173 files changed, 11592 insertions, 6949 deletions
diff --git a/ChangeLog b/ChangeLog
index bf3f089bd..b5596af5c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,183 @@
+Fri, 4 Mar 2022 14:17:37 +0100 (0e6b1f4a2)
+NAMESTORE: Warn use of low relative expiration times - Martin Schanzenbach
+Thu, 3 Mar 2022 21:34:09 +0100 (0f0ff3785)
+NAMESTORE: Do not display label for TOMBSTONE only record sets - Martin Schanzenbach
+Thu, 3 Mar 2022 21:31:15 +0100 (64598c8fe)
+GNS: Fix publishing of private records - Martin Schanzenbach
+Mon, 28 Feb 2022 02:51:04 +0000 (8d9b10826)
+Add `contrib/get_version.sh` to `EXTRA_DIST` (for allowing to launch `autoreconf -i` with the released tarball, when necessary) - madmurphy
+Sun, 27 Feb 2022 20:54:49 +0100 (fd1d4df8f)
+BUILD: Allow boostrap when offline (if gana files exist) - Martin Schanzenbach
+Sat, 26 Feb 2022 23:26:33 +0100 (82d9ca012)
+BUILD: Detect missing libsodium. Fixes #7153 - Martin Schanzenbach
+Fri, 25 Feb 2022 00:46:09 +0100 (5e4cbb92b)
+add GNUNET_B2S() macro; fix dht_line_test: we sign over query_hash, not block key - Martin Schanzenbach
+Mon, 21 Feb 2022 00:11:28 +0100 (7bc5bb42a)
+fix #7173 - Christian Grothoff
+Sun, 20 Feb 2022 21:34:39 +0100 (3bda89642)
+add salt argument to GNUNET_CRYPTO_CS_r_derive() - Christian Grothoff
+Wed, 12 Jan 2022 20:42:34 +0100 (ac77d5f43)
+add new HELLO_URI block support to block plugin - Christian Grothoff
+Wed, 12 Jan 2022 14:34:56 +0100 (3e3081cfd)
+incomplete first hack of new hello-uri lib - Christian Grothoff
+Mon, 10 Jan 2022 21:51:53 +0100 (ba9296269)
+first steps towards usable dhtu - Christian Grothoff
+Fri, 18 Feb 2022 13:02:24 +0100 (a85bfe2fe)
+DOC: Fix error - Martin Schanzenbach
+Thu, 17 Feb 2022 12:53:23 +0100 (d4dffb077)
+DOC: Fixed git links in tutorial - Martin Schanzenbach
+Tue, 15 Feb 2022 14:37:56 +0100 (f72ffa1a9)
+GNS: Allow lowercase and uppercase - Martin Schanzenbach
+Tue, 15 Feb 2022 00:13:04 +0000 (839b4da34)
+Fix incorrect information in `contrib/xdg-scheme-handler/README` - madmurphy
+Tue, 15 Feb 2022 00:07:16 +0000 (679d390e4)
+`gnunet-search`: Reduce the help page and include Alessio's suggestions - madmurphy
+Mon, 14 Feb 2022 16:00:15 +0100 (336acc330)
+GNS/NAMESTORE: Fix GNS2DNS delegations - Martin Schanzenbach
+Mon, 14 Feb 2022 15:15:03 +0100 (6866469e6)
+UTIL: Fix DNS resolution - Martin Schanzenbach
+Mon, 14 Feb 2022 12:15:54 +0100 (8f7f4944a)
+GNS: Rename CNAME test; bugfix - Martin Schanzenbach
+Sat, 12 Feb 2022 20:18:16 +0000 (e94d71fdc)
+`man gnunet-search`: better layout for `--printf` examples - madmurphy
+Sat, 12 Feb 2022 18:14:33 +0000 (8c316d9dc)
+`man gnunet-search`: add `--printf` examples, update page date - madmurphy
+Fri, 11 Feb 2022 15:20:37 +0000 (c252554c5)
+`man gnunet-search`: not just quotes - madmurphy
+Fri, 11 Feb 2022 14:59:28 +0000 (b99f65d5e)
+`man gnunet-search`: general review (cont'd) - madmurphy
+Fri, 11 Feb 2022 03:20:27 +0000 (c4bd3744a)
+`man gnunet-search`: general review - madmurphy
+Fri, 11 Feb 2022 02:52:46 +0000 (0e04edc6b)
+`man gnunet-search`: note about libextractor - madmurphy
+Fri, 11 Feb 2022 02:45:23 +0000 (d267f384a)
+`man gnunet-search`: metatype string - madmurphy
+Fri, 11 Feb 2022 01:49:29 +0000 (55307d34d)
+`man gnunet-search`: update synopsis - madmurphy
+Fri, 11 Feb 2022 01:32:58 +0000 (3ce3d040f)
+First draft of updated man page for `gnunet-search` (to be reviewed) - madmurphy
+Thu, 10 Feb 2022 22:45:00 +0000 (9294003d1)
+Add missing information to `gnunet-search`'s help page - madmurphy
+Thu, 10 Feb 2022 22:24:56 +0000 (4b887d8a8)
+New version of `gnunet-search` is ready to be tested - madmurphy
+Thu, 10 Feb 2022 22:20:32 +0000 (82e288bca)
+Use `const` for `GNUNET_FS_file_information_get_filename()`'s only argument - madmurphy
+Thu, 10 Feb 2022 22:12:48 +0000 (99dcb607e)
+Add newline before help pages' footer - madmurphy
+Mon, 7 Feb 2022 15:59:04 +0100 (14b3c75ab)
+GNS: LSD0001 improvements - Martin Schanzenbach
+Sat, 5 Feb 2022 17:17:37 +0100 (aa85ac347)
+GNS: Add tombstone string processing; also handle tombstones in monitor properly - Martin Schanzenbach
+Sat, 5 Feb 2022 00:50:38 +0100 (ee865f851)
+GNS: Implement Tombstone logic - Martin Schanzenbach
+Thu, 3 Feb 2022 22:47:03 +0100 (f3eaf5dae)
+GNS: Move VPN to DNS2GNS. Fixes #7171 - Martin Schanzenbach
+Thu, 3 Feb 2022 18:44:40 +0100 (afd2cb5db)
+GNS: Introduce REDIRECT records. Fixes #7172 - Martin Schanzenbach
+Thu, 3 Feb 2022 18:12:10 +0100 (3d72be074)
+GNS: Introduce CRITICAL flag. Fixes #7169 - Martin Schanzenbach
+Thu, 3 Feb 2022 09:25:12 +0100 (112ef3796)
+GNS: Rework GNS block wire format - Martin Schanzenbach
+Tue, 1 Feb 2022 17:52:33 +0100 (4f07822ff)
+GNS: Fix context strings in key derivation according to LSD0001 - Martin Schanzenbach
+Tue, 1 Feb 2022 15:48:52 +0100 (816bab695)
+GNS: Fix revocation wire format - Martin Schanzenbach
+Wed, 26 Jan 2022 22:41:40 +0100 (e96a8d741)
+added CS test vectors - Gian Demarmels
+Thu, 20 Jan 2022 15:21:53 +0100 (856078f62)
+DOC: Update README and handbook for dependencies - Martin Schanzenbach
+Tue, 18 Jan 2022 14:05:12 +0100 (18bf1b905)
+UTIL: Add UTF-8 NFC test - Martin Schanzenbach
+Tue, 18 Jan 2022 11:05:41 +0100 (54554ca53)
+GNS: Towards NFC - Martin Schanzenbach
+Fri, 14 Jan 2022 18:42:27 +0100 (7e43ac554)
+RECLAIM: Add DIDs - trizuz - Martin Schanzenbach
+Mon, 10 Jan 2022 10:31:59 +0100 (8f8351c2d)
+add more information to ensure signatures are fresh and request-specific - Christian Grothoff
+Sun, 9 Jan 2022 12:22:04 +0100 (ec19c1e31)
+DHT: modify API and protocol messages to add path signatures, except for now the actual signatures are just placeholders (signing and signature verification are missing) - Christian Grothoff
+Tue, 4 Jan 2022 22:18:34 +0100 (d228a5859)
+BUILD: Make GANA generation mandatory for beetstrap. Requires recutils - Martin Schanzenbach
+Tue, 4 Jan 2022 15:53:29 +0100 (a5ca7d597)
+BUILD: gnunet-signatures from gana - Martin Schanzenbach
+Tue, 4 Jan 2022 15:37:21 +0100 (7b6e0eb4f)
+BUILD: Add gana gnunet-signatures; do not yet copy - Martin Schanzenbach
+Tue, 4 Jan 2022 15:23:22 +0100 (c5f6aafd6)
+BUILD: Add gana GNS TLDs - Martin Schanzenbach
+Tue, 4 Jan 2022 13:47:07 +0100 (8fc699d2a)
+BUILD: Add gana build target for easy updates of generated headers - Martin Schanzenbach
+Sun, 2 Jan 2022 14:53:35 +0100 (329f0458f)
+clean up am_closest_peer and other functions - Christian Grothoff
+Sun, 2 Jan 2022 13:10:25 +0100 (bb686c483)
+revise DHT hashing functions, add test logic - Christian Grothoff
+Wed, 29 Dec 2021 19:12:28 +0100 (daa928456)
+implement revised block API - Christian Grothoff
+Wed, 29 Dec 2021 00:11:40 +0100 (68b028c18)
+implement new block API for FS, fix FTBFS - Christian Grothoff
+Tue, 28 Dec 2021 23:39:36 +0100 (8d8976f00)
+revise block plugin design as per discussion with Martin today (only implemented for GNS) - Christian Grothoff
+Thu, 16 Dec 2021 18:13:21 +0100 (88fb1d89e)
+IDENTITY: Expose encryption based on identities on CLI - Martin Schanzenbach
 Tue, 21 Dec 2021 15:27:27 +0100 (ff714cca7)
 changed derive_secrets API - Gian Demarmels
diff --git a/bootstrap b/bootstrap
index 766eed237..9d31d7ad7 100755
--- a/bootstrap
+++ b/bootstrap
@@ -97,9 +97,9 @@ submodules()
    if ! git --version >/dev/null; then
        echo "git not installed, skipping submodule update"
    else
-        git submodule update --init || exit 1
+        git submodule update --init && \
-        git submodule update --remote --recursive || exit 1
+        git submodule update --remote --recursive && \
-        git submodule sync || exit 1
+        git submodule sync
    fi
 }
@@ -112,17 +112,17 @@ gana_update()
      cd gnu-name-system-record-types && \
         make && \
         cp gnu_name_system_record_types.h ../../../src/include/ && \
-         make clean
+         make clean || exit 1
      cd ../gnu-name-system-default-tlds && \
         make && \
         cp tlds.conf ../../../src/gns && \
-         make clean
+         make clean || exit 1
      # Signatures
      cd ../gnunet-signatures && \
         make && \
         cp gnunet_signatures.h ../../../src/include && \
-         make clean
+         make clean || exit 1
      cd $cwd
    else
      echo "ERROR: No recutils found! Unable to generate recent GANA headers and configs."
diff --git a/configure.ac b/configure.ac
index 3ccfc9c1b..713817168 100644
--- a/configure.ac
+++ b/configure.ac
@@ -816,6 +816,7 @@ AC_CHECK_LIB([kvm], [kvm_open])
 AC_CHECK_LIB([kstat], [kstat_open])
 # check for libsodium version >= 1.0.18
+libsodium=0
 AC_CHECK_HEADER([sodium.h],
  [AC_CHECK_LIB([sodium], [crypto_core_ed25519_scalar_mul],
                [libsodium=1],
diff --git a/contrib/Makefile.am b/contrib/Makefile.am
index 4e7928c7e..e05e9caf9 100644
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -206,6 +206,7 @@ EXTRA_DIST = \
  docker/README.md \
  docker/gnunet.conf \
  benchmark/collect.awk \
+  get_version.sh \
  gnunet_infrastructure/handbook_pull.sh \
  guix.scm \
  indent_pre-commit \
diff --git a/contrib/conf/uncrustify.cfg b/contrib/conf/uncrustify.cfg
index 6ced05d7a..b02ebc4a5 100644
--- a/contrib/conf/uncrustify.cfg
+++ b/contrib/conf/uncrustify.cfg
@@ -28,7 +28,7 @@ ls_code_width=true
 pos_arith=lead
 # Fully parenthesize boolean exprs
-mod_full_paren_if_bool=true
+mod_full_paren_if_bool=false
 # Braces should be on their own line
 nl_fdef_brace=add
diff --git a/contrib/gana b/contrib/gana
-Subproject 3a71278a2aab67f9a1888af172b507d6e08364c
+Subproject 048ad729b3177a5de1726517bc905e6cd7688d0
diff --git a/contrib/xdg-scheme-handler/README.md b/contrib/xdg-scheme-handler/README.md
index 919ae37f8..07ff87bdc 100644
--- a/contrib/xdg-scheme-handler/README.md
+++ b/contrib/xdg-scheme-handler/README.md
@@ -5,4 +5,4 @@ To register the `gnunet://` URI scheme, launch the following commands from this
 directory as a privileged user:
    install -Dm644 gnunet-uri.desktop /usr/share/applications/gnunet-uri.desktop
-    update-mime-database /usr/share/applications/
+    update-mime-database /usr/share/mime
diff --git a/doc/handbook/chapters/developer.texi b/doc/handbook/chapters/developer.texi
index e3ff20dcd..5f91a646e 100644
--- a/doc/handbook/chapters/developer.texi
+++ b/doc/handbook/chapters/developer.texi
@@ -6250,7 +6250,7 @@ by NAMESTORE.
 Here a client uses the @code{GNUNET_NAMESTORE_zone_iteration_start}
 function and passes the namestore handle, the zone to iterate over and a
 callback function to call with the result.
-If the client wants to iterate over all the WHAT!? FIXME, it passes NULL for the zone.
+To iterate over all the zones, it is possible to pass NULL for the zone.
 A @code{GNUNET_NAMESTORE_ZoneIterator} handle is returned to be used to
 continue iteration.
diff --git a/doc/handbook/chapters/philosophy.texi b/doc/handbook/chapters/philosophy.texi
index 785a65e42..180589829 100644
--- a/doc/handbook/chapters/philosophy.texi
+++ b/doc/handbook/chapters/philosophy.texi
@@ -7,11 +7,12 @@
 @c of GNUnet.
 The primary goal of the GNUnet project is to provide a reliable, open,
 non-discriminating and censorship-resistant system for information
-exchange. We value free speech above state interests and intellectual
+exchange.
+We value free speech above state interests and intellectual
 monopoly. GNUnet's long-term goal is to serve as a development
 platform for the next generation of Internet protocols.
-GNUnet is an anarchistic network. Participants are encouraged to
+Participants are encouraged to
 contribute at least as much resources (storage, bandwidth) to the network
 as they consume, so that their participation does not have a negative
 impact on other users.
diff --git a/doc/handbook/chapters/user.texi b/doc/handbook/chapters/user.texi
index aa912f96f..0b44ab57c 100644
--- a/doc/handbook/chapters/user.texi
+++ b/doc/handbook/chapters/user.texi
@@ -1561,6 +1561,9 @@ The GNS currently supports the record types as defined in
 @uref{https://git.gnunet.org/gana.git/tree/gnu-name-system-record-types/registry.rec, GANA}.
 In addition, GNS supports DNS record types, such as A, AAAA or TXT.
+For a complete description of the records, please refer to the specification
+at @uref{https://lsd.gnunet.org/lsd0001, LSD0001}.
 In the following, we discuss GNS records with specific behaviour or special
 handling of DNS records.
@@ -1570,8 +1573,9 @@ handling of DNS records.
 * BOX::
 * LEHO::
 * VPN::
-* CNAME::
+* REDIRECT::
 * GNS2DNS::
+* TOMBSTONE::
 * SOA SRV PTR and MX::
 @end menu
@@ -1668,11 +1672,11 @@ having the following lines in the @file{gnunet.conf} configuration file:
 TCP_REDIRECTS = 80:localhost4:8080
 @end example
-@node CNAME
+@node REDIRECT
-@subsubsection CNAME
+@subsubsection REDIRECT
-As specified in RFC 1035 whenever a CNAME is encountered the query
+As specified in LSD0001 whenever a REDIRECT is encountered the query
-needs to be restarted with the specified name. In GNS a CNAME
+needs to be restarted with the specified name. A REDIRECT
 can either be:
 @itemize @bullet
@@ -1721,6 +1725,21 @@ However, imagine the nameserver was "ns.gnunet.org". In this case,
 delegating to "ns.gnunet.org" would mean that despite using GNS,
 censorship in the DNS ".org" zone would still be effective.
+@node TOMBSTONE
+@subsubsection TOMBSTONE
+The GNUnet GNS implementation uses the TOMBSTONE record to ensure
+ciphertext indistinguishability for published records.
+It must be ensured that when relative expiration times are decreased, the
+expiration time of the next record block MUST be after the last published block.
+A similar issue arises if the record set under a label is deleted and reused
+later.
+The creation and maintenance of the TOMBSTONE record is done automatically.
+You do not need to mind it yourself and can safely ignore any TOMBSTONE
+blocks you may see when investigating your zone(s).
+TOMBSTONE records are always private and will never be published.
 @node SOA SRV PTR and MX
 @subsubsection SOA SRV PTR and MX
diff --git a/doc/man/gnunet-search.1 b/doc/man/gnunet-search.1
index 4ec5189de..a3c6e8ece 100644
--- a/doc/man/gnunet-search.1
+++ b/doc/man/gnunet-search.1
@@ -21,7 +21,7 @@
 .\"
 .\" SPDX-License-Identifier: GPL3.0-or-later OR FDL1.3-or-later
 .\"
-.Dd February 25, 2012
+.Dd February 12, 2022
 .Dt GNUNET-SEARCH 1
 .Os
 .Sh NAME
@@ -30,13 +30,18 @@
 .Sh SYNOPSIS
 .Nm
 .Op Fl a Ar LEVEL | Fl -anonymity= Ns Ar LEVEL
+.Op Fl b | -bookmark-only
 .Op Fl c Ar FILENAME | Fl -config= Ns Ar FILENAME
+.Op Fl F Ar FORMAT | Fl -dir-printf= Ns Ar FORMAT
+.Op Fl f Ar FORMAT | Fl -printf= Ns Ar FORMAT
 .Op Fl h | -help
+.Op Fl i Ar FORMAT | Fl -iter-printf= Ns Ar FORMAT
 .Op Fl L Ar LOGLEVEL | Fl -loglevel= Ns Ar LOGLEVEL
 .Op Fl l Ar FILENAME | Fl -logfile= Ns Ar FILENAME
 .Op Fl o Ar FILENAME | Fl -output= Ns Ar FILENAME
 .Op Fl n | -no-network
 .Op Fl N Ar VALUE | Fl -results= Ns Ar VALUE
+.Op Fl s | -silent
 .Op Fl t Ar DELAY | Fl -timeout= Ns Ar DELAY
 .Op Fl v | -version
 .Op Fl V | -verbose
@@ -63,40 +68,207 @@ The specific numeric value (for anonymity levels above 1) is simple:
 Given an anonymity level L (above 1), each request FS makes on your behalf must be hidden in L-1 equivalent requests of cover traffic (traffic your peer routes for others) in the same time-period.
 The time-period is twice the average delay by which GNUnet artificially delays traffic.
 Note that regardless of the anonymity level you choose, peers that cache content in the network always use anonymity level 1.
+.It Fl b | -bookmark-only
+Do not search, print only the URI that points to the search with the given keywords.
 .It Fl c Ar FILENAME | Fl -config= Ns Ar FILENAME
 Use the configuration file
 .Ar FILENAME
 (default:
-.Pa ~/.config/gnunet.conf )
+.Pa ~/.config/gnunet.conf Ns
+).
+.It Fl F Ar FORMAT | Fl -dir-printf= Ns Ar FORMAT
+Write the search results for directories according to
+.Ar FORMAT Ns
+\&. The directives supported here are identical to those supported in the
+.Fl -printf
+argument (please refer to it for more information). If missing,
+.Fl -dir-printf
+defaults to
+.Fl -printf Ns
+\&. If
+.Fl -printf
+is missing too
+.Fl -dir-printf
+defaults to
+.Ql #%n:\engnunet-download -o "%f" -R %u\en\en Ns
+\&.
+.It Fl f Ar FORMAT | Fl -printf= Ns Ar FORMAT
+Write the search results according to
+.Ar FORMAT Ns
+, in which
+.Ql \e
+and
+.Ql %
+directives are interpreted as follows:
+.Bl -tag -width indent
+.It Li \e\e
+a literal backslash
+.No ( Ql \e Ns )
+.It Li \ea
+an alarm bell
+.It Li \eb
+a backspace
+.It Li \ee
+an escape
+.It Li \ef
+a form feed
+.It Li \en
+a newline
+.It Li \er
+a carriage return
+.It Li \et
+a horizontal tab
+.It Li \ev
+a vertical tab
+.It Li \e0
+an ASCII NUL.
+.It Li \eN...
+the character whose ASCII code is N..., expressed in octal digits
+.It Li \exX...
+the character whose ASCII code is X..., expressed in hexadecimal digits
+.Pp
+.El
+.Sy Note:
+The
+.Ql \e
+character followed by any other character not listed above is treated as an ordinary character, so both characters are printed.
+.Bl -tag -width indent
+.It Li %%
+a percent sign
+.It Li %a
+the complete list of all the printable metadata properties available, displayed according to the
+.Fl -iter-printf
+argument; this specifier optionally supports metatype filtering via hash sign
+.No (e.g.
+.Ql %2#a
+prints all embedded file names, if present - see libextractor's metatypes for the complete list of numerical identifiers)
+.It Li %f
+the file's name
+.It Li %j
+the first printable metadata property available, displayed according to the
+.Fl -iter-printf
+argument; this specifier optionally supports metatype filtering via hash sign
+.No (e.g.
+.Ql %5#j
+prints a book title, if present); see libextractor's metatypes for the complete list of numerical identifiers)
+.It Li %l
+the file name's length
+.It Li %m
+the file's mime type
+.It Li %n
+the search result number
+.It Li %s
+the file's size in bytes
+.It Li %u
+the file's URI
+.El
+.Pp
+.Sy Note:
+The
+.Ql %
+character followed by any other character not listed above is treated as an ordinary character, so both characters are printed.
+.Pp
+If missing,
+.Fl -printf
+defaults to
+.Ql #%n:\engnunet-download -o "%f" %u\en\en Ns
+\&.
 .It Fl h | -help
 Print the help page.
+.It Fl i Ar FORMAT | Fl -iter-printf= Ns Ar FORMAT
+When the
+.Ql %a
+or
+.Ql %j
+format specifiers appear in
+.Fl -printf
+or
+.Fl -dir-printf Ns
+, list each metadata property according to
+.Ar FORMAT Ns
+, in which the
+.Ql \e
+directives are interpreted as in
+.Fl -printf
+and
+.Fl -dir-printf Ns
+, while the
+.Ql %
+directives are interpreted as follows:
+.Bl -tag -width indent
+.It Li %%
+a percent sign
+.It Li %p
+the property's content
+.It Li %l
+the property content's length in bytes
+.It Li %i
+the property type's unique identifier
+.It Li %n
+the property number
+.It Li %t
+the property type (available only if compiled with libextractor)
+.It Li %w
+the name of the plugin that provided the information
+.El
+.Pp
+.Sy Note:
+The
+.Ql %
+character followed by any other character not listed above is treated as an ordinary character, so both characters are printed.
+.Pp
+If missing,
+.Fl -iter-printf
+defaults to
+.Ql \& \& %t: %p\en
+or
+.Ql \& \& MetaType #%i: %p\en Ns
+, depending on whether the program was compiled with libextractor or not.
 .It Fl L Ar LOGLEVEL | Fl -loglevel= Ns Ar LOGLEVEL
 Change the loglevel.
-Possible values for LOGLEVEL are ERROR, WARNING, INFO and DEBUG.
+Possible values for
+.Ar LOGLEVEL
+are ERROR, WARNING, INFO and DEBUG.
 .It Fl l Ar FILENAME | Fl -logfile= Ns Ar FILENAME
 Write logs to
 .Ar FILENAME .
 .It Fl o Ar FILENAME | Fl -output= Ns Ar FILENAME
 Writes a GNUnet directory containing all of the search results to
-.Ar FILENAME .
+.Ar FILENAME
+.No (e.g.
+.Ql gnunet-search --output=commons.gnd commons Ns
+).
 .It Fl n | -no-network
 Only search locally, do not forward requests to other peers.
 .It Fl N Ar VALUE | Fl -results= Ns Ar VALUE
 Automatically terminate the search after receiving
 .Ar VALUE
 results.
+.It Fl s | -silent
+Enable silent mode and do not print any result (the
+.Fl -output
+argument is required).
 .It Fl t Ar DELAY | Fl -timeout= Ns Ar DELAY
 Automatically timeout search after
 .Ar DELAY .
 The value given must be a number followed by a space and a time unit, for example "500 ms".
-Note that the quotes are required on the shell.
+Note that the quotes are required on the shell. Without a unit it defaults to microseconds (1000000 = 1 second).
-Otherwise the search runs until gnunet-search is aborted with CTRL-C.
+If 0 or omitted the search runs until gnunet-search is aborted with CTRL-C.
 .It Fl v | -version
 print the version number
 .It Fl V | -verbose
-print meta data from search results as well
+append
+.Ql %a\en
+to the default
+.Fl -printf
+and
+.Fl -dir-printf
+arguments \[u2013] ignored when these are provided by the user
 .El
-You can run gnunet-search with an URI instead of a keyword.
+.Pp
+It is possible to run
+.Nm gnunet-search
+with an URI instead of a keyword.
 The URI can have the format for a namespace search or for a keyword search.
 For a namespace search, the format is
 .Pp
@@ -108,46 +280,137 @@ For a keyword search, use
 .Pp
 If the format does not correspond to a GNUnet URI, GNUnet will automatically assume that keywords are supplied directly.
 .sp
-If multiple keywords are passed, gnunet-search will look for content matching any of the keywords.
+If multiple keywords are passed,
-The prefix "+" makes a keyword mandatory.
+.Nm gnunet-search
+will look for content matching any of the keywords.
+The
+.Ql +
+prefix makes a keyword mandatory.
 .Sh FILES
 .Pa ~/.config/gnunet.conf
 GNUnet configuration file; specifies the default value for the timeout
 .Sh EXAMPLES
-.Dl $ gnunet-search "Das Kapital"
+Example 1:
+.Pp
+.Dl $ gnunet-search 'Das Kapital'
 .Pp
-Searches for content matching the keyword "Das Kapital".
+searches for content matching the keyword
+.Dq Das Kapital Ns
+.
+.Pp
+Example 2:
+.Pp
+.Dl $ gnunet-search Das Kapital
+.Pp
+searches for content matching either keyword
+.Dq Das
+or keyword
+.Dq Kapital Ns
+.
+.Pp
+Example 3:
 .Pp
 .Dl $ gnunet-search +Das +Kapital
 .Pp
-Searches for content matching both mandatory keywords "Das" and "Kapital".
+searches for content matching both mandatory keywords
+.Dq Das
+and
+.Dq Kapital Ns
+.
 .sp
-Search results are printed by gnunet-search like this:
+Search results are printed by
+.Nm gnunet-search
+like this:
 .Pp
 .ad l
        gnunet-download -o "COPYING" gnunet://fs/chk/HASH1.HASH2.SIZE
-                Description: The GNU General Public License
+.Pp
-                Mime-type: text/plain
+          Description: The GNU General Public License
+          Mime-type: text/plain
+          ...
 .ad b
+.Pp
 The first line contains the command to run to download the file.
-The suggested filename in the example is COPYING.
+The suggested filename in the example is
-The GNUnet URI consists of the key and query hash of the file and finally the size of the file.
+.Ql COPYING Ns
-After the command to download the file, GNUnet will print meta-data about the file as advertised in the search result.
+\&. The GNUnet URI consists of the key and query hash of the file and finally the size of the file.
-The meta-data here is the description ("The GNU General Public License") and the mime-type ("text-plain").
+If the
+.Fl -verbose
+option was provided, after the command to download the file, GNUnet will print metadata about the file as advertised in the search result.
+The metadata here is the description
+.No ( Ns
+.Dq The GNU General Public License Ns
+) and the mime-type
+.No ( Ns
+.Dq text-plain Ns
+).
 See the options for
 .Xr gnunet-publish 1
-on how to supply meta-data by hand.
+on how to supply metadata by hand.
+.Pp
+The
+.Fl -printf
+.No ( Ns
+.Fl f Ns
+),
+.Fl -dir-printf
+.No ( Ns
+.Fl F Ns
+) and
+.Fl -iter-printf
+.No ( Ns
+.Fl i Ns
+) arguments offer powerful tools for manipulating the output printed. For instance,
+.Pp
+Example 4:
+.Pp
+.ad l
+        $ gnunet-search -f '%f (%s bytes)\en' commons
+.Pp
+will print a simple list of the results that match the
+.Dq commons
+keyword, with only the file name and the size printed, without any URI. Or, for instance,
+.Pp
+Example 5:
+.Pp
+.ad l
+        #!/bin/sh
+        {
+          printf '<list>'
+          gnunet-search -f '
+          <file uri="%u">
+            <filename len="%l">%f</filename>
+            <size>%s</size>
+            <mimetype>%m</mimetype>
+            <result_id>%n</result_id>
+            <metadata>%a
+            </metadata>
+          </file>' \e
+            -i '
+              <property tid="%i" type="%t">
+                <content len="%l">%p</content>
+                <property_id>%n</property_id>
+                <provided_by>%w</provided_by>
+              </property>' \e
+            -t '2 s' commons
+          printf '\en</list>\en'
+        } > commons.xml
+.Pp
+will run for two seconds and then create a file named
+.Pa commons.xml Ns
+, containing the search results that match the
+.Dq commons
+keyword in XML format.
 .Sh SEE ALSO
 .Xr gnunet-download 1 ,
 .Xr gnunet-fs-gtk 1 ,
 .Xr gnunet-publish 1 ,
 .Xr gnunet.conf 5
 .sp
-The full documentation for gnunet is maintained as a Texinfo manual.
+The full documentation for GNUnet is maintained as a Texinfo manual.
 If the
 .Xr info 1
-and gnunet programs are properly installed at your site, the command
+and gnunet packages are properly installed at your site, the command
 .Pp
 .Dl info gnunet
 .Pp
diff --git a/doc/tutorial/tutorial.texi b/doc/tutorial/tutorial.texi
index 0a011c0c8..f849e116a 100644
--- a/doc/tutorial/tutorial.texi
+++ b/doc/tutorial/tutorial.texi
@@ -225,7 +225,7 @@ This is required for obtaining the repository, which is achieved with
 the following command:
 @example
-$ git clone https://git.gnunet.org/gnunet
+$ git clone https://git.gnunet.org/gnunet.git
 @end example
 @noindent
@@ -795,7 +795,7 @@ a template build system for writing GNUnet extensions in C. It can be
 obtained as follows:
 @example
-$ git clone https://git.gnunet.org/gnunet-ext
+$ git clone https://git.gnunet.org/gnunet-ext.git
 $ cd gnunet-ext/
 $ ./bootstrap
 $ ./configure --prefix=$PREFIX --with-gnunet=$PREFIX
diff --git a/po/POTFILES.in b/po/POTFILES.in
index ad5c68056..64df0a13b 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -10,14 +10,13 @@ src/arm/arm_monitor_api.c
 src/arm/gnunet-arm.c
 src/arm/gnunet-service-arm.c
 src/arm/mockup-service.c
-src/ats-tool/gnunet-ats.c
 src/ats/ats_api_connectivity.c
 src/ats/ats_api_performance.c
 src/ats/ats_api_scanner.c
 src/ats/ats_api_scheduling.c
 src/ats/gnunet-ats-solver-eval.c
-src/ats/gnunet-service-ats.c
 src/ats/gnunet-service-ats_addresses.c
+src/ats/gnunet-service-ats.c
 src/ats/gnunet-service-ats_connectivity.c
 src/ats/gnunet-service-ats_normalization.c
 src/ats/gnunet-service-ats_performance.c
@@ -26,6 +25,7 @@ src/ats/gnunet-service-ats_preferences.c
 src/ats/gnunet-service-ats_reservations.c
 src/ats/gnunet-service-ats_scheduling.c
 src/ats/plugin_ats_proportional.c
+src/ats-tool/gnunet-ats.c
 src/auction/gnunet-auction-create.c
 src/auction/gnunet-auction-info.c
 src/auction/gnunet-auction-join.c
@@ -43,8 +43,8 @@ src/cadet/cadet_api_list_peers.c
 src/cadet/cadet_api_list_tunnels.c
 src/cadet/cadet_test_lib.c
 src/cadet/desirability_table.c
-src/cadet/gnunet-cadet-profiler.c
 src/cadet/gnunet-cadet.c
+src/cadet/gnunet-cadet-profiler.c
 src/cadet/gnunet-service-cadet.c
 src/cadet/gnunet-service-cadet_channel.c
 src/cadet/gnunet-service-cadet_connection.c
@@ -60,15 +60,15 @@ src/consensus/gnunet-service-consensus.c
 src/consensus/plugin_block_consensus.c
 src/conversation/conversation_api.c
 src/conversation/conversation_api_call.c
-src/conversation/gnunet-conversation-test.c
 src/conversation/gnunet-conversation.c
-src/conversation/gnunet-helper-audio-playback-gst.c
+src/conversation/gnunet-conversation-test.c
+src/conversation/gnunet_gst.c
+src/conversation/gnunet_gst_test.c
 src/conversation/gnunet-helper-audio-playback.c
-src/conversation/gnunet-helper-audio-record-gst.c
+src/conversation/gnunet-helper-audio-playback-gst.c
 src/conversation/gnunet-helper-audio-record.c
+src/conversation/gnunet-helper-audio-record-gst.c
 src/conversation/gnunet-service-conversation.c
-src/conversation/gnunet_gst.c
-src/conversation/gnunet_gst_test.c
 src/conversation/microphone.c
 src/conversation/plugin_gnsrecord_conversation.c
 src/conversation/speaker.c
@@ -97,16 +97,15 @@ src/datastore/plugin_datastore_template.c
 src/dht/dht_api.c
 src/dht/dht_test_lib.c
 src/dht/gnunet-dht-get.c
+src/dht/gnunet-dht-hello.c
 src/dht/gnunet-dht-monitor.c
+src/dht/gnunet_dht_profiler.c
 src/dht/gnunet-dht-put.c
 src/dht/gnunet-service-dht.c
 src/dht/gnunet-service-dht_clients.c
 src/dht/gnunet-service-dht_datacache.c
-src/dht/gnunet-service-dht_hello.c
 src/dht/gnunet-service-dht_neighbours.c
-src/dht/gnunet-service-dht_nse.c
 src/dht/gnunet-service-dht_routing.c
-src/dht/gnunet_dht_profiler.c
 src/dht/plugin_block_dht.c
 src/dhtu/plugin_dhtu_gnunet.c
 src/dhtu/plugin_dhtu_ip.c
@@ -144,8 +143,8 @@ src/fs/gnunet-auto-share.c
 src/fs/gnunet-daemon-fsprofiler.c
 src/fs/gnunet-directory.c
 src/fs/gnunet-download.c
-src/fs/gnunet-fs-profiler.c
 src/fs/gnunet-fs.c
+src/fs/gnunet-fs-profiler.c
 src/fs/gnunet-helper-fs-publish.c
 src/fs/gnunet-publish.c
 src/fs/gnunet-search.c
@@ -165,9 +164,9 @@ src/gns/gns_tld_api.c
 src/gns/gnunet-bcd.c
 src/gns/gnunet-dns2gns.c
 src/gns/gnunet-gns-benchmark.c
+src/gns/gnunet-gns.c
 src/gns/gnunet-gns-import.c
 src/gns/gnunet-gns-proxy.c
-src/gns/gnunet-gns.c
 src/gns/gnunet-service-gns.c
 src/gns/gnunet-service-gns_interceptor.c
 src/gns/gnunet-service-gns_resolver.c
@@ -183,11 +182,11 @@ src/gnsrecord/gnsrecord_serialization.c
 src/gnsrecord/gnunet-gnsrecord-tvg.c
 src/gnsrecord/json_gnsrecord.c
 src/gnsrecord/plugin_gnsrecord_dns.c
-src/gnsrecord/test.c
 src/hello/address.c
 src/hello/gnunet-hello.c
-src/hello/hello-ng.c
 src/hello/hello.c
+src/hello/hello-ng.c
+src/hello/hello-uri.c
 src/hostlist/gnunet-daemon-hostlist.c
 src/hostlist/gnunet-daemon-hostlist_client.c
 src/hostlist/gnunet-daemon-hostlist_server.c
@@ -203,8 +202,8 @@ src/json/json_helper.c
 src/json/json_mhd.c
 src/json/json_pack.c
 src/messenger/gnunet-messenger.c
-src/messenger/gnunet-service-messenger.c
 src/messenger/gnunet-service-messenger_basement.c
+src/messenger/gnunet-service-messenger.c
 src/messenger/gnunet-service-messenger_ego_store.c
 src/messenger/gnunet-service-messenger_handle.c
 src/messenger/gnunet-service-messenger_list_handles.c
@@ -244,8 +243,8 @@ src/namecache/namecache_api.c
 src/namecache/plugin_namecache_flat.c
 src/namecache/plugin_namecache_postgres.c
 src/namecache/plugin_namecache_sqlite.c
-src/namestore/gnunet-namestore-fcfsd.c
 src/namestore/gnunet-namestore.c
+src/namestore/gnunet-namestore-fcfsd.c
 src/namestore/gnunet-service-namestore.c
 src/namestore/gnunet-zoneimport.c
 src/namestore/namestore_api.c
@@ -271,17 +270,17 @@ src/nat/gnunet-service-nat_mini.c
 src/nat/gnunet-service-nat_stun.c
 src/nat/nat_api.c
 src/nat/nat_api_stun.c
-src/nse/gnunet-nse-profiler.c
 src/nse/gnunet-nse.c
+src/nse/gnunet-nse-profiler.c
 src/nse/gnunet-service-nse.c
 src/nse/nse_api.c
 src/nt/nt.c
-src/peerinfo-tool/gnunet-peerinfo.c
-src/peerinfo-tool/gnunet-peerinfo_plugins.c
-src/peerinfo-tool/plugin_rest_peerinfo.c
 src/peerinfo/gnunet-service-peerinfo.c
 src/peerinfo/peerinfo_api.c
 src/peerinfo/peerinfo_api_notify.c
+src/peerinfo-tool/gnunet-peerinfo.c
+src/peerinfo-tool/gnunet-peerinfo_plugins.c
+src/peerinfo-tool/plugin_rest_peerinfo.c
 src/peerstore/gnunet-peerstore.c
 src/peerstore/gnunet-service-peerstore.c
 src/peerstore/peerstore_api.c
@@ -315,7 +314,6 @@ src/reclaim/plugin_rest_reclaim.c
 src/reclaim/reclaim_api.c
 src/reclaim/reclaim_attribute.c
 src/reclaim/reclaim_credential.c
-src/reclaim/test.c
 src/regex/gnunet-daemon-regexprofiler.c
 src/regex/gnunet-regex-profiler.c
 src/regex/gnunet-regex-simulation-profiler.c
@@ -334,27 +332,27 @@ src/rest/gnunet-rest-server.c
 src/rest/plugin_rest_config.c
 src/rest/plugin_rest_copying.c
 src/rest/rest.c
-src/revocation/gnunet-revocation-tvg.c
 src/revocation/gnunet-revocation.c
+src/revocation/gnunet-revocation-tvg.c
 src/revocation/gnunet-service-revocation.c
 src/revocation/plugin_block_revocation.c
 src/revocation/revocation_api.c
-src/rps/gnunet-rps-profiler.c
 src/rps/gnunet-rps.c
+src/rps/gnunet-rps-profiler.c
 src/rps/gnunet-service-rps.c
 src/rps/gnunet-service-rps_custommap.c
 src/rps/gnunet-service-rps_sampler.c
 src/rps/gnunet-service-rps_sampler_elem.c
 src/rps/gnunet-service-rps_view.c
+src/rps/rps_api.c
 src/rps/rps-sampler_client.c
 src/rps/rps-sampler_common.c
 src/rps/rps-test_util.c
-src/rps/rps_api.c
 src/scalarproduct/gnunet-scalarproduct.c
-src/scalarproduct/gnunet-service-scalarproduct-ecc_alice.c
-src/scalarproduct/gnunet-service-scalarproduct-ecc_bob.c
 src/scalarproduct/gnunet-service-scalarproduct_alice.c
 src/scalarproduct/gnunet-service-scalarproduct_bob.c
+src/scalarproduct/gnunet-service-scalarproduct-ecc_alice.c
+src/scalarproduct/gnunet-service-scalarproduct-ecc_bob.c
 src/scalarproduct/scalarproduct_api.c
 src/secretsharing/gnunet-secretsharing-profiler.c
 src/secretsharing/gnunet-service-secretsharing.c
@@ -368,12 +366,12 @@ src/set/gnunet-set-ibf-profiler.c
 src/set/gnunet-set-profiler.c
 src/set/ibf.c
 src/set/ibf_sim.c
-src/set/plugin_block_set_test.c
-src/set/set_api.c
 src/seti/gnunet-service-seti.c
 src/seti/gnunet-seti-profiler.c
 src/seti/plugin_block_seti_test.c
 src/seti/seti_api.c
+src/set/plugin_block_set_test.c
+src/set/set_api.c
 src/setu/gnunet-service-setu.c
 src/setu/gnunet-service-setu_strata_estimator.c
 src/setu/gnunet-setu-ibf-profiler.c
@@ -392,16 +390,15 @@ src/statistics/gnunet-statistics.c
 src/statistics/statistics_api.c
 src/template/gnunet-service-template.c
 src/template/gnunet-template.c
-src/testbed-logger/gnunet-service-testbed-logger.c
-src/testbed-logger/testbed_logger_api.c
 src/testbed/generate-underlay-topology.c
 src/testbed/gnunet-daemon-latency-logger.c
 src/testbed/gnunet-daemon-testbed-blacklist.c
 src/testbed/gnunet-daemon-testbed-underlay.c
 src/testbed/gnunet-helper-testbed.c
+src/testbed/gnunet_mpi_test.c
 src/testbed/gnunet-service-test-barriers.c
-src/testbed/gnunet-service-testbed.c
 src/testbed/gnunet-service-testbed_barriers.c
+src/testbed/gnunet-service-testbed.c
 src/testbed/gnunet-service-testbed_cache.c
 src/testbed/gnunet-service-testbed_connectionpool.c
 src/testbed/gnunet-service-testbed_cpustatus.c
@@ -410,23 +407,23 @@ src/testbed/gnunet-service-testbed_meminfo.c
 src/testbed/gnunet-service-testbed_oc.c
 src/testbed/gnunet-service-testbed_peers.c
 src/testbed/gnunet-testbed-profiler.c
-src/testbed/gnunet_mpi_test.c
+src/testbed-logger/gnunet-service-testbed-logger.c
-src/testbed/testbed_api.c
+src/testbed-logger/testbed_logger_api.c
 src/testbed/testbed_api_barriers.c
+src/testbed/testbed_api.c
 src/testbed/testbed_api_hosts.c
 src/testbed/testbed_api_operations.c
 src/testbed/testbed_api_peers.c
 src/testbed/testbed_api_sd.c
 src/testbed/testbed_api_services.c
 src/testbed/testbed_api_statistics.c
-src/testbed/testbed_api_test.c
 src/testbed/testbed_api_testbed.c
+src/testbed/testbed_api_test.c
 src/testbed/testbed_api_topology.c
 src/testbed/testbed_api_underlay.c
 src/testing/gnunet-cmds-helper.c
 src/testing/gnunet-testing.c
 src/testing/list-keys.c
-src/testing/testing.c
 src/testing/testing_api_cmd_batch.c
 src/testing/testing_api_cmd_block_until_external_trigger.c
 src/testing/testing_api_cmd_end.c
@@ -442,51 +439,41 @@ src/testing/testing_api_cmd_system_create.c
 src/testing/testing_api_cmd_system_destroy.c
 src/testing/testing_api_loop.c
 src/testing/testing_api_traits.c
+src/testing/testing.c
 src/topology/friends.c
 src/topology/gnunet-daemon-topology.c
 src/transport/gnunet-communicator-tcp.c
 src/transport/gnunet-communicator-udp.c
 src/transport/gnunet-communicator-unix.c
 src/transport/gnunet-helper-transport-bluetooth.c
-src/transport/gnunet-helper-transport-wlan-dummy.c
 src/transport/gnunet-helper-transport-wlan.c
+src/transport/gnunet-helper-transport-wlan-dummy.c
 src/transport/gnunet-service-tng.c
-src/transport/gnunet-service-transport.c
 src/transport/gnunet-service-transport_ats.c
+src/transport/gnunet-service-transport.c
 src/transport/gnunet-service-transport_hello.c
 src/transport/gnunet-service-transport_manipulation.c
 src/transport/gnunet-service-transport_neighbours.c
 src/transport/gnunet-service-transport_plugins.c
 src/transport/gnunet-service-transport_validation.c
+src/transport/gnunet-transport.c
 src/transport/gnunet-transport-profiler.c
 src/transport/gnunet-transport-wlan-receiver.c
 src/transport/gnunet-transport-wlan-sender.c
-src/transport/gnunet-transport.c
 src/transport/plugin_transport_http_client.c
 src/transport/plugin_transport_http_common.c
 src/transport/plugin_transport_http_server.c
 src/transport/plugin_transport_smtp.c
 src/transport/plugin_transport_tcp.c
 src/transport/plugin_transport_template.c
-src/transport/plugin_transport_udp.c
 src/transport/plugin_transport_udp_broadcasting.c
+src/transport/plugin_transport_udp.c
 src/transport/plugin_transport_unix.c
 src/transport/plugin_transport_wlan.c
 src/transport/tcp_connection_legacy.c
 src/transport/tcp_server_legacy.c
 src/transport/tcp_server_mst_legacy.c
 src/transport/tcp_service_legacy.c
-src/transport/transport-testing-communicator.c
-src/transport/transport-testing-filenames.c
-src/transport/transport-testing-filenames2.c
-src/transport/transport-testing-loggers.c
-src/transport/transport-testing-loggers2.c
-src/transport/transport-testing-main.c
-src/transport/transport-testing-main2.c
-src/transport/transport-testing-send.c
-src/transport/transport-testing-send2.c
-src/transport/transport-testing.c
-src/transport/transport-testing2.c
 src/transport/transport_api2_application.c
 src/transport/transport_api2_communication.c
 src/transport/transport_api2_core.c
@@ -505,6 +492,17 @@ src/transport/transport_api_monitor_peers.c
 src/transport/transport_api_monitor_plugins.c
 src/transport/transport_api_offer_hello.c
 src/transport/transport_api_traits.c
+src/transport/transport-testing2.c
+src/transport/transport-testing.c
+src/transport/transport-testing-communicator.c
+src/transport/transport-testing-filenames2.c
+src/transport/transport-testing-filenames.c
+src/transport/transport-testing-loggers2.c
+src/transport/transport-testing-loggers.c
+src/transport/transport-testing-main2.c
+src/transport/transport-testing-main.c
+src/transport/transport-testing-send2.c
+src/transport/transport-testing-send.c
 src/util/bandwidth.c
 src/util/benchmark.c
 src/util/bio.c
@@ -520,8 +518,8 @@ src/util/consttime_memcmp.c
 src/util/container_bloomfilter.c
 src/util/container_heap.c
 src/util/container_meta_data.c
-src/util/container_multihashmap.c
 src/util/container_multihashmap32.c
+src/util/container_multihashmap.c
 src/util/container_multipeermap.c
 src/util/container_multishortmap.c
 src/util/container_multiuuidmap.c
@@ -548,8 +546,8 @@ src/util/dnsstub.c
 src/util/getopt.c
 src/util/getopt_helpers.c
 src/util/gnunet-base32.c
-src/util/gnunet-config-diff.c
 src/util/gnunet-config.c
+src/util/gnunet-config-diff.c
 src/util/gnunet-crypto-tvg.c
 src/util/gnunet-ecc.c
 src/util/gnunet-qr.c
@@ -587,8 +585,8 @@ src/vpn/gnunet-helper-vpn.c
 src/vpn/gnunet-service-vpn.c
 src/vpn/gnunet-vpn.c
 src/vpn/vpn_api.c
-src/zonemaster/gnunet-service-zonemaster-monitor.c
 src/zonemaster/gnunet-service-zonemaster.c
+src/zonemaster/gnunet-service-zonemaster-monitor.c
 src/fs/fs_api.h
 src/include/gnunet_json_lib.h
 src/testbed/testbed_api.h
diff --git a/po/de.po b/po/de.po
index 678ba739f..a30b16bc2 100644
--- a/po/de.po
+++ b/po/de.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet 0.10.1\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2015-03-08 16:16+0100\n"
 "Last-Translator: Mario Blättermann <mario.blaettermann@gmail.com>\n"
 "Language-Team: German <translation-team-de@lists.sourceforge.net>\n"
@@ -21,7 +21,7 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
 "X-Generator: Poedit 1.7.4\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, fuzzy, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr "`%s': unbekannter Dienst: %s\n"
@@ -33,7 +33,7 @@ msgstr ""
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, fuzzy, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "Es konnte keine Verbindung mit gnunetd hergestellt werden.\n"
@@ -621,44 +621,44 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr "Informationen über andere GNUnet Knoten ausgeben."
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 msgid "print logging"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1540,39 +1540,7 @@ msgstr "# Bytes empfangen über TCP"
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr "# gespeicherte Bytes"
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr "# gespeicherte Objekte"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, fuzzy, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr "Fehler beim Aktualisieren der Daten des Moduls `%s'\n"
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr "# Anfragen empfangen"
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr ""
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# Klartext PONG Nachrichten empfangen"
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr ""
@@ -1594,7 +1562,7 @@ msgstr ""
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "»%s« schlug bei %s:%d mit dem Fehler %s fehl\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1783,6 +1751,10 @@ msgstr ""
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr "# gespeicherte Bytes"
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -1970,7 +1942,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr "Sqlite-Datenbank läuft\n"
@@ -1978,55 +1950,65 @@ msgstr "Sqlite-Datenbank läuft\n"
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
 "%.*s\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
+#: src/dht/gnunet-dht-monitor.c:255
+#, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "Verbindung zum DHT-Dienst ist fehlgeschlagen!\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2066,10 +2048,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2125,17 +2103,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr ""
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, fuzzy, c-format
 msgid "Block not of type %u\n"
 msgstr "Kein Transport des Typs %d bekannt.\n"
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2872,20 +2850,20 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Ungültiges Argument »%s«\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr ""
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr "Keine Schlüsselwörter angegeben!\n"
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr ""
@@ -3012,7 +2990,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr "Dateien aus dem GNUnet herunterladen."
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr ""
@@ -3036,12 +3014,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, fuzzy, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "`%s' Dienst konnte nicht initialisiert werden.\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr "Den Grad LEVEL der gewünschten Empfänger-Anonymität setzen"
@@ -3049,7 +3027,7 @@ msgstr "Den Grad LEVEL der gewünschten Empfänger-Anonymität setzen"
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr ""
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3307,39 +3285,112 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, fuzzy, c-format
 msgid "Error searching: %s.\n"
 msgstr "Fehler beim Verlassen der DHT.\n"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "`%s' Dienst konnte nicht initialisiert werden.\n"
+#: src/fs/gnunet-search.c:668
 #, fuzzy
 msgid "Could not start searching.\n"
 msgstr "Fehler beim Starten der Collection.\n"
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+#, fuzzy
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr "Den Grad LEVEL der gewünschten Empfänger-Anonymität setzen"
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:707
-msgid "automatically terminate search after DELAY"
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
+msgstr ""
+#: src/fs/gnunet-search.c:725
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
+msgstr ""
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+msgid "Search for files that have been published on GNUnet\n"
 msgstr ""
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3691,67 +3742,72 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Ungültige Parameter. Abbruch.\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Zustellung der Nachricht `%s' fehlgeschlagen.\n"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 #, fuzzy
 msgid "Failed to start HTTP server\n"
 msgstr "Fehler beim Senden einer `%s' Anfrage an den SMTP Server.\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Zustellung der Nachricht `%s' fehlgeschlagen.\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, fuzzy, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr "Beschädigte Antwort auf `%s' von Knoten `%s' empfangen.\n"
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, fuzzy, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr "Unbekannte Anfrageart %d empfangen bei %s:%d\n"
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 #, fuzzy
 msgid "No DNS server specified!\n"
 msgstr "Keine Schlüsselwörter angegeben!\n"
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -3933,19 +3989,19 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "GNUnet Netzwerk Topologie tracen."
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "# Bytes empfangen über TCP"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 #, fuzzy
 msgid "Failed to connect to the namecache!\n"
 msgstr "Es konnte keine Verbindung mit gnunetd hergestellt werden.\n"
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 #, fuzzy
 msgid "Could not connect to DHT!\n"
 msgstr "Verbindung zu gnunetd konnte nicht hergestellt werden.\n"
@@ -3960,95 +4016,98 @@ msgstr "Fehler beim Konvertieren von Parametern in URI!\n"
 msgid "Failed to connect to the DNS service!\n"
 msgstr "Es konnte keine Verbindung mit gnunetd hergestellt werden.\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, fuzzy, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr "Kommando `%s' wurde nicht gefunden!\n"
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 #, fuzzy
 msgid "Failed to parse DNS response\n"
 msgstr "Zustellung der Nachricht `%s' fehlgeschlagen.\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "Dienst `%s' konnte nicht ordentlich entladen werden!\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, fuzzy, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "Es konnte keine Verbindung mit gnunetd hergestellt werden.\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "Dateiformat fehlerhaft (kein GNUnet Verzeichnis?)\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, fuzzy, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "Dateiformat fehlerhaft (kein GNUnet Verzeichnis?)\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr "Fehler beim Lesen der Freunde-Liste von `%s'\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, fuzzy, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "Fehler beim Speichern der Konfigurationsdatei `%s':"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "Fehler beim Speichern der Konfigurationsdatei `%s':"
@@ -4058,6 +4117,34 @@ msgstr "Fehler beim Speichern der Konfigurationsdatei `%s':"
 msgid "Gns REST API initialized\n"
 msgstr " Verbindung fehlgeschlagen\n"
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4303,7 +4390,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4364,21 +4451,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4570,49 +4657,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, fuzzy, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr "Fehler beim Aktualisieren der Daten des Moduls `%s'\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, fuzzy, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "Fehler beim Parsen der Gerätedaten von `%s' bei %s:%d.\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, fuzzy, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr "Fehler beim Speichern der Konfigurationsdatei `%s':"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, fuzzy, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "Dateiformat fehlerhaft (kein GNUnet Verzeichnis?)\n"
@@ -4652,7 +4739,7 @@ msgstr "`%s' konnte nicht aufgelöst werden: %s\n"
 msgid "No records found for `%s'"
 msgstr "Dienst `%s' konnte nicht ordentlich entladen werden!\n"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4672,7 +4759,7 @@ msgstr "Ungültiger Parameter: `%s'\n"
 msgid "You must specify a name\n"
 msgstr "Sie müssen einen Empfänger angeben!\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4681,7 +4768,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr "Die Priorität des Inhalts angeben"
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 #, fuzzy
 msgid "GNUnet zone manipulation tool"
 msgstr "GNUnet Konfiguration"
@@ -4829,140 +4916,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Dateiformat fehlerhaft (kein GNUnet Verzeichnis?)\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, fuzzy, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "Unbekannte Operation `%s'\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, fuzzy, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "Ungültiger Parameter: `%s'\n"
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, fuzzy, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "Kommando `%s' wird nicht unterstützt. Vorgang wird abgebrochen.\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, fuzzy, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr "%s: Symbolwert `%s' ist ungültig für %s\n"
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, fuzzy, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "Ungültiger Parameter: `%s'\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, fuzzy, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "Ungültiger Parameter: `%s'\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4970,107 +5030,112 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, fuzzy, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "Verbindung zu %u.%u.%u.%u:%u fehlgeschlagen: %s\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "Anwendung `%s' konnte nicht initialisiert werden.\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Unbekannter Befehl »%s«\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Ungültiges Format für IP: »%s«\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 msgid "set the desired nick name for the zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 msgid "monitor changes in the namestore"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 msgid "determine our name for the given PKEY"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr ""
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr ""
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "Verbindung fehlgeschlagen: %s\n"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -5079,10 +5144,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5678,6 +5739,51 @@ msgstr ""
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "Ungültiger Parameter: `%s'\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6563,17 +6669,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr ""
@@ -6775,7 +6881,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
 msgstr ""
@@ -7978,60 +8084,60 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr ""
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "FEHLER"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "WARNUNG"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "INFO"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "DEBUG"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr ""
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr ""
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr "Unbekannte Adresse"
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr "Ungültige Adresse"
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, fuzzy, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr ""
 "Die Konfigurationsdatei muss in der Sektion `%s' unter `%s' ein Verzeichnis "
 "angeben, in dem FS Daten gespeichert werden.\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, fuzzy, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8180,17 +8286,17 @@ msgstr ""
 msgid "Could not bind to any port: %s\n"
 msgstr "IP des Hosts `%s' konnte nicht ermittelt werden: %s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "HTTP Anfrage konnte nicht an Host `%s' gesendet werden: %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, c-format
 msgid "Sent DNS request to %s\n"
 msgstr ""
@@ -8277,84 +8383,84 @@ msgstr ""
 "Argumente, die für lange Optionen zwingend sind, sind auch für kurze "
 "Optionen zwingend.\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr ""
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr ""
 "Einen Wert aus der Konfigurationsdatei auf der Standardausgabe ausgeben"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "Sie müssen für die Option »%s« zusätzlich eine Zahl angeben.\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "Sie müssen eine relative Zeit zu der Option »%s« übergeben.\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "Sie müssen eine relative Zeit zu der Option »%s« übergeben.\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "Sie müssen eine relative Zeit zu der Option »%s« übergeben.\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "Sie müssen für die Option »%s« zusätzlich eine Zahl angeben.\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "Sie müssen für die Option »%s« zusätzlich eine Zahl angeben.\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8387,7 +8493,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "GNUnet-Konfigurationsdateien bearbeiten"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8643,7 +8749,7 @@ msgstr "Verbindung zu %u.%u.%u.%u:%u fehlgeschlagen: %s\n"
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8775,77 +8881,77 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr "IPv6-Adresse beginnt nicht mit »[«\n"
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr "IPv6-Adresse enthält kein »:« zur Abtrennung der Portnummer\n"
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr "IPv6-Adresse enthält kein »]« vor »:« zur Abtrennung der Portnummer\n"
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr "IPv6-Adresse enthält keine gültige Portnummer nach dem letzten »:«\n"
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, fuzzy, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "Ungültige Antwort auf `%s' von `%s'\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr "Port außerhalb des Bereichs\n"
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr ""
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "Ungültiges Format für IP: »%s«\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "Ungültige Netzwerk-Notation ('/%d ist nicht gültig in IPv4 CIDR)."
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, fuzzy, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "Ungültiges Format für IP: `%s'\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "Ungültige Netzwerk-Notation (endet nicht mit »;«: »%s«)\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, fuzzy, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "Falsches Format `%s' für Netzmaske: %s\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, fuzzy, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "Falsches Format `%s' für Netzwerk: %s\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -9025,12 +9131,26 @@ msgstr "Dienst wird über UDP angeboten"
 msgid "Setup tunnels via VPN."
 msgstr "Tunnel über VPN einrichten."
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 #, fuzzy
 msgid "Failed to connect to the namestore!\n"
 msgstr "Es konnte keine Verbindung mit gnunetd hergestellt werden.\n"
+#~ msgid "# items stored"
+#~ msgstr "# gespeicherte Objekte"
+#, fuzzy, c-format
+#~ msgid "Failed to load datacache plugin for `%s'\n"
+#~ msgstr "Fehler beim Aktualisieren der Daten des Moduls `%s'\n"
+#~ msgid "# requests received"
+#~ msgstr "# Anfragen empfangen"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# Klartext PONG Nachrichten empfangen"
 #, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# Anfragen empfangen"
diff --git a/po/es.po b/po/es.po
index 5f3787759..27a21fc63 100644
--- a/po/es.po
+++ b/po/es.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet 0.9.5a\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2013-02-23 17:50+0100\n"
 "Last-Translator: Miguel Ángel Arruga Vivas <rosen644835@gmail.com>\n"
 "Language-Team: Spanish <es@li.org>\n"
@@ -18,7 +18,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, fuzzy, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr "'%s': servicio desconocido: %s\n"
@@ -30,7 +30,7 @@ msgstr "El bloque del tipo %u está mal formado\n"
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "Se produjo un fallo al conectar con el almacén de nombres\n"
@@ -664,7 +664,7 @@ msgstr "salida prolija (incluye las propiedades de direcciones del ATS)"
 msgid "Print information about ATS state"
 msgstr "Imprime información acerca del estado del ATS"
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
@@ -673,7 +673,7 @@ msgstr ""
 "No se pudieron cargar las cuotas para la red «%s»:  «%s», asignando el ancho "
 "de banda predeterminado %llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
@@ -682,7 +682,7 @@ msgstr ""
 "No hay configurada una cuota de salida para la red «%s», asignando el ancho "
 "de banda predeterminado %llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
@@ -691,25 +691,25 @@ msgstr ""
 "No hay configurada una cuota de salida para la red «%s», asignando el ancho "
 "de banda predeterminado %llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 #, fuzzy
 msgid "solver to use"
 msgstr "valor a establecer"
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr "experimento para usar"
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 #, fuzzy
 msgid "print logging"
 msgstr "Iniciando descarga «%s».\n"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr "guarda protocolo al fichero en disco"
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr "deshabilita normalización"
@@ -1608,40 +1608,7 @@ msgstr "# mapas de tipos recibidos"
 msgid "# updates to my type map"
 msgstr "# actualizaciones de mi mapa de tipos"
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr "# bytes almacenados"
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr "# elementos almacenados"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr "Cargando el módulo de la cache de datos «%s»\n"
-#: src/datacache/datacache.c:203
-#, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr ""
-"Se produjo un fallo al cargar el módulo de la cache de datos para «%s»\n"
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr "# peticiones recibidas"
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr "# peticiones filtradas por el «bloomfilter»"
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# búsquedas de clientes recibidas"
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr "Caché de datos de montículo (heap) ejecutándose\n"
@@ -1663,7 +1630,7 @@ msgstr "Caché de datos de montículo (heap) ejecutándose\n"
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "«%s» falló en %s: %d con el error: %s\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1856,6 +1823,10 @@ msgstr "# reservado"
 msgid "Could not find matching reservation"
 msgstr "No se pudo encontrar una reserva coincidente"
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr "# bytes almacenados"
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -2051,7 +2022,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr "Base de datos sqlite ejecutándose\n"
@@ -2059,7 +2030,7 @@ msgstr "Base de datos sqlite ejecutándose\n"
 msgid "Template database running\n"
 msgstr "Base de datos de plantilla ejecutándose\n"
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
@@ -2068,52 +2039,63 @@ msgstr ""
 "Resultado %d, tipo %d:\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, fuzzy, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
 "Resultado %d, tipo %d:\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr "¡Se debe proveer una clave para el «GET» DHT!\n"
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
+#: src/dht/gnunet-dht-monitor.c:255
+#, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "¡Se produjo un fallo al conectar con el servicio DHT!\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 #, fuzzy
 msgid "Issuing DHT GET with key"
 msgstr "Enviando un «GET» DHT con clave"
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr "la clave de búsqueda"
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr "cuantas peticiones paralelas (réplicas) crear"
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+#, fuzzy
+msgid "use DHT's record route option"
+msgstr "opción para usar el demultiplexado de la DHT siempre"
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr "el tipo de datos a buscar"
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr "¿cuánto tiempo se debe ejecutar esta consulta antes de abandonar?"
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr "opción para usar el demultiplexado de la DHT siempre"
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
 "Iniciando una peticion «GET» a la DHT de GNUnet, imprimiendo resultados."
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr "cuanto tiempo debe ejecutarse el comando de monitorización"
@@ -2153,11 +2135,6 @@ msgstr "cuanto tiempo almacenar esta entrada en la DHT (en segundos)"
 msgid "how many replicas to create"
 msgstr "cuantas réplicas crear"
-#: src/dht/gnunet-dht-put.c:217
-#, fuzzy
-msgid "use DHT's record route option"
-msgstr "opción para usar el demultiplexado de la DHT siempre"
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr "el tipo de datos a insertar"
@@ -2217,17 +2194,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr "Medir la calidad y rendimiento del servicio NSE."
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, c-format
 msgid "Block not of type %u\n"
 msgstr "El bloque no es del tipo %u\n"
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, fuzzy, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr "Discrepancias de tamaños para el bloque\n"
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr "El bloque del tipo %u está mal formado\n"
@@ -2995,20 +2972,20 @@ msgstr "URI SKS mal formada (no se encuentra el tiempo de expiración)"
 msgid "LOC URI malformed (signature failed validation)"
 msgstr "URI SKS mal formada (se produjo un fallo al validar la firma)"
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Parámetro no válido «%s»\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr "Tipo de URI no reconocido"
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr "¡Ninguna palabra clave especificada!\n"
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr "¡Número de comillas dobles no balanceado!\n"
@@ -3137,7 +3114,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr "Finalizada descarga «%s» (%s/s).\n"
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr "Estado inesperado: %d\n"
@@ -3160,12 +3137,12 @@ msgid "Target filename must be specified.\n"
 msgstr "El nombre de fichero de destino debe ser especificado.\n"
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "No se pudo inicializar el subsistema «%s».\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr "establece el nivel LEVEL deseado de anonimato del receptor"
@@ -3173,7 +3150,7 @@ msgstr "establece el nivel LEVEL deseado de anonimato del receptor"
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr "borra descargas incompletas (cuando fueron abortadas con CTRL-C="
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr "únicamente buscar en el par local (no buscar en la red P2P)"
@@ -3439,40 +3416,114 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr "Publicar un fichero o un directorio en GNUnet"
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
 "Se produjo un fallo al escribir el directorio con los resultados de búsqueda "
 "de «%s»\n"
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, c-format
 msgid "Error searching: %s.\n"
 msgstr "Error buscando: %s.\n"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr "No se pudo crear URI de palabra clave a partir de los parámetros.\n"
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "No se pudo inicializar el subsistema «%s».\n"
+#: src/fs/gnunet-search.c:668
 msgid "Could not start searching.\n"
 msgstr "No se pudo empezar a buscar.\n"
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+#, fuzzy
-msgstr "escribir resultados de búsqueda al fichero que empiecen por «PREFIX»"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr "establece el nivel LEVEL deseado de anonimato del receptor"
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:707
-msgid "automatically terminate search after DELAY"
+msgid ""
-msgstr "terminar búsqueda automáticamente después de «DELAY»"
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
+msgstr ""
+#: src/fs/gnunet-search.c:725
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
+msgstr ""
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr "terminar búsqueda después de «VALUE» resultados encontrados"
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+#, fuzzy
+msgid "Search for files that have been published on GNUnet\n"
 msgstr "Buscar en GNUnet ficheros que han sido publicados en GNUnet"
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3816,70 +3867,75 @@ msgstr "Desindexa un fichero previamente indexado con «gnunet-publish»."
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Número de puerto %llu no válido.  Saliendo.\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Imposible crear la cuenta de usuario:"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 msgid "Failed to start HTTP server\n"
 msgstr "Se produjo un fallo al iniciar el servidor HTTP\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr ""
 "¡Se produjo un fallo al empaquetar una respuesta DNS en un paquete UDP!\n"
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Se produjo un fallo al procesar la petición DNS.  Omitiendo.\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, fuzzy, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr "El ATS devolvió resultados para %u direcciones\n"
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr "No se puede procesar la petición DNS de %s\n"
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr "Recibida petición DNS mal formada de %s\n"
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr "Recibida petición DNS no soportada de %s\n"
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 #, fuzzy
 msgid "No DNS server specified!\n"
 msgstr "¡Ninguna palabra clave especificada!\n"
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr "IP del resolvedor recursivo DNS a usar (requerido)"
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 #, fuzzy
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
 "Puerto UDP en el que escuchar para peticiones DNS entrantes; predeterminado: "
 "53"
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr "Pasarela GNUnet DNS-a-GNS (un servidor DNS)"
@@ -4063,19 +4119,19 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "Herramienta de acceso GNUnet GNS"
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "Tipo requerido\n"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 #, fuzzy
 msgid "Failed to connect to the namecache!\n"
 msgstr "¡Se produjo un fallo al conectar con el almacén de nombres!\n"
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 msgid "Could not connect to DHT!\n"
 msgstr "¡No se pudo conectar a la DHT!\n"
@@ -4089,97 +4145,100 @@ msgstr "¡Se produjo un error al convertir los argumentos a una URI!\n"
 msgid "Failed to connect to the DNS service!\n"
 msgstr "¡Se produjo un fallo al conectar con el servicio GNS!\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, fuzzy, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr "Módulo «%s» no encontrado\n"
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, fuzzy, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr "Módulo «%s» no encontrado\n"
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 #, fuzzy
 msgid "Failed to parse DNS response\n"
 msgstr "Se produjo un fallo al procesar la petición DNS.  Omitiendo.\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, fuzzy, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr "El ATS devolvió resultados para %u direcciones\n"
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "No se han encontrado ficheros en «%s»\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, fuzzy, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "Se produjo un fallo al mandar la petición DNS a %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "No se pudo procesar el registro MX «%s»\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, fuzzy, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "No se pudo procesar el registro SOA «%s»\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr ""
 "Se produjo un fallo al escribir el directorio con los resultados de búsqueda "
 "de «%s»\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "No se pudo procesar la cadena de registro VPN «%s»\n"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "No se pudo procesar la cadena de registro VPN «%s»\n"
@@ -4189,6 +4248,34 @@ msgstr "No se pudo procesar la cadena de registro VPN «%s»\n"
 msgid "Gns REST API initialized\n"
 msgstr "Conexión fallida\n"
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4456,7 +4543,7 @@ msgid "# hostlist downloads initiated"
 msgstr "# descargas de listas de máquinas iniciadas"
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr "# milisegundos entre descargas de listas de máquinas"
@@ -4519,21 +4606,21 @@ msgstr "Error escribiendo URI de listas de máquinas al fichero «%s»\n"
 msgid "# hostlist URIs written to file"
 msgstr "# URI de listas de máquinas escritas a fichero"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr "El aprendizaje está habilitado en este par\n"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr "El aprendizaje no está habilitado en este par\n"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4737,51 +4824,51 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, fuzzy, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr ""
 "Se produjo un fallo al obtener los identificadores de fichero para «%s»\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 #, fuzzy
 msgid "target name already exists"
 msgstr "El registro ya existía en el almacén de nombres"
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, fuzzy, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "Se produjo un fallo al procesar la identidad del par «%s»\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, fuzzy, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr "Se produjo un fallo al borrar el fichero de configuración %s\n"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, fuzzy, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "Se produjo un fallo al leer el directorio «%s»\n"
@@ -4822,7 +4909,7 @@ msgstr "No se pudo acceder al fichero «%s»: %s\n"
 msgid "No records found for `%s'"
 msgstr "No se han encontrado ficheros en «%s»\n"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr "\tRegistro corrupto o no soportado del tipo %u\n"
@@ -4842,7 +4929,7 @@ msgstr "Parámetro no válido «%s»\n"
 msgid "You must specify a name\n"
 msgstr "¡Debes especificar un receptor!\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr "nombre del registro a añadir/borrar/mostrar"
@@ -4851,7 +4938,7 @@ msgstr "nombre del registro a añadir/borrar/mostrar"
 msgid "specifies the public key of the zone to look in"
 msgstr "Especificar el tipo del registro a buscar"
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 msgid "GNUnet zone manipulation tool"
 msgstr "Herramienta de manipulación de zona de GNUnet"
@@ -5003,140 +5090,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr "Servicio de registro GNUnet GNS primero en llegar, primero en servirse"
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr "No se pudo añadir el registro: %s\n"
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, fuzzy, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr "No se pudo borrar el registro: %s\n"
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, fuzzy, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr "No se pudo borrar el registro: %s\n"
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Se produjo un fallo al procesar la petición DNS.  Omitiendo.\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr "No se han proporcionado opciones\n"
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "Falta la opción «%s» para la operación «%s»\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, fuzzy, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "URI no válida: «%s»\n"
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr "añadir"
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "Tipo no soportado «%s»\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr "Valor «%s» no válido para el tipo de registro «%s»\n"
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "Formato de tiempo no válido «%s»\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr "borrar"
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, fuzzy, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr "Parámetro no válido «%s»\n"
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "URI no válida: «%s»\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -5144,113 +5204,118 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, fuzzy, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr "Argumentos superfluos (ignorados).\n"
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, fuzzy, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "¡No se pudo conectar al servicio %s!\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "Se produjo un fallo al cargar el módulo del transporte para «%s»\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Comando desconocido «%s»\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Formato no válido para la IP: «%s»\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr "añadir registro"
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr "borrar registro"
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr "mostrar registros"
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
 "tiempo de expiración del registro a usar (únicamente para añadir), nunca "
 "(\"never\") es posible"
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 #, fuzzy
 msgid "set the desired nick name for the zone"
 msgstr "establece el nivel LEVEL deseado de replicación"
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 #, fuzzy
 msgid "monitor changes in the namestore"
 msgstr "¡Se produjo un fallo al conectar con el almacén de nombres!\n"
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 #, fuzzy
 msgid "determine our name for the given PKEY"
 msgstr "establece las preferencias para el par dado"
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr "tipo del registro a añadir/borrar/mostrar"
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr "URI a importar a nuestra zona"
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr "valor del registro a añadir/borrar"
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr "crear o listar registros públicos"
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 #, fuzzy
 msgid "name of the ego controlling the zone"
 msgstr "nombre de la sección a la que acceder"
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, fuzzy, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr "Se produjo un fallo al crear el espacio de nombres «%s»\n"
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "«gnunet-ecc» falló"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -5259,11 +5324,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-#, fuzzy
-msgid "Namestore failed to store record\n"
-msgstr "El almacén de nombres no pudo añadir el registro\n"
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5867,6 +5927,51 @@ msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
 "Demonio a ejecutar para realizar la traducción de protocolo IP a GNUnet"
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "URI no válida: «%s»\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6780,17 +6885,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr "El fichero de topología %s no fue encontrado\n"
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr "El fichero de topología %s no tiene datos\n"
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr "El fichero de topología %s no puede ser leido\n"
@@ -7019,7 +7124,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 #, fuzzy
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
@@ -8290,58 +8395,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr "Se necesita un nombre de máquina no vacío para el servicio «%s».\n"
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr "Mensaje `%.*s» repetido %u veces en el último %s\n"
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "ERROR"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "PELIGRO"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr "MENSAJE"
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "INFORMACIÓN"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "DEPURACIÓN"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr "NINGUNO"
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr "NO VÁLIDO"
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr "dirección desconocida"
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr "dirección no válida"
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr "¡La configuración no especifica la opción «%s» en la sección «%s»!\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8496,17 +8601,17 @@ msgstr ""
 msgid "Could not bind to any port: %s\n"
 msgstr "No se pudo asociar con ningún puerto: %s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
-#, c-format
+#, fuzzy, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr "Recibida respuesta DNS demasiado pequeña (%u bytes)"
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Se produjo un fallo al mandar la petición DNS a %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, c-format
 msgid "Sent DNS request to %s\n"
 msgstr "Petición DNS enviada a %s\n"
@@ -8593,83 +8698,83 @@ msgstr ""
 "Los parámetros obligatorios para las opciones largas también lo son para sus "
 "versiones cortas.\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr "imprime esta ayuda"
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr "crear ficheros de configuración únicos"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "Tienes que introducir un número en la opción «%s».\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "Debes introducir un tiempo relativo en la opción «%s».\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "Debes introducir un tiempo relativo en la opción «%s».\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "Debes introducir un tiempo relativo en la opción «%s».\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "Tienes que introducir un número en la opción «%s».\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "Tienes que introducir un número en la opción «%s».\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8702,7 +8807,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "Manipular ficheros de configuración de GNUnet"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8962,7 +9067,7 @@ msgstr "Error escribiendo a «%s»: %s\n"
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr "Imposible acortar la ruta unix «%s» manteniendo el nombre único\n"
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -9102,85 +9207,85 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr "Los conjuntos de caracteres pedidos fueron «%s»->«%s»\n"
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
 "Se produjo un fallo al expandir «$HOME»: variable de entorno «HOME» no "
 "establecida"
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr "La dirección IPv6 no empezaba con «[»\n"
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr "La dirección IPv6 contenía «:» para separar el número de puerto\n"
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
 "La dirección IPv6 contenía «]» antes de «:» para separar el número de "
 "puerto\n"
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
 "La dirección IPv6 contenía un número de puerto válido después del último "
 "«:»\n"
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "Dirección IPv6 «%s» no válida: %s\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, fuzzy, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr "Se produjo un fallo al iniciar el servicio «%s»\n"
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "Formato no válido para la IP: «%s»\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "Notación de red no válida («/%d» no es válido en IPv4 CIDR)."
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, fuzzy, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "Formato de tiempo no válido «%s»\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "Notación de red no válida (no termina con «;»: «%s»)\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "Formato «%s» erroneo para máscara de red\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "Formato «%s» erroneo para red\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, fuzzy, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
 "Se produjo un fallo al recuperar el espacio de nombres «%s», no se pudo "
 "retomar la operación de publicación.\n"
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -9362,11 +9467,44 @@ msgstr "el servicio es ofrecido vía UDP"
 msgid "Setup tunnels via VPN."
 msgstr "Configurar túneles vía VPN."
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 msgid "Failed to connect to the namestore!\n"
 msgstr "¡Se produjo un fallo al conectar con el almacén de nombres!\n"
+#~ msgid "# items stored"
+#~ msgstr "# elementos almacenados"
+#, c-format
+#~ msgid "Loading `%s' datacache plugin\n"
+#~ msgstr "Cargando el módulo de la cache de datos «%s»\n"
+#, c-format
+#~ msgid "Failed to load datacache plugin for `%s'\n"
+#~ msgstr ""
+#~ "Se produjo un fallo al cargar el módulo de la cache de datos para «%s»\n"
+#~ msgid "# requests received"
+#~ msgstr "# peticiones recibidas"
+#~ msgid "# requests filtered by bloom filter"
+#~ msgstr "# peticiones filtradas por el «bloomfilter»"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# búsquedas de clientes recibidas"
+#~ msgid "write search results to file starting with PREFIX"
+#~ msgstr ""
+#~ "escribir resultados de búsqueda al fichero que empiecen por «PREFIX»"
+#~ msgid "automatically terminate search after DELAY"
+#~ msgstr "terminar búsqueda automáticamente después de «DELAY»"
+#, fuzzy
+#~ msgid "Namestore failed to store record\n"
+#~ msgstr "El almacén de nombres no pudo añadir el registro\n"
 #, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# peticiones recibidas"
@@ -11531,9 +11669,6 @@ msgstr "¡Se produjo un fallo al conectar con el almacén de nombres!\n"
 #~ msgid "interrupted by shutdown"
 #~ msgstr "interrumpido por apagado"
-#~ msgid "gnunet-ecc failed"
-#~ msgstr "«gnunet-ecc» falló"
 #~ msgid ""
 #~ "File `%s' does not contain a valid private key (too long, %llu bytes).  "
 #~ "Renaming it.\n"
diff --git a/po/fr.po b/po/fr.po
index 3692461e5..f8d8afeed 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet 0.10.1\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2021-11-21 00:53+0100\n"
 "Last-Translator: Stéphane  Aulery <lkppo@free.fr>\n"
 "Language-Team: French <traduc@traduc.org>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "X-Bugs: Report translation errors to the Language-Team address.\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr ""
@@ -29,7 +29,7 @@ msgstr ""
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, c-format
 msgid "Failed to connect to namestore\n"
 msgstr ""
@@ -611,44 +611,44 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr "solveur utilisé"
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 msgid "print logging"
 msgstr "afficher le journal"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1492,38 +1492,7 @@ msgstr ""
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr ""
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr ""
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr ""
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr ""
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr ""
-#: src/datacache/datacache.c:329
-msgid "# proximity search requests received"
-msgstr ""
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr ""
@@ -1545,7 +1514,7 @@ msgstr ""
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr ""
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1728,6 +1697,10 @@ msgstr "# réservé"
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr ""
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -1907,7 +1880,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr ""
@@ -1915,7 +1888,7 @@ msgstr ""
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
@@ -1924,50 +1897,60 @@ msgstr ""
 "Resultat %d, type %d :\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, fuzzy, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
 "Resultat %d, type %d :\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
+#: src/dht/gnunet-dht-monitor.c:255
+#, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2007,10 +1990,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2066,17 +2045,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr ""
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, c-format
 msgid "Block not of type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2767,20 +2746,20 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Argument invalide « %s »\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr "Type d’URI non reconnu"
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr ""
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr ""
@@ -2904,7 +2883,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr ""
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr ""
@@ -2927,12 +2906,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr ""
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr ""
@@ -2940,7 +2919,7 @@ msgstr ""
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr ""
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3176,38 +3155,110 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, c-format
 msgid "Error searching: %s.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:668
 msgid "Could not start searching.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr ""
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:725
-msgid "automatically terminate search after DELAY"
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+msgid "Search for files that have been published on GNUnet\n"
 msgstr ""
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3531,64 +3582,69 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Argument invalide « %s »\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 msgid "Unable to set up the daemon\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 msgid "Failed to start HTTP server\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Échec du démarrage de %s\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 msgid "No DNS server specified!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -3766,17 +3822,17 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr ""
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 msgid "Properly base32-encoded public key required"
 msgstr ""
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 msgid "Failed to connect to the namecache!\n"
 msgstr ""
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 msgid "Could not connect to DHT!\n"
 msgstr ""
@@ -3788,94 +3844,97 @@ msgstr ""
 msgid "Failed to connect to the DNS service!\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 msgid "Failed to parse DNS response\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr ""
@@ -3884,6 +3943,34 @@ msgstr ""
 msgid "Gns REST API initialized\n"
 msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4124,7 +4211,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4182,21 +4269,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4384,49 +4471,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr ""
@@ -4466,7 +4553,7 @@ msgstr ""
 msgid "No records found for `%s'"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4486,7 +4573,7 @@ msgstr "fornat invalide : « %s »\n"
 msgid "You must specify a name\n"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4494,7 +4581,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 msgid "GNUnet zone manipulation tool"
 msgstr ""
@@ -4635,140 +4722,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Résolution de « %s » échouée : %s\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, c-format
 msgid "Invalid nick `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr "ajouter"
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, c-format
 msgid "Unsupported type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, c-format
 msgid "Invalid time format `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr "supprimer"
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "URI invalide « %s »\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4776,107 +4836,112 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, c-format
 msgid "Cannot connect to identity service\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Commande « %s » inconnue\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "fornat invalide : « %s »\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr "ajouter un enregistrement"
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr "suprimer un enregistrement"
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr "afficher les enregistrements"
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 msgid "set the desired nick name for the zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 msgid "monitor changes in the namestore"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 msgid "determine our name for the given PKEY"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr ""
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr ""
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "pa_stream_new() échoué : %s\n"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -4885,10 +4950,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5453,6 +5514,51 @@ msgstr ""
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "URI invalide « %s »\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, c-format
 msgid "Ego is required\n"
@@ -6317,17 +6423,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr ""
@@ -6525,7 +6631,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
 msgstr ""
@@ -7683,58 +7789,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr ""
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "ERREUR"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "AVERTISSEMENT"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "INFO"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "DEBUG"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr "AUCUN"
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr "INVALIDE"
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr "adresse inconnue"
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr "adresse invalide"
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr ""
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -7879,17 +7985,17 @@ msgstr ""
 msgid "Could not bind to any port: %s\n"
 msgstr ""
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Résolution de « %s » échouée : %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, c-format
 msgid "Sent DNS request to %s\n"
 msgstr ""
@@ -7974,82 +8080,82 @@ msgid ""
 "Arguments mandatory for long options are also mandatory for short options.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr ""
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 msgid "use configuration file FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8082,7 +8188,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr ""
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8336,7 +8442,7 @@ msgstr ""
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8462,77 +8568,77 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr ""
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr ""
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr ""
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr ""
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr ""
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "fornat invalide : « %s »\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr ""
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr ""
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr ""
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -8702,8 +8808,8 @@ msgstr ""
 msgid "Setup tunnels via VPN."
 msgstr "Configurer des tunnels via VPN."
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 msgid "Failed to connect to the namestore!\n"
 msgstr ""
diff --git a/po/it.po b/po/it.po
index 8537d1afe..b97c40faa 100644
--- a/po/it.po
+++ b/po/it.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet 0.10.1\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2019-10-16 11:00+0200\n"
 "Last-Translator: Sebastiano Pistore <sebastianopistore.info@protonmail.ch>\n"
 "Language-Team: Italian <tp@lists.linux.it>\n"
@@ -20,7 +20,7 @@ msgstr ""
 "X-Generator: Poedit 2.2.3\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr ""
@@ -32,7 +32,7 @@ msgstr ""
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, c-format
 msgid "Failed to connect to namestore\n"
 msgstr ""
@@ -612,44 +612,44 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 msgid "print logging"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1498,39 +1498,7 @@ msgstr ""
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr ""
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr "# elementi memorizzati"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr ""
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr ""
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr ""
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# richieste GET ricevute"
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr ""
@@ -1552,7 +1520,7 @@ msgstr ""
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr ""
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1736,6 +1704,10 @@ msgstr ""
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr ""
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -1916,7 +1888,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr ""
@@ -1924,55 +1896,65 @@ msgstr ""
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
 "%.*s\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
+#: src/dht/gnunet-dht-monitor.c:255
+#, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2012,10 +1994,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2070,17 +2048,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr ""
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, c-format
 msgid "Block not of type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2782,19 +2760,19 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 msgid "invalid argument"
 msgstr "argomento non valido"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr ""
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr ""
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr ""
@@ -2918,7 +2896,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr ""
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr ""
@@ -2941,12 +2919,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr ""
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr ""
@@ -2954,7 +2932,7 @@ msgstr ""
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr ""
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3195,38 +3173,110 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, c-format
 msgid "Error searching: %s.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:668
 msgid "Could not start searching.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:700
-msgid "automatically terminate search after DELAY"
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
+msgstr ""
+#: src/fs/gnunet-search.c:725
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+msgid "Search for files that have been published on GNUnet\n"
 msgstr ""
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3554,65 +3604,70 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "# messaggi PONG ricevuti"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Generazione statistiche fallita\n"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 msgid "Failed to start HTTP server\n"
 msgstr "Impossibile avviare il server HTTP\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Generazione statistiche fallita\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 msgid "No DNS server specified!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -3790,18 +3845,18 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr ""
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "# messaggi PONG ricevuti"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 msgid "Failed to connect to the namecache!\n"
 msgstr ""
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 msgid "Could not connect to DHT!\n"
 msgstr ""
@@ -3813,94 +3868,97 @@ msgstr ""
 msgid "Failed to connect to the DNS service!\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 msgid "Failed to parse DNS response\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "Impossibile avviare il servizio ' %s'\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "Impossibile avviare il servizio ' %s'\n"
@@ -3909,6 +3967,34 @@ msgstr "Impossibile avviare il servizio ' %s'\n"
 msgid "Gns REST API initialized\n"
 msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4149,7 +4235,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4207,21 +4293,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4410,49 +4496,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr ""
@@ -4492,7 +4578,7 @@ msgstr ""
 msgid "No records found for `%s'"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4512,7 +4598,7 @@ msgstr "# messaggi PONG ricevuti"
 msgid "You must specify a name\n"
 msgstr "È necessario specificare un nome\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4520,7 +4606,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 msgid "GNUnet zone manipulation tool"
 msgstr ""
@@ -4662,140 +4748,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Impossibile avviare il servizio ' %s'\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, c-format
 msgid "Invalid nick `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, c-format
 msgid "Unsupported type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, c-format
 msgid "Invalid time format `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, c-format
 msgid "Invalid URI `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4803,107 +4862,111 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, c-format
 msgid "Cannot connect to identity service\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Comando `%s' sconosciuto.\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Indirizzo IPv6 non valido: `%s'\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 msgid "set the desired nick name for the zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 msgid "monitor changes in the namestore"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 msgid "determine our name for the given PKEY"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr ""
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr ""
+#: src/namestore/gnunet-service-namestore.c:1668
+msgid "Store failed"
+msgstr ""
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -4912,10 +4975,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5481,6 +5540,51 @@ msgstr ""
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, c-format
+msgid "Invalid DID `%s'\n"
+msgstr ""
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, c-format
 msgid "Ego is required\n"
@@ -6348,17 +6452,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr ""
@@ -6556,7 +6660,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
 msgstr ""
@@ -7736,58 +7840,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr ""
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "ERRORE"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "ATTENZIONE"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "INFO"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "DEBUG"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr "NESSUNA"
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr "NON VALIDO"
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr "indirizzo sconosciuto"
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr "indirizzo non valido"
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr ""
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -7932,17 +8036,17 @@ msgstr ""
 msgid "Could not bind to any port: %s\n"
 msgstr ""
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Generazione statistiche fallita\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, c-format
 msgid "Sent DNS request to %s\n"
 msgstr ""
@@ -8027,82 +8131,82 @@ msgid ""
 "Arguments mandatory for long options are also mandatory for short options.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr ""
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 msgid "use configuration file FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8135,7 +8239,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr ""
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8389,7 +8493,7 @@ msgstr ""
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8516,77 +8620,77 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr ""
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr ""
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr ""
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr ""
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr ""
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, c-format
 msgid "Invalid format: `%s'\n"
 msgstr ""
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr ""
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr ""
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr ""
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -8760,11 +8864,18 @@ msgstr ""
 msgid "Setup tunnels via VPN."
 msgstr ""
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 msgid "Failed to connect to the namestore!\n"
 msgstr ""
+#~ msgid "# items stored"
+#~ msgstr "# elementi memorizzati"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# richieste GET ricevute"
 #, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# richieste GET ricevute"
diff --git a/po/sr.po b/po/sr.po
index 4109ed3ed..47494eeff 100644
--- a/po/sr.po
+++ b/po/sr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet-0.10.1\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2020-10-23 18:39+0200\n"
 "Last-Translator: Мирослав Николић <miroslavnikolic@rocketmail.com>\n"
 "Language-Team: Serbian <(nothing)>\n"
@@ -18,7 +18,7 @@ msgstr ""
 "%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
 "X-Bugs: Report translation errors to the Language-Team address.\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr "Его „%s“ није познат услузи идентитета\n"
@@ -30,7 +30,7 @@ msgstr "Јавни кључ „%s“ није добро оформљен\n"
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "Нисам успео да се повежем са смештајем назива\n"
@@ -628,7 +628,7 @@ msgstr "опширан излаз (укључује својства АТС ад
 msgid "Print information about ATS state"
 msgstr "Исписује податке о АТС стању"
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
@@ -637,7 +637,7 @@ msgstr ""
 "Не могу да учитам квоту за мрежу „%s“:  „%s“, додељујем основни пропусни "
 "опсег %llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
@@ -646,7 +646,7 @@ msgstr ""
 "Нема подешене одлазне квоте за мрежу „%s“, додељујем основни пропусни опсег "
 "%llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
@@ -655,23 +655,23 @@ msgstr ""
 "Није подешена одлазна квота за мрежу „%s“, додељујем основни пропусни опсег "
 "%llu\n"
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr "решавач за коришћење"
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr "експеримент за коришћење"
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 msgid "print logging"
 msgstr "исписује дневничење"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1560,39 +1560,7 @@ msgstr "# мапе врсте су примљене"
 msgid "# updates to my type map"
 msgstr "# ажурирања за моју мапу врсте"
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr "# бајтови су смештени"
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr "# ставке су смештене"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr "Учитавам прикључак „%s“ оставе података\n"
-#: src/datacache/datacache.c:203
-#, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr "Нисам успео да учитам прикључак оставе података за „%s“\n"
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr "# захтеви су примљени"
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr "# захтеви су филтрирани блум филтером"
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# претраге клијента су примљене"
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr "Остава података скупине ради\n"
@@ -1614,7 +1582,7 @@ msgstr "Остава података скупине ради\n"
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "„%s“ није успело на %s:%d са грешком: %s\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1804,6 +1772,10 @@ msgstr "# је резервисано"
 msgid "Could not find matching reservation"
 msgstr "Не могу да нађем одговарајућу резервацију"
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr "# бајтови су смештени"
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -1990,7 +1962,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr "База података Скулајта ради\n"
@@ -1998,7 +1970,7 @@ msgstr "База података Скулајта ради\n"
 msgid "Template database running\n"
 msgstr "База података шаблона ради\n"
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
@@ -2007,51 +1979,62 @@ msgstr ""
 "Резултат %d, врста %d:\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, fuzzy, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
 "Резултат %d, врста %d:\n"
 "%.*s\n"
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr "Морате доставити кључ за ДХТ ДОБАВИ!\n"
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
+#: src/dht/gnunet-dht-monitor.c:255
+#, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "Нисам успео да се повежем са „DHT“ услугом!\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 #, fuzzy
 msgid "Issuing DHT GET with key"
 msgstr "Издајем ДХТ ДОБАВИ са кључем"
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr "кључ упита"
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr "колико паралелних захтева (реплика) да направи"
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+#, fuzzy
+msgid "use DHT's record route option"
+msgstr "користи опцију ДХТ-а демултиплексирај свуда"
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr "врста података за тражење"
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr "колико дуго да извршава овај упит пре одустајања?"
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr "користи опцију ДХТ-а демултиплексирај свуда"
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr "Издаје ДОБАВИ захтев ГНУнет ДХТ-у, исписује резултате."
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr "колико дуго треба да ради наредба праћења"
@@ -2091,11 +2074,6 @@ msgstr "колико ће дуго да држи овај унос у дхт-у
 msgid "how many replicas to create"
 msgstr "број реплика за стварање"
-#: src/dht/gnunet-dht-put.c:217
-#, fuzzy
-msgid "use DHT's record route option"
-msgstr "користи опцију ДХТ-а демултиплексирај свуда"
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr "врста за уметање података"
@@ -2153,17 +2131,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr "Мери квалитет и учинковитост НСЕ услуге."
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, c-format
 msgid "Block not of type %u\n"
 msgstr "Блок није врсте %u\n"
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, fuzzy, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr "Величин не одговара за блок\n"
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr "Блок врсте %u је лош\n"
@@ -2902,20 +2880,20 @@ msgstr "SKS УРИ је лоше (не могу да обрадим време �
 msgid "LOC URI malformed (signature failed validation)"
 msgstr "SKS УРИ је лоше (потврђивање потписа није успело)"
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Неисправан аргумент „%s“\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr "Непозната УРИ врста"
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr "Нису наведене речи кључа!\n"
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr "Број двоструких квота које нису уравнотежене!\n"
@@ -3043,7 +3021,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr "Преузимање „%s“ је готово (%s/сек).\n"
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr "Неочекивано стање: %d\n"
@@ -3066,12 +3044,12 @@ msgid "Target filename must be specified.\n"
 msgstr "Назив циљне датотеке мора бити наведен.\n"
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "Не могу да покренем „%s“ субсистем.\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr "поставља жељени НИВО анонимности примаоца"
@@ -3079,7 +3057,7 @@ msgstr "поставља жељени НИВО анонимности прима
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr "брише недовршена преузимања (када се прекине са КТРЛ-Ц)"
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr "тражи само локалног парњака (без претраге П2П мреже)"
@@ -3338,38 +3316,112 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr "Објављује датотеку или директоријум на ГНУнет-у"
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr "Нисам успео да пишем директоријум са резултатима претраге за „%s“\n"
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, c-format
 msgid "Error searching: %s.\n"
 msgstr "Грешка претраге: %s.\n"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr "Не могу да створим УРИ кључне речи из аргумената.\n"
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "Не могу да покренем „%s“ субсистем.\n"
+#: src/fs/gnunet-search.c:668
 msgid "Could not start searching.\n"
 msgstr "Не могу да покренем претрагу.\n"
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+#, fuzzy
-msgstr "пише резултате претраге у датотеку која почиње са ПРЕФИКСОМ"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr "поставља жељени НИВО анонимности примаоца"
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
+msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:725
-msgid "automatically terminate search after DELAY"
+msgid ""
-msgstr "самостално окончава претрагу након ЗАСТОЈА"
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
+msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr "самостално окончава претрагу након што су пронађени резултати ВРЕДНОСТ"
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+#, fuzzy
+msgid "Search for files that have been published on GNUnet\n"
 msgstr "Претражује ГНУнет за датотекама које су објављене на ГНУнет-у"
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3712,68 +3764,73 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Неисправан број прикључника %llu.  Излазим.\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Не могу да увезем приватни кључ из датотеке „%s“\n"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 msgid "Failed to start HTTP server\n"
 msgstr "Нисам успео да покренем ХТТП сервер\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 #, fuzzy
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr "Покрећем ХТТП сервер на прикључнику ПРИКЉУЧНИК (основно је 8888)"
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr "ГНУнет ХТТП сервер за стварање бизнис картица"
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr "Нисам успео да упакујем ДНС одговор у УДП пакет!\n"
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Нисам успео да обрадим ДНС одговор\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, fuzzy, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr "АТС је вратио резултате за %u адресе\n"
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr "Не могу да обрадим ДНС захтев од „%s“\n"
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr "Примих лош ДНС захтев од „%s“\n"
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr "Примих неподржан ДНС захтев од „%s“\n"
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 msgid "No DNS server specified!\n"
 msgstr "Није наведен ДНС сервер!\n"
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr "ИП дубинског ДНС решавача за коришћење (потребно)"
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 #, fuzzy
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
 "УДП прикључник на коме ће ослушкивати за долазним ДНС захтевима; основно: 53"
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr "Посредник ДНС-до-ГНС ГНУнет-а (ДНС сервер)"
@@ -3953,18 +4010,18 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "Алат ГНУнет ГНС решавача"
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "исправан јавни кључ се захтева"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 msgid "Failed to connect to the namecache!\n"
 msgstr "Нисам успео да се повежем са оставом назива!\n"
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 msgid "Could not connect to DHT!\n"
 msgstr "Не могу да се повежем на ДХТ!\n"
@@ -3976,94 +4033,97 @@ msgstr "Грешка претварања ГНС одговора у ДНС од
 msgid "Failed to connect to the DNS service!\n"
 msgstr "Нисам успео да се повежем са ДНС услугом!\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 msgid "Failed to parse DNS response\n"
 msgstr "Нисам успео да обрадим ДНС одговор\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr "Прескачем запис неподржане врсте %d\n"
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, fuzzy, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr "АТС је вратио резултате за %u адресе\n"
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr "ГНС претраживање је резултирало ДНС називом који је предуг („%s“)\n"
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "Дубачење ГНС претраге није успело (нисам нашао запис изасланства)\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr "Дубачење ГНС претраге није успело (нисам нашао запис изасланства)\n"
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "Нисам успео да сместим у оставу ГНС резолуцију: %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, fuzzy, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr "АТС је вратио резултате за %u адресе\n"
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr "Зона %s је опозвана, резолуција није успела\n"
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "Не могу да обрадим „MX“ запис „%s“\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "Не могу да обрадим „GNS2DNS“ запис „%s“\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr "Нисам успео да серијализујем ГНС2ДНС запис са вредношћу „%s“\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "Не могу да обрадим ниску ВПН записа „%s“\n"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "Не могу да обрадим ниску ВПН записа „%s“\n"
@@ -4073,6 +4133,34 @@ msgstr "Не могу да обрадим ниску ВПН записа „%s�
 msgid "Gns REST API initialized\n"
 msgstr "Меш је покренут\n"
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4321,7 +4409,7 @@ msgid "# hostlist downloads initiated"
 msgstr "# преузимања списка домаћина су започета"
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr "# милисекунди између преузимања списка домаћина"
@@ -4382,21 +4470,21 @@ msgstr "Грешка писања УРИ-а списка домаћина у д�
 msgid "# hostlist URIs written to file"
 msgstr "# УРИ-и списка домаћина су записани у датотеку"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr "Учење је укључено на овом парњаку\n"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr "Учење није укључено на овом парњаку\n"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4595,50 +4683,50 @@ msgstr ""
 msgid "Maintain egos"
 msgstr "Одржава егое"
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr "основнст није позната"
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr "основни је подешен, али его није познат (унутрашња грешка)"
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr "Нисам успео да запишем основну мапу одредника подсистема у „%s“.\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr "Непознат его је наведен за услугу (унутрашња грешка)"
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr "одредник се већ користи за други его"
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr "назив мете већ постоји"
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr "нисам нашао одговарајући его"
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "Нисам успео да обрадим податке егоа у „%s“\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr ""
 "Нисам успео да обрадим датотеку подешавања идентитета субсистема „%s“\n"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "Нисам успео да направим директоријум „%s“ за смештајне егое\n"
@@ -4678,7 +4766,7 @@ msgstr "Не могу да приступим датотеци „%s“: %s\n"
 msgid "No records found for `%s'"
 msgstr "Нисам нашао записе за „%s“"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr "\tОштећен или неподржан запис врсте %u\n"
@@ -4698,7 +4786,7 @@ msgstr "Неисправан јавни кључ за обратну претр�
 msgid "You must specify a name\n"
 msgstr "Морате навести назив\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr "назив записа за додавање/брисање/приказ"
@@ -4707,7 +4795,7 @@ msgstr "назив записа за додавање/брисање/прика�
 msgid "specifies the public key of the zone to look in"
 msgstr "наводи јавни кључ зоне за претраживање"
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 msgid "GNUnet zone manipulation tool"
 msgstr "Алат манипуслисања ГНУнет зоном"
@@ -4853,140 +4941,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr "Услуга регистрације назива Први Стиже Први Служи ГНУ Система Назива"
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr "Додавање записа није успело: %s\n"
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr "Брисање записа није успело, запис не постоји%s%s\n"
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr "Брисање записа није успело%s%s\n"
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, fuzzy, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr "Нема позива који би могао бити отказан управо сада.\n"
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Нисам успео да обрадим ДАНЕ запис: %s\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr "Нису дате опције\n"
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "Недостаје опција „%s“ за радњу „%s“\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "Неисправан надимак „%s“\n"
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr "додај"
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "Неподржана врста „%s“\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr "Вредност „%s“ је неисправна за врсту записа „%s“\n"
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "Неисправан формат времена „%s“\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr "обриши"
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr "Неисправан јавни кључ за обратну претрагу „%s“\n"
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "Неисправан УРИ „%s“\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4994,108 +5055,113 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "Не могу да се повежем са услугом идентитета\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "Недостаје функција „%s“ у прикључку преноса за „%s“\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Непозната наредба „%s“\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Неисправан формат за ИП: „%s“\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr "додаје запис"
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr "брише запис"
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr "приказује записе"
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr "време истека записа за коришћење (само за додавање), „never“ је могуће"
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 msgid "set the desired nick name for the zone"
 msgstr "поставља жељени назив надимка за зону"
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 msgid "monitor changes in the namestore"
 msgstr "прати измене у смештају назива"
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 msgid "determine our name for the given PKEY"
 msgstr "одређује наш назив за дати „PKEY“"
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr "врста записа за додавање/брисање/приказ"
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr "УРИ за увоз у нашу зону"
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr "вредност записа за додавање/брисање"
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr "ствара или исписује јавни запис"
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
 "прави сеновити запис (важи само ако су сви остали записи исте врсте истекли"
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr "назив егоа који контролише зону"
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr "Нисам успео да реплицирам блок у остави назива: %s\n"
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "# Неуспеси „СТАВИ“ смештаја података"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -5104,10 +5170,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr "Смештај назива није успео да смести запис\n"
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5699,6 +5761,51 @@ msgstr "Нисам успео да се повежем са „%s“ услуг�
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr "Демон за покретање за обављање превода ИП протокола у ГНУнет"
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "Неисправан УРИ „%s“\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6622,17 +6729,17 @@ msgstr ""
 "Број ивица које се могу успоставити приликом додавања новог чвора у "
 "слободном размештају лествице не може бити већи од %u.  Дато је „%s = %llu“"
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr "Нисам нашао датотеку размештаја „%s“\n"
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr "Датотека размештаја „%s“ нема података\n"
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr "Не могу да прочитам датотеку размештаја „%s“\n"
@@ -6847,7 +6954,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
 msgstr "Услузи преноса недостају поставке подешавања кључа. Излазим.\n"
@@ -8085,58 +8192,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr "Потребан је не-празан назив домаћина за услугу „%s“.\n"
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr "Порука „%.*s“ је поновљена %u пута у прошлости %s\n"
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "ГРЕШКА"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "УПОЗОРЕЊЕ"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "ПОДАЦИ"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "ПРОЧИШЋАВАЊЕ"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr "НИШТА"
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr "НЕИСПРАВНО"
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr "непозната адреса"
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr "неисправна адреса"
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr "Подешавање није успело да наведе опцију „%s“ у одељку „%s“!\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8288,17 +8395,17 @@ msgstr "Нисам успео да претворим УТФ-8 назив „%s�
 msgid "Could not bind to any port: %s\n"
 msgstr "Не могу да се вежем ни за један прикључник: %s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
-#, c-format
+#, fuzzy, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr "Примих ДНС одговор који је премали (%u бајта)"
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Нисам успео да пошаљем ДНС захтев за %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, c-format
 msgid "Sent DNS request to %s\n"
 msgstr "Послао сам ДНС захтев за %s\n"
@@ -8384,83 +8491,83 @@ msgid ""
 msgstr ""
 "Аргументи обавезни за дуге опције су такође обавезни за кратке опције.\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr ""
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr "ствара јединствене датотеке подешавања"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "Морате да проследите број опцији „%s“.\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "Морате да проследите релативно време опцији „%s“.\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "Морате да проследите релативно време опцији „%s“.\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "Морате да проследите релативно време опцији „%s“.\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "Морате да проследите број опцији „%s“.\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "Морате да проследите број опцији „%s“.\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8493,7 +8600,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "Управља ГНУнет датотекама подешавања"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8755,7 +8862,7 @@ msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
 "Не могу да скратим јуникс путању „%s“ док задржавам назив јединственим\n"
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8890,78 +8997,78 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr "Скупови знакова се захтевају где је „%s“–>„%s“\n"
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
 "Нисам успео да раширим „$HOME“: променљива окружења „HOME“ није постављена"
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr "ИПв6 адреса не почиње са [\n"
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr "ИПв6 адреса садржи : за раздвајање броја прикључника\n"
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr "ИПв6 адреса садржи ] пре : за раздвајање броја прикључника\n"
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr "ИПв6 адреса садржи исправан број прикључника након последње „:“\n"
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "Неисправна ИПв6 адреса „%s“: %s\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr "Прикључник није у опсегу\n"
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr "Лоша политика прикључника „%s“\n"
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "Неисправан формат за ИП: „%s“\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "Неисправна напомена мреже („/%d“ није исправно у ИПв4 ЦИДР-у)."
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "Неисправан формат: „%s“\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "Неисправна напомена мреже (не завршава се са „;“: „%s“)\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "Погрешан формат „%s“ за мрежну маску\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "Погрешан формат „%s“ за мрежу\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -9137,11 +9244,41 @@ msgstr "услуга се нуди путем УДП-ом"
 msgid "Setup tunnels via VPN."
 msgstr "Поставља тунеле путем ВПН-а."
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 msgid "Failed to connect to the namestore!\n"
 msgstr "Нисам успео да се повежем са смештајем назива!\n"
+#~ msgid "# items stored"
+#~ msgstr "# ставке су смештене"
+#, c-format
+#~ msgid "Loading `%s' datacache plugin\n"
+#~ msgstr "Учитавам прикључак „%s“ оставе података\n"
+#, c-format
+#~ msgid "Failed to load datacache plugin for `%s'\n"
+#~ msgstr "Нисам успео да учитам прикључак оставе података за „%s“\n"
+#~ msgid "# requests received"
+#~ msgstr "# захтеви су примљени"
+#~ msgid "# requests filtered by bloom filter"
+#~ msgstr "# захтеви су филтрирани блум филтером"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# претраге клијента су примљене"
+#~ msgid "write search results to file starting with PREFIX"
+#~ msgstr "пише резултате претраге у датотеку која почиње са ПРЕФИКСОМ"
+#~ msgid "automatically terminate search after DELAY"
+#~ msgstr "самостално окончава претрагу након ЗАСТОЈА"
+#~ msgid "Namestore failed to store record\n"
+#~ msgstr "Смештај назива није успео да смести запис\n"
 #, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# захтеви су примљени"
diff --git a/po/sv.po b/po/sv.po
index 267613776..d6dcda9e2 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNUnet 0.7.0b\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2006-01-21 17:16+0100\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv@listor.tp-sv.se>\n"
@@ -16,7 +16,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, fuzzy, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr "\"%s\": okänd tjänst: %s\n"
@@ -28,7 +28,7 @@ msgstr "Ogiltigt argument: \"%s\"\n"
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, fuzzy, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
@@ -628,45 +628,45 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr "Skriv ut information om GNUnets motparter."
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 #, fuzzy
 msgid "print logging"
 msgstr "Startade samling \"%s\".\n"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1568,42 +1568,7 @@ msgstr "# krypterade PONG-meddelanden mottagna"
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-#, fuzzy
-msgid "# bytes stored"
-msgstr "# byte krypterade"
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-#, fuzzy
-msgid "# items stored"
-msgstr "# byte krypterade"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, fuzzy, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/datacache/datacache.c:297
-#, fuzzy
-msgid "# requests received"
-msgstr "# byte mottogs via TCP"
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr ""
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# klartext PONG-meddelanden mottagna"
-#: src/datacache/plugin_datacache_heap.c:527
 msgid "Heap datacache running\n"
 msgstr ""
@@ -1625,7 +1590,7 @@ msgstr ""
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "\"%s\" misslyckades vid %s:%d med fel: %s\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1816,6 +1781,11 @@ msgstr ""
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+#, fuzzy
+msgid "# bytes stored"
+msgstr "# byte krypterade"
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -2003,7 +1973,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 msgid "Sqlite database running\n"
 msgstr ""
@@ -2011,56 +1981,65 @@ msgstr ""
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
 "%.*s\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
-#, fuzzy
+#: src/dht/gnunet-dht-monitor.c:255
+#, fuzzy, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2100,10 +2079,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2160,17 +2135,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr "Kan inte tillgå tjänsten"
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, fuzzy, c-format
 msgid "Block not of type %u\n"
 msgstr "Ingen transport av typ %d är känd.\n"
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2907,20 +2882,20 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Ogiltigt argument: \"%s\"\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr ""
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr "Inga nyckelord angivna!\n"
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr ""
@@ -3049,7 +3024,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr "Uppladdning vägrades!"
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr ""
@@ -3073,12 +3048,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, fuzzy, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "Misslyckades att initiera tjänsten \"%s\".\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr ""
@@ -3086,7 +3061,7 @@ msgstr ""
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr ""
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3330,40 +3305,112 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, fuzzy, c-format
 msgid "Error searching: %s.\n"
 msgstr "Fel vid lämning av DHT.\n"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 #, fuzzy
 msgid "Could not create keyword URI from arguments.\n"
 msgstr "Kunde inte skapa namnrymd \"%s\" (existerar?).\n"
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "Misslyckades att initiera tjänsten \"%s\".\n"
+#: src/fs/gnunet-search.c:668
 #, fuzzy
 msgid "Could not start searching.\n"
 msgstr "Kunde inte skapa namnrymd \"%s\" (existerar?).\n"
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:700
-msgid "automatically terminate search after DELAY"
+msgid "do not search, print only the URI that points to this search"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
+msgstr ""
+#: src/fs/gnunet-search.c:725
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
+msgstr ""
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+msgid "Search for files that have been published on GNUnet\n"
 msgstr ""
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3715,68 +3762,73 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Ogiltiga argument. Avslutar.\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Kunde inte skapa namnrymd \"%s\" (existerar?).\n"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 #, fuzzy
 msgid "Failed to start HTTP server\n"
 msgstr "Misslyckades att starta samling.\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 #, fuzzy
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, fuzzy, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, fuzzy, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr "Mottog ogiltig \"%s\" begäran (storlek %d)\n"
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, fuzzy, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr "Mottog okänd typ av begäran %d vid %s:%d\n"
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 #, fuzzy
 msgid "No DNS server specified!\n"
 msgstr "Inga nyckelord angivna!\n"
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -3958,19 +4010,19 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "Spåra GNUnets nätverkstopologi."
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "Ogiltigt argument: \"%s\"\n"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 #, fuzzy
 msgid "Failed to connect to the namecache!\n"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 #, fuzzy
 msgid "Could not connect to DHT!\n"
 msgstr "Kunde inte ansluta till gnunetd.\n"
@@ -3984,95 +4036,98 @@ msgstr ""
 msgid "Failed to connect to the DNS service!\n"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 #, fuzzy
 msgid "Failed to parse DNS response\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "%d filer hittades i katalog.\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, fuzzy, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, fuzzy, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr "Kunde inte tolka konfigurationsfil \"%s\".\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, fuzzy, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
@@ -4082,6 +4137,34 @@ msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
 msgid "Gns REST API initialized\n"
 msgstr " Anslutning misslyckades\n"
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, fuzzy, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4328,7 +4411,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4387,21 +4470,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4592,49 +4675,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, fuzzy, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, fuzzy, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, fuzzy, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr "Kunde inte spara konfigurationsfil \"%s\":"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, fuzzy, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
@@ -4675,7 +4758,7 @@ msgstr "Kunde inte köra \"%s\": %s\n"
 msgid "No records found for `%s'"
 msgstr "%d filer hittades i katalog.\n"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4695,7 +4778,7 @@ msgstr "Ogiltigt argument: \"%s\"\n"
 msgid "You must specify a name\n"
 msgstr "Du måste ange en mottagare!\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4704,7 +4787,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr "ange prioritet för innehållet"
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 #, fuzzy
 msgid "GNUnet zone manipulation tool"
 msgstr "GNUnet-konfiguration"
@@ -4852,146 +4935,119 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, fuzzy, c-format
 msgid "Adding record failed: %s\n"
 msgstr ""
 "\n"
 "Fel vid uppladdning av fil: %s\n"
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, fuzzy, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr ""
 "\n"
 "Fel vid uppladdning av fil: %s\n"
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, fuzzy, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr ""
 "\n"
 "Fel vid uppladdning av fil: %s\n"
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, fuzzy, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "Konfigurationsfil \"%s\" skapad.\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, fuzzy, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "Ogiltiga argument: "
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, fuzzy, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "Kommando \"%s\" stöds ej.  Avbryter.\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, fuzzy, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr "%s: symbolvärde \"%s\" ogiltigt för %s\n"
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, fuzzy, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "Ogiltigt format för IP: \"%s\"\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, fuzzy, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr "Ogiltigt argument: \"%s\"\n"
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, fuzzy, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "Ogiltiga argument: "
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4999,111 +5055,116 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, fuzzy, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr "Onödiga argument (ignorerade).\n"
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, fuzzy, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "Kunde inte ansluta till gnunetd.\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "Kunde inte slå upp \"%s\": %s\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Okänd operation \"%s\"\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Ogiltigt format för IP: \"%s\"\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 #, fuzzy
 msgid "set the desired nick name for the zone"
 msgstr "Skriv ut information om GNUnets motparter."
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 #, fuzzy
 msgid "monitor changes in the namestore"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 #, fuzzy
 msgid "determine our name for the given PKEY"
 msgstr "Skriv ut information om GNUnets motparter."
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 #, fuzzy
 msgid "name of the ego controlling the zone"
 msgstr "Visa värde av alternativet"
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, fuzzy, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "gnunet-update misslyckades!"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -5112,10 +5173,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5714,6 +5771,51 @@ msgstr "Misslyckades att initiera tjänsten \"%s\".\n"
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "Ogiltiga argument: "
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6611,17 +6713,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, fuzzy, c-format
 msgid "Topology file %s not found\n"
 msgstr "\"%s\" misslyckades: tabell hittades inte!\n"
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr ""
@@ -6828,7 +6930,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 #, fuzzy
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
@@ -8075,58 +8177,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr ""
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "FEL"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "VARNING"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr "MEDDELANDE"
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "INFO"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "FELSÖKNING"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr ""
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr ""
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr ""
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr ""
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, fuzzy, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr "Konfigurationsfil \"%s\" skapad.\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, fuzzy, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8273,17 +8375,17 @@ msgstr "Misslyckades att leverera \"%s\" meddelande.\n"
 msgid "Could not bind to any port: %s\n"
 msgstr "Kunde inte köra \"%s\": %s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, fuzzy, c-format
 msgid "Sent DNS request to %s\n"
 msgstr "Misslyckades att skicka HTTP-begäran till värd \"%s\": %s\n"
@@ -8370,83 +8472,83 @@ msgstr ""
 "Argument som är obligatoriska för långa flaggor är också obligatoriska för "
 "korta flaggor.\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr "skriv ut denna hjälp"
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr "var informativ"
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr "skriv ut ett värde från konfigurationsfilen till standard ut"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, fuzzy, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "Du måste skicka med ett nummer till flaggan \"%s\".\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8480,7 +8582,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "skriv ut ett värde från konfigurationsfilen till standard ut"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8734,7 +8836,7 @@ msgstr "Fel vid skapandet av användare"
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8864,77 +8966,77 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr ""
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, fuzzy, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "Ogiltigt svar på \"%s\".\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, fuzzy, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr "Misslyckades att starta samling.\n"
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "Ogiltigt format för IP: \"%s\"\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "Ogiltig nätverksnotation (\"/%d\" är inte giltig i IPv4 CIDR)."
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, fuzzy, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "Ogiltigt format för IP: \"%s\"\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "Ogiltig nätverksnotation (slutar inte med \";\": \"%s\")\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, fuzzy, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "Fel format \"%s\" för nätmask: %s\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, fuzzy, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "Fel format \"%s\" för nätverk: %s\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -9118,13 +9220,29 @@ msgstr "# byte mottagna via UDP"
 msgid "Setup tunnels via VPN."
 msgstr ""
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 #, fuzzy
 msgid "Failed to connect to the namestore!\n"
 msgstr "Misslyckades att ansluta till gnunetd.\n"
 #, fuzzy
+#~ msgid "# items stored"
+#~ msgstr "# byte krypterade"
+#, fuzzy, c-format
+#~ msgid "Failed to load datacache plugin for `%s'\n"
+#~ msgstr "Misslyckades att läsa kompislista från \"%s\"\n"
+#, fuzzy
+#~ msgid "# requests received"
+#~ msgstr "# byte mottogs via TCP"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# klartext PONG-meddelanden mottagna"
+#, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# byte mottogs via TCP"
@@ -10546,10 +10664,6 @@ msgstr "Misslyckades att ansluta till gnunetd.\n"
 #~ msgstr "Filen \"%s\" innehåller ingen pseudonym.\n"
 #, fuzzy
-#~ msgid "gnunet-ecc failed"
-#~ msgstr "gnunet-update misslyckades!"
-#, fuzzy
 #~ msgid ""
 #~ "File `%s' does not contain a valid private key (too long, %llu bytes).  "
 #~ "Renaming it.\n"
diff --git a/po/vi.po b/po/vi.po
index a24e83e72..7d8ac0adf 100644
--- a/po/vi.po
+++ b/po/vi.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet 0.8.0a\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2008-09-10 22:05+0930\n"
 "Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
 "Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
@@ -19,7 +19,7 @@ msgstr ""
 "Plural-Forms: nplurals=1; plural=0;\n"
 "X-Generator: LocFactoryEditor 1.7b3\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr ""
@@ -31,7 +31,7 @@ msgstr "Đối số không hợp lệ cho « %s ».\n"
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, fuzzy, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "Không kết nối được đến trình nền gnunetd."
@@ -636,45 +636,45 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr "In ra thông tin về các đồng đẳng GNUnet."
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 #, fuzzy
 msgid "print logging"
 msgstr "Theo dõi"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1576,42 +1576,7 @@ msgstr "# các thông báo phát hiện dht được nhận"
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-#, fuzzy
-msgid "# bytes stored"
-msgstr "# các byte trong kho dữ liệu"
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-#, fuzzy
-msgid "# items stored"
-msgstr "# các byte trong kho dữ liệu"
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, fuzzy, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr "Lỗi cập nhật dữ liệu cho mô-đun « %s »\n"
-#: src/datacache/datacache.c:297
-#, fuzzy
-msgid "# requests received"
-msgstr "# các yêu cầu get (lấy) dht được nhận"
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr "# các yêu cầu được lọc theo bộ lọc bloom"
-#: src/datacache/datacache.c:329
-#, fuzzy
-msgid "# proximity search requests received"
-msgstr "# các yêu cầu khách lỗ hổng được nhận"
-#: src/datacache/plugin_datacache_heap.c:527
 #, fuzzy
 msgid "Heap datacache running\n"
 msgstr "kho dữ liệu sqlite"
@@ -1634,7 +1599,7 @@ msgstr "kho dữ liệu sqlite"
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "« %s » bị lỗi tại %s:%d với lỗi: %s\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1831,6 +1796,11 @@ msgstr ""
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+#, fuzzy
+msgid "# bytes stored"
+msgstr "# các byte trong kho dữ liệu"
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -2023,7 +1993,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 #, fuzzy
 msgid "Sqlite database running\n"
 msgstr "kho dữ liệu sqlite"
@@ -2032,56 +2002,65 @@ msgstr "kho dữ liệu sqlite"
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
 "%.*s\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
-#, fuzzy
+#: src/dht/gnunet-dht-monitor.c:255
+#, fuzzy, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "Lỗi kết nối đến gnunetd.\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2121,10 +2100,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2181,17 +2156,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr "Không thể truy cập đến dịch vụ"
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, fuzzy, c-format
 msgid "Block not of type %u\n"
 msgstr "Không biết truyền tải nào kiểu %d.\n"
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2926,20 +2901,20 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "Đối số không hợp lệ cho « %s ».\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr ""
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr "Chưa ghi rõ từ khoá.\n"
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr "Có dấu nháy kép thừa hay thiếu.\n"
@@ -3067,7 +3042,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr "Tiến trình tải lên « %s » đã tiếp tục lại.\n"
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, fuzzy, c-format
 msgid "Unexpected status: %d\n"
 msgstr "Gặp sự kiện bất thường: %d\n"
@@ -3091,12 +3066,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, fuzzy, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "Lỗi sơ khởi dịch vụ « %s ».\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 #, fuzzy
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr "đặt CẤP mong muốn của tình trạng nặc danh của người gửi"
@@ -3105,7 +3080,7 @@ msgstr "đặt CẤP mong muốn của tình trạng nặc danh của người g
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr "xoá việc tải về không hoàn thành (khi hủy bở dùng CTRL-C)"
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3365,41 +3340,114 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, fuzzy, c-format
 msgid "Error searching: %s.\n"
 msgstr "Gặp lỗi khi tải xuống: %s\n"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 #, fuzzy
 msgid "Could not create keyword URI from arguments.\n"
 msgstr "Không thể tạo miền tên.\n"
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "Lỗi sơ khởi dịch vụ « %s ».\n"
+#: src/fs/gnunet-search.c:668
 #, fuzzy
 msgid "Could not start searching.\n"
 msgstr "Không thể tạo miền tên.\n"
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+#, fuzzy
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr "đặt CẤP mong muốn của tình trạng nặc danh của người gửi"
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:717
-msgid "automatically terminate search after DELAY"
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:725
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
+msgstr ""
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
 #, fuzzy
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid "Search for files that have been published on GNUnet\n"
 msgstr "Không hiển thị kết quả tìm kiếm cho tập tin được chúng ta tải lên"
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3760,68 +3808,73 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "Đối số không hợp lệ cho « %s ».\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "Không thể tạo tài khoản người dùng cho trình nền."
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 #, fuzzy
 msgid "Failed to start HTTP server\n"
 msgstr "Lỗi bắt đầu thu thập.\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 #, fuzzy
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, fuzzy, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr "Nhận yêu cầu định tuyến\n"
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, fuzzy, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr "Nhận yêu cầu định tuyến\n"
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 #, fuzzy
 msgid "No DNS server specified!\n"
 msgstr "Chưa ghi rõ từ khoá.\n"
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -4003,19 +4056,19 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "Bản ghi lỗi GNUnet"
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "Đối số không hợp lệ cho « %s ».\n"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 #, fuzzy
 msgid "Failed to connect to the namecache!\n"
 msgstr "Không kết nối được đến trình nền gnunetd."
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 #, fuzzy
 msgid "Could not connect to DHT!\n"
 msgstr "Không thể kết nối tới %s:%u: %s\n"
@@ -4030,95 +4083,98 @@ msgstr "Gặp lỗi khi chuyển đổi các đối số sang URI.\n"
 msgid "Failed to connect to the DNS service!\n"
 msgstr "Lỗi kết nối đến gnunetd.\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 #, fuzzy
 msgid "Failed to parse DNS response\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "Vẫn còn không tìm thấy đồng đẳng trong « %s ».\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, fuzzy, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, fuzzy, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr "Không thể truy cập đến tập tin gnunet-directory « %s »\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, fuzzy, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
@@ -4128,6 +4184,34 @@ msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
 msgid "Gns REST API initialized\n"
 msgstr "Lỗi sơ khởi lõi.\n"
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, fuzzy, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4378,7 +4462,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4439,21 +4523,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr "# các byte danh sách máy được trả về"
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4651,49 +4735,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, fuzzy, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, fuzzy, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, fuzzy, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr "Không thể lưu tập tin cấu hình « %s »:"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, fuzzy, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "Lỗi đọc danh sách bạn bè từ « %s »\n"
@@ -4734,7 +4818,7 @@ msgstr "Không thể truy cập đến « %s »: %s\n"
 msgid "No records found for `%s'"
 msgstr "Vẫn còn không tìm thấy đồng đẳng trong « %s ».\n"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4754,7 +4838,7 @@ msgstr "Đối số không hợp lệ cho « %s ».\n"
 msgid "You must specify a name\n"
 msgstr "Phải ghi rõ tên hiệu\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4763,7 +4847,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr "xác định mức ưu tiên của nội dung"
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 #, fuzzy
 msgid "GNUnet zone manipulation tool"
 msgstr "Cấu hình GNUnet"
@@ -4912,140 +4996,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, fuzzy, c-format
 msgid "Adding record failed: %s\n"
 msgstr "Gặp lỗi khi tải lên tập tin: %s\n"
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, fuzzy, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr "Gặp lỗi khi tải lên tập tin: %s\n"
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, fuzzy, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr "Gặp lỗi khi tải lên tập tin: %s\n"
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, fuzzy, c-format
 msgid "No options given\n"
 msgstr "chưa đưa ra tên"
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, fuzzy, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "Giá trị cấu hình « %s » cho « %s » trong phần « %s » nên là con số\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, fuzzy, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "Dữ liệu nhập không hợp lệ.\n"
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, fuzzy, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "Lệnh không được hỗ trợ « %s ». Đang hủy bỏ.\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, fuzzy, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "Địa chỉ IP định dạng sai: %s\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, fuzzy, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr "Đối số không hợp lệ cho « %s ».\n"
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, fuzzy, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "Dữ liệu nhập không hợp lệ.\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -5053,110 +5110,115 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, fuzzy, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "Không thể kết nối tới %s:%u: %s\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "Không thể nạp phần bổ sung truyền tải « %s »\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "Không rõ câu lệnh « %s ».\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "Địa chỉ IP định dạng sai: %s\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 #, fuzzy
 msgid "set the desired nick name for the zone"
 msgstr "In ra thông tin về các đồng đẳng GNUnet."
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 #, fuzzy
 msgid "monitor changes in the namestore"
 msgstr "Không kết nối được đến trình nền gnunetd."
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 #, fuzzy
 msgid "determine our name for the given PKEY"
 msgstr "In ra thông tin về các đồng đẳng GNUnet."
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr ""
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, fuzzy, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr "Lỗi cập nhật dữ liệu cho mô-đun « %s »\n"
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "Kho dữ liệu đầy.\n"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -5165,10 +5227,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5769,6 +5827,51 @@ msgstr "Lỗi sơ khởi dịch vụ « %s ».\n"
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "Dữ liệu nhập không hợp lệ.\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6665,17 +6768,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, fuzzy, c-format
 msgid "Topology file %s not found\n"
 msgstr "Khoá phiên chạy từ đồng đẳng « %s » không thể được thẩm tra.\n"
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, fuzzy, c-format
 msgid "Topology file %s has no data\n"
 msgstr "Khoá phiên chạy từ đồng đẳng « %s » không thể được thẩm tra.\n"
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, fuzzy, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr "Khoá phiên chạy từ đồng đẳng « %s » không thể được thẩm tra.\n"
@@ -6888,7 +6991,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 #, fuzzy
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
@@ -8128,59 +8231,59 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, fuzzy, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr "Thông điệp « %.*s » đã lặp lại %u lần trong %llu giây trước\n"
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "LỖI"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "CẢNH BÁO"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "TIN"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "GỠ LỖI"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr ""
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr ""
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr ""
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr ""
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, fuzzy, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr ""
 "Cấu hình không thỏa mãn các ràng buộc của tập tin đặc tả cấu hình « %s ».\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, fuzzy, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8330,17 +8433,17 @@ msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
 msgid "Could not bind to any port: %s\n"
 msgstr "Không tìm thấy địa chỉ IP của máy « %s »: %s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, fuzzy, c-format
 msgid "Sent DNS request to %s\n"
 msgstr "Lỗi mở tập tin ghi sự kiện « %s »: %s\n"
@@ -8428,84 +8531,84 @@ msgstr ""
 "Mọi đối số bắt buộc phải sử dụng với tùy chọn dài cũng bắt buộc với tùy chọn "
 "ngắn.\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr "hiển thị trợ giúp này"
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr "xuất chi tiết"
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr "cấu hình chức năng ghi sự kiện để dùng CẤP_GHI_LƯU"
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 #, fuzzy
 msgid "configure logging to write logs to FILENAME"
 msgstr "cấu hình chức năng ghi sự kiện để dùng CẤP_GHI_LƯU"
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr "cập nhật một giá trị trong tập tin cấu hình"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, fuzzy, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "Phải gửi một con số cho tùy chọn « %s ».\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8539,7 +8642,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "cập nhật một giá trị trong tập tin cấu hình"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8792,7 +8895,7 @@ msgstr "Gặp lỗi khi tạo người dùng"
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8920,78 +9023,78 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr ""
 "Lỗi mở rộng biến môi trường « $HOME »: chưa đặt biến môi trường « HOME »"
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr ""
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, fuzzy, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "Mức ưu tiên tiến trình không hợp lê « %s ».\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, fuzzy, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr "Lỗi bắt đầu thu thập.\n"
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "Địa chỉ IP định dạng sai: %s\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "Ký hiệu mạng sai (« /%d » không hợp lệ trong CIDR IPv4)."
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, fuzzy, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "Địa chỉ IP định dạng sai: %s\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "Ký hiệu mạng sai (không kết thúc với « ; »: « %s »)\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, fuzzy, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "Mặt nạ mạng có định dạng sai « %s »: %s\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, fuzzy, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "Mạng có định dạng sai « %s »: %s\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -9175,13 +9278,32 @@ msgstr "# các byte đã nhận qua UDP"
 msgid "Setup tunnels via VPN."
 msgstr ""
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 #, fuzzy
 msgid "Failed to connect to the namestore!\n"
 msgstr "Không kết nối được đến trình nền gnunetd."
 #, fuzzy
+#~ msgid "# items stored"
+#~ msgstr "# các byte trong kho dữ liệu"
+#, fuzzy, c-format
+#~ msgid "Failed to load datacache plugin for `%s'\n"
+#~ msgstr "Lỗi cập nhật dữ liệu cho mô-đun « %s »\n"
+#, fuzzy
+#~ msgid "# requests received"
+#~ msgstr "# các yêu cầu get (lấy) dht được nhận"
+#~ msgid "# requests filtered by bloom filter"
+#~ msgstr "# các yêu cầu được lọc theo bộ lọc bloom"
+#, fuzzy
+#~ msgid "# proximity search requests received"
+#~ msgstr "# các yêu cầu khách lỗ hổng được nhận"
+#, fuzzy
 #~ msgid "# requests for random value received"
 #~ msgstr "# tổng số yêu cầu lỗ hổng được nhận"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index a7784f73d..dedd6914a 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnunet-0.8.1\n"
 "Report-Msgid-Bugs-To: gnunet-developers@mail.gnu.org\n"
-"POT-Creation-Date: 2022-01-10 15:13+0100\n"
+"POT-Creation-Date: 2022-03-04 22:23+0100\n"
 "PO-Revision-Date: 2011-07-09 12:12+0800\n"
 "Last-Translator: Wylmer Wang <wantinghard@gmail.com>\n"
 "Language-Team: Chinese (simplified) <i18n-zh@googlegroups.com>\n"
@@ -16,7 +16,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1304
+#: src/abd/gnunet-abd.c:392 src/namestore/gnunet-namestore.c:1254
 #, c-format
 msgid "Ego `%s' not known to identity service\n"
 msgstr ""
@@ -28,7 +28,7 @@ msgstr "“%s”的参数无效。\n"
 #: src/abd/gnunet-abd.c:558 src/abd/gnunet-service-abd.c:1751
 #: src/namestore/gnunet-namestore-fcfsd.c:1080
-#: src/namestore/gnunet-namestore.c:1001
+#: src/namestore/gnunet-namestore.c:951
 #, fuzzy, c-format
 msgid "Failed to connect to namestore\n"
 msgstr "初始化“%s”服务失败。\n"
@@ -619,45 +619,45 @@ msgstr ""
 msgid "Print information about ATS state"
 msgstr "无法获取有关用户“%s”的信息：%s\n"
-#: src/ats/gnunet-ats-solver-eval.c:2992 src/ats/gnunet-ats-solver-eval.c:3044
+#: src/ats/gnunet-ats-solver-eval.c:2993 src/ats/gnunet-ats-solver-eval.c:3045
 #, c-format
 msgid ""
 "Could not load quota for network `%s':  `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3011
+#: src/ats/gnunet-ats-solver-eval.c:3012
 #, c-format
 msgid ""
 "No outbound quota configured for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3063
+#: src/ats/gnunet-ats-solver-eval.c:3064
 #, c-format
 msgid ""
 "No outbound quota configure for network `%s', assigning default bandwidth "
 "%llu\n"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3552
+#: src/ats/gnunet-ats-solver-eval.c:3553
 msgid "solver to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3557
+#: src/ats/gnunet-ats-solver-eval.c:3558
 msgid "experiment to use"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3564
+#: src/ats/gnunet-ats-solver-eval.c:3565
 #, fuzzy
 msgid "print logging"
 msgstr "未知的命令“%s”。\n"
-#: src/ats/gnunet-ats-solver-eval.c:3569
+#: src/ats/gnunet-ats-solver-eval.c:3570
 msgid "save logging to disk"
 msgstr ""
-#: src/ats/gnunet-ats-solver-eval.c:3574
+#: src/ats/gnunet-ats-solver-eval.c:3575
 msgid "disable normalization"
 msgstr ""
@@ -1522,38 +1522,7 @@ msgstr ""
 msgid "# updates to my type map"
 msgstr ""
-#: src/datacache/datacache.c:117 src/datacache/datacache.c:275
+#: src/datacache/plugin_datacache_heap.c:555
-#: src/datastore/gnunet-service-datastore.c:743
-msgid "# bytes stored"
-msgstr ""
-#: src/datacache/datacache.c:121 src/datacache/datacache.c:279
-msgid "# items stored"
-msgstr ""
-#: src/datacache/datacache.c:185
-#, c-format
-msgid "Loading `%s' datacache plugin\n"
-msgstr ""
-#: src/datacache/datacache.c:203
-#, c-format
-msgid "Failed to load datacache plugin for `%s'\n"
-msgstr ""
-#: src/datacache/datacache.c:297
-msgid "# requests received"
-msgstr ""
-#: src/datacache/datacache.c:308
-msgid "# requests filtered by bloom filter"
-msgstr ""
-#: src/datacache/datacache.c:329
-msgid "# proximity search requests received"
-msgstr ""
-#: src/datacache/plugin_datacache_heap.c:527
 #, fuzzy
 msgid "Heap datacache running\n"
 msgstr "sqlite 数据仓库"
@@ -1576,7 +1545,7 @@ msgstr "sqlite 数据仓库"
 msgid "`%s' failed at %s:%d with error: %s\n"
 msgstr "“%s”于 %s:%d 处失败，错误为：%s\n"
-#: src/datacache/plugin_datacache_sqlite.c:693
+#: src/datacache/plugin_datacache_sqlite.c:723
 #: src/datastore/plugin_datastore_sqlite.c:531
 #: src/namecache/plugin_namecache_sqlite.c:237
 #: src/namestore/plugin_namestore_sqlite.c:273
@@ -1761,6 +1730,10 @@ msgstr ""
 msgid "Could not find matching reservation"
 msgstr ""
+#: src/datastore/gnunet-service-datastore.c:743
+msgid "# bytes stored"
+msgstr ""
 #: src/datastore/gnunet-service-datastore.c:758
 #, c-format
 msgid "Need %llu bytes more space (%llu allowed, using %llu)\n"
@@ -1945,7 +1918,7 @@ msgstr ""
 #: src/datastore/plugin_datastore_sqlite.c:1337
 #: src/namecache/plugin_namecache_sqlite.c:564
-#: src/namestore/plugin_namestore_sqlite.c:765
+#: src/namestore/plugin_namestore_sqlite.c:775
 #, fuzzy
 msgid "Sqlite database running\n"
 msgstr "sqlite 数据仓库"
@@ -1954,56 +1927,65 @@ msgstr "sqlite 数据仓库"
 msgid "Template database running\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:159
+#: src/dht/gnunet-dht-get.c:164
 #, c-format
 msgid ""
 "Result %d, type %d:\n"
 "%.*s\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:160
+#: src/dht/gnunet-dht-get.c:165
 #, c-format
 msgid "Result %d, type %d:\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:209
+#: src/dht/gnunet-dht-get.c:215
 msgid "Must provide key for DHT GET!\n"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:217 src/dht/gnunet-dht-monitor.c:255
+#: src/dht/gnunet-dht-get.c:223 src/dht/gnunet-dht-hello.c:119
-#, fuzzy
+#: src/dht/gnunet-dht-monitor.c:255
+#, fuzzy, c-format
 msgid "Failed to connect to DHT service!\n"
 msgstr "初始化“%s”服务失败。\n"
-#: src/dht/gnunet-dht-get.c:227
+#: src/dht/gnunet-dht-get.c:233
 msgid "Issuing DHT GET with key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:260 src/dht/gnunet-dht-monitor.c:302
+#: src/dht/gnunet-dht-get.c:269 src/dht/gnunet-dht-monitor.c:302
 #: src/dht/gnunet-dht-put.c:200
 msgid "the query key"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:266
+#: src/dht/gnunet-dht-get.c:275
 msgid "how many parallel requests (replicas) to create"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:272 src/dht/gnunet-dht-monitor.c:308
+#: src/dht/gnunet-dht-get.c:280 src/dht/gnunet-dht-put.c:217
+msgid "use DHT's record route option"
+msgstr ""
+#: src/dht/gnunet-dht-get.c:286 src/dht/gnunet-dht-monitor.c:308
 msgid "the type of data to look for"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:278
+#: src/dht/gnunet-dht-get.c:292
 msgid "how long to execute this query before giving up?"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:284 src/dht/gnunet-dht-put.c:206
+#: src/dht/gnunet-dht-get.c:298 src/dht/gnunet-dht-put.c:206
 msgid "use DHT's demultiplex everywhere option"
 msgstr ""
-#: src/dht/gnunet-dht-get.c:301
+#: src/dht/gnunet-dht-get.c:315
 msgid "Issue a GET request to the GNUnet DHT, prints results."
 msgstr ""
+#: src/dht/gnunet-dht-hello.c:166
+msgid "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"
+msgstr ""
 #: src/dht/gnunet-dht-monitor.c:315
 msgid "how long should the monitor command run"
 msgstr ""
@@ -2043,10 +2025,6 @@ msgstr ""
 msgid "how many replicas to create"
 msgstr ""
-#: src/dht/gnunet-dht-put.c:217
-msgid "use DHT's record route option"
-msgstr ""
 #: src/dht/gnunet-dht-put.c:223
 msgid "the type to insert data as"
 msgstr ""
@@ -2103,17 +2081,17 @@ msgstr ""
 msgid "Measure quality and performance of the DHT service."
 msgstr "无法访问该服务"
-#: src/dht/plugin_block_dht.c:328
+#: src/dht/plugin_block_dht.c:404
 #, c-format
 msgid "Block not of type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:337
+#: src/dht/plugin_block_dht.c:413
 #, c-format
 msgid "Size mismatch for block with type %u\n"
 msgstr ""
-#: src/dht/plugin_block_dht.c:348
+#: src/dht/plugin_block_dht.c:424
 #, c-format
 msgid "Block of type %u is malformed\n"
 msgstr ""
@@ -2820,20 +2798,20 @@ msgstr ""
 msgid "LOC URI malformed (signature failed validation)"
 msgstr ""
-#: src/fs/fs_uri.c:653
+#: src/fs/fs_uri.c:652
 #, fuzzy
 msgid "invalid argument"
 msgstr "“%s”的参数无效。\n"
-#: src/fs/fs_uri.c:665
+#: src/fs/fs_uri.c:671
 msgid "Unrecognized URI type"
 msgstr ""
-#: src/fs/fs_uri.c:1071 src/fs/fs_uri.c:1098
+#: src/fs/fs_uri.c:1075 src/fs/fs_uri.c:1102
 msgid "No keywords specified!\n"
 msgstr ""
-#: src/fs/fs_uri.c:1104
+#: src/fs/fs_uri.c:1108
 msgid "Number of double-quotes not balanced!\n"
 msgstr ""
@@ -2960,7 +2938,7 @@ msgid "Downloading `%s' done (%s/s).\n"
 msgstr ""
 #: src/fs/gnunet-download.c:206 src/fs/gnunet-publish.c:299
-#: src/fs/gnunet-search.c:229 src/fs/gnunet-unindex.c:117
+#: src/fs/gnunet-search.c:538 src/fs/gnunet-unindex.c:117
 #, c-format
 msgid "Unexpected status: %d\n"
 msgstr ""
@@ -2984,12 +2962,12 @@ msgid "Target filename must be specified.\n"
 msgstr ""
 #: src/fs/gnunet-download.c:271 src/fs/gnunet-publish.c:869
-#: src/fs/gnunet-search.c:294 src/fs/gnunet-unindex.c:154
+#: src/fs/gnunet-unindex.c:154
 #, fuzzy, c-format
 msgid "Could not initialize `%s' subsystem.\n"
 msgstr "初始化“%s”服务失败。\n"
-#: src/fs/gnunet-download.c:318 src/fs/gnunet-search.c:334
+#: src/fs/gnunet-download.c:318
 msgid "set the desired LEVEL of receiver-anonymity"
 msgstr ""
@@ -2997,7 +2975,7 @@ msgstr ""
 msgid "delete incomplete downloads (when aborted with CTRL-C)"
 msgstr ""
-#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:339
+#: src/fs/gnunet-download.c:330 src/fs/gnunet-search.c:740
 msgid "only search the local peer (no P2P network search)"
 msgstr ""
@@ -3235,38 +3213,110 @@ msgstr ""
 msgid "Publish a file or directory on GNUnet"
 msgstr ""
-#: src/fs/gnunet-search.c:130
+#: src/fs/gnunet-search.c:441
 #, c-format
 msgid "Failed to write directory with search results to `%s'\n"
 msgstr ""
-#: src/fs/gnunet-search.c:219
+#: src/fs/gnunet-search.c:527
 #, fuzzy, c-format
 msgid "Error searching: %s.\n"
 msgstr "创建用户出错"
-#: src/fs/gnunet-search.c:281
+#: src/fs/gnunet-search.c:587
+#, c-format
+msgid "Conflicting options --bookmark-only and --silent.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:594
+#, c-format
+msgid "Conflicting options --bookmark-only and --output.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:600
+#, c-format
+msgid "An output file is mandatory for silent mode.\n"
+msgstr ""
+#: src/fs/gnunet-search.c:621
 msgid "Could not create keyword URI from arguments.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:308
+#: src/fs/gnunet-search.c:629
+msgid ""
+"Invalid URI. Valid URIs for searching are keyword query URIs\n"
+"(\"gnunet://fs/ksk/...\") and namespace content URIs (\"gnunet://fs/sks/..."
+"\").\n"
+msgstr ""
+#: src/fs/gnunet-search.c:654
+#, fuzzy, c-format
+msgid "Could not initialize the `%s` subsystem.\n"
+msgstr "初始化“%s”服务失败。\n"
+#: src/fs/gnunet-search.c:668
 msgid "Could not start searching.\n"
 msgstr ""
-#: src/fs/gnunet-search.c:345
+#: src/fs/gnunet-search.c:694
-msgid "write search results to file starting with PREFIX"
+msgid "set the desired LEVEL of receiver-anonymity (default: 1)"
+msgstr ""
+#: src/fs/gnunet-search.c:700
+msgid "do not search, print only the URI that points to this search"
+msgstr ""
+#: src/fs/gnunet-search.c:707
+msgid ""
+"write search results for directories according to FORMAT; accepted "
+"placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults to the value of --"
+"printf when omitted or to `"
+msgstr ""
+#: src/fs/gnunet-search.c:717
+msgid ""
+"write search results according to FORMAT; accepted placeholders are: %a, %f, "
+"%j, %l, %m, %n, %s; defaults to `"
 msgstr ""
-#: src/fs/gnunet-search.c:351
+#: src/fs/gnunet-search.c:725
-msgid "automatically terminate search after DELAY"
+msgid ""
+"when the %a or %j placeholders appear in --printf or --dir-printf, list each "
+"metadata property according to FORMAT; accepted placeholders are: %i, %l, "
+"%n, %p"
 msgstr ""
-#: src/fs/gnunet-search.c:357
+#: src/fs/gnunet-search.c:734
 msgid "automatically terminate search after VALUE results are found"
 msgstr ""
-#: src/fs/gnunet-search.c:371
+#: src/fs/gnunet-search.c:746
-msgid "Search GNUnet for files that were published on GNUnet"
+msgid ""
+"create a GNUnet directory with search results at FILENAME (e.g. `gnunet-"
+"search --output=commons"
+msgstr ""
+#: src/fs/gnunet-search.c:753
+msgid "silent mode (requires the --output argument)"
+msgstr ""
+#: src/fs/gnunet-search.c:759
+msgid ""
+"automatically terminate search after DELAY; the value given must be a number "
+"followed by a space and a time unit, for example \"500 ms\"; without a unit "
+"it defaults to microseconds - 1000000 = 1 second; if 0 or omitted it means "
+"to wait for CTRL-C"
+msgstr ""
+#: src/fs/gnunet-search.c:768
+#, c-format
+msgid ""
+"be verbose (append \"%a\\n\" to the default --printf and --dir-printf "
+"arguments - ignored when these are provided by the user)"
+msgstr ""
+#: src/fs/gnunet-search.c:781
+msgid "Search for files that have been published on GNUnet\n"
 msgstr ""
 #: src/fs/gnunet-service-fs.c:371 src/fs/gnunet-service-fs.c:878
@@ -3596,67 +3646,72 @@ msgstr ""
 msgid "Expected a base32-encoded public zone key\n"
 msgstr ""
-#: src/gns/gnunet-bcd.c:571
+#: src/gns/gnunet-bcd.c:573
 #, fuzzy, c-format
 msgid "Invalid port number %u\n"
 msgstr "“%s”的参数无效。\n"
-#: src/gns/gnunet-bcd.c:612 src/namestore/gnunet-namestore-fcfsd.c:1113
+#: src/gns/gnunet-bcd.c:614 src/namestore/gnunet-namestore-fcfsd.c:1113
 #, fuzzy
 msgid "Unable to set up the daemon\n"
 msgstr "发送消息失败。\n"
-#: src/gns/gnunet-bcd.c:635 src/namestore/gnunet-namestore-fcfsd.c:987
+#: src/gns/gnunet-bcd.c:637 src/namestore/gnunet-namestore-fcfsd.c:987
 #, fuzzy
 msgid "Failed to start HTTP server\n"
 msgstr "初始化“%s”服务失败。\n"
-#: src/gns/gnunet-bcd.c:658
+#: src/gns/gnunet-bcd.c:660
 msgid "Run HTTP server on port PORT (default is 8888)"
 msgstr ""
-#: src/gns/gnunet-bcd.c:667
+#: src/gns/gnunet-bcd.c:669
 msgid "GNUnet HTTP server to create business cards"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:241
+#: src/gns/gnunet-dns2gns.c:298
 #, fuzzy
 msgid "Failed to pack DNS response into UDP packet!\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/gns/gnunet-dns2gns.c:315
+#: src/gns/gnunet-dns2gns.c:379
 #, fuzzy
 msgid "Failed to parse DNS response!\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/gns/gnunet-dns2gns.c:452
+#: src/gns/gnunet-dns2gns.c:453
+#, c-format
+msgid "VPN returned empty result for `%s'\n"
+msgstr ""
+#: src/gns/gnunet-dns2gns.c:655
 #, c-format
 msgid "Cannot parse DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:468
+#: src/gns/gnunet-dns2gns.c:671
 #, c-format
 msgid "Received malformed DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:476
+#: src/gns/gnunet-dns2gns.c:679
 #, c-format
 msgid "Received unsupported DNS request from %s\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:637
+#: src/gns/gnunet-dns2gns.c:840
 msgid "No DNS server specified!\n"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:786
+#: src/gns/gnunet-dns2gns.c:995
 msgid "IP of recursive DNS resolver to use (required)"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:792
+#: src/gns/gnunet-dns2gns.c:1001
 msgid "UDP port to listen on for inbound DNS requests; default: 2853"
 msgstr ""
-#: src/gns/gnunet-dns2gns.c:809
+#: src/gns/gnunet-dns2gns.c:1018
 msgid "GNUnet DNS-to-GNS proxy (a DNS server)"
 msgstr ""
@@ -3836,19 +3891,19 @@ msgstr ""
 msgid "GNUnet GNS resolver tool"
 msgstr "GNUnet 错误日志"
-#: src/gns/gnunet-service-gns.c:505
+#: src/gns/gnunet-service-gns.c:501
 #, fuzzy
 msgid "Properly base32-encoded public key required"
 msgstr "“%s”的参数无效。\n"
-#: src/gns/gnunet-service-gns.c:541
+#: src/gns/gnunet-service-gns.c:537
 #, fuzzy
 msgid "Failed to connect to the namecache!\n"
 msgstr "初始化“%s”服务失败。\n"
-#: src/gns/gnunet-service-gns.c:560
+#: src/gns/gnunet-service-gns.c:556
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:442
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:421
-#: src/zonemaster/gnunet-service-zonemaster.c:885
+#: src/zonemaster/gnunet-service-zonemaster.c:870
 #, fuzzy
 msgid "Could not connect to DHT!\n"
 msgstr "无法连接到 %s:%u：%s\n"
@@ -3862,95 +3917,98 @@ msgstr ""
 msgid "Failed to connect to the DNS service!\n"
 msgstr "初始化“%s”服务失败。\n"
-#: src/gns/gnunet-service-gns_resolver.c:706
+#: src/gns/gnunet-service-gns_resolver.c:659
 #, c-format
 msgid "Protocol `%s' unknown, skipping labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:718
+#: src/gns/gnunet-service-gns_resolver.c:671
 #, c-format
 msgid "Service `%s' unknown for protocol `%s', trying as number.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:724
+#: src/gns/gnunet-service-gns_resolver.c:677
 #, c-format
 msgid "Service `%s' not a port, skipping service labels.\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:938
+#: src/gns/gnunet-service-gns_resolver.c:891
 #, fuzzy
 msgid "Failed to parse DNS response\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/gns/gnunet-service-gns_resolver.c:1129
+#: src/gns/gnunet-service-gns_resolver.c:1082
 #, c-format
 msgid "Skipping record of unsupported type %d\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1447
+#: src/gns/gnunet-service-gns_resolver.c:1859
-#, c-format
-msgid "VPN returned empty result for `%s'\n"
-msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1919
 #, c-format
 msgid "Name `%s' cannot be converted to IDNA."
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1934
+#: src/gns/gnunet-service-gns_resolver.c:1874
 #, c-format
 msgid "GNS lookup resulted in DNS name that is too long (`%s')\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:1979
+#: src/gns/gnunet-service-gns_resolver.c:1914
 #, fuzzy, c-format
 msgid "GNS lookup failed (zero records found for `%s')\n"
 msgstr "运行 %s失败：%s %d\n"
-#: src/gns/gnunet-service-gns_resolver.c:2406
+#: src/gns/gnunet-service-gns_resolver.c:2312
+msgid "Unable to process critical delegation record\n"
+msgstr ""
+#: src/gns/gnunet-service-gns_resolver.c:2317
 msgid "GNS lookup recursion failed (no delegation record found)\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2429
+#: src/gns/gnunet-service-gns_resolver.c:2340
 #, fuzzy, c-format
 msgid "Failed to cache GNS resolution: %s\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/gns/gnunet-service-gns_resolver.c:2594
+#: src/gns/gnunet-service-gns_resolver.c:2505
 #, c-format
 msgid "GNS namecache returned empty result for `%s'\n"
 msgstr ""
-#: src/gns/gnunet-service-gns_resolver.c:2734
+#: src/gns/gnunet-service-gns_resolver.c:2652
 #, c-format
 msgid "Zone %s was revoked, resolution fails\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:174
+#: src/gns/plugin_gnsrecord_gns.c:136
+msgid "This is a memento of an older block for internal maintenance."
+msgstr ""
+#: src/gns/plugin_gnsrecord_gns.c:175
 #, fuzzy, c-format
 msgid "Unable to parse zone key record `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/gns/plugin_gnsrecord_gns.c:187
+#: src/gns/plugin_gnsrecord_gns.c:188
 msgid "Record type does not match parsed record type\n"
 msgstr ""
-#: src/gns/plugin_gnsrecord_gns.c:213
+#: src/gns/plugin_gnsrecord_gns.c:211
 #, fuzzy, c-format
 msgid "Unable to parse GNS2DNS record `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/gns/plugin_gnsrecord_gns.c:229
+#: src/gns/plugin_gnsrecord_gns.c:227
 #, fuzzy, c-format
 msgid "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/gns/plugin_gnsrecord_gns.c:253
+#: src/gns/plugin_gnsrecord_gns.c:251
 #, fuzzy, c-format
 msgid "Unable to parse VPN record string `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/gns/plugin_gnsrecord_gns.c:285
+#: src/gns/plugin_gnsrecord_gns.c:283
 #, fuzzy, c-format
 msgid "Unable to parse BOX record string `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
@@ -3959,6 +4017,34 @@ msgstr "解析配置文件“%s”失败\n"
 msgid "Gns REST API initialized\n"
 msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:448
+msgid "Zone delegation record not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:456
+msgid "Zone delegation record set contains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:466
+msgid "Multiple REDIRECT records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:475 src/gnsrecord/gnsrecord_misc.c:501
+msgid "Redirection record set conains mutually exclusive records."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:482
+msgid "Redirection records not allowed in apex."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:493
+msgid "Redirection records not allowed in apex.."
+msgstr ""
+#: src/gnsrecord/gnsrecord_misc.c:515
+msgid "Mutually exclusive records."
+msgstr ""
 #: src/gnsrecord/plugin_gnsrecord_dns.c:367
 #, fuzzy, c-format
 msgid "Unable to parse IPv4 address `%s'\n"
@@ -4202,7 +4288,7 @@ msgid "# hostlist downloads initiated"
 msgstr ""
 #: src/hostlist/gnunet-daemon-hostlist_client.c:1144
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1728
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1732
 msgid "# milliseconds between hostlist downloads"
 msgstr ""
@@ -4260,21 +4346,21 @@ msgstr ""
 msgid "# hostlist URIs written to file"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1657
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1661
 #: src/transport/plugin_transport_http_client.c:2300
 #, c-format
 msgid "Invalid proxy type: `%s', disabling proxy! Check configuration!\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1686
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1690
 msgid "Learning is enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1699
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1703
 msgid "Learning is not enabled on this peer\n"
 msgstr ""
-#: src/hostlist/gnunet-daemon-hostlist_client.c:1713
+#: src/hostlist/gnunet-daemon-hostlist_client.c:1717
 #, c-format
 msgid ""
 "Since learning is not enabled on this peer, hostlist file `%s' was removed\n"
@@ -4464,49 +4550,49 @@ msgstr ""
 msgid "Maintain egos"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:503
+#: src/identity/gnunet-service-identity.c:502
 msgid "no default known"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:528
+#: src/identity/gnunet-service-identity.c:527
 msgid "default configured, but ego unknown (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:621
+#: src/identity/gnunet-service-identity.c:620
-#: src/identity/gnunet-service-identity.c:896
+#: src/identity/gnunet-service-identity.c:895
-#: src/identity/gnunet-service-identity.c:1016
+#: src/identity/gnunet-service-identity.c:1015
 #, fuzzy, c-format
 msgid "Failed to write subsystem default identifier map to `%s'.\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/identity/gnunet-service-identity.c:631
+#: src/identity/gnunet-service-identity.c:630
 msgid "Unknown ego specified for service (internal error)"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:725
+#: src/identity/gnunet-service-identity.c:724
 msgid "identifier already in use for another ego"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:872
+#: src/identity/gnunet-service-identity.c:871
 msgid "target name already exists"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:914
+#: src/identity/gnunet-service-identity.c:913
-#: src/identity/gnunet-service-identity.c:1033
+#: src/identity/gnunet-service-identity.c:1032
 msgid "no matching ego found"
 msgstr ""
-#: src/identity/gnunet-service-identity.c:1131
+#: src/identity/gnunet-service-identity.c:1130
 #, fuzzy, c-format
 msgid "Failed to parse ego information in `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/identity/gnunet-service-identity.c:1189
+#: src/identity/gnunet-service-identity.c:1188
 #, fuzzy, c-format
 msgid "Failed to parse subsystem identity configuration file `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/identity/gnunet-service-identity.c:1198
+#: src/identity/gnunet-service-identity.c:1197
 #, fuzzy, c-format
 msgid "Failed to create directory `%s' for storing egos\n"
 msgstr "解析配置文件“%s”失败\n"
@@ -4546,7 +4632,7 @@ msgstr "无法解析“%s”(%s)：%s\n"
 msgid "No records found for `%s'"
 msgstr "运行 %s失败：%s %d\n"
-#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:459
+#: src/namecache/gnunet-namecache.c:119 src/namestore/gnunet-namestore.c:469
 #, c-format
 msgid "\tCorrupt or unsupported record of type %u\n"
 msgstr ""
@@ -4566,7 +4652,7 @@ msgstr "“%s”的参数无效。\n"
 msgid "You must specify a name\n"
 msgstr "您必须指定一个接收方！\n"
-#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1641
+#: src/namecache/gnunet-namecache.c:214 src/namestore/gnunet-namestore.c:1591
 msgid "name of the record to add/delete/display"
 msgstr ""
@@ -4574,7 +4660,7 @@ msgstr ""
 msgid "specifies the public key of the zone to look in"
 msgstr ""
-#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1702
+#: src/namecache/gnunet-namecache.c:233 src/namestore/gnunet-namestore.c:1652
 #, fuzzy
 msgid "GNUnet zone manipulation tool"
 msgstr "GNUnet 配置"
@@ -4723,140 +4809,113 @@ msgstr ""
 msgid "GNU Name System First-Come-First-Served name registration service"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:334
+#: src/namestore/gnunet-namestore.c:340
 #, c-format
 msgid "Adding record failed: %s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:362
+#: src/namestore/gnunet-namestore.c:368
 #, c-format
 msgid "Deleting record failed, record does not exist%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:369
+#: src/namestore/gnunet-namestore.c:375
 #, c-format
 msgid "Deleting record failed%s%s\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:656
-#, c-format
-msgid "A %s record exists already under `%s', no other records can be added.\n"
-msgstr ""
 #: src/namestore/gnunet-namestore.c:668
 #, c-format
 msgid ""
-"A zone key record exists already under `%s', no other records can be added.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:680
-#, c-format
-msgid ""
 "A SOA record exists already under `%s', cannot add a second SOA to the same "
 "zone.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:696
+#: src/namestore/gnunet-namestore.c:789
-#, c-format
-msgid "Records already exist under `%s', cannot add `%s' record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:711
-#, c-format
-msgid "Records already exist under `%s', cannot add record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:726
-#, c-format
-msgid ""
-"Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"
-msgstr ""
-#: src/namestore/gnunet-namestore.c:846
 #, c-format
 msgid "There are no records under label `%s' that could be deleted.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:889
+#: src/namestore/gnunet-namestore.c:832
 #, c-format
 msgid ""
 "There are no records under label `%s' that match the request for deletion.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:970
+#: src/namestore/gnunet-namestore.c:920
 #, fuzzy, c-format
 msgid "Failed to replace records: %s\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/namestore/gnunet-namestore.c:993
+#: src/namestore/gnunet-namestore.c:943
 #, c-format
 msgid "No options given\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1014 src/namestore/gnunet-namestore.c:1066
+#: src/namestore/gnunet-namestore.c:964 src/namestore/gnunet-namestore.c:1016
-#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1105
+#: src/namestore/gnunet-namestore.c:1026 src/namestore/gnunet-namestore.c:1055
-#: src/namestore/gnunet-namestore.c:1126 src/namestore/gnunet-namestore.c:1153
+#: src/namestore/gnunet-namestore.c:1076 src/namestore/gnunet-namestore.c:1103
-#: src/namestore/gnunet-namestore.c:1230
+#: src/namestore/gnunet-namestore.c:1180
 #, fuzzy, c-format
 msgid "Missing option `%s' for operation `%s'\n"
 msgstr "配置文件“%s”已写入。\n"
-#: src/namestore/gnunet-namestore.c:1016
+#: src/namestore/gnunet-namestore.c:966
 msgid "replace"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1045
+#: src/namestore/gnunet-namestore.c:995
 #, fuzzy, c-format
 msgid "Invalid nick `%s'\n"
 msgstr "无效条目。\n"
-#: src/namestore/gnunet-namestore.c:1068 src/namestore/gnunet-namestore.c:1078
+#: src/namestore/gnunet-namestore.c:1018 src/namestore/gnunet-namestore.c:1028
-#: src/namestore/gnunet-namestore.c:1107 src/namestore/gnunet-namestore.c:1128
+#: src/namestore/gnunet-namestore.c:1057 src/namestore/gnunet-namestore.c:1078
-#: src/namestore/gnunet-namestore.c:1232
+#: src/namestore/gnunet-namestore.c:1182
 msgid "add"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1086
+#: src/namestore/gnunet-namestore.c:1036
 #, fuzzy, c-format
 msgid "Unsupported type `%s'\n"
 msgstr "未知的命令“%s”。\n"
-#: src/namestore/gnunet-namestore.c:1096
+#: src/namestore/gnunet-namestore.c:1046
 #, c-format
 msgid "For DNS record types `SRV', `TLSA' and `OPENPGPKEY'"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1116
+#: src/namestore/gnunet-namestore.c:1066
 #, c-format
 msgid "Value `%s' invalid for record type `%s'\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1135 src/namestore/gnunet-namestore.c:1239
+#: src/namestore/gnunet-namestore.c:1085 src/namestore/gnunet-namestore.c:1189
 #, fuzzy, c-format
 msgid "Invalid time format `%s'\n"
 msgstr "IP 格式无效：“%s”\n"
-#: src/namestore/gnunet-namestore.c:1155
+#: src/namestore/gnunet-namestore.c:1105
 msgid "del"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1197
+#: src/namestore/gnunet-namestore.c:1147
 #, fuzzy, c-format
 msgid "Invalid public key for reverse lookup `%s'\n"
 msgstr "“%s”的参数无效。\n"
-#: src/namestore/gnunet-namestore.c:1222
+#: src/namestore/gnunet-namestore.c:1172
 #: src/peerinfo-tool/gnunet-peerinfo.c:737
 #, fuzzy, c-format
 msgid "Invalid URI `%s'\n"
 msgstr "无效条目。\n"
-#: src/namestore/gnunet-namestore.c:1292
+#: src/namestore/gnunet-namestore.c:1242
 #, c-format
 msgid "Label `%s' contains `.' which is not allowed\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1342
+#: src/namestore/gnunet-namestore.c:1292
 #, c-format
 msgid ""
 "No default identity configured for `namestore' subsystem\n"
@@ -4864,110 +4923,115 @@ msgid ""
 "Run gnunet-identity -d to get a list of choices for $NAME\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1407
+#: src/namestore/gnunet-namestore.c:1357
 #, c-format
 msgid "Superfluous command line arguments (starting with `%s') ignored\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1436
+#: src/namestore/gnunet-namestore.c:1386
 #, fuzzy, c-format
 msgid "Cannot connect to identity service\n"
 msgstr "无法连接到 %s:%u：%s\n"
-#: src/namestore/gnunet-namestore.c:1483
+#: src/namestore/gnunet-namestore.c:1433
 msgid "Empty record line argument is not allowed.\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1495
+#: src/namestore/gnunet-namestore.c:1445
 #, c-format
 msgid "Invalid expiration time `%s' (must be without unit)\n"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1507 src/namestore/gnunet-namestore.c:1523
+#: src/namestore/gnunet-namestore.c:1457 src/namestore/gnunet-namestore.c:1473
-#: src/namestore/gnunet-namestore.c:1540
+#: src/namestore/gnunet-namestore.c:1490
 #, fuzzy, c-format
 msgid "Missing entries in record line `%s'.\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/namestore/gnunet-namestore.c:1515
+#: src/namestore/gnunet-namestore.c:1465
 #, fuzzy, c-format
 msgid "Unknown record type `%s'\n"
 msgstr "未知的命令“%s”。\n"
-#: src/namestore/gnunet-namestore.c:1553
+#: src/namestore/gnunet-namestore.c:1503
 #, fuzzy, c-format
 msgid "Invalid record data for type %s: `%s'.\n"
 msgstr "IP 格式无效：“%s”\n"
-#: src/namestore/gnunet-namestore.c:1610
+#: src/namestore/gnunet-namestore.c:1560
 msgid "add record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1613
+#: src/namestore/gnunet-namestore.c:1563
 msgid "delete record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1617
+#: src/namestore/gnunet-namestore.c:1567
 msgid "display records"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1624
+#: src/namestore/gnunet-namestore.c:1574
 msgid ""
 "expiration time for record to use (for adding only), \"never\" is possible"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1630
+#: src/namestore/gnunet-namestore.c:1580
 #, fuzzy
 msgid "set the desired nick name for the zone"
 msgstr "无法获取有关用户“%s”的信息：%s\n"
-#: src/namestore/gnunet-namestore.c:1635
+#: src/namestore/gnunet-namestore.c:1585
 #, fuzzy
 msgid "monitor changes in the namestore"
 msgstr "初始化“%s”服务失败。\n"
-#: src/namestore/gnunet-namestore.c:1647
+#: src/namestore/gnunet-namestore.c:1597
 #, fuzzy
 msgid "determine our name for the given PKEY"
 msgstr "无法获取有关用户“%s”的信息：%s\n"
-#: src/namestore/gnunet-namestore.c:1654
+#: src/namestore/gnunet-namestore.c:1604
 msgid ""
 "set record set to values given by (possibly multiple) RECORDLINES; can be "
 "specified multiple times"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1660
+#: src/namestore/gnunet-namestore.c:1610
 msgid "type of the record to add/delete/display"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1665
+#: src/namestore/gnunet-namestore.c:1615
 msgid "URI to import into our zone"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1671
+#: src/namestore/gnunet-namestore.c:1621
 msgid "value of the record to add/delete"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1675
+#: src/namestore/gnunet-namestore.c:1625
 msgid "create or list public record"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1681
+#: src/namestore/gnunet-namestore.c:1631
 msgid ""
 "create shadow record (only valid if all other records of the same type have "
 "expired"
 msgstr ""
-#: src/namestore/gnunet-namestore.c:1687
+#: src/namestore/gnunet-namestore.c:1637
 msgid "name of the ego controlling the zone"
 msgstr ""
-#: src/namestore/gnunet-service-namestore.c:871
+#: src/namestore/gnunet-service-namestore.c:879
 #, fuzzy, c-format
 msgid "Failed to replicate block in namecache: %s\n"
 msgstr "发送消息失败。\n"
+#: src/namestore/gnunet-service-namestore.c:1668
+#, fuzzy
+msgid "Store failed"
+msgstr "“%s”已连接到“%s”。\n"
 #: src/namestore/gnunet-zoneimport.c:1847
 msgid "size to use for the main hash map"
 msgstr ""
@@ -4976,10 +5040,6 @@ msgstr ""
 msgid "minimum expiration time we assume for imported records"
 msgstr ""
-#: src/namestore/namestore_api.c:373
-msgid "Namestore failed to store record\n"
-msgstr ""
 #: src/namestore/plugin_namestore_flat.c:195
 #, c-format
 msgid "File too big to map: %llu bytes.\n"
@@ -5560,6 +5620,51 @@ msgstr "初始化“%s”服务失败。\n"
 msgid "Daemon to run to perform IP protocol translation to GNUnet"
 msgstr ""
+#: src/reclaim/gnunet-did.c:209
+#, fuzzy, c-format
+msgid "Invalid DID `%s'\n"
+msgstr "无效条目。\n"
+#: src/reclaim/gnunet-did.c:835
+msgid "Create a DID Document and display its DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:840
+msgid "Get the DID Document associated with the given DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:844
+msgid "Show the DID for a given ego"
+msgstr ""
+#: src/reclaim/gnunet-did.c:849
+msgid "Remove the DID"
+msgstr ""
+#: src/reclaim/gnunet-did.c:853 src/reclaim/gnunet-did.c:857
+msgid "Replace the DID Document."
+msgstr ""
+#: src/reclaim/gnunet-did.c:863
+msgid "The Decentralized Identity (DID)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:869
+msgid "The DID Document to store in GNUNET"
+msgstr ""
+#: src/reclaim/gnunet-did.c:874
+msgid "The name of the EGO"
+msgstr ""
+#: src/reclaim/gnunet-did.c:880
+msgid "The time until the DID Document is going to expire (e.g. 5d)"
+msgstr ""
+#: src/reclaim/gnunet-did.c:889
+msgid "Manage Decentralized Identities (DIDs)"
+msgstr ""
 #: src/reclaim/gnunet-reclaim.c:802
 #, fuzzy, c-format
 msgid "Ego is required\n"
@@ -6448,17 +6553,17 @@ msgid ""
 "free topology cannot be more than %u.  Given `%s = %llu'"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2643
+#: src/testbed/testbed_api_topology.c:1033 src/testing/testing.c:2657
 #, c-format
 msgid "Topology file %s not found\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2651
+#: src/testbed/testbed_api_topology.c:1041 src/testing/testing.c:2665
 #, c-format
 msgid "Topology file %s has no data\n"
 msgstr ""
-#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2659
+#: src/testbed/testbed_api_topology.c:1049 src/testing/testing.c:2673
 #, c-format
 msgid "Topology file %s cannot be read\n"
 msgstr ""
@@ -6665,7 +6770,7 @@ msgstr ""
 #: src/transport/gnunet-communicator-tcp.c:3338
 #: src/transport/gnunet-communicator-udp.c:3856
-#: src/transport/gnunet-service-tng.c:10512
+#: src/transport/gnunet-service-tng.c:10623
 #: src/transport/gnunet-service-transport.c:2627
 #, fuzzy
 msgid "Transport service is lacking key configuration settings. Exiting.\n"
@@ -7852,58 +7957,58 @@ msgstr ""
 msgid "Need a non-empty hostname for service `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:626 src/util/common_logging.c:665
+#: src/util/common_logging.c:648 src/util/common_logging.c:687
 #, c-format
 msgid "ERROR: Unable to parse log definition: Syntax error at `%s'.\n"
 msgstr ""
-#: src/util/common_logging.c:904
+#: src/util/common_logging.c:926
 #, fuzzy, c-format
 msgid "Message `%.*s' repeated %u times in the last %s\n"
 msgstr "消息“%.*s”重复了 %u 次，在最近 %llu 秒内\n"
-#: src/util/common_logging.c:1108
+#: src/util/common_logging.c:1131
 msgid "ERROR"
 msgstr "错误"
-#: src/util/common_logging.c:1110
+#: src/util/common_logging.c:1133
 msgid "WARNING"
 msgstr "警告"
-#: src/util/common_logging.c:1112
+#: src/util/common_logging.c:1135
 msgid "MESSAGE"
 msgstr ""
-#: src/util/common_logging.c:1114
+#: src/util/common_logging.c:1137
 msgid "INFO"
 msgstr "信息"
-#: src/util/common_logging.c:1116
+#: src/util/common_logging.c:1139
 msgid "DEBUG"
 msgstr "调试"
-#: src/util/common_logging.c:1118
+#: src/util/common_logging.c:1141
 msgid "NONE"
 msgstr ""
-#: src/util/common_logging.c:1119
+#: src/util/common_logging.c:1142
 msgid "INVALID"
 msgstr ""
-#: src/util/common_logging.c:1400
+#: src/util/common_logging.c:1423
 msgid "unknown address"
 msgstr ""
-#: src/util/common_logging.c:1445
+#: src/util/common_logging.c:1468
 msgid "invalid address"
 msgstr ""
-#: src/util/common_logging.c:1464
+#: src/util/common_logging.c:1487
 #, fuzzy, c-format
 msgid "Configuration fails to specify option `%s' in section `%s'!\n"
 msgstr "配置不满足配置规范文件“%s”的约束！\n"
-#: src/util/common_logging.c:1487
+#: src/util/common_logging.c:1510
 #, fuzzy, c-format
 msgid ""
 "Configuration specifies invalid value for option `%s' in section `%s': %s\n"
@@ -8050,17 +8155,17 @@ msgstr "打开日志文件“%s”失败：%s\n"
 msgid "Could not bind to any port: %s\n"
 msgstr "找不到主机“%s”的 IP：%s\n"
-#: src/util/dnsstub.c:344
+#: src/util/dnsstub.c:370
 #, c-format
-msgid "Received DNS response that is too small (%u bytes)"
+msgid "Received DNS response that is too small (%u bytes)\n"
 msgstr ""
-#: src/util/dnsstub.c:482
+#: src/util/dnsstub.c:508
 #, fuzzy, c-format
 msgid "Failed to send DNS request to %s: %s\n"
 msgstr "打开日志文件“%s”失败：%s\n"
-#: src/util/dnsstub.c:487
+#: src/util/dnsstub.c:513
 #, fuzzy, c-format
 msgid "Sent DNS request to %s\n"
 msgstr "打开日志文件“%s”失败：%s\n"
@@ -8145,83 +8250,83 @@ msgid ""
 "Arguments mandatory for long options are also mandatory for short options.\n"
 msgstr "长选项的必选参数对短选项也是必选的。\n"
-#: src/util/getopt_helpers.c:196
+#: src/util/getopt_helpers.c:197
 msgid "print this help"
 msgstr ""
-#: src/util/getopt_helpers.c:261
+#: src/util/getopt_helpers.c:262
 msgid "be verbose"
 msgstr ""
-#: src/util/getopt_helpers.c:377
+#: src/util/getopt_helpers.c:378
 msgid "configure logging to use LOGLEVEL"
 msgstr ""
-#: src/util/getopt_helpers.c:444
+#: src/util/getopt_helpers.c:445
 msgid "configure logging to write logs to FILENAME"
 msgstr ""
-#: src/util/getopt_helpers.c:461
+#: src/util/getopt_helpers.c:462
 #, fuzzy
 msgid "use configuration file FILENAME"
 msgstr "更改配置文件中的一个值"
-#: src/util/getopt_helpers.c:497 src/util/getopt_helpers.c:811
+#: src/util/getopt_helpers.c:498 src/util/getopt_helpers.c:812
-#: src/util/getopt_helpers.c:867
+#: src/util/getopt_helpers.c:868
 #, c-format
 msgid "You must pass a number to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:569
+#: src/util/getopt_helpers.c:570
 #, fuzzy, c-format
 msgid ""
 "You must pass a relative time (optionally with sign) to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:576
+#: src/util/getopt_helpers.c:577
 #, c-format
 msgid "Value given for time travel `%s' option is too big.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:594
+#: src/util/getopt_helpers.c:595
 msgid "[+/-]MICROSECONDS"
 msgstr ""
-#: src/util/getopt_helpers.c:596
+#: src/util/getopt_helpers.c:597
 msgid "modify system time by given offset (for debugging/testing only)"
 msgstr ""
-#: src/util/getopt_helpers.c:630
+#: src/util/getopt_helpers.c:631
 #, fuzzy, c-format
 msgid "You must pass relative time to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:684
+#: src/util/getopt_helpers.c:685
 #, fuzzy, c-format
 msgid "You must pass absolute time to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:741
+#: src/util/getopt_helpers.c:742
 #, fuzzy, c-format
 msgid "You must pass a timestamp to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:748
+#: src/util/getopt_helpers.c:749
 #, c-format
 msgid "The maximum precision allowed for timestamps is seconds.\n"
 msgstr ""
-#: src/util/getopt_helpers.c:804
+#: src/util/getopt_helpers.c:805
 #, c-format
 msgid "Your input for the '%s' option has to be a non negative number\n"
 msgstr ""
-#: src/util/getopt_helpers.c:874
+#: src/util/getopt_helpers.c:875
 #, fuzzy, c-format
 msgid "You must pass a number below %u to the `%s' option.\n"
 msgstr "您必须向“%s”选项传递一个数字。\n"
-#: src/util/getopt_helpers.c:952
+#: src/util/getopt_helpers.c:953
 #, c-format
 msgid "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"
 msgstr ""
@@ -8255,7 +8360,7 @@ msgstr ""
 msgid "Manipulate GNUnet configuration files"
 msgstr "更改配置文件中的一个值"
-#: src/util/gnunet-crypto-tvg.c:1072
+#: src/util/gnunet-crypto-tvg.c:1483
 msgid "verify a test vector from stdin"
 msgstr ""
@@ -8508,7 +8613,7 @@ msgstr "创建用户出错"
 msgid "Unable to shorten unix path `%s' while keeping name unique\n"
 msgstr ""
-#: src/util/network.c:1306
+#: src/util/network.c:1307
 #, c-format
 msgid ""
 "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"
@@ -8636,77 +8741,77 @@ msgstr ""
 msgid "Character sets requested were `%s'->`%s'\n"
 msgstr ""
-#: src/util/strings.c:487
+#: src/util/strings.c:514
 msgid "Failed to expand `$HOME': environment variable `HOME' not set"
 msgstr "扩展“$HOME”失败：没有设置环境变量“HOME”"
-#: src/util/strings.c:1023
+#: src/util/strings.c:1050
 msgid "IPv6 address did not start with `['\n"
 msgstr ""
-#: src/util/strings.c:1031
+#: src/util/strings.c:1058
 msgid "IPv6 address did contain ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1038
+#: src/util/strings.c:1065
 msgid "IPv6 address did contain ']' before ':' to separate port number\n"
 msgstr ""
-#: src/util/strings.c:1046
+#: src/util/strings.c:1073
 msgid "IPv6 address did contain a valid port number after the last ':'\n"
 msgstr ""
-#: src/util/strings.c:1055
+#: src/util/strings.c:1082
 #, fuzzy, c-format
 msgid "Invalid IPv6 address `%s': %s\n"
 msgstr "无效的进程优先级“%s”\n"
-#: src/util/strings.c:1237 src/util/strings.c:1248
+#: src/util/strings.c:1264 src/util/strings.c:1275
 msgid "Port not in range\n"
 msgstr ""
-#: src/util/strings.c:1257
+#: src/util/strings.c:1284
 #, fuzzy, c-format
 msgid "Malformed port policy `%s'\n"
 msgstr "解析配置文件“%s”失败\n"
-#: src/util/strings.c:1328 src/util/strings.c:1357 src/util/strings.c:1404
+#: src/util/strings.c:1355 src/util/strings.c:1384 src/util/strings.c:1431
-#: src/util/strings.c:1424
+#: src/util/strings.c:1451
 #, c-format
 msgid "Invalid format for IP: `%s'\n"
 msgstr "IP 格式无效：“%s”\n"
-#: src/util/strings.c:1382
+#: src/util/strings.c:1409
 #, c-format
 msgid "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."
 msgstr "网络表示法无效(“/%d” 在 IPv4 CIDR 中是非法的)。"
-#: src/util/strings.c:1433
+#: src/util/strings.c:1460
 #, fuzzy, c-format
 msgid "Invalid format: `%s'\n"
 msgstr "IP 格式无效：“%s”\n"
-#: src/util/strings.c:1475
+#: src/util/strings.c:1502
 #, c-format
 msgid "Invalid network notation (does not end with ';': `%s')\n"
 msgstr "无效的网络表示法(没有以“;”结尾：“%s”)\n"
-#: src/util/strings.c:1525
+#: src/util/strings.c:1552
 #, c-format
 msgid "Wrong format `%s' for netmask\n"
 msgstr "网络掩码的格式“%s”错误\n"
-#: src/util/strings.c:1556
+#: src/util/strings.c:1583
 #, c-format
 msgid "Wrong format `%s' for network\n"
 msgstr "网络的格式“%s”错误\n"
-#: src/util/time.c:863 src/util/time.c:891
+#: src/util/time.c:870 src/util/time.c:898
 #, c-format
 msgid "Failed to map `%s', cannot assure monotonic time!\n"
 msgstr ""
-#: src/util/time.c:899
+#: src/util/time.c:906
 #, c-format
 msgid ""
 "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"
@@ -8882,8 +8987,8 @@ msgstr ""
 msgid "Setup tunnels via VPN."
 msgstr ""
-#: src/zonemaster/gnunet-service-zonemaster-monitor.c:418
+#: src/zonemaster/gnunet-service-zonemaster-monitor.c:397
-#: src/zonemaster/gnunet-service-zonemaster.c:847
+#: src/zonemaster/gnunet-service-zonemaster.c:832
 #, fuzzy
 msgid "Failed to connect to the namestore!\n"
 msgstr "初始化“%s”服务失败。\n"
diff --git a/src/ats/ats.conf.in b/src/ats/ats.conf.in
index 4abddd99c..2c65869dd 100644
--- a/src/ats/ats.conf.in
+++ b/src/ats/ats.conf.in
@@ -15,8 +15,8 @@ MODE = proportional
 # IMPORTANT: Do not lower those quotas below 10 MiB
 # Or your peer may not bootstrap correctly.
 # Network specific inbound/outbound quotas
-UNSPECIFIED_QUOTA_IN = 10 MiB
+UNSPECIFIED_QUOTA_IN = unlimited
-UNSPECIFIED_QUOTA_OUT = 10 MiB
+UNSPECIFIED_QUOTA_OUT = unlimited
 # LOOPBACK
 LOOPBACK_QUOTA_IN = unlimited
 LOOPBACK_QUOTA_OUT = unlimited
@@ -27,8 +27,8 @@ LAN_QUOTA_OUT = unlimited
 WAN_QUOTA_IN = 10 MiB
 WAN_QUOTA_OUT = 10 MiB
 # WLAN
-WLAN_QUOTA_IN = 10 MiB
+WLAN_QUOTA_IN = unlimited
-WLAN_QUOTA_OUT = 10 MiB
+WLAN_QUOTA_OUT = unlimited
 # BLUETOOTH
 BLUETOOTH_QUOTA_IN = 10 MiB
 BLUETOOTH_QUOTA_OUT = 10 MiB
@@ -38,7 +38,7 @@ BLUETOOTH_QUOTA_OUT = 10 MiB
 # How proportional to preferences is bandwidth distribution in a network
 # 1.0: Fair with respect to addresses without preferences
 # > 1.0: The bigger, the more respect is paid to preferences
-PROP_PROPORTIONALITY_FACTOR = 2.00
+PROP_PROPORTIONALITY_FACTOR = 10.00
-# Should we stick to existing connections are prefer to switch?
+# Should we stick to existing connections or prefer to switch?
 # [1.0...2.0], lower value prefers to switch, bigger value is more tolerant
 PROP_STABILITY_FACTOR = 1.25
diff --git a/src/ats/gnunet-ats-solver-eval.c b/src/ats/gnunet-ats-solver-eval.c
index 25b963532..ba7994686 100644
--- a/src/ats/gnunet-ats-solver-eval.c
+++ b/src/ats/gnunet-ats-solver-eval.c
@@ -442,7 +442,7 @@ GNUNET_ATS_solver_logging_write_to_disk (struct LoggingHandle *l, int
    }
  }
-cleanup:
+  cleanup:
  next = lf_head;
  for (cur = next; NULL != cur; cur = next)
  {
@@ -1414,7 +1414,8 @@ load_op_add_address (struct GNUNET_ATS_TEST_Operation *o,
  }
  else
  {
-    GNUNET_STRINGS_utf8_toupper (op_network, op_network);
+    GNUNET_break (GNUNET_OK == GNUNET_STRINGS_utf8_toupper (op_network,
+                                                            op_network));
    if (0 == strcmp (op_network, "UNSPECIFIED"))
    {
      o->address_network = GNUNET_NT_UNSPECIFIED;
diff --git a/src/block/bg_bf.c b/src/block/bg_bf.c
index ae8ee0e51..601f605a2 100644
--- a/src/block/bg_bf.c
+++ b/src/block/bg_bf.c
@@ -61,7 +61,7 @@ struct BfGroupInternals
 * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
 *         supported, #GNUNET_SYSERR on error
 */
-static int
+static enum GNUNET_GenericReturnValue
 bf_group_serialize_cb (struct GNUNET_BLOCK_Group *bg,
                       uint32_t *nonce,
                       void **raw_data,
@@ -124,7 +124,7 @@ bf_group_mark_seen_cb (struct GNUNET_BLOCK_Group *bg,
 * @return #GNUNET_OK on success, #GNUNET_NO if the nonces were different and thus
 *         we failed.
 */
-static int
+static enum GNUNET_GenericReturnValue
 bf_group_merge_cb (struct GNUNET_BLOCK_Group *bg1,
                   const struct GNUNET_BLOCK_Group *bg2)
 {
diff --git a/src/block/block.c b/src/block/block.c
index 5824946f7..2e3c1dc70 100644
--- a/src/block/block.c
+++ b/src/block/block.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet.
-     Copyright (C) 2010, 2017, 2021 GNUnet e.V.
+     Copyright (C) 2010, 2017, 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -255,35 +255,6 @@ GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
 }
-enum GNUNET_BLOCK_EvaluationResult
-GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
-                       enum GNUNET_BLOCK_Type type,
-                       struct GNUNET_BLOCK_Group *group,
-                       enum GNUNET_BLOCK_EvaluationOptions eo,
-                       const struct GNUNET_HashCode *query,
-                       const void *xquery,
-                       size_t xquery_size,
-                       const void *reply_block,
-                       size_t reply_block_size)
-{
-  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
-                                                             type);
-  if (NULL == plugin)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  return plugin->evaluate (plugin->cls,
-                           ctx,
-                           type,
-                           group,
-                           eo,
-                           query,
-                           xquery,
-                           xquery_size,
-                           reply_block,
-                           reply_block_size);
-}
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
                      enum GNUNET_BLOCK_Type type,
@@ -327,7 +298,6 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
                          enum GNUNET_BLOCK_Type type,
-                          const struct GNUNET_HashCode *query,
                          const void *block,
                          size_t block_size)
 {
@@ -338,7 +308,6 @@ GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
    return GNUNET_SYSERR;
  return plugin->check_block (plugin->cls,
                              type,
-                              query,
                              block,
                              block_size);
 }
diff --git a/src/block/plugin_block_template.c b/src/block/plugin_block_template.c
index 13d9adfda..dcaf1afaa 100644
--- a/src/block/plugin_block_template.c
+++ b/src/block/plugin_block_template.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -92,49 +92,6 @@ block_plugin_template_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_template_evaluate (void *cls,
-                                struct GNUNET_BLOCK_Context *ctx,
-                                enum GNUNET_BLOCK_Type type,
-                                struct GNUNET_BLOCK_Group *group,
-                                enum GNUNET_BLOCK_EvaluationOptions eo,
-                                const struct GNUNET_HashCode *query,
-                                const void *xquery,
-                                size_t xquery_size,
-                                const void *reply_block,
-                                size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -143,16 +100,16 @@ block_plugin_template_evaluate (void *cls,
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
 * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_template_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                                   enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                                   const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                                   const void *xquery,
-                                    size_t xquery_size)
+                                   size_t xquery_size)
 {
-  return GNUNET_OK;
+  return GNUNET_SYSERR;
 }
@@ -161,19 +118,17 @@ block_plugin_template_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_template_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
-  return GNUNET_OK;
+  return GNUNET_SYSERR;
 }
@@ -195,16 +150,16 @@ block_plugin_template_check_block (void *cls,
 */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_template_check_reply (
-                                        void *cls,
+                                   void *cls,
-                                        enum GNUNET_BLOCK_Type type,
+                                   enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
+                                   struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
+                                   const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                                   const void *xquery,
-                                    size_t xquery_size,
+                                   size_t xquery_size,
-                                    const void *reply_block,
+                                   const void *reply_block,
-                                    size_t reply_block_size)
+                                   size_t reply_block_size)
 {
-  return GNUNET_BLOCK_REPLY_OK_MORE;
+  return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
 }
@@ -245,7 +200,6 @@ libgnunet_plugin_block_template_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_template_evaluate;
  api->get_key = &block_plugin_template_get_key;
  api->check_query = &block_plugin_template_check_query;
  api->check_block = &block_plugin_template_check_block;
diff --git a/src/block/plugin_block_test.c b/src/block/plugin_block_test.c
index fd643c4dc..05d379387 100644
--- a/src/block/plugin_block_test.c
+++ b/src/block/plugin_block_test.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -90,59 +90,6 @@ block_plugin_test_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group group to check against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_test_evaluate (void *cls,
-                            struct GNUNET_BLOCK_Context *ctx,
-                            enum GNUNET_BLOCK_Type type,
-                            struct GNUNET_BLOCK_Group *group,
-                            enum GNUNET_BLOCK_EvaluationOptions eo,
-                            const struct GNUNET_HashCode *query,
-                            const void *xquery,
-                            size_t xquery_size,
-                            const void *reply_block,
-                            size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-  if (GNUNET_BLOCK_TYPE_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -151,15 +98,18 @@ block_plugin_test_evaluate (void *cls,
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
 * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                               enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                               const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                               const void *xquery,
-                                    size_t xquery_size)
+                               size_t xquery_size)
 {
+  (void) cls;
+  (void) query;
+  (void) xquery;
  if (GNUNET_BLOCK_TYPE_TEST != type)
  {
    GNUNET_break (0);
@@ -168,9 +118,9 @@ block_plugin_test_check_query (void *cls,
  if (0 != xquery_size)
  {
    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
  }
-  return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
+  return GNUNET_OK;
 }
@@ -179,18 +129,19 @@ block_plugin_test_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                               enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                               const void *block,
-                                    const void *block,
+                               size_t block_size)
-                                    size_t block_size)
 {
+  (void) cls;
+  (void) block;
+  (void) block_size;
  if (GNUNET_BLOCK_TYPE_TEST != type)
  {
    GNUNET_break (0);
@@ -218,16 +169,20 @@ block_plugin_test_check_block (void *cls,
 */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_test_check_reply (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                               enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
+                               struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
+                               const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                               const void *xquery,
-                                    size_t xquery_size,
+                               size_t xquery_size,
-                                    const void *reply_block,
+                               const void *reply_block,
-                                    size_t reply_block_size)
+                               size_t reply_block_size)
 {
  struct GNUNET_HashCode chash;
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  (void) xquery_size;
  if (GNUNET_BLOCK_TYPE_TEST != type)
  {
    GNUNET_break (0);
@@ -252,8 +207,7 @@ block_plugin_test_check_reply (void *cls,
 * @param block block to get the key for
 * @param block_size number of bytes in @a block
 * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
- *         (or if extracting a key from a block of this type does not work)
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_get_key (void *cls,
@@ -262,9 +216,16 @@ block_plugin_test_get_key (void *cls,
                           size_t block_size,
                           struct GNUNET_HashCode *key)
 {
-  /* always fails since there is no fixed relationship between
+  (void) cls;
-   * keys and values for test values */
+  (void) block;
-  return GNUNET_SYSERR;
+  (void) block_size;
+  (void) key;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
@@ -284,7 +245,6 @@ libgnunet_plugin_block_test_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_test_evaluate;
  api->get_key = &block_plugin_test_get_key;
  api->check_query = &block_plugin_test_check_query;
  api->check_block = &block_plugin_test_check_block;
diff --git a/src/consensus/plugin_block_consensus.c b/src/consensus/plugin_block_consensus.c
index 430a2c0cb..f30b9b0d7 100644
--- a/src/consensus/plugin_block_consensus.c
+++ b/src/consensus/plugin_block_consensus.c
@@ -47,57 +47,6 @@ struct BlockContext
 };
-/**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_consensus_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  struct BlockContext *bctx = cls;
-  const struct ConsensusElement *ce = reply_block;
-  if (reply_block_size < sizeof(struct ConsensusElement))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  if ( (0 != ce->marker) ||
-       (0 == ce->payload_type) )
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-  if (NULL == bctx->bc)
-    bctx->bc = GNUNET_BLOCK_context_create (bctx->cfg);
-  return GNUNET_BLOCK_evaluate (bctx->bc,
-                                type,
-                                group,
-                                eo,
-                                query,
-                                xquery,
-                                xquery_size,
-                                &ce[1],
-                                reply_block_size
-                                - sizeof(struct ConsensusElement));
-}
 /**
 * Function called to validate a query.
@@ -128,7 +77,6 @@ block_plugin_consensus_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -136,7 +84,6 @@ block_plugin_consensus_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_consensus_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
@@ -144,7 +91,10 @@ block_plugin_consensus_check_block (void *cls,
  const struct ConsensusElement *ce = block;
  if (block_size < sizeof(*ce))
+  {
+    GNUNET_break_op (0);
    return GNUNET_NO;
+  }
  if ( (0 != ce->marker) ||
       (0 == ce->payload_type) )
    return GNUNET_OK;
@@ -152,7 +102,6 @@ block_plugin_consensus_check_block (void *cls,
    ctx->bc = GNUNET_BLOCK_context_create (ctx->cfg);
  return GNUNET_BLOCK_check_block (ctx->bc,
                                   ntohl (ce->payload_type),
-                                   query,
                                   &ce[1],
                                   block_size - sizeof(*ce));
 }
@@ -188,8 +137,7 @@ block_plugin_consensus_check_reply (
  struct BlockContext *ctx = cls;
  const struct ConsensusElement *ce = reply_block;
-  if (reply_block_size < sizeof(struct ConsensusElement))
+  GNUNET_assert (reply_block_size >= sizeof(struct ConsensusElement));
-    return GNUNET_NO;
  if ( (0 != ce->marker) ||
       (0 == ce->payload_type) )
    return GNUNET_BLOCK_REPLY_OK_MORE;
@@ -246,7 +194,6 @@ libgnunet_plugin_block_consensus_init (void *cls)
  ctx->cfg = cfg;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
  api->cls = ctx;
-  api->evaluate = &block_plugin_consensus_evaluate;
  api->get_key = &block_plugin_consensus_get_key;
  api->check_query = &block_plugin_consensus_check_query;
  api->check_block = &block_plugin_consensus_check_block;
diff --git a/src/consensus/test_consensus.conf b/src/consensus/test_consensus.conf
index 67b366405..df7fb6861 100644
--- a/src/consensus/test_consensus.conf
+++ b/src/consensus/test_consensus.conf
@@ -3,7 +3,7 @@ GNUNET_TEST_HOME = $GNUNET_TMP/test-consensus/
 [consensus]
 #OPTIONS = -L INFO
-BINARY = gnunet-service-evil-consensus
+BINARY = gnunet-service-consensus
 #PREFIX = valgrind
diff --git a/src/datacache/datacache.c b/src/datacache/datacache.c
index 944a99aad..761ab801f 100644
--- a/src/datacache/datacache.c
+++ b/src/datacache/datacache.c
@@ -114,11 +114,11 @@ env_delete_notify (void *cls,
  h->utilization -= size;
  GNUNET_CONTAINER_bloomfilter_remove (h->filter, key);
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# bytes stored"),
+                            "# bytes stored",
                            -(long long) size,
                            GNUNET_NO);
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# items stored"),
+                            "# items stored",
                            -1,
                            GNUNET_NO);
 }
@@ -136,15 +136,25 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
  const struct GNUNET_OS_ProjectData *pd;
  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_size (cfg, section, "QUOTA", &quota))
+      GNUNET_CONFIGURATION_get_value_size (cfg,
+                                           section,
+                                           "QUOTA",
+                                           &quota))
  {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, section, "QUOTA");
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               "QUOTA");
    return NULL;
  }
  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, section, "DATABASE", &name))
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             section,
+                                             "DATABASE",
+                                             &name))
  {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, section, "DATABASE");
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               "DATABASE");
    return NULL;
  }
  bf_size = quota / 32; /* 8 bit per entry, 1 bit per 32 kb in DB */
@@ -152,10 +162,14 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
  ret = GNUNET_new (struct GNUNET_DATACACHE_Handle);
  if (GNUNET_YES !=
-      GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "DISABLE_BF"))
+      GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                            section,
+                                            "DISABLE_BF"))
  {
    if (GNUNET_YES !=
-        GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "DISABLE_BF_RC"))
+        GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                              section,
+                                              "DISABLE_BF_RC"))
    {
      ret->bloom_name = GNUNET_DISK_mktemp ("gnunet-datacachebloom");
    }
@@ -174,7 +188,8 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
                                           5);    /* approx. 3% false positives at max use */
    }
  }
-  ret->stats = GNUNET_STATISTICS_create ("datacache", cfg);
+  ret->stats = GNUNET_STATISTICS_create ("datacache",
+                                         cfg);
  ret->section = GNUNET_strdup (section);
  ret->env.cfg = cfg;
  ret->env.delete_notify = &env_delete_notify;
@@ -182,25 +197,31 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
  ret->env.cls = ret;
  ret->env.delete_notify = &env_delete_notify;
  ret->env.quota = quota;
-  LOG (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datacache plugin\n"), name);
+  LOG (GNUNET_ERROR_TYPE_INFO,
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datacache_%s", name);
+       "Loading `%s' datacache plugin\n",
+       name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_datacache_%s",
+                   name);
  ret->short_name = name;
  ret->lib_name = libname;
  /* Load the plugin within GNUnet's default context */
  pd = GNUNET_OS_project_data_get ();
  GNUNET_OS_init (GNUNET_OS_project_data_default ());
-  ret->api = GNUNET_PLUGIN_load (libname, &ret->env);
+  ret->api = GNUNET_PLUGIN_load (libname,
+                                 &ret->env);
  GNUNET_OS_init (pd);
  if (NULL == ret->api)
  {
    /* Try to load the plugin within the application's context
       This normally happens when the application is not GNUnet itself but a
       third party; inside GNUnet this is effectively a double failure. */
-    ret->api = GNUNET_PLUGIN_load (libname, &ret->env);
+    ret->api = GNUNET_PLUGIN_load (libname,
+                                   &ret->env);
    if (NULL == ret->api)
    {
      LOG (GNUNET_ERROR_TYPE_ERROR,
-           _ ("Failed to load datacache plugin for `%s'\n"),
+           "Failed to load datacache plugin for `%s'\n",
           name);
      GNUNET_DATACACHE_destroy (ret);
      return NULL;
@@ -216,7 +237,9 @@ GNUNET_DATACACHE_destroy (struct GNUNET_DATACACHE_Handle *h)
  if (NULL != h->filter)
    GNUNET_CONTAINER_bloomfilter_free (h->filter);
  if (NULL != h->api)
-    GNUNET_break (NULL == GNUNET_PLUGIN_unload (h->lib_name, h->api));
+    GNUNET_break (NULL ==
+                  GNUNET_PLUGIN_unload (h->lib_name,
+                                        h->api));
  GNUNET_free (h->lib_name);
  GNUNET_free (h->short_name);
  GNUNET_free (h->section);
@@ -270,17 +293,19 @@ GNUNET_DATACACHE_put (struct GNUNET_DATACACHE_Handle *h,
       "Stored data under key `%s' in cache\n",
       GNUNET_h2s (key));
  if (NULL != h->filter)
-    GNUNET_CONTAINER_bloomfilter_add (h->filter, key);
+    GNUNET_CONTAINER_bloomfilter_add (h->filter,
+                                      key);
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# bytes stored"),
+                            "# bytes stored",
                            used,
                            GNUNET_NO);
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# items stored"),
+                            "# items stored",
                            1,
                            GNUNET_NO);
  while (h->utilization + used > h->env.quota)
-    GNUNET_assert (GNUNET_OK == h->api->del (h->api->cls));
+    GNUNET_assert (GNUNET_OK ==
+                   h->api->del (h->api->cls));
  h->utilization += used;
  return GNUNET_OK;
 }
@@ -294,18 +319,18 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
                      void *iter_cls)
 {
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# requests received"),
+                            "# requests received",
                            1,
                            GNUNET_NO);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Processing request for key `%s'\n",
       GNUNET_h2s (key));
  if ((NULL != h->filter) &&
-      (GNUNET_OK != GNUNET_CONTAINER_bloomfilter_test (h->filter, key)))
+      (GNUNET_OK !=
+       GNUNET_CONTAINER_bloomfilter_test (h->filter, key)))
  {
    GNUNET_STATISTICS_update (h->stats,
-                              gettext_noop (
+                              "# requests filtered by bloom filter",
-                                "# requests filtered by bloom filter"),
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
@@ -313,26 +338,33 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
         GNUNET_h2s (key));
    return 0;   /* can not be present */
  }
-  return h->api->get (h->api->cls, key, type, iter, iter_cls);
+  return h->api->get (h->api->cls,
+                      key,
+                      type,
+                      iter, iter_cls);
 }
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                              const struct GNUNET_HashCode *key,
+                              enum GNUNET_BLOCK_Type type,
                              unsigned int num_results,
                              GNUNET_DATACACHE_Iterator iter,
                              void *iter_cls)
 {
  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop (
+                            "# proximity search requests received",
-                              "# proximity search requests received"),
                            1,
                            GNUNET_NO);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Processing proximity search at `%s'\n",
       GNUNET_h2s (key));
-  return h->api->get_closest (h->api->cls, key, num_results, iter, iter_cls);
+  return h->api->get_closest (h->api->cls,
+                              key,
+                              type,
+                              num_results,
+                              iter, iter_cls);
 }
diff --git a/src/datacache/plugin_datacache_heap.c b/src/datacache/plugin_datacache_heap.c
index fbd3aea9a..5b50468a5 100644
--- a/src/datacache/plugin_datacache_heap.c
+++ b/src/datacache/plugin_datacache_heap.c
@@ -158,7 +158,7 @@ struct PutContext
 * @param value an existing value
 * @return #GNUNET_YES if not found (to continue to iterate)
 */
-static int
+static enum GNUNET_GenericReturnValue
 put_cb (void *cls,
        const struct GNUNET_HashCode *key,
        void *value)
@@ -224,15 +224,20 @@ heap_plugin_put (void *cls,
 {
  struct Plugin *plugin = cls;
  struct Value *val;
-  struct PutContext put_ctx;
+  struct PutContext put_ctx = {
+    .data = data,
-  put_ctx.found = GNUNET_NO;
+    .size = size,
-  put_ctx.data = data;
+    .path_info = path_info,
-  put_ctx.size = size;
+    .path_info_len = path_info_len,
-  put_ctx.path_info = path_info;
+    .discard_time = discard_time,
-  put_ctx.path_info_len = path_info_len;
+    .type = type
-  put_ctx.discard_time = discard_time;
+  };
-  put_ctx.type = type;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Storing %u bytes under key %s with path length %u\n",
+              (unsigned int) size,
+              GNUNET_h2s (key),
+              path_info_len);
  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
                                              key,
                                              &put_cb,
@@ -313,12 +318,25 @@ get_cb (void *cls,
  struct Value *val = value;
  int ret;
-  if ((get_ctx->type != val->type) &&
+  if ( (get_ctx->type != val->type) &&
-      (GNUNET_BLOCK_TYPE_ANY != get_ctx->type))
+       (GNUNET_BLOCK_TYPE_ANY != get_ctx->type) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s does not match block type %d\n",
+                GNUNET_h2s (key),
+                get_ctx->type);
    return GNUNET_OK;
-  if (0 ==
+  }
-      GNUNET_TIME_absolute_get_remaining (val->discard_time).rel_value_us)
+  if (GNUNET_TIME_absolute_is_past (val->discard_time))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s is expired\n",
+                GNUNET_h2s (key));
    return GNUNET_OK;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found result for key %s\n",
+              GNUNET_h2s (key));
  if (NULL != get_ctx->iter)
    ret = get_ctx->iter (get_ctx->iter_cls,
                         key,
@@ -409,13 +427,16 @@ struct GetClosestContext
 {
  struct Value **values;
+  const struct GNUNET_HashCode *key;
+  enum GNUNET_BLOCK_Type type;
  unsigned int num_results;
-  const struct GNUNET_HashCode *key;
 };
-static int
+static enum GNUNET_GenericReturnValue
 find_closest (void *cls,
              const struct GNUNET_HashCode *key,
              void *value)
@@ -427,6 +448,9 @@ find_closest (void *cls,
  if (1 != GNUNET_CRYPTO_hash_cmp (key,
                                   gcc->key))
    return GNUNET_OK; /* useless */
+  if ( (val->type != gcc->type) &&
+       (GNUNET_BLOCK_TYPE_ANY != gcc->type) )
+    return GNUNET_OK; /* useless */
  j = gcc->num_results;
  for (unsigned int i = 0; i < gcc->num_results; i++)
  {
@@ -435,8 +459,9 @@ find_closest (void *cls,
      j = i;
      break;
    }
-    if (1 == GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->key,
+    if (1 ==
-                                     key))
+        GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->key,
+                                key))
    {
      j = i;
      break;
@@ -457,6 +482,7 @@ find_closest (void *cls,
 *
 * @param cls closure (internal context for the plugin)
 * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
 * @param num_results number of results that should be returned to @a iter
 * @param iter maybe NULL (to just count)
 * @param iter_cls closure for @a iter
@@ -465,6 +491,7 @@ find_closest (void *cls,
 static unsigned int
 heap_plugin_get_closest (void *cls,
                         const struct GNUNET_HashCode *key,
+                         enum GNUNET_BLOCK_Type type,
                         unsigned int num_results,
                         GNUNET_DATACACHE_Iterator iter,
                         void *iter_cls)
@@ -473,14 +500,15 @@ heap_plugin_get_closest (void *cls,
  struct Value *values[num_results];
  struct GetClosestContext gcc = {
    .values = values,
-    .num_results = num_results,
+    .type = type,
+    .num_results = num_results * 2,
    .key = key
  };
  GNUNET_CONTAINER_multihashmap_iterate (plugin->map,
                                         &find_closest,
                                         &gcc);
-  for (unsigned int i = 0; i < num_results; i++)
+  for (unsigned int i = 0; i < num_results * 2; i++)
  {
    if (NULL == values[i])
      return i;
@@ -493,7 +521,7 @@ heap_plugin_get_closest (void *cls,
          values[i]->path_info_len,
          values[i]->path_info);
  }
-  return num_results;
+  return num_results * 2;
 }
diff --git a/src/datacache/plugin_datacache_postgres.c b/src/datacache/plugin_datacache_postgres.c
index 6a44c44a5..1a83cda86 100644
--- a/src/datacache/plugin_datacache_postgres.c
+++ b/src/datacache/plugin_datacache_postgres.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018 GNUnet e.V.
+     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -109,9 +109,20 @@ init_connection (struct Plugin *plugin)
                            " ORDER BY prox ASC, discard_time ASC LIMIT 1",
                            0),
    GNUNET_PQ_make_prepare ("get_closest",
-                            "SELECT discard_time,type,value,path,key FROM gn011dc "
+                            "(SELECT discard_time,type,value,path,key FROM gn011dc"
-                            "WHERE key>=$1 AND discard_time >= $2 ORDER BY key ASC LIMIT $3",
+                            " WHERE key >= $1"
-                            3),
+                            "   AND discard_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key ASC"
+                            " LIMIT $4)"
+                            " UNION "
+                            "(SELECT discard_time,type,value,path,key FROM gn011dc"
+                            " WHERE key <= $1"
+                            "   AND discard_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key DESC"
+                            " LIMIT $4)",
+                            4),
    GNUNET_PQ_make_prepare ("delrow",
                            "DELETE FROM gn011dc WHERE oid=$1",
                            1),
@@ -511,6 +522,7 @@ extract_result_cb (void *cls,
 *
 * @param cls closure (internal context for the plugin)
 * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
 * @param num_results number of results that should be returned to @a iter
 * @param iter maybe NULL (to just count)
 * @param iter_cls closure for @a iter
@@ -519,16 +531,19 @@ extract_result_cb (void *cls,
 static unsigned int
 postgres_plugin_get_closest (void *cls,
                             const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
                             unsigned int num_results,
                             GNUNET_DATACACHE_Iterator iter,
                             void *iter_cls)
 {
  struct Plugin *plugin = cls;
  uint32_t num_results32 = (uint32_t) num_results;
+  uint32_t type32 = (uint32_t) type;
  struct GNUNET_TIME_Absolute now;
  struct GNUNET_PQ_QueryParam params[] = {
    GNUNET_PQ_query_param_auto_from_type (key),
    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_uint32 (&type32),
    GNUNET_PQ_query_param_uint32 (&num_results32),
    GNUNET_PQ_query_param_end
  };
diff --git a/src/datacache/plugin_datacache_sqlite.c b/src/datacache/plugin_datacache_sqlite.c
index d08b32caf..6f2165433 100644
--- a/src/datacache/plugin_datacache_sqlite.c
+++ b/src/datacache/plugin_datacache_sqlite.c
@@ -454,6 +454,7 @@ sqlite_plugin_del (void *cls)
 *
 * @param cls closure (internal context for the plugin)
 * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
 * @param num_results number of results that should be returned to @a iter
 * @param iter maybe NULL (to just count)
 * @param iter_cls closure for @a iter
@@ -462,11 +463,13 @@ sqlite_plugin_del (void *cls)
 static unsigned int
 sqlite_plugin_get_closest (void *cls,
                           const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
                           unsigned int num_results,
                           GNUNET_DATACACHE_Iterator iter,
                           void *iter_cls)
 {
  struct Plugin *plugin = cls;
+  uint32_t type32 = type;
  uint32_t num_results32 = num_results;
  struct GNUNET_TIME_Absolute now;
  struct GNUNET_TIME_Absolute exp;
@@ -474,38 +477,46 @@ sqlite_plugin_get_closest (void *cls,
  void *dat;
  unsigned int cnt;
  size_t psize;
-  uint32_t type;
+  uint32_t rtype;
  struct GNUNET_HashCode hc;
  struct GNUNET_DHT_PathElement *path;
-  struct GNUNET_SQ_QueryParam params[] =
+  struct GNUNET_SQ_QueryParam params[] = {
-  { GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_auto_from_type (key),
    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_uint32 (&type32),
    GNUNET_SQ_query_param_uint32 (&num_results32),
-    GNUNET_SQ_query_param_end };
+    GNUNET_SQ_query_param_end
-  struct GNUNET_SQ_ResultSpec rs[] =
+  };
-  { GNUNET_SQ_result_spec_variable_size (&dat, &size),
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size (&dat, &size),
    GNUNET_SQ_result_spec_absolute_time (&exp),
    GNUNET_SQ_result_spec_variable_size ((void **) &path, &psize),
-    GNUNET_SQ_result_spec_uint32 (&type),
+    GNUNET_SQ_result_spec_uint32 (&rtype),
    GNUNET_SQ_result_spec_auto_from_type (&hc),
-    GNUNET_SQ_result_spec_end };
+    GNUNET_SQ_result_spec_end
+  };
  now = GNUNET_TIME_absolute_get ();
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Processing GET_CLOSEST for key `%s'\n",
       GNUNET_h2s (key));
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->get_closest_stmt, params))
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->get_closest_stmt,
+                      params))
  {
    LOG_SQLITE (plugin->dbh,
                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
                "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh, plugin->get_closest_stmt);
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_closest_stmt);
    return 0;
  }
  cnt = 0;
  while (SQLITE_ROW == sqlite3_step (plugin->get_closest_stmt))
  {
-    if (GNUNET_OK != GNUNET_SQ_extract_result (plugin->get_closest_stmt, rs))
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->get_closest_stmt,
+                                  rs))
    {
      GNUNET_break (0);
      break;
@@ -522,14 +533,22 @@ sqlite_plugin_get_closest (void *cls,
         "Found %u-byte result at %s when processing GET_CLOSE\n",
         (unsigned int) size,
         GNUNET_h2s (&hc));
-    if (GNUNET_OK != iter (iter_cls, &hc, size, dat, type, exp, psize, path))
+    if (GNUNET_OK != iter (iter_cls,
+                           &hc,
+                           size,
+                           dat,
+                           rtype,
+                           exp,
+                           psize,
+                           path))
    {
      GNUNET_SQ_cleanup_result (rs);
      break;
    }
    GNUNET_SQ_cleanup_result (rs);
  }
-  GNUNET_SQ_reset (plugin->dbh, plugin->get_closest_stmt);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_closest_stmt);
  return cnt;
 }
@@ -620,7 +639,7 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
                   &plugin->get_stmt)) ||
      (SQLITE_OK != sq_prepare (plugin->dbh,
                                "SELECT _ROWID_,key,value FROM ds091"
-                                " WHERE expire < ?"
+                                " WHERE expire < ?1"
                                " ORDER BY expire ASC LIMIT 1",
                                &plugin->del_expired_stmt)) ||
      (SQLITE_OK != sq_prepare (plugin->dbh,
@@ -632,8 +651,19 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
                                &plugin->del_stmt)) ||
      (SQLITE_OK !=
       sq_prepare (plugin->dbh,
-                   "SELECT value,expire,path,type,key FROM ds091 "
+                   "SELECT * FROM ("
-                   "WHERE key>=? AND expire >= ? ORDER BY KEY ASC LIMIT ?",
+                   " SELECT value,expire,path,type,key FROM ds091 "
+                   " WHERE key>=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY ASC LIMIT ?4)"
+                   "UNION "
+                   "SELECT * FROM ("
+                   " SELECT value,expire,path,type,key FROM ds091 "
+                   " WHERE key<=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY DESC LIMIT ?4)",
                   &plugin->get_closest_stmt)))
  {
    LOG_SQLITE (plugin->dbh,
diff --git a/src/datacache/plugin_datacache_template.c b/src/datacache/plugin_datacache_template.c
index 231413ce9..2f7b41dbe 100644
--- a/src/datacache/plugin_datacache_template.c
+++ b/src/datacache/plugin_datacache_template.c
@@ -116,6 +116,7 @@ template_plugin_del (void *cls)
 *
 * @param cls closure (internal context for the plugin)
 * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
 * @param num_results number of results that should be returned to @a iter
 * @param iter maybe NULL (to just count)
 * @param iter_cls closure for @a iter
@@ -124,6 +125,7 @@ template_plugin_del (void *cls)
 static unsigned int
 template_plugin_get_closest (void *cls,
                             const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
                             unsigned int num_results,
                             GNUNET_DATACACHE_Iterator iter,
                             void *iter_cls)
diff --git a/src/dht/.gitignore b/src/dht/.gitignore
index 25b1daf28..bd8af1217 100644
--- a/src/dht/.gitignore
+++ b/src/dht/.gitignore
@@ -10,3 +10,4 @@ test_dht_monitor
 test_dht_multipeer
 test_dht_tools.py
 test_dht_twopeer
+gnunet-dht-hello
diff --git a/src/dht/Makefile.am b/src/dht/Makefile.am
index be48fab02..68a17723d 100644
--- a/src/dht/Makefile.am
+++ b/src/dht/Makefile.am
@@ -50,7 +50,8 @@ libexec_PROGRAMS = \
 bin_PROGRAMS = \
 gnunet-dht-monitor \
 gnunet-dht-get \
- gnunet-dht-put
+ gnunet-dht-put \
+ gnunet-dht-hello
 noinst_PROGRAMS = \
 gnunet-dht-profiler
@@ -58,8 +59,6 @@ noinst_PROGRAMS = \
 gnunet_service_dht_SOURCES = \
 gnunet-service-dht.c gnunet-service-dht.h \
 gnunet-service-dht_datacache.c gnunet-service-dht_datacache.h \
- gnunet-service-dht_hello.c gnunet-service-dht_hello.h \
- gnunet-service-dht_nse.c gnunet-service-dht_nse.h \
 gnunet-service-dht_neighbours.c gnunet-service-dht_neighbours.h \
 gnunet-service-dht_routing.c gnunet-service-dht_routing.h
 gnunet_service_dht_LDADD = \
@@ -72,6 +71,7 @@ gnunet_service_dht_LDADD = \
  $(top_builddir)/src/peerinfo/libgnunetpeerinfo.la \
  $(top_builddir)/src/hello/libgnunethello.la \
  $(top_builddir)/src/block/libgnunetblock.la \
+  $(top_builddir)/src/block/libgnunetblockgroup.la \
  $(top_builddir)/src/datacache/libgnunetdatacache.la \
  $(top_builddir)/src/util/libgnunetutil.la \
  -lm
@@ -82,16 +82,22 @@ gnunet_dht_get_SOURCES = \
 gnunet-dht-get.c
 gnunet_dht_get_LDADD = \
  libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
  $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_get_LDFLAGS = \
  $(GN_LIBINTL)
+gnunet_dht_hello_SOURCES = \
+ gnunet-dht-hello.c
+gnunet_dht_hello_LDADD = \
+  libgnunetdht.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+gnunet_dht_hello_LDFLAGS = \
+  $(GN_LIBINTL)
 gnunet_dht_put_SOURCES = \
 gnunet-dht-put.c
 gnunet_dht_put_LDADD = \
  libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
  $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_put_LDFLAGS = \
  $(GN_LIBINTL)
@@ -100,7 +106,6 @@ gnunet_dht_monitor_SOURCES = \
 gnunet-dht-monitor.c
 gnunet_dht_monitor_LDADD = \
  libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
  $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_monitor_LDFLAGS = \
  $(GN_LIBINTL)
@@ -199,7 +204,6 @@ test_dht_monitor_LDADD = \
 libgnunetdht.la
 EXTRA_DIST = \
-  $(check_SCRIPTS) \
  gnunet-service-dht_clients.c \
  test_dht_api_data.conf \
  test_dht_api_peer1.conf \
@@ -209,7 +213,10 @@ EXTRA_DIST = \
  test_dht_line.conf \
  test_dht_tools.conf \
  test_dht_tools.py.in \
-  test_dht_multipeer_topology.dat
+  test_dht_multipeer_topology.dat \
+  dhtu_testbed_connect.sh \
+  dhtu_testbed_deploy.conf \
+  dhtu_testbed_deploy.sh
 if HAVE_PYTHON
 check_SCRIPTS = \
diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index 8389bbb95..474198004 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011, 2012, 2016, 2018 GNUnet e.V.
+     Copyright (C) 2009-2012, 2016, 2018, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -197,6 +197,40 @@ struct GNUNET_DHT_MonitorHandle
 /**
+ * Handle to get a HELLO URL from the DHT for manual bootstrapping.
+ */
+struct GNUNET_DHT_HelloGetHandle
+{
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *next;
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *prev;
+  /**
+   * Function to call with the result.
+   */
+  GNUNET_DHT_HelloGetCallback cb;
+  /**
+   * Closure for @a cb.
+   */
+  void *cb_cls;
+  /**
+   * Connection to the DHT service.
+   */
+  struct GNUNET_DHT_Handle *dht_handle;
+};
+/**
 * Connection to the DHT service.
 */
 struct GNUNET_DHT_Handle
@@ -232,6 +266,16 @@ struct GNUNET_DHT_Handle
  struct GNUNET_DHT_PutHandle *put_tail;
  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *hgh_head;
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *hgh_tail;
+  /**
   * Hash map containing the current outstanding unique GET requests
   * (values are of type `struct GNUNET_DHT_GetHandle`).
   */
@@ -517,9 +561,10 @@ handle_monitor_get (void *cls,
                    const struct GNUNET_DHT_MonitorGetMessage *msg)
 {
  struct GNUNET_DHT_Handle *handle = cls;
-  struct GNUNET_DHT_MonitorHandle *mh;
-  for (mh = handle->monitor_head; NULL != mh; mh = mh->next)
+  for (struct GNUNET_DHT_MonitorHandle *mh = handle->monitor_head;
+       NULL != mh;
+       mh = mh->next)
  {
    if (NULL == mh->get_cb)
      continue;
@@ -582,10 +627,12 @@ handle_monitor_get_resp (void *cls,
  const struct GNUNET_DHT_PathElement *path;
  uint32_t getl = ntohl (msg->get_path_length);
  uint32_t putl = ntohl (msg->put_path_length);
-  struct GNUNET_DHT_MonitorHandle *mh;
  path = (const struct GNUNET_DHT_PathElement *) &msg[1];
-  for (mh = handle->monitor_head; NULL != mh; mh = mh->next)
+  for (struct GNUNET_DHT_MonitorHandle *mh = handle->monitor_head;
+       NULL != mh;
+       mh = mh->next)
  {
    if (NULL == mh->get_resp_cb)
      continue;
@@ -597,9 +644,9 @@ handle_monitor_get_resp (void *cls,
                       sizeof(struct GNUNET_HashCode)))))
      mh->get_resp_cb (mh->cb_cls,
                       (enum GNUNET_BLOCK_Type) ntohl (msg->type),
-                       path,
+                       &path[putl],
                       getl,
-                       &path[getl],
+                       path,
                       putl,
                       GNUNET_TIME_absolute_ntoh (msg->expiration_time),
                       &msg->key,
@@ -726,14 +773,21 @@ process_client_result (void *cls,
  const struct GNUNET_DHT_ClientResultMessage *crm = cls;
  struct GNUNET_DHT_GetHandle *get_handle = value;
  size_t msize = ntohs (crm->header.size) - sizeof(*crm);
+  uint16_t type = ntohl (crm->type);
  uint32_t put_path_length = ntohl (crm->put_path_length);
  uint32_t get_path_length = ntohl (crm->get_path_length);
-  const struct GNUNET_DHT_PathElement *put_path;
+  const struct GNUNET_DHT_PathElement *put_path
-  const struct GNUNET_DHT_PathElement *get_path;
+    = (const struct GNUNET_DHT_PathElement *) &crm[1];
+  const struct GNUNET_DHT_PathElement *get_path
+    = &put_path[put_path_length];
+  const void *data
+    = &get_path[get_path_length];
+  size_t meta_length
+    = sizeof(struct GNUNET_DHT_PathElement) * (get_path_length
+                                               + put_path_length);
+  size_t data_length
+    = msize - meta_length;
  struct GNUNET_HashCode hc;
-  size_t data_length;
-  size_t meta_length;
-  const void *data;
  if (crm->unique_id != get_handle->unique_id)
  {
@@ -745,12 +799,14 @@ process_client_result (void *cls,
         (unsigned long long) get_handle->unique_id);
    return GNUNET_YES;
  }
-  /* FIXME: might want to check that type matches */
+  if ( (get_handle->type != GNUNET_BLOCK_TYPE_ANY) &&
-  meta_length =
+       (get_handle->type != type) )
-    sizeof(struct GNUNET_DHT_PathElement) * (get_path_length + put_path_length);
+  {
-  data_length = msize - meta_length;
+    /* type mismatch */
-  put_path = (const struct GNUNET_DHT_PathElement *) &crm[1];
+    GNUNET_break (0);
-  get_path = &put_path[put_path_length];
+    return GNUNET_YES;
+  }
  {
    char *pp;
    char *gp;
@@ -768,7 +824,6 @@ process_client_result (void *cls,
    GNUNET_free (gp);
    GNUNET_free (pp);
  }
-  data = &get_path[get_path_length];
  /* remember that we've seen this result */
  GNUNET_CRYPTO_hash (data,
                      data_length,
@@ -786,7 +841,7 @@ process_client_result (void *cls,
                    get_path_length,
                    put_path,
                    put_path_length,
-                    ntohl (crm->type),
+                    type,
                    data_length,
                    data);
  return GNUNET_YES;
@@ -813,6 +868,53 @@ handle_client_result (void *cls,
 /**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls The DHT handle.
+ * @param hdr HELLO URL message from the service.
+ * @return #GNUNET_OK if @a hdr is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_client_hello (void *cls,
+                    const struct GNUNET_MessageHeader *hdr)
+{
+  uint16_t len = ntohs (hdr->size);
+  const char *buf = (const char *) &hdr[1];
+  (void) cls;
+  if ('\0' != buf[len - sizeof (*hdr) - 1])
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+/**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls The DHT handle.
+ * @param hdr HELLO URL message from the service.
+ */
+static void
+handle_client_hello (void *cls,
+                     const struct GNUNET_MessageHeader *hdr)
+{
+  struct GNUNET_DHT_Handle *handle = cls;
+  const char *url = (const char *) &hdr[1];
+  struct GNUNET_DHT_HelloGetHandle *hgh;
+  while (NULL != (hgh = handle->hgh_head))
+  {
+    hgh->cb (hgh->cb_cls,
+             url);
+    GNUNET_DHT_hello_get_cancel (hgh);
+  }
+}
+/**
 * Process a MQ PUT transmission notification.
 *
 * @param cls The DHT handle.
@@ -859,6 +961,10 @@ try_connect (struct GNUNET_DHT_Handle *h)
                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_RESULT,
                           struct GNUNET_DHT_ClientResultMessage,
                           h),
+    GNUNET_MQ_hd_var_size (client_hello,
+                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL,
+                           struct GNUNET_MessageHeader,
+                           h),
    GNUNET_MQ_handler_end ()
  };
@@ -1194,8 +1300,7 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
 unsigned int
-GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
+GNUNET_DHT_verify_path (const void *data,
-                        const void *data,
                        size_t data_size,
                        struct GNUNET_TIME_Absolute exp_time,
                        const struct GNUNET_DHT_PathElement *put_path,
@@ -1207,47 +1312,125 @@ GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
  struct GNUNET_DHT_HopSignature hs = {
    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_DHT_HOP),
    .purpose.size = htonl (sizeof (hs)),
-    .expiration_time = GNUNET_TIME_absolute_hton (exp_time),
+    .expiration_time = GNUNET_TIME_absolute_hton (exp_time)
-    .key = *key,
  };
+  const struct GNUNET_PeerIdentity *pred;
+  const struct GNUNET_PeerIdentity *succ;
  unsigned int i;
  if (0 == get_path_len + put_path_len)
    return 0;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Verifying signatures with GPL: %u PPL: %u!\n",
+              "%s is verifying signatures with GPL: %u PPL: %u!\n",
+              GNUNET_i2s (me),
              get_path_len,
              put_path_len);
+  for (unsigned int j = 0; j<put_path_len; j++)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "PP%u=%s\n",
+                j,
+                GNUNET_i2s (&put_path[j].pred));
+  for (unsigned int j = 0; j<get_path_len; j++)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "GP%u=%s\n",
+                j,
+                GNUNET_i2s (&get_path[j].pred));
  i = put_path_len + get_path_len - 1;
  GNUNET_CRYPTO_hash (data,
                      data_size,
                      &hs.h_data);
  while (i > 0)
  {
-    hs.pred = (i - 1 >= put_path_len)
+    pred = (i - 1 >= put_path_len)
-      ? get_path[i - put_path_len - 1].pred
+      ? &get_path[i - put_path_len - 1].pred
-      : put_path[i - 1].pred;
+      : &put_path[i - 1].pred;
    if (i + 1 == get_path_len + put_path_len)
-      hs.succ = *me;
+      succ = me;
    else
-      hs.succ = (i + 1 >= put_path_len)
+      succ = (i + 1 >= put_path_len)
-        ? get_path[i + 1 - put_path_len].pred
+        ? &get_path[i + 1 - put_path_len].pred
-        : put_path[i + 1].pred;
+        : &put_path[i + 1].pred;
+    hs.pred = *pred;
+    hs.succ = *succ;
    if (GNUNET_OK !=
        GNUNET_CRYPTO_eddsa_verify (
          GNUNET_SIGNATURE_PURPOSE_DHT_HOP,
          &hs,
          (i - 1 >= put_path_len)
-          ? &get_path[i - put_path_len - 1].sig
+            ? &get_path[i - put_path_len - 1].sig
          : &put_path[i - 1].sig,
          (i >= put_path_len)
          ? &get_path[i - put_path_len].pred.public_key
          : &put_path[i].pred.public_key))
+    {
+      GNUNET_break_op (0);
      return i;
+    }
    i--;
  }
  return i;
 }
+struct GNUNET_DHT_HelloGetHandle *
+GNUNET_DHT_hello_get (struct GNUNET_DHT_Handle *dht_handle,
+                      GNUNET_DHT_HelloGetCallback cb,
+                      void *cb_cls)
+{
+  struct GNUNET_DHT_HelloGetHandle *hgh;
+  struct GNUNET_MessageHeader *hdr;
+  struct GNUNET_MQ_Envelope *env;
+  hgh = GNUNET_new (struct GNUNET_DHT_HelloGetHandle);
+  hgh->cb = cb;
+  hgh->cb_cls = cb_cls;
+  hgh->dht_handle = dht_handle;
+  GNUNET_CONTAINER_DLL_insert (dht_handle->hgh_head,
+                               dht_handle->hgh_tail,
+                               hgh);
+  env = GNUNET_MQ_msg (hdr,
+                       GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET);
+  GNUNET_MQ_send (dht_handle->mq,
+                  env);
+  return hgh;
+}
+void
+GNUNET_DHT_hello_get_cancel (struct GNUNET_DHT_HelloGetHandle *hgh)
+{
+  struct GNUNET_DHT_Handle *dht_handle = hgh->dht_handle;
+  GNUNET_CONTAINER_DLL_remove (dht_handle->hgh_head,
+                               dht_handle->hgh_tail,
+                               hgh);
+  GNUNET_free (hgh);
+}
+void
+GNUNET_DHT_hello_offer (struct GNUNET_DHT_Handle *dht_handle,
+                        const char *url,
+                        GNUNET_SCHEDULER_TaskCallback cb,
+                        void *cb_cls)
+{
+  struct GNUNET_MessageHeader *hdr;
+  size_t slen = strlen (url) + 1;
+  struct GNUNET_MQ_Envelope *env;
+  env = GNUNET_MQ_msg_extra (hdr,
+                             slen,
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL);
+  memcpy (&hdr[1],
+          url,
+          slen);
+  GNUNET_MQ_notify_sent (env,
+                         cb,
+                         cb_cls);
+  GNUNET_MQ_send (dht_handle->mq,
+                  env);
+}
 /* end of dht_api.c */
diff --git a/src/dht/dhtu_testbed_connect.sh b/src/dht/dhtu_testbed_connect.sh
new file mode 100755
index 000000000..871e9eb1b
--- /dev/null
+++ b/src/dht/dhtu_testbed_connect.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# This file is in the public domain.
+# Helper script for dhtu_testbed_deploy.sh.
+# Do not invoke directly.
+n=$1
+CFG="/tmp/deployment/${n}.conf"
+HELLO=`gnunet-dht-hello -c $CFG`
+# Create dense topology:
+#for OFF in `seq 1 $MAX`
+#do
+#    TCFG="/tmp/deployment/${OFF}.conf"
+#    gnunet-dht-hello -c $TCFG $HELLO
+#done
+#exit 0
+# Create sparse topology:
+R=1
+while test `expr $R \* $R \* $R` -lt $MAX
+do
+    END=`expr $R \* $R`
+    for M in `seq $R $R $END`
+    do
+        OFF=`expr \( $n + $M \) % $MAX`
+        TCFG="/tmp/deployment/${OFF}.conf"
+        gnunet-dht-hello -c $TCFG $HELLO
+    done
+    R=`expr $R + 1`
+done
diff --git a/src/dht/dhtu_testbed_deploy.conf b/src/dht/dhtu_testbed_deploy.conf
new file mode 100644
index 000000000..59d69894a
--- /dev/null
+++ b/src/dht/dhtu_testbed_deploy.conf
@@ -0,0 +1,26 @@
+# This file is in the public domain.
+# Simple configuration template to deploy a DHT testbed
+# with peers using the IP underlay.
+[paths]
+GNUNET_DATA_HOME=/tmp/%N%
+[dht]
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-dht-%N%.sock
+[dhtu-ip]
+ENABLED = YES
+NSE = 10
+UDP_PORT = %N%
+[dhtu-gnunet]
+ENABLED = NO
+[statistics]
+DISABLE = YES
+[dhtcache]
+DATABASE = heap
+QUOTA = 50 MB
+DISABLE_BF_RC = YES
diff --git a/src/dht/dhtu_testbed_deploy.sh b/src/dht/dhtu_testbed_deploy.sh
new file mode 100755
index 000000000..908bbf685
--- /dev/null
+++ b/src/dht/dhtu_testbed_deploy.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+# This file is in the public domain.
+# We will use UDP ports above this number.
+MINPORT=10000
+# Cleanup to run whenever we exit
+function cleanup()
+{
+    for n in `jobs -p`
+    do
+        kill $n 2> /dev/null || true
+    done
+    wait
+}
+# Install cleanup handler (except for kill -9)
+trap cleanup EXIT
+if test -z "$1"
+then
+    echo "Call with the number of peers to launch."
+    exit 1
+fi
+if test ! -x `which parallel`
+then
+    echo "This script requires GNU parallel"
+    exit 1
+fi
+if test ! -x `which gnunet-service-dht`
+then
+    echo "This script requires gnunet-service-dht in \$PATH"
+    exit 1
+fi
+if test ! -x `which gnunet-dht-hello`
+then
+    echo "This script requires gnunet-dht-hello in \$PATH"
+    exit 1
+fi
+MAX=`expr $1 - 1`
+# export GNUNET_FORCE_LOG="dht*;;;;DEBUG"
+echo -n "Starting $1 peers "
+mkdir -p /tmp/deployment
+for n in `seq 0 $MAX`
+do
+    PORT=`expr $MINPORT + $n`
+    CFG="/tmp/deployment/${n}.conf"
+    cat dhtu_testbed_deploy.conf | sed -e "s/%N%/$PORT/" > $CFG
+    gnunet-service-dht -c $CFG &> /tmp/deployment/$n.log &
+    echo -n "."
+done
+echo ""
+echo "$1 peers ready".
+unset GNUNET_FORCE_LOG
+function connect()
+{
+  n=$1
+}
+echo -n "Connecting peers ..."
+export MAX
+if test 0 != $MAX
+then
+  seq 0 $MAX | parallel ./dhtu_testbed_connect.sh :::
+fi
+echo ""
+echo "Network ready. Press ENTER to terminate the testbed!"
+echo "Interact with peers using '-c /tmp/deployment/\$N.conf'"
+read
+exit 0
diff --git a/src/dht/gnunet-dht-get.c b/src/dht/gnunet-dht-get.c
index f1076490b..42ffe75ba 100644
--- a/src/dht/gnunet-dht-get.c
+++ b/src/dht/gnunet-dht-get.c
@@ -58,6 +58,11 @@ static unsigned int verbose;
 static int demultixplex_everywhere;
 /**
+ * Use #GNUNET_DHT_RO_RECORD_ROUTE.
+ */
+static int record_route;
+/**
 * Handle to the DHT
 */
 static struct GNUNET_DHT_Handle *dht_handle;
@@ -160,9 +165,9 @@ get_result_iterator (void *cls,
           : _ ("Result %d, type %d:\n"),
           result_count,
           type,
-           (unsigned int) size,
+           (int) size,
           (char *) data);
-  if (verbose)
+  if (record_route && verbose)
  {
    fprintf (stdout,
             "  GET path: ");
@@ -200,6 +205,7 @@ run (void *cls,
     const struct GNUNET_CONFIGURATION_Handle *c)
 {
  struct GNUNET_HashCode key;
+  enum GNUNET_DHT_RouteOption ro;
  cfg = c;
  if (NULL == query_key)
@@ -228,13 +234,16 @@ run (void *cls,
             GNUNET_h2s_full (&key));
  GNUNET_SCHEDULER_add_shutdown (&cleanup_task, NULL);
  tt = GNUNET_SCHEDULER_add_delayed (timeout_request, &timeout_task, NULL);
+  ro = GNUNET_DHT_RO_NONE;
+  if (demultixplex_everywhere)
+    ro |= GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE;
+  if (record_route)
+    ro |= GNUNET_DHT_RO_RECORD_ROUTE;
  get_handle = GNUNET_DHT_get_start (dht_handle,
                                     query_type,
                                     &key,
                                     replication,
-                                     (demultixplex_everywhere)
+                                     ro,
-                                     ? GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE
-                                     : GNUNET_DHT_RO_NONE,
                                     NULL,
                                     0,
                                     &get_result_iterator,
@@ -265,6 +274,11 @@ main (int argc, char *const *argv)
      "LEVEL",
      gettext_noop ("how many parallel requests (replicas) to create"),
      &replication),
+    GNUNET_GETOPT_option_flag (
+      'R',
+      "record",
+      gettext_noop ("use DHT's record route option"),
+      &record_route),
    GNUNET_GETOPT_option_uint (
      't',
      "type",
diff --git a/src/dht/gnunet-dht-hello.c b/src/dht/gnunet-dht-hello.c
new file mode 100644
index 000000000..369ed5643
--- /dev/null
+++ b/src/dht/gnunet-dht-hello.c
@@ -0,0 +1,178 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file dht/gnunet-dht-hello.c
+ * @brief Obtain HELLO from DHT for bootstrapping
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_dht_service.h"
+#define LOG(kind, ...) GNUNET_log_from (kind, "dht-clients", __VA_ARGS__)
+/**
+ * Handle to the DHT
+ */
+static struct GNUNET_DHT_Handle *dht_handle;
+/**
+ * Handle to the DHT hello get operation.
+ */
+static struct GNUNET_DHT_HelloGetHandle *get_hello_handle;
+/**
+ * Global status value
+ */
+static int global_ret;
+/**
+ * Task run to clean up on shutdown.
+ *
+ * @param cls unused
+ */
+static void
+cleanup_task (void *cls)
+{
+  if (NULL != get_hello_handle)
+  {
+    GNUNET_DHT_hello_get_cancel (get_hello_handle);
+    get_hello_handle = NULL;
+  }
+  if (NULL != dht_handle)
+  {
+    GNUNET_DHT_disconnect (dht_handle);
+    dht_handle = NULL;
+  }
+}
+/**
+ * Task run when we are finished. Triggers shutdown.
+ *
+ * @param cls unused
+ */
+static void
+hello_done_cb (void *cls)
+{
+  GNUNET_SCHEDULER_shutdown ();
+}
+/**
+ * Function called on our HELLO.
+ *
+ * @param cls closure
+ * @param url the HELLO URL
+ */
+static void
+hello_result_cb (void *cls,
+                 const char *url)
+{
+  get_hello_handle = NULL;
+  fprintf (stdout,
+           "%s\n",
+           url);
+  GNUNET_SCHEDULER_shutdown ();
+}
+/**
+ * Main function that will be run by the scheduler.
+ *
+ * @param cls closure, NULL
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  (void) cls;
+  (void) cfgfile;
+  GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
+                                 NULL);
+  if (NULL == (dht_handle = GNUNET_DHT_connect (cfg,
+                                                1)))
+  {
+    fprintf (stderr,
+             _ ("Failed to connect to DHT service!\n"));
+    global_ret = EXIT_NOTCONFIGURED;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (NULL == args[0])
+  {
+    get_hello_handle = GNUNET_DHT_hello_get (dht_handle,
+                                             &hello_result_cb,
+                                             NULL);
+    GNUNET_break (NULL != get_hello_handle);
+  }
+  else
+  {
+    GNUNET_DHT_hello_offer (dht_handle,
+                            args[0],
+                            &hello_done_cb,
+                            NULL);
+  }
+}
+/**
+ * Entry point for gnunet-dht-hello
+ *
+ * @param argc number of arguments from the command line
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ */
+int
+main (int argc,
+      char *const *argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+  enum GNUNET_GenericReturnValue iret;
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_get_utf8_args (argc, argv,
+                                    &argc, &argv))
+    return 2;
+  iret = GNUNET_PROGRAM_run (
+    argc,
+    argv,
+    "gnunet-dht-hello [URL]",
+    gettext_noop (
+      "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"),
+    options,
+    &run,
+    NULL);
+  if (GNUNET_SYSERR == iret)
+    return EXIT_FAILURE;
+  if (GNUNET_NO == iret)
+    return EXIT_SUCCESS;
+  return global_ret;
+}
+/* end of gnunet-dht-hello.c */
diff --git a/src/dht/gnunet-service-dht.c b/src/dht/gnunet-service-dht.c
index da46dcfee..39433791d 100644
--- a/src/dht/gnunet-service-dht.c
+++ b/src/dht/gnunet-service-dht.c
@@ -27,53 +27,335 @@
 #include "platform.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_transport_service.h"
-#include "gnunet_transport_hello_service.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet-service-dht.h"
 #include "gnunet-service-dht_datacache.h"
-#include "gnunet-service-dht_hello.h"
 #include "gnunet-service-dht_neighbours.h"
-#include "gnunet-service-dht_nse.h"
 #include "gnunet-service-dht_routing.h"
 /**
+ * How often do we broadcast our HELLO to neighbours if
+ * nothing special happens?
+ */
+#define HELLO_FREQUENCY GNUNET_TIME_UNIT_HOURS
+/**
+ * Information we keep per underlay.
+ */
+struct GDS_Underlay
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct GDS_Underlay *next;
+  /**
+   * Kept in a DLL.
+   */
+  struct GDS_Underlay *prev;
+  /**
+   * Environment for this underlay.
+   */
+  struct GNUNET_DHTU_PluginEnvironment env;
+  /**
+   * Underlay API handle.
+   */
+  struct GNUNET_DHTU_PluginFunctions *dhtu;
+  /**
+   * current network size estimate for this underlay.
+   */
+  double network_size_estimate;
+  /**
+   * Name of the underlay (i.e. "gnunet" or "ip").
+   */
+  char *name;
+  /**
+   * Name of the library providing the underlay.
+   */
+  char *libname;
+};
+/**
+ * An address of this peer.
+ */
+struct MyAddress
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct MyAddress *next;
+  /**
+   * Kept in a DLL.
+   */
+  struct MyAddress *prev;
+  /**
+   * Underlay handle for the address.
+   */
+  struct GNUNET_DHTU_Source *source;
+  /**
+   * Textual representation of the address.
+   */
+  char *url;
+  /**
+   * Underlay of this address.
+   */
+  struct GDS_Underlay *u;
+};
+/**
 * Our HELLO
 */
-struct GNUNET_MessageHeader *GDS_my_hello;
+struct GNUNET_HELLO_Builder *GDS_my_hello;
 /**
- * Handle to get our current HELLO.
+ * Identity of this peer.
 */
-static struct GNUNET_TRANSPORT_HelloGetHandle *ghh;
+struct GNUNET_PeerIdentity GDS_my_identity;
 /**
- * Hello address expiration
+ * Hash of the identity of this peer.
 */
-struct GNUNET_TIME_Relative hello_expiration;
+struct GNUNET_HashCode GDS_my_identity_hash;
+/**
+ * Our private key.
+ */
+struct GNUNET_CRYPTO_EddsaPrivateKey GDS_my_private_key;
+/**
+ * Task broadcasting our HELLO.
+ */
+static struct GNUNET_SCHEDULER_Task *hello_task;
+/**
+ * Handles for the DHT underlays.
+ */
+static struct GDS_Underlay *u_head;
+/**
+ * Handles for the DHT underlays.
+ */
+static struct GDS_Underlay *u_tail;
+/**
+ * Head of addresses of this peer.
+ */
+static struct MyAddress *a_head;
+/**
+ * Tail of addresses of this peer.
+ */
+static struct MyAddress *a_tail;
+/**
+ * log of the current network size estimate, used as the point where
+ * we switch between random and deterministic routing.
+ */
+static double log_of_network_size_estimate;
+/**
+ * Callback that is called when network size estimate is updated.
+ *
+ * @param cls a `struct GDS_Underlay`
+ * @param timestamp time when the estimate was received from the server (or created by the server)
+ * @param logestimate the log(Base 2) value of the current network size estimate
+ * @param std_dev standard deviation for the estimate
+ *
+ */
+static void
+update_network_size_estimate (void *cls,
+                              struct GNUNET_TIME_Absolute timestamp,
+                              double logestimate,
+                              double std_dev)
+{
+  struct GDS_Underlay *u = cls;
+  double sum = 0.0;
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# Network size estimates received",
+                            1,
+                            GNUNET_NO);
+  /* do not allow estimates < 0.5 */
+  u->network_size_estimate = pow (2.0,
+                                  GNUNET_MAX (0.5,
+                                              logestimate));
+  for (struct GDS_Underlay *p = u_head; NULL != p; p = p->next)
+    sum += p->network_size_estimate;
+  if (sum <= 2.0)
+    log_of_network_size_estimate = 0.5;
+  else
+    log_of_network_size_estimate = log2 (sum);
+}
+/**
+ * Return the current NSE
+ *
+ * @return the current NSE as a logarithm
+ */
+double
+GDS_NSE_get (void)
+{
+  return log_of_network_size_estimate;
+}
 #include "gnunet-service-dht_clients.c"
 /**
- * Receive the HELLO from transport service, free current and replace
+ * Task run periodically to broadcast our HELLO.
- * if necessary.
 *
 * @param cls NULL
- * @param message HELLO message of peer
 */
 static void
-process_hello (void *cls,
+broadcast_hello (void *cls)
-               const struct GNUNET_MessageHeader *message)
 {
-  GNUNET_free (GDS_my_hello);
+  struct GNUNET_MessageHeader *hello;
-  GDS_my_hello = GNUNET_malloc (ntohs (message->size));
-  GNUNET_memcpy (GDS_my_hello,
+  (void) cls;
-                 message,
+  /* TODO: randomize! */
-                 ntohs (message->size));
+  hello_task = GNUNET_SCHEDULER_add_delayed (HELLO_FREQUENCY,
+                                             &broadcast_hello,
+                                             NULL);
+  hello = GNUNET_HELLO_builder_to_dht_hello_msg (GDS_my_hello,
+                                                 &GDS_my_private_key);
+  if (NULL == hello)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  GDS_NEIGHBOURS_broadcast (hello);
+  GNUNET_free (hello);
+}
+/**
+ * Function to call with new addresses of this peer.
+ *
+ * @param cls the closure
+ * @param address address under which we are likely reachable,
+ *           pointer will remain valid until @e address_del_cb is called; to be used for HELLOs. Example: "ip+udp://$PID/1.1.1.1:2086/"
+ * @param source handle for sending from this address, NULL if we can only receive
+ * @param[out] ctx storage space for DHT to use in association with this address
+ */
+static void
+u_address_add (void *cls,
+               const char *address,
+               struct GNUNET_DHTU_Source *source,
+               void **ctx)
+{
+  struct GDS_Underlay *u = cls;
+  struct MyAddress *a;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Underlay adds address %s for this peer\n",
+              address);
+  a = GNUNET_new (struct MyAddress);
+  a->source = source;
+  a->url = GNUNET_strdup (address);
+  a->u = u;
+  GNUNET_CONTAINER_DLL_insert (a_head,
+                               a_tail,
+                               a);
+  *ctx = a;
+  GNUNET_HELLO_builder_add_address (GDS_my_hello,
+                                    address);
+  if (NULL != hello_task)
+    GNUNET_SCHEDULER_cancel (hello_task);
+  hello_task = GNUNET_SCHEDULER_add_now (&broadcast_hello,
+                                         NULL);
+}
+/**
+ * Function to call with expired addresses of this peer.
+ *
+ * @param[in] ctx storage space used by the DHT in association with this address
+ */
+static void
+u_address_del (void *ctx)
+{
+  struct MyAddress *a = ctx;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Underlay deletes address %s for this peer\n",
+              a->url);
+  GNUNET_HELLO_builder_del_address (GDS_my_hello,
+                                    a->url);
+  GNUNET_CONTAINER_DLL_remove (a_head,
+                               a_tail,
+                               a);
+  GNUNET_free (a->url);
+  GNUNET_free (a);
+  if (NULL != hello_task)
+    GNUNET_SCHEDULER_cancel (hello_task);
+  hello_task = GNUNET_SCHEDULER_add_now (&broadcast_hello,
+                                         NULL);
+}
+void
+GDS_u_try_connect (const struct GNUNET_PeerIdentity *pid,
+                   const char *address)
+{
+  for (struct GDS_Underlay *u = u_head;
+       NULL != u;
+       u = u->next)
+    u->dhtu->try_connect (u->dhtu->cls,
+                          pid,
+                          address);
+}
+void
+GDS_u_send (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target,
+            const void *msg,
+            size_t msg_size,
+            GNUNET_SCHEDULER_TaskCallback finished_cb,
+            void *finished_cb_cls)
+{
+  u->dhtu->send (u->dhtu->cls,
+                 target,
+                 msg,
+                 msg_size,
+                 finished_cb,
+                 finished_cb_cls);
+}
+void
+GDS_u_drop (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_PreferenceHandle *ph)
+{
+  u->dhtu->drop (ph);
+}
+struct GNUNET_DHTU_PreferenceHandle *
+GDS_u_hold (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target)
+{
+  return u->dhtu->hold (u->dhtu->cls,
+                        target);
 }
@@ -85,30 +367,97 @@ process_hello (void *cls,
 static void
 shutdown_task (void *cls)
 {
-  if (NULL != ghh)
+  struct GDS_Underlay *u;
+  while (NULL != (u = u_head))
  {
-    GNUNET_TRANSPORT_hello_get_cancel (ghh);
+    GNUNET_PLUGIN_unload (u->libname,
-    ghh = NULL;
+                          u->dhtu);
+    GNUNET_CONTAINER_DLL_remove (u_head,
+                                 u_tail,
+                                 u);
+    GNUNET_free (u->name);
+    GNUNET_free (u->libname);
+    GNUNET_free (u);
  }
  GDS_NEIGHBOURS_done ();
  GDS_DATACACHE_done ();
  GDS_ROUTING_done ();
-  GDS_HELLO_done ();
-  GDS_NSE_done ();
  if (NULL != GDS_block_context)
  {
    GNUNET_BLOCK_context_destroy (GDS_block_context);
    GDS_block_context = NULL;
  }
+  GDS_CLIENTS_stop ();
  if (NULL != GDS_stats)
  {
    GNUNET_STATISTICS_destroy (GDS_stats,
                               GNUNET_YES);
    GDS_stats = NULL;
  }
-  GNUNET_free (GDS_my_hello);
+  if (NULL != GDS_my_hello)
-  GDS_my_hello = NULL;
+  {
-  GDS_CLIENTS_stop ();
+    GNUNET_HELLO_builder_free (GDS_my_hello);
+    GDS_my_hello = NULL;
+  }
+  if (NULL != hello_task)
+  {
+    GNUNET_SCHEDULER_cancel (hello_task);
+    hello_task = NULL;
+  }
+}
+/**
+ * Function iterating over all configuration sections.
+ * Loads plugins for enabled DHT underlays.
+ *
+ * @param cls NULL
+ * @param section configuration section to inspect
+ */
+static void
+load_underlay (void *cls,
+               const char *section)
+{
+  struct GDS_Underlay *u;
+  char *libname;
+  (void) cls;
+  if (0 != strncasecmp (section,
+                        "dhtu-",
+                        strlen ("dhtu-")))
+    return;
+  if (GNUNET_YES !=
+      GNUNET_CONFIGURATION_get_value_yesno (GDS_cfg,
+                                            section,
+                                            "ENABLED"))
+    return;
+  section += strlen ("dhtu-");
+  u = GNUNET_new (struct GDS_Underlay);
+  u->env.cls = u;
+  u->env.cfg = GDS_cfg;
+  u->env.address_add_cb = &u_address_add;
+  u->env.address_del_cb = &u_address_del;
+  u->env.network_size_cb = &update_network_size_estimate;
+  u->env.connect_cb = &GDS_u_connect;
+  u->env.disconnect_cb = &GDS_u_disconnect;
+  u->env.receive_cb = &GDS_u_receive;
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_dhtu_%s",
+                   section);
+  u->dhtu = GNUNET_PLUGIN_load (libname,
+                                &u->env);
+  if (NULL == u->dhtu)
+  {
+    GNUNET_free (libname);
+    GNUNET_free (u);
+    return;
+  }
+  u->libname = libname;
+  u->name = GNUNET_strdup (section);
+  GNUNET_CONTAINER_DLL_insert (u_head,
+                               u_tail,
+                               u);
 }
@@ -126,34 +475,64 @@ run (void *cls,
 {
  GDS_cfg = c;
  GDS_service = service;
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_time (c,
-                                           "transport",
-                                           "HELLO_EXPIRATION",
-                                           &hello_expiration))
  {
-    hello_expiration = GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION;
+    char *keyfile;
+    if (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_filename (GDS_cfg,
+                                                 "PEER",
+                                                 "PRIVATE_KEY",
+                                                 &keyfile))
+    {
+      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                                 "PEER",
+                                 "PRIVATE_KEY");
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                           GNUNET_YES,
+                                           &GDS_my_private_key))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to setup peer's private key\n");
+      GNUNET_free (keyfile);
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    GNUNET_free (keyfile);
  }
+  GNUNET_CRYPTO_eddsa_key_get_public (&GDS_my_private_key,
+                                      &GDS_my_identity.public_key);
+  GDS_my_hello = GNUNET_HELLO_builder_new (&GDS_my_identity);
+  GNUNET_CRYPTO_hash (&GDS_my_identity,
+                      sizeof(struct GNUNET_PeerIdentity),
+                      &GDS_my_identity_hash);
  GDS_block_context = GNUNET_BLOCK_context_create (GDS_cfg);
  GDS_stats = GNUNET_STATISTICS_create ("dht",
                                        GDS_cfg);
-  GNUNET_SERVICE_suspend (GDS_service);
  GDS_CLIENTS_init ();
  GDS_ROUTING_init ();
-  GDS_NSE_init ();
  GDS_DATACACHE_init ();
-  GDS_HELLO_init ();
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
-  if (GNUNET_OK != GDS_NEIGHBOURS_init ())
+                                 NULL);
+  if (GNUNET_OK !=
+      GDS_NEIGHBOURS_init ())
  {
-    shutdown_task (NULL);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_CONFIGURATION_iterate_sections (GDS_cfg,
+                                         &load_underlay,
+                                         NULL);
+  if (NULL == u_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DHT underlays configured!\n");
+    GNUNET_SCHEDULER_shutdown ();
    return;
  }
-  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
-                                 NULL);
-  ghh = GNUNET_TRANSPORT_hello_get (GDS_cfg,
-                                    GNUNET_TRANSPORT_AC_GLOBAL,
-                                    &process_hello,
-                                    NULL);
 }
diff --git a/src/dht/gnunet-service-dht.h b/src/dht/gnunet-service-dht.h
index 367ff426e..a1513fcce 100644
--- a/src/dht/gnunet-service-dht.h
+++ b/src/dht/gnunet-service-dht.h
@@ -27,6 +27,7 @@
 #define GNUNET_SERVICE_DHT_H
 #include "gnunet-service-dht_datacache.h"
+#include "gnunet-service-dht_neighbours.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_transport_service.h"
@@ -34,6 +35,11 @@
 #define DEBUG_DHT GNUNET_EXTRA_LOGGING
 /**
+ * Information we keep per underlay.
+ */
+struct GDS_Underlay;
+/**
 * Configuration we use.
 */
 extern const struct GNUNET_CONFIGURATION_Handle *GDS_cfg;
@@ -54,9 +60,81 @@ extern struct GNUNET_BLOCK_Context *GDS_block_context;
 extern struct GNUNET_STATISTICS_Handle *GDS_stats;
 /**
- * Our HELLO
+ * Our HELLO builder.
+ */
+extern struct GNUNET_HELLO_Builder *GDS_my_hello;
+/**
+ * Identity of this peer.
+ */
+extern struct GNUNET_PeerIdentity GDS_my_identity;
+/**
+ * Hash of the identity of this peer.
+ */
+extern struct GNUNET_HashCode GDS_my_identity_hash;
+/**
+ * Our private key.
+ */
+extern struct GNUNET_CRYPTO_EddsaPrivateKey GDS_my_private_key;
+/**
+ * Ask all underlays to connect to peer @a pid at @a address.
+ *
+ * @param pid identity of the peer we would connect to
+ * @param address an address of @a pid
+ */
+void
+GDS_u_try_connect (const struct GNUNET_PeerIdentity *pid,
+                   const char *address);
+/**
+ * Send message to some other participant over the network.  Note that
+ * sending is not guaranteeing that the other peer actually received the
+ * message.  For any given @a target, the DHT must wait for the @a
+ * finished_cb to be called before calling send() again.
+ *
+ * @param u underlay to use for transmission
+ * @param target receiver identification
+ * @param msg message
+ * @param msg_size number of bytes in @a msg
+ * @param finished_cb function called once transmission is done
+ *        (not called if @a target disconnects, then only the
+ *         disconnect_cb is called).
+ * @param finished_cb_cls closure for @a finished_cb
+ */
+void
+GDS_u_send (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target,
+            const void *msg,
+            size_t msg_size,
+            GNUNET_SCHEDULER_TaskCallback finished_cb,
+            void *finished_cb_cls);
+/**
+ * Drop a hold @a ph from underlay @a u.
+ *
+ * @param u the underlay controlling the hold
+ * @param ph the preference handle
+ */
+void
+GDS_u_drop (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_PreferenceHandle *ph);
+/**
+ * Create a hold on @a target at underlay @a u.
+ *
+ * @param u the underlay controlling the target
+ * @param target the peer to hold the connection to
 */
-extern struct GNUNET_MessageHeader *GDS_my_hello;
+struct GNUNET_DHTU_PreferenceHandle *
+GDS_u_hold (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target);
 /**
@@ -68,8 +146,9 @@ extern struct GNUNET_MessageHeader *GDS_my_hello;
 * @param query_hash hash of the original query, might not match key in @a bd
 * @param get_path_length number of entries in @a get_path
 * @param get_path path the reply has taken
+ * @return true on success, false on failures
 */
-void
+bool
 GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                          const struct GNUNET_HashCode *query_hash,
                          unsigned int get_path_length,
@@ -128,4 +207,12 @@ GDS_CLIENTS_process_put (enum GNUNET_DHT_RouteOption options,
                         uint32_t hop_count,
                         uint32_t desired_replication_level);
+/**
+ * Return the current NSE
+ *
+ * @return the current NSE as a logarithm
+ */
+double
+GDS_NSE_get (void);
 #endif
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index a1c3024de..6a4f58d1f 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -24,7 +24,6 @@
 * @author Christian Grothoff
 * @author Nathan Evans
 */
 #include "platform.h"
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
@@ -36,6 +35,14 @@
 /**
+ * Enable slow sanity checks to debug issues.
+ * 0: do not check
+ * 1: check all external inputs
+ * 2: check internal computations as well
+ */
+#define SANITY_CHECKS 2
+/**
 * Should routing details be logged to stderr (for debugging)?
 */
 #define LOG_TRAFFIC(kind, ...) GNUNET_log_from (kind, "dht-traffic", \
@@ -503,6 +510,15 @@ handle_dht_local_put (void *cls,
       (unsigned long) (size - sizeof(struct GNUNET_DHT_ClientPutMessage)),
       GNUNET_h2s (&dht_msg->key),
       (unsigned int) bd.type);
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break (0);
+    return;
+  }
  GNUNET_STATISTICS_update (GDS_stats,
                            "# PUT requests received from clients",
                            1,
@@ -511,9 +527,9 @@ handle_dht_local_put (void *cls,
               "CLIENT-PUT %s\n",
               GNUNET_h2s_full (&dht_msg->key));
  /* give to local clients */
-  GDS_CLIENTS_handle_reply (&bd,
+  GNUNET_break (GDS_CLIENTS_handle_reply (&bd,
-                            &bd.key,
+                                          &bd.key,
-                            0, NULL /* get path */);
+                                          0, NULL /* get path */));
  {
    struct GNUNET_CONTAINER_BloomFilter *peer_bf;
@@ -561,10 +577,12 @@ static void
 handle_local_result (void *cls,
                     const struct GDS_DATACACHE_BlockData *bd)
 {
-  /* FIXME: use 'cls' instead of looking up the client? */
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-  GDS_CLIENTS_handle_reply (bd,
+              "Datacache provided result for query key %s\n",
-                            &bd->key,
+              GNUNET_h2s (&bd->key));
-                            0, NULL /* get_path */);
+  GNUNET_break (GDS_CLIENTS_handle_reply (bd,
+                                          &bd->key,
+                                          0, NULL /* get_path */));
 }
@@ -917,7 +935,7 @@ forward_reply (void *cls,
                              GNUNET_NO);
    return GNUNET_YES;          /* type mismatch */
  }
-  if ( (0 == (record->msg_options & GNUNET_DHT_RO_FIND_PEER)) &&
+  if ( (0 == (record->msg_options & GNUNET_DHT_RO_FIND_APPROXIMATE)) &&
       (0 != GNUNET_memcmp (&frc->bd->key,
                            query_hash)) )
  {
@@ -973,9 +991,6 @@ forward_reply (void *cls,
    /* should be impossible to encounter here */
    GNUNET_break (0);
    return GNUNET_YES;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    GNUNET_break_op (0);
-    return GNUNET_NO;
  case GNUNET_BLOCK_REPLY_IRRELEVANT:
    return GNUNET_YES;
  default:
@@ -996,7 +1011,7 @@ forward_reply (void *cls,
  reply->put_path_length = htonl (frc->bd->put_path_length);
  reply->unique_id = record->unique_id;
  reply->expiration = GNUNET_TIME_absolute_hton (frc->bd->expiration_time);
-  reply->key = frc->bd->key;
+  reply->key = *query_hash;
  paths = (struct GNUNET_DHT_PathElement *) &reply[1];
  GNUNET_memcpy (paths,
                 frc->bd->put_path,
@@ -1004,7 +1019,8 @@ forward_reply (void *cls,
                 * frc->bd->put_path_length);
  GNUNET_memcpy (&paths[frc->bd->put_path_length],
                 frc->get_path,
-                 sizeof(struct GNUNET_DHT_PathElement) * frc->get_path_length);
+                 sizeof(struct GNUNET_DHT_PathElement)
+                 * frc->get_path_length);
  GNUNET_memcpy (&paths[frc->get_path_length + frc->bd->put_path_length],
                 frc->bd->data,
                 frc->bd->data_size);
@@ -1020,7 +1036,7 @@ forward_reply (void *cls,
 }
-void
+bool
 GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                          const struct GNUNET_HashCode *query_hash,
                          unsigned int get_path_length,
@@ -1035,14 +1051,31 @@ GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
  if (msize >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
-    return;
+    return false;
  }
+#if SANITY_CHECKS > 1
+  if (0 !=
+      GNUNET_DHT_verify_path (bd->data,
+                              bd->data_size,
+                              bd->expiration_time,
+                              bd->put_path,
+                              bd->put_path_length,
+                              get_path,
+                              get_path_length,
+                              &GDS_my_identity))
+  {
+    GNUNET_break (0);
+    return false;
+  }
+#endif
  frc.bd = bd;
  frc.get_path = get_path;
  frc.get_path_length = get_path_length;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Forwarding reply for query hash %s to client\n",
+       "Forwarding reply for query hash %s with GPL %u and PPL %u to client\n",
-       GNUNET_h2s (query_hash));
+       GNUNET_h2s (query_hash),
+       get_path_length,
+       bd->put_path_length);
  if (0 ==
      GNUNET_CONTAINER_multihashmap_get_multiple (forward_map,
                                                  query_hash,
@@ -1057,6 +1090,102 @@ GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                              1,
                              GNUNET_NO);
  }
+  return true;
+}
+/* **************** HELLO logic ***************** */
+/**
+ * Handler for HELLO GET message. Reply to client
+ * with a URL of our HELLO.
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
+ *
+ */
+static void
+handle_dht_local_hello_get (void *cls,
+                            const struct GNUNET_MessageHeader *msg)
+{
+  struct ClientHandle *ch = cls;
+  char *url = GNUNET_HELLO_builder_to_url (GDS_my_hello,
+                                           &GDS_my_private_key);
+  size_t slen = strlen (url) + 1;
+  struct GNUNET_MessageHeader *hdr;
+  struct GNUNET_MQ_Envelope *env;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling request from local client for my HELLO\n");
+  env = GNUNET_MQ_msg_extra (hdr,
+                             slen,
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL);
+  memcpy (&hdr[1],
+          url,
+          slen);
+  GNUNET_free (url);
+  GNUNET_MQ_send (ch->mq,
+                  env);
+  GNUNET_SERVICE_client_continue (ch->client);
+}
+/**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls the client we received this message from
+ * @param hdr HELLO URL message from the service.
+ * @return #GNUNET_OK if @a hdr is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_dht_local_hello_offer (void *cls,
+                             const struct GNUNET_MessageHeader *hdr)
+{
+  uint16_t len = ntohs (hdr->size);
+  const char *buf = (const char *) &hdr[1];
+  (void) cls;
+  if ('\0' != buf[len - sizeof (*hdr) - 1])
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+/**
+ * Handler for HELLO OFFER message.  Try to use the
+ * HELLO to connect to another peer.
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
+ */
+static void
+handle_dht_local_hello_offer (void *cls,
+                              const struct GNUNET_MessageHeader *msg)
+{
+  struct ClientHandle *ch = cls;
+  const char *url = (const char *) &msg[1];
+  struct GNUNET_HELLO_Builder *b;
+  struct GNUNET_PeerIdentity pid;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Local client provided HELLO URL %s\n",
+              url);
+  b = GNUNET_HELLO_builder_from_url (url);
+  if (NULL == b)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (ch->client);
+    return;
+  }
+  GNUNET_SERVICE_client_continue (ch->client);
+  GNUNET_HELLO_builder_iterate (b,
+                                &pid,
+                                &GDS_try_connect,
+                                &pid);
+  GNUNET_HELLO_builder_free (b);
 }
@@ -1330,8 +1459,8 @@ response_action (void *cls,
                 bd->put_path_length * sizeof(struct GNUNET_DHT_PathElement));
  GNUNET_memcpy (path,
                 resp_ctx->get_path,
-                 resp_ctx->get_path_length * sizeof(struct
+                 resp_ctx->get_path_length
-                                                    GNUNET_DHT_PathElement));
+                 * sizeof(struct GNUNET_DHT_PathElement));
  GNUNET_memcpy (&path[resp_ctx->get_path_length],
                 bd->data,
                 bd->data_size);
@@ -1504,6 +1633,14 @@ GDS_CLIENTS_stop (void)
                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN, \
                           struct GNUNET_DHT_ClientGetResultSeenMessage, \
                           NULL), \
+    GNUNET_MQ_hd_fixed_size (dht_local_hello_get,              \
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET, \
+                             struct GNUNET_MessageHeader, \
+                             NULL), \
+    GNUNET_MQ_hd_var_size (dht_local_hello_offer, \
+                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL, \
+                           struct GNUNET_MessageHeader, \
+                           NULL), \
    GNUNET_MQ_handler_end ())
diff --git a/src/dht/gnunet-service-dht_datacache.c b/src/dht/gnunet-service-dht_datacache.c
index cb778717b..be0a6db81 100644
--- a/src/dht/gnunet-service-dht_datacache.c
+++ b/src/dht/gnunet-service-dht_datacache.c
@@ -36,7 +36,7 @@
 * How many "closest" results to we return for migration when
 * asked (at most)?
 */
-#define NUM_CLOSEST 42
+#define NUM_CLOSEST 4
 /**
@@ -68,7 +68,7 @@ GDS_DATACACHE_handle_put (const struct GDS_DATACACHE_BlockData *bd)
                            1,
                            GNUNET_NO);
  GNUNET_CRYPTO_hash_xor (&bd->key,
-                          &my_identity_hash,
+                          &GDS_my_identity_hash,
                          &xor);
  r = GNUNET_DATACACHE_put (datacache,
                            &bd->key,
@@ -126,7 +126,7 @@ struct GetRequestContext
  /**
   * Return value to give back.
   */
-  enum GNUNET_BLOCK_EvaluationResult eval;
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
 };
@@ -204,13 +204,6 @@ datacache_get_iterator (void *cls,
                              1,
                              GNUNET_NO);
    break;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    /* maybe it expired? */
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# Invalid RESULTS found in datacache",
-                              1,
-                              GNUNET_NO);
-    break;
  case GNUNET_BLOCK_REPLY_IRRELEVANT:
    GNUNET_STATISTICS_update (GDS_stats,
                              "# Irrelevant RESULTS found in datacache",
@@ -222,7 +215,7 @@ datacache_get_iterator (void *cls,
 }
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                          enum GNUNET_BLOCK_Type type,
                          const void *xquery,
@@ -231,22 +224,23 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                          GDS_DATACACHE_GetCallback gc,
                          void *gc_cls)
 {
-  struct GetRequestContext ctx;
+  struct GetRequestContext ctx = {
+                                  .eval = GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
+    .key = *key,
+    .xquery = xquery,
+    .xquery_size = xquery_size,
+    .bg = bg,
+    .gc = gc,
+    .gc_cls = gc_cls
+  };
  unsigned int r;
  if (NULL == datacache)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
  GNUNET_STATISTICS_update (GDS_stats,
                            "# GET requests given to datacache",
                            1,
                            GNUNET_NO);
-  ctx.eval = GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  ctx.key = *key;
-  ctx.xquery = xquery;
-  ctx.xquery_size = xquery_size;
-  ctx.bg = bg;
-  ctx.gc = gc;
-  ctx.gc_cls = gc_cls;
  r = GNUNET_DATACACHE_get (datacache,
                            key,
                            type,
@@ -261,85 +255,44 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
 }
-/**
+enum GNUNET_BLOCK_ReplyEvaluationResult
- * Closure for #datacache_get_successors_iterator().
- */
-struct SuccContext
-{
-  /**
-   * Function to call on the result
-   */
-  GDS_DATACACHE_GetCallback cb;
-  /**
-   * Closure for @e cb.
-   */
-  void *cb_cls;
-};
-/**
- * Iterator for local get request results,
- *
- * @param cls closure with the `struct GNUNET_HashCode *` with the trail ID
- * @param key the key this data is stored under
- * @param size the size of the data identified by key
- * @param data the actual data
- * @param type the type of the data
- * @param exp when does this value expire?
- * @param put_path_length number of peers in @a put_path
- * @param put_path path the reply took on put
- * @return #GNUNET_OK to continue iteration, anything else
- * to stop iteration.
- */
-static enum GNUNET_GenericReturnValue
-datacache_get_successors_iterator (void *cls,
-                                   const struct GNUNET_HashCode *key,
-                                   size_t size,
-                                   const char *data,
-                                   enum GNUNET_BLOCK_Type type,
-                                   struct GNUNET_TIME_Absolute exp,
-                                   unsigned int put_path_length,
-                                   const struct
-                                   GNUNET_DHT_PathElement *put_path)
-{
-  const struct SuccContext *sc = cls;
-  struct GDS_DATACACHE_BlockData bd = {
-    .key = *key,
-    .expiration_time = exp,
-    .put_path = put_path,
-    .data = data,
-    .data_size = size,
-    .put_path_length = put_path_length,
-    .type = type
-  };
-  /* NOTE: The datacache currently does not store the RO from
-     the original 'put', so we don't know the 'correct' option
-     at this point anymore.  Thus, we conservatively assume
-     that recording is desired (for now). */
-  sc->cb (sc->cb_cls,
-          &bd);
-  return GNUNET_OK;
-}
-void
 GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *xquery,
+                           size_t xquery_size,
+                           struct GNUNET_BLOCK_Group *bg,
                           GDS_DATACACHE_GetCallback cb,
                           void *cb_cls)
 {
-  struct SuccContext sc = {
+  struct GetRequestContext ctx = {
-    .cb = cb,
+                                  .eval = GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
-    .cb_cls = cb_cls
+    .key = *key,
+    .xquery = xquery,
+    .xquery_size = xquery_size,
+    .bg = bg,
+    .gc = cb,
+    .gc_cls = cb_cls
  };
+  unsigned int r;
-  (void) GNUNET_DATACACHE_get_closest (datacache,
+  if (NULL == datacache)
-                                       key,
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-                                       NUM_CLOSEST,
+  GNUNET_STATISTICS_update (GDS_stats,
-                                       &datacache_get_successors_iterator,
+                            "# GET closest requests given to datacache",
-                                       &sc);
+                            1,
+                            GNUNET_NO);
+  r = GNUNET_DATACACHE_get_closest (datacache,
+                                    key,
+                                    type,
+                                    NUM_CLOSEST,
+                                    &datacache_get_iterator,
+                                    &ctx);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "DATACACHE approximate GET for key %s completed (%d). %u results found.\n",
+       GNUNET_h2s (key),
+       ctx.eval,
+       r);
+  return ctx.eval;
 }
diff --git a/src/dht/gnunet-service-dht_datacache.h b/src/dht/gnunet-service-dht_datacache.h
index 691a51e0e..d860139f5 100644
--- a/src/dht/gnunet-service-dht_datacache.h
+++ b/src/dht/gnunet-service-dht_datacache.h
@@ -107,7 +107,7 @@ typedef void
 * @param gc_cls closure for @a gc
 * @return evaluation result for the local replies
 */
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                          enum GNUNET_BLOCK_Type type,
                          const void *xquery,
@@ -122,11 +122,20 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
 * another peer.
 *
 * @param key the location at which the peer is looking for data that is close
+ * @param type requested data type
+ * @param xquery extended query
+ * @param xquery_size number of bytes in xquery
+ * @param bg block group to use for evaluation of replies
 * @param cb function to call with the result
 * @param cb_cls closure for @a cb
+ * @return evaluation result for the local replies
 */
-void
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *xquery,
+                           size_t xquery_size,
+                           struct GNUNET_BLOCK_Group *bg,
                           GDS_DATACACHE_GetCallback cb,
                           void *cb_cls);
diff --git a/src/dht/gnunet-service-dht_hello.c b/src/dht/gnunet-service-dht_hello.c
deleted file mode 100644
index 949456575..000000000
--- a/src/dht/gnunet-service-dht_hello.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file dht/gnunet-service-dht_hello.c
- * @brief GNUnet DHT integration with peerinfo
- * @author Christian Grothoff
- *
- * TODO:
- * - consider adding mechanism to remove expired HELLOs
- */
-#include "platform.h"
-#include "gnunet-service-dht.h"
-#include "gnunet-service-dht_hello.h"
-#include "gnunet_peerinfo_service.h"
-/**
- * Handle for peerinfo notifications.
- */
-static struct GNUNET_PEERINFO_NotifyContext *pnc;
-/**
- * Hash map of peers to HELLOs.
- */
-static struct GNUNET_CONTAINER_MultiPeerMap *peer_to_hello;
-/**
- * Obtain a peer's HELLO if available
- *
- * @param peer peer to look for a HELLO from
- * @return HELLO for the given peer
- */
-const struct GNUNET_HELLO_Message *
-GDS_HELLO_get (const struct GNUNET_PeerIdentity *peer)
-{
-  if (NULL == peer_to_hello)
-    return NULL;
-  return GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
-                                            peer);
-}
-/**
- * Function called for each HELLO known to PEERINFO.
- *
- * @param cls closure
- * @param peer id of the peer, NULL for last call
- * @param hello hello message for the peer (can be NULL)
- * @param err_msg error message (not used)
- *
- * FIXME this is called once per address. Merge instead of replacing?
- */
-static void
-process_hello (void *cls,
-               const struct GNUNET_PeerIdentity *peer,
-               const struct GNUNET_HELLO_Message *hello,
-               const char *err_msg)
-{
-  struct GNUNET_TIME_Absolute ex;
-  struct GNUNET_HELLO_Message *hm;
-  if (NULL == hello)
-    return;
-  ex = GNUNET_HELLO_get_last_expiration (hello);
-  if (0 == GNUNET_TIME_absolute_get_remaining (ex).rel_value_us)
-    return;
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# HELLOs obtained from peerinfo",
-                            1,
-                            GNUNET_NO);
-  hm = GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
-                                          peer);
-  GNUNET_free (hm);
-  hm = GNUNET_malloc (GNUNET_HELLO_size (hello));
-  GNUNET_memcpy (hm,
-                 hello,
-                 GNUNET_HELLO_size (hello));
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CONTAINER_multipeermap_put (peer_to_hello,
-                                                    peer,
-                                                    hm,
-                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
-}
-/**
- * Initialize HELLO subsystem.
- */
-void
-GDS_HELLO_init ()
-{
-  pnc = GNUNET_PEERINFO_notify (GDS_cfg,
-                                GNUNET_NO,
-                                &process_hello,
-                                NULL);
-  peer_to_hello = GNUNET_CONTAINER_multipeermap_create (256,
-                                                        GNUNET_NO);
-}
-/**
- * Free memory occopied by the HELLO.
- */
-static enum GNUNET_GenericReturnValue
-free_hello (void *cls,
-            const struct GNUNET_PeerIdentity *key,
-            void *hello)
-{
-  GNUNET_free (hello);
-  return GNUNET_OK;
-}
-/**
- * Shutdown HELLO subsystem.
- */
-void
-GDS_HELLO_done ()
-{
-  if (NULL != pnc)
-  {
-    GNUNET_PEERINFO_notify_cancel (pnc);
-    pnc = NULL;
-  }
-  if (NULL != peer_to_hello)
-  {
-    GNUNET_CONTAINER_multipeermap_iterate (peer_to_hello,
-                                           &free_hello,
-                                           NULL);
-    GNUNET_CONTAINER_multipeermap_destroy (peer_to_hello);
-  }
-}
-/* end of gnunet-service-dht_hello.c */
diff --git a/src/dht/gnunet-service-dht_hello.h b/src/dht/gnunet-service-dht_hello.h
deleted file mode 100644
index f8b90862d..000000000
--- a/src/dht/gnunet-service-dht_hello.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file dht/gnunet-service-dht_hello.h
- * @brief GNUnet DHT integration with peerinfo
- * @author Christian Grothoff
- */
-#ifndef GNUNET_SERVICE_DHT_HELLO_H
-#define GNUNET_SERVICE_DHT_HELLO_H
-#include "gnunet_util_lib.h"
-#include "gnunet_hello_lib.h"
-/**
- * Obtain a peer's HELLO if available
- *
- * @param peer peer to look for a HELLO from
- * @return HELLO for the given peer
- */
-const struct GNUNET_HELLO_Message *
-GDS_HELLO_get (const struct GNUNET_PeerIdentity *peer);
-/**
- * Initialize HELLO subsystem.
- */
-void
-GDS_HELLO_init (void);
-/**
- * Shutdown HELLO subsystem.
- */
-void
-GDS_HELLO_done (void);
-#endif
diff --git a/src/dht/gnunet-service-dht_neighbours.c b/src/dht/gnunet-service-dht_neighbours.c
index cf150ea0c..2f9cbab84 100644
--- a/src/dht/gnunet-service-dht_neighbours.c
+++ b/src/dht/gnunet-service-dht_neighbours.c
@@ -28,13 +28,10 @@
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
 #include "gnunet_signatures.h"
-#include "gnunet_ats_service.h"
-#include "gnunet_core_service.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet-service-dht.h"
-#include "gnunet-service-dht_hello.h"
 #include "gnunet-service-dht_neighbours.h"
-#include "gnunet-service-dht_nse.h"
 #include "gnunet-service-dht_routing.h"
 #include "dht.h"
@@ -42,9 +39,17 @@
                                                __VA_ARGS__)
 /**
- * Enable slow sanity checks to debug issues.
+ * Enable slow sanity checks to debug issues. 
+ * 
+ * TODO: might want to eventually implement probabilistic
+ * load-based path verification, but for now it is all or nothing
+ * based on this define.
+ *
+ * 0: do not check -- if signatures become performance critical
+ * 1: check all external inputs -- normal production for now
+ * 2: check internal computations as well -- for debugging 
 */
-#define SANITY_CHECKS 1
+#define SANITY_CHECKS 2
 /**
 * How many buckets will we allow in total.
@@ -74,6 +79,7 @@
 #define DHT_MINIMUM_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
    GNUNET_TIME_UNIT_MINUTES, 2)
 /**
 * How long to additionally wait on average per #bucket_size to send out the
 * FIND PEER requests if we did successfully connect (!) to a a new peer and
@@ -83,7 +89,7 @@
 * top).  Also the range in which we randomize, so the effective value
 * is half of the number given here.
 */
-#define DHT_AVG_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
+#define DHT_AVG_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply (    \
    GNUNET_TIME_UNIT_SECONDS, 6)
 /**
@@ -91,11 +97,6 @@
 */
 #define GET_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 2)
-/**
- * Hello address expiration
- */
-extern struct GNUNET_TIME_Relative hello_expiration;
 GNUNET_NETWORK_STRUCT_BEGIN
@@ -263,81 +264,134 @@ GNUNET_NETWORK_STRUCT_END
 /**
 * Entry for a peer in a bucket.
 */
-struct PeerInfo
+struct PeerInfo;
+/**
+ * List of targets that we can use to reach this peer.
+ */
+struct Target
 {
  /**
-   * Next peer entry (DLL)
+   * Kept in a DLL.
   */
-  struct PeerInfo *next;
+  struct Target *next;
  /**
-   *  Prev peer entry (DLL)
+   * Kept in a DLL.
   */
-  struct PeerInfo *prev;
+  struct Target *prev;
  /**
   * Handle for sending messages to this peer.
   */
-  struct GNUNET_MQ_Handle *mq;
+  struct GNUNET_DHTU_Target *utarget;
  /**
-   * What is the identity of the peer?
+   * Underlay providing this target.
   */
-  const struct GNUNET_PeerIdentity *id;
+  struct GDS_Underlay *u;
  /**
-   * Hash of @e id.
+   * Peer this is a target for.
   */
-  struct GNUNET_HashCode phash;
+  struct PeerInfo *pi;
  /**
-   * Which bucket is this peer in?
+   * Handle used to 'hold' the connection to this peer.
   */
-  int peer_bucket;
+  struct GNUNET_DHTU_PreferenceHandle *ph;
+  /**
+   * Set to number of messages are waiting for the transmission to finish.
+   */
+  unsigned int load;
+  /**
+   * Set to @a true if the target was dropped, but we could not clean
+   * up yet because @e busy was also true.
+   */
+  bool dropped;
 };
 /**
- * Peers are grouped into buckets.
+ * Entry for a peer in a bucket.
 */
-struct PeerBucket
+struct PeerInfo
 {
  /**
-   * Head of DLL
+   * What is the identity of the peer?
   */
-  struct PeerInfo *head;
+  struct GNUNET_PeerIdentity id;
  /**
-   * Tail of DLL
+   * Hash of @e id.
   */
-  struct PeerInfo *tail;
+  struct GNUNET_HashCode phash;
  /**
-   * Number of peers in the bucket.
+   * When does our HELLO from this peer expire?
   */
-  unsigned int peers_size;
+  struct GNUNET_TIME_Absolute hello_expiration;
+  /**
+   * Next peer entry (DLL)
+   */
+  struct PeerInfo *next;
+  /**
+   *  Prev peer entry (DLL)
+   */
+  struct PeerInfo *prev;
+  /**
+   * Head of DLL of targets for this peer.
+   */
+  struct Target *t_head;
+  /**
+   * Tail of DLL of targets for this peer.
+   */
+  struct Target *t_tail;
+  /**
+   * Block with a HELLO of this peer.
+   */
+  void *hello;
+  /**
+   * Number of bytes in @e hello.
+   */
+  size_t hello_size;
+  /**
+   * Which bucket is this peer in?
+   */
+  int peer_bucket;
 };
 /**
- * Information about a peer that we would like to connect to.
+ * Peers are grouped into buckets.
 */
-struct ConnectInfo
+struct PeerBucket
 {
  /**
-   * Handle to active HELLO offer operation, or NULL.
+   * Head of DLL
   */
-  struct GNUNET_TRANSPORT_OfferHelloHandle *oh;
+  struct PeerInfo *head;
  /**
-   * Handle to active connectivity suggestion operation, or NULL.
+   * Tail of DLL
   */
-  struct GNUNET_ATS_ConnectivitySuggestHandle *sh;
+  struct PeerInfo *tail;
  /**
-   * How much would we like to connect to this peer?
+   * Number of peers in the bucket.
   */
-  uint32_t strength;
+  unsigned int peers_size;
 };
@@ -374,12 +428,6 @@ static struct PeerBucket k_buckets[MAX_BUCKETS];
 static struct GNUNET_CONTAINER_MultiPeerMap *all_connected_peers;
 /**
- * Hash map of all peers we would like to be connected to.
- * Values are of type `struct ConnectInfo`.
- */
-static struct GNUNET_CONTAINER_MultiPeerMap *all_desired_peers;
-/**
 * Maximum size for each bucket.
 */
 static unsigned int bucket_size = DEFAULT_BUCKET_SIZE;
@@ -389,30 +437,83 @@ static unsigned int bucket_size = DEFAULT_BUCKET_SIZE;
 */
 static struct GNUNET_SCHEDULER_Task *find_peer_task;
-/**
- * Identity of this peer.
- */
-static struct GNUNET_PeerIdentity my_identity;
 /**
- * Hash of the identity of this peer.
+ * Function called whenever we finished sending to a target.
+ * Marks the transmission as finished (and the target as ready
+ * for the next message).
+ *
+ * @param cls a `struct Target *`
 */
-struct GNUNET_HashCode my_identity_hash;
+static void
+send_done_cb (void *cls)
+{
+  struct Target *t = cls;
+  struct PeerInfo *pi = t->pi; /* NULL if t->dropped! */
-/**
+  GNUNET_assert (t->load > 0);
- * Handle to CORE.
+  t->load--;
- */
+  if (0 < t->load)
-static struct GNUNET_CORE_Handle *core_api;
+    return;
+  if (t->dropped)
+  {
+    GNUNET_free (t);
+    return;
+  }
+  /* move target back to the front */
+  GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                               pi->t_tail,
+                               t);
+  GNUNET_CONTAINER_DLL_insert (pi->t_head,
+                               pi->t_tail,
+                               t);
+}
-/**
- * Handle to ATS connectivity.
- */
-static struct GNUNET_ATS_ConnectivityHandle *ats_ch;
 /**
- * Our private key.
+ * Send @a msg to @a pi.
+ *
+ * @param pi where to send the message
+ * @param msg message to send
 */
-static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
+static void
+do_send (struct PeerInfo *pi,
+         const struct GNUNET_MessageHeader *msg)
+{
+  struct Target *t;
+  for (t = pi->t_head;
+       NULL != t;
+       t = t->next)
+    if (t->load < MAXIMUM_PENDING_PER_PEER)
+      break;
+  if (NULL == t)
+  {
+    /* all targets busy, drop message */
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# messages dropped (underlays busy)",
+                              1,
+                              GNUNET_NO);
+    return;
+  }
+  t->load++;
+  /* rotate busy targets to the end */
+  if (MAXIMUM_PENDING_PER_PEER == t->load)
+  {
+    GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                                 pi->t_tail,
+                                 t);
+    GNUNET_CONTAINER_DLL_insert_tail (pi->t_head,
+                                      pi->t_tail,
+                                      t);
+  }
+  GDS_u_send (t->u,
+              t->utarget,
+              msg,
+              ntohs (msg->size),
+              &send_done_cb,
+              t);
+}
 /**
@@ -426,11 +527,10 @@ static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
 * @param pred predecessor peer ID
 * @param succ successor peer ID
 * @param[out] sig where to write the signature
- *      (of purpose #GNUNET_SIGNATURE_PURPOSE_DHT_HOP)
+ *      (of purpose #GNUNET_SIGNATURE_PURPOSE_DHT_PUT_HOP)
 */
 static void
-sign_path (const struct GNUNET_HashCode *key,
+sign_path (const void *data,
-           const void *data,
           size_t data_size,
           struct GNUNET_TIME_Absolute exp_time,
           const struct GNUNET_PeerIdentity *pred,
@@ -441,7 +541,6 @@ sign_path (const struct GNUNET_HashCode *key,
    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_DHT_HOP),
    .purpose.size = htonl (sizeof (hs)),
    .expiration_time = GNUNET_TIME_absolute_hton (exp_time),
-    .key = *key,
    .pred = *pred,
    .succ = *succ
  };
@@ -449,7 +548,7 @@ sign_path (const struct GNUNET_HashCode *key,
  GNUNET_CRYPTO_hash (data,
                      data_size,
                      &hs.h_data);
-  GNUNET_CRYPTO_eddsa_sign (&my_private_key,
+  GNUNET_CRYPTO_eddsa_sign (&GDS_my_private_key,
                            &hs,
                            sig);
 }
@@ -469,7 +568,7 @@ find_bucket (const struct GNUNET_HashCode *hc)
  unsigned int bits;
  GNUNET_CRYPTO_hash_xor (hc,
-                          &my_identity_hash,
+                          &GDS_my_identity_hash,
                          &xor);
  bits = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
  if (bits == MAX_BUCKETS)
@@ -483,171 +582,6 @@ find_bucket (const struct GNUNET_HashCode *hc)
 /**
- * Function called when #GNUNET_TRANSPORT_offer_hello() is done.
- * Clean up the "oh" field in the @a cls
- *
- * @param cls a `struct ConnectInfo`
- */
-static void
-offer_hello_done (void *cls)
-{
-  struct ConnectInfo *ci = cls;
-  ci->oh = NULL;
-}
-/**
- * Function called for all entries in #all_desired_peers to clean up.
- *
- * @param cls NULL
- * @param peer peer the entry is for
- * @param value the value to remove
- * @return #GNUNET_YES
- */
-static enum GNUNET_GenericReturnValue
-free_connect_info (void *cls,
-                   const struct GNUNET_PeerIdentity *peer,
-                   void *value)
-{
-  struct ConnectInfo *ci = value;
-  (void) cls;
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CONTAINER_multipeermap_remove (all_desired_peers,
-                                                       peer,
-                                                       ci));
-  if (NULL != ci->sh)
-  {
-    GNUNET_ATS_connectivity_suggest_cancel (ci->sh);
-    ci->sh = NULL;
-  }
-  if (NULL != ci->oh)
-  {
-    GNUNET_TRANSPORT_offer_hello_cancel (ci->oh);
-    ci->oh = NULL;
-  }
-  GNUNET_free (ci);
-  return GNUNET_YES;
-}
-/**
- * Consider if we want to connect to a given peer, and if so
- * let ATS know.  If applicable, the HELLO is offered to the
- * TRANSPORT service.
- *
- * @param pid peer to consider connectivity requirements for
- * @param h a HELLO message, or NULL
- */
-static void
-try_connect (const struct GNUNET_PeerIdentity *pid,
-             const struct GNUNET_MessageHeader *h)
-{
-  int bucket_idx;
-  struct GNUNET_HashCode pid_hash;
-  struct ConnectInfo *ci;
-  uint32_t strength;
-  struct PeerBucket *bucket;
-  GNUNET_CRYPTO_hash (pid,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &pid_hash);
-  bucket_idx = find_bucket (&pid_hash);
-  if (bucket_idx < 0)
-  {
-    GNUNET_break (0);
-    return; /* self!? */
-  }
-  bucket = &k_buckets[bucket_idx];
-  ci = GNUNET_CONTAINER_multipeermap_get (all_desired_peers,
-                                          pid);
-  if (bucket->peers_size < bucket_size)
-    strength = (bucket_size - bucket->peers_size) * bucket_idx;
-  else
-    strength = 0;
-  if (GNUNET_YES ==
-      GNUNET_CONTAINER_multipeermap_contains (all_connected_peers,
-                                              pid))
-    strength *= 2; /* double for connected peers */
-  if ( (0 == strength) &&
-       (NULL != ci) )
-  {
-    /* release request */
-    GNUNET_assert (GNUNET_YES ==
-                   free_connect_info (NULL,
-                                      pid,
-                                      ci));
-    return;
-  }
-  if (NULL == ci)
-  {
-    ci = GNUNET_new (struct ConnectInfo);
-    GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CONTAINER_multipeermap_put (all_desired_peers,
-                                                      pid,
-                                                      ci,
-                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
-  }
-  if ( (NULL != ci->oh) &&
-       (NULL != h) )
-    GNUNET_TRANSPORT_offer_hello_cancel (ci->oh);
-  if (NULL != h)
-    ci->oh = GNUNET_TRANSPORT_offer_hello (GDS_cfg,
-                                           h,
-                                           &offer_hello_done,
-                                           ci);
-  if ( (NULL != ci->sh) &&
-       (ci->strength != strength) )
-    GNUNET_ATS_connectivity_suggest_cancel (ci->sh);
-  if (ci->strength != strength)
-  {
-    ci->sh = GNUNET_ATS_connectivity_suggest (ats_ch,
-                                              pid,
-                                              strength);
-    ci->strength = strength;
-  }
-}
-/**
- * Function called for each peer in #all_desired_peers during
- * #update_connect_preferences() if we have reason to adjust
- * the strength of our desire to keep connections to certain
- * peers.  Calls #try_connect() to update the calculations for
- * the given @a pid.
- *
- * @param cls NULL
- * @param pid peer to update
- * @param value unused
- * @return #GNUNET_YES (continue to iterate)
- */
-static enum GNUNET_GenericReturnValue
-update_desire_strength (void *cls,
-                        const struct GNUNET_PeerIdentity *pid,
-                        void *value)
-{
-  (void) cls;
-  (void) value;
-  try_connect (pid,
-               NULL);
-  return GNUNET_YES;
-}
-/**
- * Update our preferences for connectivity as given to ATS.
- */
-static void
-update_connect_preferences (void)
-{
-  GNUNET_CONTAINER_multipeermap_iterate (all_desired_peers,
-                                         &update_desire_strength,
-                                         NULL);
-}
-/**
 * Add each of the peers we already know to the Bloom filter of
 * the request so that we don't get duplicate HELLOs.
 *
@@ -702,7 +636,7 @@ send_find_peer_message (void *cls)
        GNUNET_CRYPTO_QUALITY_WEAK,
        GNUNET_TIME_relative_multiply (
          DHT_AVG_FIND_PEER_INTERVAL,
-          100 * (1 + newly_found_peers) / bucket_size).rel_value_us);
+          1 + 100 * (1 + newly_found_peers) / bucket_size).rel_value_us);
    newly_found_peers = 0;
    GNUNET_assert (NULL == find_peer_task);
    find_peer_task =
@@ -719,7 +653,7 @@ send_find_peer_message (void *cls)
    struct GNUNET_CONTAINER_BloomFilter *peer_bf;
    bg = GNUNET_BLOCK_group_create (GDS_block_context,
-                                    GNUNET_BLOCK_TYPE_DHT_HELLO,
+                                    GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
                                    GNUNET_CRYPTO_random_u32 (
                                      GNUNET_CRYPTO_QUALITY_WEAK,
                                      UINT32_MAX),
@@ -736,12 +670,12 @@ send_find_peer_message (void *cls)
                                           DHT_BLOOM_SIZE,
                                           GNUNET_CONSTANTS_BLOOMFILTER_K);
    if (GNUNET_OK !=
-        GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_HELLO,
+        GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
-                                   GNUNET_DHT_RO_FIND_PEER
+                                   GNUNET_DHT_RO_FIND_APPROXIMATE
                                   | GNUNET_DHT_RO_RECORD_ROUTE,
                                   FIND_PEER_REPLICATION_LEVEL,
                                   0, /* hop count */
-                                   &my_identity_hash,
+                                   &GDS_my_identity_hash,
                                   NULL, 0, /* xquery */
                                   bg,
                                   peer_bf))
@@ -765,123 +699,180 @@ send_find_peer_message (void *cls)
 /**
- * Method called whenever a peer connects.
+ * The list of the first #bucket_size peers of @a bucket
+ * changed. We should thus make sure we have called 'hold'
+ * all of the first bucket_size peers!
 *
- * @param cls closure
+ * @param[in,out] bucket the bucket where the peer set changed
- * @param peer peer identity this notification is about
- * @param mq message queue for sending messages to @a peer
- * @return our `struct PeerInfo` for @a peer
 */
-static void *
+static void
-handle_core_connect (void *cls,
+update_hold (struct PeerBucket *bucket)
-                     const struct GNUNET_PeerIdentity *peer,
-                     struct GNUNET_MQ_Handle *mq)
 {
+  unsigned int off = 0;
+  /* find the peer -- we just go over all of them, should
+     be hardly any more expensive than just finding the 'right'
+     one. */
+  for (struct PeerInfo *pos = bucket->head;
+       NULL != pos;
+       pos = pos->next)
+  {
+    if (off > bucket_size)
+      break;   /* We only hold up to #bucket_size peers per bucket */
+    off++;
+    for (struct Target *tp = pos->t_head;
+         NULL != tp;
+         tp = tp->next)
+      if (NULL == tp->ph)
+        tp->ph = GDS_u_hold (tp->u,
+                             tp->utarget);
+  }
+}
+void
+GDS_u_connect (void *cls,
+               struct GNUNET_DHTU_Target *target,
+               const struct GNUNET_PeerIdentity *pid,
+               void **ctx)
+{
+  struct GDS_Underlay *u = cls;
  struct PeerInfo *pi;
  struct PeerBucket *bucket;
+  bool do_hold = false;
-  (void) cls;
  /* Check for connect to self message */
-  if (0 == GNUNET_memcmp (&my_identity,
+  if (0 == GNUNET_memcmp (&GDS_my_identity,
-                          peer))
+                          pid))
-    return NULL;
+    return;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Connected to peer %s\n",
-              GNUNET_i2s (peer));
+              GNUNET_i2s (pid));
-  GNUNET_assert (NULL ==
+  pi = GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
-                 GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
+                                          pid);
-                                                    peer));
+  if (NULL == pi)
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# peers connected",
-                            1,
-                            GNUNET_NO);
-  pi = GNUNET_new (struct PeerInfo);
-  pi->id = peer;
-  pi->mq = mq;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &pi->phash);
-  pi->peer_bucket = find_bucket (&pi->phash);
-  GNUNET_assert ( (pi->peer_bucket >= 0) &&
-                  ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
-  bucket = &k_buckets[pi->peer_bucket];
-  GNUNET_CONTAINER_DLL_insert_tail (bucket->head,
-                                    bucket->tail,
-                                    pi);
-  bucket->peers_size++;
-  closest_bucket = GNUNET_MAX (closest_bucket,
-                               (unsigned int) pi->peer_bucket + 1);
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONTAINER_multipeermap_put (all_connected_peers,
-                                                    pi->id,
-                                                    pi,
-                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
-  if (bucket->peers_size <= bucket_size)
  {
-    update_connect_preferences ();
+    GNUNET_STATISTICS_update (GDS_stats,
-    newly_found_peers++;
+                              "# peers connected",
+                              1,
+                              GNUNET_NO);
+    pi = GNUNET_new (struct PeerInfo);
+    pi->id = *pid;
+    GNUNET_CRYPTO_hash (pid,
+                        sizeof(*pid),
+                        &pi->phash);
+    pi->peer_bucket = find_bucket (&pi->phash);
+    GNUNET_assert ( (pi->peer_bucket >= 0) &&
+                    ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
+    bucket = &k_buckets[pi->peer_bucket];
+    GNUNET_CONTAINER_DLL_insert_tail (bucket->head,
+                                      bucket->tail,
+                                      pi);
+    bucket->peers_size++;
+    closest_bucket = GNUNET_MAX (closest_bucket,
+                                 (unsigned int) pi->peer_bucket + 1);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multipeermap_put (all_connected_peers,
+                                                      &pi->id,
+                                                      pi,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    if (bucket->peers_size <= bucket_size)
+    {
+      newly_found_peers++;
+      do_hold = true;
+    }
+    if ( (1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
+         (GNUNET_YES != disable_try_connect) )
+    {
+      /* got a first connection, good time to start with FIND PEER requests... */
+      GNUNET_assert (NULL == find_peer_task);
+      find_peer_task = GNUNET_SCHEDULER_add_now (&send_find_peer_message,
+                                                 NULL);
+    }
  }
-  if ( (1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
-       (GNUNET_YES != disable_try_connect) )
  {
-    /* got a first connection, good time to start with FIND PEER requests... */
+    struct Target *t;
-    GNUNET_assert (NULL == find_peer_task);
-    find_peer_task = GNUNET_SCHEDULER_add_now (&send_find_peer_message,
+    t = GNUNET_new (struct Target);
-                                               NULL);
+    t->u = u;
+    t->utarget = target;
+    t->pi = pi;
+    GNUNET_CONTAINER_DLL_insert (pi->t_head,
+                                 pi->t_tail,
+                                 t);
+    *ctx = t;
  }
-  return pi;
+  if (do_hold)
+    update_hold (bucket);
 }
-/**
+void
- * Method called whenever a peer disconnects.
+GDS_u_disconnect (void *ctx)
- *
- * @param cls closure
- * @param peer peer identity this notification is about
- * @param internal_cls our `struct PeerInfo` for @a peer
- */
-static void
-handle_core_disconnect (void *cls,
-                        const struct GNUNET_PeerIdentity *peer,
-                        void *internal_cls)
 {
-  struct PeerInfo *to_remove = internal_cls;
+  struct Target *t = ctx;
+  struct PeerInfo *pi;
  struct PeerBucket *bucket;
+  bool was_held = false;
-  (void) cls;
  /* Check for disconnect from self message (on shutdown) */
-  if (NULL == to_remove)
+  if (NULL == t)
    return;
+  pi = t->pi;
+  GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                               pi->t_tail,
+                               t);
+  if (NULL != t->ph)
+  {
+    GDS_u_drop (t->u,
+                t->ph);
+    t->ph = NULL;
+    was_held = true;
+  }
+  if (t->load > 0)
+  {
+    t->dropped = true;
+    t->pi = NULL;
+  }
+  else
+  {
+    GNUNET_free (t);
+  }
+  if (NULL != pi->t_head)
+    return; /* got other connections still */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Disconnected from peer %s\n",
-              GNUNET_i2s (peer));
+              GNUNET_i2s (&pi->id));
  GNUNET_STATISTICS_update (GDS_stats,
                            "# peers connected",
                            -1,
                            GNUNET_NO);
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multipeermap_remove (all_connected_peers,
-                                                       peer,
+                                                       &pi->id,
-                                                       to_remove));
+                                                       pi));
  if ( (0 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
       (GNUNET_YES != disable_try_connect))
  {
    GNUNET_SCHEDULER_cancel (find_peer_task);
    find_peer_task = NULL;
  }
-  GNUNET_assert (to_remove->peer_bucket >= 0);
+  GNUNET_assert (pi->peer_bucket >= 0);
-  bucket = &k_buckets[to_remove->peer_bucket];
+  bucket = &k_buckets[pi->peer_bucket];
  GNUNET_CONTAINER_DLL_remove (bucket->head,
                               bucket->tail,
-                               to_remove);
+                               pi);
  GNUNET_assert (bucket->peers_size > 0);
  bucket->peers_size--;
+  if ( (was_held) &&
+       (bucket->peers_size >= bucket_size - 1) )
+    update_hold (bucket);
  while ( (closest_bucket > 0) &&
          (0 == k_buckets[closest_bucket - 1].peers_size))
    closest_bucket--;
-  if (bucket->peers_size < bucket_size)
+  GNUNET_free (pi->hello);
-    update_connect_preferences ();
+  GNUNET_free (pi);
-  GNUNET_free (to_remove);
 }
@@ -894,17 +885,14 @@ handle_core_disconnect (void *cls,
 * @return Some number of peers to forward the message to
 */
 static unsigned int
-get_forward_count (uint32_t hop_count,
+get_forward_count (uint16_t hop_count,
-                   uint32_t target_replication)
+                   uint16_t target_replication)
 {
  uint32_t random_value;
  uint32_t forward_count;
  float target_value;
+  float rm1;
-  if (0 == target_replication)
-    target_replication = 1; /* 0 is verboten */
-  if (target_replication > GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL)
-    target_replication = GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL;
  if (hop_count > GDS_NSE_get () * 4.0)
  {
    /* forcefully terminate */
@@ -919,15 +907,15 @@ get_forward_count (uint32_t hop_count,
    /* Once we have reached our ideal number of hops, only forward to 1 peer */
    return 1;
  }
-  /* bound by system-wide maximum */
+  /* bound by system-wide maximum and minimum */
+  if (0 == target_replication)
+    target_replication = 1; /* 0 is verboten */
  target_replication =
    GNUNET_MIN (GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL,
                target_replication);
+  rm1 = target_replication - 1.0;
  target_value =
-    1 + (target_replication - 1.0) / (GDS_NSE_get ()
+    1 + (rm1) / (GDS_NSE_get () + (rm1 * hop_count));
-                                      + ((float) (target_replication - 1.0)
-                                         * hop_count));
  /* Set forward count to floor of target_value */
  forward_count = (uint32_t) target_value;
@@ -956,7 +944,7 @@ enum GNUNET_GenericReturnValue
 GDS_am_closest_peer (const struct GNUNET_HashCode *key,
                     const struct GNUNET_CONTAINER_BloomFilter *bloom)
 {
-  if (0 == GNUNET_memcmp (&my_identity_hash,
+  if (0 == GNUNET_memcmp (&GDS_my_identity_hash,
                          key))
    return GNUNET_YES;
  for (int bucket_num = find_bucket (key);
@@ -983,7 +971,7 @@ GDS_am_closest_peer (const struct GNUNET_HashCode *key,
         because an unfiltered peer exists, we are not the
         closest. */
      int delta = GNUNET_CRYPTO_hash_xorcmp (&pos->phash,
-                                             &my_identity_hash,
+                                             &GDS_my_identity_hash,
                                             key);
      switch (delta)
      {
@@ -1047,7 +1035,7 @@ select_peer (const struct GNUNET_HashCode *key,
      struct GNUNET_HashCode xor;
      GNUNET_CRYPTO_hash_xor (key,
-                              &my_identity_hash,
+                              &GDS_my_identity_hash,
                              &xor);
      best_bucket = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
    }
@@ -1067,13 +1055,14 @@ select_peer (const struct GNUNET_HashCode *key,
        if (count >= bucket_size)
          break; /* we only consider first #bucket_size entries per bucket */
        count++;
-        if (GNUNET_YES ==
+        if ( (NULL != bloom) &&
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
+             (GNUNET_YES ==
-                                               &pos->phash))
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
        {
          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                      "Excluded peer `%s' due to BF match in greedy routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                      GNUNET_h2s (key));
          continue;
        }
@@ -1140,7 +1129,7 @@ select_peer (const struct GNUNET_HashCode *key,
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Selected peer `%s' in greedy routing for %s\n",
-                GNUNET_i2s (chosen->id),
+                GNUNET_i2s (&chosen->id),
                GNUNET_h2s (key));
    return chosen;
  } /* end of 'greedy' peer selection */
@@ -1155,22 +1144,24 @@ select_peer (const struct GNUNET_HashCode *key,
    for (unsigned int bc = 0; bc < closest_bucket; bc++)
    {
+      struct PeerBucket *bucket = &k_buckets[bc];
      unsigned int count = 0;
-      for (struct PeerInfo *pos = k_buckets[bc].head;
+      for (struct PeerInfo *pos = bucket->head;
           NULL != pos;
           pos = pos->next)
      {
        count++;
        if (count > bucket_size)
          break; /* limits search to #bucket_size peers per bucket */
-        if (GNUNET_YES ==
+        if ( (NULL != bloom) &&
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
+             (GNUNET_YES ==
-                                               &pos->phash))
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
        {
          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                      "Excluded peer `%s' due to BF match in random routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                      GNUNET_h2s (key));
          continue;             /* Ignore filtered peers */
        }
@@ -1201,15 +1192,16 @@ select_peer (const struct GNUNET_HashCode *key,
        if (count > bucket_size)
          break; /* limits search to #bucket_size peers per bucket */
-        if (GNUNET_YES ==
+        if ( (NULL != bloom) &&
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
+             (GNUNET_YES ==
-                                               &pos->phash))
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
          continue;             /* Ignore bloomfiltered peers */
        if (0 == selected--)
        {
          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                      "Selected peer `%s' in random routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                      GNUNET_h2s (key));
          return pos;
        }
@@ -1237,8 +1229,8 @@ select_peer (const struct GNUNET_HashCode *key,
 static unsigned int
 get_target_peers (const struct GNUNET_HashCode *key,
                  struct GNUNET_CONTAINER_BloomFilter *bloom,
-                  uint32_t hop_count,
+                  uint16_t hop_count,
-                  uint32_t target_replication,
+                  uint16_t target_replication,
                  struct PeerInfo ***targets)
 {
  unsigned int target;
@@ -1294,11 +1286,36 @@ get_target_peers (const struct GNUNET_HashCode *key,
 }
+/**
+ * If we got a HELLO, consider it for our own routing table 
+ *
+ * @param bd block data we got 
+ */
+static void
+hello_check (const struct GDS_DATACACHE_BlockData *bd)
+{
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_HELLO_Builder *b;
+  if (GNUNET_BLOCK_TYPE_DHT_URL_HELLO != bd->type)
+    return;
+  b = GNUNET_HELLO_builder_from_block (bd->data,
+                                       bd->data_size);
+  if (GNUNET_YES != disable_try_connect)
+    GNUNET_HELLO_builder_iterate (b,
+                                  &pid,
+                                  &GDS_try_connect,
+                                  &pid);
+  GNUNET_HELLO_builder_free (b);
+}
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                           enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
+                           uint16_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t hop_count,
                           struct GNUNET_CONTAINER_BloomFilter *bf)
 {
  unsigned int target_count;
@@ -1308,27 +1325,31 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
  unsigned int put_path_length = bd->put_path_length;
  GNUNET_assert (NULL != bf);
-#if SANITY_CHECKS
+#if SANITY_CHECKS > 1
  if (0 !=
-      GNUNET_DHT_verify_path (&bd->key,
+      GNUNET_DHT_verify_path (bd->data,
-                              bd->data,
                              bd->data_size,
                              bd->expiration_time,
                              bd->put_path,
                              bd->put_path_length,
                              NULL, 0, /* get_path */
-                              &my_identity))
+                              &GDS_my_identity))
  {
    GNUNET_break_op (0);
    put_path_length = 0;
  }
 #endif
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Adding myself (%s) to PUT bloomfilter for %s\n",
+              "Adding myself (%s) to PUT bloomfilter for %s with RO(%s/%s)\n",
-              GNUNET_i2s (&my_identity),
+              GNUNET_i2s (&GDS_my_identity),
-              GNUNET_h2s (&bd->key));
+              GNUNET_h2s (&bd->key),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
+  
+  /* if we got a HELLO, consider it for our own routing table */
+  hello_check (bd);
  GNUNET_CONTAINER_bloomfilter_add (bf,
-                                    &my_identity_hash);
+                                    &GDS_my_identity_hash);
  GNUNET_STATISTICS_update (GDS_stats,
                            "# PUT requests routed",
                            1,
@@ -1345,7 +1366,7 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                "Routing PUT for %s terminates after %u hops at %s\n",
                GNUNET_h2s (&bd->key),
                (unsigned int) hop_count,
-                GNUNET_i2s (&my_identity));
+                GNUNET_i2s (&GDS_my_identity));
    return GNUNET_NO;
  }
  msize = bd->put_path_length * sizeof(struct GNUNET_DHT_PathElement)
@@ -1367,33 +1388,23 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
  for (unsigned int i = 0; i < target_count; i++)
  {
    struct PeerInfo *target = targets[i];
-    struct GNUNET_MQ_Envelope *env;
    struct PeerPutMessage *ppm;
+    char buf[sizeof (*ppm) + msize] GNUNET_ALIGN;
    struct GNUNET_DHT_PathElement *pp;
-    if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
-    {
-      /* skip */
-      GNUNET_STATISTICS_update (GDS_stats,
-                                "# P2P messages dropped due to full queue",
-                                1,
-                                GNUNET_NO);
-      skip_count++;
-      continue;
-    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Routing PUT for %s after %u hops to %s\n",
                GNUNET_h2s (&bd->key),
                (unsigned int) hop_count,
-                GNUNET_i2s (target->id));
+                GNUNET_i2s (&target->id));
-    env = GNUNET_MQ_msg_extra (ppm,
+    ppm = (struct PeerPutMessage *) buf;
-                               msize,
+    ppm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_PUT);
-                               GNUNET_MESSAGE_TYPE_DHT_P2P_PUT);
+    ppm->header.size = htons (sizeof (buf));
-    ppm->options = htonl (options);
    ppm->type = htonl (bd->type);
-    ppm->hop_count = htonl (hop_count + 1);
+    ppm->options = htons (options);
-    ppm->desired_replication_level = htonl (desired_replication_level);
+    ppm->hop_count = htons (hop_count + 1);
-    ppm->put_path_length = htonl (put_path_length);
+    ppm->desired_replication_level = htons (desired_replication_level);
+    ppm->put_path_length = htons (put_path_length);
    ppm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
    GNUNET_break (GNUNET_YES ==
                  GNUNET_CONTAINER_bloomfilter_test (bf,
@@ -1412,20 +1423,23 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
    {
      /* Note that the signature in 'put_path' was not initialized before,
         so this is crucial to avoid sending garbage. */
-      sign_path (&bd->key,
+      sign_path (bd->data,
-                 bd->data,
                 bd->data_size,
                 bd->expiration_time,
                 &pp[put_path_length - 1].pred,
-                 target->id,
+                 &target->id,
                 &pp[put_path_length - 1].sig);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Signing PUT PATH %u => %s\n",
+                  put_path_length,
+                  GNUNET_B2S (&pp[put_path_length - 1].sig));
    }
    GNUNET_memcpy (&pp[put_path_length],
                   bd->data,
                   bd->data_size);
-    GNUNET_MQ_send (target->mq,
+    do_send (target,
-                    env);
+             &ppm->header);
  }
  GNUNET_free (targets);
  GNUNET_STATISTICS_update (GDS_stats,
@@ -1439,8 +1453,8 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                           enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
+                           uint16_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t hop_count,
                           const struct GNUNET_HashCode *key,
                           const void *xquery,
                           size_t xquery_size,
@@ -1466,18 +1480,21 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                                   desired_replication_level,
                                   &targets);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Adding myself (%s) to GET bloomfilter for %s\n",
+              "Adding myself (%s) to GET bloomfilter for %s with RO(%s/%s)\n",
-              GNUNET_i2s (&my_identity),
+              GNUNET_i2s (&GDS_my_identity),
-              GNUNET_h2s (key));
+              GNUNET_h2s (key),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
  GNUNET_CONTAINER_bloomfilter_add (peer_bf,
-                                    &my_identity_hash);
+                                    &GDS_my_identity_hash);
  if (0 == target_count)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Routing GET for %s terminates after %u hops at %s\n",
                GNUNET_h2s (key),
                (unsigned int) hop_count,
-                GNUNET_i2s (&my_identity));
+                GNUNET_i2s (&GDS_my_identity));
    return GNUNET_NO;
  }
  if (GNUNET_OK !=
@@ -1504,32 +1521,22 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
  for (unsigned int i = 0; i < target_count; i++)
  {
    struct PeerInfo *target = targets[i];
-    struct GNUNET_MQ_Envelope *env;
    struct PeerGetMessage *pgm;
+    char buf[sizeof (*pgm) + msize] GNUNET_ALIGN;
    char *xq;
-    if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
-    {
-      /* skip */
-      GNUNET_STATISTICS_update (GDS_stats,
-                                "# P2P messages dropped due to full queue",
-                                1,
-                                GNUNET_NO);
-      skip_count++;
-      continue;
-    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Routing GET for %s after %u hops to %s\n",
                GNUNET_h2s (key),
                (unsigned int) hop_count,
-                GNUNET_i2s (target->id));
+                GNUNET_i2s (&target->id));
-    env = GNUNET_MQ_msg_extra (pgm,
+    pgm = (struct PeerGetMessage *) buf;
-                               msize,
+    pgm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_GET);
-                               GNUNET_MESSAGE_TYPE_DHT_P2P_GET);
+    pgm->header.size = htons (sizeof (buf));
-    pgm->options = htonl (options);
    pgm->type = htonl (type);
-    pgm->hop_count = htonl (hop_count + 1);
+    pgm->options = htons (options);
-    pgm->desired_replication_level = htonl (desired_replication_level);
+    pgm->hop_count = htons (hop_count + 1);
+    pgm->desired_replication_level = htons (desired_replication_level);
    pgm->xquery_size = htonl (xquery_size);
    pgm->bf_mutator = bf_nonce;
    GNUNET_break (GNUNET_YES ==
@@ -1547,8 +1554,8 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
    GNUNET_memcpy (&xq[xquery_size],
                   reply_bf,
                   reply_bf_size);
-    GNUNET_MQ_send (target->mq,
+    do_send (target,
-                    env);
+             &pgm->header);
  }
  GNUNET_STATISTICS_update (GDS_stats,
                            "# GET messages queued for transmission",
@@ -1568,34 +1575,30 @@ GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target)
 }
-void
+bool
 GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
                             const struct GDS_DATACACHE_BlockData *bd,
                             const struct GNUNET_HashCode *query_hash,
                             unsigned int get_path_length,
                             const struct GNUNET_DHT_PathElement *get_path)
 {
-  struct GNUNET_MQ_Envelope *env;
-  struct PeerResultMessage *prm;
  struct GNUNET_DHT_PathElement *paths;
  size_t msize;
  unsigned int ppl = bd->put_path_length;
-#if SANITY_CHECKS
+#if SANITY_CHECKS > 1
  if (0 !=
-      GNUNET_DHT_verify_path (&bd->key,
+      GNUNET_DHT_verify_path (bd->data,
-                              bd->data,
                              bd->data_size,
                              bd->expiration_time,
                              bd->put_path,
                              bd->put_path_length,
                              get_path,
                              get_path_length,
-                              &my_identity))
+                              &GDS_my_identity))
  {
    GNUNET_break_op (0);
-    get_path_length = 0;
+    return false;
-    ppl = 0;
  }
 #endif
  msize = bd->data_size + (get_path_length + ppl)
@@ -1620,84 +1623,99 @@ GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
       (bd->data_size > GNUNET_MAX_MESSAGE_SIZE))
  {
    GNUNET_break (0);
-    return;
+    return false;
-  }
-  if (GNUNET_MQ_get_length (pi->mq) >= MAXIMUM_PENDING_PER_PEER)
-  {
-    /* skip */
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# P2P messages dropped due to full queue",
-                              1,
-                              GNUNET_NO);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Peer queue full, ignoring reply for key %s\n",
-                GNUNET_h2s (&bd->key));
-    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Forwarding reply for key %s to peer %s\n",
              GNUNET_h2s (query_hash),
-              GNUNET_i2s (pi->id));
+              GNUNET_i2s (&pi->id));
  GNUNET_STATISTICS_update (GDS_stats,
                            "# RESULT messages queued for transmission",
                            1,
                            GNUNET_NO);
-  env = GNUNET_MQ_msg_extra (prm,
-                             msize,
-                             GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT);
-  prm->type = htonl (bd->type);
-  prm->put_path_length = htonl (ppl);
-  prm->get_path_length = htonl (get_path_length);
-  prm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
-  prm->key = *query_hash;
-  paths = (struct GNUNET_DHT_PathElement *) &prm[1];
-  GNUNET_memcpy (paths,
-                 bd->put_path,
-                 ppl * sizeof(struct GNUNET_DHT_PathElement));
-  GNUNET_memcpy (&paths[ppl],
-                 get_path,
-                 get_path_length * sizeof(struct GNUNET_DHT_PathElement));
-  /* 0 == get_path_length means path is not being tracked */
-  if (0 != get_path_length)
  {
-    /* Note that the signature in 'get_path' was not initialized before,
+    struct PeerResultMessage *prm;
-       so this is crucial to avoid sending garbage. */
+    char buf[sizeof (*prm) + msize] GNUNET_ALIGN;
-    sign_path (&bd->key,
-               bd->data,
+    prm = (struct PeerResultMessage *) buf;
-               bd->data_size,
+    prm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT);
-               bd->expiration_time,
+    prm->header.size = htons (sizeof (buf));
-               &paths[ppl + get_path_length - 1].pred,
+    prm->type = htonl (bd->type);
-               pi->id,
+    prm->reserved = htonl (0);
-               &paths[ppl + get_path_length - 1].sig);
+    prm->put_path_length = htons (ppl);
-  }
+    prm->get_path_length = htons (get_path_length);
-  GNUNET_memcpy (&paths[ppl + get_path_length],
+    prm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
-                 bd->data,
+    prm->key = *query_hash;
-                 bd->data_size);
+    paths = (struct GNUNET_DHT_PathElement *) &prm[1];
-  GNUNET_MQ_send (pi->mq,
+    if (NULL != bd->put_path)
-                  env);
+    {
-}
+      GNUNET_memcpy (paths,
+                     bd->put_path,
+                     ppl * sizeof(struct GNUNET_DHT_PathElement));
+    }
+    else
+    {
+      GNUNET_assert (0 == ppl);
+    }
+    if (NULL != get_path)
+    {
+      GNUNET_memcpy (&paths[ppl],
+                     get_path,
+                     get_path_length * sizeof(struct GNUNET_DHT_PathElement));
+    }
+    else
+    {
+      GNUNET_assert (0 == get_path_length);
+    }
+    /* 0 == get_path_length+ppl means path is not being tracked */
+    if (0 != (get_path_length + ppl))
+    {
+      /* Note that the last signature in 'paths' was not initialized before,
+         so this is crucial to avoid sending garbage. */
+      sign_path (bd->data,
+                 bd->data_size,
+                 bd->expiration_time,
+                 &paths[ppl + get_path_length - 1].pred,
+                 &pi->id,
+                 &paths[ppl + get_path_length - 1].sig);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Signing GET PATH %u/%u of %s => %s\n",
+                  ppl,
+                  get_path_length,
+                  GNUNET_h2s (query_hash),
+                  GNUNET_B2S (&paths[ppl + get_path_length - 1].sig));
+    }
+    GNUNET_memcpy (&paths[ppl + get_path_length],
+                   bd->data,
+                   bd->data_size);
+#if SANITY_CHECKS > 1
+    {
+      struct GNUNET_DHT_PathElement xpaths[get_path_length + 1];
-/**
+      memcpy (xpaths,
- * To be called on core init.
+              &paths[ppl],
- *
+              get_path_length * sizeof (struct GNUNET_DHT_PathElement));
- * @param cls service closure
+      xpaths[get_path_length].pred = GDS_my_identity;
- * @param identity the public identity of this peer
+      if (0 !=
- */
+          GNUNET_DHT_verify_path (bd->data,
-static void
+                                  bd->data_size,
-core_init (void *cls,
+                                  bd->expiration_time,
-           const struct GNUNET_PeerIdentity *identity)
+                                  paths,
-{
+                                  ppl,
-  (void) cls;
+                                  xpaths,
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                                  get_path_length + 1,
-              "CORE called, I am %s\n",
+                                  &pi->id))
-              GNUNET_i2s (identity));
+      {
-  my_identity = *identity;
+        GNUNET_break (0);
-  GNUNET_CRYPTO_hash (identity,
+        return false;
-                      sizeof(struct GNUNET_PeerIdentity),
+      }
-                      &my_identity_hash);
+    }
-  GNUNET_SERVICE_resume (GDS_service);
+#endif
+    do_send (pi,
+             &prm->header);
+  }
+  return true;
 }
@@ -1713,7 +1731,7 @@ check_dht_p2p_put (void *cls,
                   const struct PeerPutMessage *put)
 {
  uint16_t msize = ntohs (put->header.size);
-  uint32_t putlen = ntohl (put->put_path_length);
+  uint16_t putlen = ntohs (put->put_path_length);
  (void) cls;
  if ( (msize <
@@ -1732,34 +1750,37 @@ check_dht_p2p_put (void *cls,
 /**
 * Core handler for p2p put requests.
 *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
 * @param message message
 */
 static void
 handle_dht_p2p_put (void *cls,
                    const struct PeerPutMessage *put)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
  uint16_t msize = ntohs (put->header.size);
  enum GNUNET_DHT_RouteOption options
-    = (enum GNUNET_DHT_RouteOption) ntohl (put->options);
+    = (enum GNUNET_DHT_RouteOption) ntohs (put->options);
+  const struct GNUNET_DHT_PathElement *put_path
+    = (const struct GNUNET_DHT_PathElement *) &put[1];
+  uint16_t putlen
+    = ntohs (put->put_path_length);
  struct GDS_DATACACHE_BlockData bd = {
    .key = put->key,
    .expiration_time = GNUNET_TIME_absolute_ntoh (put->expiration_time),
-    .type = ntohl (put->type)
+    .type = ntohl (put->type),
+    .data_size = msize - (sizeof(*put)
+                          + putlen * sizeof(struct GNUNET_DHT_PathElement)),
+    .data = &put_path[putlen]
  };
-  const struct GNUNET_DHT_PathElement *put_path
-    = (const struct GNUNET_DHT_PathElement *) &put[1];
-  uint32_t putlen
-    = ntohl (put->put_path_length);
-  bd.data_size = msize - (sizeof(*put)
-                          + putlen * sizeof(struct GNUNET_DHT_PathElement));
-  bd.data = &put_path[putlen];
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "PUT for `%s' from %s\n",
+              "PUT for `%s' from %s with RO (%s/%s)\n",
              GNUNET_h2s (&put->key),
-              GNUNET_i2s (peer->id));
+              GNUNET_i2s (&peer->id),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
  if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
  {
    GNUNET_STATISTICS_update (GDS_stats,
@@ -1768,6 +1789,17 @@ handle_dht_p2p_put (void *cls,
                              GNUNET_NO);
    return;
  }
+  if (GNUNET_NO ==
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (0 == (options & GNUNET_DHT_RO_RECORD_ROUTE))
+    putlen = 0;
  GNUNET_STATISTICS_update (GDS_stats,
                            "# P2P PUT requests received",
                            1,
@@ -1796,25 +1828,14 @@ handle_dht_p2p_put (void *cls,
      }
      break;
    case GNUNET_NO:
-      GNUNET_break_op (0);
-      return;
-    case GNUNET_SYSERR:
      /* cannot verify, good luck */
      break;
+    case GNUNET_SYSERR:
+      /* block type not supported, good luck */
+      break;
    }
  }
-  if (GNUNET_NO ==
-      GNUNET_BLOCK_check_block (GDS_block_context,
-                                bd.type,
-                                &bd.key,
-                                bd.data,
-                                bd.data_size))
-  {
-    GNUNET_break_op (0);
-    return;
-  }
  {
    struct GNUNET_CONTAINER_BloomFilter *bf;
    struct GNUNET_DHT_PathElement pp[putlen + 1];
@@ -1830,42 +1851,39 @@ handle_dht_p2p_put (void *cls,
    bd.put_path_length = putlen + 1;
    if (0 != (options & GNUNET_DHT_RO_RECORD_ROUTE))
    {
-#if SANITY_CHECKS
+      unsigned int failure_offset;
-      for (unsigned int i = 0; i <= putlen; i++)
+      
-      {
-        for (unsigned int j = 0; j < i; j++)
-        {
-          GNUNET_break (0 !=
-                        GNUNET_memcmp (&pp[i].pred,
-                                       &pp[j].pred));
-        }
-        GNUNET_break (0 !=
-                      GNUNET_memcmp (&pp[i].pred,
-                                     peer->id));
-      }
-      if (0 !=
-          GNUNET_DHT_verify_path (&bd.key,
-                                  bd.data,
-                                  bd.data_size,
-                                  bd.expiration_time,
-                                  bd.put_path,
-                                  putlen,
-                                  NULL, 0, /* get_path */
-                                  &my_identity))
-      {
-        GNUNET_break_op (0);
-        putlen = 0;
-      }
-#endif
      GNUNET_memcpy (pp,
                     put_path,
                     putlen * sizeof(struct GNUNET_DHT_PathElement));
-      pp[putlen].pred = *peer->id;
+      pp[putlen].pred = peer->id;
      /* zero-out signature, not valid until we actually do forward! */
      memset (&pp[putlen].sig,
              0,
              sizeof (pp[putlen].sig));
-      putlen++;
+#if SANITY_CHECKS      
+    /* TODO: might want to eventually implement probabilistic
+       load-based path verification, but for now it is all or nothing */
+      failure_offset 
+        = GNUNET_DHT_verify_path (bd.data,
+                                  bd.data_size,
+                                  bd.expiration_time,
+                                  pp,
+                                  putlen + 1,
+                                  NULL, 0,   /* get_path */
+                                  &GDS_my_identity);
+#else
+      failure_offset = 0;
+#endif
+      if (0 != failure_offset)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Recorded put path invalid at offset %u, truncating\n",
+                    failure_offset);
+        GNUNET_assert (failure_offset <= putlen);
+        bd.put_path = &pp[failure_offset];
+        bd.put_path_length = putlen - failure_offset;
+      }      
    }
    else
    {
@@ -1873,9 +1891,9 @@ handle_dht_p2p_put (void *cls,
    }
    /* give to local clients */
-    GDS_CLIENTS_handle_reply (&bd,
+    GNUNET_break (GDS_CLIENTS_handle_reply (&bd,
-                              &bd.key,
+                                            &bd.key,
-                              0, NULL /* get path */);
+                                            0, NULL /* get path */));
    /* store locally */
    if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
@@ -1889,8 +1907,8 @@ handle_dht_p2p_put (void *cls,
      forwarded
        = GDS_NEIGHBOURS_handle_put (&bd,
                                     options,
-                                     ntohl (put->desired_replication_level),
+                                     ntohs (put->desired_replication_level),
-                                     ntohl (put->hop_count),
+                                     ntohs (put->hop_count),
                                     bf);
      /* notify monitoring clients */
      GDS_CLIENTS_process_put (options
@@ -1898,8 +1916,8 @@ handle_dht_p2p_put (void *cls,
                                ? GNUNET_DHT_RO_LAST_HOP
                                : 0),
                               &bd,
-                               ntohl (put->hop_count),
+                               ntohs (put->hop_count),
-                               ntohl (put->desired_replication_level));
+                               ntohs (put->desired_replication_level));
    }
    GNUNET_CONTAINER_bloomfilter_free (bf);
  }
@@ -1907,49 +1925,64 @@ handle_dht_p2p_put (void *cls,
 /**
- * We have received a FIND PEER request.  Send matching
+ * We have received a request for a HELLO.  Sends our
- * HELLOs back.
+ * HELLO back.
 *
- * @param pi sender of the FIND PEER request
+ * @param pi sender of the request
 * @param key peers close to this key are desired
 * @param bg group for filtering peers
 */
 static void
-handle_find_peer (struct PeerInfo *pi,
+handle_find_my_hello (struct PeerInfo *pi,
-                  const struct GNUNET_HashCode *query_hash,
+                      const struct GNUNET_HashCode *query_hash,
-                  struct GNUNET_BLOCK_Group *bg)
+                      struct GNUNET_BLOCK_Group *bg)
 {
-  int bucket_idx;
+  size_t block_size = 0;
-  struct PeerBucket *bucket;
-  struct PeerInfo *peer;
+  /* TODO: consider caching our HELLO block for a bit, to
-  unsigned int choice;
+     avoid signing too often here... */
-  struct GDS_DATACACHE_BlockData bd = {
+  GNUNET_break (GNUNET_NO ==
-    .type = GNUNET_BLOCK_TYPE_DHT_HELLO
+                GNUNET_HELLO_builder_to_block (GDS_my_hello,
-  };
+                                               &GDS_my_private_key,
+                                               NULL,
-  /* first, check about our own HELLO */
+                                               &block_size));
-  if (NULL != GDS_my_hello)
  {
-    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
+    char block[block_size];
-      hello_expiration),
-    bd.key = my_identity_hash,
+    if (GNUNET_OK !=
-    bd.data = GDS_my_hello;
+        GNUNET_HELLO_builder_to_block (GDS_my_hello,
-    bd.data_size = GNUNET_HELLO_size (
+                                       &GDS_my_private_key,
-      (const struct GNUNET_HELLO_Message *) GDS_my_hello);
+                                       block,
-    GNUNET_break (bd.data_size >= sizeof(struct GNUNET_MessageHeader));
+                                       &block_size))
-    if (GNUNET_BLOCK_REPLY_OK_MORE ==
-        GNUNET_BLOCK_check_reply (GDS_block_context,
-                                  GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                  bg,
-                                  &my_identity_hash,
-                                  NULL, 0,
-                                  bd.data,
-                                  bd.data_size))
    {
-      GDS_NEIGHBOURS_handle_reply (pi,
+      GNUNET_STATISTICS_update (GDS_stats,
-                                   &bd,
+                                "# FIND PEER requests ignored due to lack of HELLO",
-                                   query_hash,
+                                1,
-                                   0, NULL /* get path */);
+                                GNUNET_NO);
+    }
+    else if (GNUNET_BLOCK_REPLY_OK_MORE ==
+             GNUNET_BLOCK_check_reply (GDS_block_context,
+                                       GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+                                       bg,
+                                       &GDS_my_identity_hash,
+                                       NULL, 0,
+                                       block,
+                                       block_size))
+    {
+      struct GDS_DATACACHE_BlockData bd = {
+        .type = GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+        .expiration_time
+          = GNUNET_TIME_relative_to_absolute (
+              GNUNET_HELLO_ADDRESS_EXPIRATION),
+        .key = GDS_my_identity_hash,
+        .data = block,
+        .data_size = block_size
+      };
+      GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
+                                                 &bd,
+                                                 query_hash,
+                                                 0, NULL /* get path */));
    }
    else
    {
@@ -1959,70 +1992,52 @@ handle_find_peer (struct PeerInfo *pi,
                                GNUNET_NO);
    }
  }
-  else
+}
-  {
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# FIND PEER requests ignored due to lack of HELLO",
-                              1,
-                              GNUNET_NO);
-  }
-  /* then, also consider sending a random HELLO from the closest bucket */
-  /* FIXME: How can this be true? Shouldnt we just do find_bucket() ? */
-  if (0 ==
-      GNUNET_memcmp (&my_identity_hash,
-                     query_hash))
-    bucket_idx = closest_bucket - 1;
-  else
-    bucket_idx = GNUNET_MIN ((int) closest_bucket - 1,
-                             find_bucket (query_hash));
-  if (bucket_idx < 0)
-    return;
-  bucket = &k_buckets[bucket_idx];
-  if (bucket->peers_size == 0)
-    return;
-  choice = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                     bucket->peers_size);
-  peer = bucket->head;
-  while (choice > 0)
-  {
-    GNUNET_assert (NULL != peer);
-    peer = peer->next;
-    choice--;
-  }
-  choice = bucket->peers_size;
-  {
+/**
-    const struct GNUNET_HELLO_Message *hello;
+ * We have received a request for nearby HELLOs.  Sends matching
-    size_t hello_size;
+ * HELLOs back.
+ *
+ * @param pi sender of the request
+ * @param key peers close to this key are desired
+ * @param bg group for filtering peers
+ */
+static void
+handle_find_local_hello (struct PeerInfo *pi,
+                         const struct GNUNET_HashCode *query_hash,
+                         struct GNUNET_BLOCK_Group *bg)
+{
+  /* Force non-random selection by hop count */
+  struct PeerInfo *peer;
-    do
+  peer = select_peer (query_hash,
-    {
+                      NULL,
-      peer = peer->next;
+                      GDS_NSE_get () + 1);
-      if (0 == choice--)
+  if ( (NULL != peer->hello) &&
-        return;                 /* no non-masked peer available */
+       (! GNUNET_TIME_absolute_is_past (peer->hello_expiration)) &&
-      if (NULL == peer)
+       (GNUNET_BLOCK_REPLY_OK_MORE ==
-        peer = bucket->head;
+        GNUNET_BLOCK_check_reply (
-      hello = GDS_HELLO_get (peer->id);
+          GDS_block_context,
-    } while ( (NULL == hello) ||
+          GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
-              (GNUNET_BLOCK_REPLY_OK_MORE !=
+          bg,
-               GNUNET_BLOCK_check_reply (
+          &peer->phash,
-                 GDS_block_context,
+          NULL, 0,        /* xquery */
-                 GNUNET_BLOCK_TYPE_DHT_HELLO,
+          peer->hello,
-                 bg,
+          peer->hello_size)) )
-                 &peer->phash,
+  {
-                 NULL, 0, /* xquery */
+    struct GDS_DATACACHE_BlockData bd = {
-                 hello,
+      .type = GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
-                 (hello_size = GNUNET_HELLO_size (hello)))));
+      .expiration_time = peer->hello_expiration,
-    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
+      .key = peer->phash,
-      GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION);
+      .data = peer->hello,
-    bd.key = peer->phash;
+      .data_size = peer->hello_size
-    bd.data = hello;
+    };
-    bd.data_size = hello_size;
-    GDS_NEIGHBOURS_handle_reply (pi,
+    GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
-                                 &bd,
+                                               &bd,
-                                 query_hash,
+                                               query_hash,
-                                 0, NULL /* get path */);
+                                               0, NULL /* get path */));
  }
 }
@@ -2039,17 +2054,17 @@ handle_local_result (void *cls,
 {
  struct PeerInfo *peer = cls;
-  GDS_NEIGHBOURS_handle_reply (peer,
+  GNUNET_break (GDS_NEIGHBOURS_handle_reply (peer,
-                               bd,
+                                             bd,
-                               &bd->key,
+                                             &bd->key,
-                               0, NULL /* get path */);
+                                             0, NULL /* get path */));
 }
 /**
 * Check validity of p2p get request.
 *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
 * @param get the message
 * @return #GNUNET_OK if the message is well-formed
 */
@@ -2073,20 +2088,21 @@ check_dht_p2p_get (void *cls,
 /**
 * Core handler for p2p get requests.
 *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
 * @param get the message
 */
 static void
 handle_dht_p2p_get (void *cls,
                    const struct PeerGetMessage *get)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
  uint16_t msize = ntohs (get->header.size);
  uint32_t xquery_size = ntohl (get->xquery_size);
-  uint32_t hop_count = ntohl (get->hop_count);
+  uint32_t hop_count = ntohs (get->hop_count);
  size_t reply_bf_size = msize - (sizeof(*get) + xquery_size);
  enum GNUNET_BLOCK_Type type = (enum GNUNET_BLOCK_Type) ntohl (get->type);
-  enum GNUNET_DHT_RouteOption options = (enum GNUNET_DHT_RouteOption)  ntohl (
+  enum GNUNET_DHT_RouteOption options = (enum GNUNET_DHT_RouteOption)  ntohs (
    get->options);
  enum GNUNET_BLOCK_ReplyEvaluationResult eval = GNUNET_BLOCK_REPLY_OK_MORE;
  const void *xquery = (const void *) &get[1];
@@ -2133,32 +2149,45 @@ handle_dht_p2p_get (void *cls,
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "GET for %s at %s after %u hops\n",
                GNUNET_h2s (&get->key),
-                GNUNET_i2s (&my_identity),
+                GNUNET_i2s (&GDS_my_identity),
                (unsigned int) hop_count);
-    /* local lookup (this may update the reply_bf) */
+    /* local lookup (this may update the bg) */
    if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
         (GDS_am_closest_peer (&get->key,
                               peer_bf)) )
    {
-      if ((0 != (options & GNUNET_DHT_RO_FIND_PEER)))
+      if (GNUNET_BLOCK_TYPE_DHT_URL_HELLO == type)
      {
        GNUNET_STATISTICS_update (GDS_stats,
-                                  "# P2P FIND PEER requests processed",
+                                  "# P2P HELLO lookup requests processed",
                                  1,
                                  GNUNET_NO);
-        handle_find_peer (peer,
+        handle_find_my_hello (peer,
-                          &get->key,
+                              &get->key,
-                          bg);
+                              bg);
+        if (0 != (options & GNUNET_DHT_RO_FIND_APPROXIMATE))
+          handle_find_local_hello (peer,
+                                   &get->key,
+                                   bg);
      }
      else
      {
-        eval = GDS_DATACACHE_handle_get (&get->key,
+        if (0 != (options & GNUNET_DHT_RO_FIND_APPROXIMATE))
-                                         type,
+          eval = GDS_DATACACHE_get_closest (&get->key,
-                                         xquery,
+                                            type,
-                                         xquery_size,
+                                            xquery,
-                                         bg,
+                                            xquery_size,
-                                         &handle_local_result,
+                                            bg,
-                                         peer);
+                                            &handle_local_result,
+                                            peer);
+        else
+          eval = GDS_DATACACHE_handle_get (&get->key,
+                                           type,
+                                           xquery,
+                                           xquery_size,
+                                           bg,
+                                           &handle_local_result,
+                                           peer);
      }
    }
    else
@@ -2169,8 +2198,10 @@ handle_dht_p2p_get (void *cls,
                                GNUNET_NO);
    }
-    /* remember request for routing replies */
+    /* remember request for routing replies
-    GDS_ROUTING_add (peer->id,
+       TODO: why should we do this if GNUNET_BLOCK_REPLY_OK_LAST == eval?
+    */
+    GDS_ROUTING_add (&peer->id,
                     type,
                     bg,      /* bg now owned by routing, but valid at least until end of this function! */
                     options,
@@ -2181,7 +2212,7 @@ handle_dht_p2p_get (void *cls,
    /* P2P forwarding */
    {
      bool forwarded = false;
-      uint32_t desired_replication_level = ntohl (
+      uint16_t desired_replication_level = ntohs (
        get->desired_replication_level);
      if (eval != GNUNET_BLOCK_REPLY_OK_LAST)
@@ -2220,18 +2251,25 @@ handle_dht_p2p_get (void *cls,
 * @param query_hash hash of the original query, might not match key in @a bd
 * @param get_path_length number of entries in @a get_path
 * @param get_path path the reply has taken
+ * @return true on success
 */
-static void
+static bool
 process_reply_with_path (const struct GDS_DATACACHE_BlockData *bd,
                         const struct GNUNET_HashCode *query_hash,
                         unsigned int get_path_length,
                         const struct GNUNET_DHT_PathElement *get_path)
 {
  /* forward to local clients */
-  GDS_CLIENTS_handle_reply (bd,
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                            query_hash,
+              "Forwarding reply to local clients\n");
-                            get_path_length,
+  if (! GDS_CLIENTS_handle_reply (bd,
-                            get_path);
+                                  query_hash,
+                                  get_path_length,
+                                  get_path))
+  {
+    GNUNET_break (0);
+    return false;
+  }
  GDS_CLIENTS_process_get_resp (bd,
                                get_path,
                                get_path_length);
@@ -2256,6 +2294,7 @@ process_reply_with_path (const struct GDS_DATACACHE_BlockData *bd,
                       query_hash,
                       get_path_length,
                       get_path);
+  return true;
 }
@@ -2270,8 +2309,8 @@ static enum GNUNET_GenericReturnValue
 check_dht_p2p_result (void *cls,
                      const struct PeerResultMessage *prm)
 {
-  uint32_t get_path_length = ntohl (prm->get_path_length);
+  uint16_t get_path_length = ntohs (prm->get_path_length);
-  uint32_t put_path_length = ntohl (prm->put_path_length);
+  uint16_t put_path_length = ntohs (prm->put_path_length);
  uint16_t msize = ntohs (prm->header.size);
  (void) cls;
@@ -2301,18 +2340,20 @@ static void
 handle_dht_p2p_result (void *cls,
                       const struct PeerResultMessage *prm)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
  uint16_t msize = ntohs (prm->header.size);
-  uint32_t get_path_length = ntohl (prm->get_path_length);
+  uint16_t get_path_length = ntohs (prm->get_path_length);
  struct GDS_DATACACHE_BlockData bd = {
    .expiration_time  = GNUNET_TIME_absolute_ntoh (prm->expiration_time),
    .put_path = (const struct GNUNET_DHT_PathElement *) &prm[1],
-    .put_path_length = ntohl (prm->put_path_length),
+    .put_path_length = ntohs (prm->put_path_length),
+    .key = prm->key,
    .type = ntohl (prm->type)
  };
  const struct GNUNET_DHT_PathElement *get_path
    = &bd.put_path[bd.put_path_length];
+    
  /* parse and validate message */
  if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
  {
@@ -2327,6 +2368,15 @@ handle_dht_p2p_result (void *cls,
  bd.data_size = msize - (sizeof(struct PeerResultMessage)
                          + (get_path_length + bd.put_path_length)
                          * sizeof(struct GNUNET_DHT_PathElement));
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
  GNUNET_STATISTICS_update (GDS_stats,
                            "# P2P RESULTS received",
                            1,
@@ -2337,7 +2387,6 @@ handle_dht_p2p_result (void *cls,
                            GNUNET_NO);
  {
    enum GNUNET_GenericReturnValue ret;
-    const struct GNUNET_HashCode *pquery;
    ret = GNUNET_BLOCK_get_key (GDS_block_context,
                                bd.type,
@@ -2345,102 +2394,274 @@ handle_dht_p2p_result (void *cls,
                                bd.data_size,
                                &bd.key);
    if (GNUNET_NO == ret)
-    {
+      bd.key = prm->key;
-      GNUNET_break_op (0);
-      return;
-    }
-    pquery = (GNUNET_OK == ret) ? &bd.key : &prm->key;
-    if (GNUNET_OK !=
-        GNUNET_BLOCK_check_block (GDS_block_context,
-                                  bd.type,
-                                  pquery,
-                                  bd.data,
-                                  bd.data_size))
-    {
-      GNUNET_break_op (0);
-      return;
-    }
  }
  /* if we got a HELLO, consider it for our own routing table */
-  if (GNUNET_BLOCK_TYPE_DHT_HELLO == bd.type)
+  hello_check (&bd);
-  {
-    const struct GNUNET_MessageHeader *h = bd.data;
-    struct GNUNET_PeerIdentity pid;
-    /* Should be a HELLO, validate and consider using it! */
-    if (bd.data_size < sizeof(struct GNUNET_HELLO_Message))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (bd.data_size != ntohs (h->size))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (GNUNET_OK !=
-        GNUNET_HELLO_get_id ((const struct GNUNET_HELLO_Message *) h,
-                             &pid))
-    {
-      GNUNET_break_op (0);
-      return;
-    }
-    if ( (GNUNET_YES != disable_try_connect) &&
-         (0 != GNUNET_memcmp (&my_identity,
-                              &pid)) )
-      try_connect (&pid,
-                   h);
-  }
-  /* First, check if 'peer' is already on the path, and if
+  /* Need to append 'peer' to 'get_path' */
-     so, truncate it instead of expanding. */
-  for (unsigned int i = 0; i <= get_path_length; i++)
-    if (0 == GNUNET_memcmp (&get_path[i].pred,
-                            peer->id))
-    {
-      process_reply_with_path (&bd,
-                               &prm->key,
-                               i, get_path);
-      return;
-    }
-  /* Need to append 'peer' to 'get_path' (normal case) */
  {
    struct GNUNET_DHT_PathElement xget_path[get_path_length + 1];
+    struct GNUNET_DHT_PathElement *gp = xget_path;
+    unsigned int failure_offset;
    GNUNET_memcpy (xget_path,
                   get_path,
                   get_path_length * sizeof(struct GNUNET_DHT_PathElement));
-    xget_path[get_path_length].pred = *peer->id;
+    xget_path[get_path_length].pred = peer->id;
    memset (&xget_path[get_path_length].sig,
            0,
            sizeof (xget_path[get_path_length].sig));
-    process_reply_with_path (&bd,
+#if SANITY_CHECKS
-                             &prm->key,
+    /* TODO: might want to eventually implement probabilistic
-                             get_path_length + 1, xget_path);
+       load-based path verification, but for now it is all or nothing */
+    failure_offset 
+      = GNUNET_DHT_verify_path (bd.data,
+                                bd.data_size,
+                                bd.expiration_time,
+                                bd.put_path,
+                                bd.put_path_length,
+                                xget_path,
+                                get_path_length + 1,
+                                &GDS_my_identity);
+#else
+    failure_offset = 0;
+#endif
+    if (0 != failure_offset)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Recorded path invalid at offset %u, truncating\n",
+                  failure_offset);
+      GNUNET_assert (failure_offset <= bd.put_path_length + get_path_length);
+      if (failure_offset >= bd.put_path_length)
+      {
+        /* failure on get path */
+        get_path_length -= (failure_offset - bd.put_path_length);
+        gp = &xget_path[failure_offset - bd.put_path_length];
+        bd.put_path_length = 0;
+      }
+      else
+      {
+        /* failure on put path */
+        bd.put_path = &bd.put_path[failure_offset];
+        bd.put_path_length -= failure_offset;
+      }
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Extending GET path of length %u with %s\n",
+                get_path_length,
+                GNUNET_i2s (&peer->id));
+    GNUNET_break (process_reply_with_path (&bd,
+                                           &prm->key,
+                                           get_path_length + 1,
+                                           gp));
  }
 }
-enum GNUNET_GenericReturnValue
+/**
-GDS_NEIGHBOURS_init ()
+ * Check validity of a p2p hello message.
+ *
+ * @param cls closure
+ * @param hello message
+ * @return #GNUNET_YES if the message is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_dht_p2p_hello (void *cls,
+                     const struct GNUNET_MessageHeader *hello)
 {
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
+  enum GNUNET_GenericReturnValue ret;
+  size_t hellob_size;
+  void *hellob;
+  struct GNUNET_TIME_Absolute expiration;
+  ret = GNUNET_HELLO_dht_msg_to_block (hello,
+                                       &peer->id,
+                                       &hellob,
+                                       &hellob_size,
+                                       &expiration);
+  GNUNET_free (hellob);
+  return ret;
+}
+/**
+ * Core handler for p2p HELLO messages.
+ *
+ * @param cls closure
+ * @param message message
+ */
+static void
+handle_dht_p2p_hello (void *cls,
+                      const struct GNUNET_MessageHeader *hello)
+{
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
+  GNUNET_free (peer->hello);
+  peer->hello_size = 0;
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_HELLO_dht_msg_to_block (hello,
+                                               &peer->id,
+                                               &peer->hello,
+                                               &peer->hello_size,
+                                               &peer->hello_expiration));
+}
+void
+GDS_u_receive (void *cls,
+               void **tctx,
+               void **sctx,
+               const void *message,
+               size_t message_size)
+{
+  struct Target *t = *tctx;
  struct GNUNET_MQ_MessageHandler core_handlers[] = {
    GNUNET_MQ_hd_var_size (dht_p2p_get,
                           GNUNET_MESSAGE_TYPE_DHT_P2P_GET,
                           struct PeerGetMessage,
-                           NULL),
+                           t),
    GNUNET_MQ_hd_var_size (dht_p2p_put,
                           GNUNET_MESSAGE_TYPE_DHT_P2P_PUT,
                           struct PeerPutMessage,
-                           NULL),
+                           t),
    GNUNET_MQ_hd_var_size (dht_p2p_result,
                           GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT,
                           struct PeerResultMessage,
-                           NULL),
+                           t),
+    GNUNET_MQ_hd_var_size (dht_p2p_hello,
+                           GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO,
+                           struct GNUNET_MessageHeader,
+                           t),
    GNUNET_MQ_handler_end ()
  };
+  const struct GNUNET_MessageHeader *mh = message;
+  (void) cls; /* the 'struct GDS_Underlay' */
+  (void) sctx; /* our receiver address */
+  if (NULL == t)
+  {
+    /* Received message claiming to originate from myself?
+       Ignore! */
+    GNUNET_break_op (0);
+    return;
+  }
+  if (message_size < sizeof (*mh))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (message_size != ntohs (mh->size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling message of type %u from peer %s\n",
+              ntohs (mh->type),
+              GNUNET_i2s (&t->pi->id));
+  if (GNUNET_OK !=
+      GNUNET_MQ_handle_message (core_handlers,
+                                mh))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+}
+/**
+ * Callback function used to extract URIs from a builder.
+ * Called when we should consider connecting to a peer.
+ *
+ * @param cls closure pointing to a `struct GNUNET_PeerIdentity *`
+ * @param uri one of the URIs
+ */
+void
+GDS_try_connect (void *cls,
+                 const char *uri)
+{
+  const struct GNUNET_PeerIdentity *pid = cls;
+  struct GNUNET_HashCode phash;
+  int peer_bucket;
+  struct PeerBucket *bucket;
+  if (0 == GNUNET_memcmp (&GDS_my_identity,
+                          pid))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got a HELLO for my own PID, ignoring it\n");
+    return; /* that's us! */
+  }
+  GNUNET_CRYPTO_hash (pid,
+                      sizeof(*pid),
+                      &phash);
+  peer_bucket = find_bucket (&phash);
+  GNUNET_assert ( (peer_bucket >= 0) &&
+                  ((unsigned int) peer_bucket < MAX_BUCKETS));
+  bucket = &k_buckets[peer_bucket];
+  if (bucket->peers_size >= bucket_size)
+    return; /* do not care */
+  for (struct PeerInfo *pi = bucket->head;
+       NULL != pi;
+       pi = pi->next)
+    if (0 ==
+        GNUNET_memcmp (&pi->id,
+                       pid))
+    {
+      /* already connected */
+      /* TODO: maybe consider 'uri' anyway as an additional
+         alternative address??? */
+      return;
+    }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Discovered peer %s at %s suitable for bucket %d (%u/%u), trying to connect\n",
+              GNUNET_i2s (pid),
+              uri,
+              peer_bucket,
+              bucket->peers_size,
+              bucket_size);
+  /* new peer that we like! */
+  GDS_u_try_connect (pid,
+                     uri);
+}
+/**
+ * Send @a msg to all peers in our buckets.
+ *
+ * @param msg message to broadcast
+ */
+void
+GDS_NEIGHBOURS_broadcast (const struct GNUNET_MessageHeader *msg)
+{
+  for (unsigned int bc = 0; bc<closest_bucket; bc++)
+  {
+    struct PeerBucket *bucket = &k_buckets[bc];
+    unsigned int count = 0;
+    for (struct PeerInfo *pos = bucket->head;
+         NULL != pos;
+         pos = pos->next)
+    {
+      if (count >= bucket_size)
+        break;   /* we only consider first #bucket_size entries per bucket */
+      count++;
+      do_send (pos,
+               msg);
+    }
+  }
+}
+enum GNUNET_GenericReturnValue
+GDS_NEIGHBOURS_init ()
+{
  unsigned long long temp_config_num;
  disable_try_connect
@@ -2457,45 +2678,8 @@ GDS_NEIGHBOURS_init ()
    = GNUNET_CONFIGURATION_get_value_yesno (GDS_cfg,
                                            "DHT",
                                            "CACHE_RESULTS");
-  {
-    char *keyfile;
-    if (GNUNET_OK !=
-        GNUNET_CONFIGURATION_get_value_filename (GDS_cfg,
-                                                 "PEER",
-                                                 "PRIVATE_KEY",
-                                                 &keyfile))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Core service is lacking HOSTKEY configuration setting.  Exiting.\n");
-      return GNUNET_SYSERR;
-    }
-    if (GNUNET_SYSERR ==
-        GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
-                                           GNUNET_YES,
-                                           &my_private_key))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Failed to setup peer's private key\n");
-      GNUNET_free (keyfile);
-      return GNUNET_SYSERR;
-    }
-    GNUNET_free (keyfile);
-  }
-  ats_ch = GNUNET_ATS_connectivity_init (GDS_cfg);
-  core_api = GNUNET_CORE_connect (GDS_cfg,
-                                  NULL,
-                                  &core_init,
-                                  &handle_core_connect,
-                                  &handle_core_disconnect,
-                                  core_handlers);
-  if (NULL == core_api)
-    return GNUNET_SYSERR;
  all_connected_peers = GNUNET_CONTAINER_multipeermap_create (256,
                                                              GNUNET_YES);
-  all_desired_peers = GNUNET_CONTAINER_multipeermap_create (256,
-                                                            GNUNET_NO);
  return GNUNET_OK;
 }
@@ -2503,21 +2687,12 @@ GDS_NEIGHBOURS_init ()
 void
 GDS_NEIGHBOURS_done ()
 {
-  if (NULL == core_api)
+  if (NULL == all_connected_peers)
    return;
-  GNUNET_CORE_disconnect (core_api);
-  core_api = NULL;
  GNUNET_assert (0 ==
                 GNUNET_CONTAINER_multipeermap_size (all_connected_peers));
  GNUNET_CONTAINER_multipeermap_destroy (all_connected_peers);
  all_connected_peers = NULL;
-  GNUNET_CONTAINER_multipeermap_iterate (all_desired_peers,
-                                         &free_connect_info,
-                                         NULL);
-  GNUNET_CONTAINER_multipeermap_destroy (all_desired_peers);
-  all_desired_peers = NULL;
-  GNUNET_ATS_connectivity_done (ats_ch);
-  ats_ch = NULL;
  GNUNET_assert (NULL == find_peer_task);
 }
@@ -2525,7 +2700,7 @@ GDS_NEIGHBOURS_done ()
 struct GNUNET_PeerIdentity *
 GDS_NEIGHBOURS_get_id ()
 {
-  return &my_identity;
+  return &GDS_my_identity;
 }
diff --git a/src/dht/gnunet-service-dht_neighbours.h b/src/dht/gnunet-service-dht_neighbours.h
index 35bbb125d..4f4172f71 100644
--- a/src/dht/gnunet-service-dht_neighbours.h
+++ b/src/dht/gnunet-service-dht_neighbours.h
@@ -30,13 +30,9 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_dht_service.h"
+#include "gnunet_dhtu_plugin.h"
 #include "gnunet-service-dht_datacache.h"
-/**
- * Hash of the identity of this peer.
- */
-extern struct GNUNET_HashCode my_identity_hash;
 struct PeerInfo;
@@ -67,8 +63,8 @@ GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target);
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                           enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
+                           uint16_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t hop_count,
                           struct GNUNET_CONTAINER_BloomFilter *bf);
@@ -92,8 +88,8 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                           enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
+                           uint16_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t hop_count,
                           const struct GNUNET_HashCode *key,
                           const void *xquery,
                           size_t xquery_size,
@@ -112,8 +108,9 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
 * @param query_hash query that was used for the request
 * @param get_path_length number of entries in put_path
 * @param get_path peers this reply has traversed so far (if tracked)
+ * @return true on success
 */
-void
+bool
 GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
                             const struct GDS_DATACACHE_BlockData *bd,
                             const struct GNUNET_HashCode *query_hash,
@@ -137,6 +134,73 @@ GDS_am_closest_peer (const struct GNUNET_HashCode *key,
 /**
+ * Callback function used to extract URIs from a builder.
+ * Called when we should consider connecting to a peer.
+ *
+ * @param cls closure pointing to a `struct GNUNET_PeerIdentity *`
+ * @param uri one of the URIs
+ */
+void
+GDS_try_connect (void *cls,
+                 const char *uri);
+/**
+ * Function to call when we connect to a peer and can henceforth transmit to
+ * that peer.
+ *
+ * @param cls the closure, must be a `struct GDS_Underlay`
+ * @param target handle to the target,
+ *    pointer will remain valid until @e disconnect_cb is called
+ * @para pid peer identity,
+ *    pointer will remain valid until @e disconnect_cb is called
+ * @param[out] ctx storage space for DHT to use in association with this target
+ */
+void
+GDS_u_connect (void *cls,
+               struct GNUNET_DHTU_Target *target,
+               const struct GNUNET_PeerIdentity *pid,
+               void **ctx);
+/**
+ * Function to call when we disconnected from a peer and can henceforth
+ * cannot transmit to that peer anymore.
+ *
+ * @param[in] ctx storage space used by the DHT in association with this target
+ */
+void
+GDS_u_disconnect (void *ctx);
+/**
+ * Function to call when we receive a message.
+ *
+ * @param cls the closure
+ * @param origin where the message originated from
+ * @param[in,out] tctx ctx of target address where we received the message from
+ * @param[in,out] sctx ctx of our own source address at which we received the message
+ * @param message the message we received @param message_size number of
+ * bytes in @a message
+ */
+void
+GDS_u_receive (void *cls,
+               void **tctx,
+               void **sctx,
+               const void *message,
+               size_t message_size);
+/**
+ * Send @a msg to all peers in our buckets.
+ *
+ * @param msg message to broadcast
+ */
+void
+GDS_NEIGHBOURS_broadcast (const struct GNUNET_MessageHeader *msg);
+/**
 * Initialize neighbours subsystem.
 *
 * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
diff --git a/src/dht/gnunet-service-dht_nse.c b/src/dht/gnunet-service-dht_nse.c
deleted file mode 100644
index 58f18816a..000000000
--- a/src/dht/gnunet-service-dht_nse.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file dht/gnunet-service-dht_nse.c
- * @brief GNUnet DHT integration with NSE
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_nse_service.h"
-#include "gnunet-service-dht.h"
-#include "gnunet-service-dht_nse.h"
-/**
- * log of the current network size estimate, used as the point where
- * we switch between random and deterministic routing.  Default
- * value of 4.0 is used if NSE module is not available (i.e. not
- * configured).
- */
-static double log_of_network_size_estimate = 4.0;
-/**
- * Network size estimation handle.
- */
-static struct GNUNET_NSE_Handle *nse;
-/**
- * Callback that is called when network size estimate is updated.
- *
- * @param cls closure
- * @param timestamp time when the estimate was received from the server (or created by the server)
- * @param logestimate the log(Base 2) value of the current network size estimate
- * @param std_dev standard deviation for the estimate
- *
- */
-static void
-update_network_size_estimate (void *cls,
-                              struct GNUNET_TIME_Absolute timestamp,
-                              double logestimate,
-                              double std_dev)
-{
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# Network size estimates received",
-                            1, GNUNET_NO);
-  /* do not allow estimates < 0.5 */
-  log_of_network_size_estimate = GNUNET_MAX (0.5, logestimate);
-}
-/**
- * Return the log of the current network size estimate.
- *
- * @return log of NSE
- */
-double
-GDS_NSE_get ()
-{
-  return log_of_network_size_estimate;
-}
-/**
- * Initialize NSE subsystem.
- */
-void
-GDS_NSE_init ()
-{
-  unsigned long long hops;
-  if ( (GNUNET_YES ==
-        GNUNET_CONFIGURATION_have_value (GDS_cfg,
-                                         "dht",
-                                         "FORCE_NSE")) &&
-       (GNUNET_OK ==
-        GNUNET_CONFIGURATION_get_value_number (GDS_cfg,
-                                               "dht",
-                                               "FORCE_NSE",
-                                               &hops)) )
-  {
-    log_of_network_size_estimate = (double) hops;
-    return;
-  }
-  nse = GNUNET_NSE_connect (GDS_cfg,
-                            &update_network_size_estimate,
-                            NULL);
-}
-/**
- * Shutdown NSE subsystem.
- */
-void
-GDS_NSE_done ()
-{
-  if (NULL != nse)
-  {
-    GNUNET_NSE_disconnect (nse);
-    nse = NULL;
-  }
-}
-/* end of gnunet-service-dht_nse.c */
diff --git a/src/dht/gnunet-service-dht_nse.h b/src/dht/gnunet-service-dht_nse.h
deleted file mode 100644
index e99389e74..000000000
--- a/src/dht/gnunet-service-dht_nse.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file dht/gnunet-service-dht_nse.h
- * @brief GNUnet DHT integration with NSE
- * @author Christian Grothoff
- */
-#ifndef GNUNET_SERVICE_DHT_NSE_H
-#define GNUNET_SERVICE_DHT_NSE_H
-/**
- * Return the log of the current network size estimate.
- *
- * @return log of NSE
- */
-double
-GDS_NSE_get (void);
-/**
- * Initialize NSE subsystem.
- */
-void
-GDS_NSE_init (void);
-/**
- * Shutdown NSE subsystem.
- */
-void
-GDS_NSE_done (void);
-#endif
diff --git a/src/dht/gnunet-service-dht_routing.c b/src/dht/gnunet-service-dht_routing.c
index e7b5c3571..6deb5fa16 100644
--- a/src/dht/gnunet-service-dht_routing.c
+++ b/src/dht/gnunet-service-dht_routing.c
@@ -27,6 +27,7 @@
 #include "gnunet-service-dht_neighbours.h"
 #include "gnunet-service-dht_routing.h"
 #include "gnunet-service-dht.h"
+#include "gnunet_block_group_lib.h"
 /**
@@ -151,7 +152,7 @@ process (void *cls,
    bdx.put_path_length = 0;
    bdx.put_path = NULL;
  }
-  if ( (0 == (rr->options & GNUNET_DHT_RO_FIND_PEER)) &&
+  if ( (0 == (rr->options & GNUNET_DHT_RO_FIND_APPROXIMATE)) &&
       (0 != GNUNET_memcmp (query_hash,
                            &bdx.key)) )
  {
@@ -174,6 +175,22 @@ process (void *cls,
              GNUNET_h2s (&bdx.key),
              bdx.type,
              eval);
+  if (GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED == eval)
+  {
+    /* If we do not know the block type, we still filter
+       exact duplicates by the block content */
+    struct GNUNET_HashCode chash;
+    
+    GNUNET_CRYPTO_hash (bdx.data,
+                        bdx.data_size,
+                        &chash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (rr->bg,
+                                            &chash))
+      eval = GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    else
+      eval = GNUNET_BLOCK_REPLY_OK_MORE;
+  }
  switch (eval)
  {
  case GNUNET_BLOCK_REPLY_OK_MORE:
@@ -195,10 +212,11 @@ process (void *cls,
                    GNUNET_h2s (query_hash));
        return GNUNET_OK;
      }
-      GDS_NEIGHBOURS_handle_reply (pi,
+      GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
-                                   &bdx,
+                                                 &bdx,
-                                   query_hash,
+                                                 query_hash,
-                                   get_path_length, pc->get_path);
+                                                 get_path_length,
+                                                 pc->get_path));
    }
    break;
  case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
@@ -207,13 +225,6 @@ process (void *cls,
                              1,
                              GNUNET_NO);
    return GNUNET_OK;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    GNUNET_break (0);
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# Invalid REPLIES matched against routing table",
-                              1,
-                              GNUNET_NO);
-    return GNUNET_OK;
  case GNUNET_BLOCK_REPLY_IRRELEVANT:
    GNUNET_STATISTICS_update (GDS_stats,
                              "# Irrelevant REPLIES matched against routing table",
@@ -325,6 +336,7 @@ try_combine_recent (void *cls,
 *
 * @param sender peer that originated the request
 * @param type type of the block
+ * @param[in] bg block group for filtering duplicate replies
 * @param options options for processing
 * @param key key for the content
 * @param xquery extended query
diff --git a/src/dht/plugin_block_dht.c b/src/dht/plugin_block_dht.c
index 7c6fb9ed6..3dd3dd792 100644
--- a/src/dht/plugin_block_dht.c
+++ b/src/dht/plugin_block_dht.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2010, 2017 GNUnet e.V.
+     Copyright (C) 2010, 2017, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -28,6 +28,7 @@
 #include "platform.h"
 #include "gnunet_constants.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet_block_plugin.h"
 #include "gnunet_block_group_lib.h"
@@ -89,80 +90,9 @@ block_plugin_dht_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to check against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_dht_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *group,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-  struct GNUNET_HashCode phash;
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (reply_block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  msg = reply_block;
-  if (reply_block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  hello = reply_block;
-  if (GNUNET_OK != GNUNET_HELLO_get_id (hello, &pid))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (&pid,
-                      sizeof(pid),
-                      &phash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &phash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
- * @param ctx block context
 * @param type block type
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
@@ -171,19 +101,31 @@ block_plugin_dht_evaluate (void *cls,
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_dht_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                              enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                              const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                              const void *xquery,
-                                    size_t xquery_size)
+                              size_t xquery_size)
 {
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
+  switch (type)
-    return GNUNET_SYSERR;
-  if (0 != xquery_size)
  {
-    GNUNET_break_op (0);
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    return GNUNET_NO;
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
  }
-  return GNUNET_OK;
 }
@@ -192,44 +134,71 @@ block_plugin_dht_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_dht_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                              enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                              const void *block,
-                                    const void *block,
+                              size_t block_size)
-                                    size_t block_size)
 {
-  const struct GNUNET_HELLO_Message *hello;
+  switch (type)
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_SYSERR;
-  if (block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  msg = block;
-  if (block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  hello = block;
-  if (GNUNET_OK !=
-      GNUNET_HELLO_get_id (hello,
-                           &pid))
  {
-    GNUNET_break_op (0);
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    return GNUNET_NO;
+    {
+      const struct GNUNET_HELLO_Message *hello;
+      struct GNUNET_PeerIdentity pid;
+      const struct GNUNET_MessageHeader *msg;
+      if (block_size < sizeof(struct GNUNET_MessageHeader))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      msg = block;
+      if (block_size != ntohs (msg->size))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      hello = block;
+      if (GNUNET_OK !=
+          GNUNET_HELLO_get_id (hello,
+                               &pid))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      return GNUNET_OK;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode h_pid;
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        return GNUNET_NO;
+      }
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
  }
-  return GNUNET_OK;
 }
@@ -251,49 +220,63 @@ block_plugin_dht_check_block (void *cls,
 */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_dht_check_reply (
-                                        void *cls,
+  void *cls,
-                                        enum GNUNET_BLOCK_Type type,
+  enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
+  struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
+  const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+  const void *xquery,
-                                    size_t xquery_size,
+  size_t xquery_size,
-                                    const void *reply_block,
+  const void *reply_block,
-                                    size_t reply_block_size)
+  size_t reply_block_size)
 {
-  const struct GNUNET_HELLO_Message *hello;
+  switch (type)
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-  struct GNUNET_HashCode phash;
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  if (reply_block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  msg = reply_block;
-  if (reply_block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  hello = reply_block;
-  if (GNUNET_OK !=
-      GNUNET_HELLO_get_id (hello,
-                           &pid))
  {
-    GNUNET_break_op (0);
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    return GNUNET_BLOCK_REPLY_INVALID;
+    {
+      const struct GNUNET_MessageHeader *msg = reply_block;
+      const struct GNUNET_HELLO_Message *hello = reply_block;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode phash;
+      GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_MessageHeader));
+      GNUNET_assert (reply_block_size == ntohs (msg->size));
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_HELLO_get_id (hello,
+                                          &pid));
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof(pid),
+                          &phash);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &phash))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode h_pid;
+      b = GNUNET_HELLO_builder_from_block (reply_block,
+                                           reply_block_size);
+      GNUNET_assert (NULL != b);
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &h_pid))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
  }
-  GNUNET_CRYPTO_hash (&pid,
-                      sizeof(pid),
-                      &phash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &phash))
-    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-  return GNUNET_BLOCK_REPLY_OK_MORE;
 }
@@ -315,41 +298,76 @@ block_plugin_dht_get_key (void *cls,
                          size_t block_size,
                          struct GNUNET_HashCode *key)
 {
-  const struct GNUNET_MessageHeader *msg;
+  switch (type)
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity *pid;
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_SYSERR;
-  if (block_size < sizeof(struct GNUNET_MessageHeader))
  {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-                     "block-dht",
+    {
-                     _ ("Block not of type %u\n"),
+      const struct GNUNET_MessageHeader *msg;
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
+      const struct GNUNET_HELLO_Message *hello;
-    return GNUNET_NO;
+      struct GNUNET_PeerIdentity *pid;
-  }
-  msg = block;
+      if (block_size < sizeof(struct GNUNET_MessageHeader))
-  if (block_size != ntohs (msg->size))
+      {
-  {
+        GNUNET_break_op (0);
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+        memset (key,
-                     "block-dht",
+                0,
-                     _ ("Size mismatch for block with type %u\n"),
+                sizeof (*key));
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
+        return GNUNET_OK;
-    return GNUNET_NO;
+      }
-  }
+      msg = block;
-  hello = block;
+      if (block_size != ntohs (msg->size))
-  memset (key, 0, sizeof(*key));
+      {
-  pid = (struct GNUNET_PeerIdentity *) key;
+        GNUNET_break_op (0);
-  if (GNUNET_OK != GNUNET_HELLO_get_id (hello, pid))
+        memset (key,
-  {
+                0,
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                sizeof (*key));
-                     "block-dht",
+        return GNUNET_OK;
-                     _ ("Block of type %u is malformed\n"),
+      }
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
+      hello = block;
-    return GNUNET_NO;
+      memset (key,
+              0,
+              sizeof(*key));
+      pid = (struct GNUNET_PeerIdentity *) key;
+      if (GNUNET_OK !=
+          GNUNET_HELLO_get_id (hello,
+                               pid))
+      {
+        GNUNET_break_op (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      return GNUNET_OK;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          key);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
  }
-  return GNUNET_OK;
 }
@@ -361,12 +379,12 @@ libgnunet_plugin_block_dht_init (void *cls)
 {
  static enum GNUNET_BLOCK_Type types[] = {
    GNUNET_BLOCK_TYPE_DHT_HELLO,
+    GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
    GNUNET_BLOCK_TYPE_ANY       /* end of list */
  };
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_dht_evaluate;
  api->get_key = &block_plugin_dht_get_key;
  api->check_query = &block_plugin_dht_check_query;
  api->check_block = &block_plugin_dht_check_block;
diff --git a/src/dht/test_dht_topo.c b/src/dht/test_dht_topo.c
index eb7e80d3b..4830ba629 100644
--- a/src/dht/test_dht_topo.c
+++ b/src/dht/test_dht_topo.c
@@ -326,7 +326,7 @@ timeout_cb (void *cls)
 *
 * @param cls closure with our 'struct GetOperation'
 * @param exp when will this value expire
- * @param key key of the result
+ * @param query query hash
 * @param get_path peers on reply path (or NULL if not recorded)
 * @param get_path_length number of entries in @a get_path
 * @param put_path peers on the PUT path (or NULL if not recorded)
@@ -338,7 +338,7 @@ timeout_cb (void *cls)
 static void
 dht_get_handler (void *cls,
                 struct GNUNET_TIME_Absolute exp,
-                 const struct GNUNET_HashCode *key,
+                 const struct GNUNET_HashCode *query,
                 const struct GNUNET_DHT_PathElement *get_path,
                 unsigned int get_path_length,
                 const struct GNUNET_DHT_PathElement *put_path,
@@ -359,8 +359,15 @@ dht_get_handler (void *cls,
    GNUNET_break (0);
    return;
  }
-  GNUNET_CRYPTO_hash (key,
+  if (0 != GNUNET_memcmp (query,
-                      sizeof(*key),
+                          &get_op->key))
+  {
+    /* exact search should only yield exact results */
+    GNUNET_break (0);
+    return;
+  }
+  GNUNET_CRYPTO_hash (query,
+                      sizeof(*query),
                      &want);
  if (0 != memcmp (&want,
                   data,
@@ -370,18 +377,21 @@ dht_get_handler (void *cls,
    return;
  }
  if (0 !=
-      GNUNET_DHT_verify_path (key,
+      GNUNET_DHT_verify_path (data,
-                              data,
                              size,
                              exp,
-                              get_path,
-                              get_path_length,
                              put_path,
                              put_path_length,
+                              get_path,
+                              get_path_length,
                              &get_op->me))
  {
+    GNUNET_break (0);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Path signature verification failed!\n");
+                "Path signature (%u/%u) verification failed for peer %s!\n",
+                get_path_length,
+                put_path_length,
+                GNUNET_i2s (&get_op->me));
  }
  else
  {
diff --git a/src/dhtu/Makefile.am b/src/dhtu/Makefile.am
index 0e10721cd..ebffa9ecf 100644
--- a/src/dhtu/Makefile.am
+++ b/src/dhtu/Makefile.am
@@ -10,6 +10,10 @@ if USE_COVERAGE
  XLIBS = -lgcov
 endif
+pkgcfg_DATA = \
+  dhtu.conf
 plugin_LTLIBRARIES = \
  libgnunet_plugin_dhtu_gnunet.la \
  libgnunet_plugin_dhtu_ip.la
@@ -67,6 +71,9 @@ test_dhtu_ip_LDADD = \
 check_PROGRAMS = \
 test_dhtu_ip
+EXTRA_DIST = \
+  dhtu.conf
 if ENABLE_TEST_RUN
 AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
 TESTS = \
diff --git a/src/dhtu/dhtu.conf b/src/dhtu/dhtu.conf
new file mode 100644
index 000000000..ea5ade752
--- /dev/null
+++ b/src/dhtu/dhtu.conf
@@ -0,0 +1,7 @@
+[dhtu-gnunet]
+ENABLED = YES
+[dhtu-ip]
+ENABLED = NO
+NSE = 4
+UDP_PORT = 6666
diff --git a/src/dhtu/plugin_dhtu_gnunet.c b/src/dhtu/plugin_dhtu_gnunet.c
index 2163af941..b072be2be 100644
--- a/src/dhtu/plugin_dhtu_gnunet.c
+++ b/src/dhtu/plugin_dhtu_gnunet.c
@@ -70,11 +70,6 @@ struct GNUNET_DHTU_Source
 {
  /**
-   * Hash of @e pid, position of this peer in the DHT overlay.
-   */
-  struct GNUNET_DHTU_HashKey id;
-  /**
   * Application context for this source.
   */
  void *app_ctx;
@@ -125,11 +120,6 @@ struct GNUNET_DHTU_Target
  struct GNUNET_PeerIdentity pid;
  /**
-   * Hash of @e pid, position of this peer in the DHT overlay.
-   */
-  struct GNUNET_DHTU_HashKey id;
-  /**
   * Preference counter, length of the @a ph_head DLL.
   */
  unsigned int ph_count;
@@ -240,27 +230,26 @@ hello_offered_cb (void *cls)
 * Request creation of a session with a peer at the given @a address.
 *
 * @param cls closure (internal context for the plugin)
+ * @param pid target identity of the peer to connect to
 * @param address target address to connect to
 */
 static void
-ip_try_connect (void *cls,
+gnunet_try_connect (void *cls,
-                const char *address)
+                    const struct GNUNET_PeerIdentity *pid,
+                    const char *address)
 {
  struct Plugin *plugin = cls;
  struct GNUNET_HELLO_Message *hello = NULL;
  struct HelloHandle *hh;
  struct GNUNET_CRYPTO_EddsaPublicKey pubkey;
+  (void) pid; /* will be needed with future address URIs */
  if (GNUNET_OK !=
      GNUNET_HELLO_parse_uri (address,
                              &pubkey,
                              &hello,
                              &GPI_plugins_find))
-  {
-    GNUNET_break (0);
    return;
-  }
  hh = GNUNET_new (struct HelloHandle);
  hh->plugin = plugin;
  GNUNET_CONTAINER_DLL_insert (plugin->hh_head,
@@ -283,8 +272,8 @@ ip_try_connect (void *cls,
 * @param target connection to keep alive
 */
 static struct GNUNET_DHTU_PreferenceHandle *
-ip_hold (void *cls,
+gnunet_hold (void *cls,
-         struct GNUNET_DHTU_Target *target)
+             struct GNUNET_DHTU_Target *target)
 {
  struct Plugin *plugin = cls;
  struct GNUNET_DHTU_PreferenceHandle *ph;
@@ -312,7 +301,7 @@ ip_hold (void *cls,
 * @param target connection to keep alive
 */
 static void
-ip_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
+gnunet_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
 {
  struct GNUNET_DHTU_Target *target = ph->target;
  struct Plugin *plugin = target->plugin;
@@ -350,12 +339,12 @@ ip_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
 * @param finished_cb_cls closure for @a finished_cb
 */
 static void
-ip_send (void *cls,
+gnunet_send (void *cls,
-         struct GNUNET_DHTU_Target *target,
+             struct GNUNET_DHTU_Target *target,
-         const void *msg,
+             const void *msg,
-         size_t msg_size,
+             size_t msg_size,
-         GNUNET_SCHEDULER_TaskCallback finished_cb,
+             GNUNET_SCHEDULER_TaskCallback finished_cb,
-         void *finished_cb_cls)
+             void *finished_cb_cls)
 {
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_MessageHeader *cmsg;
@@ -394,12 +383,9 @@ core_connect_cb (void *cls,
  target->plugin = plugin;
  target->mq = mq;
  target->pid = *peer;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof (*peer),
-                      &target->id.sha512);
  plugin->env->connect_cb (plugin->env->cls,
                           target,
-                           &target->id,
+                           &target->pid,
                           &target->app_ctx);
  return target;
 }
@@ -461,11 +447,7 @@ peerinfo_cb (void *cls,
                                   &GPI_plugins_find);
  if (NULL == addr)
    return;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof (*peer),
-                      &plugin->src.id.sha512);
  plugin->env->address_add_cb (plugin->env->cls,
-                               &plugin->src.id,
                               addr,
                               &plugin->src,
                               &plugin->src.app_ctx);
@@ -584,6 +566,10 @@ libgnunet_plugin_dhtu_gnunet_done (void *cls)
  }
  if (NULL != plugin->nse)
    GNUNET_NSE_disconnect (plugin->nse);
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
  if (NULL != plugin->core)
    GNUNET_CORE_disconnect (plugin->core);
  if (NULL != plugin->ats)
@@ -604,7 +590,7 @@ libgnunet_plugin_dhtu_gnunet_done (void *cls)
 * @return the plugin's API
 */
 void *
-libgnunet_plugin_dhtu_ip_init (void *cls)
+libgnunet_plugin_dhtu_gnunet_init (void *cls)
 {
  struct GNUNET_DHTU_PluginEnvironment *env = cls;
  struct GNUNET_DHTU_PluginFunctions *api;
@@ -621,10 +607,10 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
  plugin->env = env;
  api = GNUNET_new (struct GNUNET_DHTU_PluginFunctions);
  api->cls = plugin;
-  api->try_connect = &ip_try_connect;
+  api->try_connect = &gnunet_try_connect;
-  api->hold = &ip_hold;
+  api->hold = &gnunet_hold;
-  api->drop = &ip_drop;
+  api->drop = &gnunet_drop;
-  api->send = &ip_send;
+  api->send = &gnunet_send;
  plugin->ats = GNUNET_ATS_connectivity_init (env->cfg);
  plugin->core = GNUNET_CORE_connect (env->cfg,
                                      plugin,
@@ -640,6 +626,7 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
       (NULL == plugin->nse) )
  {
    GNUNET_break (0);
+    GNUNET_free (api);
    libgnunet_plugin_dhtu_gnunet_done (plugin);
    return NULL;
  }
diff --git a/src/dhtu/plugin_dhtu_ip.c b/src/dhtu/plugin_dhtu_ip.c
index 8eec6294b..612d2c119 100644
--- a/src/dhtu/plugin_dhtu_ip.c
+++ b/src/dhtu/plugin_dhtu_ip.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2021 GNUnet e.V.
+     Copyright (C) 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -56,17 +56,12 @@ struct GNUNET_DHTU_Source
  struct GNUNET_DHTU_Source *prev;
  /**
-   * Position of this peer in the DHT.
-   */
-  struct GNUNET_DHTU_HashKey id;
-  /**
   * Application context for this source.
   */
  void *app_ctx;
  /**
-   * Address in URL form ("ip+udp://$IP:$PORT")
+   * Address in URL form ("ip+udp://$PID/$IP:$PORT")
   */
  char *address;
@@ -121,9 +116,9 @@ struct GNUNET_DHTU_Target
  struct GNUNET_DHTU_PreferenceHandle *ph_tail;
  /**
-   * Position of this peer in the DHT.
+   * Peer's identity.
   */
-  struct GNUNET_DHTU_HashKey id;
+  struct GNUNET_PeerIdentity pid;
  /**
   * Target IP address.
@@ -217,14 +212,24 @@ struct Plugin
  char *port;
  /**
+   * My UDP socket.
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+  /**
+   * My identity.
+   */
+  struct GNUNET_PeerIdentity my_id;
+  /**
   * How often have we scanned for IPs?
   */
  unsigned int scan_generation;
  /**
-   * My UDP socket.
+   * Port as a 16-bit value.
   */
-  struct GNUNET_NETWORK_Handle *sock;
+  uint16_t port16;
 };
@@ -232,18 +237,20 @@ struct Plugin
 * Create a target to which we may send traffic.
 *
 * @param plugin our plugin
+ * @param pid presumed identity of the target
 * @param addr target address
 * @param addrlen number of bytes in @a addr
 * @return new target object
 */
 static struct GNUNET_DHTU_Target *
 create_target (struct Plugin *plugin,
+               const struct GNUNET_PeerIdentity *pid,
               const struct sockaddr *addr,
               socklen_t addrlen)
 {
  struct GNUNET_DHTU_Target *dst;
-  if (MAX_DESTS >
+  if (MAX_DESTS <=
      GNUNET_CONTAINER_multihashmap_size (plugin->dsts))
  {
    struct GNUNET_HashCode key;
@@ -275,42 +282,16 @@ create_target (struct Plugin *plugin,
  }
  dst = GNUNET_new (struct GNUNET_DHTU_Target);
  dst->addrlen = addrlen;
+  dst->pid = *pid;
  memcpy (&dst->addr,
          addr,
          addrlen);
-  switch (addr->sa_family)
-  {
-  case AF_INET:
-    {
-      const struct sockaddr_in *s4 = (const struct sockaddr_in *) addr;
-      GNUNET_assert (sizeof (struct sockaddr_in) == addrlen);
-      GNUNET_CRYPTO_hash (&s4->sin_addr,
-                          sizeof (struct in_addr),
-                          &dst->id.sha512);
-    }
-    break;
-  case AF_INET6:
-    {
-      const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *) addr;
-      GNUNET_assert (sizeof (struct sockaddr_in6) == addrlen);
-      GNUNET_CRYPTO_hash (&s6->sin6_addr,
-                          sizeof (struct in6_addr),
-                          &dst->id.sha512);
-    }
-    break;
-  default:
-    GNUNET_break (0);
-    GNUNET_free (dst);
-    return NULL;
-  }
  GNUNET_CONTAINER_DLL_insert (plugin->dst_head,
                               plugin->dst_tail,
                               dst);
  plugin->env->connect_cb (plugin->env->cls,
                           dst,
-                           &dst->id,
+                           &dst->pid,
                           &dst->app_ctx);
  return dst;
 }
@@ -321,6 +302,7 @@ create_target (struct Plugin *plugin,
 * create one!
 *
 * @param plugin the plugin handle
+ * @param pid presumed identity of the target
 * @param src source target is from, or NULL if unknown
 * @param addr socket address to find
 * @param addrlen number of bytes in @a addr
@@ -328,6 +310,7 @@ create_target (struct Plugin *plugin,
 */
 static struct GNUNET_DHTU_Target *
 find_target (struct Plugin *plugin,
+             const struct GNUNET_PeerIdentity *pid,
             const void *addr,
             size_t addrlen)
 {
@@ -342,6 +325,7 @@ find_target (struct Plugin *plugin,
  if (NULL == dst)
  {
    dst = create_target (plugin,
+                         pid,
                         (const struct sockaddr *) addr,
                         addrlen);
    GNUNET_assert (GNUNET_YES ==
@@ -370,10 +354,12 @@ find_target (struct Plugin *plugin,
 * Request creation of a session with a peer at the given @a address.
 *
 * @param cls closure (internal context for the plugin)
+ * @param pid identity of the target peer
 * @param address target address to connect to
 */
 static void
 ip_try_connect (void *cls,
+                const struct GNUNET_PeerIdentity *pid,
                const char *address)
 {
  struct Plugin *plugin = cls;
@@ -389,19 +375,13 @@ ip_try_connect (void *cls,
      strncmp (address,
               "ip+",
               strlen ("ip+")))
-  {
-    GNUNET_break (0);
    return;
-  }
  address += strlen ("ip+");
  if (0 !=
      strncmp (address,
               "udp://",
               strlen ("udp://")))
-  {
-    GNUNET_break (0);
    return;
-  }
  address += strlen ("udp://");
  addr = GNUNET_strdup (address);
  colon = strchr (addr, ':');
@@ -426,6 +406,7 @@ ip_try_connect (void *cls,
  }
  GNUNET_free (addr);
  (void) find_target (plugin,
+                      pid,
                      result->ai_addr,
                      result->ai_addrlen);
  freeaddrinfo (result);
@@ -499,10 +480,17 @@ ip_send (void *cls,
         void *finished_cb_cls)
 {
  struct Plugin *plugin = cls;
+  char buf[sizeof (plugin->my_id) + msg_size];
+  memcpy (buf,
+          &plugin->my_id,
+          sizeof (plugin->my_id));
+  memcpy (&buf[sizeof (plugin->my_id)],
+          msg,
+          msg_size);
  GNUNET_NETWORK_socket_sendto (plugin->sock,
-                                msg,
+                                buf,
-                                msg_size,
+                                sizeof (buf),
                                (const struct sockaddr *) &target->addr,
                                target->addrlen);
  finished_cb (finished_cb_cls);
@@ -538,9 +526,6 @@ create_source (struct Plugin *plugin,
      char buf[INET_ADDRSTRLEN];
      GNUNET_assert (sizeof (struct sockaddr_in) == addrlen);
-      GNUNET_CRYPTO_hash (&s4->sin_addr,
-                          sizeof (struct in_addr),
-                          &src->id.sha512);
      GNUNET_asprintf (&src->address,
                       "ip+udp://%s:%u",
                       inet_ntop (AF_INET,
@@ -556,9 +541,6 @@ create_source (struct Plugin *plugin,
      char buf[INET6_ADDRSTRLEN];
      GNUNET_assert (sizeof (struct sockaddr_in6) == addrlen);
-      GNUNET_CRYPTO_hash (&s6->sin6_addr,
-                          sizeof (struct in6_addr),
-                          &src->id.sha512);
      GNUNET_asprintf (&src->address,
                       "ip+udp://[%s]:%u",
                       inet_ntop (AF_INET6,
@@ -577,7 +559,6 @@ create_source (struct Plugin *plugin,
                               plugin->src_tail,
                               src);
  plugin->env->address_add_cb (plugin->env->cls,
-                               &src->id,
                               src->address,
                               src,
                               &src->app_ctx);
@@ -586,6 +567,101 @@ create_source (struct Plugin *plugin,
 /**
+ * Compare two addresses excluding the ports for equality. Only compares IP
+ * address. Must only be called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp_np (const struct sockaddr *a1,
+            const struct sockaddr *a2,
+            size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+/**
+ * Compare two addresses for equality. Only
+ * compares IP address and port. Must only be
+ * called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp (const struct sockaddr *a1,
+         const struct sockaddr *a2,
+         size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+      if (s1->sin_port != s2->sin_port)
+        return 1;
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+      if (s1->sin6_port != s2->sin6_port)
+        return 1;
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+/**
 * Callback function invoked for each interface found.
 *
 * @param cls closure
@@ -597,7 +673,7 @@ create_source (struct Plugin *plugin,
 * @param addrlen length of the address
 * @return #GNUNET_OK to continue iteration, #GNUNET_SYSERR to abort
 */
-static int
+static enum GNUNET_GenericReturnValue
 process_ifcs (void *cls,
              const char *name,
              int isDefault,
@@ -614,17 +690,45 @@ process_ifcs (void *cls,
       src = src->next)
  {
    if ( (addrlen == src->addrlen) &&
-         (0 == memcmp (addr,
+         (0 == addrcmp_np (addr,
-                       &src->addr,
+                           (const struct sockaddr *) &src->addr,
-                       addrlen)) )
+                           addrlen)) )
    {
      src->scan_generation = plugin->scan_generation;
      return GNUNET_OK;
    }
  }
-  (void) create_source (plugin,
+  switch (addr->sa_family)
-                        addr,
+  {
-                        addrlen);
+  case AF_INET:
+    {
+      struct sockaddr_in v4;
+      GNUNET_assert (sizeof(v4) == addrlen);
+      memcpy (&v4,
+              addr,
+              addrlen);
+      v4.sin_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v4,
+                            sizeof (v4));
+      break;
+    }
+  case AF_INET6:
+    {
+      struct sockaddr_in6 v6;
+      GNUNET_assert (sizeof(v6) == addrlen);
+      memcpy (&v6,
+              addr,
+              addrlen);
+      v6.sin6_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v6,
+                            sizeof (v6));
+      break;
+    }
+  }
  return GNUNET_OK;
 }
@@ -648,7 +752,7 @@ scan (void *cls)
       src = next)
  {
    next = src->next;
-    if (src->scan_generation == plugin->scan_generation)
+    if (src->scan_generation >= plugin->scan_generation)
      continue;
    GNUNET_CONTAINER_DLL_remove (plugin->src_head,
                                 plugin->src_tail,
@@ -682,9 +786,9 @@ find_source (struct Plugin *plugin,
       src = src->next)
  {
    if ( (addrlen == src->addrlen) &&
-         (0 == memcmp (addr,
+         (0 == addrcmp (addr,
-                       &src->addr,
+                        (const struct sockaddr *) &src->addr,
-                       addrlen)) )
+                        addrlen)) )
      return src;
  }
@@ -704,7 +808,8 @@ read_cb (void *cls)
 {
  struct Plugin *plugin = cls;
  ssize_t ret;
-  char buf[65536];
+  const struct GNUNET_PeerIdentity *pid;
+  char buf[65536] GNUNET_ALIGN;
  struct sockaddr_storage sa;
  struct iovec iov = {
    .iov_base = buf,
@@ -719,98 +824,120 @@ read_cb (void *cls)
    .msg_control = ctl,
    .msg_controllen = sizeof (ctl)
  };
+  struct GNUNET_DHTU_Target *dst = NULL;
+  struct GNUNET_DHTU_Source *src = NULL;
  ret = recvmsg  (GNUNET_NETWORK_get_fd (plugin->sock),
                  &mh,
                  MSG_DONTWAIT);
-  if (ret >= 0)
+  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    plugin->sock,
+    &read_cb,
+    plugin);
+  if (ret < 0)
+    return; /* read failure, hopefully EAGAIN */
+  if (ret < sizeof (*pid))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  /* find IP where we received message */
+  for (struct cmsghdr *cmsg = CMSG_FIRSTHDR (&mh);
+       NULL != cmsg;
+       cmsg = CMSG_NXTHDR (&mh,
+                           cmsg))
  {
-    struct GNUNET_DHTU_Target *dst = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-    struct GNUNET_DHTU_Source *src = NULL;
+                "Got CMSG level %u (%d/%d), type %u (%d/%d)\n",
-    struct cmsghdr *cmsg;
+                cmsg->cmsg_level,
+                (cmsg->cmsg_level == IPPROTO_IP),
-    /* find IP where we received message */
+                (cmsg->cmsg_level == IPPROTO_IPV6),
-    for (cmsg = CMSG_FIRSTHDR (&mh);
+                cmsg->cmsg_type,
-         NULL != cmsg;
+                (cmsg->cmsg_type == IP_PKTINFO),
-         cmsg = CMSG_NXTHDR (&mh,
+                (cmsg->cmsg_type == IPV6_PKTINFO));
-                             cmsg))
+    if ( (cmsg->cmsg_level == IPPROTO_IP) &&
+         (cmsg->cmsg_type == IP_PKTINFO) )
    {
-      if ( (cmsg->cmsg_level == IPPROTO_IP) &&
+      if (CMSG_LEN (sizeof (struct in_pktinfo)) ==
-           (cmsg->cmsg_type == IP_PKTINFO) )
+          cmsg->cmsg_len)
      {
-        if (CMSG_LEN (sizeof (struct in_pktinfo)) ==
+        struct in_pktinfo pi;
-            cmsg->cmsg_len)
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
        {
-          struct in_pktinfo pi;
+          struct sockaddr_in sa = {
+            .sin_family = AF_INET,
-          memcpy (&pi,
+            .sin_addr = pi.ipi_addr,
-                  CMSG_DATA (cmsg),
+            .sin_port = htons (plugin->port16)
-                  sizeof (pi));
+          };
-          {
-            struct sockaddr_in sa = {
+          src = find_source (plugin,
-              .sin_family = AF_INET,
+                             &sa,
-              .sin_addr = pi.ipi_addr
+                             sizeof (sa));
-            };
+          /* For sources we discovered by reading,
+             force the generation far into the future */
-            src = find_source (plugin,
+          src->scan_generation = plugin->scan_generation + 60;
-                               &sa,
-                               sizeof (sa));
-          }
-          break;
        }
-        else
+        break;
-          GNUNET_break (0);
      }
-      if ( (cmsg->cmsg_level == IPPROTO_IPV6) &&
+      else
-           (cmsg->cmsg_type == IPV6_RECVPKTINFO) )
+        GNUNET_break (0);
+    }
+    if ( (cmsg->cmsg_level == IPPROTO_IPV6) &&
+         (cmsg->cmsg_type == IPV6_PKTINFO) )
+    {
+      if (CMSG_LEN (sizeof (struct in6_pktinfo)) ==
+          cmsg->cmsg_len)
      {
-        if (CMSG_LEN (sizeof (struct in6_pktinfo)) ==
+        struct in6_pktinfo pi;
-            cmsg->cmsg_len)
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
        {
-          struct in6_pktinfo pi;
+          struct sockaddr_in6 sa = {
+            .sin6_family = AF_INET6,
-          memcpy (&pi,
+            .sin6_addr = pi.ipi6_addr,
-                  CMSG_DATA (cmsg),
+            .sin6_port = htons (plugin->port16),
-                  sizeof (pi));
+            .sin6_scope_id = pi.ipi6_ifindex
-          {
+          };
-            struct sockaddr_in6 sa = {
-              .sin6_family = AF_INET6,
+          src = find_source (plugin,
-              .sin6_addr = pi.ipi6_addr,
+                             &sa,
-              .sin6_scope_id = pi.ipi6_ifindex
+                             sizeof (sa));
-            };
+          /* For sources we discovered by reading,
+             force the generation far into the future */
-            src = find_source (plugin,
+          src->scan_generation = plugin->scan_generation + 60;
-                               &sa,
+          break;
-                               sizeof (sa));
-            break;
-          }
        }
-        else
-          GNUNET_break (0);
      }
-    }
+      else
-    dst = find_target (plugin,
+        GNUNET_break (0);
-                       &sa,
-                       mh.msg_namelen);
-    if ( (NULL == src) ||
-         (NULL == dst) )
-    {
-      GNUNET_break (0);
-    }
-    else
-    {
-      plugin->env->receive_cb (plugin->env->cls,
-                               dst->app_ctx,
-                               src->app_ctx,
-                               buf,
-                               ret);
    }
  }
-  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
+  if (NULL == src)
-    GNUNET_TIME_UNIT_FOREVER_REL,
+  {
-    plugin->sock,
+    GNUNET_break (0);
-    &read_cb,
+    return;
-    plugin);
+  }
+  pid = (const struct GNUNET_PeerIdentity *) buf;
+  dst = find_target (plugin,
+                     pid,
+                     &sa,
+                     mh.msg_namelen);
+  if (NULL == dst)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  plugin->env->receive_cb (plugin->env->cls,
+                           &dst->app_ctx,
+                           &src->app_ctx,
+                           &buf[sizeof(*pid)],
+                           ret - sizeof (*pid));
 }
@@ -874,6 +1001,14 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
  plugin = GNUNET_new (struct Plugin);
  plugin->env = env;
  plugin->port = port;
+  plugin->port16 = (uint16_t) nport;
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_get_peer_identity (env->cfg,
+                                       &plugin->my_id))
+  {
+    GNUNET_free (plugin);
+    return NULL;
+  }
  af = AF_INET6;
  sock = socket (af,
                 SOCK_DGRAM,
@@ -1017,9 +1152,18 @@ libgnunet_plugin_dhtu_ip_done (void *cls)
    GNUNET_free (src->address);
    GNUNET_free (src);
  }
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
  GNUNET_CONTAINER_multihashmap_destroy (plugin->dsts);
+  if (NULL != plugin->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (plugin->read_task);
+    plugin->read_task = NULL;
+  }
  GNUNET_SCHEDULER_cancel (plugin->scan_task);
-  GNUNET_break (0 ==
+  GNUNET_break (GNUNET_OK ==
                GNUNET_NETWORK_socket_close (plugin->sock));
  GNUNET_free (plugin->port);
  GNUNET_free (plugin);
diff --git a/src/dns/plugin_block_dns.c b/src/dns/plugin_block_dns.c
index d3eb7d2b9..a596beb28 100644
--- a/src/dns/plugin_block_dns.c
+++ b/src/dns/plugin_block_dns.c
@@ -90,93 +90,6 @@ block_plugin_dns_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_dns_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *bg,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_DNS_Advertisement *ad;
-  struct GNUNET_HashCode phash;
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DNS:
-    if (0 != xquery_size)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-    if (sizeof(struct GNUNET_DNS_Advertisement) != reply_block_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    ad = reply_block;
-    if (ntohl (ad->purpose.size) !=
-        sizeof(struct GNUNET_DNS_Advertisement)
-        - sizeof(struct GNUNET_CRYPTO_EddsaSignature))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (0 ==
-        GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh
-                                              (ad->expiration_time)).
-        rel_value_us)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "DNS advertisement has expired\n");
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (GNUNET_OK !=
-        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_DNS_RECORD,
-                                     &ad->purpose,
-                                     &ad->signature,
-                                     &ad->peer.public_key))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &phash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                            &phash))
-      return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-  default:
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -198,9 +111,13 @@ block_plugin_dns_check_query (void *cls,
  {
  case GNUNET_BLOCK_TYPE_DNS:
    if (0 != xquery_size)
-      return GNUNET_NO;
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
    return GNUNET_OK;
  default:
+    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
 }
@@ -211,17 +128,15 @@ block_plugin_dns_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_dns_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                              enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                              const void *block,
-                                    const void *block,
+                              size_t block_size)
-                                    size_t block_size)
 {
  const struct GNUNET_DNS_Advertisement *ad;
@@ -260,6 +175,7 @@ block_plugin_dns_check_block (void *cls,
    }
    return GNUNET_OK;
  default:
+    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
 }
@@ -283,14 +199,14 @@ block_plugin_dns_check_block (void *cls,
 */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_dns_check_reply (
-                                   void *cls,
+                              void *cls,
-                                   enum GNUNET_BLOCK_Type type,
+                              enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
+                              struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
+                              const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                              const void *xquery,
-                                    size_t xquery_size,
+                              size_t xquery_size,
-                                    const void *reply_block,
+                              const void *reply_block,
-                                    size_t reply_block_size)
+                              size_t reply_block_size)
 {
  struct GNUNET_HashCode phash;
@@ -306,6 +222,7 @@ block_plugin_dns_check_reply (
      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
    return GNUNET_BLOCK_REPLY_OK_MORE;
  default:
+    GNUNET_break (0);
    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
  }
 }
@@ -329,8 +246,12 @@ block_plugin_dns_get_key (void *cls,
                          size_t block_size,
                          struct GNUNET_HashCode *key)
 {
-  /* we cannot extract a key from a block of this type */
+  if (GNUNET_BLOCK_TYPE_DNS != type)
-  return GNUNET_SYSERR;
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
@@ -347,7 +268,6 @@ libgnunet_plugin_block_dns_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_dns_evaluate;
  api->get_key = &block_plugin_dns_get_key;
  api->check_query = &block_plugin_dns_check_query;
  api->check_block = &block_plugin_dns_check_block;
diff --git a/src/fs/fs_file_information.c b/src/fs/fs_file_information.c
index 3324abd58..c5faa14d4 100644
--- a/src/fs/fs_file_information.c
+++ b/src/fs/fs_file_information.c
@@ -57,7 +57,7 @@ GNUNET_FS_file_information_get_id (struct GNUNET_FS_FileInformation *s)
 * @return "filename" field of the structure (can be NULL)
 */
 const char *
-GNUNET_FS_file_information_get_filename (struct GNUNET_FS_FileInformation *s)
+GNUNET_FS_file_information_get_filename (const struct GNUNET_FS_FileInformation *s)
 {
  return s->filename;
 }
diff --git a/src/fs/fs_uri.c b/src/fs/fs_uri.c
index 73ea5d60d..2d5566b54 100644
--- a/src/fs/fs_uri.c
+++ b/src/fs/fs_uri.c
@@ -653,18 +653,24 @@ GNUNET_FS_uri_parse (const char *uri, char **emsg)
      *emsg = GNUNET_strdup (_ ("invalid argument"));
    return NULL;
  }
-  if (NULL == emsg)
+  /**
-    emsg = &msg;
+   * FIXME: Do we want to log this?
-  *emsg = NULL;
+   */
-  if ((NULL != (ret = uri_chk_parse (uri, emsg))) ||
+  msg = NULL;
-      (NULL != (ret = uri_ksk_parse (uri, emsg))) ||
+  if (NULL != (ret = uri_chk_parse (uri, &msg)))
-      (NULL != (ret = uri_sks_parse (uri, emsg))) ||
+    return ret;
-      (NULL != (ret = uri_loc_parse (uri, emsg))))
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_ksk_parse (uri, &msg)))
+    return ret;
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_sks_parse (uri, &msg)))
+    return ret;
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_loc_parse (uri, &msg)))
    return ret;
-  if (NULL == *emsg)
+  GNUNET_free (msg);
+  if (NULL != emsg)
    *emsg = GNUNET_strdup (_ ("Unrecognized URI type"));
-  if (emsg == &msg)
-    GNUNET_free (msg);
  return NULL;
 }
diff --git a/src/fs/gnunet-search.c b/src/fs/gnunet-search.c
index 3bf013650..7e2e4d2a6 100644
--- a/src/fs/gnunet-search.c
+++ b/src/fs/gnunet-search.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet.
-     Copyright (C) 2001, 2002, 2004, 2005, 2006, 2007, 2009 GNUnet e.V.
+     Copyright (C) 2001, 2002, 2004, 2005, 2006, 2007, 2009, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -24,10 +24,57 @@
 * @author Krista Bennett
 * @author James Blackwell
 * @author Igor Wronsky
+ * @author madmurphy
 */
+#include <ctype.h>
+#include <inttypes.h>
+#include <limits.h>
 #include "platform.h"
 #include "gnunet_fs_service.h"
+#define GNUNET_SEARCH_log(kind, ...) \
+        GNUNET_log_from(kind, "gnunet-search", __VA_ARGS__)
+/*  The default settings that we use for the printed output  */
+#define DEFAULT_DIR_FORMAT       "#%n:\ngnunet-download -o \"%f\" -R %u\n\n"
+#define HELP_DEFAULT_DIR_FORMAT  "#%n:\\ngnunet-download -o \"%f\" -R %u\\n\\n"
+#define DEFAULT_FILE_FORMAT      "#%n:\ngnunet-download -o \"%f\" %u\n\n"
+#define HELP_DEFAULT_FILE_FORMAT "#%n:\\ngnunet-download -o \"%f\" %u\\n\\n"
+#define VERB_DEFAULT_DIR_FORMAT  DEFAULT_DIR_FORMAT "%a\n"
+#define VERB_DEFAULT_FILE_FORMAT DEFAULT_FILE_FORMAT "%a\n"
+#if HAVE_LIBEXTRACTOR
+#define DEFAULT_META_FORMAT      "  %t: %p\n"
+#define HELP_DEFAULT_META_FORMAT "  %t: %p\\n"
+#define HELP_EXTRACTOR_TEXTADD   ", %t"
+#else
+#define DEFAULT_META_FORMAT      "  MetaType #%i: %p\n"
+#define HELP_DEFAULT_META_FORMAT "  MetaType #%i: %p\\n"
+#define HELP_EXTRACTOR_TEXTADD   ""
+#endif
+#define GENERIC_DIRECTORY_NAME   "collection"
+#define GENERIC_FILE_NAME        "no-name"
+#define GENERIC_FILE_MIMETYPE    "application/octet-stream"
+enum GNUNET_SEARCH_MetadataPrinterFlags {
+  METADATA_PRINTER_FLAG_NONE = 0,
+  METADATA_PRINTER_FLAG_ONE_RUN = 1,
+  METADATA_PRINTER_FLAG_HAVE_TYPE = 2
+};
+struct GNUNET_SEARCH_MetadataPrinterInfo {
+  unsigned int counter;
+  unsigned int flags;
+  int type;
+};
 static int ret;
 static const struct GNUNET_CONFIGURATION_Handle *cfg;
@@ -38,6 +85,12 @@ static struct GNUNET_FS_SearchContext *sc;
 static char *output_filename;
+static char *format_string;
+static char *dir_format_string;
+static char *meta_format_string;
 static struct GNUNET_FS_DirectoryBuilder *db;
 static unsigned int anonymity = 1;
@@ -53,16 +106,79 @@ static unsigned int results;
 static unsigned int verbose;
+static int bookmark_only;
 static int local_only;
+static int silent_mode;
 static struct GNUNET_SCHEDULER_Task *tt;
 /**
+ * Print the escape sequence at the beginning of a string.
+ *
+ * @param esc a string that **must** begin with a backslash (the function only
+ *        assumes that it does, but does not check)
+ * @return the fragment that follows what has been printed
+ * @author madmurphy
+ *
+ * If `"\\nfoo"` is passed as argument, this function prints a new line and
+ * returns `"foo"`
+ */
+static const char *
+print_escape_sequence (const char *const esc)
+{
+  unsigned int probe;
+  const char * cursor = esc + 1;
+  char tmp;
+  switch (*cursor)
+  {
+  /*  Trivia  */
+  case '\\': putchar ('\\'); return cursor + 1;
+  case 'a': putchar ('\a'); return cursor + 1;
+  case 'b': putchar ('\b'); return cursor + 1;
+  case 'e': putchar ('\x1B'); return cursor + 1;
+  case 'f': putchar ('\f'); return cursor + 1;
+  case 'n': putchar ('\n'); return cursor + 1;
+  case 'r': putchar ('\r'); return cursor + 1;
+  case 't': putchar ('\t'); return cursor + 1;
+  case 'v': putchar ('\v'); return cursor + 1;
+  /*  Possibly hexadecimal code point  */
+  case 'x':
+    probe = 0;
+    while (probe < 256 && isxdigit((tmp = *++cursor)))
+      probe = (probe << 4) + tmp - (tmp > 96 ? 87 : tmp > 64 ? 55 : 48);
+    goto maybe_codepoint;
+  /*  Possibly octal code point  */
+  case '0': case '1': case '2': case '3':
+  case '4': case '5': case '6': case '7':
+    probe = *cursor++ - 48;
+    do probe = (probe << 3) + *cursor++ - 48;
+    while (probe < 256 && cursor < esc + 4 && *cursor > 47 && *cursor < 56);
+    goto maybe_codepoint;
+  /*  Boredom  */
+  case '\0': putchar ('\\'); return cursor;
+  default: printf ("\\%c", *cursor); return cursor + 1;
+  }
+maybe_codepoint:
+  if (probe < 256)
+    putchar (probe);
+  else
+    fwrite (esc, 1, cursor - esc, stdout);
+  return cursor;
+}
+/**
 * Type of a function that libextractor calls for each
 * meta data item found.
 *
- * @param cls closure (user-defined, unused)
+ * @param cls closure (user-defined, used for the iteration info)
 * @param plugin_name name of the plugin that produced this value;
 *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
 *        used in the main libextractor library and yielding
@@ -76,33 +192,228 @@ static struct GNUNET_SCHEDULER_Task *tt;
 * @return 0 to continue extracting, 1 to abort
 */
 static int
-item_printer (void *cls,
+item_printer (void *const cls,
-              const char *plugin_name,
+              const char *const plugin_name,
-              enum EXTRACTOR_MetaType type,
+              const enum EXTRACTOR_MetaType type,
-              enum EXTRACTOR_MetaFormat format,
+              const enum EXTRACTOR_MetaFormat format,
-              const char *data_mime_type,
+              const char *const data_mime_type,
-              const char *data,
+              const char *const data,
-              size_t data_size)
+              const size_t data_size)
 {
-  if ((format != EXTRACTOR_METAFORMAT_UTF8) &&
+#define info ((struct GNUNET_SEARCH_MetadataPrinterInfo *) cls)
-      (format != EXTRACTOR_METAFORMAT_C_STRING))
+  if ((format != EXTRACTOR_METAFORMAT_UTF8 &&
+       format != EXTRACTOR_METAFORMAT_C_STRING) ||
+      type == EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME)
    return 0;
-  if (type == EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME)
+  info->counter++;
+  if ((info->flags & METADATA_PRINTER_FLAG_HAVE_TYPE) && type != info->type)
    return 0;
+  const char *cursor = meta_format_string;
+  const char *next_spec = strchr(cursor, '%');
+  const char *next_esc = strchr(cursor, '\\');
+parse_format:
+  /*  If an escape sequence exists before the next format specifier...  */
+  if (next_esc && (!next_spec || next_esc < next_spec))
+  {
+    if (next_esc > cursor)
+      fwrite (cursor, 1, next_esc - cursor, stdout);
+    cursor = print_escape_sequence (next_esc);
+    next_esc = strchr(cursor, '\\');
+    goto parse_format;
+  }
+  /*  If a format specifier exists before the next escape sequence...  */
+  if (next_spec && (!next_esc || next_spec < next_esc))
+  {
+    if (next_spec > cursor)
+      fwrite (cursor, 1, next_spec - cursor, stdout);
+    switch (*++next_spec)
+    {
+    case '%': putchar('%'); break;
+    case 'i': printf ("%d", type); break;
+    case 'l': printf ("%lu", (long unsigned int) data_size); break;
+    case 'n': printf ("%u", info->counter); break;
+    case 'p': printf ("%s", data); break;
 #if HAVE_LIBEXTRACTOR
-  printf ("\t%20s: %s\n",
+    case 't':
-          dgettext (LIBEXTRACTOR_GETTEXT_DOMAIN,
+      printf ("%s",
-                    EXTRACTOR_metatype_to_string (type)),
+              dgettext (LIBEXTRACTOR_GETTEXT_DOMAIN,
-          data);
+                        EXTRACTOR_metatype_to_string (type)));
-#else
+      break;
-  printf ("\t%20d: %s\n", type, data);
 #endif
-  return 0;
+    case 'w': printf ("%s", plugin_name); break;
+    case '\0': putchar('%'); return 0;
+    default: printf ("%%%c", *next_spec); break;
+    }
+    cursor = next_spec + 1;
+    next_spec = strchr(cursor, '%');
+    goto parse_format;
+  }
+  if (*cursor)
+    printf ("%s", cursor);
+  return info->flags & METADATA_PRINTER_FLAG_ONE_RUN;
+#undef info
+}
+/**
+ * Print a search result according to the current formats
+ *
+ * @param filename the filename for this result
+ * @param uri the `struct GNUNET_FS_Uri` this result refers to
+ * @param metadata the `struct GNUNET_CONTAINER_MetaData` associated with this
+          result
+ * @param resultnum the result number
+ * @param is_directory GNUNET_YES if this is a directory, otherwise GNUNET_NO
+ * @author madmurphy
+ */
+static void
+print_search_result (const char *const filename,
+                     const struct GNUNET_FS_Uri *const uri,
+                     const struct GNUNET_CONTAINER_MetaData *const metadata,
+                     const unsigned int resultnum,
+                     const int is_directory)
+{
+  const char *cursor = GNUNET_YES == is_directory ?
+                         dir_format_string
+                       : format_string;
+  const char *next_spec = strchr(cursor, '%');
+  const char *next_esc = strchr(cursor, '\\');
+  char *placeholder;
+  struct GNUNET_SEARCH_MetadataPrinterInfo info;
+parse_format:
+  /*  If an escape sequence exists before the next format specifier...  */
+  if (next_esc && (!next_spec || next_esc < next_spec))
+  {
+    if (next_esc > cursor)
+      fwrite (cursor, 1, next_esc - cursor, stdout);
+    cursor = print_escape_sequence (next_esc);
+    next_esc = strchr(cursor, '\\');
+    goto parse_format;
+  }
+  /*  If a format specifier exists before the next escape sequence...  */
+  if (next_spec && (!next_esc || next_spec < next_esc))
+  {
+    if (next_spec > cursor)
+      fwrite (cursor, 1, next_spec - cursor, stdout);
+    switch (*++next_spec)
+    {
+    /*  All metadata fields  */
+    case 'a':
+      info.flags = METADATA_PRINTER_FLAG_NONE;
+iterate_meta:
+      info.counter = 0;
+      GNUNET_CONTAINER_meta_data_iterate (metadata, &item_printer, &info);
+      break;
+    /*  File's name  */
+    case 'f':
+      if (GNUNET_YES == is_directory)
+      {
+        printf ("%s%s", filename, GNUNET_FS_DIRECTORY_EXT);
+        break;
+      }
+      printf ("%s", filename);
+      break;
+    /*  Only the first metadata field  */
+    case 'j':
+      info.flags = METADATA_PRINTER_FLAG_ONE_RUN;
+      goto iterate_meta;
+    /*  File name's length  */
+    case 'l':
+      printf ("%lu",
+              (long unsigned int) (  GNUNET_YES == is_directory ?
+                                       strlen(filename) +
+                                       (sizeof(GNUNET_FS_DIRECTORY_EXT) - 1)
+                                   :
+                                       strlen(filename)));
+      break;
+    /*  File's mime type  */
+    case 'm':
+      if (GNUNET_YES == is_directory)
+      {
+        printf ("%s", GNUNET_FS_DIRECTORY_MIME);
+        break;
+      }
+      placeholder = GNUNET_CONTAINER_meta_data_get_by_type (
+        metadata,
+        EXTRACTOR_METATYPE_MIMETYPE);
+      printf ("%s", placeholder ? placeholder : GENERIC_FILE_MIMETYPE);
+      GNUNET_free (placeholder);
+      break;
+    /*  Result number  */
+    case 'n': printf ("%u", resultnum); break;
+    /*  File's size  */
+    case 's':
+      printf ("%" PRIu64, GNUNET_FS_uri_chk_get_file_size (uri));
+      break;
+    /*  File's URI  */
+    case 'u':
+      placeholder = GNUNET_FS_uri_to_string (uri);
+      printf ("%s", placeholder);
+      GNUNET_free (placeholder);
+      break;
+    /*  We can add as many cases as we want here...  */
+    /*  Handle `%123#a` and `%123#j` (e.g. `%5#j` is a book title)  */
+    case '0': case '1': case '2': case '3': case '4':
+    case '5': case '6': case '7': case '8': case '9':
+      cursor = next_spec;
+      info.type = *cursor - 48;
+      while (isdigit(*++cursor) && info.type < (INT_MAX - *cursor + 48) / 10)
+        info.type = info.type * 10 + *cursor - 48;
+      if (info.type == 0 || *cursor != '#')
+        goto not_a_specifier;
+      switch (*++cursor)
+      {
+      /*  All metadata fields of type `info.type`   */
+      case 'a':
+        next_spec = cursor;
+        info.flags = METADATA_PRINTER_FLAG_HAVE_TYPE;
+        goto iterate_meta;
+      /*  Only the first metadata field of type `info.type`  */
+      case 'j':
+        next_spec = cursor;
+        info.flags = METADATA_PRINTER_FLAG_HAVE_TYPE |
+                     METADATA_PRINTER_FLAG_ONE_RUN;
+        goto iterate_meta;
+      }
+      goto not_a_specifier;
+    /*  All other cases  */
+    case '%': putchar('%'); break;
+    case '\0': putchar('%'); return;
+not_a_specifier:
+    default: printf ("%%%c", *next_spec); break;
+    }
+    cursor = next_spec + 1;
+    next_spec = strchr(cursor, '%');
+    goto parse_format;
+  }
+  if (*cursor)
+    printf ("%s", cursor);
 }
 static void
-clean_task (void *cls)
+clean_task (void *const cls)
 {
  size_t dsize;
  void *ddata;
@@ -126,9 +437,10 @@ clean_task (void *cls)
                            GNUNET_DISK_PERM_USER_READ
                            | GNUNET_DISK_PERM_USER_WRITE))
  {
-    fprintf (stderr,
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
-             _ ("Failed to write directory with search results to `%s'\n"),
+                      _ ("Failed to write directory with search results to "
-             output_filename);
+                         "`%s'\n"),
+                      output_filename);
  }
  GNUNET_free (ddata);
  GNUNET_free (output_filename);
@@ -149,11 +461,11 @@ clean_task (void *cls)
 *         field in the GNUNET_FS_ProgressInfo struct.
 */
 static void *
-progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
+progress_cb (void *const cls,
+             const struct GNUNET_FS_ProgressInfo *const info)
 {
  static unsigned int cnt;
  int is_directory;
-  char *uri;
  char *filename;
  switch (info->status)
@@ -162,13 +474,17 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
    break;
  case GNUNET_FS_STATUS_SEARCH_RESULT:
+    if (silent_mode)
+      break;
    if (db != NULL)
-      GNUNET_FS_directory_builder_add (db,
+      GNUNET_FS_directory_builder_add (
-                                       info->value.search.specifics.result.uri,
+        db,
-                                       info->value.search.specifics.result.meta,
+        info->value.search.specifics.result.uri,
-                                       NULL);
+        info->value.search.specifics.result.meta,
-    uri = GNUNET_FS_uri_to_string (info->value.search.specifics.result.uri);
+        NULL);
-    printf ("#%u:\n", ++cnt);
+    cnt++;
    filename = GNUNET_CONTAINER_meta_data_get_by_type (
      info->value.search.specifics.result.meta,
      EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME);
@@ -179,45 +495,37 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
      while ((filename[0] != '\0') && ('/' == filename[strlen (filename) - 1]))
        filename[strlen (filename) - 1] = '\0';
      GNUNET_DISK_filename_canonicalize (filename);
-      if (GNUNET_YES == is_directory)
-        printf ("gnunet-download -o \"%s%s\" -R %s\n",
-                filename,
-                GNUNET_FS_DIRECTORY_EXT,
-                uri);
-      else
-        printf ("gnunet-download -o \"%s\" %s\n", filename, uri);
    }
-    else if (GNUNET_YES == is_directory)
+    print_search_result (  filename ?
-      printf ("gnunet-download -o \"collection%s\" -R %s\n",
+                             filename
-              GNUNET_FS_DIRECTORY_EXT,
+                         : is_directory ?
-              uri);
+                             GENERIC_DIRECTORY_NAME
-    else
+                         :
-      printf ("gnunet-download %s\n", uri);
+                             GENERIC_FILE_NAME,
-    if (verbose)
+                         info->value.search.specifics.result.uri,
-      GNUNET_CONTAINER_meta_data_iterate (info->value.search.specifics.result
+                         info->value.search.specifics.result.meta,
-                                          .meta,
+                         cnt,
-                                          &item_printer,
+                         is_directory);
-                                          NULL);
-    printf ("\n");
    fflush (stdout);
    GNUNET_free (filename);
-    GNUNET_free (uri);
    results++;
    if ((results_limit > 0) && (results >= results_limit))
+    {
      GNUNET_SCHEDULER_shutdown ();
+      /*  otherwise the function might keep printing results for a while...  */
+      silent_mode = GNUNET_YES;
+    }
    break;
  case GNUNET_FS_STATUS_SEARCH_UPDATE:
-    break;
  case GNUNET_FS_STATUS_SEARCH_RESULT_STOPPED:
    /* ignore */
    break;
  case GNUNET_FS_STATUS_SEARCH_ERROR:
-    fprintf (stderr,
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
-             _ ("Error searching: %s.\n"),
+                      _ ("Error searching: %s.\n"),
-             info->value.search.specifics.error.message);
+                      info->value.search.specifics.error.message);
    GNUNET_SCHEDULER_shutdown ();
    break;
@@ -226,7 +534,9 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
    break;
  default:
-    fprintf (stderr, _ ("Unexpected status: %d\n"), info->status);
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
+                      _ ("Unexpected status: %d\n"),
+                      info->status);
    break;
  }
  return NULL;
@@ -234,7 +544,7 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
 static void
-shutdown_task (void *cls)
+shutdown_task (void *const cls)
 {
  if (sc != NULL)
  {
@@ -245,9 +555,10 @@ shutdown_task (void *cls)
 static void
-timeout_task (void *cls)
+timeout_task (void *const cls)
 {
  tt = NULL;
+  silent_mode = GNUNET_YES;
  GNUNET_SCHEDULER_shutdown ();
 }
@@ -258,18 +569,47 @@ timeout_task (void *cls)
 * @param cls closure
 * @param args remaining command-line arguments
 * @param cfgfile name of the configuration file used (for saving, can be NULL!)
- * @param c configuration
+ * @param cfgarg configuration
 */
 static void
-run (void *cls,
+run (void *const cls,
-     char *const *args,
+     char *const *const args,
-     const char *cfgfile,
+     const char *const cfgfile,
-     const struct GNUNET_CONFIGURATION_Handle *c)
+     const struct GNUNET_CONFIGURATION_Handle *const cfgarg)
 {
  struct GNUNET_FS_Uri *uri;
  unsigned int argc;
  enum GNUNET_FS_SearchOptions options;
+  if (silent_mode && bookmark_only)
+  {
+    fprintf (stderr,
+             _ ("Conflicting options --bookmark-only and --silent.\n"));
+    ret = 1;
+    return;
+  }
+  if (bookmark_only && output_filename)
+  {
+    fprintf (stderr,
+             _ ("Conflicting options --bookmark-only and --output.\n"));
+    ret = 1;
+    return;
+  }
+  if (silent_mode && !output_filename)
+  {
+    fprintf (stderr, _ ("An output file is mandatory for silent mode.\n"));
+    ret = 1;
+    return;
+  }
+  if (NULL == dir_format_string)
+    dir_format_string = format_string ? format_string
+                      : verbose ? VERB_DEFAULT_DIR_FORMAT
+                      : DEFAULT_DIR_FORMAT;
+  if (NULL == format_string)
+    format_string = verbose ? VERB_DEFAULT_FILE_FORMAT
+                  : DEFAULT_FILE_FORMAT;
+  if (NULL == meta_format_string)
+    meta_format_string = DEFAULT_META_FORMAT;
  argc = 0;
  while (NULL != args[argc])
    argc++;
@@ -282,7 +622,27 @@ run (void *cls,
    ret = 1;
    return;
  }
-  cfg = c;
+  if (!GNUNET_FS_uri_test_ksk (uri) && !GNUNET_FS_uri_test_sks (uri))
+  {
+    fprintf (stderr,
+             "%s",
+             _ ("Invalid URI. Valid URIs for searching are keyword query "
+                "URIs\n(\"gnunet://fs/ksk/...\") and namespace content URIs "
+                "(\"gnunet://fs/sks/...\").\n"));
+    GNUNET_FS_uri_destroy (uri);
+    ret = 1;
+    return;
+  }
+  if (bookmark_only)
+  {
+    char * bmstr = GNUNET_FS_uri_to_string (uri);
+    printf ("%s\n", bmstr);
+    GNUNET_free (bmstr);
+    GNUNET_FS_uri_destroy (uri);
+    ret = 0;
+    return;
+  }
+  cfg = cfgarg;
  ctx = GNUNET_FS_start (cfg,
                         "gnunet-search",
                         &progress_cb,
@@ -291,7 +651,7 @@ run (void *cls,
                         GNUNET_FS_OPTIONS_END);
  if (NULL == ctx)
  {
-    fprintf (stderr, _ ("Could not initialize `%s' subsystem.\n"), "FS");
+    fprintf (stderr, _ ("Could not initialize the `%s` subsystem.\n"), "FS");
    GNUNET_FS_uri_destroy (uri);
    ret = 1;
    return;
@@ -321,18 +681,59 @@ run (void *cls,
 *
 * @param argc number of arguments from the command line
 * @param argv command line arguments
- * @return 0 ok, 1 on error
+ * @return 0 ok, an error number on error
 */
 int
 main (int argc, char *const *argv)
 {
  struct GNUNET_GETOPT_CommandLineOption options[] =
-  { GNUNET_GETOPT_option_uint ('a',
+  { GNUNET_GETOPT_option_uint (
-                               "anonymity",
+      'a',
-                               "LEVEL",
+      "anonymity",
-                               gettext_noop (
+      "LEVEL",
-                                 "set the desired LEVEL of receiver-anonymity"),
+      gettext_noop ("set the desired LEVEL of receiver-anonymity (default: "
-                               &anonymity),
+                    "1)"),
+      &anonymity),
+    GNUNET_GETOPT_option_flag (
+      'b',
+      "bookmark-only",
+      gettext_noop ("do not search, print only the URI that points to this "
+                    "search"),
+      &bookmark_only),
+    GNUNET_GETOPT_option_string (
+      'F',
+      "dir-printf",
+      "FORMAT",
+      gettext_noop ("write search results for directories according to "
+                    "FORMAT; accepted placeholders are: %a, %f, %j, %l, %m, "
+                    "%n, %s; defaults to the value of --printf when omitted "
+                    "or to `" HELP_DEFAULT_DIR_FORMAT "` if --printf is "
+                    "omitted too"),
+      &dir_format_string),
+    GNUNET_GETOPT_option_string (
+      'f',
+      "printf",
+      "FORMAT",
+      gettext_noop ("write search results according to FORMAT; accepted "
+                    "placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults "
+                    "to `" HELP_DEFAULT_FILE_FORMAT "` when omitted"),
+      &format_string),
+    GNUNET_GETOPT_option_string (
+      'i',
+      "iter-printf",
+      "FORMAT",
+      gettext_noop ("when the %a or %j placeholders appear in --printf or "
+                    "--dir-printf, list each metadata property according to "
+                    "FORMAT; accepted placeholders are: %i, %l, %n, %p"
+                    HELP_EXTRACTOR_TEXTADD ", %w; defaults to `"
+                    HELP_DEFAULT_META_FORMAT "` when omitted"),
+      &meta_format_string),
+    GNUNET_GETOPT_option_uint ('N',
+                               "results",
+                               "VALUE",
+                               gettext_noop ("automatically terminate search "
+                                             "after VALUE results are found"),
+                               &results_limit),
    GNUNET_GETOPT_option_flag (
      'n',
      "no-network",
@@ -341,39 +742,49 @@ main (int argc, char *const *argv)
    GNUNET_GETOPT_option_string (
      'o',
      "output",
-      "PREFIX",
+      "FILENAME",
-      gettext_noop ("write search results to file starting with PREFIX"),
+      gettext_noop ("create a GNUnet directory with search results at "
+                    "FILENAME (e.g. `gnunet-search --output=commons"
+                    GNUNET_FS_DIRECTORY_EXT " commons`)"),
      &output_filename),
+    GNUNET_GETOPT_option_flag (
+      's',
+      "silent",
+      gettext_noop ("silent mode (requires the --output argument)"),
+      &silent_mode),
    GNUNET_GETOPT_option_relative_time (
      't',
      "timeout",
      "DELAY",
-      gettext_noop ("automatically terminate search after DELAY"),
+      gettext_noop ("automatically terminate search after DELAY; the value "
+                    "given must be a number followed by a space and a time "
+                    "unit, for example \"500 ms\"; without a unit it defaults "
+                    "to microseconds - 1000000 = 1 second; if 0 or omitted "
+                    "it means to wait for CTRL-C"),
      &timeout),
-    GNUNET_GETOPT_option_verbose (&verbose),
+    GNUNET_GETOPT_option_increment_uint (
-    GNUNET_GETOPT_option_uint ('N',
+      'V',
-                               "results",
+      "verbose",
-                               "VALUE",
+      gettext_noop ("be verbose (append \"%a\\n\" to the default --printf and "
-                               gettext_noop ("automatically terminate search "
+                    "--dir-printf arguments - ignored when these are provided "
-                                             "after VALUE results are found"),
+                    "by the user)"),
-                               &results_limit),
+      &verbose),
    GNUNET_GETOPT_OPTION_END };
  if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv, &argc, &argv))
-    return 2;
+    return 12;
-  ret =
+  if (GNUNET_SYSERR == 
-    (GNUNET_OK ==
+      GNUNET_PROGRAM_run (argc,
-     GNUNET_PROGRAM_run (argc,
+                          argv,
-                         argv,
+                          "gnunet-search [OPTIONS] KEYWORD1 KEYWORD2 ...",
-                         "gnunet-search [OPTIONS] KEYWORD",
+                          gettext_noop ("Search for files that have been "
-                         gettext_noop (
+                                        "published on GNUnet\n"),
-                           "Search GNUnet for files that were published on GNUnet"),
                         options,
                         &run,
                         NULL))
-    ? ret
+    ret = 1;
-    : 1;
  GNUNET_free_nz ((void *) argv);
  return ret;
 }
diff --git a/src/fs/gnunet-service-fs_pr.c b/src/fs/gnunet-service-fs_pr.c
index beb29a506..154c454ca 100644
--- a/src/fs/gnunet-service-fs_pr.c
+++ b/src/fs/gnunet-service-fs_pr.c
@@ -247,7 +247,8 @@ static unsigned long long max_pending_requests = (32 * 1024);
 * @param pr request for which the BF is to be recomputed
 */
 static void
-refresh_bloomfilter (enum GNUNET_BLOCK_Type type, struct GSF_PendingRequest *pr)
+refresh_bloomfilter (enum GNUNET_BLOCK_Type type,
+                     struct GSF_PendingRequest *pr)
 {
  if (NULL != pr->bg)
  {
@@ -406,7 +407,7 @@ GSF_pending_request_create_ (enum GSF_PendingRequestOptions options,
        break;     /* let the request live briefly... */
      if (NULL != dpr->rh)
        dpr->rh (dpr->rh_cls,
-                 GNUNET_BLOCK_EVALUATION_REQUEST_VALID,
+                 GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
                 dpr,
                 UINT32_MAX,
                 GNUNET_TIME_UNIT_FOREVER_ABS,
@@ -557,7 +558,10 @@ GSF_pending_request_get_message_ (struct GSF_PendingRequest *pr)
    k++;
  }
  if (GNUNET_OK !=
-      GNUNET_BLOCK_group_serialize (pr->bg, &bf_nonce, &bf_data, &bf_size))
+      GNUNET_BLOCK_group_serialize (pr->bg,
+                                    &bf_nonce,
+                                    &bf_data,
+                                    &bf_size))
  {
    bf_size = 0;
    bf_data = NULL;
@@ -765,11 +769,6 @@ struct ProcessReplyClosure
  enum GNUNET_BLOCK_Type type;
  /**
-   * Control flags for evaluation.
-   */
-  enum GNUNET_BLOCK_EvaluationOptions eo;
-  /**
   * How much was this reply worth to us?
   */
  uint32_t priority;
@@ -850,7 +849,6 @@ process_reply (void *cls,
  case GNUNET_BLOCK_REPLY_OK_MORE:
    update_request_performance_data (prq, pr);
    break;
  case GNUNET_BLOCK_REPLY_OK_LAST:
    /* short cut: stop processing early, no BF-update, etc. */
    update_request_performance_data (prq, pr);
@@ -885,7 +883,6 @@ process_reply (void *cls,
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Duplicate response, discarding.\n");
    return GNUNET_YES;   /* duplicate */
  case GNUNET_BLOCK_REPLY_IRRELEVANT:
    GNUNET_STATISTICS_update (GSF_stats,
                              "# irrelevant replies discarded",
@@ -894,8 +891,6 @@ process_reply (void *cls,
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Irrelevant response, ignoring.\n");
    return GNUNET_YES;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    return GNUNET_YES;
  case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
    GNUNET_break (0); /* bad installation? */
    return GNUNET_NO;
@@ -1127,8 +1122,9 @@ handle_dht_reply (void *cls,
                                             prq.expiration);
  prq.size = size;
  prq.type = type;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
+  process_reply (&prq,
-  process_reply (&prq, key, pr);
+                 key,
+                 pr);
  if ((GNUNET_YES == active_to_migration) &&
      (GNUNET_NO == test_put_load_too_high (prq.priority)))
  {
@@ -1229,6 +1225,15 @@ cadet_reply_proc (void *cls,
  struct GNUNET_HashCode query;
  pr->cadet_request = NULL;
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GSF_block_ctx,
+                                type,
+                                data,
+                                data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
  if (GNUNET_BLOCK_TYPE_ANY == type)
  {
    GNUNET_break (NULL == data);
@@ -1247,7 +1252,11 @@ cadet_reply_proc (void *cls,
    return;
  }
  if (GNUNET_YES !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, data, data_size, &query))
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            data,
+                            data_size,
+                            &query))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Failed to derive key for block of type %d\n",
@@ -1268,8 +1277,9 @@ cadet_reply_proc (void *cls,
                                             prq.expiration);
  prq.size = data_size;
  prq.type = type;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
+  process_reply (&prq,
-  process_reply (&prq, &query, pr);
+                 &query,
+                 pr);
 }
@@ -1611,7 +1621,11 @@ called_from_on_demand:
  prq.expiration = expiration;
  prq.size = size;
  if (GNUNET_OK !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, data, size, &query))
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            data,
+                            size,
+                            &query))
  {
    GNUNET_break (0);
    GNUNET_DATASTORE_remove (GSF_dsh,
@@ -1631,8 +1645,9 @@ called_from_on_demand:
  prq.anonymity_level = anonymity;
  if ((0 == old_rf) && (0 == pr->public_data.results_found))
    GSF_update_datastore_delay_ (pr->public_data.start_time);
-  prq.eo = GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO;
+  process_reply (&prq,
-  process_reply (&prq, key, pr);
+                 key,
+                 pr);
  pr->local_result = prq.eval;
  if (GNUNET_BLOCK_REPLY_OK_LAST == prq.eval)
  {
@@ -1720,7 +1735,8 @@ GSF_local_lookup_ (struct GSF_PendingRequest *pr,
 * @param put the actual message
 */
 void
-handle_p2p_put (void *cls, const struct PutMessage *put)
+handle_p2p_put (void *cls,
+                const struct PutMessage *put)
 {
  struct GSF_ConnectedPeer *cp = cls;
  uint16_t msize;
@@ -1746,7 +1762,20 @@ handle_p2p_put (void *cls, const struct PutMessage *put)
                                           GNUNET_TIME_UNIT_YEARS),
                                         expiration);
  if (GNUNET_OK !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, &put[1], dsize, &query))
+      GNUNET_BLOCK_check_block (GSF_block_ctx,
+                                type,
+                                &put[1],
+                                dsize))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            &put[1],
+                            dsize,
+                            &query))
  {
    GNUNET_break_op (0);
    return;
@@ -1764,7 +1793,6 @@ handle_p2p_put (void *cls, const struct PutMessage *put)
  prq.priority = 0;
  prq.anonymity_level = UINT32_MAX;
  prq.request_found = GNUNET_NO;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
  GNUNET_CONTAINER_multihashmap_get_multiple (pr_map,
                                              &query,
                                              &process_reply,
diff --git a/src/fs/plugin_block_fs.c b/src/fs/plugin_block_fs.c
index 43380b3b6..029f95bc5 100644
--- a/src/fs/plugin_block_fs.c
+++ b/src/fs/plugin_block_fs.c
@@ -111,110 +111,6 @@ block_plugin_fs_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to use for evaluation
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_fs_evaluate (void *cls,
-                          struct GNUNET_BLOCK_Context *ctx,
-                          enum GNUNET_BLOCK_Type type,
-                          struct GNUNET_BLOCK_Group *bg,
-                          enum GNUNET_BLOCK_EvaluationOptions eo,
-                          const struct GNUNET_HashCode *query,
-                          const void *xquery,
-                          size_t xquery_size,
-                          const void *reply_block,
-                          size_t reply_block_size)
-{
-  const struct UBlock *ub;
-  struct GNUNET_HashCode hc;
-  struct GNUNET_HashCode chash;
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
-  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-    return GNUNET_BLOCK_EVALUATION_OK_LAST;
-  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-    if (reply_block_size < sizeof(struct UBlock))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    ub = reply_block;
-    GNUNET_CRYPTO_hash (&ub->verification_key,
-                        sizeof(ub->verification_key),
-                        &hc);
-    if (0 != memcmp (&hc,
-                     query,
-                     sizeof(struct GNUNET_HashCode)))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (reply_block_size != ntohl (ub->purpose.size) + sizeof(struct
-                                                              GNUNET_CRYPTO_EcdsaSignature))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if ((0 == (eo & GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO)) &&
-        (GNUNET_OK !=
-         GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK,
-                                      &ub->purpose,
-                                      &ub->signature,
-                                      &ub->verification_key)))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &chash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                            &chash))
-      return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-  default:
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-}
-/**
 * Function called to obtain the key for a block.
 *
 * @param cls closure
@@ -245,8 +141,11 @@ block_plugin_fs_get_key (void *cls,
  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
    if (block_size < sizeof(struct UBlock))
    {
-      GNUNET_break (0);
+      GNUNET_break_op (0);
-      return GNUNET_SYSERR;
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
    }
    ub = block;
    GNUNET_CRYPTO_hash (&ub->verification_key,
@@ -290,6 +189,7 @@ block_plugin_fs_check_query (void *cls,
    }
    return GNUNET_OK;
  default:
+    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
 }
@@ -300,7 +200,6 @@ block_plugin_fs_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -308,7 +207,6 @@ block_plugin_fs_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_fs_check_block (void *cls,
                             enum GNUNET_BLOCK_Type type,
-                             const struct GNUNET_HashCode *query,
                             const void *block,
                             size_t block_size)
 {
@@ -346,6 +244,7 @@ block_plugin_fs_check_block (void *cls,
      return GNUNET_OK;
    }
  default:
+    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
 }
@@ -396,6 +295,7 @@ block_plugin_fs_check_reply (void *cls,
      return GNUNET_BLOCK_REPLY_OK_MORE;
    }
  default:
+    GNUNET_break (0);
    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
  }
 }
@@ -416,7 +316,6 @@ libgnunet_plugin_block_fs_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_fs_evaluate;
  api->get_key = &block_plugin_fs_get_key;
  api->create_group = &block_plugin_fs_create_group;
  api->check_query = &block_plugin_fs_check_query;
diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index 315b4dbf3..d49e0c5c8 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -155,6 +155,7 @@ gnunet_dns2gns_LDADD = \
  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
  libgnunetgns.la \
  $(top_builddir)/src/util/libgnunetutil.la \
+  $(USE_VPN) \
  $(top_builddir)/src/identity/libgnunetidentity.la \
  $(GN_LIBINTL)
@@ -218,7 +219,6 @@ gnunet_service_gns_LDADD = \
  $(top_builddir)/src/dht/libgnunetdht.la \
  $(top_builddir)/src/namecache/libgnunetnamecache.la \
  $(LIBIDN) $(LIBIDN2) \
-  $(USE_VPN) \
  $(GN_LIBINTL)
@@ -270,8 +270,7 @@ check_SCRIPTS = \
  test_gns_rel_expiration.sh\
  test_gns_soa_lookup.sh\
  test_gns_revocation.sh\
-  test_gns_cname_lookup.sh\
+  test_gns_redirect_lookup.sh
-  test_proxy.sh
 if HAVE_GNUTLS
 if HAVE_LIBGNURL
@@ -292,7 +291,26 @@ EXTRA_DIST = \
  zonefiles/J7POEUT41A8PBFS7KVVDRF88GBOU4HK8PSU5QKVLVE3R9T91E99G.zkey \
  zonefiles/OEFL7A4VEF1B40QLEMTG5D8G1CN6EN16QUSG5R2DT71GRJN34LSG.zkey \
  zonefiles/test_zonekey \
-  $(check_SCRIPTS) \
+  test_gns_lookup.sh \
+  test_gns_config_lookup.sh \
+  test_gns_ipv6_lookup.sh\
+  test_gns_txt_lookup.sh\
+  test_gns_caa_lookup.sh\
+  test_gns_mx_lookup.sh \
+  test_gns_gns2dns_lookup.sh \
+  test_gns_gns2dns_zkey_lookup.sh \
+  test_gns_gns2dns_cname_lookup.sh \
+  test_gns_dht_lookup.sh\
+  test_gns_delegated_lookup.sh \
+  test_gns_at_lookup.sh\
+  test_gns_zkey_lookup.sh\
+  test_gns_rel_expiration.sh\
+  test_gns_soa_lookup.sh\
+  test_gns_revocation.sh\
+  test_gns_redirect_lookup.sh\
+  test_proxy.sh\
+  test_plugin_rest_gns.sh\
+  test_proxy.sh \
  $(pkgdata_DATA) \
  test_gnunet_gns.sh.in
diff --git a/src/gns/gnunet-bcd.c b/src/gns/gnunet-bcd.c
index 83efcfba5..60fe25945 100644
--- a/src/gns/gnunet-bcd.c
+++ b/src/gns/gnunet-bcd.c
@@ -419,6 +419,8 @@ create_response (void *cls,
             "\\def\\gpglineone{%s}\n\\def\\gpglinetwo{%s}\n",
             line1,
             line2);
+    GNUNET_free (line1);
+    GNUNET_free (line2);
  }
  fprintf (deffile,
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 06f4c9841..46659cdda 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -27,6 +27,7 @@
 #include <gnunet_dnsparser_lib.h>
 #include <gnunet_gns_service.h>
 #include <gnunet_dnsstub_lib.h>
+#include "gnunet_vpn_service.h"
 #include "gns.h"
 /**
@@ -35,6 +36,46 @@
 #define TIMEOUT GNUNET_TIME_UNIT_MINUTES
 /**
+ * Default timeout for VPN redirections.
+ */
+#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
+struct Request;
+/**
+ * Closure for #vpn_allocation_cb.
+ */
+struct VpnContext
+{
+  /**
+   * Which resolution process are we processing.
+   */
+  struct Request *request;
+  /**
+   * Handle to the VPN request that we were performing.
+   */
+  struct GNUNET_VPN_RedirectionRequest *vpn_request;
+  /**
+   * Number of records serialized in @e rd_data.
+   */
+  unsigned int rd_count;
+  /**
+   * Serialized records.
+   */
+  char *rd_data;
+  /**
+   * Number of bytes in @e rd_data.
+   */
+  ssize_t rd_data_size;
+};
+/**
 * Data kept per request.
 */
 struct Request
@@ -72,6 +113,11 @@ struct Request
  struct GNUNET_SCHEDULER_Task *timeout_task;
  /**
+   * Vpn resulution context
+   */
+  struct VpnContext *vpn_ctx;
+  /**
   * Original UDP request message.
   */
  char *udp_msg;
@@ -90,6 +136,7 @@ struct Request
   * ID of the original request.
   */
  uint16_t original_request_id;
 };
 /**
@@ -109,6 +156,11 @@ static struct in6_addr address6;
 struct GNUNET_GNS_Handle *gns;
 /**
+ * Our handle to the vpn service
+ */
+static struct GNUNET_VPN_Handle *vpn_handle;
+/**
 * Stub resolver
 */
 struct GNUNET_DNSSTUB_Context *dns_stub;
@@ -183,6 +235,11 @@ do_shutdown (void *cls)
    GNUNET_GNS_disconnect (gns);
    gns = NULL;
  }
+  if (NULL != vpn_handle)
+  {
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
+  }
  if (NULL != dns_stub)
  {
    GNUNET_DNSSTUB_stop (dns_stub);
@@ -269,6 +326,7 @@ static void
 do_timeout (void *cls)
 {
  struct Request *request = cls;
+  struct VpnContext *vpn_ctx;
  if (NULL != request->packet)
    GNUNET_DNSPARSER_free_packet (request->packet);
@@ -277,6 +335,12 @@ do_timeout (void *cls)
  if (NULL != request->dns_lookup)
    GNUNET_DNSSTUB_resolve_cancel (request->dns_lookup);
  GNUNET_free (request->udp_msg);
+  if (NULL != (vpn_ctx = request->vpn_ctx))
+  {
+    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
+    GNUNET_free (vpn_ctx->rd_data);
+    GNUNET_free (vpn_ctx);
+  }
  GNUNET_free (request);
 }
@@ -321,6 +385,79 @@ dns_result_processor (void *cls,
  send_response (request);
 }
+/**
+ * Callback invoked from the VPN service once a redirection is
+ * available.  Provides the IP address that can now be used to
+ * reach the requested destination.  Replaces the "VPN" record
+ * with the respective A/AAAA record and continues processing.
+ *
+ * @param cls closure
+ * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
+ *                will match 'result_af' from the request
+ * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
+ *                that the VPN allocated for the redirection;
+ *                traffic to this IP will now be redirected to the
+ *                specified target peer; NULL on error
+ */
+static void
+vpn_allocation_cb (void *cls,
+                   int af,
+                   const void *address)
+{
+  struct VpnContext *vpn_ctx = cls;
+  struct Request *request = vpn_ctx->request;
+  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
+  unsigned int i;
+  vpn_ctx->vpn_request = NULL;
+  request->vpn_ctx = NULL;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_records_deserialize (
+                   (size_t) vpn_ctx->rd_data_size,
+                   vpn_ctx->rd_data,
+                   vpn_ctx->rd_count,
+                   rd));
+  for (i = 0; i < vpn_ctx->rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
+    {
+      switch (af)
+      {
+      case AF_INET:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
+        rd[i].data_size = sizeof(struct in_addr);
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        break;
+      case AF_INET6:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        rd[i].data_size = sizeof(struct in6_addr);
+        break;
+      default:
+        GNUNET_assert (0);
+      }
+      break;
+    }
+  }
+  GNUNET_assert (i < vpn_ctx->rd_count);
+  if (0 == vpn_ctx->rd_count)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("VPN returned empty result for `%s'\n"),
+                request->packet->queries[0].name);
+  send_response (request);
+  GNUNET_free (vpn_ctx->rd_data);
+  GNUNET_free (vpn_ctx);
+}
 /**
 * Iterator called on obtained result for a GNS lookup.
@@ -339,6 +476,11 @@ result_processor (void *cls,
  struct Request *request = cls;
  struct GNUNET_DNSPARSER_Packet *packet;
  struct GNUNET_DNSPARSER_Record rec;
+  struct VpnContext *vpn_ctx;
+  const struct GNUNET_TUN_GnsVpnRecord *vpn;
+  const char *vname;
+  struct GNUNET_HashCode vhash;
+  int af;
  request->lookup = NULL;
  if (GNUNET_NO == was_gns)
@@ -415,6 +557,67 @@ result_processor (void *cls,
                           packet->num_answers,
                           rec);
      break;
+    case GNUNET_GNSRECORD_TYPE_VPN:
+      if ((GNUNET_DNSPARSER_TYPE_A != request->packet->queries[0].type) &&
+          (GNUNET_DNSPARSER_TYPE_AAAA != request->packet->queries[0].type))
+        break;
+      af = (GNUNET_DNSPARSER_TYPE_A == request->packet->queries[0].type) ? AF_INET :
+           AF_INET6;
+      if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
+          rd[i].data_size)
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
+      vname = (const char *) &vpn[1];
+      if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
+                                                     GNUNET_TUN_GnsVpnRecord)
+          ])
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      GNUNET_TUN_service_name_to_hash (vname,
+                                       &vhash);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
+                  GNUNET_i2s (&vpn->peer),
+                  vname,
+                  (int) af,
+                  (int) ntohs (vpn->proto));
+      vpn_ctx = GNUNET_new (struct VpnContext);
+      request->vpn_ctx = vpn_ctx;
+      vpn_ctx->request = request;
+      vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                                 rd);
+      if (vpn_ctx->rd_data_size < 0)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (vpn_ctx);
+        break;
+      }
+      vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
+      vpn_ctx->rd_count = rd_count;
+      GNUNET_assert (vpn_ctx->rd_data_size ==
+                     GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                         rd,
+                                                         (size_t) vpn_ctx
+                                                         ->rd_data_size,
+                                                         vpn_ctx->rd_data));
+      vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
+                                                          af,
+                                                          ntohs (
+                                                            vpn->proto),
+                                                          &vpn->peer,
+                                                          &vhash,
+                                                          GNUNET_TIME_relative_to_absolute (
+                                                            VPN_TIMEOUT),
+                                                          &
+                                                          vpn_allocation_cb,
+                                                          vpn_ctx);
+      return;
    default:
      /* skip */
@@ -641,6 +844,8 @@ run (void *cls,
                                 NULL);
  if (NULL == (gns = GNUNET_GNS_connect (cfg)))
    return;
+  if (NULL == (vpn_handle = GNUNET_VPN_connect (cfg)))
+    return;
  GNUNET_assert (NULL != (dns_stub = GNUNET_DNSSTUB_start (128)));
  if (GNUNET_OK !=
      GNUNET_DNSSTUB_add_dns_ip (dns_stub,
@@ -649,6 +854,8 @@ run (void *cls,
    GNUNET_DNSSTUB_stop (dns_stub);
    GNUNET_GNS_disconnect (gns);
    gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
    return;
  }
@@ -750,6 +957,8 @@ run (void *cls,
  {
    GNUNET_GNS_disconnect (gns);
    gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
    GNUNET_DNSSTUB_stop (dns_stub);
    dns_stub = NULL;
    return;
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 5833f4d0b..b28236fed 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -420,15 +420,11 @@ handle_lookup (void *cls,
               const struct LookupMessage *sh_msg)
 {
  struct GnsClient *gc = cls;
-  char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 1];
  struct ClientLookupHandle *clh;
-  char *nameptr = name;
+  const char *name;
-  const char *utf_in;
  GNUNET_SERVICE_client_continue (gc->client);
-  utf_in = (const char *) &sh_msg[1];
+  name = (const char *) &sh_msg[1];
-  GNUNET_STRINGS_utf8_tolower (utf_in,
-                               nameptr);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received LOOKUP `%s' message\n",
              name);
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 51e650b4f..72b228f33 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -52,7 +52,6 @@
 #include "gns.h"
 #include "gnunet-service-gns.h"
 #include "gnunet-service-gns_resolver.h"
-#include "gnunet_vpn_service.h"
 /**
@@ -68,11 +67,6 @@
    GNUNET_TIME_UNIT_SECONDS, 15)
 /**
- * Default timeout for VPN redirections.
- */
-#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
-/**
 * DHT replication level
 */
 #define DHT_GNS_REPLICATION_LEVEL 10
@@ -255,38 +249,6 @@ struct DnsResult
 /**
- * Closure for #vpn_allocation_cb.
- */
-struct VpnContext
-{
-  /**
-   * Which resolution process are we processing.
-   */
-  struct GNS_ResolverHandle *rh;
-  /**
-   * Handle to the VPN request that we were performing.
-   */
-  struct GNUNET_VPN_RedirectionRequest *vpn_request;
-  /**
-   * Number of records serialized in @e rd_data.
-   */
-  unsigned int rd_count;
-  /**
-   * Serialized records.
-   */
-  char *rd_data;
-  /**
-   * Number of bytes in @e rd_data.
-   */
-  ssize_t rd_data_size;
-};
-/**
 * Handle to a currently pending resolution.  On result (positive or
 * negative) the #GNS_ResultProcessor is called.
 */
@@ -322,10 +284,6 @@ struct GNS_ResolverHandle
   */
  struct GNUNET_DHT_GetHandle *get_handle;
-  /**
-   * Handle to a VPN request, NULL if none is active.
-   */
-  struct VpnContext *vpn_ctx;
  /**
   * Socket for a DNS request, NULL if none is active.
@@ -463,11 +421,6 @@ struct CacheOps
 static struct GNUNET_NAMECACHE_Handle *namecache_handle;
 /**
- * Our handle to the vpn service
- */
-static struct GNUNET_VPN_Handle *vpn_handle;
-/**
 * Resolver handle to the dht
 */
 static struct GNUNET_DHT_Handle *dht_handle;
@@ -1235,16 +1188,16 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
 /**
- * We encountered a CNAME record during our resolution.
+ * We encountered a REDIRECT record during our resolution.
 * Merge it into our chain.
 *
 * @param rh resolution we are performing
- * @param cname value of the cname record we got for the current
+ * @param rname value of the redirect record we got for the current
 *        authority chain tail
 */
 static void
-handle_gns_cname_result (struct GNS_ResolverHandle *rh,
+handle_gns_redirect_result (struct GNS_ResolverHandle *rh,
-                         const char *cname)
+                            const char *rname)
 {
  size_t nlen;
  char *res;
@@ -1253,14 +1206,17 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
  int af;
  struct GNUNET_IDENTITY_PublicKey zone;
-  nlen = strlen (cname);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-  tld = GNS_get_tld (cname);
+              "Handling GNS REDIRECT result `%s'\n",
+              rname);
+  nlen = strlen (rname);
+  tld = GNS_get_tld (rname);
  if (0 == strcmp ("+", tld))
  {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
    if (0 == rh->name_resolution_pos)
    {
-      res = GNUNET_strndup (cname, nlen - 2);
+      res = GNUNET_strndup (rname, nlen - 2);
      rh->name_resolution_pos = nlen - 2;
    }
    else
@@ -1270,7 +1226,7 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                       (int) rh->name_resolution_pos,
                       rh->name,
                       (int) (nlen - 2),
-                       cname);
+                       rname);
      rh->name_resolution_pos = strlen (res);
    }
    GNUNET_free (rh->name);
@@ -1291,13 +1247,13 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
  }
  if (GNUNET_OK == GNUNET_GNSRECORD_zkey_to_pkey (tld, &zone))
  {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
    if (0 == rh->name_resolution_pos)
    {
      GNUNET_asprintf (&res,
                       "%.*s",
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
-                       cname);
+                       rname);
    }
    else
    {
@@ -1305,8 +1261,8 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                       "%.*s.%.*s",
                       (int) rh->name_resolution_pos,
                       rh->name,
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
-                       cname);
+                       rname);
    }
    rh->name_resolution_pos = strlen (res);
    GNUNET_free (rh->name);
@@ -1326,18 +1282,62 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
  }
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Got CNAME `%s' from GNS for `%s'\n",
+              "Got REDIRECT `%s' from GNS for `%s'\n",
-              cname,
+              rname,
              rh->name);
  if (NULL != rh->std_resolve)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Multiple CNAME results from GNS resolving `%s'! Not really allowed...\n",
+                "Multiple REDIRECT results from GNS resolving `%s'! Not really allowed...\n",
                rh->name);
    GNUNET_RESOLVER_request_cancel (rh->std_resolve);
  }
  /* name is absolute, go to DNS */
  GNUNET_free (rh->name);
+  rh->name = GNUNET_strdup (rname);
+  rh->name_resolution_pos = strlen (rh->name);
+  switch (rh->record_type)
+  {
+  case GNUNET_DNSPARSER_TYPE_A:
+    af = AF_INET;
+    break;
+  case GNUNET_DNSPARSER_TYPE_AAAA:
+    af = AF_INET6;
+    break;
+  default:
+    af = AF_UNSPEC;
+    break;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Doing standard DNS lookup for `%s'\n",
+              rh->name);
+  rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name,
+                                            af,
+                                            DNS_LOOKUP_TIMEOUT,
+                                            &handle_dns_result,
+                                            rh);
+}
+/**
+ * We encountered a CNAME record during our resolution.
+ * Merge it into our chain.
+ *
+ * @param rh resolution we are performing
+ * @param cname value of the cname record we got for the current
+ *        authority chain tail
+ */
+static void
+handle_gns_cname_result (struct GNS_ResolverHandle *rh,
+                         const char *cname)
+{
+  int af;
+  GNUNET_free (rh->name);
  rh->name = GNUNET_strdup (cname);
  rh->name_resolution_pos = strlen (rh->name);
  switch (rh->record_type)
@@ -1379,80 +1379,6 @@ handle_gns_resolution_result (void *cls,
                              const struct GNUNET_GNSRECORD_Data *rd);
-/**
- * Callback invoked from the VPN service once a redirection is
- * available.  Provides the IP address that can now be used to
- * reach the requested destination.  Replaces the "VPN" record
- * with the respective A/AAAA record and continues processing.
- *
- * @param cls closure
- * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
- *                will match 'result_af' from the request
- * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
- *                that the VPN allocated for the redirection;
- *                traffic to this IP will now be redirected to the
- *                specified target peer; NULL on error
- */
-static void
-vpn_allocation_cb (void *cls,
-                   int af,
-                   const void *address)
-{
-  struct VpnContext *vpn_ctx = cls;
-  struct GNS_ResolverHandle *rh = vpn_ctx->rh;
-  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
-  unsigned int i;
-  vpn_ctx->vpn_request = NULL;
-  rh->vpn_ctx = NULL;
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_GNSRECORD_records_deserialize (
-                   (size_t) vpn_ctx->rd_data_size,
-                   vpn_ctx->rd_data,
-                   vpn_ctx->rd_count,
-                   rd));
-  for (i = 0; i < vpn_ctx->rd_count; i++)
-  {
-    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
-    {
-      switch (af)
-      {
-      case AF_INET:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
-        rd[i].data_size = sizeof(struct in_addr);
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        break;
-      case AF_INET6:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        rd[i].data_size = sizeof(struct in6_addr);
-        break;
-      default:
-        GNUNET_assert (0);
-      }
-      break;
-    }
-  }
-  GNUNET_assert (i < vpn_ctx->rd_count);
-  if (0 == vpn_ctx->rd_count)
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("VPN returned empty result for `%s'\n"),
-                rh->name);
-  handle_gns_resolution_result (rh,
-                                vpn_ctx->rd_count,
-                                rd);
-  GNUNET_free (vpn_ctx->rd_data);
-  GNUNET_free (vpn_ctx);
-}
 /**
 * We have resolved one or more of the nameservers for a
@@ -1653,6 +1579,20 @@ handle_gns2dns_ip (void *cls,
    ac->authority_info.dns_authority.found = GNUNET_YES;
 }
+/**
+ * We found a REDIRECT record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with CNAME to resolve recursively
+ */
+static void
+recursive_redirect_resolution (struct GNS_ResolverHandle *rh,
+                               const struct GNUNET_GNSRECORD_Data *rd)
+{
+  handle_gns_redirect_result (rh,
+                              rd->data);
+}
 /**
 * We found a CNAME record, perform recursive resolution on it.
@@ -1956,11 +1896,6 @@ handle_gns_resolution_result (void *cls,
 {
  struct GNS_ResolverHandle *rh = cls;
  char *cname;
-  struct VpnContext *vpn_ctx;
-  const struct GNUNET_TUN_GnsVpnRecord *vpn;
-  const char *vname;
-  struct GNUNET_HashCode vhash;
-  int af;
  char scratch[UINT16_MAX];
  size_t scratch_off;
  size_t scratch_start;
@@ -2006,8 +1941,18 @@ handle_gns_resolution_result (void *cls,
      GNUNET_free (cname);
      return;
    }
-    /* If A/AAAA was requested, but we got a VPN
+    if ((rd_count > 0) &&
-       record, we convert it to A/AAAA using GNUnet VPN */
+        (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[0].record_type) &&
+        (GNUNET_GNSRECORD_TYPE_REDIRECT != rh->record_type))
+    {
+      handle_gns_redirect_result (rh,
+                                  rd[0].data);
+      return;
+    }
+    /* If A/AAAA was requested,
+     * but we got a GNS2DNS record */
    if ((GNUNET_DNSPARSER_TYPE_A == rh->record_type) ||
        (GNUNET_DNSPARSER_TYPE_AAAA == rh->record_type))
    {
@@ -2015,69 +1960,6 @@ handle_gns_resolution_result (void *cls,
      {
        switch (rd[i].record_type)
        {
-        case GNUNET_GNSRECORD_TYPE_VPN:
-          {
-            af = (GNUNET_DNSPARSER_TYPE_A == rh->record_type) ? AF_INET :
-                 AF_INET6;
-            if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
-                rd[i].data_size)
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
-            vname = (const char *) &vpn[1];
-            if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
-                                                           GNUNET_TUN_GnsVpnRecord)
-                ])
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            GNUNET_TUN_service_name_to_hash (vname,
-                                             &vhash);
-            GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                        "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
-                        GNUNET_i2s (&vpn->peer),
-                        vname,
-                        (int) af,
-                        (int) ntohs (vpn->proto));
-            vpn_ctx = GNUNET_new (struct VpnContext);
-            rh->vpn_ctx = vpn_ctx;
-            vpn_ctx->rh = rh;
-            vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                                       rd);
-            if (vpn_ctx->rd_data_size < 0)
-            {
-              GNUNET_break_op (0);
-              GNUNET_free (vpn_ctx);
-              fail_resolution (rh);
-              return;
-            }
-            vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
-            vpn_ctx->rd_count = rd_count;
-            GNUNET_assert (vpn_ctx->rd_data_size ==
-                           GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                               rd,
-                                                               (size_t) vpn_ctx
-                                                               ->rd_data_size,
-                                                               vpn_ctx->rd_data));
-            vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
-                                                                af,
-                                                                ntohs (
-                                                                  vpn->proto),
-                                                                &vpn->peer,
-                                                                &vhash,
-                                                                GNUNET_TIME_relative_to_absolute (
-                                                                  VPN_TIMEOUT),
-                                                                &
-                                                                vpn_allocation_cb,
-                                                                vpn_ctx);
-            return;
-          }
        case GNUNET_GNSRECORD_TYPE_GNS2DNS:
          {
            /* delegation to DNS */
@@ -2117,6 +1999,23 @@ handle_gns_resolution_result (void *cls,
         so we can free it afterwards. */
      switch (rd[i].record_type)
      {
+      case GNUNET_GNSRECORD_TYPE_REDIRECT:
+        {
+          char *rname;
+          rname = GNUNET_strndup (rd[i].data, rd[i].data_size);
+          rname = translate_dot_plus (rh, rname);
+          GNUNET_break (NULL != rname);
+          scratch_start = scratch_off;
+          memcpy (&scratch[scratch_start], rname, strlen (rname) + 1);
+          scratch_off += strlen (rname) + 1;
+          GNUNET_assert (rd_off < rd_count);
+          rd_new[rd_off].data = &scratch[scratch_start];
+          rd_new[rd_off].data_size = scratch_off - scratch_start;
+          rd_off++;
+          GNUNET_free (rname);
+        }
+        break;
      case GNUNET_DNSPARSER_TYPE_CNAME:
        {
          char *cname;
@@ -2380,6 +2279,12 @@ handle_gns_resolution_result (void *cls,
  switch (rd[0].record_type)
  {
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
+    GNUNET_break_op (1 == rd_count);  /* REDIRECT should be unique */
+    recursive_redirect_resolution (rh,
+                                   &rd[0]);
+    return;
  case GNUNET_DNSPARSER_TYPE_CNAME:
    GNUNET_break_op (1 == rd_count);  /* CNAME should be unique */
    recursive_cname_resolution (rh,
@@ -2393,15 +2298,21 @@ handle_gns_resolution_result (void *cls,
                               &rd[0]);
    return;
-  default:
+  case GNUNET_GNSRECORD_TYPE_GNS2DNS:
    if (GNUNET_OK ==
        recursive_gns2dns_resolution (rh,
                                      rd_count,
                                      rd))
      return;
    break;
+  default:
+    if (GNUNET_YES != GNUNET_GNSRECORD_is_critical (rd[0].record_type))
+      return;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Unable to process critical delegation record\n"));
+    break;
  }
-fail:
+  fail:
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              _ ("GNS lookup recursion failed (no delegation record found)\n"));
  fail_resolution (rh);
@@ -2618,6 +2529,13 @@ handle_namecache_block_response (void *cls,
  GNUNET_assert (NULL != rh->namecache_qe);
  rh->namecache_qe = NULL;
+  if (NULL == block)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "No block found\n");
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got block with expiration %s\n",
+                GNUNET_STRINGS_absolute_time_to_string (GNUNET_GNSRECORD_block_get_expiration (block)));
  if (((GNUNET_GNS_LO_DEFAULT == rh->options) ||
       ((GNUNET_GNS_LO_LOCAL_MASTER == rh->options) &&
        (ac != rh->ac_head))) &&
@@ -2916,7 +2834,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
 {
  struct DnsResult *dr;
  struct AuthorityChain *ac;
-  struct VpnContext *vpn_ctx;
  GNUNET_CONTAINER_DLL_remove (rlh_head,
                               rlh_tail,
@@ -2981,12 +2898,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
    GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
    rh->dht_heap_node = NULL;
  }
-  if (NULL != (vpn_ctx = rh->vpn_ctx))
-  {
-    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
-    GNUNET_free (vpn_ctx->rd_data);
-    GNUNET_free (vpn_ctx);
-  }
  if (NULL != rh->namecache_qe)
  {
    GNUNET_NAMECACHE_cancel (rh->namecache_qe);
@@ -3046,7 +2957,6 @@ GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
  if (GNUNET_YES == disable_cache)
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Namecache disabled\n");
-  vpn_handle = GNUNET_VPN_connect (cfg);
 }
@@ -3077,8 +2987,6 @@ GNS_resolver_done ()
  }
  GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
  dht_lookup_heap = NULL;
-  GNUNET_VPN_disconnect (vpn_handle);
-  vpn_handle = NULL;
  dht_handle = NULL;
  namecache_handle = NULL;
 }
diff --git a/src/gns/plugin_block_gns.c b/src/gns/plugin_block_gns.c
index 407754a8c..fd9c99cb4 100644
--- a/src/gns/plugin_block_gns.c
+++ b/src/gns/plugin_block_gns.c
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2010-2013 GNUnet e.V.
+     Copyright (C) 2010-2013, 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -92,98 +92,16 @@ block_plugin_gns_create_group (void *cls,
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg block group to use for evaluation
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on @a type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_gns_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *bg,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_HashCode h;
-  struct GNUNET_HashCode chash;
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  if (NULL == reply_block)
-  {
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  }
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_GNSRECORD_query_from_block (block,
-                                     &h);
-  if (0 != GNUNET_memcmp (&h, query))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  if (GNUNET_OK !=
-      GNUNET_GNSRECORD_block_verify (block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to obtain the key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
 *
 * @param cls closure
 * @param type block type
 * @param reply_block block to get the key for
 * @param reply_block_size number of bytes in @a reply_block
 * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
- *         (or if extracting a key from a block of this type does not work)
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_get_key (void *cls,
@@ -194,12 +112,18 @@ block_plugin_gns_get_key (void *cls,
 {
  const struct GNUNET_GNSRECORD_Block *block;
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
  {
    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
+    memset (key,
+            0,
+            sizeof (*key));
+    return GNUNET_OK;
  }
  block = reply_block;
  GNUNET_GNSRECORD_query_from_block (block,
@@ -227,8 +151,11 @@ block_plugin_gns_check_query (void *cls,
                              const void *xquery,
                              size_t xquery_size)
 {
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (0 != xquery_size)
  {
    GNUNET_break_op (0);
@@ -243,7 +170,6 @@ block_plugin_gns_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -251,14 +177,16 @@ block_plugin_gns_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_check_block (void *cls,
                              enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_HashCode *query,
                              const void *block,
                              size_t block_size)
 {
  const struct GNUNET_GNSRECORD_Block *gblock;
  
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (block_size < sizeof(struct GNUNET_GNSRECORD_Block))
  {
    GNUNET_break_op (0);
@@ -306,23 +234,16 @@ block_plugin_gns_check_reply (void *cls,
                              const void *reply_block,
                              size_t reply_block_size)
 {
-  const struct GNUNET_GNSRECORD_Block *block;
+  const struct GNUNET_GNSRECORD_Block *block = reply_block;
  struct GNUNET_HashCode chash;
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
  {
-    GNUNET_break_op (0);
+    GNUNET_break (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
  }
+  GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_GNSRECORD_Block));
+  GNUNET_assert (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size);
  GNUNET_CRYPTO_hash (reply_block,
                      reply_block_size,
                      &chash);
@@ -347,7 +268,6 @@ libgnunet_plugin_block_gns_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_gns_evaluate;
  api->get_key = &block_plugin_gns_get_key;
  api->create_group = &block_plugin_gns_create_group;
  api->check_query = &block_plugin_gns_check_query;
diff --git a/src/gns/plugin_gnsrecord_gns.c b/src/gns/plugin_gnsrecord_gns.c
index 391144925..dc7ffa9b2 100644
--- a/src/gns/plugin_gnsrecord_gns.c
+++ b/src/gns/plugin_gnsrecord_gns.c
@@ -64,8 +64,7 @@ gns_value_to_string (void *cls,
    return GNUNET_IDENTITY_public_key_to_string (&pk);
  case GNUNET_GNSRECORD_TYPE_NICK:
-    return GNUNET_strndup (data, data_size);
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
  case GNUNET_GNSRECORD_TYPE_LEHO:
    return GNUNET_strndup (data, data_size);
@@ -133,7 +132,9 @@ gns_value_to_string (void *cls,
      GNUNET_free (ival);
      return box_str;
    }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+    return GNUNET_strdup (_("This is a memento of an older block for internal maintenance."));
+  }
  default:
    return NULL;
  }
@@ -184,16 +185,13 @@ gns_string_to_value (void *cls,
    if (record_type != type)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _("Record type does not match parsed record type\n"));
+                  _ ("Record type does not match parsed record type\n"));
      return GNUNET_SYSERR;
    }
    return GNUNET_OK;
  case GNUNET_GNSRECORD_TYPE_NICK:
-    *data = GNUNET_strdup (s);
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
-    *data_size = strlen (s);
-    return GNUNET_OK;
  case GNUNET_GNSRECORD_TYPE_LEHO:
    *data = GNUNET_strdup (s);
    *data_size = strlen (s);
@@ -301,6 +299,12 @@ gns_string_to_value (void *cls,
      GNUNET_free (bval);
      return GNUNET_OK;
    }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+      *data_size = 0;
+      *data = NULL;
+      return GNUNET_OK;
+    }
  default:
    return GNUNET_SYSERR;
@@ -317,12 +321,16 @@ static struct
  const char *name;
  uint32_t number;
 } gns_name_map[] = { { "PKEY", GNUNET_GNSRECORD_TYPE_PKEY },
-                     { "EDKEY", GNUNET_GNSRECORD_TYPE_PKEY },
+                     { "EDKEY", GNUNET_GNSRECORD_TYPE_EDKEY },
                     { "NICK", GNUNET_GNSRECORD_TYPE_NICK },
                     { "LEHO", GNUNET_GNSRECORD_TYPE_LEHO },
                     { "VPN", GNUNET_GNSRECORD_TYPE_VPN },
                     { "GNS2DNS", GNUNET_GNSRECORD_TYPE_GNS2DNS },
                     { "BOX", GNUNET_GNSRECORD_TYPE_BOX },
+                     { "REDIRECT", GNUNET_GNSRECORD_TYPE_REDIRECT },
+                     /* Tombstones should never be added manually
+                      * so this makes sense, kind of */
+                     { "\u271E", GNUNET_GNSRECORD_TYPE_TOMBSTONE },
                     { NULL, UINT32_MAX } };
@@ -365,6 +373,19 @@ gns_number_to_typename (void *cls, uint32_t type)
 }
+static enum GNUNET_GenericReturnValue
+gns_is_critical (void *cls, uint32_t type)
+{
+  return ((type == GNUNET_GNSRECORD_TYPE_PKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_EDKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_GNS2DNS) ||
+          (type == GNUNET_GNSRECORD_TYPE_REDIRECT) ?
+          GNUNET_YES : GNUNET_NO);
+}
 /**
 * Entry point for the plugin.
 *
@@ -381,6 +402,7 @@ libgnunet_plugin_gnsrecord_gns_init (void *cls)
  api->string_to_value = &gns_string_to_value;
  api->typename_to_number = &gns_typename_to_number;
  api->number_to_typename = &gns_number_to_typename;
+  api->is_critical = &gns_is_critical;
  return api;
 }
diff --git a/src/gns/test_gns_cname_lookup.sh b/src/gns/test_gns_cname_lookup.sh
deleted file mode 100755
index 3a189e1e2..000000000
--- a/src/gns/test_gns_cname_lookup.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/bin/sh
-# This file is in the public domain.
-trap "gnunet-arm -e -c test_gns_lookup.conf" INT
-LOCATION=$(which gnunet-config)
-if [ -z $LOCATION ]
-then
-  LOCATION="gnunet-config"
-fi
-$LOCATION --version 1> /dev/null
-if test $? != 0
-then
-        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
-        exit 77
-fi
-# permissive DNS resolver we will use for the test
-DNS_RESOLVER="8.8.8.8"
-if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
-then
-  echo "Cannot reach DNS, skipping test"
-  exit 77
-fi
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-TEST_IP_PLUS="127.0.0.1"
-TEST_IP_DNS="131.159.74.67"
-TEST_RECORD_CNAME_SERVER="server"
-TEST_RECORD_CNAME_PLUS="server.+"
-TEST_RECORD_CNAME_DNS="gnunet.org"
-TEST_RECORD_NAME_SERVER="server"
-TEST_RECORD_NAME_PLUS="www"
-TEST_RECORD_NAME_ZKEY="www2"
-TEST_RECORD_NAME_DNS="www3"
-MY_EGO="myego"
-TEST_DOMAIN_PLUS="www.$MY_EGO"
-TEST_DOMAIN_ZKEY="www2.$MY_EGO"
-TEST_DOMAIN_DNS="www3.$MY_EGO"
-which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
-gnunet-arm -s -c test_gns_lookup.conf
-gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
-MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
-TEST_RECORD_CNAME_ZKEY="server.${MY_EGO_PKEY}"
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-RES_CNAME=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
-RES_CNAME_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t CNAME -c test_gns_lookup.conf`
-RES_CNAME_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
-RES_CNAME_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
-TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
-gnunet-arm -e -c test_gns_lookup.conf
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-# make cmp case-insensitive by converting to lower case first
-RES_CNAME_RAW=`echo $RES_CNAME_RAW | tr [A-Z] [a-z]`
-TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
-if [ "$RES_CNAME_RAW" = "server.$TESTEGOZONE" ]
-then
-  echo "PASS: CNAME resolution from GNS"
-else
-  echo "FAIL: CNAME resolution from GNS, got $RES_CNAME_RAW, expected server.$TESTEGOZONE."
-  exit 1
-fi
-if [ "$RES_CNAME" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.+)"
-else
-  echo "FAIL: IP resolution from GNS (.+), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-if [ "$RES_CNAME_ZKEY" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.zkey)"
-else
-  echo "FAIL: IP resolution from GNS (.zkey), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-if echo "$RES_CNAME_DNS" | grep "$TEST_IP_DNS" > /dev/null
-then
-  echo "PASS: IP resolution from DNS"
-  exit 0
-else
-  echo "FAIL: IP resolution from DNS, got $RES_CNAME_DNS, expected $TEST_IP_DNS."
-  exit 1
-fi
diff --git a/src/gns/test_gns_gns2dns_cname_lookup.sh b/src/gns/test_gns_gns2dns_cname_lookup.sh
index ce1afacf4..9315f6b2f 100755
--- a/src/gns/test_gns_gns2dns_cname_lookup.sh
+++ b/src/gns/test_gns_gns2dns_cname_lookup.sh
@@ -16,9 +16,11 @@ fi
 rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IPALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # main label used during resolution
 TEST_RECORD_NAME="homepage"
@@ -46,7 +48,7 @@ TEST_DOMAIN="www.${TEST_RECORD_NAME}.$MY_EGO"
 which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 gnunet-arm -s -c test_gns_lookup.conf
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
@@ -59,6 +61,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS2 -e never -c test_gns_lookup.conf
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS3 -e never -c test_gns_lookup.conf
+gnunet-namestore -z $MY_EGO -D -c test_gns_lookup.conf
 echo "EGOs:"
 gnunet-identity -d
diff --git a/src/gns/test_gns_gns2dns_lookup.sh b/src/gns/test_gns_gns2dns_lookup.sh
index dcad594b3..240e441a4 100755
--- a/src/gns/test_gns_gns2dns_lookup.sh
+++ b/src/gns/test_gns_gns2dns_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
@@ -49,7 +51,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 gnunet-arm -s -c test_gns_lookup.conf
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
@@ -69,7 +71,7 @@ gnunet-identity -d
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -91,7 +93,7 @@ else
  ret=1
 fi
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
  echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -99,7 +101,7 @@ else
  ret=1
 fi
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
  echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_gns2dns_zkey_lookup.sh b/src/gns/test_gns_gns2dns_zkey_lookup.sh
index 1f8e34c42..a299c34b6 100755
--- a/src/gns/test_gns_gns2dns_zkey_lookup.sh
+++ b/src/gns/test_gns_gns2dns_zkey_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'www.gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
@@ -46,7 +48,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 gnunet-arm -s -c test_gns_lookup.conf
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
@@ -66,7 +68,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -88,7 +90,7 @@ else
  ret=1
 fi
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
  echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -96,7 +98,7 @@ else
  ret=1
 fi
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
  echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_redirect_lookup.sh b/src/gns/test_gns_redirect_lookup.sh
new file mode 100755
index 000000000..dfe5087ef
--- /dev/null
+++ b/src/gns/test_gns_redirect_lookup.sh
@@ -0,0 +1,100 @@
+#!/bin/sh
+# This file is in the public domain.
+trap "gnunet-arm -e -c test_gns_lookup.conf" INT
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+        exit 77
+fi
+# permissive DNS resolver we will use for the test
+DNS_RESOLVER="8.8.8.8"
+if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
+then
+  echo "Cannot reach DNS, skipping test"
+  exit 77
+fi
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+TEST_IP_PLUS="127.0.0.1"
+TEST_IP_DNS="131.159.74.67"
+TEST_RECORD_REDIRECT_SERVER="server"
+TEST_RECORD_REDIRECT_PLUS="server.+"
+TEST_RECORD_REDIRECT_DNS="gnunet.org"
+TEST_RECORD_NAME_SERVER="server"
+TEST_RECORD_NAME_PLUS="www"
+TEST_RECORD_NAME_ZKEY="www2"
+TEST_RECORD_NAME_DNS="www3"
+MY_EGO="myego"
+TEST_DOMAIN_PLUS="www.$MY_EGO"
+TEST_DOMAIN_ZKEY="www2.$MY_EGO"
+TEST_DOMAIN_DNS="www3.$MY_EGO"
+which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
+gnunet-arm -s -c test_gns_lookup.conf
+gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
+MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
+TEST_RECORD_REDIRECT_ZKEY="server.${MY_EGO_PKEY}"
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -D -z $MY_EGO
+RES_REDIRECT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
+RES_REDIRECT_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t REDIRECT -c test_gns_lookup.conf`
+RES_REDIRECT_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
+RES_REDIRECT_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
+TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
+gnunet-arm -e -c test_gns_lookup.conf
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+# make cmp case-insensitive by converting to lower case first
+RES_REDIRECT_RAW=`echo $RES_REDIRECT_RAW | tr [A-Z] [a-z]`
+TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
+if [ "$RES_REDIRECT_RAW" = "server.$TESTEGOZONE" ]
+then
+  echo "PASS: REDIRECT resolution from GNS"
+else
+  echo "FAIL: REDIRECT resolution from GNS, got $RES_REDIRECT_RAW, expected server.$TESTEGOZONE."
+  exit 1
+fi
+if [ "$RES_REDIRECT" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.+)"
+else
+  echo "FAIL: IP resolution from GNS (.+), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+if [ "$RES_REDIRECT_ZKEY" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.zkey)"
+else
+  echo "FAIL: IP resolution from GNS (.zkey), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+if echo "$RES_REDIRECT_DNS" | grep "$TEST_IP_DNS" > /dev/null
+then
+  echo "PASS: IP resolution from DNS"
+  exit 0
+else
+  echo "FAIL: IP resolution from DNS, got $RES_REDIRECT_DNS, expected $TEST_IP_DNS."
+  exit 1
+fi
diff --git a/src/gnsrecord/Makefile.am b/src/gnsrecord/Makefile.am
index 4308d9c1a..e2538b1a2 100644
--- a/src/gnsrecord/Makefile.am
+++ b/src/gnsrecord/Makefile.am
@@ -20,7 +20,6 @@ check_PROGRAMS = \
 test_gnsrecord_crypto \
 test_gnsrecord_serialization \
 test_gnsrecord_block_expiration \
- test_gnsrecord_testvectors \
 perf_gnsrecord_crypto
 if ENABLE_TEST_RUN
@@ -35,7 +34,8 @@ lib_LTLIBRARIES = \
  libgnunetgnsrecordjson.la
 gnunet_gnsrecord_tvg_SOURCES = \
- gnunet-gnsrecord-tvg.c
+ gnunet-gnsrecord-tvg.c \
+ gnsrecord_crypto.h
 gnunet_gnsrecord_tvg_LDADD = \
  $(top_builddir)/src/util/libgnunetutil.la \
  $(top_builddir)/src/identity/libgnunetidentity.la \
@@ -86,13 +86,13 @@ libgnunet_plugin_gnsrecord_dns_la_LDFLAGS = \
 EXTRA_DIST = \
  $(check_SCRIPTS)
-test_gnsrecord_testvectors_SOURCES = \
+#test_gnsrecord_testvectors_SOURCES = \
- test_gnsrecord_testvectors.c
+# test_gnsrecord_testvectors.c
-test_gnsrecord_testvectors_LDADD = \
+#test_gnsrecord_testvectors_LDADD = \
-  $(top_builddir)/src/testing/libgnunettesting.la \
+#  $(top_builddir)/src/testing/libgnunettesting.la \
-        $(top_builddir)/src/identity/libgnunetidentity.la \
+#       $(top_builddir)/src/identity/libgnunetidentity.la \
-  libgnunetgnsrecord.la \
+#  libgnunetgnsrecord.la \
-  $(top_builddir)/src/util/libgnunetutil.la
+#  $(top_builddir)/src/util/libgnunetutil.la
 test_gnsrecord_serialization_SOURCES = \
diff --git a/src/gnsrecord/gnsrecord.c b/src/gnsrecord/gnsrecord.c
index e9994a868..52c480ef6 100644
--- a/src/gnsrecord/gnsrecord.c
+++ b/src/gnsrecord/gnsrecord.c
@@ -260,4 +260,25 @@ GNUNET_GNSRECORD_number_to_typename (uint32_t type)
 }
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type)
+{
+  struct Plugin *plugin;
+  if (GNUNET_GNSRECORD_TYPE_ANY == type)
+    return GNUNET_NO;
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (NULL == plugin->api->is_critical)
+      continue;
+    if (GNUNET_NO == plugin->api->is_critical (plugin->api->cls, type))
+      continue;
+    return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
 /* end of gnsrecord.c */
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index 890ddb011..ff92911de 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -223,7 +223,6 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
-  uint32_t rd_count_nbo;
  struct GNUNET_TIME_Absolute now;
  if (payload_len < 0)
@@ -254,7 +253,6 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
  /* serialize */
  *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
  (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
-  rd_count_nbo = htonl (rd_count);
  {
    char payload[payload_len];
@@ -282,12 +280,12 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                              label,
                              ecblock->expiration_time.abs_value_us__,
                              pkey);
-    GNUNET_break (payload_len ==
+    GNUNET_assert (payload_len ==
-                  ecdsa_symmetric_encrypt (payload,
+                   ecdsa_symmetric_encrypt (payload,
-                                           payload_len,
+                                            payload_len,
-                                           skey,
+                                            skey,
-                                           ctr,
+                                            ctr,
-                                           &ecblock[1]));
+                                            &ecblock[1]));
    GNUNET_memcpy (&gnr_block[1], &ecblock[1], payload_len);
  }
  if (GNUNET_OK !=
@@ -298,8 +296,10 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
    GNUNET_break (0);
    GNUNET_free (*block);
    GNUNET_free (dkey);
+    GNUNET_free (gnr_block);
    return GNUNET_SYSERR;
  }
+  GNUNET_free (gnr_block);
  GNUNET_free (dkey);
  return GNUNET_OK;
 }
@@ -348,7 +348,6 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
  unsigned char nonce[crypto_secretbox_NONCEBYTES];
  unsigned char skey[crypto_secretbox_KEYBYTES];
  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
-  uint32_t rd_count_nbo;
  struct GNUNET_TIME_Absolute now;
  if (payload_len < 0)
@@ -381,7 +380,6 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
                          + payload_len + crypto_secretbox_MACBYTES);
  (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block)
                 + payload_len + crypto_secretbox_MACBYTES);
-  rd_count_nbo = htonl (rd_count);
  {
    char payload[payload_len];
@@ -415,12 +413,12 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
                                 label,
                                 edblock->expiration_time.abs_value_us__,
                                 pkey);
-    GNUNET_break (GNUNET_OK ==
+    GNUNET_assert (GNUNET_OK ==
-                  eddsa_symmetric_encrypt (payload,
+                   eddsa_symmetric_encrypt (payload,
-                                           payload_len,
+                                            payload_len,
-                                           skey,
+                                            skey,
-                                           nonce,
+                                            nonce,
-                                           &edblock[1]));
+                                            &edblock[1]));
    GNUNET_memcpy (&gnr_block[1], &edblock[1],
                   payload_len + crypto_secretbox_MACBYTES);
@@ -438,7 +436,7 @@ GNUNET_GNSRECORD_block_calculate_size (const struct
                                       unsigned int rd_count)
 {
  struct GNUNET_IDENTITY_PublicKey pkey;
-  ssize_t res;
+  ssize_t res = -1;
  GNUNET_IDENTITY_key_get_public (key,
                                  &pkey);
@@ -453,7 +451,7 @@ GNUNET_GNSRECORD_block_calculate_size (const struct
  default:
    GNUNET_assert (0);
  }
-  return -1;
+  return res;
 }
@@ -593,8 +591,9 @@ GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
  purp = GNUNET_malloc (sizeof (struct GNRBlockPS) + payload_len);
  purp->purpose.size = htonl (sizeof (struct GNRBlockPS) + payload_len);
  purp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
-  GNUNET_memcpy (&purp[1], &block[1], payload_len);
+  GNUNET_memcpy (&purp[1],
+                 &block[1],
+                 payload_len);
  switch (ntohl (block->type))
  {
  case GNUNET_GNSRECORD_TYPE_PKEY:
@@ -650,10 +649,10 @@ block_decrypt_ecdsa (const struct GNUNET_GNSRECORD_Block *block,
    char payload[payload_len];
    unsigned int rd_count;
-    GNUNET_break (payload_len ==
+    GNUNET_assert (payload_len ==
-                  ecdsa_symmetric_decrypt (&block[1], payload_len,
+                   ecdsa_symmetric_decrypt (&block[1], payload_len,
-                                           key, ctr,
+                                            key, ctr,
-                                           payload));
+                                            payload));
    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                              payload);
    if (rd_count > 2048)
@@ -754,7 +753,6 @@ block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block,
                     GNUNET_GNSRECORD_RecordCallback proc,
                     void *proc_cls)
 {
-  const struct GNUNET_GNSRECORD_EddsaBlock *edblock = &block->eddsa_block;
  size_t payload_len = ntohl (block->size) - sizeof (struct
                                                     GNUNET_GNSRECORD_Block);
  unsigned char nonce[crypto_secretbox_NONCEBYTES];
@@ -776,10 +774,10 @@ block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block,
    char payload[payload_len];
    unsigned int rd_count;
-    GNUNET_break (GNUNET_OK ==
+    GNUNET_assert (GNUNET_OK ==
-                  eddsa_symmetric_decrypt (&block[1], payload_len,
+                   eddsa_symmetric_decrypt (&block[1], payload_len,
-                                           key, nonce,
+                                            key, nonce,
-                                           payload));
+                                            payload));
    payload_len -= crypto_secretbox_MACBYTES;
    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                              payload);
@@ -909,7 +907,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
                               proc_cls);
    break;
  default:
-    return GNUNET_SYSERR;
+    res = GNUNET_SYSERR;
  }
  GNUNET_free (norm_label);
  return res;
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 61604c730..54d8fb860 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -38,23 +38,26 @@
 #define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
 char *
-GNUNET_GNSRECORD_string_to_lowercase (const char *src)
+GNUNET_GNSRECORD_string_normalize (const char *src)
 {
-  char *res;
+  /*FIXME: We may want to follow RFC5890/RFC5891 */
+  return GNUNET_STRINGS_utf8_normalize (src);
-  res = GNUNET_strdup (src);
-  GNUNET_STRINGS_utf8_tolower (src, res);
-  return res;
 }
-char *
+enum GNUNET_GenericReturnValue
-GNUNET_GNSRECORD_string_normalize (const char *src)
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg)
 {
-  char *res;
+  if (NULL == label)
-  res = GNUNET_strdup (src);
+  {
-  GNUNET_STRINGS_utf8_tolower (src, res);
+    *emsg = GNUNET_strdup (_ ("Label is NULL which is not allowed\n"));
-  GNUNET_STRINGS_utf8_normalize (src, res);
+    return GNUNET_NO;
-  return res;
+  }
+  if (0 != strchr (label, '.'))
+  {
+    *emsg = GNUNET_strdup (_ ("Label  contains `.' which is not allowed\n"));
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
 }
 /**
@@ -144,19 +147,11 @@ GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
 }
-/**
- * Returns the expiration time of the given block of records. The block
- * expiration time is the expiration time of the record with smallest
- * expiration time.
- *
- * @param rd_count number of records given in @a rd
- * @param rd array of records
- * @return absolute expiration time
- */
 struct GNUNET_TIME_Absolute
 GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
                                             const struct
-                                             GNUNET_GNSRECORD_Data *rd)
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min)
 {
  struct GNUNET_TIME_Absolute expire;
  struct GNUNET_TIME_Absolute at;
@@ -164,8 +159,8 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
  struct GNUNET_TIME_Absolute at_shadow;
  struct GNUNET_TIME_Relative rt_shadow;
-  if (NULL == rd)
+  if (0 == rd_count)
-    return GNUNET_TIME_UNIT_ZERO_ABS;
+    return GNUNET_TIME_absolute_max (GNUNET_TIME_UNIT_ZERO_ABS, min);
  expire = GNUNET_TIME_UNIT_FOREVER_ABS;
  for (unsigned int c = 0; c < rd_count; c++)
  {
@@ -202,6 +197,7 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
    expire = GNUNET_TIME_absolute_min (at,
                                       expire);
  }
+  expire = GNUNET_TIME_absolute_max (expire, min);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Determined expiration time for block with %u records to be %s\n",
       rd_count,
@@ -284,12 +280,24 @@ GNUNET_GNSRECORD_identity_from_data (const char *data,
 {
  if (GNUNET_NO == GNUNET_GNSRECORD_is_zonekey_type (type))
    return GNUNET_SYSERR;
-  if (data_size > sizeof (struct GNUNET_IDENTITY_PublicKey))
+  switch (type)
-    return GNUNET_SYSERR;
+  {
-  return (GNUNET_IDENTITY_read_key_from_buffer (key, data, data_size) ==
+  case GNUNET_GNSRECORD_TYPE_PKEY:
-          data_size?
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey))
-          GNUNET_OK :
+      return GNUNET_SYSERR;
-          GNUNET_SYSERR);
+    memcpy (&key->ecdsa_key, data, data_size);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EddsaPublicKey))
+      return GNUNET_SYSERR;
+    memcpy (&key->eddsa_key, data, data_size);
+    break;
+  default:
+    return GNUNET_NO;
+  }
+  key->type = htonl (type);
+  return GNUNET_YES;
 }
@@ -302,16 +310,11 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 {
  char *tmp;
  *type = ntohl (key->type);
-  *data_size = GNUNET_IDENTITY_key_get_length (key);
+  *data_size = GNUNET_IDENTITY_key_get_length (key) - sizeof (key->type);
  if (0 == *data_size)
    return GNUNET_SYSERR;
  tmp = GNUNET_malloc (*data_size);
-  if (GNUNET_IDENTITY_write_key_to_buffer (key, tmp, *data_size)
+  memcpy (tmp, ((char*) key) + sizeof (key->type), *data_size);
-      != *data_size) {
-    GNUNET_free (tmp);
-    *data_size = 0;
-    return GNUNET_SYSERR;
-  }
  *data = tmp;
  return GNUNET_OK;
 }
@@ -406,5 +409,176 @@ GNUNET_GNSRECORD_record_to_identity_key (const struct GNUNET_GNSRECORD_Data *rd,
 }
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct
+                                       GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *
+                                       rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *expiry,
+                                       int include_private,
+                                       char **emsg)
+{
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute minimum_expiration;
+  int have_zone_delegation = GNUNET_NO;
+  int have_gns2dns = GNUNET_NO;
+  int have_other = GNUNET_NO;
+  int have_redirect = GNUNET_NO;
+  int have_empty_label = (0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, label));
+  unsigned int rd_count_tmp;
+  minimum_expiration = GNUNET_TIME_UNIT_ZERO_ABS;
+  now = GNUNET_TIME_absolute_get ();
+  rd_count_tmp = 0;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    /* Ignore the tombstone. For maintenance only. Remember expiration time. */
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+    {
+      minimum_expiration.abs_value_us = rd[i].expiration_time;
+      continue;
+    }
+    /* No NICK records unless empty label */
+    if (have_empty_label &&
+        (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type))
+      continue;
+    /**
+     * Check for delegation and redirect consistency.
+     * Note that we check for consistency BEFORE we filter for
+     * private records ON PURPOSE.
+     * We also want consistent record sets in our local zone(s).
+     * The only exception is the tombstone (above) which we ignore
+     * for the consistency check(s).
+     * FIXME: What about shadow records? Should we ignore them?
+     */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
+    {
+      /* No delegation records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record set contains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_zone_delegation = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[i].record_type)
+    {
+      if (GNUNET_YES == have_redirect)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Multiple REDIRECT records."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set conains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      /* No redirection records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      have_redirect = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_GNS2DNS == rd[i].record_type)
+    {
+      /* No gns2dns records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex.."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_zone_delegation))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set conains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_gns2dns = GNUNET_YES;
+    }
+    else
+    {
+      /* Some other record.
+       * Not allowed for zone delegations or redirections */
+      if ((GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_other = GNUNET_YES;
+    }
+    /* Ignore private records for public record set */
+    if ((GNUNET_NO == include_private) &&
+        (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE)))
+      continue;
+    /* Skip expired records */
+    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
+        (rd[i].expiration_time < now.abs_value_us))
+      continue;     /* record already expired, skip it */
+    rd_public[rd_count_tmp] = rd[i];
+    /* Make sure critical record types are marked as such */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_critical (rd[i].record_type))
+      rd_public[rd_count_tmp].flags |= GNUNET_GNSRECORD_RF_CRITICAL;
+    rd_count_tmp++;
+  }
+  *expiry = GNUNET_GNSRECORD_record_get_expiration_time (rd_count_tmp,
+                                                         rd_public,
+                                                         minimum_expiration);
+  *rd_count_public = rd_count_tmp;
+  return GNUNET_OK;
+}
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_convert_records_for_export (const char *label,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             unsigned int rd_count,
+                                             struct GNUNET_GNSRECORD_Data *
+                                             rd_public,
+                                             unsigned int *rd_count_public,
+                                             struct GNUNET_TIME_Absolute *expiry,
+                                             char **emsg)
+{
+  return GNUNET_GNSRECORD_normalize_record_set (label,
+                                                rd,
+                                                rd_count,
+                                                rd_public,
+                                                rd_count_public,
+                                                expiry,
+                                                GNUNET_NO,
+                                                emsg);
+}
 /* end of gnsrecord_misc.c */
diff --git a/src/gnsrecord/gnunet-gnsrecord-tvg.c b/src/gnsrecord/gnunet-gnsrecord-tvg.c
index f9b83e48b..87de32066 100644
--- a/src/gnsrecord/gnunet-gnsrecord-tvg.c
+++ b/src/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -33,9 +33,6 @@
 #include <inttypes.h>
 #include "gnsrecord_crypto.h"
-#define TEST_RECORD_LABEL "test"
-#define TEST_RECORD_A "1.2.3.4"
-#define TEST_RRCOUNT 2
 static char *d_pkey =
  "50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
@@ -43,7 +40,9 @@ static char *d_pkey =
 static char *d_edkey =
  "5af7020ee19160328832352bbc6a68a8d71a7cbe1b929969a7c66d415a0d8f65";
-int parsehex (char *src, char *dst, size_t dstlen, int invert)
+static int
+parsehex (char *src, char *dst, size_t dstlen, int invert)
 {
  char *line = src;
  char *data = line;
@@ -83,6 +82,7 @@ print_bytes_ (void *buf,
  printf ("\n");
 }
 static void
 print_bytes (void *buf,
             size_t buf_len,
@@ -95,7 +95,7 @@ print_bytes (void *buf,
 static void
 print_record (const struct GNUNET_GNSRECORD_Data *rd)
 {
+  uint16_t flags = htons (rd->flags);
  fprintf (stdout,
           "EXPIRATION: %" PRIu64 "\n", rd->expiration_time);
  fprintf (stdout,
@@ -103,7 +103,9 @@ print_record (const struct GNUNET_GNSRECORD_Data *rd)
  fprintf (stdout,
           "TYPE: %d\n", rd->record_type);
  fprintf (stdout,
-           "FLAGS: %d\n", rd->flags);
+           "FLAGS: ");
+  print_bytes ((void*) &flags, sizeof (flags), 8);
+  printf ("\n");
  fprintf (stdout,
           "DATA:\n");
  print_bytes ((char*) rd->data, rd->data_size, 8);
@@ -120,15 +122,9 @@ print_record (const struct GNUNET_GNSRECORD_Data *rd)
 * @param cfg configuration
 */
 static void
-run_pkey (void)
+run_pkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char *label)
 {
-  struct GNUNET_GNSRECORD_Data rd[2];
  struct GNUNET_TIME_Absolute expire;
-  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
-  struct GNUNET_TIME_Absolute exp1;
-  struct GNUNET_TIME_Absolute exp2;
-  struct GNUNET_TIME_Relative delta1;
-  struct GNUNET_TIME_Relative delta2;
  struct GNUNET_GNSRECORD_Block *rrblock;
  char *bdata;
  struct GNUNET_IDENTITY_PrivateKey id_priv;
@@ -136,24 +132,12 @@ run_pkey (void)
  struct GNUNET_IDENTITY_PrivateKey pkey_data_p;
  struct GNUNET_IDENTITY_PublicKey pkey_data;
  struct GNUNET_HashCode query;
-  void *data;
-  size_t data_size;
  char *rdata;
  size_t rdata_size;
-  uint32_t rd_count_nbo;
  char ztld[128];
  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
-  /*
-   * Make two different expiration times
-   */
-  GNUNET_STRINGS_fancy_time_to_absolute ("2048-01-23 10:51:34",
-                                         &exp1);
-  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
-                                         &exp2);
  id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
  parsehex (d_pkey,
@@ -168,13 +152,14 @@ run_pkey (void)
                sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey), 8, 1);
  fprintf (stdout, "\n");
  fprintf (stdout, "Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
  print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
  GNUNET_STRINGS_data_to_string (&id_pub,
                                 GNUNET_IDENTITY_key_get_length (&id_pub),
                                 ztld,
                                 sizeof (ztld));
  fprintf (stdout, "\n");
-  fprintf (stdout, "Encoded zone identifier (zkl = zTLD):\n");
+  fprintf (stdout, "zTLD:\n");
  fprintf (stdout, "%s\n", ztld);
  fprintf (stdout, "\n");
@@ -183,39 +168,31 @@ run_pkey (void)
  GNUNET_IDENTITY_key_get_public (&pkey_data_p,
                                  &pkey_data);
  fprintf (stdout,
-           "Label: %s\nRRCOUNT: %d\n\n", TEST_RECORD_LABEL, TEST_RRCOUNT);
+           "Label: %s\nRRCOUNT: %d\n\n", label, rd_count);
-  memset (rd, 0, sizeof (struct GNUNET_GNSRECORD_Data) * 2);
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
-                   GNUNET_DNSPARSER_TYPE_A, TEST_RECORD_A, &data, &data_size));
-  rd[0].data = data;
-  rd[0].data_size = data_size;
-  rd[0].expiration_time = exp1.abs_value_us;
-  rd[0].record_type = GNUNET_DNSPARSER_TYPE_A;
-  fprintf (stdout, "Record #0\n");
-  print_record (&rd[0]);
-  rd[1].data = "Some nick";
+  for (int i = 0; i < rd_count; i++)
-  rd[1].data_size = sizeof (struct GNUNET_IDENTITY_PublicKey);
+  {
-  rd[1].expiration_time = exp2.abs_value_us;
+    fprintf (stdout, "Record #%d\n", i);
-  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
+    print_record (&rd[i]);
-  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+  }
-  fprintf (stdout, "Record #1\n");
-  print_record (&rd[1]);
-  rdata_size = GNUNET_GNSRECORD_records_get_size (TEST_RRCOUNT,
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                  rd);
  rdata = GNUNET_malloc (rdata_size);
-  GNUNET_GNSRECORD_records_serialize (2,
+  GNUNET_GNSRECORD_records_serialize (rd_count,
                                      rd,
-                                      rdata_size,
+                                      (size_t) rdata_size,
                                      rdata);
  fprintf (stdout, "RDATA:\n");
-  print_bytes (rdata, rdata_size, 8);
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
  fprintf (stdout, "\n");
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (TEST_RRCOUNT, rd);
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count, rd,
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
  GNR_derive_block_aes_key (ctr,
                            skey,
-                            TEST_RECORD_LABEL,
+                            label,
                            GNUNET_TIME_absolute_hton (
                              expire).abs_value_us__,
                            &id_pub.ecdsa_key);
@@ -227,25 +204,26 @@ run_pkey (void)
  print_bytes (skey, sizeof (skey), 8);
  fprintf (stdout, "\n");
  GNUNET_GNSRECORD_query_from_public_key (&id_pub,
-                                          TEST_RECORD_LABEL,
+                                          label,
                                          &query);
  fprintf (stdout, "Storage key (q):\n");
  print_bytes (&query, sizeof (query), 8);
  fprintf (stdout, "\n");
  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (&id_priv,
                                                             expire,
-                                                             TEST_RECORD_LABEL,
+                                                             label,
                                                             rd,
-                                                             TEST_RRCOUNT,
+                                                             rd_count,
                                                             &rrblock));
-  size_t bdata_size = ntohl(rrblock->size) - sizeof (struct GNUNET_GNSRECORD_Block);
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
  bdata = (char*) &(&rrblock->ecdsa_block)[1];
  fprintf (stdout, "BDATA:\n");
  print_bytes (bdata, bdata_size, 8);
  fprintf (stdout, "\n");
  fprintf (stdout, "RRBLOCK:\n");
-  print_bytes (rrblock, ntohl(rrblock->size), 8);
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
  fprintf (stdout, "\n");
  GNUNET_free (rdata);
 }
@@ -260,15 +238,9 @@ run_pkey (void)
 * @param cfg configuration
 */
 static void
-run_edkey (void)
+run_edkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char*label)
 {
-  struct GNUNET_GNSRECORD_Data rd[2];
  struct GNUNET_TIME_Absolute expire;
-  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
-  struct GNUNET_TIME_Absolute exp1;
-  struct GNUNET_TIME_Absolute exp2;
-  struct GNUNET_TIME_Relative delta1;
-  struct GNUNET_TIME_Relative delta2;
  struct GNUNET_GNSRECORD_Block *rrblock;
  char *bdata;
  struct GNUNET_IDENTITY_PrivateKey id_priv;
@@ -276,23 +248,13 @@ run_edkey (void)
  struct GNUNET_IDENTITY_PrivateKey pkey_data_p;
  struct GNUNET_IDENTITY_PublicKey pkey_data;
  struct GNUNET_HashCode query;
-  void *data;
-  size_t data_size;
  char *rdata;
  size_t rdata_size;
-  uint32_t rd_count_nbo;
  char ztld[128];
  unsigned char nonce[crypto_secretbox_NONCEBYTES];
  unsigned char skey[crypto_secretbox_KEYBYTES];
-  /*
-   * Make two different expiration times
-   */
-  GNUNET_STRINGS_fancy_time_to_absolute ("%2048-01-23 10:51:34",
-                                         &exp1);
-  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
-                                         &exp2);
  id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
  GNUNET_IDENTITY_key_get_public (&id_priv,
@@ -311,13 +273,14 @@ run_edkey (void)
                                           GNUNET_CRYPTO_EddsaPrivateKey), 8);
  fprintf (stdout, "\n");
  fprintf (stdout, "Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
  print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
  GNUNET_STRINGS_data_to_string (&id_pub,
                                 GNUNET_IDENTITY_key_get_length (&id_pub),
                                 ztld,
                                 sizeof (ztld));
  fprintf (stdout, "\n");
-  fprintf (stdout, "Encoded zone identifier (zkl = zTLD):\n");
+  fprintf (stdout, "zTLD:\n");
  fprintf (stdout, "%s\n", ztld);
  fprintf (stdout, "\n");
@@ -326,40 +289,33 @@ run_edkey (void)
  GNUNET_IDENTITY_key_get_public (&pkey_data_p,
                                  &pkey_data);
  fprintf (stdout,
-           "Label: %s\nRRCOUNT: %d\n\n", TEST_RECORD_LABEL, TEST_RRCOUNT);
+           "Label: %s\nRRCOUNT: %d\n\n", label, rd_count);
-  memset (rd, 0, sizeof (struct GNUNET_GNSRECORD_Data) * 2);
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
-                   GNUNET_DNSPARSER_TYPE_A, TEST_RECORD_A, &data, &data_size));
-  rd[0].data = data;
-  rd[0].data_size = data_size;
-  rd[0].expiration_time = exp1.abs_value_us;
-  rd[0].record_type = GNUNET_DNSPARSER_TYPE_A;
-  fprintf (stdout, "Record #0\n");
-  print_record (&rd[0]);
-  rd[1].data = "My Nick";
+  for (int i = 0; i < rd_count; i++)
-  rd[1].data_size = sizeof (struct GNUNET_IDENTITY_PublicKey);
+  {
-  rd[1].expiration_time = exp2.abs_value_us;
+    fprintf (stdout, "Record #%d\n", i);
-  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
+    print_record (&rd[i]);
-  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+  }
-  fprintf (stdout, "Record #1\n");
-  print_record (&rd[1]);
-  rdata_size = GNUNET_GNSRECORD_records_get_size (TEST_RRCOUNT,
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                  rd);
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (TEST_RRCOUNT,
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count,
-                                                        rd);
+                                                        rd,
-  rdata = GNUNET_malloc (rdata_size);
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
-  GNUNET_GNSRECORD_records_serialize (2,
+  GNUNET_assert (0 < rdata_size);
+  rdata = GNUNET_malloc ((size_t) rdata_size);
+  GNUNET_GNSRECORD_records_serialize (rd_count,
                                      rd,
-                                      rdata_size,
+                                      (size_t) rdata_size,
                                      rdata);
  fprintf (stdout, "RDATA:\n");
-  print_bytes (rdata, rdata_size, 8);
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
  fprintf (stdout, "\n");
  GNR_derive_block_xsalsa_key (nonce,
                               skey,
-                               TEST_RECORD_LABEL,
+                               label,
                               GNUNET_TIME_absolute_hton (
                                 expire).abs_value_us__,
                               &id_pub.eddsa_key);
@@ -370,7 +326,7 @@ run_edkey (void)
  print_bytes (skey, sizeof (skey), 8);
  fprintf (stdout, "\n");
  GNUNET_GNSRECORD_query_from_public_key (&id_pub,
-                                          TEST_RECORD_LABEL,
+                                          label,
                                          &query);
  fprintf (stdout, "Storage key (q):\n");
  print_bytes (&query, sizeof (query), 8);
@@ -378,18 +334,19 @@ run_edkey (void)
  GNUNET_assert (GNUNET_OK ==  GNUNET_GNSRECORD_block_create (&id_priv,
                                                              expire,
-                                                              TEST_RECORD_LABEL,
+                                                              label,
                                                              rd,
-                                                              TEST_RRCOUNT,
+                                                              rd_count,
                                                              &rrblock));
-  size_t bdata_size = ntohl(rrblock->size) - sizeof (struct GNUNET_GNSRECORD_Block);
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
  bdata = (char*) &(&rrblock->eddsa_block)[1];
  fprintf (stdout, "BDATA:\n");
  print_bytes (bdata, bdata_size, 8);
  fprintf (stdout, "\n");
  fprintf (stdout, "RRBLOCK:\n");
-  print_bytes (rrblock, ntohl(rrblock->size), 8);
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
  fprintf (stdout, "\n");
  GNUNET_free (rdata);
 }
@@ -409,8 +366,67 @@ run (void *cls,
     const char *cfgfile,
     const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
-  run_pkey ();
+  struct GNUNET_GNSRECORD_Data rd_pkey;
-  run_edkey ();
+  struct GNUNET_GNSRECORD_Data rd[3];
+  struct GNUNET_TIME_Absolute exp1;
+  struct GNUNET_TIME_Absolute exp2;
+  struct GNUNET_TIME_Relative exp3;
+  size_t pkey_data_size;
+  size_t ip_data_size;
+  char *pkey_data;
+  char *ip_data;
+  /*
+   * Make different expiration times
+   */
+  GNUNET_STRINGS_fancy_time_to_absolute ("2048-01-23 10:51:34",
+                                         &exp1);
+  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
+                                         &exp2);
+  GNUNET_STRINGS_fancy_time_to_relative ("100y",
+                                         &exp3);
+  memset (&rd_pkey, 0, sizeof (struct GNUNET_GNSRECORD_Data));
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_GNSRECORD_TYPE_PKEY,
+                   "000G0011WESGZY9VRV9NNJ66W3GKNZFZF56BFD2BQF3MHMJST2G2GKDYGG",
+                   (void**) &pkey_data,
+                   &pkey_data_size));
+  rd_pkey.data = pkey_data;
+  rd_pkey.data_size = pkey_data_size;
+  rd_pkey.expiration_time = exp1.abs_value_us;
+  rd_pkey.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
+  rd_pkey.flags = GNUNET_GNSRECORD_RF_CRITICAL;
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_DNSPARSER_TYPE_AAAA,
+                   "::dead:beef",
+                   (void**) &ip_data,
+                   &ip_data_size));
+  rd[0].data = ip_data;
+  rd[0].data_size = ip_data_size;
+  rd[0].expiration_time = exp1.abs_value_us;
+  rd[0].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+  rd[0].flags = GNUNET_GNSRECORD_RF_NONE;
+  rd[1].data = "\u611b\u79f0";
+  rd[1].data_size = strlen (rd[1].data);
+  rd[1].expiration_time = exp2.abs_value_us;
+  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
+  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+  rd[2].data = "Hello World";
+  rd[2].data_size = strlen (rd[2].data);
+  rd[2].expiration_time = exp3.rel_value_us;
+  rd[2].record_type = GNUNET_DNSPARSER_TYPE_TXT;
+  rd[2].flags = GNUNET_GNSRECORD_RF_SUPPLEMENTAL
+                | GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+  run_pkey (&rd_pkey, 1, "testdelegation");
+  run_pkey (rd, 3, "namesystem");
+  run_edkey (&rd_pkey, 1, "testdelegation");
+  run_edkey (rd, 3, "namesystem");
 }
diff --git a/src/gnsrecord/perf_gnsrecord_crypto.c b/src/gnsrecord/perf_gnsrecord_crypto.c
index d9a3c20cf..6b5f84235 100644
--- a/src/gnsrecord/perf_gnsrecord_crypto.c
+++ b/src/gnsrecord/perf_gnsrecord_crypto.c
@@ -90,12 +90,12 @@ run (void *cls,
  start_time = GNUNET_TIME_absolute_get ();
  for (unsigned int i = 0; i < ROUNDS; i++)
  {
-    GNUNET_assert (NULL != (block =
+    GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (&privkey,
-                              GNUNET_GNSRECORD_block_create2 (&privkey,
                                                              expire,
                                                              s_name,
                                                              s_rd,
-                                                              RECORDS)));
+                                                              RECORDS,
+                                                              &block));
    GNUNET_GNSRECORD_query_from_private_key (&privkey,
                                             s_name,
                                             &query);
diff --git a/src/gnsrecord/plugin_gnsrecord_dns.c b/src/gnsrecord/plugin_gnsrecord_dns.c
index 123c59905..649133cd1 100644
--- a/src/gnsrecord/plugin_gnsrecord_dns.c
+++ b/src/gnsrecord/plugin_gnsrecord_dns.c
@@ -773,6 +773,12 @@ dns_number_to_typename (void *cls, uint32_t type)
 }
+static enum GNUNET_GenericReturnValue
+dns_is_critical (void *cls, uint32_t type)
+{
+  return GNUNET_NO;
+}
 /**
 * Entry point for the plugin.
 *
@@ -789,6 +795,7 @@ libgnunet_plugin_gnsrecord_dns_init (void *cls)
  api->string_to_value = &dns_string_to_value;
  api->typename_to_number = &dns_typename_to_number;
  api->number_to_typename = &dns_number_to_typename;
+  api->is_critical = &dns_is_critical;
  return api;
 }
diff --git a/src/gnsrecord/test_gnsrecord_block_expiration.c b/src/gnsrecord/test_gnsrecord_block_expiration.c
index b53d7d7e8..d14ce3914 100644
--- a/src/gnsrecord/test_gnsrecord_block_expiration.c
+++ b/src/gnsrecord/test_gnsrecord_block_expiration.c
@@ -72,7 +72,8 @@ run (void *cls, char *const *args, const char *cfgfile,
  GNUNET_assert (expiration_abs.abs_value_us ==
                 GNUNET_GNSRECORD_record_get_expiration_time (2,
-                                                              rd).abs_value_us);
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
  rd[1].expiration_time = expiration_abs_shadow.abs_value_us;
  rd[1].record_type = TEST_RECORD_TYPE;
@@ -83,7 +84,8 @@ run (void *cls, char *const *args, const char *cfgfile,
  GNUNET_assert (expiration_abs_shadow.abs_value_us ==
                 GNUNET_GNSRECORD_record_get_expiration_time (2,
-                                                              rd).abs_value_us);
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
  res = 0;
 }
diff --git a/src/gnsrecord/test_gnsrecord_testvectors.c b/src/gnsrecord/test_gnsrecord_testvectors.c
index 153c56261..bb4922417 100644
--- a/src/gnsrecord/test_gnsrecord_testvectors.c
+++ b/src/gnsrecord/test_gnsrecord_testvectors.c
@@ -10,16 +10,16 @@
 static char *d =
-"50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
+  "50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
 static char *zid =
-"00010000677c477d2d93097c85b195c6f96d84ff61f5982c2c4fe02d5a11fedfb0c2901f";
+  "00010000677c477d2d93097c85b195c6f96d84ff61f5982c2c4fe02d5a11fedfb0c2901f";
 #define RRCOUNT 2
-#define LABEL "test"
+#define LABEL "namesystem"
-#define R0_EXPIRATION 14888744139323793
+#define R0_EXPIRATION 
 #define R0_DATA_SIZE 4
 #define R0_TYPE 1
 #define R0_FLAGS 0
@@ -31,12 +31,12 @@ static char *zid =
 #define R1_TYPE 65536
 #define R1_FLAGS 2
 #define R1_DATA \
-"000100000e601be42eb57fb4697610cf3a3b18347b65a33f025b5b174abefb30807bfecf"
+  "000100000e601be42eb57fb4697610cf3a3b18347b65a33f025b5b174abefb30807bfecf"
 #define R1_RRBLOCK \
-"000100008e16da87203b5159c5538e9b765742e968c54af9afbc0890dc80205ad14c84e107b0c115fc0089aa38b9c7ab9cbe1d77040d282a51a2ad493f61f3495f02d8170fe473a55ec6bdf9a509ab1701ffc37ea3bb4cac4a672520986df96e67cc1a73000000940000000f0034e53be193799100e4837eb5d04f92903de4b5234e8ccac5736c9793379a59c33375fc8951aca2eb7aad067bf9af60bf26758646a17f5e5c3b6215f94079545b1c4d4f1b2ebb22c2b4dad44126817b6f001530d476401dd67ac0148554e806353da9e4298079f3e1b16942c48d90c4360c61238c40d9d52911aea52cc0037ac7160bb3cf5b2f4a722fd96b"
+  "000100008e16da87203b5159c5538e9b765742e968c54af9afbc0890dc80205ad14c84e107b0c115fc0089aa38b9c7ab9cbe1d77040d282a51a2ad493f61f3495f02d8170fe473a55ec6bdf9a509ab1701ffc37ea3bb4cac4a672520986df96e67cc1a73000000940000000f0034e53be193799100e4837eb5d04f92903de4b5234e8ccac5736c9793379a59c33375fc8951aca2eb7aad067bf9af60bf26758646a17f5e5c3b6215f94079545b1c4d4f1b2ebb22c2b4dad44126817b6f001530d476401dd67ac0148554e806353da9e4298079f3e1b16942c48d90c4360c61238c40d9d52911aea52cc0037ac7160bb3cf5b2f4a722fd96b"
-int parsehex(char *src, char *dst, size_t dstlen, int invert)
+int parsehex (char *src, char *dst, size_t dstlen, int invert)
 {
  char *line = src;
  char *data = line;
@@ -44,7 +44,8 @@ int parsehex(char *src, char *dst, size_t dstlen, int invert)
  int read_byte;
  int data_len = 0;
-  while (sscanf(data, " %02x%n", &read_byte, &off) == 1) {
+  while (sscanf (data, " %02x%n", &read_byte, &off) == 1)
+  {
    if (invert)
      dst[dstlen - 1 - data_len++] = read_byte;
    else
@@ -62,8 +63,8 @@ res_checker (void *cls,
  int r1_found = 0;
  char r0_data[R0_DATA_SIZE];
  char r1_data[R1_DATA_SIZE];
-  parsehex(R0_DATA, (char*)r0_data, 0, 0);
+  parsehex (R0_DATA, (char*) r0_data, 0, 0);
-  parsehex(R1_DATA, (char*)r1_data, 0, 0);
+  parsehex (R1_DATA, (char*) r1_data, 0, 0);
  GNUNET_assert (rd_count == RRCOUNT);
  for (int i = 0; i < RRCOUNT; i++)
  {
@@ -104,7 +105,7 @@ res_checker (void *cls,
 int
-main()
+main ()
 {
  struct GNUNET_IDENTITY_PrivateKey priv;
  struct GNUNET_IDENTITY_PublicKey pub;
@@ -112,13 +113,15 @@ main()
  struct GNUNET_GNSRECORD_Block *rrblock;
  char *bdata;
-  parsehex(d,(char*)&priv.ecdsa_key, sizeof (priv.ecdsa_key), 1);
+  parsehex (d,(char*) &priv.ecdsa_key, sizeof (priv.ecdsa_key), 1);
  priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
-  parsehex(zid,(char*)&pub_parsed, 0, 0);
+  parsehex (zid,(char*) &pub_parsed, 0, 0);
-  GNUNET_IDENTITY_key_get_public(&priv, &pub);
+  GNUNET_IDENTITY_key_get_public (&priv, &pub);
  GNUNET_assert (0 == memcmp (&pub, &pub_parsed, sizeof (pub)));
  rrblock = GNUNET_malloc (strlen (R1_RRBLOCK) / 2);
-  parsehex(R1_RRBLOCK, (char*)rrblock, 0, 0);
+  parsehex (R1_RRBLOCK, (char*) rrblock, 0, 0);
+  GNUNET_assert (GNUNET_YES
+                 == GNUNET_GNSRECORD_is_critical (GNUNET_GNSRECORD_TYPE_PKEY));
  GNUNET_GNSRECORD_block_decrypt (rrblock,
                                  &pub_parsed,
                                  LABEL,
diff --git a/src/hello/.gitignore b/src/hello/.gitignore
index bb49ceb20..d175d148e 100644
--- a/src/hello/.gitignore
+++ b/src/hello/.gitignore
@@ -1,3 +1,5 @@
 gnunet-hello
 test_friend_hello
 test_hello
+test_hello-uri
+test_hello-ng
diff --git a/src/hello/Makefile.am b/src/hello/Makefile.am
index 6a250e42f..c04b85106 100644
--- a/src/hello/Makefile.am
+++ b/src/hello/Makefile.am
@@ -11,7 +11,8 @@ lib_LTLIBRARIES = libgnunethello.la
 libgnunethello_la_SOURCES = \
  hello.c \
  address.c \
-  hello-ng.c
+  hello-ng.c \
+  hello-uri.c
 libgnunethello_la_LIBADD = \
 $(top_builddir)/src/util/libgnunetutil.la $(XLIB) \
 $(LTLIBINTL)
@@ -24,6 +25,7 @@ noinst_PROGRAMS = \
 check_PROGRAMS = \
 test_hello \
+ test_hello-uri \
 test_friend_hello \
 test_hello-ng
@@ -36,25 +38,32 @@ test_hello_SOURCES = \
 test_hello.c
 test_hello_LDADD = \
 libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 test_hello_ng_SOURCES = \
 test_hello-ng.c
 test_hello_ng_LDADD = \
 libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
+test_hello_uri_SOURCES = \
+ test_hello-uri.c
+test_hello_uri_LDADD = \
+ libgnunethello.la \
+ $(top_builddir)/src/util/libgnunetutil.la \
+ -lgcrypt
 test_friend_hello_SOURCES = \
 test_friend_hello.c
 test_friend_hello_LDADD = \
 libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 gnunet_hello_SOURCES = \
 gnunet-hello.c
 gnunet_hello_LDADD = \
 libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 gnunet_hello_LDFLAGS = \
  $(GN_LIBINTL)
diff --git a/src/hello/hello-uri.c b/src/hello/hello-uri.c
new file mode 100644
index 000000000..bacaf697e
--- /dev/null
+++ b/src/hello/hello-uri.c
@@ -0,0 +1,891 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file hello/hello-uri.c
+ * @brief helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ *
+ * Note:
+ * - Current API does not support deserializing HELLO of
+ *   another peer and then serializing it into another
+ *   format (we always require the private key).
+ *   Not sure if we need this, but if we do, we need
+ *   to extend the builder and the API.
+ * - Current API does not allow overriding the default
+ *   HELLO expiration time. We may want to add a function
+ *   that does this to create bootstrap HELLOs shipped with
+ *   the TGZ.
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_util_lib.h"
+GNUNET_NETWORK_STRUCT_BEGIN
+/**
+ * Message signed as part of a HELLO block/URL.
+ */
+struct HelloSignaturePurpose
+{
+  /**
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_HELLO
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+  /**
+   * When does the signature expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+  /**
+   * Hash over all addresses.
+   */
+  struct GNUNET_HashCode h_addrs;
+};
+/**
+ * Message used when gossiping HELLOs between peers.
+ */
+struct HelloUriMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_HELLO_URI
+   */
+  struct GNUNET_MessageHeader header;
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+  /* followed by a 'block' */
+};
+/**
+ * Start of a 'block'.
+ */
+struct BlockHeader
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+};
+/**
+ * Message used when a DHT provides its HELLO to direct
+ * neighbours.
+ */
+struct DhtHelloMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO
+   */
+  struct GNUNET_MessageHeader header;
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+  /* followed by the serialized addresses of the 'block' */
+};
+GNUNET_NETWORK_STRUCT_END
+/**
+ * Address of a peer.
+ */
+struct Address
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *next;
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *prev;
+  /**
+   * Actual URI, allocated at the end of this struct.
+   */
+  const char *uri;
+  /**
+   * Length of @a uri including 0-terminator.
+   */
+  size_t uri_len;
+};
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+  /**
+   * Head of the addresses DLL.
+   */
+  struct Address *a_head;
+  /**
+   * Tail of the addresses DLL.
+   */
+  struct Address *a_tail;
+  /**
+   * Length of the @a a_head DLL.
+   */
+  unsigned int a_length;
+};
+/**
+ * Compute @a hash over addresses in @a builder.
+ *
+ * @param builder the builder to hash addresses of
+ * @param[out] hash where to write the hash
+ */
+static void
+hash_addresses (const struct GNUNET_HELLO_Builder *builder,
+                struct GNUNET_HashCode *hash)
+{
+  struct GNUNET_HashContext *hc;
+  hc = GNUNET_CRYPTO_hash_context_start ();
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_CRYPTO_hash_context_read (hc,
+                                     a->uri,
+                                     a->uri_len);
+  }
+  GNUNET_CRYPTO_hash_context_finish (hc,
+                                     hash);
+}
+/**
+ * Create HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to sign
+ * @param priv key to sign with
+ * @param[out] sig where to write the signature
+ */
+static void
+sign_hello (const struct GNUNET_HELLO_Builder *builder,
+            struct GNUNET_TIME_Timestamp et,
+            const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+            struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et.abs_time)
+  };
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  GNUNET_CRYPTO_eddsa_sign (priv,
+                            &hsp,
+                            sig);
+}
+/**
+ * Verify HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to verify
+ * @param sig signature to verify
+ * @return #GNUNET_OK if everything is ok, #GNUNET_NO if the
+ *    HELLO expired, #GNUNET_SYSERR if the signature is wrong
+ */
+static enum GNUNET_GenericReturnValue
+verify_hello (const struct GNUNET_HELLO_Builder *builder,
+              struct GNUNET_TIME_Absolute et,
+              const struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et)
+  };
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_HELLO,
+                                  &hsp,
+                                  sig,
+                                  &builder->pid.public_key))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_TIME_absolute_is_past (et))
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid)
+{
+  struct GNUNET_HELLO_Builder *builder;
+  builder = GNUNET_new (struct GNUNET_HELLO_Builder);
+  builder->pid = *pid;
+  return builder;
+}
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder)
+{
+  struct Address *a;
+  while (NULL != (a = builder->a_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                                 builder->a_tail,
+                                 a);
+    builder->a_length--;
+    GNUNET_free (a);
+  }
+  GNUNET_assert (0 == builder->a_length);
+  GNUNET_free (builder);
+}
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg)
+{
+  const struct HelloUriMessage *h;
+  uint16_t size = ntohs (msg->size);
+  if (GNUNET_MESSAGE_TYPE_HELLO_URI != ntohs (msg->type))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (sizeof (struct HelloUriMessage) > size)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  h = (const struct HelloUriMessage *) msg;
+  size -= sizeof (*h);
+  return GNUNET_HELLO_builder_from_block (&h[1],
+                                          size);
+}
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size)
+{
+  const struct BlockHeader *bh = block;
+  struct GNUNET_HELLO_Builder *b;
+  if (block_size < sizeof (*bh))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  b = GNUNET_HELLO_builder_new (&bh->pid);
+  block += sizeof (*bh);
+  block_size -= sizeof (*bh);
+  while (block_size > 0)
+  {
+    const void *end = memchr (block,
+                              '\0',
+                              block_size);
+    if (NULL == end)
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          block))
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    end++;
+    block_size -= (end - block);
+    block = end;
+  }
+  {
+    enum GNUNET_GenericReturnValue ret;
+    ret = verify_hello (b,
+                        GNUNET_TIME_absolute_ntoh (bh->expiration_time),
+                        &bh->sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url)
+{
+  const char *q;
+  const char *s1;
+  const char *s2;
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Absolute et;
+  size_t len;
+  struct GNUNET_HELLO_Builder *b;
+  if (0 != strncasecmp (url,
+                        "gnunet://hello/",
+                        strlen ("gnunet://hello/")))
+    return NULL;
+  url += strlen ("gnunet://hello/");
+  s1 = strchr (url, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  s2 = strchr (s1 + 1, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  q = strchr (url, '?');
+  if (NULL == q)
+    q = url + strlen (url);
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (url,
+                                     s1 - url,
+                                     &pid,
+                                     sizeof(pid)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (s1 + 1,
+                                     s2 - (s1 + 1),
+                                     &sig,
+                                     sizeof(sig)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  {
+    unsigned long long sec;
+    char dummy = '?';
+    if ( (0 == sscanf (s2 + 1,
+                       "%llu%c",
+                       &sec,
+                       &dummy)) ||
+         ('?' != dummy) )
+    {
+      GNUNET_break_op (0);
+      return NULL;
+    }
+    et = GNUNET_TIME_absolute_from_s (sec);
+  }
+  b = GNUNET_HELLO_builder_new (&pid);
+  len = strlen (q);
+  while (len > 0)
+  {
+    const char *eq;
+    const char *amp;
+    char *addr = NULL;
+    char *uri;
+    /* skip ?/& separator */
+    len--;
+    q++;
+    eq = strchr (q, '=');
+    if ( (eq == q) ||
+         (NULL == eq) )
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    amp = strchr (eq, '&');
+    if (NULL == amp)
+      amp = &q[len];
+    GNUNET_STRINGS_urldecode (eq + 1,
+                              amp - (eq + 1),
+                              &addr);
+    if ( (NULL == addr) ||
+         (0 == strlen (addr)) )
+    {
+      GNUNET_free (addr);
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_asprintf (&uri,
+                     "%.*s://%s",
+                     (int) (eq - q),
+                     q,
+                     addr);
+    GNUNET_free (addr);
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          uri))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (uri);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_free (uri);
+    /* move to next URL */
+    len -= (amp - q);
+    q = amp;
+  }
+  {
+    enum GNUNET_GenericReturnValue ret;
+    ret = verify_hello (b,
+                        et,
+                        &sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct HelloUriMessage *msg;
+  size_t blen;
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen));
+  env = GNUNET_MQ_msg_extra (msg,
+                             blen,
+                             GNUNET_MESSAGE_TYPE_HELLO_URI);
+  msg->url_counter = htonl ((uint16_t) builder->a_length);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                &msg[1],
+                                                &blen));
+  return env;
+}
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct DhtHelloMessage *msg;
+  size_t blen;
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen));
+  GNUNET_assert (blen < UINT16_MAX);
+  GNUNET_assert (blen >= sizeof (struct BlockHeader));
+  {
+    char buf[blen] GNUNET_ALIGN;
+    const struct BlockHeader *block = (const struct BlockHeader *) buf;
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (builder,
+                                                  priv,
+                                                  buf,
+                                                  &blen));
+    msg = GNUNET_malloc (sizeof (*msg)
+                         + blen
+                         - sizeof (*block));
+    msg->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO);
+    msg->header.size = htons (sizeof (*msg)
+                              + blen
+                              - sizeof (*block));
+    memcpy (&msg[1],
+            &block[1],
+            blen - sizeof (*block));
+    msg->sig = block->sig;
+    msg->expiration_time = block->expiration_time;
+  }
+  msg->url_counter = htonl ((uint16_t) builder->a_length);
+  return &msg->header;
+}
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Timestamp et;
+  char *result;
+  char *pids;
+  char *sigs;
+  const char *sep = "?";
+  et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  sign_hello (builder,
+              et,
+              priv,
+              &sig);
+  pids = GNUNET_STRINGS_data_to_string_alloc (&builder->pid,
+                                              sizeof (builder->pid));
+  sigs = GNUNET_STRINGS_data_to_string_alloc (&sig,
+                                              sizeof (sig));
+  GNUNET_asprintf (&result,
+                   "gnunet://hello/%s/%s/%llu",
+                   pids,
+                   sigs,
+                   (unsigned long long) GNUNET_TIME_timestamp_to_s (et));
+  GNUNET_free (sigs);
+  GNUNET_free (pids);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    char *ue;
+    char *tmp;
+    int pfx_len;
+    const char *eou;
+    eou = strstr (a->uri,
+                  "://");
+    if (NULL == eou)
+    {
+      GNUNET_break (0);
+      GNUNET_free (result);
+      return NULL;
+    }
+    pfx_len = eou - a->uri;
+    eou += 3;
+    GNUNET_STRINGS_urlencode (eou,
+                              a->uri_len - 4 - pfx_len,
+                              &ue);
+    GNUNET_asprintf (&tmp,
+                     "%s%s%.*s=%s",
+                     result,
+                     sep,
+                     pfx_len,
+                     a->uri,
+                     ue);
+    GNUNET_free (ue);
+    GNUNET_free (result);
+    result = tmp;
+    sep = "&";
+  }
+  return result;
+}
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size)
+{
+  struct BlockHeader bh;
+  size_t needed = sizeof (bh);
+  char *pos;
+  struct GNUNET_TIME_Timestamp et;
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_assert (needed + a->uri_len > needed);
+    needed += a->uri_len;
+  }
+  if ( (NULL == block) ||
+       (needed < *block_size) )
+  {
+    *block_size = needed;
+    return GNUNET_NO;
+  }
+  bh.pid = builder->pid;
+  et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  bh.expiration_time = GNUNET_TIME_absolute_hton (et.abs_time);
+  sign_hello (builder,
+              et,
+              priv,
+              &bh.sig);
+  memcpy (block,
+          &bh,
+          sizeof (bh));
+  pos = block + sizeof (bh);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    memcpy (pos,
+            a->uri,
+            a->uri_len);
+    pos += a->uri_len;
+  }
+  *block_size = needed;
+  return GNUNET_OK;
+}
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  size_t alen = strlen (address) + 1;
+  struct Address *a;
+  const char *e;
+  if (NULL == (e = strstr (address,
+                           "://")))
+  {
+    GNUNET_break_op (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Invalid address `%s'\n",
+                address);
+    return GNUNET_SYSERR;
+  }
+  if (e == address)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  for (const char *p = address; p != e; p++)
+    if ( (! isalpha ((unsigned char) *p)) &&
+         ('+' != *p) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      return GNUNET_NO;
+  a = GNUNET_malloc (sizeof (struct Address) + alen);
+  a->uri_len = alen;
+  memcpy (&a[1],
+          address,
+          alen);
+  a->uri = (const char *) &a[1];
+  GNUNET_CONTAINER_DLL_insert_tail (builder->a_head,
+                                    builder->a_tail,
+                                    a);
+  builder->a_length++;
+  return GNUNET_OK;
+}
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  struct Address *a;
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      break;
+  if (NULL == a)
+    return GNUNET_NO;
+  GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                               builder->a_tail,
+                               a);
+  builder->a_length--;
+  GNUNET_free (a);
+  return GNUNET_OK;
+}
+void
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              struct GNUNET_PeerIdentity *pid,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls)
+{
+  struct Address *nxt;
+  *pid = builder->pid;
+  if (NULL == uc)
+    return;
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = nxt)
+  {
+    nxt = a->next;
+    uc (uc_cls,
+        a->uri);
+  }
+}
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration)
+{
+  const struct DhtHelloMessage *msg
+    = (const struct DhtHelloMessage *) hello;
+  uint16_t len = ntohs (hello->size);
+  struct BlockHeader *bh;
+  struct GNUNET_HELLO_Builder *b;
+  enum GNUNET_GenericReturnValue ret;
+  if (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO != ntohs (hello->type))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (len < sizeof (*msg))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len -= sizeof (*msg);
+  *block_size = len + sizeof (*bh);
+  *block = GNUNET_malloc (*block_size);
+  bh = *block;
+  bh->pid = *pid;
+  bh->sig = msg->sig;
+  bh->expiration_time = msg->expiration_time;
+  *block_expiration = GNUNET_TIME_absolute_ntoh (msg->expiration_time);
+  memcpy (&bh[1],
+          &msg[1],
+          len);
+  b = GNUNET_HELLO_builder_from_block (*block,
+                                       *block_size);
+  if (NULL == b)
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  ret = verify_hello (b,
+                      *block_expiration,
+                      &msg->sig);
+  GNUNET_HELLO_builder_free (b);
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  return ret;
+}
diff --git a/src/hello/test_hello-ng.c b/src/hello/test_hello-ng.c
index e6b1d42a0..4ace9439f 100644
--- a/src/hello/test_hello-ng.c
+++ b/src/hello/test_hello-ng.c
@@ -1,3 +1,22 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
 #include "platform.h"
 #include "gnunet_util_lib.h"
 #include "gnunet_nt_lib.h"
@@ -23,12 +42,12 @@ main (int argc,
                             GNUNET_NT_LAN,
                             t,
                             &privKey,
-                             (void**)&res,
+                             (void**) &res,
                             &res_len);
  GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
              "%s\n", res);
  GNUNET_assert (NULL !=
-                 GNUNET_HELLO_extract_address ((void**)res,
+                 GNUNET_HELLO_extract_address ((void**) res,
                                               res_len,
                                               &pid,
                                               &nt,
diff --git a/src/hello/test_hello-uri.c b/src/hello/test_hello-uri.c
new file mode 100644
index 000000000..7e70d6763
--- /dev/null
+++ b/src/hello/test_hello-uri.c
@@ -0,0 +1,212 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file hello/test_hello-uri.c
+ * @brief test for helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_util_lib.h"
+/**
+ * Check for expected URIs.
+ *
+ * @param cls a `unsigned int*`, bitmask set to found URIs
+ * @param uri URI to check for
+ */
+static void
+check_uris (void *cls,
+            const char *uri)
+{
+  unsigned int *found = cls;
+  if (0 == strcmp (uri,
+                   "test://address"))
+    *found |= 1;
+  else if (0 == strcmp (uri,
+                        "test://more"))
+    *found |= 2;
+  else
+    *found = (unsigned int) -1;
+}
+int
+main (int argc,
+      char *argv[])
+{
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_HELLO_Builder *b;
+  struct GNUNET_CRYPTO_EddsaPrivateKey priv;
+  GNUNET_log_setup ("test-hell-uri",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_eddsa_key_create (&priv);
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "invalid"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "i%v://bla"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "://empty"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://more"));
+  {
+    void *block;
+    size_t block_size = 0;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size));
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size));
+    GNUNET_assert (0 != block_size);
+    block = GNUNET_malloc (block_size);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  block,
+                                                  &block_size));
+    b2 = GNUNET_HELLO_builder_from_block (block,
+                                          block_size);
+    GNUNET_free (block);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+  {
+    char *url;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    b2 = GNUNET_HELLO_builder_from_url (url);
+    GNUNET_free (url);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+    env = GNUNET_HELLO_builder_to_env (b,
+                                       &priv);
+    b2 = GNUNET_HELLO_builder_from_msg (GNUNET_MQ_env_get_msg (env));
+    GNUNET_free (env);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+  GNUNET_HELLO_builder_free (b);
+  GNUNET_CRYPTO_mpi_print_unsigned (priv.d,
+                                    sizeof (priv.d),
+                                    GCRYMPI_CONST_ONE);
+  priv.d[0] &= 248;
+  priv.d[31] &= 127;
+  priv.d[31] |= 64;
+  {
+    char *buf;
+    buf = GNUNET_STRINGS_data_to_string_alloc (&priv,
+                                               sizeof (priv));
+    fprintf (stderr,
+             "PK: %s\n",
+             buf);
+    GNUNET_free (buf);
+  }
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "a://first"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "b://second"));
+  {
+    char *url;
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    fprintf (stderr,
+             "TV: %s\n",
+             url);
+    GNUNET_free (url);
+  }
+  return 0;
+}
diff --git a/src/hostlist/gnunet-daemon-hostlist_client.c b/src/hostlist/gnunet-daemon-hostlist_client.c
index 44966d3de..1f7d4cc35 100644
--- a/src/hostlist/gnunet-daemon-hostlist_client.c
+++ b/src/hostlist/gnunet-daemon-hostlist_client.c
@@ -1635,7 +1635,11 @@ GNUNET_HOSTLIST_client_start (const struct GNUNET_CONFIGURATION_Handle *c,
                                                            "PROXY_TYPE",
                                                            &proxytype_str))
    {
-      GNUNET_STRINGS_utf8_toupper (proxytype_str, proxytype_str);
+      if (GNUNET_OK != GNUNET_STRINGS_utf8_toupper (proxytype_str,
+                                                    proxytype_str))
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Unable to convert `%s' to UTF-8 uppercase\n",
+                    proxytype_str);
      proxy_type = CURLPROXY_HTTP;
      if (0 == strcmp (proxytype_str, "HTTP"))
        proxy_type = CURLPROXY_HTTP;
diff --git a/src/identity/Makefile.am b/src/identity/Makefile.am
index e535c208a..5a2110974 100644
--- a/src/identity/Makefile.am
+++ b/src/identity/Makefile.am
@@ -95,6 +95,7 @@ test_identity_defaults_LDADD = \
  $(top_builddir)/src/util/libgnunetutil.la 
 EXTRA_DIST = \
-  test_identity.conf 
+  test_identity.conf \
+  test_identity_messages.sh 
diff --git a/src/identity/gnunet-service-identity.c b/src/identity/gnunet-service-identity.c
index 2bb4b0897..51f897557 100644
--- a/src/identity/gnunet-service-identity.c
+++ b/src/identity/gnunet-service-identity.c
@@ -489,8 +489,7 @@ handle_get_default_message (void *cls,
  char *identifier;
  name = GNUNET_strdup ((const char *) &gdm[1]);
-  GNUNET_STRINGS_utf8_tolower ((const char *) &gdm[1],
+  GNUNET_STRINGS_utf8_tolower ((const char *) &gdm[1], name);
-                               name);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received GET_DEFAULT for service `%s' from client\n",
              name);
diff --git a/src/include/Makefile.am b/src/include/Makefile.am
index e4b02b8ee..8808f6802 100644
--- a/src/include/Makefile.am
+++ b/src/include/Makefile.am
@@ -57,6 +57,7 @@ gnunetinclude_HEADERS = \
  gnunet_gnsrecord_plugin.h \
  gnu_name_system_record_types.h \
  gnunet_hello_lib.h \
+  gnunet_hello_uri_lib.h \
  gnunet_helper_lib.h \
  gnunet_identity_service.h \
  gnunet_abe_lib.h \
diff --git a/src/include/gnunet_block_group_lib.h b/src/include/gnunet_block_group_lib.h
index 6cb601757..b03e913c6 100644
--- a/src/include/gnunet_block_group_lib.h
+++ b/src/include/gnunet_block_group_lib.h
@@ -94,7 +94,7 @@ GNUNET_BLOCK_GROUP_bf_create (void *cls,
 * @return #GNUNET_YES if @a hc is (likely) a duplicate
 *         #GNUNET_NO if @a hc was definitively not in @bg (but now is)
 */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_GROUP_bf_test_and_set (struct GNUNET_BLOCK_Group *bg,
                                    const struct GNUNET_HashCode *hc);
diff --git a/src/include/gnunet_block_lib.h b/src/include/gnunet_block_lib.h
index 5640209a6..515b8256c 100644
--- a/src/include/gnunet_block_lib.h
+++ b/src/include/gnunet_block_lib.h
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet.
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -119,6 +119,12 @@ enum GNUNET_BLOCK_Type
  GNUNET_BLOCK_TYPE_REVOCATION = 12,
  /**
+   * Type of a block that contains a DHT-NG HELLO for a peer (for
+   * DHT and CADET find-peer operations).
+   */
+  GNUNET_BLOCK_TYPE_DHT_URL_HELLO = 13,
+  /**
   * Block to store a cadet regex state
   */
  GNUNET_BLOCK_TYPE_REGEX = 22,
@@ -156,108 +162,35 @@ enum GNUNET_BLOCK_Type
 /**
- * Flags that can be set to control the evaluation.
- * @deprecated
- */
-enum GNUNET_BLOCK_EvaluationOptions
-{
-  /**
-   * Default behavior.
-   */
-  GNUNET_BLOCK_EO_NONE = 0,
-  /**
-   * The block is obtained from the local database, skip cryptographic
-   * checks.
-   */
-  GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO = 1
-};
-/**
 * Possible ways for how a block may relate to a query.
- * @deprecated
 */
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 {
-  /**
-   * Valid result, and there may be more.
-   */
-  GNUNET_BLOCK_EVALUATION_OK_MORE = 0,
  /**
-   * Last possible valid result.
+   * Specified block type not supported by any plugin.
   */
-  GNUNET_BLOCK_EVALUATION_OK_LAST = 1,
+  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
  /**
   * Valid result, but suppressed because it is a duplicate.
   */
-  GNUNET_BLOCK_EVALUATION_OK_DUPLICATE = 2,
+  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
-  /**
-   * Block does not match query (invalid result)
-   */
-  GNUNET_BLOCK_EVALUATION_RESULT_INVALID = 3,
  /**
   * Block does not match xquery (valid result, not relevant for the request)
   */
-  GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT = 4,
+  GNUNET_BLOCK_REPLY_IRRELEVANT = 1,
-  /**
-   * Query is valid, no reply given.
-   */
-  GNUNET_BLOCK_EVALUATION_REQUEST_VALID = 10,
-  /**
-   * Query format does not match block type (invalid query).  For
-   * example, xquery not given or xquery_size not appropriate for
-   * type.
-   */
-  GNUNET_BLOCK_EVALUATION_REQUEST_INVALID = 11,
-  /**
-   * Specified block type not supported by this plugin.
-   */
-  GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED = 20
-};
-/**
- * Possible ways for how a block may relate to a query.
- */
-enum GNUNET_BLOCK_ReplyEvaluationResult
-{
-  /**
-   * Valid result, but suppressed because it is a duplicate.
-   */
-  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
  /**
   * Valid result, and there may be more.
   */
-  GNUNET_BLOCK_REPLY_OK_MORE = 1,
+  GNUNET_BLOCK_REPLY_OK_MORE = 2,
  /**
   * Last possible valid result.
   */
-  GNUNET_BLOCK_REPLY_OK_LAST = 2,
+  GNUNET_BLOCK_REPLY_OK_LAST = 3
-  /**
-   * Specified block type not supported by any plugin.
-   */
-  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
-  /**
-   * Block does not match query (invalid result)
-   */
-  GNUNET_BLOCK_REPLY_INVALID = -2,
-  /**
-   * Block does not match xquery (valid result, not relevant for the request)
-   */
-  GNUNET_BLOCK_REPLY_IRRELEVANT = -3,
 };
@@ -356,44 +289,12 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg);
 /**
- * Function called to validate a reply or a request.  For
+ * Function called to validate if a reply is good for a
- * request evaluation, simply pass "NULL" for the @a reply_block.
+ * particular query.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param ctx block contxt
- * @param type block type
- * @param group block group to use for evaluation
- * @param eo evaluation options to control evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- * @deprecated
- */
-enum GNUNET_BLOCK_EvaluationResult
-GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
-                       enum GNUNET_BLOCK_Type type,
-                       struct GNUNET_BLOCK_Group *group,
-                       enum GNUNET_BLOCK_EvaluationOptions eo,
-                       const struct GNUNET_HashCode *query,
-                       const void *xquery,
-                       size_t xquery_size,
-                       const void *reply_block,
-                       size_t reply_block_size);
-/**
- * Function called to validate a reply.
- * Also checks the query key against the block contents
- * as it would be done with the #GNUNET_BLOCK_get_key() function.
 *
 * @param ctx block contxt
 * @param type block type
- * @param group block group to use for evaluation
+ * @param[in,out] group block group to use for evaluation
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
 * @param xquery_size number of bytes in @a xquery
@@ -436,7 +337,6 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
 *
 * @param ctx block contxt
 * @param type block type
- * @param query query key (hash)
 * @param block payload to put
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
@@ -445,13 +345,14 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
                          enum GNUNET_BLOCK_Type type,
-                          const struct GNUNET_HashCode *query,
                          const void *block,
                          size_t block_size);
 /**
- * Function called to obtain the key for a block.
+ * Function called to obtain the @a key for a @a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
 *
 * @param ctx block context
 * @param type block type
@@ -459,9 +360,8 @@ GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
 * @param block_size number of bytes in @a block
 * @param key set to the key (query) for the given block
 * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
+ *         #GNUNET_NO if extracting a key from a block of this @a type does not work
- *         #GNUNET_SYSERR if type not supported
+ *         #GNUNET_SYSERR if @a type not supported
- *         (or if extracting a key from a block of this type does not work)
 */
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
diff --git a/src/include/gnunet_block_plugin.h b/src/include/gnunet_block_plugin.h
index 2c9a3839d..1fa7ccf8b 100644
--- a/src/include/gnunet_block_plugin.h
+++ b/src/include/gnunet_block_plugin.h
@@ -1,6 +1,6 @@
 /*
     This file is part of GNUnet
-     Copyright (C) 2010,2013,2017 GNUnet e.V.
+     Copyright (C) 2010, 2013, 2017, 2021, 2022 GNUnet e.V.
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
@@ -163,43 +163,9 @@ typedef struct GNUNET_BLOCK_Group *
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group which block group to use for evaluation
- * @param eo evaluation options to control evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- * @deprecated
- */
-typedef enum GNUNET_BLOCK_EvaluationResult
-(*GNUNET_BLOCK_EvaluationFunction)(void *cls,
-                                   struct GNUNET_BLOCK_Context *ctx,
-                                   enum GNUNET_BLOCK_Type type,
-                                   struct GNUNET_BLOCK_Group *group,
-                                   enum GNUNET_BLOCK_EvaluationOptions eo,
-                                   const struct GNUNET_HashCode *query,
-                                   const void *xquery,
-                                   size_t xquery_size,
-                                   const void *reply_block,
-                                   size_t reply_block_size);
-/**
 * Function called to validate a query.
 *
 * @param cls closure
- * @param ctx block context
 * @param type block type
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
@@ -215,19 +181,17 @@ typedef enum GNUNET_GenericReturnValue
 /**
- * Function called to validate a block for storage.
+ * Function called to validate a @a block for storage.
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the @a block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if the @a type is not supported
 */
 typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_BlockEvaluationFunction)(void *cls,
                                        enum GNUNET_BLOCK_Type type,
-                                        const struct GNUNET_HashCode *query,
                                        const void *block,
                                        size_t block_size);
@@ -260,17 +224,18 @@ typedef enum GNUNET_BLOCK_ReplyEvaluationResult
 /**
- * Function called to obtain the key for a block.
+ * Function called to obtain the @a key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
 *
 * @param cls closure
 * @param type block type
- * @param block block to get the key for
+ * @param block block to get the @a key for
 * @param block_size number of bytes in @a block
 * @param[out] key set to the key (query) for the given block
 * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
+ *         #GNUNET_NO if extracting a key for this @a type does not work
- *         #GNUNET_SYSERR if type not supported
+ *         #GNUNET_SYSERR if @a type not supported
- *         (or if extracting a key from a block of this type does not work)
 */
 typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GetKeyFunction) (void *cls,
@@ -297,14 +262,6 @@ struct GNUNET_BLOCK_PluginFunctions
  const enum GNUNET_BLOCK_Type *types;
  /**
-   * Main function of a block plugin.  Allows us to check if a
-   * block matches a query.
-   *
-   * @param deprecated
-   */
-  GNUNET_BLOCK_EvaluationFunction evaluate;
-  /**
   * Obtain the key for a given block (if possible).
   */
  GNUNET_BLOCK_GetKeyFunction get_key;
diff --git a/src/include/gnunet_common.h b/src/include/gnunet_common.h
index 4472d3ee8..9bcd99c7b 100644
--- a/src/include/gnunet_common.h
+++ b/src/include/gnunet_common.h
@@ -623,6 +623,31 @@ GNUNET_abort_ (void) GNUNET_NORETURN;
 /**
+ * Convert a buffer to an 8-character string
+ * representative of the contents. This is used
+ * for logging binary data when debugging.
+ *
+ * @param buf buffer to log
+ * @param buf_size number of bytes in @a buf
+ * @return text representation of buf, valid until next
+ *         call to this function
+ */
+const char *
+GNUNET_b2s (const void *buf,
+           size_t buf_size);
+/**
+ * Convert a fixed-sized object to a string using
+ * #GNUNET_b2s().
+ *
+ * @param obj address of object to convert
+ * @return string representing the binary obj buffer
+ */
+#define GNUNET_B2S(obj) GNUNET_b2s ((obj), sizeof (*(obj)))
+/**
 * @ingroup logging
 * Ignore the next @a n calls to the log function.
 *
@@ -1240,7 +1265,7 @@ GNUNET_is_zero_ (const void *a,
 * @return GNUNET_YES if a is zero, GNUNET_NO otherwise
 */
 #define GNUNET_is_zero(a)           \
-  GNUNET_is_zero_ (a, sizeof (*a))
+  GNUNET_is_zero_ ((a), sizeof (*(a)))
 /**
diff --git a/src/include/gnunet_crypto_lib.h b/src/include/gnunet_crypto_lib.h
index 1ab135d80..72d783148 100644
--- a/src/include/gnunet_crypto_lib.h
+++ b/src/include/gnunet_crypto_lib.h
@@ -307,7 +307,7 @@ struct GNUNET_CRYPTO_SymmetricSessionKey
 /**
 * Type of a nonce used for challenges.
 */
-struct ChallengeNonceP
+struct GNUNET_CRYPTO_ChallengeNonceP
 {
  /**
   * The value of the nonce.  Note that this is NOT a hash.
@@ -2551,9 +2551,9 @@ GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv);
 * @param[out] pub where to write the public key
 */
 void
-GNUNET_CRYPTO_cs_private_key_get_public (const struct
+GNUNET_CRYPTO_cs_private_key_get_public (
-                                         GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                                         struct GNUNET_CRYPTO_CsPublicKey *pub);
+  struct GNUNET_CRYPTO_CsPublicKey *pub);
 /**
@@ -2565,11 +2565,13 @@ GNUNET_CRYPTO_cs_private_key_get_public (const struct
 * Comment: Can be done in one HKDF shot and split output.
 *
 * @param nonce is a random nonce
+ * @param seed seed to use in derivation
 * @param lts is a long-term-secret in form of a private key
 * @param[out] r array containing derived secrets r0 and r1
 */
 void
 GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsNonce *nonce,
+                           const char *seed,
                           const struct GNUNET_CRYPTO_CsPrivateKey *lts,
                           struct GNUNET_CRYPTO_CsRSecret r[2]);
@@ -2595,10 +2597,9 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
 * @param[out] bs array containing the two derived blinding secrets
 */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
-                                          GNUNET_CRYPTO_CsNonce *blind_seed,
+  const struct GNUNET_CRYPTO_CsNonce *blind_seed,
-                                          struct GNUNET_CRYPTO_CsBlindingSecret
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2]);
-                                          bs[2]);
 /**
@@ -2614,15 +2615,14 @@ GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
 * @param[out] blinded_r_pub array of the two blinded R
 */
 void
-GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
+GNUNET_CRYPTO_cs_calc_blinded_c (
-                                 bs[2],
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
-                                 const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                                 const void *msg,
+  const void *msg,
-                                 size_t msg_len,
+  size_t msg_len,
-                                 struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
-                                 struct GNUNET_CRYPTO_CsRPublic
+  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2]);
-                                 blinded_r_pub[2]);
 /**
@@ -2642,13 +2642,12 @@ GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
 * @return 0 or 1 for b (see Clause Blind Signature Scheme)
 */
 unsigned int
-GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+GNUNET_CRYPTO_cs_sign_derive (
-                              const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                              const struct GNUNET_CRYPTO_CsC c[2],
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
-                              const struct GNUNET_CRYPTO_CsNonce *nonce,
+  const struct GNUNET_CRYPTO_CsC c[2],
-                              struct GNUNET_CRYPTO_CsBlindS *
+  const struct GNUNET_CRYPTO_CsNonce *nonce,
-                              blinded_signature_scalar
+  struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar);
-                              );
 /**
@@ -2659,10 +2658,10 @@ GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
 * @param[out] signature_scalar where to write the unblinded signature
 */
 void
-GNUNET_CRYPTO_cs_unblind (const struct
+GNUNET_CRYPTO_cs_unblind (
-                          GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-                          const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-                          struct GNUNET_CRYPTO_CsS *signature_scalar);
+  struct GNUNET_CRYPTO_CsS *signature_scalar);
 /**
diff --git a/src/include/gnunet_datacache_lib.h b/src/include/gnunet_datacache_lib.h
index 11076e3e7..737a5c845 100644
--- a/src/include/gnunet_datacache_lib.h
+++ b/src/include/gnunet_datacache_lib.h
@@ -154,6 +154,7 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 *
 * @param h handle to the datacache
 * @param key area of the keyspace to look into
+ * @param type entries of which type are relevant?
 * @param num_results number of results that should be returned to @a iter
 * @param iter maybe NULL (to just count)
 * @param iter_cls closure for @a iter
@@ -162,6 +163,7 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                              const struct GNUNET_HashCode *key,
+                              enum GNUNET_BLOCK_Type type,
                              unsigned int num_results,
                              GNUNET_DATACACHE_Iterator iter,
                              void *iter_cls);
diff --git a/src/include/gnunet_datacache_plugin.h b/src/include/gnunet_datacache_plugin.h
index 24570be72..34bf5f277 100644
--- a/src/include/gnunet_datacache_plugin.h
+++ b/src/include/gnunet_datacache_plugin.h
@@ -158,14 +158,16 @@ struct GNUNET_DATACACHE_PluginFunctions
  /**
-   * Iterate over the results that are "close" to a particular key in
+   * Iterate over the results that are "close" to a particular key in the
-   * the datacache.  "close" is defined as numerically larger than @a
+   * datacache.  "close" is defined as returning the @a num_results that are
-   * key (when interpreted as a circular address space), with small
+   * numerically closest and larger than @a key and also @a num_results that
-   * distance.
+   * are numerically lower than @a key. Thus, the maximum number of results
+   * returned is actually twice @a num_results.
   *
   * @param cls closure (internal context for the plugin)
   * @param key area of the keyspace to look into
-   * @param num_results number of results that should be returned to @a iter
+   * @param type desired block type for the replies
+   * @param num_results half the number of results that should be returned to @a iter
   * @param iter maybe NULL (to just count)
   * @param iter_cls closure for @a iter
   * @return the number of results found
@@ -173,6 +175,7 @@ struct GNUNET_DATACACHE_PluginFunctions
  unsigned int
  (*get_closest) (void *cls,
                  const struct GNUNET_HashCode *key,
+                  enum GNUNET_BLOCK_Type type,
                  unsigned int num_results,
                  GNUNET_DATACACHE_Iterator iter,
                  void *iter_cls);
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index 768b19fb1..22b659d66 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -101,14 +101,14 @@ enum GNUNET_DHT_RouteOption
  GNUNET_DHT_RO_RECORD_ROUTE = 2,
  /**
-   * This is a 'FIND-PEER' request, so approximate results are fine.
+   * Approximate results are fine.
   */
-  GNUNET_DHT_RO_FIND_PEER = 4,
+  GNUNET_DHT_RO_FIND_APPROXIMATE = 4,
  /**
-    * Flag given to monitors if this was the last hop for a GET/PUT.
+   * Flag given to monitors if this was the last hop for a GET/PUT.
-    * This is only used for internal processing.
+   * This is only used for internal processing.
-    */
+   */
  GNUNET_DHT_RO_LAST_HOP = 65535
 };
@@ -131,11 +131,6 @@ struct GNUNET_DHT_HopSignature
  struct GNUNET_TIME_AbsoluteNBO expiration_time;
  /**
-   * Key of the block.
-   */
-  struct GNUNET_HashCode key;
-  /**
   * Hash over the payload of the block.
   */
  struct GNUNET_HashCode h_data;
@@ -181,6 +176,7 @@ struct GNUNET_DHT_PathElement
 };
 GNUNET_NETWORK_STRUCT_END
 /**
@@ -266,7 +262,7 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
 *
 * @param cls closure
 * @param exp when will this value expire
- * @param key key of the result
+ * @param query_hash key of the query
 * @param get_path peers on reply path (or NULL if not recorded)
 *                 [0] = datastore's first neighbor, [length - 1] = local peer
 * @param get_path_length number of entries in @a get_path
@@ -282,7 +278,7 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
 typedef void
 (*GNUNET_DHT_GetIterator) (void *cls,
                           struct GNUNET_TIME_Absolute exp,
-                           const struct GNUNET_HashCode *key,
+                           const struct GNUNET_HashCode *query_hash,
                           const struct GNUNET_DHT_PathElement *get_path,
                           unsigned int get_path_length,
                           const struct GNUNET_DHT_PathElement *put_path,
@@ -487,7 +483,6 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
 * the last signature on the path is never verified as that is the slot where
 * our peer (@a me) would need to sign.
 *
- * @param key key of the data (not necessarily the query hash)
 * @param data payload (the block)
 * @param data_size number of bytes in @a data
 * @param exp_time expiration time of @a data
@@ -501,8 +496,7 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
 *         @a get_path_len + @a put_path_len - 1 if no signature was valid
 */
 unsigned int
-GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
+GNUNET_DHT_verify_path (const void *data,
-                        const void *data,
                        size_t data_size,
                        struct GNUNET_TIME_Absolute exp_time,
                        const struct GNUNET_DHT_PathElement *put_path,
@@ -512,6 +506,63 @@ GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
                        const struct GNUNET_PeerIdentity *me);
+/**
+ * Handle to get a HELLO URL from the DHT for manual bootstrapping.
+ */
+struct GNUNET_DHT_HelloGetHandle;
+/**
+ * Signature called with the result of a HELLO GET operation.
+ *
+ * @param cls closure
+ * @param hello_url the resulting HELLO URL, NULL on error
+ */
+typedef void
+(*GNUNET_DHT_HelloGetCallback)(void *cls,
+                               const char *hello_url);
+/**
+ * Obtain HELLO URL of the DHT identified by @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param cb function to call with the result
+ * @param cb_cls closure for @a cb
+ * @return NULL on failure
+ */
+struct GNUNET_DHT_HelloGetHandle *
+GNUNET_DHT_hello_get (struct GNUNET_DHT_Handle *dht_handle,
+                      GNUNET_DHT_HelloGetCallback cb,
+                      void *cb_cls);
+/**
+ * Cancel hello get operation.
+ *
+ * @param[in] hgh operation to cancel.
+ */
+void
+GNUNET_DHT_hello_get_cancel (struct GNUNET_DHT_HelloGetHandle *hgh);
+/**
+ * Offer HELLO URL of the DHT identified by @a dht_handle.
+ * Callback may be invoked once, only way to cancel is to
+ * disconnect @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param url URL with a HELLO to offer to the DHT
+ * @param cb function called when done
+ * @param cb_cls closure for @a cb
+ */
+void
+GNUNET_DHT_hello_offer (struct GNUNET_DHT_Handle *dht_handle,
+                        const char *url,
+                        GNUNET_SCHEDULER_TaskCallback cb,
+                        void *cb_cls);
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
 #endif
diff --git a/src/include/gnunet_dhtu_plugin.h b/src/include/gnunet_dhtu_plugin.h
index 2c97d5848..fa0b5f667 100644
--- a/src/include/gnunet_dhtu_plugin.h
+++ b/src/include/gnunet_dhtu_plugin.h
@@ -59,15 +59,6 @@ struct GNUNET_DHTU_PreferenceHandle;
 /**
- * Key used to identify peer's position in the DHT.
- */
-struct GNUNET_DHTU_HashKey
-{
-  struct GNUNET_HashCode sha512;
-};
-/**
 * The datastore service will pass a pointer to a struct
 * of this type as the first and only argument to the
 * entry point of each datastore plugin.
@@ -88,7 +79,6 @@ struct GNUNET_DHTU_PluginEnvironment
   * Function to call with new addresses of this peer.
   *
   * @param cls the closure
-   * @param key hash position of this address in the DHT
   * @param address address under which we are likely reachable,
   *           pointer will remain valid until @e address_del_cb is called; to be used for HELLOs. Example: "ip+udp://1.1.1.1:2086/"
   * @param source handle for sending from this address, NULL if we can only receive
@@ -96,7 +86,6 @@ struct GNUNET_DHTU_PluginEnvironment
   */
  void
  (*address_add_cb)(void *cls,
-                    struct GNUNET_DHTU_HashKey *key,
                    const char *address,
                    struct GNUNET_DHTU_Source *source,
                    void **ctx);
@@ -128,20 +117,19 @@ struct GNUNET_DHTU_PluginEnvironment
   * that peer.
   *
   * @param cls the closure
-   * @param pk public key of the target,
-   *    pointer will remain valid until @e disconnect_cb is called
-   * @para peer_id hash position of the peer,
-   *    pointer will remain valid until @e disconnect_cb is called
   * @param target handle to the target,
   *    pointer will remain valid until @e disconnect_cb is called
+   * @para pid peer identity,
+   *    pointer will remain valid until @e disconnect_cb is called
   * @param[out] ctx storage space for DHT to use in association with this target
   */
  void
  (*connect_cb)(void *cls,
                struct GNUNET_DHTU_Target *target,
-                struct GNUNET_DHTU_HashKey *key,
+                const struct GNUNET_PeerIdentity *pid,
                void **ctx);
  /**
   * Function to call when we disconnected from a peer and can henceforth
   * cannot transmit to that peer anymore.
@@ -185,10 +173,12 @@ struct GNUNET_DHTU_PluginFunctions
   * Request creation of a session with a peer at the given @a address.
   *
   * @param cls closure (internal context for the plugin)
-   * @param address target address to connect to
+   * @param pid target identity of the peer to connect to
+   * @param address target address URI to connect to
   */
  void
  (*try_connect) (void *cls,
+                  const struct GNUNET_PeerIdentity *pid,
                  const char *address);
@@ -205,7 +195,7 @@ struct GNUNET_DHTU_PluginFunctions
          struct GNUNET_DHTU_Target *target);
  /**
-   * Do no long request underlay to keep the connection alive.
+   * Do no longer request underlay to keep the connection alive.
   *
   * @param cls closure
   * @param target connection to keep alive
diff --git a/src/include/gnunet_fs_service.h b/src/include/gnunet_fs_service.h
index 686035e2c..96936bad2 100644
--- a/src/include/gnunet_fs_service.h
+++ b/src/include/gnunet_fs_service.h
@@ -1729,7 +1729,7 @@ GNUNET_FS_file_information_get_id (struct GNUNET_FS_FileInformation *s);
 * @return "filename" field of the structure (can be NULL)
 */
 const char *
-GNUNET_FS_file_information_get_filename (struct GNUNET_FS_FileInformation *s);
+GNUNET_FS_file_information_get_filename (const struct GNUNET_FS_FileInformation *s);
 /**
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index 3f6c9b9aa..5c06f8045 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -48,12 +48,6 @@ extern "C" {
 /**
- * String we use to indicate an empty label (top-level
- * entry in the zone).  DNS uses "@", so do we.
- */
-#define GNUNET_GNS_EMPTY_LABEL_AT "@"
-/**
 * Connection to the GNS service.
 */
 struct GNUNET_GNS_Handle;
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index fdbac3cf5..51dd5972d 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -44,6 +44,12 @@ extern "C" {
 #endif
 /**
+ * String we use to indicate an empty label (top-level
+ * entry in the zone).  DNS uses "@", so do we.
+ */
+#define GNUNET_GNS_EMPTY_LABEL_AT "@"
+/**
 * Maximum size of a value that can be stored in a GNS block.
 */
 #define GNUNET_GNSRECORD_MAX_BLOCK_SIZE (63 * 1024)
@@ -299,8 +305,6 @@ struct GNUNET_GNSRECORD_ReverseRecord
  /* followed by the name the delegator uses to refer to our namespace */
 };
-GNUNET_NETWORK_STRUCT_END
 /**
 * Process a records that were decrypted from a block.
@@ -427,7 +431,8 @@ GNUNET_GNSRECORD_is_expired (const struct GNUNET_GNSRECORD_Data *rd);
 /**
- * Normalize a UTF-8 string to UTF-8 NFC
+ * Normalize a UTF-8 string to a GNS name
+ *
 * @param src source string
 * @return converted result
 */
@@ -436,15 +441,6 @@ GNUNET_GNSRECORD_string_normalize (const char *src);
 /**
- * Convert a UTF-8 string to UTF-8 lowercase
- * @param src source string
- * @return converted result
- */
-char *
-GNUNET_GNSRECORD_string_to_lowercase (const char *src);
-/**
 * Convert a zone to a string (for printing debug messages).
 * This is one of the very few calls in the entire API that is
 * NOT reentrant!
@@ -616,11 +612,14 @@ GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
 *
 * @param rd_count number of records given in @a rd
 * @param rd array of records
+ * @param min minimum expiration time
 * @return absolute expiration time
 */
 struct GNUNET_TIME_Absolute
-GNUNET_GNSRECORD_record_get_expiration_time (
+GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
-  unsigned int rd_count, const struct GNUNET_GNSRECORD_Data *rd);
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min);
 /**
@@ -700,6 +699,77 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_is_zonekey_type (uint32_t type);
+/**
+ * Check if this type is a critical record.
+ *
+ * @param type the type to check
+ * @return GNUNET_YES if it is critical.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type);
+/**
+ * Normalize namestore records: Check for consistency and
+ * expirations. Purge expired records. Returns a "clean" record set.
+ * Also returns the minimum expiration time this block should be
+ * published under.
+ * Also checks rules with respect to labels (e.g. no delegations under
+ * the empty label)
+ *
+ * @param label the label under which this set (supposed to be) stored.
+ * @param rd input records
+ * @param rd_count size of the @a rd and @a rd_public arrays
+ * @param rd_public where to write the converted records
+ * @param rd_public_count number of records written to @a rd_public
+ * @param min_expiry the minimum expiration of this set
+ * @param include_private GNUNET_YES if private records should be included.
+ * @param emsg the error message if something went wrong
+ * @return GNUNET_OK if set could be normalized and is consistent
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *min_expiry,
+                                       int include_private,
+                                       char **emsg);
+/**
+ * Convert namestore records from the internal format to that
+ * suitable for publication (removes private records).
+ *
+ * @param label the label under which this set is (supposed to be) published.
+ * @param rd input records
+ * @param rd_count size of the @a rd and @a rd_public arrays
+ * @param rd_public where to write the converted records
+ * @param rd_public_count number of records written to @a rd_public
+ * @param expiry the expiration of the block
+ * @param emsg the error message if something went wrong
+ * @return GNUNET_OK if set is consistent and can be exported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_convert_records_for_export (const char *label,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             unsigned int rd_count,
+                                             struct GNUNET_GNSRECORD_Data *
+                                             rd_public,
+                                             unsigned int *rd_count_public,
+                                             struct GNUNET_TIME_Absolute *expiry,
+                                             char **emsg);
+/**
+ * Check label for invalid characters.
+ *
+ * @param label the label to check
+ * @param emsg an error message (NULL if label is valid). Will be allocated.
+ * @return GNUNET_OK if label is valid.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg);
 #if 0 /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/include/gnunet_gnsrecord_plugin.h b/src/include/gnunet_gnsrecord_plugin.h
index aec22c3af..84b7c3c23 100644
--- a/src/include/gnunet_gnsrecord_plugin.h
+++ b/src/include/gnunet_gnsrecord_plugin.h
@@ -105,6 +105,18 @@ typedef const char *
 (*GNUNET_GNSRECORD_NumberToTypenameFunction) (void *cls,
                                              uint32_t type);
+/**
+ * Function called to check for critical records.
+ *
+ * @param cls closure
+ * @param type number of a type to check
+ * @return GNUNET_YES if critical, otherwise GNUNET_NO
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_GNSRECORD_IsCriticalFunction) (void *cls,
+                                        uint32_t type);
 /**
 * Each plugin is required to return a pointer to a struct of this
@@ -136,6 +148,11 @@ struct GNUNET_GNSRECORD_PluginFunctions
   * Number to typename.
   */
  GNUNET_GNSRECORD_NumberToTypenameFunction number_to_typename;
+  /**
+   * Is critical.
+   */
+  GNUNET_GNSRECORD_IsCriticalFunction is_critical;
 };
 /** @} */  /* end of group */
diff --git a/src/include/gnunet_hello_uri_lib.h b/src/include/gnunet_hello_uri_lib.h
new file mode 100644
index 000000000..c109a151a
--- /dev/null
+++ b/src/include/gnunet_hello_uri_lib.h
@@ -0,0 +1,248 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Christian Grothoff
+ * @file
+ * Helper library for handling HELLO URIs
+ *
+ * @defgroup hello_uri  Hello_Uri library
+ * Helper library for handling HELLO URIs
+ *
+ * @{
+ */
+#ifndef GNUNET_HELLO_URI_LIB_H
+#define GNUNET_HELLO_URI_LIB_H
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+#include "gnunet_util_lib.h"
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder;
+/**
+ * For how long are HELLO signatures valid?
+ */
+#define GNUNET_HELLO_ADDRESS_EXPIRATION GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_DAYS, 2)
+/**
+ * Allocate builder.
+ *
+ * @param pid peer the builder is for
+ * @return new builder
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid);
+/**
+ * Release resources of a @a builder.
+ *
+ * @param[in] builder to free
+ */
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder);
+/**
+ * Parse @a msg into builder.
+ *
+ * @param msg message to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg);
+/**
+ * Parse @a block into builder.
+ *
+ * @param block DHT block to parse
+ * @param block_size number of bytes in @a block
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size);
+/**
+ * Parse GNUnet HELLO @a url into builder.
+ *
+ * @param url URL to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url);
+/**
+ * Generate envelope with GNUnet HELLO message (including
+ * peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+/**
+ * Generate DHT HELLO message (without peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+/**
+ * Generate GNUnet HELLO URI from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return hello URI
+ */
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+/**
+ * Generate DHT block from a @a builder
+ *
+ * @param builder the builder to serialize
+ * @param priv private key to use to sign the result
+ * @param[out] block where to write the block, NULL to only calculate @a block_size
+ * @param[in,out] block_size input is number of bytes available in @a block,
+ *                           output is number of bytes needed in @a block
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a block_size was too small
+ *      or if @a block was NULL
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size);
+/**
+ * Add individual @a address to the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to add
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was already
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+/**
+ * Remove individual @a address from the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to remove
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was not
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+/**
+ * Callback function used to extract URIs from a builder.
+ *
+ * @param cls closure
+ * @param uri one of the URIs
+ */
+typedef void
+(*GNUNET_HELLO_UriCallback) (void *cls,
+                             const char *uri);
+/**
+ * Iterate over URIs in a builder.
+ *
+ * @param builder builder to iterate over
+ * @param[out] pid set to the peer the @a builder is for
+ * @param uc callback invoked for each URI, can be NULL
+ * @param uc_cls closure for @a addrgen
+ */
+void
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              struct GNUNET_PeerIdentity *pid,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls);
+/**
+ * Convert a DHT @a hello message to a HELLO @a block.
+ *
+ * @param hello the HELLO message
+ * @param pid peer that created the @a hello
+ * @param[out] block set to the HELLO block
+ * @param[out] block_size set to number of bytes in @a block
+ * @param[out] block_expiration set to expiration time of @a block
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if the @a hello is expired (@a block is set!)
+ *         #GNUNET_SYSERR if @a hello is invalid (@a block will be set to NULL)
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration);
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+/* ifndef GNUNET_HELLO_URI_LIB_H */
+#endif
+/** @} */ /* end of group */
+/* end of gnunet_hello_uri_lib.h */
diff --git a/src/include/gnunet_json_lib.h b/src/include/gnunet_json_lib.h
index 7d101196c..6e73a3365 100644
--- a/src/include/gnunet_json_lib.h
+++ b/src/include/gnunet_json_lib.h
@@ -48,10 +48,10 @@ struct GNUNET_JSON_Specification;
 * @return #GNUNET_SYSERR on error,
 *         #GNUNET_OK on success
 */
-typedef int
+typedef enum GNUNET_GenericReturnValue
-(*GNUNET_JSON_Parser) (void *cls,
+(*GNUNET_JSON_Parser)(void *cls,
-                       json_t *root,
+                      json_t *root,
-                       struct GNUNET_JSON_Specification *spec);
+                      struct GNUNET_JSON_Specification *spec);
 /**
diff --git a/src/include/gnunet_namestore_service.h b/src/include/gnunet_namestore_service.h
index 2482b97a5..619b81aed 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -134,6 +134,39 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
                                GNUNET_NAMESTORE_ContinuationWithStatus cont,
                                void *cont_cls);
+/**
+ * Store an item in the namestore.  If the item is already present,
+ * it is replaced with the new record.  Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the value has been stored in the
+ * database. Monitors may be notified asynchronously (basically with
+ * a buffer). However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param rd_count number of records in the 'rd' array
+ * @param rd array of records with data to store
+ * @param is_zonemaster update tombstones, do not process monitors
+ * @param cont continuation to call when done
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_store_ (struct GNUNET_NAMESTORE_Handle *h,
+                                 const struct GNUNET_IDENTITY_PrivateKey *pkey,
+                                 const char *label,
+                                 unsigned int rd_count,
+                                 const struct GNUNET_GNSRECORD_Data *rd,
+                                 int is_zonemaster,
+                                 GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                 void *cont_cls);
 /**
 * Process a record that was stored in the namestore.
@@ -179,6 +212,61 @@ GNUNET_NAMESTORE_records_lookup (struct GNUNET_NAMESTORE_Handle *h,
 /**
+ * Open a record set for editing.
+ * Retrieves an exclusive lock on this set.
+ * Must be commited using @a GNUNET_NAMESTORE_records_commit
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param error_cb function to call on error (i.e. disconnect or unable to get lock)
+ *        the handle is afterwards invalid
+ * @param error_cb_cls closure for @a error_cb
+ * @param rm function to call with the result (with 0 records if we don't have that label)
+ * @param rm_cls closure for @a rm
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_open (struct GNUNET_NAMESTORE_Handle *h,
+                               const struct
+                               GNUNET_IDENTITY_PrivateKey *pkey,
+                               const char *label,
+                               GNUNET_SCHEDULER_TaskCallback error_cb,
+                               void *error_cb_cls,
+                               GNUNET_NAMESTORE_RecordMonitor rm,
+                               void *rm_cls);
+/**
+ * Commit the record set to the namestore.
+ * Releases the lock on the record set.
+ * Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the value has been stored in the
+ * database. Monitors may be notified asynchronously (basically with
+ * a buffer). However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param rd_count number of records in the 'rd' array
+ * @param rd array of records with data to store
+ * @param cont continuation to call when done
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_commit (struct GNUNET_NAMESTORE_Handle *h,
+                                 const struct GNUNET_IDENTITY_PrivateKey *pkey,
+                                 const char *label,
+                                 unsigned int rd_count,
+                                 const struct GNUNET_GNSRECORD_Data *rd,
+                                 GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                 void *cont_cls);
+/**
 * Look for an existing PKEY delegation record for a given public key.
 * Returns at most one result to the processor.
 *
diff --git a/src/include/gnunet_protocols.h b/src/include/gnunet_protocols.h
index 9e278eb92..f2892e125 100644
--- a/src/include/gnunet_protocols.h
+++ b/src/include/gnunet_protocols.h
@@ -153,10 +153,10 @@ extern "C" {
 ******************************************************************************/
 /**
- * Previously used for HELLO messages used for communicating peer addresses.
+ * Latest HELLO messages used for communicating peer addresses.
 * Managed by libgnunethello.
 */
-#define GNUNET_MESSAGE_TYPE_HELLO_LEGACY 16
+#define GNUNET_MESSAGE_TYPE_HELLO_URI 16
 /**
 * HELLO message with friend only flag used for communicating peer addresses.
@@ -660,13 +660,26 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN 156
 /**
- * DHT wants to use CORE to transmit data.
+ * HELLO advertising a neighbours addresses.
 */
-#define GNUNET_MESSAGE_TYPE_DHT_CORE 143
+#define GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO 157
 /**
- * Further X-VINE DHT messages continued from 880
+ * Encapsulation of DHT messages in CORE service.
 */
+#define GNUNET_MESSAGE_TYPE_DHT_CORE 158
+/**
+ * HELLO URL send between client and service (in
+ * either direction).
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL 159
+/**
+ * Client requests DHT service's HELLO URL.
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET 161
 /*******************************************************************************
 * HOSTLIST message types
@@ -1796,7 +1809,6 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_SETU_P2P_SEND_FULL 710
 /*******************************************************************************
 * SETI message types
 ******************************************************************************/
diff --git a/src/include/gnunet_strings_lib.h b/src/include/gnunet_strings_lib.h
index 9dd2f733e..bb8577b7a 100644
--- a/src/include/gnunet_strings_lib.h
+++ b/src/include/gnunet_strings_lib.h
@@ -159,14 +159,12 @@ GNUNET_STRINGS_to_utf8 (const char *input,
 /**
 * Normalize the utf-8 input string to NFC.
- * Output needs to be allocated appropriately.
 *
 * @param input input string
- * @param output output buffer
+ * @return result (freshly allocated) or NULL on error.
 */
-void
+char*
-GNUNET_STRINGS_utf8_normalize (const char *input,
+GNUNET_STRINGS_utf8_normalize (const char *input);
-                               char *output);
 /**
@@ -192,8 +190,9 @@ GNUNET_STRINGS_from_utf8 (const char *input,
 *
 * @param input input string
 * @param output output buffer
+ * @return GNUNET_OK on success
 */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_tolower (const char *input,
                             char *output);
@@ -204,8 +203,9 @@ GNUNET_STRINGS_utf8_tolower (const char *input,
 *
 * @param input input string
 * @param output output buffer
+ * @return GNUNET_OK on success
 */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_toupper (const char *input,
                             char *output);
@@ -458,7 +458,7 @@ GNUNET_STRINGS_base64url_decode (const char *data,
 *
 * @param data the data to encode
 * @param len the length of the input
- * @param output where to write the output (*output should be NULL,
+ * @param[out] out where to write the output (*output should be NULL,
 *   is allocated)
 * @return the size of the output
 */
diff --git a/src/include/gnunet_time_lib.h b/src/include/gnunet_time_lib.h
index b14439462..96413c3cc 100644
--- a/src/include/gnunet_time_lib.h
+++ b/src/include/gnunet_time_lib.h
@@ -762,11 +762,22 @@ GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch);
 *
 * @param s_after_epoch seconds after epoch to convert
 * @return converted time value
- */struct GNUNET_TIME_Timestamp
+ */
+struct GNUNET_TIME_Timestamp
 GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch);
 /**
+ * Convert timestamp to number of seconds after the UNIX epoch.
+ *
+ * @param ts timestamp to convert
+ * @return converted time value
+ */
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts);
+/**
 * Convert absolute time from network byte order.
 *
 * @param a time to convert
diff --git a/src/json/json_pack.c b/src/json/json_pack.c
index 296f56104..cc1ca3e97 100644
--- a/src/json/json_pack.c
+++ b/src/json/json_pack.c
@@ -31,6 +31,12 @@ GNUNET_JSON_pack_ (struct GNUNET_JSON_PackSpec spec[])
 {
  json_t *ret;
+  if (NULL == spec[0].field_name)
+  {
+    ret = spec[0].object;
+    spec[0].object = NULL;
+    return ret;
+  }
  ret = json_object ();
  GNUNET_assert (NULL != ret);
  for (unsigned int i = 0;
diff --git a/src/messenger/gnunet-service-messenger.c b/src/messenger/gnunet-service-messenger.c
index 546f4c0d2..31bffec18 100644
--- a/src/messenger/gnunet-service-messenger.c
+++ b/src/messenger/gnunet-service-messenger.c
@@ -170,9 +170,7 @@ handle_room_close (void *cls,
  if (GNUNET_YES == close_handle_room (msg_client->handle, &(msg->key)))
  {
-    const struct GNUNET_ShortHashCode *member_id = get_handle_member_id (msg_client->handle, &(msg->key));
+    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Closing room succeeded: %s\n", GNUNET_h2s (&(msg->key)));
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Closing room with member id: %s\n", GNUNET_sh2s (member_id));
    struct GNUNET_MESSENGER_RoomMessage *response;
    struct GNUNET_MQ_Envelope *env;
diff --git a/src/messenger/gnunet-service-messenger_member_session.c b/src/messenger/gnunet-service-messenger_member_session.c
index 846dbbe2b..6bd1d24b8 100644
--- a/src/messenger/gnunet-service-messenger_member_session.c
+++ b/src/messenger/gnunet-service-messenger_member_session.c
@@ -84,6 +84,9 @@ check_member_session_completion (struct GNUNET_MESSENGER_MemberSession *session)
 {
  GNUNET_assert (session);
+  GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Check session history (%s) for completion.\n",
+             GNUNET_sh2s(get_member_session_id(session)));
  if (!session->messages.tail)
  {
    session->completed = GNUNET_YES;
@@ -142,7 +145,10 @@ check_member_session_completion (struct GNUNET_MESSENGER_MemberSession *session)
 completion:
  if (GNUNET_YES == is_member_session_completed(session))
  {
-    GNUNET_CONTAINER_multihashmap_destroy (session->history);
+    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Completed session history (%s)\n",
+               GNUNET_sh2s(get_member_session_id(session)));
+    GNUNET_CONTAINER_multihashmap_clear (session->history);
    struct GNUNET_MESSENGER_ContactStore *store = get_member_contact_store(session->member->store);
diff --git a/src/messenger/gnunet-service-messenger_room.c b/src/messenger/gnunet-service-messenger_room.c
index 7f2fd0ca6..7a20d2191 100644
--- a/src/messenger/gnunet-service-messenger_room.c
+++ b/src/messenger/gnunet-service-messenger_room.c
@@ -92,14 +92,14 @@ static void
 handle_room_messages (struct GNUNET_MESSENGER_SrvRoom *room);
 void
-destroy_room (struct GNUNET_MESSENGER_SrvRoom *room)
+destroy_room (struct GNUNET_MESSENGER_SrvRoom *room,
+              int deletion)
 {
  GNUNET_assert(room);
  if (room->idle)
  {
    GNUNET_SCHEDULER_cancel (room->idle);
    room->idle = NULL;
  }
@@ -107,18 +107,22 @@ destroy_room (struct GNUNET_MESSENGER_SrvRoom *room)
    GNUNET_CADET_close_port (room->port);
  GNUNET_CONTAINER_multipeermap_iterate (room->tunnels, iterate_destroy_tunnels, NULL);
  handle_room_messages (room);
-  if (room->service->dir)
+  if (!(room->service->dir))
+    goto skip_saving;
+  if (GNUNET_YES == deletion)
+    remove_room (room);
+  else
    save_room (room);
+skip_saving:
  clear_member_store (get_room_member_store(room));
  clear_message_store (get_room_message_store(room));
  clear_operation_store(get_room_operation_store(room));
  GNUNET_CONTAINER_multipeermap_destroy (room->tunnels);
  clear_list_tunnels (&(room->basement));
  clear_message_state(&(room->state));
@@ -1221,6 +1225,20 @@ save_room (struct GNUNET_MESSENGER_SrvRoom *room)
  GNUNET_free(room_dir);
 }
+void
+remove_room (struct GNUNET_MESSENGER_SrvRoom *room)
+{
+  GNUNET_assert(room);
+  char *room_dir;
+  get_room_data_subdir (room, &room_dir);
+  if (GNUNET_YES == GNUNET_DISK_directory_test (room_dir, GNUNET_YES))
+    GNUNET_DISK_directory_remove(room_dir);
+  GNUNET_free(room_dir);
+}
 static void
 remove_room_member_session (struct GNUNET_MESSENGER_SrvRoom *room,
                            struct GNUNET_MESSENGER_MemberSession *session)
diff --git a/src/messenger/gnunet-service-messenger_room.h b/src/messenger/gnunet-service-messenger_room.h
index 4b3811104..58edc4121 100644
--- a/src/messenger/gnunet-service-messenger_room.h
+++ b/src/messenger/gnunet-service-messenger_room.h
@@ -95,10 +95,15 @@ create_room (struct GNUNET_MESSENGER_SrvHandle *handle,
 /**
 * Destroys a room and frees its memory fully.
 *
+ * The <i>deletion</i> flag should only be set to #GNUNET_YES if the
+ * room gets dropped by the service, otherwise #GNUNET_NO.
+ *
 * @param[in/out] room Room
+ * @param[in] deletion Flag to indicate context of destruction
 */
 void
-destroy_room (struct GNUNET_MESSENGER_SrvRoom *room);
+destroy_room (struct GNUNET_MESSENGER_SrvRoom *room,
+              int deletion);
 /**
 * Returns the used member store of a given <i>room</i>.
@@ -364,4 +369,12 @@ load_room (struct GNUNET_MESSENGER_SrvRoom *room);
 void
 save_room (struct GNUNET_MESSENGER_SrvRoom *room);
+/**
+ * Removes the configuration for a given <i>room</i> of a service.
+ *
+ * @param[in] room Room
+ */
+void
+remove_room (struct GNUNET_MESSENGER_SrvRoom *room);
 #endif //GNUNET_SERVICE_MESSENGER_ROOM_H
diff --git a/src/messenger/gnunet-service-messenger_service.c b/src/messenger/gnunet-service-messenger_service.c
index b53b72af8..83d7632d8 100644
--- a/src/messenger/gnunet-service-messenger_service.c
+++ b/src/messenger/gnunet-service-messenger_service.c
@@ -94,7 +94,7 @@ iterate_destroy_rooms (void *cls,
                       void *value)
 {
  struct GNUNET_MESSENGER_SrvRoom *room = value;
-  destroy_room (room);
+  destroy_room (room, GNUNET_NO);
  return GNUNET_YES;
 }
@@ -220,7 +220,7 @@ open_service_room (struct GNUNET_MESSENGER_Service *service,
                                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST)))
    return GNUNET_YES;
-  destroy_room (room);
+  destroy_room (room, GNUNET_YES);
  return GNUNET_NO;
 }
@@ -253,7 +253,7 @@ entry_service_room (struct GNUNET_MESSENGER_Service *service,
  }
  else
  {
-    destroy_room (room);
+    destroy_room (room, GNUNET_YES);
    return GNUNET_NO;
  }
@@ -287,7 +287,7 @@ close_service_room (struct GNUNET_MESSENGER_Service *service,
  {
    if (GNUNET_OK == GNUNET_CONTAINER_multihashmap_remove (service->rooms, key, room))
    {
-      destroy_room (room);
+      destroy_room (room, GNUNET_YES);
      return GNUNET_YES;
    }
    else
diff --git a/src/messenger/messenger.conf.in b/src/messenger/messenger.conf.in
index 6b54550ea..ef0544681 100644
--- a/src/messenger/messenger.conf.in
+++ b/src/messenger/messenger.conf.in
@@ -1,12 +1,12 @@
 [messenger]
-START_ON_DEMAND = YES
+START_ON_DEMAND = @START_ON_DEMAND@
 RUN_PER_USER = YES
-PORT = 2097
+@JAVAPORT@PORT = 2125
 HOSTNAME = localhost
 BINARY = gnunet-service-messenger
 ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
-UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-messenger.sock
+UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-messenger.sock
 UNIX_MATCH_UID = NO
 UNIX_MATCH_GID = YES
diff --git a/src/messenger/messenger_api_message.c b/src/messenger/messenger_api_message.c
index 496c98dbf..3814def70 100644
--- a/src/messenger/messenger_api_message.c
+++ b/src/messenger/messenger_api_message.c
@@ -219,6 +219,10 @@ get_message_body_kind_size (enum GNUNET_MESSENGER_MessageKind kind)
  case GNUNET_MESSENGER_KIND_PRIVATE:
    length += member_size(struct GNUNET_MESSENGER_Message, body.privacy.key);
    break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    length += member_size(struct GNUNET_MESSENGER_Message, body.deletion.hash);
+    length += member_size(struct GNUNET_MESSENGER_Message, body.deletion.delay);
+    break;
  default:
    break;
  }
@@ -445,6 +449,10 @@ encode_message_body (enum GNUNET_MESSENGER_MessageKind kind,
    encode_step(buffer, offset, &(body->privacy.key));
    encode_step_ext(buffer, offset, body->privacy.data, min(length - offset, body->privacy.length));
    break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    encode_step(buffer, offset, &(body->deletion.hash));
+    encode_step(buffer, offset, &(body->deletion.delay));
+    break;
  default:
    break;
  }
@@ -616,6 +624,10 @@ decode_message_body (enum GNUNET_MESSENGER_MessageKind *kind,
    body->privacy.length = (length - offset);
    decode_step_malloc(buffer, offset, body->privacy.data, length - offset, 0);
    break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    decode_step(buffer, offset, &(body->deletion.hash));
+    decode_step(buffer, offset, &(body->deletion.delay));
+    break;
  default:
    *kind = GNUNET_MESSENGER_KIND_UNKNOWN;
    break;
diff --git a/src/namecache/test_namecache_api_cache_block.c b/src/namecache/test_namecache_api_cache_block.c
index 310c4de42..6188fb014 100644
--- a/src/namecache/test_namecache_api_cache_block.c
+++ b/src/namecache/test_namecache_api_cache_block.c
@@ -187,9 +187,10 @@ run (void *cls,
  rd.data = GNUNET_malloc (TEST_RECORD_DATALEN);
  rd.flags = 0;
  memset ((char *) rd.data, 'a', TEST_RECORD_DATALEN);
-  block = GNUNET_GNSRECORD_block_create (&privkey,
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (&privkey,
-                                         GNUNET_TIME_UNIT_FOREVER_ABS,
+                                                             GNUNET_TIME_UNIT_FOREVER_ABS,
-                                         name, &rd, 1);
+                                                             name, &rd, 1,
+                                                             &block));
  if (NULL == block)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index 51708dd67..2441b864a 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -39,6 +39,7 @@ if HAVE_SQLITE
 SQLITE_PLUGIN = libgnunet_plugin_namestore_sqlite.la
 SQLITE_TESTS = test_plugin_namestore_sqlite \
 test_namestore_api_store_sqlite \
+ test_namestore_api_store_locking_sqlite \
 test_namestore_api_store_update_sqlite \
 test_namestore_api_zone_iteration_sqlite \
 test_namestore_api_remove_sqlite \
@@ -249,6 +250,16 @@ test_namestore_api_store_sqlite_LDADD = \
  $(top_builddir)/src/identity/libgnunetidentity.la \
  libgnunetnamestore.la
+test_namestore_api_store_locking_sqlite_SOURCES = \
+ test_namestore_api_store_locking.c
+test_namestore_api_store_locking_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
+  libgnunetnamestore.la
 test_namestore_api_store_postgres_SOURCES = \
 test_namestore_api_store.c
 test_namestore_api_store_postgres_LDADD = \
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 852d99608..af40f2dbe 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -33,6 +33,12 @@
 #include <gnunet_gns_service.h>
 #include <gnunet_namestore_service.h>
+/**
+ * The upper bound for the zone iteration interval
+ * (per record).
+ */
+#define WARN_RELATIVE_EXPIRATION_LIMIT GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MINUTES, 15)
 /**
 * Entry in record set for bulk processing.
@@ -430,6 +436,8 @@ display_record (const char *rname,
    if ((GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
        (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)))
      continue;
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
    if ((type != rd[i].record_type) && (GNUNET_GNSRECORD_TYPE_ANY != type))
      continue;
    have_record = GNUNET_YES;
@@ -447,6 +455,8 @@ display_record (const char *rname,
    if ((GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
        (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)))
      continue;
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
    if ((type != rd[i].record_type) && (GNUNET_GNSRECORD_TYPE_ANY != type))
      continue;
    typestr = GNUNET_GNSRECORD_number_to_typename (rd[i].record_type);
@@ -649,28 +659,6 @@ get_existing_record (void *cls,
  {
    switch (rd[i].record_type)
    {
-    case GNUNET_DNSPARSER_TYPE_CNAME:
-      fprintf (
-        stderr,
-        _ (
-          "A %s record exists already under `%s', no other records can be added.\n"),
-        "CNAME",
-        rec_name);
-      ret = 1;
-      test_finished ();
-      return;
-    case GNUNET_GNSRECORD_TYPE_PKEY:
-    case GNUNET_GNSRECORD_TYPE_EDKEY:
-      fprintf (
-        stderr,
-        _ (
-          "A zone key record exists already under `%s', no other records can be added.\n"),
-        rec_name);
-      ret = 1;
-      test_finished ();
-      return;
    case GNUNET_DNSPARSER_TYPE_SOA:
      if (GNUNET_DNSPARSER_TYPE_SOA == type)
      {
@@ -686,51 +674,6 @@ get_existing_record (void *cls,
      break;
    }
  }
-  switch (type)
-  {
-  case GNUNET_DNSPARSER_TYPE_CNAME:
-    if (0 != rd_count)
-    {
-      fprintf (stderr,
-               _ (
-                 "Records already exist under `%s', cannot add `%s' record.\n"),
-               rec_name,
-               "CNAME");
-      ret = 1;
-      test_finished ();
-      return;
-    }
-    break;
-  case GNUNET_GNSRECORD_TYPE_PKEY:
-  case GNUNET_GNSRECORD_TYPE_EDKEY:
-    if (0 != rd_count)
-    {
-      fprintf (stderr,
-               _ (
-                 "Records already exist under `%s', cannot add record.\n"),
-               rec_name);
-      ret = 1;
-      test_finished ();
-      return;
-    }
-    break;
-  case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-    for (unsigned int i = 0; i < rd_count; i++)
-      if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
-      {
-        fprintf (
-          stderr,
-          _ (
-            "Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"),
-          rec_name);
-        ret = 1;
-        test_finished ();
-        return;
-      }
-    break;
-  }
  memset (rdn, 0, sizeof(struct GNUNET_GNSRECORD_Data));
  GNUNET_memcpy (&rdn[1], rd, rd_count * sizeof(struct GNUNET_GNSRECORD_Data));
  rde = &rdn[0];
@@ -929,6 +872,13 @@ parse_expiration (const char *expirationstring,
  {
    *etime_is_rel = GNUNET_YES;
    *etime = etime_rel.rel_value_us;
+    if (GNUNET_TIME_relative_cmp (etime_rel, <, WARN_RELATIVE_EXPIRATION_LIMIT))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Relative expiration times of less than %s are not recommended. To improve availability, consider increasing this value.\n",
+                  GNUNET_STRINGS_relative_time_to_string (
+                    WARN_RELATIVE_EXPIRATION_LIMIT, GNUNET_NO));
+    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Storing record with relative expiration time of %s\n",
                GNUNET_STRINGS_relative_time_to_string (etime_rel, GNUNET_NO));
@@ -1212,8 +1162,8 @@ run_with_zone_pkey (const struct GNUNET_CONFIGURATION_Handle *cfg)
    char sname[64];
    struct GNUNET_IDENTITY_PublicKey pkey;
-    memset(sh, 0, 105);
+    memset (sh, 0, 105);
-    memset(sname, 0, 64);
+    memset (sname, 0, 64);
    if ((2 != (sscanf (uri, "gnunet://gns/%58s/%63s", sh, sname))) ||
        (GNUNET_OK !=
@@ -1286,15 +1236,6 @@ identity_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
  el = NULL;
-  if ((NULL != name) && (0 != strchr (name, '.')))
-  {
-    fprintf (stderr,
-             _ ("Label `%s' contains `.' which is not allowed\n"),
-             name);
-    GNUNET_SCHEDULER_shutdown ();
-    ret = -1;
-    return;
-  }
  if (NULL == ego)
  {
@@ -1705,13 +1646,13 @@ main (int argc, char *const *argv)
                                  NULL)))
  {
    GNUNET_free_nz ((void *) argv);
-    //FIXME
+    // FIXME
-    //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+    // GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
    return lret;
  }
  GNUNET_free_nz ((void *) argv);
-  //FIXME
+  // FIXME
-  //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+  // GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
  return ret;
 }
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 9b2d9b6f3..d735822fb 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -121,6 +121,23 @@ struct ZoneIteration
  int send_end;
 };
+/**
+ * Lock on a record set
+ */
+struct RecordsLock
+{
+  /* DLL */
+  struct RecordsLock *prev;
+  /* DLL */
+  struct RecordsLock *next;
+  /* Hash of the locked label */
+  struct GNUNET_HashCode label_hash;
+  /* Client locking the zone */
+  struct NamestoreClient *client;
+};
 /**
 * A namestore client
@@ -394,6 +411,16 @@ static struct StoreActivity *sa_head;
 static struct StoreActivity *sa_tail;
 /**
+ * Head of the DLL of record set locks
+ */
+static struct RecordsLock *locks_head;
+/**
+ * Tail of the DLL of record set locks
+ */
+static struct RecordsLock *locks_tail;
+/**
 * Notification context shared by all monitors.
 */
 static struct GNUNET_NotificationContext *monitor_nc;
@@ -420,6 +447,7 @@ static void
 cleanup_task (void *cls)
 {
  struct CacheOperation *cop;
+  struct RecordsLock *lock;
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Stopping namestore service\n");
@@ -431,6 +459,14 @@ cleanup_task (void *cls)
    GNUNET_CONTAINER_DLL_remove (cop_head, cop_tail, cop);
    GNUNET_free (cop);
  }
+  while (NULL != (lock = locks_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (locks_head,
+                                 locks_tail,
+                                 lock);
+    GNUNET_free (lock);
+  }
  if (NULL != namecache)
  {
    GNUNET_NAMECACHE_disconnect (namecache);
@@ -808,7 +844,8 @@ send_lookup_response (struct NamestoreClient *nc,
 * @param rid client's request ID
 */
 static void
-send_store_response (struct NamestoreClient *nc, int res, uint32_t rid)
+send_store_response (struct NamestoreClient *nc, int res, const char*emsg,
+                     uint32_t rid)
 {
  struct GNUNET_MQ_Envelope *env;
  struct RecordStoreResponseMessage *rcr_msg;
@@ -820,10 +857,17 @@ send_store_response (struct NamestoreClient *nc, int res, uint32_t rid)
                            "Store requests completed",
                            1,
                            GNUNET_NO);
-  env = GNUNET_MQ_msg (rcr_msg,
+  env = GNUNET_MQ_msg_extra (rcr_msg,
-                       GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE);
+                             (NULL != emsg) ? strlen (emsg) + 1 : 0,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE);
  rcr_msg->gns_header.r_id = htonl (rid);
  rcr_msg->op_result = htonl (res);
+  rcr_msg->reserved = htons (0);
+  if (NULL != emsg)
+  {
+    rcr_msg->emsg_len = htons (strlen (emsg) + 1);
+    memcpy (&rcr_msg[1], emsg, strlen (emsg) + 1);
+  }
  GNUNET_MQ_send (nc->mq, env);
 }
@@ -874,7 +918,7 @@ finish_cache_operation (void *cls, int32_t success, const char *emsg)
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "CACHE operation completed\n");
  GNUNET_CONTAINER_DLL_remove (cop_head, cop_tail, cop);
  if (NULL != cop->nc)
-    send_store_response (cop->nc, success, cop->rid);
+    send_store_response (cop->nc, success, emsg, cop->rid);
  if (NULL != (zi = cop->zi))
  {
    zi->cache_ops--;
@@ -910,29 +954,40 @@ refresh_block (struct NamestoreClient *nc,
               const struct GNUNET_GNSRECORD_Data *rd)
 {
  struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_GNSRECORD_Data rd_clean[rd_count];
  struct CacheOperation *cop;
  struct GNUNET_IDENTITY_PublicKey pkey;
  struct GNUNET_GNSRECORD_Data *nick;
  struct GNUNET_GNSRECORD_Data *res;
  unsigned int res_count;
+  unsigned int rd_count_clean;
  struct GNUNET_TIME_Absolute exp_time;
+  /** Do not block-cache tombstones */
+  rd_count_clean = 0;
+  for (int i = 0; i < rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
+    rd_clean[rd_count_clean++] = rd[i];
+  }
  nick = get_nick_record (zone_key);
-  res_count = rd_count;
+  res_count = rd_count_clean;
-  res = (struct GNUNET_GNSRECORD_Data *) rd;  /* fixme: a bit unclean... */
+  res = (struct GNUNET_GNSRECORD_Data *) rd_clean;  /* fixme: a bit unclean... */
  if ((NULL != nick) && (0 != strcmp (name, GNUNET_GNS_EMPTY_LABEL_AT)))
  {
    nick->flags =
      (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
-    merge_with_nick_records (nick, rd_count, rd, &res_count, &res);
+    merge_with_nick_records (nick, rd_count_clean, rd_clean, &res_count, &res);
  }
  if (NULL != nick)
    GNUNET_free (nick);
  if (0 == res_count)
  {
    if (NULL != nc)
-      send_store_response (nc, GNUNET_OK, rid);
+      send_store_response (nc, GNUNET_OK, NULL, rid);
-    if (rd != res)
+    if (rd_clean != res)
      GNUNET_free (res);
    return;   /* no data, no need to update cache */
  }
@@ -943,20 +998,21 @@ refresh_block (struct NamestoreClient *nc,
                              1,
                              GNUNET_NO);
    if (NULL != nc)
-      send_store_response (nc, GNUNET_OK, rid);
+      send_store_response (nc, GNUNET_OK, NULL, rid);
-    if (rd != res)
+    if (rd_clean != res)
      GNUNET_free (res);
    return;
  }
-  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count, res);
+  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count, res,
+                                                          GNUNET_TIME_UNIT_ZERO_ABS);
  if (cache_keys)
    GNUNET_assert (GNUNET_OK ==
-      GNUNET_GNSRECORD_block_create2 (zone_key, exp_time, name,
+                   GNUNET_GNSRECORD_block_create2 (zone_key, exp_time, name,
-                                      res, res_count, &block));
+                                                   res, res_count, &block));
  else
    GNUNET_assert (GNUNET_OK ==
-      GNUNET_GNSRECORD_block_create (zone_key, exp_time, name,
+                   GNUNET_GNSRECORD_block_create (zone_key, exp_time, name,
-                                     res, res_count, &block));
+                                                  res, res_count, &block));
  GNUNET_assert (NULL != block);
  GNUNET_IDENTITY_key_get_public (zone_key, &pkey);
  GNUNET_log (
@@ -974,7 +1030,7 @@ refresh_block (struct NamestoreClient *nc,
  cop->nc = nc;
  cop->zi = zi;
  if (NULL != zi)
-    zi->cache_ops++;
+    zi->cache_ops ++;
  cop->rid = rid;
  GNUNET_CONTAINER_DLL_insert (cop_head, cop_tail, cop);
  cop->qe = GNUNET_NAMECACHE_block_cache (namecache,
@@ -982,7 +1038,7 @@ refresh_block (struct NamestoreClient *nc,
                                          &finish_cache_operation,
                                          cop);
  GNUNET_free (block);
-  if (rd != res)
+  if (rd_clean != res)
    GNUNET_free (res);
 }
@@ -1098,6 +1154,7 @@ client_disconnect_cb (void *cls,
  struct NamestoreClient *nc = app_ctx;
  struct ZoneIteration *no;
  struct CacheOperation *cop;
+  struct RecordsLock *lock;
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Client %p disconnected\n", client);
@@ -1148,6 +1205,15 @@ client_disconnect_cb (void *cls,
  for (cop = cop_head; NULL != cop; cop = cop->next)
    if (nc == cop->nc)
      cop->nc = NULL;
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+  {
+    if (nc != lock->client)
+      continue;
+    GNUNET_CONTAINER_DLL_remove (locks_head,
+                                 locks_tail,
+                                 lock);
+    GNUNET_free (lock);
+  }
  GNUNET_free (nc);
 }
@@ -1341,6 +1407,105 @@ check_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
  return GNUNET_OK;
 }
+static void
+calculate_lock_hash (const char *label,
+                     const struct GNUNET_IDENTITY_PrivateKey *zone,
+                     struct GNUNET_HashCode *result)
+{
+  struct GNUNET_HashContext *hctx;
+  hctx = GNUNET_CRYPTO_hash_context_start ();
+  GNUNET_CRYPTO_hash_context_read (hctx, label, strlen (label));
+  GNUNET_CRYPTO_hash_context_read (hctx, zone,
+                                   sizeof (*zone));
+  GNUNET_CRYPTO_hash_context_finish (hctx, result);
+}
+/**
+ * Release a lock on a record set.
+ * Does nothing if lock not held.
+ *
+ * @param label the label of the record set
+ * @param zone the zone
+ * @param nc the client releasing the lock
+ */
+static void
+NST_label_lock_release (const char *label,
+                        const struct GNUNET_IDENTITY_PrivateKey *zone,
+                        const struct NamestoreClient *nc)
+{
+  struct GNUNET_HashCode label_hash;
+  struct RecordsLock *lock;
+  calculate_lock_hash (label, zone, &label_hash);
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+    if (0 == memcmp (&label_hash, &lock->label_hash, sizeof (label_hash)))
+      break;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Record locked: %s\n", (NULL == lock) ? "No" : "Yes");
+  if (NULL == lock)
+    return;
+  if (lock->client != nc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Lock is held by other client on `%s'\n", label);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Unocking %s\n", GNUNET_h2s (&label_hash));
+  GNUNET_CONTAINER_DLL_remove (locks_head,
+                               locks_tail,
+                               lock);
+  GNUNET_free (lock);
+}
+/**
+ * Get/set a lock on a record set.
+ * May be called multiple times but will
+ * not aquire additional locks.
+ *
+ * @param the label of the record set
+ * @param the zone
+ * @param the client doing the locking
+ * @return GNUNET_YES if lock retrieved or set already.
+ */
+static enum GNUNET_GenericReturnValue
+NST_label_lock (const char *label,
+                const struct GNUNET_IDENTITY_PrivateKey *zone,
+                struct NamestoreClient *nc)
+{
+  struct GNUNET_HashCode label_hash;
+  struct RecordsLock *lock;
+  calculate_lock_hash (label, zone, &label_hash);
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+    if (0 == memcmp (&label_hash, &lock->label_hash, sizeof (label_hash)))
+      break;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Record locked: %s\n", (NULL == lock) ? "No" : "Yes");
+  if (NULL != lock)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client holds lock: %s\n", (lock->client != nc) ? "No" : "Yes");
+    if (lock->client != nc)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Lock is held by other client on `%s'\n", label);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  }
+  lock = GNUNET_new (struct RecordsLock);
+  lock->client = nc;
+  memcpy (&lock->label_hash, &label_hash, sizeof (label_hash));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Locking %s\n", GNUNET_h2s (&label_hash));
+  GNUNET_CONTAINER_DLL_insert (locks_head,
+                               locks_tail,
+                               lock);
+  return GNUNET_YES;
+}
 /**
 * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP message
@@ -1355,13 +1520,14 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
  struct GNUNET_MQ_Envelope *env;
  struct LabelLookupResponseMessage *llr_msg;
  struct RecordLookupContext rlc;
+  struct RecordsLock *lock;
+  struct GNUNET_HashCode label_hash;
  const char *name_tmp;
  char *res_name;
  char *conv_name;
  uint32_t name_len;
  int res;
-  name_len = ntohl (ll_msg->label_len);
  name_tmp = (const char *) &ll_msg[1];
  GNUNET_SERVICE_client_continue (nc->client);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1377,6 +1543,29 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
    GNUNET_SERVICE_client_drop (nc->client);
    return;
  }
+  name_len = strlen (conv_name) + 1;
+  if (GNUNET_YES == ntohl (ll_msg->locking))
+  {
+    if (GNUNET_NO == NST_label_lock (conv_name, &ll_msg->zone, nc))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Lock is held by other client on `%s'\n", conv_name);
+      env =
+        GNUNET_MQ_msg_extra (llr_msg,
+                             name_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP_RESPONSE);
+      llr_msg->gns_header.r_id = ll_msg->gns_header.r_id;
+      llr_msg->private_key = ll_msg->zone;
+      llr_msg->name_len = htons (name_len);
+      llr_msg->rd_count = htons (0);
+      llr_msg->rd_len = htons (0);
+      llr_msg->found = htons (GNUNET_SYSERR);
+      GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
+      GNUNET_MQ_send (nc->mq, env);
+      GNUNET_free (conv_name);
+      return;
+    }
+  }
  rlc.label = conv_name;
  rlc.found = GNUNET_NO;
  rlc.res_rd_count = 0;
@@ -1388,7 +1577,6 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
                                      conv_name,
                                      &lookup_it,
                                      &rlc);
-  GNUNET_free (conv_name);
  env =
    GNUNET_MQ_msg_extra (llr_msg,
                         name_len + rlc.rd_ser_len,
@@ -1400,16 +1588,18 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
  llr_msg->rd_len = htons (rlc.rd_ser_len);
  res_name = (char *) &llr_msg[1];
  if ((GNUNET_YES == rlc.found) && (GNUNET_OK == res))
-    llr_msg->found = ntohs (GNUNET_YES);
+    llr_msg->found = htons (GNUNET_YES);
  else
-    llr_msg->found = ntohs (GNUNET_NO);
+    llr_msg->found = htons (GNUNET_NO);
-  GNUNET_memcpy (&llr_msg[1], name_tmp, name_len);
+  GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
  GNUNET_memcpy (&res_name[name_len], rlc.res_rd, rlc.rd_ser_len);
  GNUNET_MQ_send (nc->mq, env);
  GNUNET_free (rlc.res_rd);
+  GNUNET_free (conv_name);
 }
 /**
 * Checks a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE message
 *
@@ -1452,6 +1642,45 @@ check_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
 /**
+ * Check if set contains a tombstone, store if necessary
+ *
+ * @param cls a `struct GNUNET_GNSRECORD_Data **` for storing the nick (if found)
+ * @param seq sequence number of the record, MUST NOT BE ZERO
+ * @param private_key the private key of the zone (unused)
+ * @param label should be #GNUNET_GNS_EMPTY_LABEL_AT
+ * @param rd_count number of records in @a rd
+ * @param rd records stored under @a label in the zone
+ */
+static void
+get_block_exp_existing (void *cls,
+                        uint64_t seq,
+                        const struct
+                        GNUNET_IDENTITY_PrivateKey *private_key,
+                        const char *label,
+                        unsigned int rd_count,
+                        const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_TIME_Absolute *exp = cls;
+  struct GNUNET_GNSRECORD_Data rd_pub[rd_count];
+  unsigned int rd_pub_count;
+  char *emsg;
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
+                                                                rd,
+                                                                rd_count,
+                                                                rd_pub,
+                                                                &rd_pub_count,
+                                                                exp,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "%s\n", emsg);
+    GNUNET_free (emsg);
+  }
+}
+/**
 * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE message
 *
 * @param cls client sending the message
@@ -1470,37 +1699,75 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
  unsigned int rd_count;
  int res;
  struct StoreActivity *sa;
+  struct RecordsLock *lock;
+  struct GNUNET_HashCode label_hash;
+  struct GNUNET_TIME_Absolute existing_block_exp;
+  struct GNUNET_TIME_Absolute new_block_exp;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received NAMESTORE_RECORD_STORE message\n");
+  existing_block_exp = GNUNET_TIME_UNIT_ZERO_ABS;
+  new_block_exp = GNUNET_TIME_UNIT_ZERO_ABS;
  rid = ntohl (rp_msg->gns_header.r_id);
  name_len = ntohs (rp_msg->name_len);
  rd_count = ntohs (rp_msg->rd_count);
  rd_ser_len = ntohs (rp_msg->rd_len);
-  GNUNET_break (0 == ntohs (rp_msg->reserved));
  name_tmp = (const char *) &rp_msg[1];
  rd_ser = &name_tmp[name_len];
  {
    struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
+    char *emsg;
-    if (GNUNET_OK !=
-        GNUNET_GNSRECORD_records_deserialize (rd_ser_len, rd_ser, rd_count, rd))
-    {
-      GNUNET_break (0);
-      GNUNET_SERVICE_client_drop (nc->client);
-      return;
-    }
    /* Extracting and converting private key */
    conv_name = GNUNET_GNSRECORD_string_normalize (name_tmp);
    if (NULL == conv_name)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Error converting name `%s'\n",
+                  "Error normalizing name `%s'\n",
                  name_tmp);
-      GNUNET_SERVICE_client_drop (nc->client);
+      send_store_response (nc, GNUNET_SYSERR, _ ("Error normalizing name."),
+                           rid);
+      GNUNET_SERVICE_client_continue (nc->client);
+      return;
+    }
+    /* Check name for validity */
+    if (GNUNET_OK != GNUNET_GNSRECORD_label_check (conv_name, &emsg))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Label invalid: `%s'\n",
+                  emsg);
+      send_store_response (nc, GNUNET_SYSERR, emsg, rid);
+      GNUNET_free (emsg);
+      GNUNET_free (conv_name);
+      GNUNET_SERVICE_client_continue (nc->client);
+      return;
+    }
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_records_deserialize (rd_ser_len, rd_ser, rd_count, rd))
+    {
+      send_store_response (nc, GNUNET_SYSERR,
+                           _ ("Error deserializing records."), rid);
+      GNUNET_free (conv_name);
+      GNUNET_SERVICE_client_continue (nc->client);
      return;
    }
+    if (GNUNET_YES == ntohl (rp_msg->locking))
+    {
+      if (GNUNET_NO == NST_label_lock (conv_name, &rp_msg->private_key, nc))
+      {
+        send_store_response (nc, GNUNET_SYSERR, _ ("Record set locked."), rid);
+        GNUNET_SERVICE_client_continue (nc->client);
+        GNUNET_free (conv_name);
+        return;
+      }
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Client has lock on `%s', continuing.\n", conv_name);
+      if (GNUNET_YES == ntohl (rp_msg->locking))
+        NST_label_lock_release (conv_name, &rp_msg->private_key, nc);
+    }
    GNUNET_STATISTICS_update (statistics,
                              "Well-formed store requests received",
                              1,
@@ -1509,12 +1776,12 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
                "Creating %u records for name `%s'\n",
                (unsigned int) rd_count,
                conv_name);
-    if ((0 == rd_count) &&
+    if ((GNUNET_NO == GSN_database->lookup_records (GSN_database->cls,
-        (GNUNET_NO == GSN_database->lookup_records (GSN_database->cls,
                                                    &rp_msg->private_key,
                                                    conv_name,
-                                                    NULL,
+                                                    &get_block_exp_existing,
-                                                    0)))
+                                                    &existing_block_exp)) &&
+        (rd_count == 0))
    {
      /* This name does not exist, so cannot be removed */
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1525,9 +1792,18 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
    else
    {
      /* remove "NICK" records, unless this is for the
-       #GNUNET_GNS_EMPTY_LABEL_AT label */
+       #GNUNET_GNS_EMPTY_LABEL_AT label
+       We may need one additional record later for tombstone.
+       FIXME: Since we must normalize the record set (check for
+       consistency etc) we have to iterate the set twice.
+       May be inefficient.
+       We cannot really move the nick caching into GNSRECORD.
+       */
      struct GNUNET_GNSRECORD_Data rd_clean[GNUNET_NZL (rd_count)];
+      struct GNUNET_GNSRECORD_Data rd_nf[GNUNET_NZL (rd_count) + 1];
      unsigned int rd_clean_off;
+      unsigned int rd_nf_count;
+      char *emsg;
      int have_nick;
      rd_clean_off = 0;
@@ -1535,6 +1811,7 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
      for (unsigned int i = 0; i < rd_count; i++)
      {
        rd_clean[rd_clean_off] = rd[i];
        if ((0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, conv_name)) ||
            (GNUNET_GNSRECORD_TYPE_NICK != rd[i].record_type))
          rd_clean_off++;
@@ -1546,6 +1823,38 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
          have_nick = GNUNET_YES;
        }
      }
+      if (GNUNET_OK != GNUNET_GNSRECORD_normalize_record_set (conv_name,
+                                                              rd_clean,
+                                                              rd_clean_off,
+                                                              rd_nf,
+                                                              &rd_nf_count,
+                                                              &new_block_exp,
+                                                              GNUNET_YES,
+                                                              &emsg))
+      {
+        send_store_response (nc, GNUNET_SYSERR, emsg, rid);
+        GNUNET_free (emsg);
+        GNUNET_SERVICE_client_continue (nc->client);
+        GNUNET_free (conv_name);
+        return;
+      }
+      /*
+       * If existing_block_exp is 0, then there was not record set
+       * and no tombstone.
+       * Otherwise, if the existing block expiration is after the
+       * new block expiration would be, we need to add a tombstone
+       * or update it.
+       */
+      if (GNUNET_TIME_absolute_cmp (new_block_exp, <=, existing_block_exp))
+      {
+        rd_nf[rd_nf_count].record_type = GNUNET_GNSRECORD_TYPE_TOMBSTONE;
+        rd_nf[rd_nf_count].expiration_time =
+          existing_block_exp.abs_value_us;
+        rd_nf[rd_nf_count].data = NULL;
+        rd_nf[rd_nf_count].data_size = 0;
+        rd_nf[rd_nf_count].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+        rd_nf_count++;
+      }
      if ((0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, conv_name)) &&
          (GNUNET_NO == have_nick))
      {
@@ -1555,19 +1864,18 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
      res = GSN_database->store_records (GSN_database->cls,
                                         &rp_msg->private_key,
                                         conv_name,
-                                         rd_clean_off,
+                                         rd_nf_count,
-                                         rd_clean);
+                                         rd_nf);
    }
    if (GNUNET_OK != res)
    {
-      /* store not successful, not need to tell monitors */
+      /* store not successful, no need to tell monitors */
-      send_store_response (nc, res, rid);
+      send_store_response (nc, res, _ ("Store failed"), rid);
      GNUNET_SERVICE_client_continue (nc->client);
      GNUNET_free (conv_name);
      return;
    }
    sa = GNUNET_malloc (sizeof(struct StoreActivity)
                        + ntohs (rp_msg->gns_header.header.size));
    GNUNET_CONTAINER_DLL_insert (sa_head, sa_tail, sa);
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index fd9a8ed47..0f3ffa837 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -68,6 +68,11 @@ struct RecordStoreMessage
  struct GNUNET_TIME_AbsoluteNBO expire;
  /**
+   * Unock the label with this request.
+   */
+  uint32_t locking GNUNET_PACKED;
+  /**
   * Name length
   */
  uint16_t name_len GNUNET_PACKED;
@@ -83,7 +88,7 @@ struct RecordStoreMessage
  uint16_t rd_count GNUNET_PACKED;
  /**
-   * always zero (for alignment)
+   * Reserved for alignment.
   */
  uint16_t reserved GNUNET_PACKED;
@@ -113,6 +118,20 @@ struct RecordStoreResponseMessage
   * #GNUNET_SYSERR on failure, #GNUNET_OK on success
   */
  int32_t op_result GNUNET_PACKED;
+  /**
+   * Error message length
+   */
+  uint16_t emsg_len GNUNET_PACKED;
+  /**
+   * Reserved for alignment.
+   */
+  uint16_t reserved GNUNET_PACKED;
+  /**
+   * Followed by error message
+   */
 };
@@ -132,6 +151,11 @@ struct LabelLookupMessage
  uint32_t label_len GNUNET_PACKED;
  /**
+   * Lock the label with this lookup
+   */
+  uint32_t locking GNUNET_PACKED;
+  /**
   * The private key of the zone to look up in
   */
  struct GNUNET_IDENTITY_PrivateKey zone;
@@ -171,7 +195,7 @@ struct LabelLookupResponseMessage
   * Was the label found in the database??
   * #GNUNET_YES or #GNUNET_NO
   */
-  uint16_t found GNUNET_PACKED;
+  int16_t found GNUNET_PACKED;
  /**
   * The private key of the authority.
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index b24db9b26..a7380bbde 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -346,6 +346,44 @@ check_rd (size_t rd_len, const void *rd_buf, unsigned int rd_count)
  return GNUNET_OK;
 }
+/**
+ * Handle an incoming message of type
+ * #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE
+ *
+ * @param cls
+ * @param msg the message we received
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static int
+check_record_store_response (void *cls,
+                             const struct RecordStoreResponseMessage *msg)
+{
+  const char *emsg;
+  size_t msg_len;
+  size_t emsg_len;
+  (void) cls;
+  msg_len = ntohs (msg->gns_header.header.size);
+  emsg_len = ntohs (msg->emsg_len);
+  if (0 != ntohs (msg->reserved))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (msg_len != sizeof(struct RecordStoreResponseMessage) + emsg_len)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  emsg = (const char *) &msg[1];
+  if ((0 != emsg_len) && ('\0' != emsg[emsg_len - 1]))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
 /**
 * Handle an incoming message of type
@@ -364,19 +402,16 @@ handle_record_store_response (void *cls,
  const char *emsg;
  qe = find_qe (h, ntohl (msg->gns_header.r_id));
+  emsg = (const char *) &msg[1];
  res = ntohl (msg->op_result);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received RECORD_STORE_RESPONSE with result %d\n",
       res);
-  /* TODO: add actual error message from namestore to response... */
-  if (GNUNET_SYSERR == res)
-    emsg = _ ("Namestore failed to store record\n");
-  else
-    emsg = NULL;
  if (NULL == qe)
    return;
  if (NULL != qe->cont)
-    qe->cont (qe->cont_cls, res, emsg);
+    qe->cont (qe->cont_cls, res,
+             (GNUNET_OK == res) ? NULL : emsg);
  free_qe (qe);
 }
@@ -444,8 +479,10 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
  size_t name_len;
  size_t rd_len;
  unsigned int rd_count;
+  int16_t found = (int16_t) ntohs (msg->found);
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_LOOKUP_RESULT\n");
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_LOOKUP_RESULT (found=%i)\n",
+        found);
  qe = find_qe (h, ntohl (msg->gns_header.r_id));
  if (NULL == qe)
    return;
@@ -453,7 +490,7 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
  rd_count = ntohs (msg->rd_count);
  name_len = ntohs (msg->name_len);
  name = (const char *) &msg[1];
-  if (GNUNET_NO == ntohs (msg->found))
+  if (GNUNET_NO == found)
  {
    /* label was not in namestore */
    if (NULL != qe->proc)
@@ -461,6 +498,13 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
    free_qe (qe);
    return;
  }
+  if (GNUNET_SYSERR == found)
+  {
+    if (NULL != qe->error_cb)
+      qe->error_cb (qe->error_cb_cls);
+    free_qe (qe);
+    return;
+  }
  rd_tmp = &name[name_len];
  {
@@ -775,7 +819,7 @@ static void
 reconnect (struct GNUNET_NAMESTORE_Handle *h)
 {
  struct GNUNET_MQ_MessageHandler handlers[] =
-  { GNUNET_MQ_hd_fixed_size (record_store_response,
+  { GNUNET_MQ_hd_var_size (record_store_response,
                             GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE,
                             struct RecordStoreResponseMessage,
                             h),
@@ -969,30 +1013,16 @@ warn_delay (void *cls)
  GNUNET_NAMESTORE_cancel (qe);
 }
-/**
- * Store an item in the namestore.  If the item is already present,
- * it is replaced with the new record.  Use an empty array to
- * remove all records under the given name.
- *
- * @param h handle to the namestore
- * @param pkey private key of the zone
- * @param label name that is being mapped (at most 255 characters long)
- * @param rd_count number of records in the @a rd array
- * @param rd array of records with data to store
- * @param cont continuation to call when done
- * @param cont_cls closure for @a cont
- * @return handle to abort the request
- */
 struct GNUNET_NAMESTORE_QueueEntry *
-GNUNET_NAMESTORE_records_store (
+records_store_ (
  struct GNUNET_NAMESTORE_Handle *h,
  const struct GNUNET_IDENTITY_PrivateKey *pkey,
  const char *label,
  unsigned int rd_count,
  const struct GNUNET_GNSRECORD_Data *rd,
  GNUNET_NAMESTORE_ContinuationWithStatus cont,
-  void *cont_cls)
+  void *cont_cls,
+  int locking)
 {
  struct GNUNET_NAMESTORE_QueueEntry *qe;
  struct GNUNET_MQ_Envelope *env;
@@ -1037,8 +1067,9 @@ GNUNET_NAMESTORE_records_store (
  msg->name_len = htons (name_len);
  msg->rd_count = htons (rd_count);
  msg->rd_len = htons (rd_ser_len);
-  msg->reserved = htons (0);
+  msg->reserved = ntohs(0);
  msg->private_key = *pkey;
+  msg->locking = htonl (locking);
  name_tmp = (char *) &msg[1];
  GNUNET_memcpy (name_tmp, label, name_len);
@@ -1070,28 +1101,45 @@ GNUNET_NAMESTORE_records_store (
  return qe;
 }
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_store (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  unsigned int rd_count,
+  const struct GNUNET_GNSRECORD_Data *rd,
+  GNUNET_NAMESTORE_ContinuationWithStatus cont,
+  void *cont_cls)
+{
+  return records_store_ (h, pkey, label,
+                         rd_count, rd, cont, cont_cls, GNUNET_NO);
+}
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_commit (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  unsigned int rd_count,
+  const struct GNUNET_GNSRECORD_Data *rd,
+  GNUNET_NAMESTORE_ContinuationWithStatus cont,
+  void *cont_cls)
+{
+  return records_store_ (h, pkey, label,
+                         rd_count, rd, cont, cont_cls, GNUNET_YES);
+}
-/**
- * Lookup an item in the namestore.
- *
- * @param h handle to the namestore
- * @param pkey private key of the zone
- * @param label name that is being mapped (at most 255 characters long)
- * @param error_cb function to call on error (i.e. disconnect)
- * @param error_cb_cls closure for @a error_cb
- * @param rm function to call with the result (with 0 records if we don't have that label)
- * @param rm_cls closure for @a rm
- * @return handle to abort the request
- */
 struct GNUNET_NAMESTORE_QueueEntry *
-GNUNET_NAMESTORE_records_lookup (
+records_lookup_ (
  struct GNUNET_NAMESTORE_Handle *h,
  const struct GNUNET_IDENTITY_PrivateKey *pkey,
  const char *label,
  GNUNET_SCHEDULER_TaskCallback error_cb,
  void *error_cb_cls,
  GNUNET_NAMESTORE_RecordMonitor rm,
-  void *rm_cls)
+  void *rm_cls,
+  int locking)
 {
  struct GNUNET_NAMESTORE_QueueEntry *qe;
  struct GNUNET_MQ_Envelope *env;
@@ -1119,6 +1167,7 @@ GNUNET_NAMESTORE_records_lookup (
  msg->gns_header.r_id = htonl (qe->op_id);
  msg->zone = *pkey;
  msg->label_len = htonl (label_len);
+  msg->locking = htonl (locking);
  GNUNET_memcpy (&msg[1], label, label_len);
  if (NULL == h->mq)
    qe->env = env;
@@ -1127,22 +1176,34 @@ GNUNET_NAMESTORE_records_lookup (
  return qe;
 }
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_lookup (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  GNUNET_SCHEDULER_TaskCallback error_cb,
+  void *error_cb_cls,
+  GNUNET_NAMESTORE_RecordMonitor rm,
+  void *rm_cls)
+{
+  return records_lookup_ (h, pkey, label,
+                          error_cb, error_cb_cls, rm, rm_cls, GNUNET_NO);
+}
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_open (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  GNUNET_SCHEDULER_TaskCallback error_cb,
+  void *error_cb_cls,
+  GNUNET_NAMESTORE_RecordMonitor rm,
+  void *rm_cls)
+{
+  return records_lookup_ (h, pkey, label,
+                          error_cb, error_cb_cls, rm, rm_cls, GNUNET_YES);
+}
-/**
- * Look for an existing PKEY delegation record for a given public key.
- * Returns at most one result to the processor.
- *
- * @param h handle to the namestore
- * @param zone public key of the zone to look up in, never NULL
- * @param value_zone public key of the target zone (value), never NULL
- * @param error_cb function to call on error (i.e. disconnect)
- * @param error_cb_cls closure for @a error_cb
- * @param proc function to call on the matching records, or with
- *        NULL (rd_count == 0) if there are no matching records
- * @param proc_cls closure for @a proc
- * @return a handle that can be used to
- *         cancel
- */
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_zone_to_name (
  struct GNUNET_NAMESTORE_Handle *h,
diff --git a/src/namestore/plugin_namestore_sqlite.c b/src/namestore/plugin_namestore_sqlite.c
index 7cb9b7ed0..0b3aac84f 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -329,6 +329,11 @@ namestore_sqlite_store_records (void *cls,
          0,
          sizeof(pkey));
  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Checking if `%d' is zonekey type\n",
+       rd[i].record_type);
    if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
    {
      GNUNET_break (GNUNET_YES ==
@@ -336,8 +341,13 @@ namestore_sqlite_store_records (void *cls,
                                                         rd[i].data_size,
                                                         rd[i].record_type,
                                                         &pkey));
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Storing delegation zone record value `%s'\n",
+       GNUNET_GNSRECORD_z2s (&pkey));
      break;
    }
+  }
  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
                                     UINT64_MAX);
  data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
diff --git a/src/namestore/test_namestore_api_lookup_nick.c b/src/namestore/test_namestore_api_lookup_nick.c
index 6ce969c9b..7decf39f8 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -262,12 +262,12 @@ nick_cont (void *cls, int32_t success, const char *emsg)
              "Nick added : %s\n",
              (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
-  rd_orig.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
+  rd_orig.expiration_time = GNUNET_TIME_UNIT_HOURS.rel_value_us;
  rd_orig.record_type = TEST_RECORD_TYPE;
  rd_orig.data_size = TEST_RECORD_DATALEN;
  record_data = GNUNET_malloc (TEST_RECORD_DATALEN);
  rd_orig.data = record_data;
-  rd_orig.flags = 0;
+  rd_orig.flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
  memset ((char *) rd_orig.data, 'a', TEST_RECORD_DATALEN);
  nsqe = GNUNET_NAMESTORE_records_store (nsh, &privkey,
diff --git a/src/namestore/test_namestore_api_lookup_public.c b/src/namestore/test_namestore_api_lookup_public.c
index 5e3e7bbd8..cd69b96ef 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -188,7 +188,7 @@ run (void *cls,
     struct GNUNET_TESTING_Peer *peer)
 {
  struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
  endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                &endbadly,
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c b/src/namestore/test_namestore_api_lookup_shadow.c
index 79fa4c9c6..8f47d1280 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -223,7 +223,7 @@ run (void *cls,
     struct GNUNET_TESTING_Peer *peer)
 {
  struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
  endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                &endbadly,
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index 4fc197750..0bcd130f9 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -32,7 +32,7 @@
 #define TEST_RECORD_TYPE GNUNET_DNSPARSER_TYPE_TXT
-#define TEST_NAME "dummy.dummy.gnunet"
+#define TEST_NAME "gnunet"
 #define TEST_RECORD_DATALEN 123
 #define TEST_RECORD_DATA 'a'
 #define TEST_SHADOW_RECORD_DATA 'b'
diff --git a/src/namestore/test_namestore_api_remove.c b/src/namestore/test_namestore_api_remove.c
index b6254e531..e8124c595 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -153,7 +153,7 @@ run (void *cls,
     struct GNUNET_TESTING_Peer *peer)
 {
  struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
  endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                &endbadly,
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c b/src/namestore/test_namestore_api_remove_not_existing_record.c
index e66992909..958ea4bf2 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -127,7 +127,7 @@ run (void *cls,
     const struct GNUNET_CONFIGURATION_Handle *cfg,
     struct GNUNET_TESTING_Peer *peer)
 {
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
  endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                &endbadly,
diff --git a/src/namestore/test_namestore_api_zone_to_name.c b/src/namestore/test_namestore_api_zone_to_name.c
index 3fd10e4a1..1e2f8248b 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -216,11 +216,11 @@ run (void *cls,
  {
    struct GNUNET_GNSRECORD_Data rd;
-    rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
+    rd.expiration_time = GNUNET_TIME_UNIT_HOURS.rel_value_us;
    rd.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
-    rd.data_size = GNUNET_IDENTITY_key_get_length (&s_zone_value);
+    rd.data_size = sizeof (s_zone_value.ecdsa_key);
-    rd.data = &s_zone_value;
+    rd.data = &s_zone_value.ecdsa_key;
-    rd.flags = 0;
+    rd.flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
    nsh = GNUNET_NAMESTORE_connect (cfg);
    GNUNET_break (NULL != nsh);
@@ -230,7 +230,7 @@ run (void *cls,
                                    1,
                                    &rd,
                                    &put_cont,
-                                    NULL);
+                                    s_name);
  }
 }
diff --git a/src/namestore/test_namestore_delete.sh b/src/namestore/test_namestore_delete.sh
index 44ea1e66c..b861a4bc0 100755
--- a/src/namestore/test_namestore_delete.sh
+++ b/src/namestore/test_namestore_delete.sh
@@ -61,15 +61,7 @@ for LINE in $OUTPUT ;
 stop_peer
-if [ $FOUND_NAME = false -a $FOUND_IP != false ]
+if [ $FOUND_IP = true ]
-then
-  echo "PASS: Delete name in namestore"
-  exit 0
-elif [ $FOUND_NAME = true ]
-then
-  echo "FAIL: Delete name in namestore: name returned"
-  exit 1
-elif [ $FOUND_IP = true ]
 then
  echo "FAIL: Delete name in namestore: IP returned"
  exit 1
diff --git a/src/namestore/test_plugin_rest_namestore.sh b/src/namestore/test_plugin_rest_namestore.sh
index 8a45cebf5..50b3c8c12 100755
--- a/src/namestore/test_plugin_rest_namestore.sh
+++ b/src/namestore/test_plugin_rest_namestore.sh
@@ -78,15 +78,16 @@ curl_delete () {
 TEST_ID="test"
 gnunet-arm -s -c test_namestore_api.conf
-gnunet-arm -i rest -c test_namestore_api.conf
 #Test GET
 gnunet-identity -C $TEST_ID -c test_namestore_api.conf
 test="$(gnunet-namestore -D -z $TEST_ID -c test_namestore_api.conf)"
 name=$TEST_ID
 public="$(gnunet-identity -d -c test_namestore_api.conf | grep $TEST_ID | awk 'NR==1{print $3}')"
 echo "$name $public"
-valgrind gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY" -c test_namestore_api.conf
+gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY" -c test_namestore_api.conf
-#curl_get "${namestore_link}" "HTTP/1.1 200 OK"
+sleep 1
+gnunet-arm -i rest -c test_namestore_api.conf
+sleep 1
 curl_get "${namestore_link}/$name" "HTTP/1.1 200 OK"
 curl_get "${namestore_link}/$public" "error"
 gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf
@@ -128,9 +129,6 @@ gnunet-namestore -z $name -d -n "test_entry"  -c test_namestore_api.conf > /dev/
 #Test DELETE
 gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY"  -c test_namestore_api.conf
 curl_delete "${namestore_link}/$name/test_entry" "HTTP/1.1 204" 
-curl_delete "${namestore_link}/$name/test_entry" "error" 
-gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY"  -c test_namestore_api.conf
-curl_delete "${namestore_link}/$public/test_entry" "error" 
 gnunet-arm -e  -c test_namestore_api.conf
 exit 0;
diff --git a/src/reclaim/reclaim_api.c b/src/reclaim/reclaim_api.c
index f41473f9f..bc6b835c9 100644
--- a/src/reclaim/reclaim_api.c
+++ b/src/reclaim/reclaim_api.c
@@ -1550,7 +1550,6 @@ GNUNET_RECLAIM_ticket_issue (
  struct IssueTicketMessage *tim;
  size_t attr_len;
-  fprintf (stderr, "Issuing ticket\n");
  op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
  op->h = h;
  op->ti_cb = cb;
diff --git a/src/reclaim/test_reclaim.conf b/src/reclaim/test_reclaim.conf
index ec19056e4..2dc53fe81 100644
--- a/src/reclaim/test_reclaim.conf
+++ b/src/reclaim/test_reclaim.conf
@@ -15,7 +15,7 @@ PLUGINS =
 [reclaim]
 START_ON_DEMAND = YES
-TICKET_REFRESH_INTERVAL = 15s
+TICKET_REFRESH_INTERVAL = 30 s
 #PREFIX = valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --log-file=$GNUNET_TMP/idplog
 [gns]
diff --git a/src/reclaim/test_reclaim_consume.sh b/src/reclaim/test_reclaim_consume.sh
index 9186d3cb1..c012862c3 100755
--- a/src/reclaim/test_reclaim_consume.sh
+++ b/src/reclaim/test_reclaim_consume.sh
@@ -32,12 +32,14 @@ TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
 gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 TICKET=$(gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c test_reclaim.conf | awk '{print $1}')
-gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf >/dev/null 2>&1
+gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf #>/dev/null 2>&1
-if test $? != 0
+RES=$?
+gnunet-identity -D testego -c test_reclaim.conf
+gnunet-identity -D rpego -c test_reclaim.conf
+gnunet-arm -e -c test_reclaim.conf
+if test $RES != 0
 then
-  "Failed."
+  echo "Failed."
-  exit 1
 fi
-#curl http://localhost:7776/reclaim/tickets/testego
-gnunet-arm -e -c test_reclaim.conf
diff --git a/src/regex/plugin_block_regex.c b/src/regex/plugin_block_regex.c
index 0953830ab..61442ac10 100644
--- a/src/regex/plugin_block_regex.c
+++ b/src/regex/plugin_block_regex.c
@@ -93,242 +93,6 @@ block_plugin_regex_create_group (void *cls,
 /**
- * Function called to validate a reply or a request of type
- * #GNUNET_BLOCK_TYPE_REGEX.
- * For request evaluation, pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param type block type
- * @param bg block group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-evaluate_block_regex (void *cls,
-                      enum GNUNET_BLOCK_Type type,
-                      struct GNUNET_BLOCK_Group *bg,
-                      enum GNUNET_BLOCK_EvaluationOptions eo,
-                      const struct GNUNET_HashCode *query,
-                      const void *xquery,
-                      size_t xquery_size,
-                      const void *reply_block,
-                      size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-  if (NULL == reply_block)
-  {
-    if (0 != xquery_size)
-    {
-      const char *s;
-      s = (const char *) xquery;
-      if ('\0' != s[xquery_size - 1])     /* must be valid 0-terminated string */
-      {
-        GNUNET_break_op (0);
-        return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-      }
-    }
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  }
-  if (0 != xquery_size)
-  {
-    const char *s;
-    s = (const char *) xquery;
-    if ('\0' != s[xquery_size - 1])   /* must be valid 0-terminated string */
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-  }
-  else if (NULL != query)
-  {
-    /* xquery is required for regex GETs, at least an empty string */
-    GNUNET_break_op (0);
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "type %d, query %p, xquery %p\n",
-                type, query, xquery);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  switch (REGEX_BLOCK_check (reply_block,
-                             reply_block_size,
-                             query,
-                             xquery))
-  {
-  case GNUNET_SYSERR:
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  case GNUNET_NO:
-    /* xquery mismatch, can happen */
-    return GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT;
-  default:
-    break;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
- * Function called to validate a reply or a request of type
- * #GNUNET_BLOCK_TYPE_REGEX_ACCEPT.
- * For request evaluation, pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param type block type
- * @param bg block group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-evaluate_block_regex_accept (void *cls,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_BLOCK_Group *bg,
-                             enum GNUNET_BLOCK_EvaluationOptions eo,
-                             const struct GNUNET_HashCode *query,
-                             const void *xquery,
-                             size_t xquery_size, const void *reply_block,
-                             size_t reply_block_size)
-{
-  const struct RegexAcceptBlock *rba;
-  struct GNUNET_HashCode chash;
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (sizeof(struct RegexAcceptBlock) != reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  rba = reply_block;
-  if (ntohl (rba->purpose.size) !=
-      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-      + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-      + sizeof(struct GNUNET_HashCode))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  if (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (
-                                                 rba->expiration_time)).
-      rel_value_us)
-  {
-    /* technically invalid, but can happen without an error, so
-       we're nice by reporting it as a 'duplicate' */
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  }
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT,
-                                   &rba->purpose,
-                                   &rba->signature,
-                                   &rba->peer.public_key))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_regex_evaluate (void *cls,
-                             struct GNUNET_BLOCK_Context *ctx,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_BLOCK_Group *bg,
-                             enum GNUNET_BLOCK_EvaluationOptions eo,
-                             const struct GNUNET_HashCode *query,
-                             const void *xquery,
-                             size_t xquery_size,
-                             const void *reply_block,
-                             size_t reply_block_size)
-{
-  enum GNUNET_BLOCK_EvaluationResult result;
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    result = evaluate_block_regex (cls,
-                                   type,
-                                   bg,
-                                   eo,
-                                   query,
-                                   xquery, xquery_size,
-                                   reply_block, reply_block_size);
-    break;
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    result = evaluate_block_regex_accept (cls,
-                                          type,
-                                          bg,
-                                          eo,
-                                          query,
-                                          xquery, xquery_size,
-                                          reply_block, reply_block_size);
-    break;
-  default:
-    result = GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-  return result;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -341,10 +105,10 @@ block_plugin_regex_evaluate (void *cls,
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
+                                enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
+                                const struct GNUNET_HashCode *query,
-                                    const void *xquery,
+                                const void *xquery,
-                                    size_t xquery_size)
+                                size_t xquery_size)
 {
  switch (type)
  {
@@ -380,7 +144,6 @@ block_plugin_regex_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -388,7 +151,6 @@ block_plugin_regex_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
@@ -398,7 +160,7 @@ block_plugin_regex_check_block (void *cls,
    if (GNUNET_SYSERR ==
        REGEX_BLOCK_check (block,
                           block_size,
-                           query,
+                           NULL,
                           NULL))
      return GNUNET_NO;
    return GNUNET_OK;
@@ -480,12 +242,7 @@ block_plugin_regex_check_reply (
      const char *s;
      
      s = (const char *) xquery;
-      if ('\0' != s[xquery_size - 1])   /* must be valid 0-terminated string */
+      GNUNET_assert ('\0' == s[xquery_size - 1]);
-      {
-        /* Technically, the query is invalid ... */
-        GNUNET_break (0);
-        return GNUNET_BLOCK_REPLY_INVALID;
-      }
    }
    switch (REGEX_BLOCK_check (reply_block,
                               reply_block_size,
@@ -493,8 +250,7 @@ block_plugin_regex_check_reply (
                               xquery))
    {
    case GNUNET_SYSERR:
-      GNUNET_break_op (0);
+      GNUNET_assert (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
    case GNUNET_NO:
      /* xquery mismatch, can happen */
      return GNUNET_BLOCK_REPLY_IRRELEVANT;
@@ -513,20 +269,12 @@ block_plugin_regex_check_reply (
    {
    const struct RegexAcceptBlock *rba;
-    if (sizeof(struct RegexAcceptBlock) != reply_block_size)
+    GNUNET_assert (sizeof(struct RegexAcceptBlock) == reply_block_size);
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
-    }
    rba = reply_block;
-    if (ntohl (rba->purpose.size) !=
+    GNUNET_assert (ntohl (rba->purpose.size) ==
        sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
        + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-        + sizeof(struct GNUNET_HashCode))
+                   + sizeof(struct GNUNET_HashCode));
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
-    }
    GNUNET_CRYPTO_hash (reply_block,
                        reply_block_size,
                        &chash);
@@ -552,8 +300,8 @@ block_plugin_regex_check_reply (
 * @param block block to get the key for
 * @param block_size number of bytes in @a block
 * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported,
- *         (or if extracting a key from a block of this type does not work)
+ *         #GNUNET_NO if extracting a key from a block of this type does not work
 */
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_get_key (void *cls,
@@ -571,14 +319,20 @@ block_plugin_regex_get_key (void *cls,
                             key))
    {
      GNUNET_break_op (0);
-      return GNUNET_NO;
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
    }
    return GNUNET_OK;
  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
    if (sizeof(struct RegexAcceptBlock) != block_size)
    {
      GNUNET_break_op (0);
-      return GNUNET_NO;
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
    }
    *key = ((struct RegexAcceptBlock *) block)->key;
    return GNUNET_OK;
@@ -603,7 +357,6 @@ libgnunet_plugin_block_regex_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_regex_evaluate;
  api->get_key = &block_plugin_regex_get_key;
  api->check_query = &block_plugin_regex_check_query;
  api->check_block = &block_plugin_regex_check_block;
diff --git a/src/revocation/gnunet-revocation-tvg.c b/src/revocation/gnunet-revocation-tvg.c
index 3ba5b56fa..a34a6bc98 100644
--- a/src/revocation/gnunet-revocation-tvg.c
+++ b/src/revocation/gnunet-revocation-tvg.c
@@ -159,6 +159,7 @@ run (void *cls,
  print_bytes (pow,
               GNUNET_REVOCATION_proof_get_size (pow),
               8);
+  GNUNET_free (ph);
 }
diff --git a/src/revocation/plugin_block_revocation.c b/src/revocation/plugin_block_revocation.c
index 3beae60bb..12ec555e4 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -44,65 +44,6 @@ struct InternalContext
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls our `struct InternalContext`
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_revocation_evaluate (void *cls,
-                                  struct GNUNET_BLOCK_Context *ctx,
-                                  enum GNUNET_BLOCK_Type type,
-                                  struct GNUNET_BLOCK_Group *group,
-                                  enum GNUNET_BLOCK_EvaluationOptions eo,
-                                  const struct GNUNET_HashCode *query,
-                                  const void *xquery,
-                                  size_t xquery_size,
-                                  const void *reply_block,
-                                  size_t reply_block_size)
-{
-  struct InternalContext *ic = cls;
-  ssize_t pklen;
-  const struct RevokeMessage *rm = reply_block;
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (reply_block_size != sizeof(*rm))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
-  const struct GNUNET_IDENTITY_PublicKey *pk;
-  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
-                                                 ic->matching_bits,
-                                                 ic->epoch_duration))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  pklen = GNUNET_IDENTITY_key_get_length (pk);
-  if (0 > pklen)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  return GNUNET_BLOCK_EVALUATION_OK_LAST;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -124,7 +65,10 @@ block_plugin_revocation_check_query (void *cls,
  (void) query;
  (void) xquery;
  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (0 != xquery_size)
    return GNUNET_NO;
  return GNUNET_OK;
@@ -136,7 +80,6 @@ block_plugin_revocation_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -144,7 +87,6 @@ block_plugin_revocation_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_revocation_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
@@ -157,7 +99,10 @@ block_plugin_revocation_check_block (void *cls,
  size_t left;
  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (block_size < sizeof(*rm) + sizeof(*pow))
  {
    GNUNET_break_op (0);
@@ -224,7 +169,10 @@ block_plugin_revocation_check_reply (
  (void) reply_block;
  (void) reply_block_size;
  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
  return GNUNET_BLOCK_REPLY_OK_LAST;
 }
@@ -255,7 +203,10 @@ block_plugin_revocation_get_key (void *cls,
  size_t left;
  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
    return GNUNET_SYSERR;
+  }
  if (block_size < sizeof(*rm) + sizeof(*pow))
  {
    GNUNET_break_op (0);
@@ -314,7 +265,6 @@ libgnunet_plugin_block_revocation_init (void *cls)
    return NULL;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_revocation_evaluate;
  api->get_key = &block_plugin_revocation_get_key;
  api->check_query = &block_plugin_revocation_check_query;
  api->check_block = &block_plugin_revocation_check_block;
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index bc5dae021..9080ab862 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -758,13 +758,11 @@ GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow)
  size_t size;
  size_t ksize;
  const struct GNUNET_IDENTITY_PublicKey *pk;
-  const struct GNUNET_IDENTITY_Signature *sig;
  size = sizeof (struct GNUNET_REVOCATION_PowP);
  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
  ksize = GNUNET_IDENTITY_key_get_length (pk);
  size += ksize;
-  sig = (struct GNUNET_IDENTITY_Signature *) ((char*) &pow[1] + ksize);
  size += GNUNET_IDENTITY_signature_get_raw_length_by_type (pk->type);
  return size;
 }
diff --git a/src/set/plugin_block_set_test.c b/src/set/plugin_block_set_test.c
index 3d66831bb..cb5cef5ad 100644
--- a/src/set/plugin_block_set_test.c
+++ b/src/set/plugin_block_set_test.c
@@ -30,46 +30,9 @@
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_set_test_evaluate (void *cls,
-                                struct GNUNET_BLOCK_Context *ctx,
-                                enum GNUNET_BLOCK_Type type,
-                                struct GNUNET_BLOCK_Group *group,
-                                enum GNUNET_BLOCK_EvaluationOptions eo,
-                                const struct GNUNET_HashCode *query,
-                                const void *xquery,
-                                size_t xquery_size,
-                                const void *reply_block,
-                                size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
- * @param ctx block context
 * @param type block type
 * @param query original query (hash)
 * @param xquery extrended query data (can be NULL, depending on type)
@@ -92,7 +55,6 @@ block_plugin_set_test_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,7 +62,6 @@ block_plugin_set_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_set_test_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
@@ -141,7 +102,7 @@ block_plugin_set_test_check_reply (void *cls,
  if ((NULL == reply_block) ||
      (0 == reply_block_size) ||
      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
  return GNUNET_BLOCK_REPLY_OK_MORE;
 }
@@ -164,7 +125,7 @@ block_plugin_set_test_get_key (void *cls,
                               size_t block_size,
                               struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  return GNUNET_NO;
 }
@@ -181,7 +142,6 @@ libgnunet_plugin_block_set_test_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_set_test_evaluate;
  api->get_key = &block_plugin_set_test_get_key;
  api->check_query = &block_plugin_set_test_check_query;
  api->check_block = &block_plugin_set_test_check_block;
diff --git a/src/seti/plugin_block_seti_test.c b/src/seti/plugin_block_seti_test.c
index af86e1af6..5b9196cef 100644
--- a/src/seti/plugin_block_seti_test.c
+++ b/src/seti/plugin_block_seti_test.c
@@ -30,42 +30,6 @@
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_seti_test_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -83,6 +47,16 @@ block_plugin_seti_test_check_query (void *cls,
                                    const void *xquery,
                                    size_t xquery_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
  return GNUNET_OK;
 }
@@ -92,7 +66,6 @@ block_plugin_seti_test_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,10 +73,15 @@ block_plugin_seti_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_seti_test_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
+  (void) cls;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
  if ((NULL == block) ||
      (0 == block_size) ||
      (0 != ((char *) block)[0]))
@@ -138,10 +116,18 @@ block_plugin_seti_test_check_reply (void *cls,
                                    const void *reply_block,
                                    size_t reply_block_size)
 {
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
  if ( (NULL == reply_block) ||
       (0 == reply_block_size) ||
       (0 != ((char *) reply_block)[0]) )
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
  return GNUNET_BLOCK_REPLY_OK_MORE;
 }
@@ -164,7 +150,12 @@ block_plugin_seti_test_get_key (void *cls,
                                size_t block_size,
                                struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
@@ -181,7 +172,6 @@ libgnunet_plugin_block_seti_test_init (void *cls)
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_seti_test_evaluate;
  api->get_key = &block_plugin_seti_test_get_key;
  api->check_query = &block_plugin_seti_test_check_query;
  api->check_block = &block_plugin_seti_test_check_block;
diff --git a/src/setu/plugin_block_setu_test.c b/src/setu/plugin_block_setu_test.c
index 9872bba39..178ad3314 100644
--- a/src/setu/plugin_block_setu_test.c
+++ b/src/setu/plugin_block_setu_test.c
@@ -23,49 +23,12 @@
 * @brief set test block, recognizes elements with non-zero first byte as invalid
 * @author Christian Grothoff
 */
 #include "platform.h"
 #include "gnunet_block_plugin.h"
 #include "gnunet_block_group_lib.h"
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_setu_test_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-/**
 * Function called to validate a query.
 *
 * @param cls closure
@@ -83,6 +46,16 @@ block_plugin_setu_test_check_query (void *cls,
                                    const void *xquery,
                                    size_t xquery_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
  return GNUNET_OK;
 }
@@ -92,7 +65,6 @@ block_plugin_setu_test_check_query (void *cls,
 *
 * @param cls closure
 * @param type block type
- * @param query key for the block (hash), must match exactly
 * @param block block data to validate
 * @param block_size number of bytes in @a block
 * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,14 +72,18 @@ block_plugin_setu_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_setu_test_check_block (void *cls,
                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                    const void *block,
                                    size_t block_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
  if ( (NULL == block) ||
       (0 == block_size) ||
       (0 != ((char *) block)[0]) )
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
  return GNUNET_OK;
 }
@@ -138,10 +114,18 @@ block_plugin_setu_test_check_reply (void *cls,
                                    const void *reply_block,
                                    size_t reply_block_size)
 {
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
  if ( (NULL == reply_block) ||
       (0 == reply_block_size) ||
       (0 != ((char *) reply_block)[0]) )
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
  return GNUNET_BLOCK_REPLY_OK_MORE;
 }
@@ -164,7 +148,12 @@ block_plugin_setu_test_get_key (void *cls,
                                size_t block_size,
                                struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
@@ -175,13 +164,12 @@ void *
 libgnunet_plugin_block_setu_test_init (void *cls)
 {
  static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_SETU_TEST,
+                                           GNUNET_BLOCK_TYPE_SETU_TEST,
    GNUNET_BLOCK_TYPE_ANY       /* end of list */
  };
  struct GNUNET_BLOCK_PluginFunctions *api;
  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_setu_test_evaluate;
  api->get_key = &block_plugin_setu_test_get_key;
  api->check_query = &block_plugin_setu_test_check_query;
  api->check_block = &block_plugin_setu_test_check_block;
diff --git a/src/transport/Makefile.am b/src/transport/Makefile.am
index ec00bc917..69b05fb13 100644
--- a/src/transport/Makefile.am
+++ b/src/transport/Makefile.am
@@ -773,6 +773,8 @@ TESTS += \
 endif
 endif
+# Only test TNG if we run experimental
+if HAVE_EXPERIMENTAL
 check_SCRIPTS= \
  test_transport_simple_send_string.sh \
  test_transport_simple_send.sh \
@@ -780,6 +782,7 @@ check_SCRIPTS= \
  test_transport_udp_backchannel.sh \
  test_transport_simple_send_dv_circle.sh 
  # test_transport_simple_send_dv_inverse.sh
+endif
 test_transport_start_with_config_SOURCES = \
 test_transport_start_with_config.c
@@ -1521,7 +1524,10 @@ test_transport_api_slow_ats_LDADD = \
 EXTRA_DIST = \
-$(check_SCRIPTS) \
+test_transport_simple_send_string.sh \
+test_transport_simple_send.sh \
+test_transport_simple_send_broadcast.sh \
+test_transport_udp_backchannel.sh \
 gnunet-transport-certificate-creation.in \
 communicator-unix.conf \
 test_plugin_hostkey \
diff --git a/src/transport/gnunet-communicator-tcp.c b/src/transport/gnunet-communicator-tcp.c
index 3bfdeaa90..be75fa0e8 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -143,7 +143,7 @@ struct TcpHandshakeSignature
  /**
   * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 /**
@@ -176,7 +176,7 @@ struct TcpHandshakeAckSignature
  /**
   * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 /**
@@ -203,7 +203,7 @@ struct TCPConfirmation
  /**
   * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
@@ -238,7 +238,7 @@ struct TCPConfirmationAck
  /**
   * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
@@ -587,12 +587,12 @@ struct Queue
  /**
   * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /**
   * Challenge value received. In case of inbound connection we have to remember the value, because we send the challenge back later after we received the GNUNET_MESSAGE_TYPE_COMMUNICATOR_TCP_CONFIRMATION_ACK.
   */
-  struct ChallengeNonceP challenge_received;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge_received;
  /**
   * Iteration Context for retrieving the monotonic time send with key for rekeying.
@@ -1447,7 +1447,7 @@ handshake_ack_monotime_cb (void *cls,
 * @param queue The queue context.
 */
 static void
-send_challenge (struct ChallengeNonceP challenge, struct Queue *queue)
+send_challenge (struct GNUNET_CRYPTO_ChallengeNonceP challenge, struct Queue *queue)
 {
  struct TCPConfirmationAck tca;
  struct TcpHandshakeAckSignature thas;
@@ -1680,7 +1680,7 @@ try_handle_plaintext (struct Queue *queue)
  uint16_t type;
  size_t size = 0; /* make compiler happy */
  struct TcpHandshakeAckSignature thas;
-  const struct ChallengeNonceP challenge = queue->challenge;
+  const struct GNUNET_CRYPTO_ChallengeNonceP challenge = queue->challenge;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "try handle plaintext!\n");
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c
index 0427bd229..21c9be05c 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -581,7 +581,7 @@ struct DvInitPS
  /**
   * Challenge value used by the initiator to re-identify the path.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
@@ -621,7 +621,7 @@ struct DvHopPS
  /**
   * Challenge value used by the initiator to re-identify the path.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
@@ -715,7 +715,7 @@ struct TransportDVLearnMessage
  /**
   * Challenge value used by the initiator to re-identify the path.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /* Followed by @e num_hops `struct DVPathEntryP` values,
     excluding the initiator of the DV trace; the last entry is the
@@ -834,7 +834,7 @@ struct TransportValidationChallengeMessage
  /**
   * Challenge to be signed by the receiving peer.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /**
   * Timestamp of the sender, to be copied into the reply to allow
@@ -864,7 +864,7 @@ struct TransportValidationPS
  /**
   * Challenge signed by the receiving peer.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
@@ -893,7 +893,7 @@ struct TransportValidationResponseMessage
  /**
   * The challenge that was signed by the receiving peer.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /**
   * Original timestamp of the sender (was @code{sender_time}),
@@ -1056,7 +1056,7 @@ struct LearnLaunchEntry
  /**
   * Challenge that uniquely identifies this activity.
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /**
   * When did we transmit the DV learn message (used to calculate RTT) and
@@ -2569,7 +2569,7 @@ struct ValidationState
   * (We must not rotate more often as otherwise we may discard valid answers
   * due to packet losses, latency and reorderings on the network).
   */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
  /**
   * Claimed address of the peer.
@@ -6886,7 +6886,7 @@ static int
 validate_dv_initiator_signature (
  struct GNUNET_TIME_AbsoluteNBO sender_monotonic_time,
  const struct GNUNET_PeerIdentity *init,
-  const struct ChallengeNonceP *challenge,
+  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge,
  const struct GNUNET_CRYPTO_EddsaSignature *init_sig)
 {
  struct DvInitPS ip = { .purpose.purpose = htonl (
@@ -8340,7 +8340,7 @@ struct CheckKnownChallengeContext
  /**
   * Set to the challenge we are looking for.
   */
-  const struct ChallengeNonceP *challenge;
+  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge;
  /**
   * Set to a matching validation state, if one was found.
diff --git a/src/transport/gnunet-service-transport.c b/src/transport/gnunet-service-transport.c
index 24cc6464a..fad2ca4a1 100644
--- a/src/transport/gnunet-service-transport.c
+++ b/src/transport/gnunet-service-transport.c
@@ -1628,8 +1628,8 @@ GST_receive_callback (void *cls,
  GST_neighbours_notify_data_recv (address, message);
  switch (type)
  {
-  case GNUNET_MESSAGE_TYPE_HELLO_LEGACY:
+  case GNUNET_MESSAGE_TYPE_HELLO_URI:
-    /* Legacy HELLO message, discard  */
+    /* Future HELLO message, discard  */
    return ret;
  case GNUNET_MESSAGE_TYPE_HELLO:
diff --git a/src/transport/test_transport_simple_send.sh b/src/transport/test_transport_simple_send.sh
index 3d5266622..0250070be 100755
--- a/src/transport/test_transport_simple_send.sh
+++ b/src/transport/test_transport_simple_send.sh
@@ -2,9 +2,10 @@
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_topo.conf"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_topo.conf"
diff --git a/src/transport/test_transport_simple_send_broadcast.sh b/src/transport/test_transport_simple_send_broadcast.sh
index f264b1203..a4801bf70 100755
--- a/src/transport/test_transport_simple_send_broadcast.sh
+++ b/src/transport/test_transport_simple_send_broadcast.sh
@@ -2,10 +2,10 @@
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
diff --git a/src/transport/test_transport_simple_send_dv.sh b/src/transport/test_transport_simple_send_dv.sh
index fa127cfa4..b57ee0629 100755
--- a/src/transport/test_transport_simple_send_dv.sh
+++ b/src/transport/test_transport_simple_send_dv.sh
@@ -2,10 +2,10 @@
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
diff --git a/src/transport/test_transport_simple_send_dv_circle.sh b/src/transport/test_transport_simple_send_dv_circle.sh
index de16df356..bd5f00abe 100755
--- a/src/transport/test_transport_simple_send_dv_circle.sh
+++ b/src/transport/test_transport_simple_send_dv_circle.sh
@@ -2,11 +2,10 @@
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf"
-    #./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf"
diff --git a/src/transport/test_transport_simple_send_string.sh b/src/transport/test_transport_simple_send_string.sh
index b2bd05d5f..211abb494 100755
--- a/src/transport/test_transport_simple_send_string.sh
+++ b/src/transport/test_transport_simple_send_string.sh
@@ -11,9 +11,11 @@ EOF
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config -s '$string'"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config -s '$string'"
diff --git a/src/transport/test_transport_udp_backchannel.sh b/src/transport/test_transport_udp_backchannel.sh
index c52734a55..1a7c83385 100755
--- a/src/transport/test_transport_udp_backchannel.sh
+++ b/src/transport/test_transport_udp_backchannel.sh
@@ -5,11 +5,10 @@ fi
 if ! [ -d "/run/netns" ]; then
    echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
-#exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
-exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; GNUNET_FORCE_LOG=';;;;DEBUG' GNUNET_FORCE_LOGFILE='test.out' ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
-# exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
-else
    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
    exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; GNUNET_FORCE_LOG=';;;;DEBUG' GNUNET_FORCE_LOGFILE='test.out' ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
diff --git a/src/util/common_logging.c b/src/util/common_logging.c
index cba37cd2f..b07f3fc0b 100644
--- a/src/util/common_logging.c
+++ b/src/util/common_logging.c
@@ -321,6 +321,28 @@ log_rotate (const char *new_name)
 }
+const char *
+GNUNET_b2s (const void *buf,
+            size_t buf_size)
+{
+  static GNUNET_THREAD_LOCAL char ret[9];
+  struct GNUNET_HashCode hc;
+  char *tmp;
+  GNUNET_CRYPTO_hash (buf,
+                      buf_size,
+                      &hc);
+  tmp = GNUNET_STRINGS_data_to_string_alloc (&hc,
+                                             sizeof (hc));
+  memcpy (ret,
+          tmp,
+          8);
+  GNUNET_free (tmp);
+  ret[8] = '\0';
+  return ret;
+}
 /**
 * Setup the log file.
 *
@@ -1015,7 +1037,8 @@ mylog (enum GNUNET_ErrorType kind,
    else
    {
      /* RFC 3339 timestamp, with snprintf placeholder for microseconds */
-      if (0 == strftime (date2, DATE_STR_SIZE, "%Y-%m-%dT%H:%M:%S.%%06u%z", tmptr))
+      if (0 == strftime (date2, DATE_STR_SIZE, "%Y-%m-%dT%H:%M:%S.%%06u%z",
+                         tmptr))
        abort ();
      /* Fill in microseconds */
      if (0 > snprintf (date, sizeof(date), date2, timeofday.tv_usec))
diff --git a/src/util/crypto_cs.c b/src/util/crypto_cs.c
index c89ba5d83..4c6648229 100644
--- a/src/util/crypto_cs.c
+++ b/src/util/crypto_cs.c
@@ -40,11 +40,6 @@
 */
-/**
- * Create a new random private key.
- *
- * @param[out] priv where to write the fresh private key
- */
 void
 GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 {
@@ -52,16 +47,10 @@ GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 }
-/**
- * Extract the public key of the given private key.
- *
- * @param priv the private key
- * @param[out] pub where to write the public key
- */
 void
-GNUNET_CRYPTO_cs_private_key_get_public (const struct
+GNUNET_CRYPTO_cs_private_key_get_public (
-                                         GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                                         struct GNUNET_CRYPTO_CsPublicKey *pub)
+  struct GNUNET_CRYPTO_CsPublicKey *pub)
 {
  GNUNET_assert (0 == crypto_scalarmult_ed25519_base_noclamp (pub->point.y,
                                                              priv->scalar.d));
@@ -69,63 +58,40 @@ GNUNET_CRYPTO_cs_private_key_get_public (const struct
 /**
- * maps 32 random bytes to a scalar
+ * Maps 32 random bytes to a scalar.  This is necessary because libsodium
- * this is necessary because libsodium expects scalar to be in the prime order subgroup
+ * expects scalar to be in the prime order subgroup.
- * @param[out] scalar containing 32 byte char array, is modified to be in prime order subgroup
+ *
+ * @param[in,out] scalar containing 32 byte char array, is modified to be in prime order subgroup
 */
 static void
 map_to_scalar_subgroup (struct GNUNET_CRYPTO_Cs25519Scalar *scalar)
 {
-  // perform clamping as described in RFC7748
+  /* perform clamping as described in RFC7748 */
  scalar->d[0] &= 248;
  scalar->d[31] &= 127;
  scalar->d[31] |= 64;
 }
-/**
- * Derive a new secret r pair r0 and r1.
- * In original papers r is generated randomly
- * To provide abort-idempotency, r needs to be derived but still needs to be UNPREDICTABLE
- * To ensure unpredictability a new nonce should be used when a new r needs to be derived.
- * Uses HKDF internally.
- * Comment: Can be done in one HKDF shot and split output.
- *
- * @param nonce is a random nonce
- * @param lts is a long-term-secret in form of a private key
- * @param[out] r array containing derived secrets r0 and r1
- */
 void
 GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsNonce *nonce,
+                           const char *seed,
                           const struct GNUNET_CRYPTO_CsPrivateKey *lts,
                           struct GNUNET_CRYPTO_CsRSecret r[2])
 {
-  GNUNET_assert (GNUNET_YES ==
+  GNUNET_assert (
-                 GNUNET_CRYPTO_hkdf (r,
+    GNUNET_YES ==
-                                     sizeof (struct GNUNET_CRYPTO_CsRSecret)
+    GNUNET_CRYPTO_kdf (
-                                     * 2,
+      r,     sizeof (struct GNUNET_CRYPTO_CsRSecret) * 2,
-                                     GCRY_MD_SHA512,
+      seed,   strlen (seed),
-                                     GCRY_MD_SHA256,
+      lts,   sizeof (*lts),
-                                     "r",
+      nonce, sizeof (*nonce),
-                                     strlen ("r"),
+      NULL,  0));
-                                     lts,
-                                     sizeof (*lts),
-                                     nonce,
-                                     sizeof (*nonce),
-                                     NULL,
-                                     0));
  map_to_scalar_subgroup (&r[0].scalar);
  map_to_scalar_subgroup (&r[1].scalar);
 }
-/**
- * Extract the public R of the given secret r.
- *
- * @param r_priv the private key
- * @param[out] r_pub where to write the public key
- */
 void
 GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
                               struct GNUNET_CRYPTO_CsRPublic *r_pub)
@@ -135,36 +101,23 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
 }
-/**
- * Derives new random blinding factors.
- * In original papers blinding factors are generated randomly
- * To provide abort-idempotency, blinding factors need to be derived but still need to be UNPREDICTABLE
- * To ensure unpredictability a new nonce has to be used.
- * Uses HKDF internally
- *
- * @param secret is secret to derive blinding factors
- * @param secret_len secret length
- * @param[out] bs array containing the two derived blinding secrets
- */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
-                                          GNUNET_CRYPTO_CsNonce *blind_seed,
+  const struct GNUNET_CRYPTO_CsNonce *blind_seed,
-                                          struct GNUNET_CRYPTO_CsBlindingSecret
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
-                                          bs[2])
 {
-  GNUNET_assert (GNUNET_YES ==
+  GNUNET_assert (
-                 GNUNET_CRYPTO_hkdf (bs,
+    GNUNET_YES ==
-                                     sizeof (struct
+    GNUNET_CRYPTO_hkdf (bs,
-                                             GNUNET_CRYPTO_CsBlindingSecret)
+                        sizeof (struct GNUNET_CRYPTO_CsBlindingSecret) * 2,
-                                     * 2,
+                        GCRY_MD_SHA512,
-                                     GCRY_MD_SHA512,
+                        GCRY_MD_SHA256,
-                                     GCRY_MD_SHA256,
+                        "alphabeta",
-                                     "alphabeta",
+                        strlen ("alphabeta"),
-                                     strlen ("alphabeta"),
+                        blind_seed,
-                                     blind_seed,
+                        sizeof(*blind_seed),
-                                     sizeof(*blind_seed),
+                        NULL,
-                                     NULL,
+                        0));
-                                     0));
  map_to_scalar_subgroup (&bs[0].alpha);
  map_to_scalar_subgroup (&bs[0].beta);
  map_to_scalar_subgroup (&bs[1].alpha);
@@ -205,11 +158,16 @@ cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash,
  memcpy (r_m_concat, r_dash, sizeof(struct GNUNET_CRYPTO_CsRPublic));
  memcpy (r_m_concat + sizeof(struct GNUNET_CRYPTO_CsRPublic), msg, msg_len);
  struct GNUNET_HashCode prehash;
-  GNUNET_CRYPTO_hash (r_m_concat, r_m_concat_len, &prehash);
+  GNUNET_CRYPTO_hash (r_m_concat,
+                      r_m_concat_len,
+                      &prehash);
  // modulus converted to MPI representation
  gcry_mpi_t l_mpi;
-  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi, L_BIG_ENDIAN, sizeof(L_BIG_ENDIAN));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi,
+                                   L_BIG_ENDIAN,
+                                   sizeof(L_BIG_ENDIAN));
  // calculate full domain hash
  gcry_mpi_t c_mpi;
@@ -224,7 +182,9 @@ cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash,
  // convert c from mpi
  unsigned char c_big_endian[256 / 8];
-  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian, sizeof(c_big_endian), c_mpi);
+  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian,
+                                    sizeof(c_big_endian),
+                                    c_mpi);
  gcry_mpi_release (c_mpi);
  for (size_t i = 0; i<32; i++)
    c->scalar.d[i] = c_big_endian[31 - i];
@@ -266,28 +226,15 @@ calc_r_dash (const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
 }
-/**
- * Calculate two blinded c's
- * Comment: One would be insecure due to Wagner's algorithm solving ROS
- *
- * @param bs array of the two blinding factor structs each containing alpha and beta
- * @param r_pub array of the two signer's nonce R
- * @param pub the public key of the signer
- * @param msg the message to blind in preparation for signing
- * @param msg_len length of message msg
- * @param[out] blinded_c array of the two blinded c's
- * @param[out] blinded_r_pub array of the two blinded R
- */
 void
-GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
+GNUNET_CRYPTO_cs_calc_blinded_c (
-                                 bs[2],
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
-                                 const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                                 const void *msg,
+  const void *msg,
-                                 size_t msg_len,
+  size_t msg_len,
-                                 struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
-                                 struct GNUNET_CRYPTO_CsRPublic
+  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
-                                 blinded_r_pub[2])
 {
  // for i 0/1: R'i = Ri + alpha i*G + beta i*pub
  calc_r_dash (&bs[0], &r_pub[0], pub, &blinded_r_pub[0]);
@@ -309,30 +256,13 @@ GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
 }
-/**
- * Sign a blinded c
- * This function derives b from a nonce and a longterm secret
- * In original papers b is generated randomly
- * To provide abort-idempotency, b needs to be derived but still need to be UNPREDICTABLE.
- * To ensure unpredictability a new nonce has to be used for every signature
- * HKDF is used internally for derivation
- * r0 and r1 can be derived prior by using GNUNET_CRYPTO_cs_r_derive
- *
- * @param priv private key to use for the signing and as LTS in HKDF
- * @param r array of the two secret nonce from the signer
- * @param c array of the two blinded c to sign c_b
- * @param nonce is a random nonce
- * @param[out] blinded_signature_scalar where to write the signature
- * @return 0 or 1 for b (see Clause Blind Signature Scheme)
- */
 unsigned int
-GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+GNUNET_CRYPTO_cs_sign_derive (
-                              const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                              const struct GNUNET_CRYPTO_CsC c[2],
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
-                              const struct GNUNET_CRYPTO_CsNonce *nonce,
+  const struct GNUNET_CRYPTO_CsC c[2],
-                              struct GNUNET_CRYPTO_CsBlindS *
+  const struct GNUNET_CRYPTO_CsNonce *nonce,
-                              blinded_signature_scalar
+  struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar)
-                              )
 {
  uint32_t hkdf_out;
@@ -365,18 +295,11 @@ GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
 }
-/**
- * Unblind a blind-signed signature using a c that was blinded
- *
- * @param blinded_signature_scalar the signature made on the blinded c
- * @param bs the blinding factors used in the blinding
- * @param[out] signature_scalar where to write the unblinded signature
- */
 void
-GNUNET_CRYPTO_cs_unblind (const struct
+GNUNET_CRYPTO_cs_unblind (
-                          GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-                          const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-                          struct GNUNET_CRYPTO_CsS *signature_scalar)
+  struct GNUNET_CRYPTO_CsS *signature_scalar)
 {
  crypto_core_ed25519_scalar_add (signature_scalar->scalar.d,
                                  blinded_signature_scalar->scalar.d,
@@ -384,16 +307,6 @@ GNUNET_CRYPTO_cs_unblind (const struct
 }
-/**
- * Verify whether the given message corresponds to the given signature and the
- * signature is valid with respect to the given public key.
- *
- * @param sig signature that is being validated
- * @param pub public key of the signer
- * @param msg is the message that should be signed by @a sig  (message is used to calculate c)
- * @param msg_len is the message length
- * @returns #GNUNET_YES on success, #GNUNET_SYSERR if signature invalid
- */
 enum GNUNET_GenericReturnValue
 GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
                         const struct GNUNET_CRYPTO_CsPublicKey *pub,
@@ -402,7 +315,12 @@ GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
 {
  // calculate c' = H(R, m)
  struct GNUNET_CRYPTO_CsC c_dash;
-  cs_full_domain_hash (&sig->r_point, msg, msg_len, pub, &c_dash);
+  cs_full_domain_hash (&sig->r_point,
+                       msg,
+                       msg_len,
+                       pub,
+                       &c_dash);
  // s'G ?= R' + c' pub
  struct GNUNET_CRYPTO_Cs25519Point sig_scal_mul_base;
diff --git a/src/util/crypto_hash.c b/src/util/crypto_hash.c
index dcd46e5f9..f516f5474 100644
--- a/src/util/crypto_hash.c
+++ b/src/util/crypto_hash.c
@@ -76,7 +76,8 @@ GNUNET_CRYPTO_hash_from_string2 (const char *enc,
  char upper_enc[enclen];
  char *up_ptr = upper_enc;
-  GNUNET_STRINGS_utf8_toupper (enc, up_ptr);
+  if (GNUNET_OK != GNUNET_STRINGS_utf8_toupper (enc, up_ptr))
+    return GNUNET_SYSERR;
  return GNUNET_STRINGS_string_to_data (upper_enc, enclen,
                                        (unsigned char *) result,
diff --git a/src/util/dnsstub.c b/src/util/dnsstub.c
index 1ac274c92..c2f2a441f 100644
--- a/src/util/dnsstub.c
+++ b/src/util/dnsstub.c
@@ -324,24 +324,50 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
    found = GNUNET_NO;
    for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
    {
-      if (0 == memcmp (&addr,
+      if (ds->ss.ss_family != addr.ss_family)
-                       &ds->ss,
+        continue;
-                       GNUNET_MIN (sizeof(struct sockaddr_storage), addrlen)))
+      if (addr.ss_family == AF_INET)
      {
-        found = GNUNET_YES;
+        struct sockaddr_in *v4 = (struct sockaddr_in *) &addr;
-        break;
+        struct sockaddr_in *ds_v4 = (struct sockaddr_in *) &ds->ss;
+        if ((0 == memcmp (&v4->sin_addr,
+                         &ds_v4->sin_addr,
+                         sizeof(struct sockaddr_in))) &&
+            (v4->sin_port == ds_v4->sin_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
+      }
+      else
+      {
+        struct sockaddr_in6 *v6 = (struct sockaddr_in6 *) &addr;
+        struct sockaddr_in6 *ds_v6 = (struct sockaddr_in6 *) &ds->ss;
+        if (0 == memcmp (&v6->sin6_addr,
+                         &ds_v6->sin6_addr,
+                         sizeof (v6->sin6_addr)) &&
+            (v6->sin6_port == ds_v6->sin6_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
      }
    }
    if (GNUNET_NO == found)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Received DNS response from server we never asked (ignored)");
+                  "Received DNS response from server we never asked (ignored)\n");
      return GNUNET_NO;
    }
    if (sizeof(struct GNUNET_TUN_DnsHeader) > (size_t) r)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _ ("Received DNS response that is too small (%u bytes)"),
+                  _ ("Received DNS response that is too small (%u bytes)\n"),
                  (unsigned int) r);
      return GNUNET_NO;
    }
@@ -648,7 +674,7 @@ GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
  ds = GNUNET_new (struct DnsServer);
  switch (sa->sa_family)
  {
-  case AF_INET:
+  case AF_INET :
    GNUNET_memcpy (&ds->ss, sa, sizeof(struct sockaddr_in));
    break;
diff --git a/src/util/getopt_helpers.c b/src/util/getopt_helpers.c
index 917aa440b..96aee40e3 100644
--- a/src/util/getopt_helpers.c
+++ b/src/util/getopt_helpers.c
@@ -174,7 +174,8 @@ OUTER:
    i++;
  }
  pd = GNUNET_OS_project_data_get ();
-  printf ("Report bugs to %s.\n"
+  printf ("\n"
+          "Report bugs to %s.\n"
          "Home page: %s\n",
          pd->bug_email,
          pd->homepage);
diff --git a/src/util/gnunet-crypto-tvg.c b/src/util/gnunet-crypto-tvg.c
index 6b2a7f472..0071f3e90 100644
--- a/src/util/gnunet-crypto-tvg.c
+++ b/src/util/gnunet-crypto-tvg.c
@@ -852,7 +852,7 @@ checkvec (const char *operation,
      return GNUNET_SYSERR;
    }
-    if ((b != 1)&& (b != 0))
+    if ((b != 1) && (b != 0))
    {
      GNUNET_break (0);
      return GNUNET_SYSERR;
@@ -869,9 +869,14 @@ checkvec (const char *operation,
    unsigned int b_comp;
-    GNUNET_CRYPTO_cs_r_derive (&nonce, &priv, r_priv_comp);
+    GNUNET_CRYPTO_cs_r_derive (&nonce,
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[0], &r_pub_comp[0]);
+                               "rw",
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[1], &r_pub_comp[1]);
+                               &priv,
+                               r_priv_comp);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[0],
+                                   &r_pub_comp[0]);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[1],
+                                   &r_pub_comp[1]);
    GNUNET_assert (0 == memcmp (&r_priv_comp,
                                &r_priv,
                                sizeof(struct GNUNET_CRYPTO_CsRSecret) * 2));
@@ -1316,9 +1321,14 @@ output_vectors ()
                                                     strlen ("nonce_secret"),
                                                     NULL,
                                                     0));
-    GNUNET_CRYPTO_cs_r_derive (&nonce, &priv, r_priv);
+    GNUNET_CRYPTO_cs_r_derive (&nonce,
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv[0], &r_pub[0]);
+                               "rw",
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv[1], &r_pub[1]);
+                               &priv,
+                               r_priv);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[0],
+                                   &r_pub[0]);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[1],
+                                   &r_pub[1]);
    GNUNET_CRYPTO_cs_blinding_secrets_derive (&nonce,
                                              bs);
    GNUNET_CRYPTO_cs_calc_blinded_c (bs,
diff --git a/src/util/network.c b/src/util/network.c
index 688c37665..2f77bc54e 100644
--- a/src/util/network.c
+++ b/src/util/network.c
@@ -350,7 +350,8 @@ initialize_network_handle (struct GNUNET_NETWORK_Handle *h,
  if (h->fd >= FD_SETSIZE)
  {
-    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (h));
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (h));
    errno = EMFILE;
    return GNUNET_SYSERR;
  }
diff --git a/src/util/plugin.c b/src/util/plugin.c
index 39874a588..6ee41eec9 100644
--- a/src/util/plugin.c
+++ b/src/util/plugin.c
@@ -289,12 +289,12 @@ GNUNET_PLUGIN_unload (const char *library_name,
  done = resolve_function (pos,
                           "done");
  ret = NULL;
-  if (NULL != done)
-    ret = done (arg);
  if (NULL == prev)
    plugins = pos->next;
  else
    prev->next = pos->next;
+  if (NULL != done)
+    ret = done (arg);
  lt_dlclose (pos->handle);
  GNUNET_free (pos->name);
  GNUNET_free (pos);
diff --git a/src/util/strings.c b/src/util/strings.c
index ece096f72..7e218cc59 100644
--- a/src/util/strings.c
+++ b/src/util/strings.c
@@ -390,7 +390,7 @@ GNUNET_STRINGS_conv (const char *input,
  ret[encoded_string_length] = '\0';
  free (encoded_string);
  return ret;
-fail:
+  fail:
  LOG (GNUNET_ERROR_TYPE_WARNING,
       _ ("Character sets requested were `%s'->`%s'\n"),
       "UTF-8",
@@ -426,24 +426,27 @@ GNUNET_STRINGS_from_utf8 (const char *input,
 }
-void
+char *
-GNUNET_STRINGS_utf8_normalize (const char *input,
+GNUNET_STRINGS_utf8_normalize (const char *input)
-                               char *output)
 {
  uint8_t *tmp;
  size_t len;
+  char *output;
  tmp = u8_normalize (UNINORM_NFC,
                      (uint8_t *) input,
                      strlen ((char*) input),
                      NULL,
                      &len);
+  if (NULL == tmp)
+    return NULL;
+  output = GNUNET_malloc (len + 1);
  GNUNET_memcpy (output, tmp, len);
  output[len] = '\0';
  free (tmp);
+  return output;
 }
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_tolower (const char *input,
                             char *output)
 {
@@ -456,13 +459,16 @@ GNUNET_STRINGS_utf8_tolower (const char *input,
                       UNINORM_NFD,
                       NULL,
                       &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
  GNUNET_memcpy (output, tmp_in, len);
  output[len] = '\0';
-  free (tmp_in);
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
 }
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_toupper (const char *input,
                             char *output)
 {
@@ -475,9 +481,13 @@ GNUNET_STRINGS_utf8_toupper (const char *input,
                       UNINORM_NFD,
                       NULL,
                       &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
+  /* 0-terminator does not fit */
  GNUNET_memcpy (output, tmp_in, len);
  output[len] = '\0';
-  free (tmp_in);
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
 }
@@ -1604,7 +1614,7 @@ GNUNET_STRINGS_base64_encode (const void *in,
  char *opt;
  ret = 0;
-  GNUNET_assert (len < SIZE_MAX / 4 * 3 );
+  GNUNET_assert (len < SIZE_MAX / 4 * 3);
  opt = GNUNET_malloc (2 + (len * 4 / 3) + 8);
  for (size_t i = 0; i < len; ++i)
  {
@@ -1741,7 +1751,7 @@ GNUNET_STRINGS_base64_decode (const char *data,
      output[ret++] = c;
    }
  }
-END:
+  END:
  *out = output;
  return ret;
 }
@@ -1803,12 +1813,19 @@ GNUNET_STRINGS_urldecode (const char *data,
  char *wpos = *out;
  size_t resl = 0;
-  while ('\0' != *rpos)
+  while ( ('\0' != *rpos) &&
+          (data + len != rpos) )
  {
    unsigned int num;
    switch (*rpos)
    {
    case '%':
+      if (rpos + 3 > data + len)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (*out);
+        return 0;
+      }
      if (1 != sscanf (rpos + 1, "%2x", &num))
        break;
      *wpos = (char) ((unsigned char) num);
diff --git a/src/util/test_crypto_cs.c b/src/util/test_crypto_cs.c
index d3406516e..914ded9bc 100644
--- a/src/util/test_crypto_cs.c
+++ b/src/util/test_crypto_cs.c
@@ -1,6 +1,6 @@
 /*
   This file is part of GNUnet
-   Copyright (C) 2014,2015 GNUnet e.V.
+   Copyright (C) 2021,2022 GNUnet e.V.
   GNUnet is free software: you can redistribute it and/or modify it
   under the terms of the GNU Affero General Public License as published
@@ -30,148 +30,168 @@
 #define ITER 25
-void
+static void
 test_create_priv (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 {
  /* TEST 1
   * Check that privkey is set
   */
  struct GNUNET_CRYPTO_CsPrivateKey other_priv;
-  memcpy (&other_priv.scalar, &priv->scalar, sizeof(other_priv.scalar));
+  other_priv = *priv;
  GNUNET_CRYPTO_cs_private_key_generate (priv);
+  GNUNET_assert (0 !=
-  GNUNET_assert (0 != memcmp (&other_priv.scalar,
+                 GNUNET_memcmp (&other_priv.scalar,
-                              &priv->scalar,
+                                &priv->scalar));
-                              sizeof(other_priv.scalar)));
 }
-void
+static void
 test_generate_pub (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                       struct GNUNET_CRYPTO_CsPublicKey *pub)
+                   struct GNUNET_CRYPTO_CsPublicKey *pub)
 {
  /* TEST 1
   * Check that pubkey is set
   */
  struct GNUNET_CRYPTO_CsPublicKey other_pub;
-  memcpy (&other_pub.point, &pub->point, sizeof(other_pub.point));
-  GNUNET_CRYPTO_cs_private_key_get_public (priv, pub);
-  GNUNET_assert (0 != memcmp (&other_pub.point,
+  other_pub = *pub;
-                              &pub->point,
+  GNUNET_CRYPTO_cs_private_key_get_public (priv,
-                              sizeof(other_pub.point)));
+                                           pub);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_pub.point,
+                                &pub->point));
  /* TEST 2
   * Check that pubkey is a valid point
   */
-  GNUNET_assert (1 == crypto_core_ed25519_is_valid_point (pub->point.y));
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (pub->point.y));
  /* TEST 3
   * Check if function gives the same result for the same output
   */
-  memcpy (&other_pub.point, &pub->point, sizeof(other_pub.point));
+  other_pub = *pub;
+  for (unsigned int i = 0; i<ITER; i++)
-  for (int i = 0; i<ITER; i++) {
+  {
-    GNUNET_CRYPTO_cs_private_key_get_public (priv, pub);
+    GNUNET_CRYPTO_cs_private_key_get_public (priv,
-    GNUNET_assert (0 == memcmp (&other_pub.point,
+                                             pub);
-                                &pub->point,
+    GNUNET_assert (0 ==
-                                sizeof(other_pub.point)));
+                   GNUNET_memcmp (&other_pub.point,
+                                  &pub->point));
  }
 }
-void
+static void
 test_derive_rsecret (const struct GNUNET_CRYPTO_CsNonce *nonce,
-                   const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                     const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                   struct GNUNET_CRYPTO_CsRSecret r[2])
+                     struct GNUNET_CRYPTO_CsRSecret r[2])
 {
  /* TEST 1
   * Check that r are set
   */
  struct GNUNET_CRYPTO_CsPrivateKey other_r[2];
-  memcpy (&other_r[0], &r[0], sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
-  GNUNET_CRYPTO_cs_r_derive (nonce, priv, r);
+  memcpy (other_r,
+          r,
-  GNUNET_assert (0 != memcmp (&other_r[0],
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
-                              &r[0],
+  GNUNET_CRYPTO_cs_r_derive (nonce,
-                              sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+                             "nw",
+                             priv,
+                             r);
+  GNUNET_assert (0 !=
+                 memcmp (&other_r[0],
+                         &r[0],
+                         sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
  /* TEST 2
   * Check if function gives the same result for the same input.
   * This test ensures that the derivation is deterministic.
   */
-  memcpy (&other_r[0], &r[0], sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
+  memcpy (other_r,
-  for (int i = 0; i<ITER; i++) {
+          r,
-    GNUNET_CRYPTO_cs_r_derive (nonce, priv, r);
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
-    GNUNET_assert (0 == memcmp (&other_r[0],
+  for (unsigned int i = 0; i<ITER; i++)
-                                &r[0],
+  {
-                                sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+    GNUNET_CRYPTO_cs_r_derive (nonce,
+                               "nw",
+                               priv,
+                               r);
+    GNUNET_assert (0 ==
+                   memcmp (other_r,
+                           r,
+                           sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
  }
 }
-void
+static void
 test_generate_rpublic (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
-                     struct GNUNET_CRYPTO_CsRPublic *r_pub)
+                       struct GNUNET_CRYPTO_CsRPublic *r_pub)
 {
  /* TEST 1
   * Check that r_pub is set
   */
  struct GNUNET_CRYPTO_CsRPublic other_r_pub;
-  memcpy (&other_r_pub.point, &r_pub->point, sizeof(other_r_pub.point));
-  GNUNET_CRYPTO_cs_r_get_public (r_priv, r_pub);
-  GNUNET_assert (0 != memcmp (&other_r_pub.point,
-                              &r_pub->point,
-                              sizeof(other_r_pub.point)));
+  other_r_pub = *r_pub;
+  GNUNET_CRYPTO_cs_r_get_public (r_priv,
+                                 r_pub);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_r_pub.point,
+                                &r_pub->point));
  /* TEST 2
   * Check that r_pub is a valid point
   */
-  GNUNET_assert (1 == crypto_core_ed25519_is_valid_point (r_pub->point.y));
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (r_pub->point.y));
  /* TEST 3
   * Check if function gives the same result for the same output
   */
-  memcpy (&other_r_pub.point, &r_pub->point, sizeof(other_r_pub.point));
+  other_r_pub.point = r_pub->point;
-  for (int i = 0; i<ITER; i++) {
+  for (int i = 0; i<ITER; i++)
-    GNUNET_CRYPTO_cs_r_get_public (r_priv, r_pub);
+  {
-    GNUNET_assert (0 == memcmp (&other_r_pub.point,
+    GNUNET_CRYPTO_cs_r_get_public (r_priv,
-                                &r_pub->point,
+                                   r_pub);
-                                sizeof(other_r_pub.point)));
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_r_pub.point,
+                                  &r_pub->point));
  }
 }
-void
+static void
 test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsNonce *blind_seed,
-                           struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
+                             struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
 {
  /* TEST 1
   * Check that blinding secrets are set
   */
  struct GNUNET_CRYPTO_CsBlindingSecret other_bs[2];
-  memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
-          * 2);
+  memcpy (other_bs,
+          bs,
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
  GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
-  GNUNET_assert (0 != memcmp (&other_bs[0],
+  GNUNET_assert (0 !=
-                              &bs[0],
+                 memcmp (other_bs,
-                              sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+                         bs,
-                              * 2));
+                         sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+                         * 2));
  /* TEST 2
   * Check if function gives the same result for the same input.
   * This test ensures that the derivation is deterministic.
   */
-  memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+  memcpy (other_bs,
-          * 2);
+          bs,
-  for (int i = 0; i<ITER; i++) {
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
+  for (unsigned int i = 0; i<ITER; i++)
+  {
    GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
    GNUNET_assert (0 == memcmp (&other_bs[0],
                                &bs[0],
@@ -181,19 +201,20 @@ test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsNonce *blind_seed,
 }
-void
+static void
 test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
-                  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+                    const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                    const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                  const void *msg,
+                    const void *msg,
-                  size_t msg_len,
+                    size_t msg_len,
-                  struct GNUNET_CRYPTO_CsC blinded_cs[2],
+                    struct GNUNET_CRYPTO_CsC blinded_cs[2],
-                  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
+                    struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
 {
  /* TEST 1
   * Check that the blinded c's and blinded r's
   */
  struct GNUNET_CRYPTO_CsC other_blinded_c[2];
  memcpy (&other_blinded_c[0],
          &blinded_cs[0],
          sizeof(struct GNUNET_CRYPTO_CsC) * 2);
@@ -222,7 +243,8 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
   * Check if R' - aG -bX = R for b = 0
   * This test does the opposite operations and checks wether the equation is still correct.
   */
-  for (unsigned int b = 0; b <= 1; b++) {
+  for (unsigned int b = 0; b <= 1; b++)
+  {
    struct GNUNET_CRYPTO_Cs25519Point aG;
    struct GNUNET_CRYPTO_Cs25519Point bX;
    struct GNUNET_CRYPTO_Cs25519Point r_min_aG;
@@ -252,7 +274,6 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
  }
  /* TEST 3
   * Check that the blinded r_pubs' are valid points
   */
@@ -271,7 +292,8 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
          &blinded_r_pub[0],
          sizeof(struct GNUNET_CRYPTO_CsRPublic) * 2);
-  for (int i = 0; i<ITER; i++) {
+  for (unsigned int i = 0; i<ITER; i++)
+  {
    GNUNET_CRYPTO_cs_calc_blinded_c (bs,
                                     r_pub,
                                     pub,
@@ -289,13 +311,13 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
 }
-void
+static void
 test_blind_sign (unsigned int *b,
-               const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                 const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-               const struct GNUNET_CRYPTO_CsRSecret r[2],
+                 const struct GNUNET_CRYPTO_CsRSecret r[2],
-               const struct GNUNET_CRYPTO_CsC c[2],
+                 const struct GNUNET_CRYPTO_CsC c[2],
-               const struct GNUNET_CRYPTO_CsNonce *nonce,
+                 const struct GNUNET_CRYPTO_CsNonce *nonce,
-               struct GNUNET_CRYPTO_CsBlindS *blinded_s)
+                 struct GNUNET_CRYPTO_CsBlindS *blinded_s)
 {
  /* TEST 1
   * Check that blinded_s is set
@@ -336,8 +358,10 @@ test_blind_sign (unsigned int *b,
   * Check if function gives the same result for the same input.
   */
  memcpy (&other_blinded_s, blinded_s, sizeof(struct GNUNET_CRYPTO_CsBlindS));
-  unsigned int other_b;
+  for (unsigned int i = 0; i<ITER; i++)
-  for (int i = 0; i<ITER; i++) {
+  {
+    unsigned int other_b;
    other_b = GNUNET_CRYPTO_cs_sign_derive (priv, r, c, nonce, blinded_s);
    GNUNET_assert (other_b == *b);
@@ -348,10 +372,10 @@ test_blind_sign (unsigned int *b,
 }
-void
+static void
 test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-              const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+               const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-              struct GNUNET_CRYPTO_CsS *signature_scalar)
+               struct GNUNET_CRYPTO_CsS *signature_scalar)
 {
  /* TEST 1
   * Check that signature_scalar is set
@@ -387,7 +411,8 @@ test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
  memcpy (&other_signature_scalar, signature_scalar,
          sizeof(struct GNUNET_CRYPTO_CsS));
-  for (int i = 0; i<ITER; i++) {
+  for (unsigned int i = 0; i<ITER; i++)
+  {
    GNUNET_CRYPTO_cs_unblind (blinded_signature_scalar, bs, signature_scalar);
    GNUNET_assert (0 == memcmp (&other_signature_scalar,
                                signature_scalar,
@@ -396,10 +421,10 @@ test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
 }
-void
+static void
 test_blind_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
-                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                   const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                 const struct GNUNET_CRYPTO_CsC *c)
+                   const struct GNUNET_CRYPTO_CsC *c)
 {
  /* TEST 1
   * Test verifies the blinded signature sG == Rb + cbX
@@ -425,28 +450,30 @@ test_blind_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
 }
-void
+static void
 test_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
-            const struct GNUNET_CRYPTO_CsPublicKey *pub,
+             const struct GNUNET_CRYPTO_CsPublicKey *pub,
-            const void *msg,
+             const void *msg,
-            size_t msg_len)
+             size_t msg_len)
 {
  /* TEST 1
   * Test simple verification
   */
-  GNUNET_assert (GNUNET_YES == GNUNET_CRYPTO_cs_verify (sig,
+  GNUNET_assert (GNUNET_YES ==
-                                                        pub,
+                 GNUNET_CRYPTO_cs_verify (sig,
-                                                        msg,
+                                          pub,
-                                                        msg_len));
+                                          msg,
+                                          msg_len));
  /* TEST 2
   * Test verification of "wrong" message
   */
  char other_msg[] = "test massege";
  size_t other_msg_len = strlen ("test massege");
-  GNUNET_assert (GNUNET_SYSERR == GNUNET_CRYPTO_cs_verify (sig,
+  GNUNET_assert (GNUNET_SYSERR ==
-                                                       pub,
+                 GNUNET_CRYPTO_cs_verify (sig,
-                                                       other_msg,
+                                          pub,
-                                                       other_msg_len));
+                                          other_msg,
+                                          other_msg_len));
 }
@@ -461,71 +488,122 @@ main (int argc,
  size_t message_len = strlen ("test message");
  struct GNUNET_CRYPTO_CsPrivateKey priv;
+  memset (&priv,
+          42,
+          sizeof (priv));
  test_create_priv (&priv);
  struct GNUNET_CRYPTO_CsPublicKey pub;
-  test_generate_pub (&priv, &pub);
+  memset (&pub,
+          42,
+          sizeof (pub));
+  test_generate_pub (&priv,
+                     &pub);
  // derive nonce
  struct GNUNET_CRYPTO_CsNonce nonce;
-  GNUNET_assert (GNUNET_YES == GNUNET_CRYPTO_hkdf (nonce.nonce,
+  GNUNET_assert (GNUNET_YES ==
-                                                   sizeof(nonce.nonce),
+                 GNUNET_CRYPTO_kdf (nonce.nonce,
-                                                   GCRY_MD_SHA512,
+                                    sizeof(nonce.nonce),
-                                                   GCRY_MD_SHA256,
+                                    "nonce",
-                                                   "nonce",
+                                    strlen ("nonce"),
-                                                   strlen ("nonce"),
+                                    "nonce_secret",
-                                                   "nonce_secret",
+                                    strlen ("nonce_secret"),
-                                                   strlen ("nonce_secret"),
+                                    NULL,
-                                                   NULL,
+                                    0));
-                                                   0));
  // generate r, R
  struct GNUNET_CRYPTO_CsRSecret r_secrets[2];
-  test_derive_rsecret (&nonce, &priv, r_secrets);
+  memset (r_secrets,
+          42,
+          sizeof (r_secrets));
+  test_derive_rsecret (&nonce,
+                       &priv,
+                       r_secrets);
  struct GNUNET_CRYPTO_CsRPublic r_publics[2];
-  test_generate_rpublic (&r_secrets[0], &r_publics[0]);
-  test_generate_rpublic (&r_secrets[1], &r_publics[1]);
+  memset (r_publics,
+          42,
+          sizeof (r_publics));
+  test_generate_rpublic (&r_secrets[0],
+                         &r_publics[0]);
+  test_generate_rpublic (&r_secrets[1],
+                         &r_publics[1]);
  // ---------- actions performed by user
  // generate blinding secrets
  struct GNUNET_CRYPTO_CsBlindingSecret blindingsecrets[2];
+  memset (blindingsecrets,
+          42,
+          sizeof (blindingsecrets));
  test_derive_blindingsecrets (&nonce,
                               blindingsecrets);
  // calculate blinded c's
  struct GNUNET_CRYPTO_CsC blinded_cs[2];
  struct GNUNET_CRYPTO_CsRPublic blinded_r_pubs[2];
+  memset (blinded_cs,
+          42,
+          sizeof (blinded_cs));
+  memset (blinded_r_pubs,
+          42,
+          sizeof (blinded_r_pubs));
  test_calc_blindedc (blindingsecrets,
-                    r_publics,
+                      r_publics,
-                    &pub,
+                      &pub,
-                    message,
+                      message,
-                    message_len,
+                      message_len,
-                    blinded_cs,
+                      blinded_cs,
-                    blinded_r_pubs);
+                      blinded_r_pubs);
  // ---------- actions performed by signer
  // sign blinded c's and get b and s in return
  unsigned int b;
  struct GNUNET_CRYPTO_CsBlindS blinded_s;
-  test_blind_sign (&b, &priv, r_secrets, blinded_cs, &nonce, &blinded_s);
+  memset (&blinded_s,
+          42,
+          sizeof (blinded_s));
+  test_blind_sign (&b,
+                   &priv,
+                   r_secrets,
+                   blinded_cs,
+                   &nonce,
+                   &blinded_s);
  // verify blinded signature
  struct GNUNET_CRYPTO_CsSignature blinded_signature;
  blinded_signature.r_point = r_publics[b];
  blinded_signature.s_scalar.scalar = blinded_s.scalar;
-  test_blind_verify (&blinded_signature, &pub, &blinded_cs[b]);
+  test_blind_verify (&blinded_signature,
+                     &pub,
+                     &blinded_cs[b]);
  // ---------- actions performed by user
-    struct GNUNET_CRYPTO_CsS sig_scalar;
+  struct GNUNET_CRYPTO_CsS sig_scalar;
-  test_unblinds (&blinded_s, &blindingsecrets[b], &sig_scalar);
+  memset (&sig_scalar,
+          42,
+          sizeof (sig_scalar));
+  test_unblinds (&blinded_s,
+                 &blindingsecrets[b],
+                 &sig_scalar);
  // verify unblinded signature
  struct GNUNET_CRYPTO_CsSignature signature;
  signature.r_point = blinded_r_pubs[b];
  signature.s_scalar = sig_scalar;
-  test_verify (&signature, &pub, message, message_len);
+  test_verify (&signature,
+               &pub,
+               message,
+               message_len);
  return 0;
 }
diff --git a/src/util/test_strings.c b/src/util/test_strings.c
index 1ecd31464..cccffcaf5 100644
--- a/src/util/test_strings.c
+++ b/src/util/test_strings.c
@@ -114,10 +114,9 @@ main (int argc, char *argv[])
  /* Normalization */
  r = "q\u0307\u0323"; /* Non-canonical order */
-  GNUNET_STRINGS_utf8_normalize (r,
+  b = GNUNET_STRINGS_utf8_normalize (r);
-                                 buf);
+  GNUNET_assert (0 == strcmp ("q\u0323\u0307", b));
-  GNUNET_assert (0 == strcmp ("q\u0323\u0307", buf));
+  GNUNET_free (b);
  b = GNUNET_STRINGS_to_utf8 ("TEST", 4, "ASCII");
  WANT ("TEST", b);
diff --git a/src/util/time.c b/src/util/time.c
index 83b39b4e8..68a6937a0 100644
--- a/src/util/time.c
+++ b/src/util/time.c
@@ -695,6 +695,13 @@ GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch)
 }
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts)
+{
+  return ts.abs_time.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+}
 struct GNUNET_TIME_Absolute
 GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a)
 {
diff --git a/src/zonemaster/gnunet-service-zonemaster-monitor.c b/src/zonemaster/gnunet-service-zonemaster-monitor.c
index 3392a19d7..748a0f342 100644
--- a/src/zonemaster/gnunet-service-zonemaster-monitor.c
+++ b/src/zonemaster/gnunet-service-zonemaster-monitor.c
@@ -29,7 +29,6 @@
 #include "gnunet_namestore_service.h"
 #include "gnunet_statistics_service.h"
 #define LOG_STRERROR_FILE(kind, syscall, \
                          filename) GNUNET_log_from_strerror_file (kind, "util", \
                                                                   syscall, \
@@ -58,7 +57,6 @@
 */
 #define DHT_GNS_REPLICATION_LEVEL 5
 /**
 * Handle for DHT PUT activity triggered from the namestore monitor.
 */
@@ -197,39 +195,6 @@ dht_put_monitor_continuation (void *cls)
 /**
- * Convert namestore records from the internal format to that
- * suitable for publication (removes private records, converts
- * to absolute expiration time).
- *
- * @param rd input records
- * @param rd_count size of the @a rd and @a rd_public arrays
- * @param rd_public where to write the converted records
- * @return number of records written to @a rd_public
- */
-static unsigned int
-convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
-                            unsigned int rd_count,
-                            struct GNUNET_GNSRECORD_Data *rd_public)
-{
-  struct GNUNET_TIME_Absolute now;
-  unsigned int rd_public_count;
-  rd_public_count = 0;
-  now = GNUNET_TIME_absolute_get ();
-  for (unsigned int i = 0; i < rd_count; i++)
-  {
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
-      continue;
-    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
-        (rd[i].expiration_time < now.abs_value_us))
-      continue;   /* record already expired, skip it */
-    rd_public[rd_public_count++] = rd[i];
-  }
-  return rd_public_count;
-}
-/**
 * Store GNS records in the DHT.
 *
 * @param key key of the zone
@@ -244,16 +209,14 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
                 const char *label,
                 const struct GNUNET_GNSRECORD_Data *rd_public,
                 unsigned int rd_public_count,
+                 struct GNUNET_TIME_Absolute expire,
                 struct DhtPutActivity *ma)
 {
  struct GNUNET_GNSRECORD_Block *block;
  struct GNUNET_HashCode query;
-  struct GNUNET_TIME_Absolute expire;
  size_t block_size;
  struct GNUNET_DHT_PutHandle *ret;
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
-                                                        rd_public);
  if (cache_keys)
    GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (key,
                                                                expire,
@@ -301,7 +264,6 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
  return ret;
 }
 /**
 * Process a record that was stored in the namestore
 * (invoked by the monitor).
@@ -322,6 +284,8 @@ handle_monitor_event (void *cls,
  struct GNUNET_GNSRECORD_Data rd_public[rd_count];
  unsigned int rd_public_count;
  struct DhtPutActivity *ma;
+  struct GNUNET_TIME_Absolute expire;
+  char *emsg;
  (void) cls;
  GNUNET_STATISTICS_update (statistics,
@@ -334,9 +298,21 @@ handle_monitor_event (void *cls,
              label);
  /* filter out records that are not public, and convert to
     absolute expiration time. */
-  rd_public_count = convert_records_for_export (rd,
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
-                                                rd_count,
+                                                                rd,
-                                                rd_public);
+                                                                rd_count,
+                                                                rd_public,
+                                                                &rd_public_count,
+                                                                &expire,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Zonemaster-monitor failed: %s\n", emsg);
+    GNUNET_free (emsg);
+    GNUNET_NAMESTORE_zone_monitor_next (zmon,
+                                        1);
+    return;   /* nothing to do */
+  }
  if (0 == rd_public_count)
  {
    GNUNET_NAMESTORE_zone_monitor_next (zmon,
@@ -347,8 +323,9 @@ handle_monitor_event (void *cls,
  ma->start_date = GNUNET_TIME_absolute_get ();
  ma->ph = perform_dht_put (zone,
                            label,
-                            rd,
+                            rd_public,
-                            rd_count,
+                            rd_public_count,
+                            expire,
                            ma);
  if (NULL == ma->ph)
  {
diff --git a/src/zonemaster/gnunet-service-zonemaster.c b/src/zonemaster/gnunet-service-zonemaster.c
index bacafb97c..c6b86bf71 100644
--- a/src/zonemaster/gnunet-service-zonemaster.c
+++ b/src/zonemaster/gnunet-service-zonemaster.c
@@ -30,7 +30,6 @@
 #include "gnunet_namestore_service.h"
 #include "gnunet_statistics_service.h"
 #define LOG_STRERROR_FILE(kind, syscall, \
                          filename) GNUNET_log_from_strerror_file (kind, "util", \
                                                                   syscall, \
@@ -90,7 +89,6 @@
 */
 #define DHT_GNS_REPLICATION_LEVEL 5
 /**
 * Handle for DHT PUT activity triggered from the namestore monitor.
 */
@@ -527,46 +525,6 @@ dht_put_continuation (void *cls)
 }
-/**
- * Convert namestore records from the internal format to that
- * suitable for publication (removes private records, converts
- * to absolute expiration time).
- *
- * @param rd input records
- * @param rd_count size of the @a rd and @a rd_public arrays
- * @param rd_public where to write the converted records
- * @return number of records written to @a rd_public
- */
-static unsigned int
-convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
-                            unsigned int rd_count,
-                            struct GNUNET_GNSRECORD_Data *rd_public)
-{
-  struct GNUNET_TIME_Absolute now;
-  unsigned int rd_public_count;
-  rd_public_count = 0;
-  now = GNUNET_TIME_absolute_get ();
-  for (unsigned int i = 0; i < rd_count; i++)
-  {
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
-      continue;
-    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
-        (rd[i].expiration_time < now.abs_value_us))
-      continue;   /* record already expired, skip it */
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
-    {
-      /* GNUNET_GNSRECORD_block_create will convert to absolute time;
-         we just need to adjust our iteration frequency */
-      min_relative_record_time.rel_value_us =
-        GNUNET_MIN (rd[i].expiration_time,
-                    min_relative_record_time.rel_value_us);
-    }
-    rd_public[rd_public_count++] = rd[i];
-  }
-  return rd_public_count;
-}
 /**
 * Store GNS records in the DHT.
@@ -583,30 +541,28 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
                 const char *label,
                 const struct GNUNET_GNSRECORD_Data *rd_public,
                 unsigned int rd_public_count,
+                 const struct GNUNET_TIME_Absolute expire,
                 struct DhtPutActivity *ma)
 {
  struct GNUNET_GNSRECORD_Block *block;
  struct GNUNET_HashCode query;
-  struct GNUNET_TIME_Absolute expire;
  size_t block_size;
  struct GNUNET_DHT_PutHandle *ret;
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
-                                                        rd_public);
  if (cache_keys)
    GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (key,
-                                            expire,
+                                                                expire,
-                                            label,
+                                                                label,
-                                            rd_public,
+                                                                rd_public,
-                                            rd_public_count,
+                                                                rd_public_count,
-                                            &block));
+                                                                &block));
  else
    GNUNET_assert (GNUNET_OK ==  GNUNET_GNSRECORD_block_create (key,
-                                           expire,
+                                                                expire,
-                                           label,
+                                                                label,
-                                           rd_public,
+                                                                rd_public,
-                                           rd_public_count,
+                                                                rd_public_count,
-                                           &block));
+                                                                &block));
  if (NULL == block)
  {
    GNUNET_break (0);
@@ -713,7 +669,6 @@ zone_iteration_finished (void *cls)
  }
 }
 /**
 * Function used to put all records successively into the DHT.
 *
@@ -733,12 +688,26 @@ put_gns_record (void *cls,
  struct GNUNET_GNSRECORD_Data rd_public[rd_count];
  unsigned int rd_public_count;
  struct DhtPutActivity *ma;
+  struct GNUNET_TIME_Absolute expire;
+  char *emsg;
  (void) cls;
  ns_iteration_left--;
-  rd_public_count = convert_records_for_export (rd,
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
-                                                rd_count,
+                                                                rd,
-                                                rd_public);
+                                                                rd_count,
+                                                                rd_public,
+                                                                &rd_public_count,
+                                                                &expire,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Record set inconsistent, moving to next record set: %s\n",
+                emsg);
+    GNUNET_free (emsg);
+    check_zone_namestore_next ();
+    return;
+  }
  if (0 == rd_public_count)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -746,15 +715,30 @@ put_gns_record (void *cls,
    check_zone_namestore_next ();
    return;
  }
+  for (unsigned int i = 0; i < rd_public_count; i++)
+  {
+    if (0 != (rd_public[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    {
+      /* GNUNET_GNSRECORD_block_create will convert to absolute time;
+         we just need to adjust our iteration frequency */
+      min_relative_record_time.rel_value_us =
+        GNUNET_MIN (rd_public[i].expiration_time,
+                    min_relative_record_time.rel_value_us);
+    }
+  }
  /* We got a set of records to publish */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Starting DHT PUT\n");
  ma = GNUNET_new (struct DhtPutActivity);
  ma->start_date = GNUNET_TIME_absolute_get ();
  ma->ph = perform_dht_put (key,
                            label,
                            rd_public,
                            rd_public_count,
+                            expire,
                            ma);
  put_cnt++;
  if (0 == put_cnt % DELTA_INTERVAL)
@@ -788,7 +772,6 @@ put_gns_record (void *cls,
  }
 }
 /**
 * Periodically iterate over all zones and store everything in DHT
 *