12 files changed, 542 insertions, 459 deletions

diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index 315b4dbf3..d49e0c5c8 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -155,6 +155,7 @@ gnunet_dns2gns_LDADD = \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetgns.la \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(USE_VPN) \
   $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL)
 
@@ -218,7 +219,6 @@ gnunet_service_gns_LDADD = \
   $(top_builddir)/src/dht/libgnunetdht.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   $(LIBIDN) $(LIBIDN2) \
-  $(USE_VPN) \
   $(GN_LIBINTL)
 
 
@@ -270,8 +270,7 @@ check_SCRIPTS = \
   test_gns_rel_expiration.sh\
   test_gns_soa_lookup.sh\
   test_gns_revocation.sh\
-  test_gns_cname_lookup.sh\
-  test_proxy.sh
+  test_gns_redirect_lookup.sh
 
 if HAVE_GNUTLS
 if HAVE_LIBGNURL
@@ -292,7 +291,26 @@ EXTRA_DIST = \
   zonefiles/J7POEUT41A8PBFS7KVVDRF88GBOU4HK8PSU5QKVLVE3R9T91E99G.zkey \
   zonefiles/OEFL7A4VEF1B40QLEMTG5D8G1CN6EN16QUSG5R2DT71GRJN34LSG.zkey \
   zonefiles/test_zonekey \
-  $(check_SCRIPTS) \
+  test_gns_lookup.sh \
+  test_gns_config_lookup.sh \
+  test_gns_ipv6_lookup.sh\
+  test_gns_txt_lookup.sh\
+  test_gns_caa_lookup.sh\
+  test_gns_mx_lookup.sh \
+  test_gns_gns2dns_lookup.sh \
+  test_gns_gns2dns_zkey_lookup.sh \
+  test_gns_gns2dns_cname_lookup.sh \
+  test_gns_dht_lookup.sh\
+  test_gns_delegated_lookup.sh \
+  test_gns_at_lookup.sh\
+  test_gns_zkey_lookup.sh\
+  test_gns_rel_expiration.sh\
+  test_gns_soa_lookup.sh\
+  test_gns_revocation.sh\
+  test_gns_redirect_lookup.sh\
+  test_proxy.sh\
+  test_plugin_rest_gns.sh\
+  test_proxy.sh \
   $(pkgdata_DATA) \
   test_gnunet_gns.sh.in
 
diff --git a/src/gns/gnunet-bcd.c b/src/gns/gnunet-bcd.c
index 83efcfba5..60fe25945 100644
--- a/src/gns/gnunet-bcd.c
+++ b/src/gns/gnunet-bcd.c
@@ -419,6 +419,8 @@ create_response (void *cls,
              "\\def\\gpglineone{%s}\n\\def\\gpglinetwo{%s}\n",
              line1,
              line2);
+    GNUNET_free (line1);
+    GNUNET_free (line2);
   }
 
   fprintf (deffile,
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 06f4c9841..46659cdda 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -27,6 +27,7 @@
 #include <gnunet_dnsparser_lib.h>
 #include <gnunet_gns_service.h>
 #include <gnunet_dnsstub_lib.h>
+#include "gnunet_vpn_service.h"
 #include "gns.h"
 
 /**
@@ -35,6 +36,46 @@
 #define TIMEOUT GNUNET_TIME_UNIT_MINUTES
 
 /**
+ * Default timeout for VPN redirections.
+ */
+#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
+
+
+struct Request;
+
+/**
+ * Closure for #vpn_allocation_cb.
+ */
+struct VpnContext
+{
+  /**
+   * Which resolution process are we processing.
+   */
+  struct Request *request;
+
+  /**
+   * Handle to the VPN request that we were performing.
+   */
+  struct GNUNET_VPN_RedirectionRequest *vpn_request;
+
+  /**
+   * Number of records serialized in @e rd_data.
+   */
+  unsigned int rd_count;
+
+  /**
+   * Serialized records.
+   */
+  char *rd_data;
+
+  /**
+   * Number of bytes in @e rd_data.
+   */
+  ssize_t rd_data_size;
+};
+
+
+/**
  * Data kept per request.
  */
 struct Request
@@ -72,6 +113,11 @@ struct Request
   struct GNUNET_SCHEDULER_Task *timeout_task;
 
   /**
+   * Vpn resulution context
+   */
+  struct VpnContext *vpn_ctx;
+
+  /**
    * Original UDP request message.
    */
   char *udp_msg;
@@ -90,6 +136,7 @@ struct Request
    * ID of the original request.
    */
   uint16_t original_request_id;
+
 };
 
 /**
@@ -109,6 +156,11 @@ static struct in6_addr address6;
 struct GNUNET_GNS_Handle *gns;
 
 /**
+ * Our handle to the vpn service
+ */
+static struct GNUNET_VPN_Handle *vpn_handle;
+
+/**
  * Stub resolver
  */
 struct GNUNET_DNSSTUB_Context *dns_stub;
@@ -183,6 +235,11 @@ do_shutdown (void *cls)
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
   }
+  if (NULL != vpn_handle)
+  {
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
+  }
   if (NULL != dns_stub)
   {
     GNUNET_DNSSTUB_stop (dns_stub);
@@ -269,6 +326,7 @@ static void
 do_timeout (void *cls)
 {
   struct Request *request = cls;
+  struct VpnContext *vpn_ctx;
 
   if (NULL != request->packet)
     GNUNET_DNSPARSER_free_packet (request->packet);
@@ -277,6 +335,12 @@ do_timeout (void *cls)
   if (NULL != request->dns_lookup)
     GNUNET_DNSSTUB_resolve_cancel (request->dns_lookup);
   GNUNET_free (request->udp_msg);
+  if (NULL != (vpn_ctx = request->vpn_ctx))
+  {
+    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
+    GNUNET_free (vpn_ctx->rd_data);
+    GNUNET_free (vpn_ctx);
+  }
   GNUNET_free (request);
 }
 
@@ -321,6 +385,79 @@ dns_result_processor (void *cls,
   send_response (request);
 }
 
+/**
+ * Callback invoked from the VPN service once a redirection is
+ * available.  Provides the IP address that can now be used to
+ * reach the requested destination.  Replaces the "VPN" record
+ * with the respective A/AAAA record and continues processing.
+ *
+ * @param cls closure
+ * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
+ *                will match 'result_af' from the request
+ * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
+ *                that the VPN allocated for the redirection;
+ *                traffic to this IP will now be redirected to the
+ *                specified target peer; NULL on error
+ */
+static void
+vpn_allocation_cb (void *cls,
+                   int af,
+                   const void *address)
+{
+  struct VpnContext *vpn_ctx = cls;
+  struct Request *request = vpn_ctx->request;
+  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
+  unsigned int i;
+
+  vpn_ctx->vpn_request = NULL;
+  request->vpn_ctx = NULL;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_records_deserialize (
+                   (size_t) vpn_ctx->rd_data_size,
+                   vpn_ctx->rd_data,
+                   vpn_ctx->rd_count,
+                   rd));
+  for (i = 0; i < vpn_ctx->rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
+    {
+      switch (af)
+      {
+      case AF_INET:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
+        rd[i].data_size = sizeof(struct in_addr);
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        break;
+
+      case AF_INET6:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        rd[i].data_size = sizeof(struct in6_addr);
+        break;
+
+      default:
+        GNUNET_assert (0);
+      }
+      break;
+    }
+  }
+  GNUNET_assert (i < vpn_ctx->rd_count);
+  if (0 == vpn_ctx->rd_count)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("VPN returned empty result for `%s'\n"),
+                request->packet->queries[0].name);
+  send_response (request);
+  GNUNET_free (vpn_ctx->rd_data);
+  GNUNET_free (vpn_ctx);
+}
+
+
 
 /**
  * Iterator called on obtained result for a GNS lookup.
@@ -339,6 +476,11 @@ result_processor (void *cls,
   struct Request *request = cls;
   struct GNUNET_DNSPARSER_Packet *packet;
   struct GNUNET_DNSPARSER_Record rec;
+  struct VpnContext *vpn_ctx;
+  const struct GNUNET_TUN_GnsVpnRecord *vpn;
+  const char *vname;
+  struct GNUNET_HashCode vhash;
+  int af;
 
   request->lookup = NULL;
   if (GNUNET_NO == was_gns)
@@ -415,6 +557,67 @@ result_processor (void *cls,
                            packet->num_answers,
                            rec);
       break;
+    case GNUNET_GNSRECORD_TYPE_VPN:
+      if ((GNUNET_DNSPARSER_TYPE_A != request->packet->queries[0].type) &&
+          (GNUNET_DNSPARSER_TYPE_AAAA != request->packet->queries[0].type))
+        break;
+      af = (GNUNET_DNSPARSER_TYPE_A == request->packet->queries[0].type) ? AF_INET :
+           AF_INET6;
+      if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
+          rd[i].data_size)
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
+      vname = (const char *) &vpn[1];
+      if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
+                                                     GNUNET_TUN_GnsVpnRecord)
+          ])
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      GNUNET_TUN_service_name_to_hash (vname,
+                                       &vhash);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
+                  GNUNET_i2s (&vpn->peer),
+                  vname,
+                  (int) af,
+                  (int) ntohs (vpn->proto));
+      vpn_ctx = GNUNET_new (struct VpnContext);
+      request->vpn_ctx = vpn_ctx;
+      vpn_ctx->request = request;
+      vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                                 rd);
+      if (vpn_ctx->rd_data_size < 0)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (vpn_ctx);
+        break;
+      }
+      vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
+      vpn_ctx->rd_count = rd_count;
+      GNUNET_assert (vpn_ctx->rd_data_size ==
+                     GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                         rd,
+                                                         (size_t) vpn_ctx
+                                                         ->rd_data_size,
+                                                         vpn_ctx->rd_data));
+      vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
+                                                          af,
+                                                          ntohs (
+                                                            vpn->proto),
+                                                          &vpn->peer,
+                                                          &vhash,
+                                                          GNUNET_TIME_relative_to_absolute (
+                                                            VPN_TIMEOUT),
+                                                          &
+                                                          vpn_allocation_cb,
+                                                          vpn_ctx);
+      return;
+
 
     default:
       /* skip */
@@ -641,6 +844,8 @@ run (void *cls,
                                  NULL);
   if (NULL == (gns = GNUNET_GNS_connect (cfg)))
     return;
+  if (NULL == (vpn_handle = GNUNET_VPN_connect (cfg)))
+    return;
   GNUNET_assert (NULL != (dns_stub = GNUNET_DNSSTUB_start (128)));
   if (GNUNET_OK !=
       GNUNET_DNSSTUB_add_dns_ip (dns_stub,
@@ -649,6 +854,8 @@ run (void *cls,
     GNUNET_DNSSTUB_stop (dns_stub);
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
     return;
   }
 
@@ -750,6 +957,8 @@ run (void *cls,
   {
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
     GNUNET_DNSSTUB_stop (dns_stub);
     dns_stub = NULL;
     return;
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 5833f4d0b..b28236fed 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -420,15 +420,11 @@ handle_lookup (void *cls,
                const struct LookupMessage *sh_msg)
 {
   struct GnsClient *gc = cls;
-  char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 1];
   struct ClientLookupHandle *clh;
-  char *nameptr = name;
-  const char *utf_in;
+  const char *name;
 
   GNUNET_SERVICE_client_continue (gc->client);
-  utf_in = (const char *) &sh_msg[1];
-  GNUNET_STRINGS_utf8_tolower (utf_in,
-                               nameptr);
+  name = (const char *) &sh_msg[1];
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received LOOKUP `%s' message\n",
               name);
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 51e650b4f..72b228f33 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -52,7 +52,6 @@
 #include "gns.h"
 #include "gnunet-service-gns.h"
 #include "gnunet-service-gns_resolver.h"
-#include "gnunet_vpn_service.h"
 
 
 /**
@@ -68,11 +67,6 @@
     GNUNET_TIME_UNIT_SECONDS, 15)
 
 /**
- * Default timeout for VPN redirections.
- */
-#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
-
-/**
  * DHT replication level
  */
 #define DHT_GNS_REPLICATION_LEVEL 10
@@ -255,38 +249,6 @@ struct DnsResult
 
 
 /**
- * Closure for #vpn_allocation_cb.
- */
-struct VpnContext
-{
-  /**
-   * Which resolution process are we processing.
-   */
-  struct GNS_ResolverHandle *rh;
-
-  /**
-   * Handle to the VPN request that we were performing.
-   */
-  struct GNUNET_VPN_RedirectionRequest *vpn_request;
-
-  /**
-   * Number of records serialized in @e rd_data.
-   */
-  unsigned int rd_count;
-
-  /**
-   * Serialized records.
-   */
-  char *rd_data;
-
-  /**
-   * Number of bytes in @e rd_data.
-   */
-  ssize_t rd_data_size;
-};
-
-
-/**
  * Handle to a currently pending resolution.  On result (positive or
  * negative) the #GNS_ResultProcessor is called.
  */
@@ -322,10 +284,6 @@ struct GNS_ResolverHandle
    */
   struct GNUNET_DHT_GetHandle *get_handle;
 
-  /**
-   * Handle to a VPN request, NULL if none is active.
-   */
-  struct VpnContext *vpn_ctx;
 
   /**
    * Socket for a DNS request, NULL if none is active.
@@ -463,11 +421,6 @@ struct CacheOps
 static struct GNUNET_NAMECACHE_Handle *namecache_handle;
 
 /**
- * Our handle to the vpn service
- */
-static struct GNUNET_VPN_Handle *vpn_handle;
-
-/**
  * Resolver handle to the dht
  */
 static struct GNUNET_DHT_Handle *dht_handle;
@@ -1235,16 +1188,16 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
 
 
 /**
- * We encountered a CNAME record during our resolution.
+ * We encountered a REDIRECT record during our resolution.
  * Merge it into our chain.
  *
  * @param rh resolution we are performing
- * @param cname value of the cname record we got for the current
+ * @param rname value of the redirect record we got for the current
  *        authority chain tail
  */
 static void
-handle_gns_cname_result (struct GNS_ResolverHandle *rh,
-                         const char *cname)
+handle_gns_redirect_result (struct GNS_ResolverHandle *rh,
+                            const char *rname)
 {
   size_t nlen;
   char *res;
@@ -1253,14 +1206,17 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   int af;
   struct GNUNET_IDENTITY_PublicKey zone;
 
-  nlen = strlen (cname);
-  tld = GNS_get_tld (cname);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling GNS REDIRECT result `%s'\n",
+              rname);
+  nlen = strlen (rname);
+  tld = GNS_get_tld (rname);
   if (0 == strcmp ("+", tld))
   {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
     if (0 == rh->name_resolution_pos)
     {
-      res = GNUNET_strndup (cname, nlen - 2);
+      res = GNUNET_strndup (rname, nlen - 2);
       rh->name_resolution_pos = nlen - 2;
     }
     else
@@ -1270,7 +1226,7 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                        (int) rh->name_resolution_pos,
                        rh->name,
                        (int) (nlen - 2),
-                       cname);
+                       rname);
       rh->name_resolution_pos = strlen (res);
     }
     GNUNET_free (rh->name);
@@ -1291,13 +1247,13 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   }
   if (GNUNET_OK == GNUNET_GNSRECORD_zkey_to_pkey (tld, &zone))
   {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
     if (0 == rh->name_resolution_pos)
     {
       GNUNET_asprintf (&res,
                        "%.*s",
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
-                       cname);
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
+                       rname);
     }
     else
     {
@@ -1305,8 +1261,8 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                        "%.*s.%.*s",
                        (int) rh->name_resolution_pos,
                        rh->name,
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
-                       cname);
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
+                       rname);
     }
     rh->name_resolution_pos = strlen (res);
     GNUNET_free (rh->name);
@@ -1326,18 +1282,62 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   }
 
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Got CNAME `%s' from GNS for `%s'\n",
-              cname,
+              "Got REDIRECT `%s' from GNS for `%s'\n",
+              rname,
               rh->name);
   if (NULL != rh->std_resolve)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Multiple CNAME results from GNS resolving `%s'! Not really allowed...\n",
+                "Multiple REDIRECT results from GNS resolving `%s'! Not really allowed...\n",
                 rh->name);
     GNUNET_RESOLVER_request_cancel (rh->std_resolve);
   }
   /* name is absolute, go to DNS */
   GNUNET_free (rh->name);
+  rh->name = GNUNET_strdup (rname);
+  rh->name_resolution_pos = strlen (rh->name);
+  switch (rh->record_type)
+  {
+  case GNUNET_DNSPARSER_TYPE_A:
+    af = AF_INET;
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_AAAA:
+    af = AF_INET6;
+    break;
+
+  default:
+    af = AF_UNSPEC;
+    break;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Doing standard DNS lookup for `%s'\n",
+              rh->name);
+
+  rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name,
+                                            af,
+                                            DNS_LOOKUP_TIMEOUT,
+                                            &handle_dns_result,
+                                            rh);
+}
+
+
+
+/**
+ * We encountered a CNAME record during our resolution.
+ * Merge it into our chain.
+ *
+ * @param rh resolution we are performing
+ * @param cname value of the cname record we got for the current
+ *        authority chain tail
+ */
+static void
+handle_gns_cname_result (struct GNS_ResolverHandle *rh,
+                         const char *cname)
+{
+  int af;
+
+  GNUNET_free (rh->name);
   rh->name = GNUNET_strdup (cname);
   rh->name_resolution_pos = strlen (rh->name);
   switch (rh->record_type)
@@ -1379,80 +1379,6 @@ handle_gns_resolution_result (void *cls,
                               const struct GNUNET_GNSRECORD_Data *rd);
 
 
-/**
- * Callback invoked from the VPN service once a redirection is
- * available.  Provides the IP address that can now be used to
- * reach the requested destination.  Replaces the "VPN" record
- * with the respective A/AAAA record and continues processing.
- *
- * @param cls closure
- * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
- *                will match 'result_af' from the request
- * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
- *                that the VPN allocated for the redirection;
- *                traffic to this IP will now be redirected to the
- *                specified target peer; NULL on error
- */
-static void
-vpn_allocation_cb (void *cls,
-                   int af,
-                   const void *address)
-{
-  struct VpnContext *vpn_ctx = cls;
-  struct GNS_ResolverHandle *rh = vpn_ctx->rh;
-  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
-  unsigned int i;
-
-  vpn_ctx->vpn_request = NULL;
-  rh->vpn_ctx = NULL;
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_GNSRECORD_records_deserialize (
-                   (size_t) vpn_ctx->rd_data_size,
-                   vpn_ctx->rd_data,
-                   vpn_ctx->rd_count,
-                   rd));
-  for (i = 0; i < vpn_ctx->rd_count; i++)
-  {
-    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
-    {
-      switch (af)
-      {
-      case AF_INET:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
-        rd[i].data_size = sizeof(struct in_addr);
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        break;
-
-      case AF_INET6:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        rd[i].data_size = sizeof(struct in6_addr);
-        break;
-
-      default:
-        GNUNET_assert (0);
-      }
-      break;
-    }
-  }
-  GNUNET_assert (i < vpn_ctx->rd_count);
-  if (0 == vpn_ctx->rd_count)
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("VPN returned empty result for `%s'\n"),
-                rh->name);
-  handle_gns_resolution_result (rh,
-                                vpn_ctx->rd_count,
-                                rd);
-  GNUNET_free (vpn_ctx->rd_data);
-  GNUNET_free (vpn_ctx);
-}
-
 
 /**
  * We have resolved one or more of the nameservers for a
@@ -1653,6 +1579,20 @@ handle_gns2dns_ip (void *cls,
     ac->authority_info.dns_authority.found = GNUNET_YES;
 }
 
+/**
+ * We found a REDIRECT record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with CNAME to resolve recursively
+ */
+static void
+recursive_redirect_resolution (struct GNS_ResolverHandle *rh,
+                               const struct GNUNET_GNSRECORD_Data *rd)
+{
+  handle_gns_redirect_result (rh,
+                              rd->data);
+}
+
 
 /**
  * We found a CNAME record, perform recursive resolution on it.
@@ -1956,11 +1896,6 @@ handle_gns_resolution_result (void *cls,
 {
   struct GNS_ResolverHandle *rh = cls;
   char *cname;
-  struct VpnContext *vpn_ctx;
-  const struct GNUNET_TUN_GnsVpnRecord *vpn;
-  const char *vname;
-  struct GNUNET_HashCode vhash;
-  int af;
   char scratch[UINT16_MAX];
   size_t scratch_off;
   size_t scratch_start;
@@ -2006,8 +1941,18 @@ handle_gns_resolution_result (void *cls,
       GNUNET_free (cname);
       return;
     }
-    /* If A/AAAA was requested, but we got a VPN
-       record, we convert it to A/AAAA using GNUnet VPN */
+    if ((rd_count > 0) &&
+        (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[0].record_type) &&
+        (GNUNET_GNSRECORD_TYPE_REDIRECT != rh->record_type))
+    {
+      handle_gns_redirect_result (rh,
+                                  rd[0].data);
+      return;
+    }
+
+
+    /* If A/AAAA was requested,
+     * but we got a GNS2DNS record */
     if ((GNUNET_DNSPARSER_TYPE_A == rh->record_type) ||
         (GNUNET_DNSPARSER_TYPE_AAAA == rh->record_type))
     {
@@ -2015,69 +1960,6 @@ handle_gns_resolution_result (void *cls,
       {
         switch (rd[i].record_type)
         {
-        case GNUNET_GNSRECORD_TYPE_VPN:
-          {
-            af = (GNUNET_DNSPARSER_TYPE_A == rh->record_type) ? AF_INET :
-                 AF_INET6;
-            if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
-                rd[i].data_size)
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
-            vname = (const char *) &vpn[1];
-            if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
-                                                           GNUNET_TUN_GnsVpnRecord)
-                ])
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            GNUNET_TUN_service_name_to_hash (vname,
-                                             &vhash);
-            GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                        "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
-                        GNUNET_i2s (&vpn->peer),
-                        vname,
-                        (int) af,
-                        (int) ntohs (vpn->proto));
-            vpn_ctx = GNUNET_new (struct VpnContext);
-            rh->vpn_ctx = vpn_ctx;
-            vpn_ctx->rh = rh;
-            vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                                       rd);
-            if (vpn_ctx->rd_data_size < 0)
-            {
-              GNUNET_break_op (0);
-              GNUNET_free (vpn_ctx);
-              fail_resolution (rh);
-              return;
-            }
-            vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
-            vpn_ctx->rd_count = rd_count;
-            GNUNET_assert (vpn_ctx->rd_data_size ==
-                           GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                               rd,
-                                                               (size_t) vpn_ctx
-                                                               ->rd_data_size,
-                                                               vpn_ctx->rd_data));
-            vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
-                                                                af,
-                                                                ntohs (
-                                                                  vpn->proto),
-                                                                &vpn->peer,
-                                                                &vhash,
-                                                                GNUNET_TIME_relative_to_absolute (
-                                                                  VPN_TIMEOUT),
-                                                                &
-                                                                vpn_allocation_cb,
-                                                                vpn_ctx);
-            return;
-          }
-
         case GNUNET_GNSRECORD_TYPE_GNS2DNS:
           {
             /* delegation to DNS */
@@ -2117,6 +1999,23 @@ handle_gns_resolution_result (void *cls,
          so we can free it afterwards. */
       switch (rd[i].record_type)
       {
+      case GNUNET_GNSRECORD_TYPE_REDIRECT:
+        {
+          char *rname;
+          rname = GNUNET_strndup (rd[i].data, rd[i].data_size);
+          rname = translate_dot_plus (rh, rname);
+          GNUNET_break (NULL != rname);
+          scratch_start = scratch_off;
+          memcpy (&scratch[scratch_start], rname, strlen (rname) + 1);
+          scratch_off += strlen (rname) + 1;
+          GNUNET_assert (rd_off < rd_count);
+          rd_new[rd_off].data = &scratch[scratch_start];
+          rd_new[rd_off].data_size = scratch_off - scratch_start;
+          rd_off++;
+          GNUNET_free (rname);
+        }
+        break;
+
       case GNUNET_DNSPARSER_TYPE_CNAME:
         {
           char *cname;
@@ -2380,6 +2279,12 @@ handle_gns_resolution_result (void *cls,
 
   switch (rd[0].record_type)
   {
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
+    GNUNET_break_op (1 == rd_count);  /* REDIRECT should be unique */
+    recursive_redirect_resolution (rh,
+                                   &rd[0]);
+    return;
+
   case GNUNET_DNSPARSER_TYPE_CNAME:
     GNUNET_break_op (1 == rd_count);  /* CNAME should be unique */
     recursive_cname_resolution (rh,
@@ -2393,15 +2298,21 @@ handle_gns_resolution_result (void *cls,
                                &rd[0]);
     return;
 
-  default:
+  case GNUNET_GNSRECORD_TYPE_GNS2DNS:
     if (GNUNET_OK ==
         recursive_gns2dns_resolution (rh,
                                       rd_count,
                                       rd))
       return;
     break;
+  default:
+    if (GNUNET_YES != GNUNET_GNSRECORD_is_critical (rd[0].record_type))
+      return;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Unable to process critical delegation record\n"));
+    break;
   }
-fail:
+  fail:
   GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
               _ ("GNS lookup recursion failed (no delegation record found)\n"));
   fail_resolution (rh);
@@ -2618,6 +2529,13 @@ handle_namecache_block_response (void *cls,
 
   GNUNET_assert (NULL != rh->namecache_qe);
   rh->namecache_qe = NULL;
+  if (NULL == block)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "No block found\n");
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got block with expiration %s\n",
+                GNUNET_STRINGS_absolute_time_to_string (GNUNET_GNSRECORD_block_get_expiration (block)));
   if (((GNUNET_GNS_LO_DEFAULT == rh->options) ||
        ((GNUNET_GNS_LO_LOCAL_MASTER == rh->options) &&
         (ac != rh->ac_head))) &&
@@ -2916,7 +2834,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
 {
   struct DnsResult *dr;
   struct AuthorityChain *ac;
-  struct VpnContext *vpn_ctx;
 
   GNUNET_CONTAINER_DLL_remove (rlh_head,
                                rlh_tail,
@@ -2981,12 +2898,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
     GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
     rh->dht_heap_node = NULL;
   }
-  if (NULL != (vpn_ctx = rh->vpn_ctx))
-  {
-    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
-    GNUNET_free (vpn_ctx->rd_data);
-    GNUNET_free (vpn_ctx);
-  }
   if (NULL != rh->namecache_qe)
   {
     GNUNET_NAMECACHE_cancel (rh->namecache_qe);
@@ -3046,7 +2957,6 @@ GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
   if (GNUNET_YES == disable_cache)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Namecache disabled\n");
-  vpn_handle = GNUNET_VPN_connect (cfg);
 }
 
 
@@ -3077,8 +2987,6 @@ GNS_resolver_done ()
   }
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
   dht_lookup_heap = NULL;
-  GNUNET_VPN_disconnect (vpn_handle);
-  vpn_handle = NULL;
   dht_handle = NULL;
   namecache_handle = NULL;
 }
diff --git a/src/gns/plugin_block_gns.c b/src/gns/plugin_block_gns.c
index 407754a8c..fd9c99cb4 100644
--- a/src/gns/plugin_block_gns.c
+++ b/src/gns/plugin_block_gns.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010-2013 GNUnet e.V.
+     Copyright (C) 2010-2013, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -92,98 +92,16 @@ block_plugin_gns_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg block group to use for evaluation
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on @a type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_gns_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *bg,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_HashCode h;
-  struct GNUNET_HashCode chash;
-
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  if (NULL == reply_block)
-  {
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  }
-
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_GNSRECORD_query_from_block (block,
-                                     &h);
-  if (0 != GNUNET_memcmp (&h, query))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  if (GNUNET_OK !=
-      GNUNET_GNSRECORD_block_verify (block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to obtain the key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param cls closure
  * @param type block type
  * @param reply_block block to get the key for
  * @param reply_block_size number of bytes in @a reply_block
  * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_get_key (void *cls,
@@ -194,12 +112,18 @@ block_plugin_gns_get_key (void *cls,
 {
   const struct GNUNET_GNSRECORD_Block *block;
 
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
   {
     GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
+    memset (key,
+            0,
+            sizeof (*key));
+    return GNUNET_OK;
   }
   block = reply_block;
   GNUNET_GNSRECORD_query_from_block (block,
@@ -227,8 +151,11 @@ block_plugin_gns_check_query (void *cls,
                               const void *xquery,
                               size_t xquery_size)
 {
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (0 != xquery_size)
   {
     GNUNET_break_op (0);
@@ -243,7 +170,6 @@ block_plugin_gns_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -251,14 +177,16 @@ block_plugin_gns_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_check_block (void *cls,
                               enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_HashCode *query,
                               const void *block,
                               size_t block_size)
 {
   const struct GNUNET_GNSRECORD_Block *gblock;
   
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (block_size < sizeof(struct GNUNET_GNSRECORD_Block))
   {
     GNUNET_break_op (0);
@@ -306,23 +234,16 @@ block_plugin_gns_check_reply (void *cls,
                               const void *reply_block,
                               size_t reply_block_size)
 {
-  const struct GNUNET_GNSRECORD_Block *block;
+  const struct GNUNET_GNSRECORD_Block *block = reply_block;
   struct GNUNET_HashCode chash;
 
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
   {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   }
+  GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_GNSRECORD_Block));
+  GNUNET_assert (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size);
   GNUNET_CRYPTO_hash (reply_block,
                       reply_block_size,
                       &chash);
@@ -347,7 +268,6 @@ libgnunet_plugin_block_gns_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_gns_evaluate;
   api->get_key = &block_plugin_gns_get_key;
   api->create_group = &block_plugin_gns_create_group;
   api->check_query = &block_plugin_gns_check_query;
diff --git a/src/gns/plugin_gnsrecord_gns.c b/src/gns/plugin_gnsrecord_gns.c
index 391144925..dc7ffa9b2 100644
--- a/src/gns/plugin_gnsrecord_gns.c
+++ b/src/gns/plugin_gnsrecord_gns.c
@@ -64,8 +64,7 @@ gns_value_to_string (void *cls,
     return GNUNET_IDENTITY_public_key_to_string (&pk);
 
   case GNUNET_GNSRECORD_TYPE_NICK:
-    return GNUNET_strndup (data, data_size);
-
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
   case GNUNET_GNSRECORD_TYPE_LEHO:
     return GNUNET_strndup (data, data_size);
 
@@ -133,7 +132,9 @@ gns_value_to_string (void *cls,
       GNUNET_free (ival);
       return box_str;
     }
-
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+    return GNUNET_strdup (_("This is a memento of an older block for internal maintenance."));
+  }
   default:
     return NULL;
   }
@@ -184,16 +185,13 @@ gns_string_to_value (void *cls,
     if (record_type != type)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _("Record type does not match parsed record type\n"));
+                  _ ("Record type does not match parsed record type\n"));
       return GNUNET_SYSERR;
     }
     return GNUNET_OK;
 
   case GNUNET_GNSRECORD_TYPE_NICK:
-    *data = GNUNET_strdup (s);
-    *data_size = strlen (s);
-    return GNUNET_OK;
-
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
   case GNUNET_GNSRECORD_TYPE_LEHO:
     *data = GNUNET_strdup (s);
     *data_size = strlen (s);
@@ -301,6 +299,12 @@ gns_string_to_value (void *cls,
       GNUNET_free (bval);
       return GNUNET_OK;
     }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+      *data_size = 0;
+      *data = NULL;
+      return GNUNET_OK;
+    }
+
 
   default:
     return GNUNET_SYSERR;
@@ -317,12 +321,16 @@ static struct
   const char *name;
   uint32_t number;
 } gns_name_map[] = { { "PKEY", GNUNET_GNSRECORD_TYPE_PKEY },
-                     { "EDKEY", GNUNET_GNSRECORD_TYPE_PKEY },
+                     { "EDKEY", GNUNET_GNSRECORD_TYPE_EDKEY },
                      { "NICK", GNUNET_GNSRECORD_TYPE_NICK },
                      { "LEHO", GNUNET_GNSRECORD_TYPE_LEHO },
                      { "VPN", GNUNET_GNSRECORD_TYPE_VPN },
                      { "GNS2DNS", GNUNET_GNSRECORD_TYPE_GNS2DNS },
                      { "BOX", GNUNET_GNSRECORD_TYPE_BOX },
+                     { "REDIRECT", GNUNET_GNSRECORD_TYPE_REDIRECT },
+                     /* Tombstones should never be added manually
+                      * so this makes sense, kind of */
+                     { "\u271E", GNUNET_GNSRECORD_TYPE_TOMBSTONE },
                      { NULL, UINT32_MAX } };
 
 
@@ -365,6 +373,19 @@ gns_number_to_typename (void *cls, uint32_t type)
 }
 
 
+static enum GNUNET_GenericReturnValue
+gns_is_critical (void *cls, uint32_t type)
+{
+  return ((type == GNUNET_GNSRECORD_TYPE_PKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_EDKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_GNS2DNS) ||
+          (type == GNUNET_GNSRECORD_TYPE_REDIRECT) ?
+          GNUNET_YES : GNUNET_NO);
+}
+
+
+
+
 /**
  * Entry point for the plugin.
  *
@@ -381,6 +402,7 @@ libgnunet_plugin_gnsrecord_gns_init (void *cls)
   api->string_to_value = &gns_string_to_value;
   api->typename_to_number = &gns_typename_to_number;
   api->number_to_typename = &gns_number_to_typename;
+  api->is_critical = &gns_is_critical;
   return api;
 }
 
diff --git a/src/gns/test_gns_cname_lookup.sh b/src/gns/test_gns_cname_lookup.sh
deleted file mode 100755
index 3a189e1e2..000000000
--- a/src/gns/test_gns_cname_lookup.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/bin/sh
-# This file is in the public domain.
-trap "gnunet-arm -e -c test_gns_lookup.conf" INT
-
-LOCATION=$(which gnunet-config)
-if [ -z $LOCATION ]
-then
-  LOCATION="gnunet-config"
-fi
-$LOCATION --version 1> /dev/null
-if test $? != 0
-then
-        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
-        exit 77
-fi
-
-# permissive DNS resolver we will use for the test
-DNS_RESOLVER="8.8.8.8"
-if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
-then
-  echo "Cannot reach DNS, skipping test"
-  exit 77
-fi
-
-
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-
-TEST_IP_PLUS="127.0.0.1"
-TEST_IP_DNS="131.159.74.67"
-TEST_RECORD_CNAME_SERVER="server"
-TEST_RECORD_CNAME_PLUS="server.+"
-TEST_RECORD_CNAME_DNS="gnunet.org"
-TEST_RECORD_NAME_SERVER="server"
-TEST_RECORD_NAME_PLUS="www"
-TEST_RECORD_NAME_ZKEY="www2"
-TEST_RECORD_NAME_DNS="www3"
-MY_EGO="myego"
-TEST_DOMAIN_PLUS="www.$MY_EGO"
-TEST_DOMAIN_ZKEY="www2.$MY_EGO"
-TEST_DOMAIN_DNS="www3.$MY_EGO"
-which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
-
-gnunet-arm -s -c test_gns_lookup.conf
-gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
-MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
-TEST_RECORD_CNAME_ZKEY="server.${MY_EGO_PKEY}"
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-RES_CNAME=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
-RES_CNAME_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t CNAME -c test_gns_lookup.conf`
-RES_CNAME_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
-RES_CNAME_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
-
-TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
-gnunet-arm -e -c test_gns_lookup.conf
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-
-# make cmp case-insensitive by converting to lower case first
-RES_CNAME_RAW=`echo $RES_CNAME_RAW | tr [A-Z] [a-z]`
-TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
-if [ "$RES_CNAME_RAW" = "server.$TESTEGOZONE" ]
-then
-  echo "PASS: CNAME resolution from GNS"
-else
-  echo "FAIL: CNAME resolution from GNS, got $RES_CNAME_RAW, expected server.$TESTEGOZONE."
-  exit 1
-fi
-
-if [ "$RES_CNAME" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.+)"
-else
-  echo "FAIL: IP resolution from GNS (.+), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-
-if [ "$RES_CNAME_ZKEY" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.zkey)"
-else
-  echo "FAIL: IP resolution from GNS (.zkey), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-
-if echo "$RES_CNAME_DNS" | grep "$TEST_IP_DNS" > /dev/null
-then
-  echo "PASS: IP resolution from DNS"
-  exit 0
-else
-  echo "FAIL: IP resolution from DNS, got $RES_CNAME_DNS, expected $TEST_IP_DNS."
-  exit 1
-fi
diff --git a/src/gns/test_gns_gns2dns_cname_lookup.sh b/src/gns/test_gns_gns2dns_cname_lookup.sh
index ce1afacf4..9315f6b2f 100755
--- a/src/gns/test_gns_gns2dns_cname_lookup.sh
+++ b/src/gns/test_gns_gns2dns_cname_lookup.sh
@@ -16,9 +16,11 @@ fi
 
 rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IPALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 
 # main label used during resolution
 TEST_RECORD_NAME="homepage"
@@ -46,7 +48,7 @@ TEST_DOMAIN="www.${TEST_RECORD_NAME}.$MY_EGO"
 which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -59,6 +61,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS2 -e never -c test_gns_lookup.conf
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS3 -e never -c test_gns_lookup.conf
 
+gnunet-namestore -z $MY_EGO -D -c test_gns_lookup.conf
 
 echo "EGOs:"
 gnunet-identity -d
diff --git a/src/gns/test_gns_gns2dns_lookup.sh b/src/gns/test_gns_gns2dns_lookup.sh
index dcad594b3..240e441a4 100755
--- a/src/gns/test_gns_gns2dns_lookup.sh
+++ b/src/gns/test_gns_gns2dns_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
 
@@ -49,7 +51,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
 
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -69,7 +71,7 @@ gnunet-identity -d
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -91,7 +93,7 @@ else
   ret=1
 fi
 
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
   echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -99,7 +101,7 @@ else
   ret=1
 fi
 
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
   echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_gns2dns_zkey_lookup.sh b/src/gns/test_gns_gns2dns_zkey_lookup.sh
index 1f8e34c42..a299c34b6 100755
--- a/src/gns/test_gns_gns2dns_zkey_lookup.sh
+++ b/src/gns/test_gns_gns2dns_zkey_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'www.gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
 
@@ -46,7 +48,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
 
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -66,7 +68,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -88,7 +90,7 @@ else
   ret=1
 fi
 
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
   echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -96,7 +98,7 @@ else
   ret=1
 fi
 
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
   echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_redirect_lookup.sh b/src/gns/test_gns_redirect_lookup.sh
new file mode 100755
index 000000000..dfe5087ef
--- /dev/null
+++ b/src/gns/test_gns_redirect_lookup.sh
@@ -0,0 +1,100 @@
+#!/bin/sh
+# This file is in the public domain.
+trap "gnunet-arm -e -c test_gns_lookup.conf" INT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+        exit 77
+fi
+
+# permissive DNS resolver we will use for the test
+DNS_RESOLVER="8.8.8.8"
+if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
+then
+  echo "Cannot reach DNS, skipping test"
+  exit 77
+fi
+
+
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+
+TEST_IP_PLUS="127.0.0.1"
+TEST_IP_DNS="131.159.74.67"
+TEST_RECORD_REDIRECT_SERVER="server"
+TEST_RECORD_REDIRECT_PLUS="server.+"
+TEST_RECORD_REDIRECT_DNS="gnunet.org"
+TEST_RECORD_NAME_SERVER="server"
+TEST_RECORD_NAME_PLUS="www"
+TEST_RECORD_NAME_ZKEY="www2"
+TEST_RECORD_NAME_DNS="www3"
+MY_EGO="myego"
+TEST_DOMAIN_PLUS="www.$MY_EGO"
+TEST_DOMAIN_ZKEY="www2.$MY_EGO"
+TEST_DOMAIN_DNS="www3.$MY_EGO"
+which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
+
+gnunet-arm -s -c test_gns_lookup.conf
+gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
+MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
+TEST_RECORD_REDIRECT_ZKEY="server.${MY_EGO_PKEY}"
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -D -z $MY_EGO
+RES_REDIRECT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
+RES_REDIRECT_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t REDIRECT -c test_gns_lookup.conf`
+RES_REDIRECT_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
+RES_REDIRECT_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
+
+TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
+gnunet-arm -e -c test_gns_lookup.conf
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+
+# make cmp case-insensitive by converting to lower case first
+RES_REDIRECT_RAW=`echo $RES_REDIRECT_RAW | tr [A-Z] [a-z]`
+TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
+if [ "$RES_REDIRECT_RAW" = "server.$TESTEGOZONE" ]
+then
+  echo "PASS: REDIRECT resolution from GNS"
+else
+  echo "FAIL: REDIRECT resolution from GNS, got $RES_REDIRECT_RAW, expected server.$TESTEGOZONE."
+  exit 1
+fi
+
+if [ "$RES_REDIRECT" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.+)"
+else
+  echo "FAIL: IP resolution from GNS (.+), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+
+if [ "$RES_REDIRECT_ZKEY" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.zkey)"
+else
+  echo "FAIL: IP resolution from GNS (.zkey), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+
+if echo "$RES_REDIRECT_DNS" | grep "$TEST_IP_DNS" > /dev/null
+then
+  echo "PASS: IP resolution from DNS"
+  exit 0
+else
+  echo "FAIL: IP resolution from DNS, got $RES_REDIRECT_DNS, expected $TEST_IP_DNS."
+  exit 1
+fi