138 files changed, 10274 insertions, 11527 deletions

diff --git a/src/include/.gitignore b/src/include/.gitignore
new file mode 100644
index 000000000..76ca45ab4
--- /dev/null
+++ b/src/include/.gitignore
@@ -0,0 +1,3 @@
+!gnunet_config.h.in
+gnunet_config.h
+gnunet_mysql_compat.h
diff --git a/src/include/Makefile.am b/src/include/Makefile.am
index e4b02b8ee..ea8bae62f 100644
--- a/src/include/Makefile.am
+++ b/src/include/Makefile.am
@@ -4,23 +4,22 @@ SUBDIRS = .
 gnunetincludedir = $(includedir)/gnunet
 
 EXTRA_DIST = \
+  platform.h \
   gauger.h \
   block_fs.h \
   block_dns.h \
   block_regex.h
 
 gnunetinclude_HEADERS = \
-  platform.h gettext.h \
+  gnunet_config.h \
+  gettext.h \
   compat.h \
   gnunet_abd_service.h \
   gnunet_applications.h \
   gnunet_arm_service.h \
-  gnunet_ats_service.h \
-  gnunet_ats_application_service.h \
-  gnunet_ats_transport_service.h \
-  gnunet_ats_plugin.h \
   gnunet_bandwidth_lib.h \
   gnunet_bio_lib.h \
+  gnunet_dht_block_types.h \
   gnunet_block_lib.h \
   gnunet_block_group_lib.h \
   gnunet_block_plugin.h \
@@ -47,8 +46,7 @@ gnunetinclude_HEADERS = \
   gnunet_dnsparser_lib.h \
   gnunet_dnsstub_lib.h \
   gnunet_dns_service.h \
-  gnunet_fragmentation_lib.h \
-  gnunet_friends_lib.h \
+  gnunet_error_codes.h \
   gnunet_fs_service.h \
   gnunet_getopt_lib.h \
   gnunet_gns_service.h \
@@ -56,10 +54,11 @@ gnunetinclude_HEADERS = \
   gnunet_gnsrecord_json_lib.h \
   gnunet_gnsrecord_plugin.h \
   gnu_name_system_record_types.h \
-  gnunet_hello_lib.h \
+  gnu_name_system_protocols.h \
+  gnu_name_system_service_ports.h \
+  gnunet_hello_uri_lib.h \
   gnunet_helper_lib.h \
   gnunet_identity_service.h \
-  gnunet_abe_lib.h \
   gnunet_reclaim_lib.h \
   gnunet_reclaim_plugin.h \
   gnunet_reclaim_service.h \
@@ -71,8 +70,6 @@ gnunetinclude_HEADERS = \
   gnunet_microphone_lib.h \
   gnunet_mst_lib.h \
   gnunet_mq_lib.h \
-  gnunet_my_lib.h \
-  gnunet_mysql_lib.h \
   gnunet_namecache_plugin.h \
   gnunet_namecache_service.h \
   gnunet_namestore_plugin.h \
@@ -83,10 +80,8 @@ gnunetinclude_HEADERS = \
   gnunet_network_lib.h \
   gnunet_nse_service.h \
   gnunet_nt_lib.h \
-  gnunet_op_lib.h \
   gnunet_os_lib.h \
   gnunet_peer_lib.h \
-  gnunet_peerinfo_service.h \
   gnunet_peerstore_plugin.h \
   gnunet_peerstore_service.h \
   gnunet_plugin_lib.h \
@@ -113,21 +108,17 @@ gnunetinclude_HEADERS = \
   gnunet_sq_lib.h \
   gnunet_statistics_service.h \
   gnunet_strings_lib.h \
-  gnunet_testbed_service.h \
-  gnunet_testbed_logger_service.h \
   gnunet_testing_lib.h \
-  gnunet_testing_plugin.h \
-  gnunet_testing_ng_lib.h \
-  gnunet_testing_netjail_lib.h \
+  gnunet_testing_arm_lib.h \
+  gnunet_testing_core_lib.h \
+  gnunet_testing_testbed_lib.h \
+  gnunet_testing_transport_lib.h \
+  gnunet_testbed_lib.h \
   gnunet_time_lib.h \
-  gnunet_transport_service.h \
   gnunet_transport_application_service.h \
   gnunet_transport_communication_service.h \
-  gnunet_transport_core_service.h \
-  gnunet_transport_hello_service.h \
-  gnunet_transport_manipulation_service.h \
   gnunet_transport_monitor_service.h \
-  gnunet_transport_plugin.h \
+  gnunet_transport_core_service.h \
   gnunet_tun_lib.h \
   gnunet_uri_lib.h \
   gnunet_util_lib.h \
diff --git a/src/include/block_dns.h b/src/include/block_dns.h
index 2186cb1a1..4ac6d0250 100644
--- a/src/include/block_dns.h
+++ b/src/include/block_dns.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup vpn_suite
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -30,6 +33,7 @@
 #ifndef BLOCK_DNS_H
 #define BLOCK_DNS_H
 
+
 #include "gnunet_util_lib.h"
 
 GNUNET_NETWORK_STRUCT_BEGIN
@@ -65,3 +69,5 @@ GNUNET_NETWORK_STRUCT_END
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */  /* end of group addition to vpn_suite */
diff --git a/src/include/block_fs.h b/src/include/block_fs.h
index e4caf6e50..b64a83f39 100644
--- a/src/include/block_fs.h
+++ b/src/include/block_fs.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup fs_l2
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef BLOCK_FS_H
 #define BLOCK_FS_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_fs_service.h"
 
@@ -98,3 +102,5 @@ GNUNET_NETWORK_STRUCT_END
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */  /* end of group addition to fs_l2 */
diff --git a/src/include/block_regex.h b/src/include/block_regex.h
index cc78f2c32..fea19e335 100644
--- a/src/include/block_regex.h
+++ b/src/include/block_regex.h
@@ -36,6 +36,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 #include <stdint.h>
 
diff --git a/src/include/gauger.h b/src/include/gauger.h
index 716ce9cb1..f811b335c 100644
--- a/src/include/gauger.h
+++ b/src/include/gauger.h
@@ -11,6 +11,7 @@
 #ifndef __GAUGER_H__
 #define __GAUGER_H__
 
+
 #include <unistd.h>
 #include <stdio.h>
 #include <sys/wait.h>
diff --git a/src/include/gettext.h b/src/include/gettext.h
index 458512657..d62a3db7d 100644
--- a/src/include/gettext.h
+++ b/src/include/gettext.h
@@ -20,9 +20,14 @@
 #define _LIBGETTEXT_H 1
 
 /* NLS can be disabled through the configure --disable-nls option.  */
+#ifndef ENABLE_NLS
+#define ENABLE_NLS 0
+#endif
+
 #if ENABLE_NLS
 
 /* Get declarations of GNU message catalog functions.  */
+
 #include <libintl.h>
 
 #else
@@ -46,11 +51,11 @@
 #define dgettext(Domainname, Msgid) ((const char *) (Msgid))
 #define dcgettext(Domainname, Msgid, Category) ((const char *) (Msgid))
 #define ngettext(Msgid1, Msgid2, N) \
-  ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
+        ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
 #define dngettext(Domainname, Msgid1, Msgid2, N) \
-  ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
+        ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
 #define dcngettext(Domainname, Msgid1, Msgid2, N, Category) \
-  ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
+        ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
 /* slight modification here to avoid warnings: generate GNUNET_NO code,
    not even the cast... */
 #define textdomain(Domainname)
diff --git a/src/include/gnu_name_system_protocols.h b/src/include/gnu_name_system_protocols.h
new file mode 100644
index 000000000..c10eef468
--- /dev/null
+++ b/src/include/gnu_name_system_protocols.h
@@ -0,0 +1,96 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012-2023 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+#ifndef GNUNET_GNS_PROTOCOLS_H
+#define GNUNET_GNS_PROTOCOLS_H
+
+/**
+ * WARNING:
+ * This header is generated!
+ * In order to add GNS service ports, you must register
+ * them in GANA, and then use the header generation script
+ * to create an update of this file. You may then replace this
+ * file with the update.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+struct GNUNET_GNS_Protocol
+{
+  const char *name;
+
+  uint16_t number;
+};
+
+struct GNUNET_GNS_Protocol GNUNET_GNS_Protocols[] = {
+  /**
+   * LIGHTest trust policy scheme
+   */
+  {
+    .name = "trust",
+    .number = 49152
+  },
+
+  {
+    .name = NULL,
+    .number = 0
+  }
+};
+
+uint16_t
+GNUNET_GNS_protocol_name_to_number (const char *name)
+{
+  int i = 0;
+  while (NULL != GNUNET_GNS_Protocols[i].name)
+  {
+    if (0 == strcmp (name, GNUNET_GNS_Protocols[i].name))
+      return GNUNET_GNS_Protocols[i].number;
+    i++;
+  }
+  return 0;
+}
+
+
+const char*
+GNUNET_GNS_protocol_number_to_name (uint16_t number)
+{
+  int i = 0;
+  while (NULL != GNUNET_GNS_Protocols[i].name)
+  {
+    if (number == GNUNET_GNS_Protocols[i].number)
+      return GNUNET_GNS_Protocols[i].name;
+    i++;
+  }
+  return NULL;
+}
+
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/gnu_name_system_record_types.h b/src/include/gnu_name_system_record_types.h
index 22b2c472e..8a62cac11 100644
--- a/src/include/gnu_name_system_record_types.h
+++ b/src/include/gnu_name_system_record_types.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2012-2021 GNUnet e.V.
+     Copyright (C) 2012-2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -38,106 +38,162 @@ extern "C" {
 
 
 /**
- * GNS zone transfer
+ * GNS zone delegation (PKEY)
  */
 #define GNUNET_GNSRECORD_TYPE_PKEY 65536
 
+
 /**
- * GNS nick names
+ * GNS zone nickname
  */
 #define GNUNET_GNSRECORD_TYPE_NICK 65537
 
+
 /**
- * legacy hostnames
+ * GNS legacy hostname
  */
 #define GNUNET_GNSRECORD_TYPE_LEHO 65538
 
+
 /**
  * VPN resolution
  */
 #define GNUNET_GNSRECORD_TYPE_VPN 65539
 
+
 /**
  * Delegation to DNS
  */
 #define GNUNET_GNSRECORD_TYPE_GNS2DNS 65540
 
+
 /**
- * Boxed records (see TLSA/SRV handling in GNS)
+ * Box record
  */
 #define GNUNET_GNSRECORD_TYPE_BOX 65541
 
+
 /**
  * social place for SecuShare
  */
 #define GNUNET_GNSRECORD_TYPE_PLACE 65542
 
+
 /**
  * Endpoint for conversation
  */
 #define GNUNET_GNSRECORD_TYPE_PHONE 65543
 
+
 /**
  * identity attribute
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE 65544
 
+
 /**
  * local ticket reference
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET 65545
 
+
+/**
+ * SBox record
+ */
+#define GNUNET_GNSRECORD_TYPE_SBOX 65547
+
+
 /**
  * For ABD policies
  */
 #define GNUNET_GNSRECORD_TYPE_DELEGATE 65548
 
+
 /**
  * For ABD reverse lookups
  */
 #define GNUNET_GNSRECORD_TYPE_ATTRIBUTE 65549
 
+
 /**
  * for reclaim records
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE_REF 65550
 
+
+/**
+ * Redirection record
+ */
+#define GNUNET_GNSRECORD_TYPE_REDIRECT 65551
+
+
 /**
  * For reclaim OIDC client names.
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_CLIENT 65552
 
+
 /**
  * Used reclaimID OIDC client redirect URIs.
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT 65553
 
+
 /**
  * Record type for an attribute attestation (e.g. JWT).
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL 65554
 
+
 /**
  * Record type for a presentation of a credential.
  */
 #define GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION 65555
 
+
 /**
- * Record type for EDKEY zone delegations.
+ * GNS zone delegation (EDKEY)
  */
 #define GNUNET_GNSRECORD_TYPE_EDKEY 65556
 
+
 /**
  * Encoding for Robust Immutable Storage (ERIS) binary read capability
  */
 #define GNUNET_GNSRECORD_TYPE_ERIS_READ_CAPABILITY 65557
 
+
 /**
  * Record type to share an entry of a messenger room
  */
 #define GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY 65558
 
 
+/**
+ * Record type to indicate a previously delete record (PRIVATE only)
+ */
+#define GNUNET_GNSRECORD_TYPE_TOMBSTONE 65559
+
+
+/**
+ * Record type to store details about a messenger room
+ */
+#define GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS 65560
+
+
+/**
+ * Record type to store DID Documents
+ */
+#define GNUNET_GNSRECORD_TYPE_DID_DOCUMENT 65561
+
+
+/**
+ * Private metadata for a delegation registration
+ */
+#define GNUNET_GNSRECORD_TYPE_GNS_REGISTRAR_METADATA 4294901760
+
+
+
 #if 0 /* keep Emacsens' auto-indent happy */
 {
 #endif
diff --git a/src/include/gnu_name_system_service_ports.h b/src/include/gnu_name_system_service_ports.h
new file mode 100644
index 000000000..040e598b6
--- /dev/null
+++ b/src/include/gnu_name_system_service_ports.h
@@ -0,0 +1,104 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012-2023 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+#ifndef GNUNET_GNS_SERVICE_PORTS_H
+#define GNUNET_GNS_SERVICE_PORTS_H
+
+/**
+ * WARNING:
+ * This header is generated!
+ * In order to add GNS service ports, you must register
+ * them in GANA, and then use the header generation script
+ * to create an update of this file. You may then replace this
+ * file with the update.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+struct GNUNET_GNS_ServicePort
+{
+  const char *name;
+
+  uint16_t port;
+};
+
+struct GNUNET_GNS_ServicePort GNUNET_GNS_ServicePorts[] = {
+  /**
+   * Used by Trust Scheme Authorities to publish information about Trust Schemes (LIGHTest)
+   */
+  {
+    .name = "scheme",
+    .port = 49152
+  },
+
+  /**
+   * Used Trust Translation Authorities to publish information about Trust Translations (LIGHTest)
+   */
+  {
+    .name = "translation",
+    .port = 49153
+  },
+
+  {
+    .name = NULL,
+    .port = 0
+  }
+};
+
+uint16_t
+GNUNET_GNS_service_port_name_to_number (const char *name)
+{
+  int i = 0;
+  while (NULL != GNUNET_GNS_ServicePorts[i].name)
+  {
+    if (0 == strcmp (name, GNUNET_GNS_ServicePorts[i].name))
+      return GNUNET_GNS_ServicePorts[i].port;
+    i++;
+  }
+  return 0;
+}
+
+
+const char*
+GNUNET_GNS_service_port_number_to_name (uint16_t port)
+{
+  int i = 0;
+  while (NULL != GNUNET_GNS_ServicePorts[i].name)
+  {
+    if (port == GNUNET_GNS_ServicePorts[i].port)
+      return GNUNET_GNS_ServicePorts[i].name;
+    i++;
+  }
+  return NULL;
+}
+
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/gnunet_abd_service.h b/src/include/gnunet_abd_service.h
index afec880f1..cb6e77256 100644
--- a/src/include/gnunet_abd_service.h
+++ b/src/include/gnunet_abd_service.h
@@ -19,19 +19,23 @@
  */
 
 /**
+ * @addtogroup reclaim_suite
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
  * API to the Credential service
  *
  * @defgroup abd  Credential service
- * Credentials
+ * Credential service for Attribute-Based Decryption
  *
  * @{
  */
 #ifndef GNUNET_ABD_SERVICE_H
 #define GNUNET_ABD_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_gns_service.h"
 #include "gnunet_identity_service.h"
@@ -103,7 +107,7 @@ struct GNUNET_ABD_DelegationRecordSet
   /**
    * Public key of the subject this attribute was delegated to
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey subject_key;
+  struct GNUNET_CRYPTO_PublicKey subject_key;
 
   /**
    * Length of attribute, may be 0
@@ -123,7 +127,7 @@ struct GNUNET_ABD_DelegationSet
   /**
    * Public key of the subject this attribute was delegated to
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey subject_key;
+  struct GNUNET_CRYPTO_PublicKey subject_key;
 
   uint32_t subject_attribute_len;
 
@@ -143,12 +147,12 @@ struct GNUNET_ABD_Delegation
   /**
    * The issuer of the delegation
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey issuer_key;
+  struct GNUNET_CRYPTO_PublicKey issuer_key;
 
   /**
    * Public key of the subject this attribute was delegated to
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey subject_key;
+  struct GNUNET_CRYPTO_PublicKey subject_key;
 
   /**
    * Length of the attribute
@@ -181,17 +185,17 @@ struct GNUNET_ABD_Delegate
   /**
    * The issuer of the credential
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey issuer_key;
+  struct GNUNET_CRYPTO_PublicKey issuer_key;
 
   /**
    * Public key of the subject this credential was issued to
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey subject_key;
+  struct GNUNET_CRYPTO_PublicKey subject_key;
 
   /**
    * Signature of this credential
    */
-  struct GNUNET_CRYPTO_EcdsaSignature signature;
+  struct GNUNET_CRYPTO_Signature signature;
 
   /**
    * Expiration of this credential
@@ -318,9 +322,9 @@ typedef void (*GNUNET_ABD_RemoveDelegateResultProcessor) (void *cls,
  */
 struct GNUNET_ABD_Request*
   GNUNET_ABD_verify (struct GNUNET_ABD_Handle *handle,
-                     const struct GNUNET_CRYPTO_EcdsaPublicKey *issuer_key,
+                     const struct GNUNET_CRYPTO_PublicKey *issuer_key,
                      const char *issuer_attribute,
-                     const struct GNUNET_CRYPTO_EcdsaPublicKey *subject_key,
+                     const struct GNUNET_CRYPTO_PublicKey *subject_key,
                      uint32_t delegate_count,
                      const struct GNUNET_ABD_Delegate *delegates,
                      enum GNUNET_ABD_AlgoDirectionFlags direction,
@@ -331,9 +335,9 @@ struct GNUNET_ABD_Request*
 
 struct GNUNET_ABD_Request*
   GNUNET_ABD_collect (struct GNUNET_ABD_Handle *handle,
-                      const struct GNUNET_CRYPTO_EcdsaPublicKey *issuer_key,
+                      const struct GNUNET_CRYPTO_PublicKey *issuer_key,
                       const char *issuer_attribute,
-                      const struct GNUNET_CRYPTO_EcdsaPrivateKey *subject_key,
+                      const struct GNUNET_CRYPTO_PrivateKey *subject_key,
                       enum GNUNET_ABD_AlgoDirectionFlags direction,
                       GNUNET_ABD_CredentialResultProcessor proc,
                       void *proc_cls,
@@ -356,7 +360,7 @@ struct GNUNET_ABD_Request *
 GNUNET_ABD_add_delegation (struct GNUNET_ABD_Handle *handle,
                            struct GNUNET_IDENTITY_Ego *issuer,
                            const char *attribute,
-                           struct GNUNET_CRYPTO_EcdsaPublicKey *subject,
+                           struct GNUNET_CRYPTO_PublicKey *subject,
                            const char *delegated_attribute,
                            GNUNET_ABD_DelegateResultProcessor proc,
                            void *proc_cls);
@@ -384,13 +388,13 @@ GNUNET_ABD_remove_delegation (struct GNUNET_ABD_Handle *handle,
  *
  * @param issuer the ego that should be used to issue the attribute
  * @param subject the subject of the attribute
- * @param attribute the name of the attribute
+ * @param iss_attr the name of the attribute
  * @param expiration the TTL of the credential
  * @return handle to the queued request
  */
 struct GNUNET_ABD_Delegate*
-GNUNET_ABD_delegate_issue (const struct GNUNET_CRYPTO_EcdsaPrivateKey *issuer,
-                           struct GNUNET_CRYPTO_EcdsaPublicKey *subject,
+GNUNET_ABD_delegate_issue (const struct GNUNET_CRYPTO_PrivateKey *issuer,
+                           struct GNUNET_CRYPTO_PublicKey *subject,
                            const char *iss_attr,
                            const char *sub_attr,
                            struct GNUNET_TIME_Absolute *expiration);
@@ -415,3 +419,5 @@ GNUNET_ABD_request_cancel (struct GNUNET_ABD_Request *lr);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */  /* end of group addition to reclaim_suite */
diff --git a/src/include/gnunet_abe_lib.h b/src/include/gnunet_abe_lib.h
deleted file mode 100644
index 7aeb3520d..000000000
--- a/src/include/gnunet_abe_lib.h
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2001-2018 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file include/gnunet_abe_lib.h
- * @brief Attribute-Based Encryption primitives for GNUnet
- *
- * @author Martin Schanzenbach
- *
- * @defgroup abe  ABE Crypto library: Attribute-Based Encryption operations
- *
- */
-#ifndef GNUNET_ABE_LIB_H
-#define GNUNET_ABE_LIB_H
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_common.h"
-#include <gcrypt.h>
-
-/**
- * @brief type for ABE master keys
- */
-struct GNUNET_CRYPTO_AbeMasterKey;
-
-/**
- * @brief type for ABE keys
- */
-struct GNUNET_CRYPTO_AbeKey;
-
-
-/**
- * @ingroup abe
- * Create a new CP-ABE master key. Caller must free return value.
- *
- * @return fresh private key; free using #GNUNET_ABE_cpabe_delete_master_key
- */
-struct GNUNET_ABE_AbeMasterKey *
-GNUNET_ABE_cpabe_create_master_key (void);
-
-/**
- * @ingroup abe
- * Delete a CP-ABE master key.
- *
- * @param key the master key
- * @return fresh private key; free using #GNUNET_free
- */
-void
-GNUNET_ABE_cpabe_delete_master_key (struct GNUNET_ABE_AbeMasterKey *key);
-
-/**
- * @ingroup abe
- * Create a new CP-ABE key. Caller must free return value.
- *
- * @param key the master key
- * @param attrs the attributes to append to the key
- * @return fresh private key; free using #GNUNET_ABE_cpabe_delete_key
- */
-struct GNUNET_ABE_AbeKey *
-GNUNET_ABE_cpabe_create_key (struct GNUNET_ABE_AbeMasterKey *key,
-                             char **attrs);
-
-/**
- * @ingroup abe
- * Delete a CP-ABE key.
- *
- * @param key the key to delete
- * @param delete_pub GNUNET_YES if the public key should also be freed (bug in gabe)
- * @return fresh private key; free using #GNUNET_free
- */
-void
-GNUNET_ABE_cpabe_delete_key (struct GNUNET_ABE_AbeKey *key,
-                             int delete_pub);
-
-
-/**
- * @ingroup abe
- * Encrypt a block using  sessionkey.
- *
- * @param block the block to encrypt
- * @param size the size of the @a block
- * @param policy the ABE policy
- * @param key the key used to encrypt
- * @param result the result buffer. Will be allocated. Free using #GNUNET_free
- * @return the size of the encrypted block, -1 for errors
- */
-ssize_t
-GNUNET_ABE_cpabe_encrypt (const void *block,
-                          size_t size,
-                          const char *policy,
-                          const struct GNUNET_ABE_AbeMasterKey *key,
-                          void **result);
-
-/**
- * @ingroup abe
- * Decrypt a block using the ABE key.
- *
- * @param block the block to encrypt
- * @param size the size of the @a block
- * @param key the key used to decrypt
- * @param result the result buffer. Will be allocated. Free using #GNUNET_free
- * @return the size of the encrypted block, -1 for errors
- */
-ssize_t
-GNUNET_ABE_cpabe_decrypt (const void *block,
-                          size_t size,
-                          const struct GNUNET_ABE_AbeKey *key,
-                          void **result);
-
-/**
- * @ingroup abe
- * Serialize an ABE key.
- *
- * @param key the key to serialize
- * @param result the result buffer. Will be allocated. Free using #GNUNET_free
- * @return the size of the encrypted block, -1 for errors
- */
-ssize_t
-GNUNET_ABE_cpabe_serialize_key (const struct GNUNET_ABE_AbeKey *key,
-                                void **result);
-
-/**
- * @ingroup abe
- * Deserialize a serialized ABE key.
- *
- * @param data the data to deserialize
- * @param len the length of the data.
- * @return the ABE key. NULL of unsuccessful
- */
-struct GNUNET_ABE_AbeKey*
-GNUNET_ABE_cpabe_deserialize_key (const void *data,
-                                  size_t len);
-
-/**
- * @ingroup abe
- * Serialize an ABE master key.
- *
- * @param key the key to serialize
- * @param result the result buffer. Will be allocated. Free using #GNUNET_free
- * @return the size of the encrypted block, -1 for errors
- */
-ssize_t
-GNUNET_ABE_cpabe_serialize_master_key (const struct
-                                       GNUNET_ABE_AbeMasterKey *key,
-                                       void **result);
-
-/**
- * @ingroup abe
- * Deserialize an ABE master key.
- *
- * @param data the data to deserialize
- * @param len the length of the data.
- * @return the ABE key. NULL of unsuccessful
- */
-struct GNUNET_ABE_AbeMasterKey*
-GNUNET_ABE_cpabe_deserialize_master_key (const void *data,
-                                         size_t len);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-
-/* ifndef GNUNET_ABE_LIB_H */
-#endif
-/* end of gnunet_abe_lib.h */
diff --git a/src/include/gnunet_applications.h b/src/include/gnunet_applications.h
index 1e2ac59f7..489dc7050 100644
--- a/src/include/gnunet_applications.h
+++ b/src/include/gnunet_applications.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -133,4 +136,6 @@ extern "C"
 
 /** @} */  /* end of group */
 
+/** @} */  /* end of group addition to Backbone */
+
 /* end of gnunet_applications.h */
diff --git a/src/include/gnunet_arm_service.h b/src/include/gnunet_arm_service.h
index 9615f8c9d..ef860bff4 100644
--- a/src/include/gnunet_arm_service.h
+++ b/src/include/gnunet_arm_service.h
@@ -43,6 +43,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -243,8 +244,9 @@ struct GNUNET_ARM_Operation;
  *                  #GNUNET_SYSERR if there was an error.
  */
 typedef void
-(*GNUNET_ARM_ConnectionStatusCallback) (void *cls,
-                                        int connected);
+(*GNUNET_ARM_ConnectionStatusCallback) (
+  void *cls,
+  enum GNUNET_GenericReturnValue connected);
 
 
 /**
@@ -258,9 +260,10 @@ typedef void
  * @param result result of the operation
  */
 typedef void
-(*GNUNET_ARM_ResultCallback) (void *cls,
-                              enum GNUNET_ARM_RequestStatus rs,
-                              enum GNUNET_ARM_Result result);
+(*GNUNET_ARM_ResultCallback) (
+  void *cls,
+  enum GNUNET_ARM_RequestStatus rs,
+  enum GNUNET_ARM_Result result);
 
 
 /**
@@ -275,10 +278,11 @@ typedef void
  * @param list list of services managed by arm
  */
 typedef void
-(*GNUNET_ARM_ServiceListCallback) (void *cls,
-                                   enum GNUNET_ARM_RequestStatus rs,
-                                   unsigned int count,
-                                   const struct GNUNET_ARM_ServiceInfo *list);
+(*GNUNET_ARM_ServiceListCallback) (
+  void *cls,
+  enum GNUNET_ARM_RequestStatus rs,
+  unsigned int count,
+  const struct GNUNET_ARM_ServiceInfo *list);
 
 
 /**
@@ -293,18 +297,20 @@ typedef void
  * @return context to use for further ARM operations, NULL on error.
  */
 struct GNUNET_ARM_Handle *
-GNUNET_ARM_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                    GNUNET_ARM_ConnectionStatusCallback conn_status,
-                    void *conn_status_cls);
+GNUNET_ARM_connect (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  GNUNET_ARM_ConnectionStatusCallback conn_status,
+  void *conn_status_cls);
 
 
 /**
  * Disconnect from the ARM service and destroy the handle.
  *
- * @param h the handle that was being used
+ * @param[in] h the handle that was being used
  */
 void
-GNUNET_ARM_disconnect (struct GNUNET_ARM_Handle *h);
+GNUNET_ARM_disconnect (
+  struct GNUNET_ARM_Handle *h);
 
 
 /**
@@ -314,7 +320,8 @@ GNUNET_ARM_disconnect (struct GNUNET_ARM_Handle *h);
  * @param op operation to cancel
  */
 void
-GNUNET_ARM_operation_cancel (struct GNUNET_ARM_Operation *op);
+GNUNET_ARM_operation_cancel (
+  struct GNUNET_ARM_Operation *op);
 
 
 /**
@@ -326,9 +333,10 @@ GNUNET_ARM_operation_cancel (struct GNUNET_ARM_Operation *op);
  * @return handle for the operation, NULL on error
  */
 struct GNUNET_ARM_Operation *
-GNUNET_ARM_request_service_list (struct GNUNET_ARM_Handle *h,
-                                 GNUNET_ARM_ServiceListCallback cont,
-                                 void *cont_cls);
+GNUNET_ARM_request_service_list (
+  struct GNUNET_ARM_Handle *h,
+  GNUNET_ARM_ServiceListCallback cont,
+  void *cont_cls);
 
 
 /**
@@ -346,10 +354,11 @@ GNUNET_ARM_request_service_list (struct GNUNET_ARM_Handle *h,
  * @return handle for the operation, NULL on error
  */
 struct GNUNET_ARM_Operation *
-GNUNET_ARM_request_service_stop (struct GNUNET_ARM_Handle *h,
-                                 const char *service_name,
-                                 GNUNET_ARM_ResultCallback cont,
-                                 void *cont_cls);
+GNUNET_ARM_request_service_stop (
+  struct GNUNET_ARM_Handle *h,
+  const char *service_name,
+  GNUNET_ARM_ResultCallback cont,
+  void *cont_cls);
 
 
 /**
@@ -363,12 +372,12 @@ GNUNET_ARM_request_service_stop (struct GNUNET_ARM_Handle *h,
  * @return handle for the operation, NULL on error
  */
 struct GNUNET_ARM_Operation *
-GNUNET_ARM_request_service_start (struct GNUNET_ARM_Handle *h,
-                                  const char *service_name,
-                                  enum GNUNET_OS_InheritStdioFlags
-                                  std_inheritance,
-                                  GNUNET_ARM_ResultCallback cont,
-                                  void *cont_cls);
+GNUNET_ARM_request_service_start (
+  struct GNUNET_ARM_Handle *h,
+  const char *service_name,
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  GNUNET_ARM_ResultCallback cont,
+  void *cont_cls);
 
 
 /**
@@ -385,10 +394,10 @@ struct GNUNET_ARM_MonitorHandle;
  * @param status status of the service
  */
 typedef void
-(*GNUNET_ARM_ServiceMonitorCallback) (void *cls,
-                                      const char *service,
-                                      enum GNUNET_ARM_ServiceMonitorStatus
-                                      status);
+(*GNUNET_ARM_ServiceMonitorCallback) (
+  void *cls,
+  const char *service,
+  enum GNUNET_ARM_ServiceMonitorStatus status);
 
 
 /**
@@ -403,9 +412,10 @@ typedef void
  * @return context to use for further ARM monitor operations, NULL on error.
  */
 struct GNUNET_ARM_MonitorHandle *
-GNUNET_ARM_monitor_start (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                          GNUNET_ARM_ServiceMonitorCallback cont,
-                          void *cont_cls);
+GNUNET_ARM_monitor_start (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  GNUNET_ARM_ServiceMonitorCallback cont,
+  void *cont_cls);
 
 
 /**
@@ -414,7 +424,8 @@ GNUNET_ARM_monitor_start (const struct GNUNET_CONFIGURATION_Handle *cfg,
  * @param h the handle that was being used
  */
 void
-GNUNET_ARM_monitor_stop (struct GNUNET_ARM_MonitorHandle *h);
+GNUNET_ARM_monitor_stop (
+  struct GNUNET_ARM_MonitorHandle *h);
 
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/include/gnunet_ats_application_service.h b/src/include/gnunet_ats_application_service.h
deleted file mode 100644
index a48dba825..000000000
--- a/src/include/gnunet_ats_application_service.h
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
-   This file is part of GNUnet.
-   Copyright (C) 2010-2015, 2018 GNUnet e.V.
-
-   GNUnet is free software: you can redistribute it and/or modify it
-   under the terms of the GNU Affero General Public License as published
-   by the Free Software Foundation, either version 3 of the License,
-   or (at your option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Affero General Public License for more details.
-
-   You should have received a copy of the GNU Affero General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file
- * Bandwidth allocation API for applications to interact with
- *
- * @author Christian Grothoff
- * @author Matthias Wachs
- *
- * @defgroup ats  ATS service
- * Bandwidth allocation
- *
- * @see [Documentation](https://gnunet.org/ats-subsystem)
- *
- * @{
- */
-#ifndef GNUNET_ATS_APPLICATION_SERVICE_H
-#define GNUNET_ATS_APPLICATION_SERVICE_H
-
-#include "gnunet_constants.h"
-#include "gnunet_util_lib.h"
-
-/**
- * Handle to the ATS subsystem for making suggestions about
- * connections the peer would like to have.
- */
-struct GNUNET_ATS_ApplicationHandle;
-
-
-/**
- * Initialize the ATS application client handle.
- *
- * @param cfg configuration to use
- * @return ats application handle, NULL on error
- */
-struct GNUNET_ATS_ApplicationHandle *
-GNUNET_ATS_application_init (const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Shutdown ATS application client.
- *
- * @param ch handle to destroy
- */
-void
-GNUNET_ATS_application_done (struct GNUNET_ATS_ApplicationHandle *ch);
-
-
-/**
- * Handle for suggestion requests.
- */
-struct GNUNET_ATS_ApplicationSuggestHandle;
-
-
-/**
- * An application would like to communicate with a peer.  ATS should
- * allocate bandwidth using a suitable address for requiremetns @a pk
- * to transport.
- *
- * @param ch handle
- * @param peer identity of the peer we need an address for
- * @param pk what kind of application will the application require (can be
- *         #GNUNET_MQ_PREFERENCE_NONE, we will still try to connect)
- * @param bw desired bandwidth, can be zero (we will still try to connect)
- * @return suggestion handle, NULL if request is already pending
- */
-struct GNUNET_ATS_ApplicationSuggestHandle *
-GNUNET_ATS_application_suggest (struct GNUNET_ATS_ApplicationHandle *ch,
-                                const struct GNUNET_PeerIdentity *peer,
-                                enum GNUNET_MQ_PreferenceKind pk,
-                                struct GNUNET_BANDWIDTH_Value32NBO bw);
-
-
-/**
- * We no longer care about communicating with a peer.
- *
- * @param sh handle
- */
-void
-GNUNET_ATS_application_suggest_cancel (struct
-                                       GNUNET_ATS_ApplicationSuggestHandle *sh);
-
-/** @} */  /* end of group */
-
-#endif
-/* end of file gnunet_ats_application_service.h */
diff --git a/src/include/gnunet_ats_plugin.h b/src/include/gnunet_ats_plugin.h
deleted file mode 100644
index c0662673c..000000000
--- a/src/include/gnunet_ats_plugin.h
+++ /dev/null
@@ -1,486 +0,0 @@
-/*
-   This file is part of GNUnet
-   Copyright (C) 2009-2015 GNUnet e.V.
-
-   GNUnet is free software: you can redistribute it and/or modify it
-   under the terms of the GNU Affero General Public License as published
-   by the Free Software Foundation, either version 3 of the License,
-   or (at your option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Affero General Public License for more details.
-
-   You should have received a copy of the GNU Affero General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * API for the ATS solvers.
- *
- * @defgroup ats-plugin  ATS service plugin API
- * Plugin API for the ATS service.
- *
- * Specifies the struct that is given to the plugin's entry method and the other
- * struct that must be returned.  Note that the destructors of ATS plugins will
- * be given the value returned by the constructor and is expected to return a
- * NULL pointer.
- *
- * @{
- */
-#ifndef PLUGIN_ATS_H
-#define PLUGIN_ATS_H
-
-#include "gnunet_ats_service.h"
-#include "gnunet_statistics_service.h"
-
-/**
- * Representation of an address the plugin can choose from.
- */
-struct ATS_Address;
-
-/**
- * Change the preference for a peer
- *
- * @param handle the solver handle
- * @param client the client sending this request
- * @param peer the peer id
- * @param kind the preference kind to change
- * @param score the new preference score
- * @param pref_rel the normalized preference value for this kind over all clients
- */
-typedef void
-(*GAS_solver_address_change_preference) (void *solver,
-                                         const struct GNUNET_PeerIdentity *peer,
-                                         enum GNUNET_ATS_PreferenceKind kind,
-                                         double pref_rel);
-
-
-/**
- * Give feedback about the current assignment
- *
- * @param handle the solver handle
- * @param application the application sending this request
- * @param peer the peer id
- * @param scope the time interval for this feedback: [now - scope .. now]
- * @param kind the preference kind for this feedback
- * @param score the feedback score
- */
-typedef void
-(*GAS_solver_address_feedback_preference) (void *solver,
-                                           struct GNUNET_SERVICE_Client *
-                                           application,
-                                           const struct
-                                           GNUNET_PeerIdentity *peer,
-                                           const struct GNUNET_TIME_Relative
-                                           scope,
-                                           enum GNUNET_ATS_PreferenceKind kind,
-                                           double score);
-
-/**
- * Notify the solver about a bulk operation changing possibly a lot of values
- * Solver will not resolve until all bulk operations are marked as done
- *
- * @param solver the solver
- */
-typedef void
-(*GAS_solver_bulk_start) (void *solver);
-
-
-/**
- * Mark a bulk operation as done
- * Solver will resolve if values have changed
- *
- * @param solver the solver
- */
-typedef void
-(*GAS_solver_bulk_stop) (void *solver);
-
-
-/**
- * Add a single address within a network to the solver
- *
- * @param solver the solver Handle
- * @param address the address to add
- * @param network network type of this address
- */
-typedef void
-(*GAS_solver_address_add) (void *solver,
-                           struct ATS_Address *address,
-                           uint32_t network);
-
-
-/**
- * Delete an address or just the session from the solver
- *
- * @param solver the solver Handle
- * @param address the address to delete
- */
-typedef void
-(*GAS_solver_address_delete) (void *solver,
-                              struct ATS_Address *address);
-
-
-/**
- * Transport properties for this address have changed
- *
- * @param solver solver handle
- * @param address the address
- */
-typedef void
-(*GAS_solver_address_property_changed) (void *solver,
-                                        struct ATS_Address *address);
-
-
-/**
- * Get the preferred address for a peer from solver
- *
- * @param solver the solver to use
- * @param peer the peer
- */
-typedef void
-(*GAS_solver_get_preferred_address) (void *solver,
-                                     const struct GNUNET_PeerIdentity *peer);
-
-
-/**
- * Stop getting the preferred address for a peer from solver
- *
- * @param solver the solver to use
- * @param peer the peer
- */
-typedef void
-(*GAS_solver_stop_get_preferred_address) (void *solver,
-                                          const struct
-                                          GNUNET_PeerIdentity *peer);
-
-
-/**
- * Solver functions.
- *
- * Each solver is required to set up and return an instance
- * of this struct during initialization.
- */
-struct GNUNET_ATS_SolverFunctions
-{
-  /**
-   * Closure to pass to all solver functions in this struct.
-   */
-  void *cls;
-
-  /**
-   * Add a new address for a peer to the solver
-   *
-   * The address is already contained in the addresses hashmap!
-   */
-  GAS_solver_address_add s_add;
-
-  /**
-   * Update the properties of an address in the solver
-   */
-  GAS_solver_address_property_changed s_address_update_property;
-
-  /**
-   * Tell solver to notify ATS if the address to use changes for a specific
-   * peer using the bandwidth changed callback
-   *
-   * The solver must only notify about changes for peers with pending address
-   * requests!
-   */
-  GAS_solver_get_preferred_address s_get;
-
-  /**
-   * Tell solver stop notifying ATS about changes for this peers
-   *
-   * The solver must only notify about changes for peers with pending address
-   * requests!
-   */
-  GAS_solver_stop_get_preferred_address s_get_stop;
-
-  /**
-   * Delete an address in the solver
-   *
-   * The address is not contained in the address hashmap anymore!
-   */
-  GAS_solver_address_delete s_del;
-
-  /**
-   * Change relative preference for quality in solver
-   */
-  GAS_solver_address_change_preference s_pref;
-
-  /**
-   * Give feedback about the current assignment
-   */
-  GAS_solver_address_feedback_preference s_feedback;
-
-  /**
-   * Start a bulk operation
-   *
-   * Used if many values have to be updated at the same time.
-   * When a bulk operation is pending the solver does not have to resolve
-   * the problem since more updates will follow anyway
-   *
-   * For each call to bulk_start, a call to bulk_stop is required!
-   */
-  GAS_solver_bulk_start s_bulk_start;
-
-  /**
-   * Bulk operation done
-   *
-   * If no more bulk operations are pending, the solver can solve the problem
-   * with the updated values
-   */
-  GAS_solver_bulk_stop s_bulk_stop;
-};
-
-
-/**
- * Operation codes for solver information callback
- *
- * Order of calls is expected to be:
- * #GAS_OP_SOLVE_START
- * #GAS_OP_SOLVE_STOP
- * #GAS_OP_SOLVE_UPDATE_NOTIFICATION_START
- * #GAS_OP_SOLVE_UPDATE_NOTIFICATION_STOP
- *
- */
-enum GAS_Solver_Operation
-{
-  /**
-   * A solution iteration has been started
-   */
-  GAS_OP_SOLVE_START,
-
-  /**
-   * A solution iteration has been finished
-   */
-  GAS_OP_SOLVE_STOP,
-
-  /**
-   * The setup of the problem as a preparation to solve it was started
-   */
-  GAS_OP_SOLVE_SETUP_START,
-
-  /**
-   * The setup of the problem as a preparation to solve is finished
-   */
-  GAS_OP_SOLVE_SETUP_STOP,
-
-  /**
-   * Solving of the LP problem was started
-   * MLP solver only
-   */
-  GAS_OP_SOLVE_MLP_LP_START,
-
-  /**
-   * Solving of the LP problem is done
-   * MLP solver only
-   */
-  GAS_OP_SOLVE_MLP_LP_STOP,
-
-  /**
-   * Solving of the MLP problem was started
-   * MLP solver only
-   */
-  GAS_OP_SOLVE_MLP_MLP_START,
-
-  /**
-   * Solving of the MLP problem is done
-   * MLP solver only
-   */
-  GAS_OP_SOLVE_MLP_MLP_STOP,
-
-  /**
-   * After the problem was finished, start notifications about changes
-   * to addresses
-   */
-  GAS_OP_SOLVE_UPDATE_NOTIFICATION_START,
-
-  /**
-   * After the problem was finished, notifications about changes to addresses
-   * are done
-   */
-  GAS_OP_SOLVE_UPDATE_NOTIFICATION_STOP
-};
-
-
-/**
- * Status of a GAS_Solver_Operation operation
- */
-enum GAS_Solver_Status
-{
-  /**
-   * Success
-   */
-  GAS_STAT_SUCCESS,
-
-  /**
-   * Failure
-   */
-  GAS_STAT_FAIL
-};
-
-
-/**
- * Status of the operation
- */
-enum GAS_Solver_Additional_Information
-{
-  /**
-   * No more specific information
-   */
-  GAS_INFO_NONE,
-
-  /**
-   * A full solution process is performed
-   * Quite specific to the MLP solver
-   */
-  GAS_INFO_FULL,
-
-  /**
-   * An existing solution was reused
-   * Quite specific to the MLP solver
-   */
-  GAS_INFO_UPDATED,
-
-  /**
-   * The proportional solver had to recalculate for a single network
-   */
-  GAS_INFO_PROP_SINGLE,
-
-  /**
-   * The proportional solver had to recalculate for all networks
-   */
-  GAS_INFO_PROP_ALL
-};
-
-
-/**
- * Callback to call with additional information
- * Used for measurement
- *
- * @param cls the closure
- * @param op the operation
- */
-typedef void
-(*GAS_solver_information_callback) (void *cls,
-                                    enum GAS_Solver_Operation op,
-                                    enum GAS_Solver_Status stat,
-                                    enum GAS_Solver_Additional_Information);
-
-
-/**
- * Callback to call from solver when bandwidth for address has changed
- *
- * @param address the with changed bandwidth assigned
- */
-typedef void
-(*GAS_bandwidth_changed_cb) (void *cls,
-                             struct ATS_Address *address);
-
-
-/**
- * Callback to call from solver to obtain application preference
- * values for a peer.
- *
- * @param cls the cls
- * @param id the peer id
- * @return carry of double values containing the preferences with
- *      GNUNET_ATS_PreferenceCount elements
- */
-typedef const double *
-(*GAS_get_preferences) (void *cls,
-                        const struct GNUNET_PeerIdentity *id);
-
-
-/**
- * Callback to call from solver to obtain application connectivity
- * preferences for a peer.
- *
- * @param cls the cls
- * @param id the peer id
- * @return 0 if connectivity is not desired, non-null if address
- *      suggestions are requested
- */
-typedef unsigned int
-(*GAS_get_connectivity) (void *cls,
-                         const struct GNUNET_PeerIdentity *id);
-
-
-/**
- * The ATS plugin will pass a pointer to a struct
- * of this type as to the initialization function
- * of the ATS plugins.
- */
-struct GNUNET_ATS_PluginEnvironment
-{
-  /**
-   * Configuration handle to be used by the solver
-   */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-  /**
-   * Statistics handle to be used by the solver
-   */
-  struct GNUNET_STATISTICS_Handle *stats;
-
-  /**
-   * Closure to pass to all callbacks in this struct.
-   */
-  void *cls;
-
-  /**
-   * Hashmap containing all addresses available
-   */
-  struct GNUNET_CONTAINER_MultiPeerMap *addresses;
-
-  /**
-   * ATS addresses callback to be notified about bandwidth assignment changes
-   */
-  GAS_bandwidth_changed_cb bandwidth_changed_cb;
-
-  /**
-   * ATS addresses function to obtain preference values
-   */
-  GAS_get_preferences get_preferences;
-
-  /**
-   * ATS addresses function to obtain preference values
-   */
-  GAS_get_connectivity get_connectivity;
-
-  /**
-   * Callback for solver to call with status information,
-   * can be NULL
-   */
-  GAS_solver_information_callback info_cb;
-
-  /**
-   * Number of networks available, size of the @e out_quota
-   * and @e in_quota arrays.
-   */
-  unsigned int network_count;
-
-  /**
-   * Array of configured outbound quotas
-   * Order according to networks in network array
-   */
-  unsigned long long out_quota[GNUNET_NT_COUNT];
-
-  /**
-   * Array of configured inbound quotas
-   * Order according to networks in network array
-   */
-  unsigned long long in_quota[GNUNET_NT_COUNT];
-};
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_ats_service.h b/src/include/gnunet_ats_service.h
deleted file mode 100644
index 68ba8e6b2..000000000
--- a/src/include/gnunet_ats_service.h
+++ /dev/null
@@ -1,624 +0,0 @@
-/*
-   This file is part of GNUnet.
-   Copyright (C) 2010-2015 GNUnet e.V.
-
-   GNUnet is free software: you can redistribute it and/or modify it
-   under the terms of the GNU Affero General Public License as published
-   by the Free Software Foundation, either version 3 of the License,
-   or (at your option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Affero General Public License for more details.
-
-   You should have received a copy of the GNU Affero General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file
- * Automatic transport selection and outbound bandwidth determination
- *
- * @author Christian Grothoff
- * @author Matthias Wachs
- *
- * @defgroup ats  ATS service
- * Automatic Transport Selection and outbound bandwidth determination
- *
- * @see [Documentation](https://gnunet.org/ats-subsystem)
- *
- * @{
- */
-#ifndef GNUNET_ATS_SERVICE_H
-#define GNUNET_ATS_SERVICE_H
-
-#include "gnunet_constants.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_hello_lib.h"
-
-
-/**
- * Default bandwidth assigned to a network : 64 KB/s
- */
-#define GNUNET_ATS_DefaultBandwidth 65536
-
-/**
- * Undefined value for an `enum GNUNET_ATS_Property`
- */
-#define GNUNET_ATS_VALUE_UNDEFINED UINT32_MAX
-
-/**
- * String representation for GNUNET_ATS_VALUE_UNDEFINED
- */
-#define GNUNET_ATS_VALUE_UNDEFINED_STR "undefined"
-
-/**
- * Maximum bandwidth assigned to a network : 4095 MB/s
- */
-#define GNUNET_ATS_MaxBandwidth UINT32_MAX
-
-/**
- * Textual equivalent for GNUNET_ATS_MaxBandwidth
- */
-#define GNUNET_ATS_MaxBandwidthString "unlimited"
-
-
-/**
- * ATS performance characteristics for an address.
- */
-struct GNUNET_ATS_Properties
-{
-  /**
-   * Delay.  Time between when the time packet is sent and the packet
-   * arrives.  FOREVER if we did not measure yet.
-   */
-  struct GNUNET_TIME_Relative delay;
-
-  /**
-   * Actual traffic on this connection from this peer to the other peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_out;
-
-  /**
-   * Actual traffic on this connection from the other peer to this peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_in;
-
-  /**
-   * Distance on network layer (required for distance-vector routing)
-   * in hops.  Zero for direct connections (e.g. plain TCP/UDP).
-   */
-  unsigned int distance;
-
-  /**
-   * Which network scope does the respective address belong to?
-   * This property does not change.
-   */
-  enum GNUNET_NetworkType scope;
-};
-
-
-/**
- * ATS performance characteristics for an address in
- * network byte order (for IPC).
- */
-struct GNUNET_ATS_PropertiesNBO
-{
-  /**
-   * Actual traffic on this connection from this peer to the other peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_out GNUNET_PACKED;
-
-  /**
-   * Actual traffic on this connection from the other peer to this peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_in GNUNET_PACKED;
-
-  /**
-   * Which network scope does the respective address belong to?
-   * This property does not change.
-   */
-  uint32_t scope GNUNET_PACKED;
-
-  /**
-   * Distance on network layer (required for distance-vector routing)
-   * in hops.  Zero for direct connections (e.g. plain TCP/UDP).
-   */
-  uint32_t distance GNUNET_PACKED;
-
-  /**
-   * Delay.  Time between when the time packet is sent and the packet
-   * arrives.  FOREVER if we did not measure yet.
-   */
-  struct GNUNET_TIME_RelativeNBO delay;
-};
-
-
-/* ********************* LAN Characterization library ************************ */
-/* Note: these functions do not really communicate with the ATS service */
-
-
-/**
- * Convert ATS properties from host to network byte order.
- *
- * @param nbo[OUT] value written
- * @param hbo value read
- */
-void
-GNUNET_ATS_properties_hton (struct GNUNET_ATS_PropertiesNBO *nbo,
-                            const struct GNUNET_ATS_Properties *hbo);
-
-
-/**
- * Convert ATS properties from network to host byte order.
- *
- * @param hbo[OUT] value written
- * @param nbo value read
- */
-void
-GNUNET_ATS_properties_ntoh (struct GNUNET_ATS_Properties *hbo,
-                            const struct GNUNET_ATS_PropertiesNBO *nbo);
-
-
-/* ********************Connection Suggestion API ***************************** */
-
-/**
- * Handle to the ATS subsystem for making suggestions about
- * connections the peer would like to have.
- */
-struct GNUNET_ATS_ConnectivityHandle;
-
-/**
- * Handle for address suggestion requests.
- */
-struct GNUNET_ATS_ConnectivitySuggestHandle;
-
-
-/**
- * Initialize the ATS connectivity suggestion client handle.
- *
- * @param cfg configuration to use
- * @return ats connectivity handle, NULL on error
- */
-struct GNUNET_ATS_ConnectivityHandle *
-GNUNET_ATS_connectivity_init (const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Shutdown ATS connectivity suggestion client.
- *
- * @param ch handle to destroy
- */
-void
-GNUNET_ATS_connectivity_done (struct GNUNET_ATS_ConnectivityHandle *ch);
-
-
-/**
- * We would like to establish a new connection with a peer.  ATS
- * should suggest a good address to begin with.
- *
- * @param ch handle
- * @param peer identity of the peer we need an address for
- * @param strength how urgent is the need for such a suggestion
- * @return suggestion handle, NULL if request is already pending
- */
-struct GNUNET_ATS_ConnectivitySuggestHandle *
-GNUNET_ATS_connectivity_suggest (struct GNUNET_ATS_ConnectivityHandle *ch,
-                                 const struct GNUNET_PeerIdentity *peer,
-                                 uint32_t strength);
-
-
-/**
- * We no longer care about being connected to a peer.
- *
- * @param sh handle
- */
-void
-GNUNET_ATS_connectivity_suggest_cancel (struct
-                                        GNUNET_ATS_ConnectivitySuggestHandle *sh);
-
-
-/* ******************************** Scheduling API ***************************** */
-
-/**
- * Handle to the ATS subsystem for bandwidth/transport scheduling information.
- */
-struct GNUNET_ATS_SchedulingHandle;
-
-/**
- * Opaque session handle, defined by plugins.  Contents not known to ATS.
- */
-struct GNUNET_ATS_Session;
-
-
-/**
- * Signature of a function called by ATS with the current bandwidth
- * and address preferences as determined by ATS.  If our connection
- * to ATS dies and thus all suggestions become invalid, this function
- * is called ONCE with all arguments (except @a cls) being NULL/0.
- *
- * @param cls closure
- * @param peer for which we suggest an address, NULL if ATS connection died
- * @param address suggested address (including peer identity of the peer),
- *             may be NULL to signal disconnect from peer
- * @param session session to use, NULL to establish a new outgoing session
- * @param bandwidth_out assigned outbound bandwidth for the connection,
- *        0 to signal disconnect
- * @param bandwidth_in assigned inbound bandwidth for the connection,
- *        0 to signal disconnect
- */
-typedef void
-(*GNUNET_ATS_AddressSuggestionCallback) (void *cls,
-                                         const struct GNUNET_PeerIdentity *peer,
-                                         const struct
-                                         GNUNET_HELLO_Address *address,
-                                         struct GNUNET_ATS_Session *session,
-                                         struct GNUNET_BANDWIDTH_Value32NBO
-                                         bandwidth_out,
-                                         struct GNUNET_BANDWIDTH_Value32NBO
-                                         bandwidth_in);
-
-
-/**
- * Initialize the ATS scheduling subsystem.
- *
- * @param cfg configuration to use
- * @param suggest_cb notification to call whenever the suggestation changed
- * @param suggest_cb_cls closure for @a suggest_cb
- * @return ats context
- */
-struct GNUNET_ATS_SchedulingHandle *
-GNUNET_ATS_scheduling_init (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            GNUNET_ATS_AddressSuggestionCallback suggest_cb,
-                            void *suggest_cb_cls);
-
-
-/**
- * Client is done with ATS scheduling, release resources.
- *
- * @param sh handle to release
- */
-void
-GNUNET_ATS_scheduling_done (struct GNUNET_ATS_SchedulingHandle *sh);
-
-
-/**
- * Handle used within ATS to track an address.
- */
-struct GNUNET_ATS_AddressRecord;
-
-
-/**
- * We have a new address ATS should know. Addresses have to be added with this
- * function before they can be: updated, set in use and destroyed
- *
- * @param sh handle
- * @param address the address
- * @param session session handle (if available, e.g for incoming connections)
- * @param prop performance data for the address
- * @return handle to the address representation inside ATS, NULL
- *         on error (i.e. ATS knows this exact address already, or
- *         address is invalid)
- */
-struct GNUNET_ATS_AddressRecord *
-GNUNET_ATS_address_add (struct GNUNET_ATS_SchedulingHandle *sh,
-                        const struct GNUNET_HELLO_Address *address,
-                        struct GNUNET_ATS_Session *session,
-                        const struct GNUNET_ATS_Properties *prop);
-
-
-/**
- * An address was used to initiate a session.
- *
- * @param ar address record to update information for
- * @param session session handle
- */
-void
-GNUNET_ATS_address_add_session (struct GNUNET_ATS_AddressRecord *ar,
-                                struct GNUNET_ATS_Session *session);
-
-
-/**
- * A @a session was destroyed, disassociate it from the given address
- * record.  If this was an incoming address, destroys the address as
- * well.
- *
- * @param ar address record to update information for
- * @param session session handle
- * @return #GNUNET_YES if the @a ar was destroyed because
- *                     it was an incoming address,
- *         #GNUNET_NO if the @ar was kept because we can
- *                    use it still to establish a new session
- */
-int
-GNUNET_ATS_address_del_session (struct GNUNET_ATS_AddressRecord *ar,
-                                struct GNUNET_ATS_Session *session);
-
-
-/**
- * We have updated performance statistics for a given address.  Note
- * that this function can be called for addresses that are currently
- * in use as well as addresses that are valid but not actively in use.
- * Furthermore, the peer may not even be connected to us right now (@a
- * session value of NULL used to signal disconnect, or somehow we
- * otherwise got updated on @a ats information).  Based on the
- * information provided, ATS may update bandwidth assignments and
- * suggest to switch addresses.
- *
- * @param ar address record to update information for
- * @param prop performance data for the address
- */
-void
-GNUNET_ATS_address_update (struct GNUNET_ATS_AddressRecord *ar,
-                           const struct GNUNET_ATS_Properties *prop);
-
-
-/**
- * An address got destroyed, stop using it as a valid address.
- *
- * @param ar address record to destroy, it's validation has
- *           expired and ATS may no longer use it
- */
-void
-GNUNET_ATS_address_destroy (struct GNUNET_ATS_AddressRecord *ar);
-
-
-/* ******************************** Performance API ***************************** */
-
-/**
- * ATS Handle to obtain and/or modify performance information.
- */
-struct GNUNET_ATS_PerformanceHandle;
-
-/**
- * Signature of a function that is called with QoS information about an address.
- *
- * @param cls closure
- * @param address the address, NULL if ATS service was disconnected or
- *        when the iteration is completed in the case of
- *        #GNUNET_ATS_performance_list_addresses()
- * @param address_active #GNUNET_YES if this address is actively used
- *        to maintain a connection to a peer;
- *        #GNUNET_NO if the address is not actively used;
- *        #GNUNET_SYSERR if this address is no longer available for ATS
- * @param bandwidth_out assigned outbound bandwidth for the connection
- * @param bandwidth_in assigned inbound bandwidth for the connection
- * @param prop performance data for the address
- */
-typedef void
-(*GNUNET_ATS_AddressInformationCallback) (void *cls,
-                                          const struct
-                                          GNUNET_HELLO_Address *address,
-                                          int address_active,
-                                          struct GNUNET_BANDWIDTH_Value32NBO
-                                          bandwidth_out,
-                                          struct GNUNET_BANDWIDTH_Value32NBO
-                                          bandwidth_in,
-                                          const struct
-                                          GNUNET_ATS_Properties *prop);
-
-
-/**
- * Handle for an address listing operation
- */
-struct GNUNET_ATS_AddressListHandle;
-
-
-/**
- * Get handle to access performance API of the ATS subsystem.
- *
- * @param cfg configuration to use
- * @param addr_info_cb callback called when performance characteristics for
- *      an address change
- * @param addr_info_cb_cls closure for @a addr_info_cb
- * @return ats performance context
- */
-struct GNUNET_ATS_PerformanceHandle *
-GNUNET_ATS_performance_init (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                             GNUNET_ATS_AddressInformationCallback addr_info_cb,
-                             void *addr_info_cb_cls);
-
-
-/**
- * Get information about addresses known to the ATS subsystem.
- *
- * @param ph the performance handle to use
- * @param peer peer idm can be NULL for all peers
- * @param all #GNUNET_YES to get information about all addresses or #GNUNET_NO to
- *        get only address currently used
- * @param infocb callback to call with the addresses,
- *        will callback with address == NULL when done
- * @param infocb_cls closure for @a infocb
- * @return handle to abort the operation
- */
-struct GNUNET_ATS_AddressListHandle *
-GNUNET_ATS_performance_list_addresses (struct GNUNET_ATS_PerformanceHandle *ph,
-                                       const struct GNUNET_PeerIdentity *peer,
-                                       int all,
-                                       GNUNET_ATS_AddressInformationCallback
-                                       infocb,
-                                       void *infocb_cls);
-
-
-/**
- * Cancel a pending address listing operation
- *
- * @param alh the `struct GNUNET_ATS_AddressListHandle` handle to cancel
- */
-void
-GNUNET_ATS_performance_list_addresses_cancel (struct
-                                              GNUNET_ATS_AddressListHandle *alh);
-
-
-/**
- * Client is done using the ATS performance subsystem, release resources.
- *
- * @param ph handle
- */
-void
-GNUNET_ATS_performance_done (struct GNUNET_ATS_PerformanceHandle *ph);
-
-
-/**
- * Function called with reservation result.
- *
- * @param cls closure
- * @param peer identifies the peer
- * @param amount set to the amount that was actually reserved or unreserved;
- *               either the full requested amount or zero (no partial reservations)
- * @param res_delay if the reservation could not be satisfied (amount was 0), how
- *        long should the client wait until re-trying?
- */
-typedef void
-(*GNUNET_ATS_ReservationCallback) (void *cls,
-                                   const struct GNUNET_PeerIdentity *peer,
-                                   int32_t amount,
-                                   struct GNUNET_TIME_Relative res_delay);
-
-
-/**
- * Context that can be used to cancel a peer information request.
- */
-struct GNUNET_ATS_ReservationContext;
-
-
-/**
- * Reserve inbound bandwidth from the given peer.  ATS will look at
- * the current amount of traffic we receive from the peer and ensure
- * that the peer could add 'amount' of data to its stream.
- *
- * @param ph performance handle
- * @param peer identifies the peer
- * @param amount reserve N bytes for receiving, negative
- *                amounts can be used to undo a (recent) reservation;
- * @param rcb function to call with the resulting reservation information
- * @param rcb_cls closure for @a rcb
- * @return NULL on error
- * @deprecated will be replaced soon
- */
-struct GNUNET_ATS_ReservationContext *
-GNUNET_ATS_reserve_bandwidth (struct GNUNET_ATS_PerformanceHandle *ph,
-                              const struct GNUNET_PeerIdentity *peer,
-                              int32_t amount,
-                              GNUNET_ATS_ReservationCallback rcb,
-                              void *rcb_cls);
-
-
-/**
- * Cancel request for reserving bandwidth.
- *
- * @param rc context returned by the original GNUNET_ATS_reserve_bandwidth call
- */
-void
-GNUNET_ATS_reserve_bandwidth_cancel (struct GNUNET_ATS_ReservationContext *rc);
-
-
-/**
- * ATS preference types as array initializer
- */
-#define GNUNET_ATS_PreferenceType { GNUNET_ATS_PREFERENCE_BANDWIDTH, \
-                                    GNUNET_ATS_PREFERENCE_LATENCY, \
-                                    GNUNET_ATS_PREFERENCE_END }
-
-/**
- * ATS preference types as string array initializer
- */
-#define GNUNET_ATS_PreferenceTypeString { "BANDWIDTH", "LATENCY", "END" }
-
-/**
- * Enum defining all known preference categories.
- */
-enum GNUNET_ATS_PreferenceKind
-{
-  /**
-   * Change the peer's bandwidth value (value per byte of bandwidth in
-   * the goal function) to the given amount.  The argument is followed
-   * by a double value giving the desired value (can be negative).
-   * Preference changes are forgotten if peers disconnect.
-   */
-  GNUNET_ATS_PREFERENCE_BANDWIDTH = 0,
-
-  /**
-   * Change the peer's latency value to the given amount.  The
-   * argument is followed by a double value giving the desired value
-   * (can be negative).  The absolute score in the goal function is
-   * the inverse of the latency in microseconds (minimum: 1
-   * microsecond) multiplied by the latency preferences.
-   */
-  GNUNET_ATS_PREFERENCE_LATENCY = 1,
-
-  /**
-   * End of preference list.
-   */
-  GNUNET_ATS_PREFERENCE_END = 2
-};
-
-
-/**
- * Convert a GNUNET_ATS_PreferenceType to a string
- *
- * @param type the preference type
- * @return a string or NULL if invalid
- */
-const char *
-GNUNET_ATS_print_preference_type (enum GNUNET_ATS_PreferenceKind type);
-
-
-/**
- * Change preferences for the given peer. Preference changes are forgotten if peers
- * disconnect.
- *
- * @param ph performance handle @param peer identifies the peer
- * @param ... #GNUNET_ATS_PREFERENCE_END-terminated specification of the
- * desired changes
- */
-void
-GNUNET_ATS_performance_change_preference (struct
-                                          GNUNET_ATS_PerformanceHandle *ph,
-                                          const struct
-                                          GNUNET_PeerIdentity *peer,
-                                          ...);
-
-
-/**
- * Application feedback on how good preference requirements are fulfilled
- * for the preferences included in the given time scope [now - scope .. now]
- *
- * An application notifies ATS if (and only if) it has feedback information
- * for specific properties. This values are valid until the feedback scores are
- * updated by the application.
- *
- * If the application has no feedback for this preference kind the application
- * will not explicitly call for this property and will not include it in this
- * function call.
- *
- * @param ph performance handle
- * @param scope the time interval this valid for: [now - scope .. now]
- * @param peer identifies the peer
- * @param ... #GNUNET_ATS_PREFERENCE_END-terminated specification of the desired changes
- */
-void
-GNUNET_ATS_performance_give_feedback (struct GNUNET_ATS_PerformanceHandle *ph,
-                                      const struct GNUNET_PeerIdentity *peer,
-                                      const struct GNUNET_TIME_Relative scope,
-                                      ...);
-
-#endif
-
-/** @} */  /* end of group */
-
-/* end of file gnunet-service-transport_ats.h */
diff --git a/src/include/gnunet_ats_transport_service.h b/src/include/gnunet_ats_transport_service.h
deleted file mode 100644
index fd821baef..000000000
--- a/src/include/gnunet_ats_transport_service.h
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
-   This file is part of GNUnet.
-   Copyright (C) 2010-2015, 2018 GNUnet e.V.
-
-   GNUnet is free software: you can redistribute it and/or modify it
-   under the terms of the GNU Affero General Public License as published
-   by the Free Software Foundation, either version 3 of the License,
-   or (at your option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Affero General Public License for more details.
-
-   You should have received a copy of the GNU Affero General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @file
- * Bandwidth allocation API for the transport service
- *
- * @author Christian Grothoff
- * @author Matthias Wachs
- *
- * @defgroup ats  ATS service
- * Bandwidth allocation for transport service
- *
- * @see [Documentation](https://gnunet.org/ats-subsystem)
- *
- * @{
- */
-#ifndef GNUNET_ATS_TRANSPORT_SERVICE_H
-#define GNUNET_ATS_TRANSPORT_SERVICE_H
-
-#include "gnunet_constants.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_nt_lib.h"
-#include "gnunet_transport_communication_service.h"
-
-
-/**
- * ATS performance characteristics for a session.
- */
-struct GNUNET_ATS_Properties
-{
-  /**
-   * Delay.  Time between when the time packet is sent and the packet
-   * arrives.  FOREVER if we did not (successfully) measure yet.
-   */
-  struct GNUNET_TIME_Relative delay;
-
-  /**
-   * Confirmed successful payload on this connection from this peer to
-   * the other peer.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t goodput_out;
-
-  /**
-   * Confirmed useful payload on this connection to this peer from
-   * the other peer.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t goodput_in;
-
-  /**
-   * Actual traffic on this connection from this peer to the other peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_out;
-
-  /**
-   * Actual traffic on this connection from the other peer to this peer.
-   * Includes transport overhead.
-   *
-   * Unit: [bytes/second]
-   */
-  uint32_t utilization_in;
-
-  /**
-   * Distance on network layer (required for distance-vector routing)
-   * in hops.  Zero for direct connections (e.g. plain TCP/UDP).
-   */
-  uint32_t distance;
-
-  /**
-   * MTU of the network layer, UINT32_MAX for no MTU (stream).
-   *
-   * Unit: [bytes]
-   */
-  uint32_t mtu;
-
-  /**
-   * Which network scope does the respective address belong to?
-   */
-  enum GNUNET_NetworkType nt;
-
-  /**
-   * What characteristics does this communicator have?
-   */
-  enum GNUNET_TRANSPORT_CommunicatorCharacteristics cc;
-};
-
-
-/* ******************************** Transport API ***************************** */
-
-/**
- * Handle to the ATS subsystem for bandwidth/transport transport information.
- */
-struct GNUNET_ATS_TransportHandle;
-
-/**
- * Opaque session handle, to be defined by transport.  Contents not known to ATS.
- */
-struct GNUNET_ATS_Session;
-
-
-/**
- * Signature of a function called by ATS with the current bandwidth
- * allocation to be used as determined by ATS.
- *
- * @param cls closure
- * @param session session this is about
- * @param bandwidth_out assigned outbound bandwidth for the connection,
- *        0 to signal disconnect
- * @param bandwidth_in assigned inbound bandwidth for the connection,
- *        0 to signal disconnect
- */
-typedef void
-(*GNUNET_ATS_AllocationCallback) (void *cls,
-                                  struct GNUNET_ATS_Session *session,
-                                  struct GNUNET_BANDWIDTH_Value32NBO
-                                  bandwidth_out,
-                                  struct GNUNET_BANDWIDTH_Value32NBO
-                                  bandwidth_in);
-
-
-/**
- * Signature of a function called by ATS suggesting transport to
- * try connecting with a particular address.
- *
- * @param cls closure
- * @param pid target peer
- * @param address the address to try
- */
-typedef void
-(*GNUNET_ATS_SuggestionCallback) (void *cls,
-                                  const struct GNUNET_PeerIdentity *pid,
-                                  const char *address);
-
-
-/**
- * Initialize the ATS transport subsystem.
- *
- * @param cfg configuration to use
- * @param alloc_cb notification to call whenever the allocation changed
- * @param alloc_cb_cls closure for @a alloc_cb
- * @param suggest_cb notification to call whenever the suggestation is made
- * @param suggest_cb_cls closure for @a suggest_cb
- * @return ats context
- */
-struct GNUNET_ATS_TransportHandle *
-GNUNET_ATS_transport_init (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                           GNUNET_ATS_AllocationCallback alloc_cb,
-                           void *alloc_cb_cls,
-                           GNUNET_ATS_SuggestionCallback suggest_cb,
-                           void *suggest_cb_cls);
-
-
-/**
- * Client is done with ATS transport, release resources.
- *
- * @param ath handle to release
- */
-void
-GNUNET_ATS_transport_done (struct GNUNET_ATS_TransportHandle *ath);
-
-
-/**
- * Handle used within ATS to track an session.
- */
-struct GNUNET_ATS_SessionRecord;
-
-
-/**
- * We have a new session ATS should know. Sessiones have to be added with this
- * function before they can be: updated, set in use and destroyed
- *
- * @param ath handle
- * @param pid peer we connected to
- * @param address the address (human readable version),
- * @param session transport-internal handle for the session/queue, NULL if
- *        the session is inbound-only
- * @param prop performance data for the session
- * @return handle to the session representation inside ATS, NULL
- *         on error (i.e. ATS knows this exact session already, or
- *         session is invalid)
- */
-struct GNUNET_ATS_SessionRecord *
-GNUNET_ATS_session_add (struct GNUNET_ATS_TransportHandle *ath,
-                        const struct GNUNET_PeerIdentity *pid,
-                        const char *address,
-                        struct GNUNET_ATS_Session *session,
-                        const struct GNUNET_ATS_Properties *prop);
-
-
-/**
- * We have updated performance statistics for a given session.  Based
- * on the information provided, ATS may update bandwidth assignments.
- *
- * @param ar session record to update information for
- * @param prop performance data for the session
- */
-void
-GNUNET_ATS_session_update (struct GNUNET_ATS_SessionRecord *ar,
-                           const struct GNUNET_ATS_Properties *prop);
-
-
-/**
- * A session was destroyed, ATS should now schedule and
- * allocate under the assumption that this @a ar is no
- * longer in use.
- *
- * @param ar session record to drop
- */
-void
-GNUNET_ATS_session_del (struct GNUNET_ATS_SessionRecord *ar);
-
-
-#endif
-
-/** @} */  /* end of group */
-
-/* end of file gnunet-service-transport_ats.h */
diff --git a/src/include/gnunet_bandwidth_lib.h b/src/include/gnunet_bandwidth_lib.h
index 9130ff57e..00a7d6c5d 100644
--- a/src/include/gnunet_bandwidth_lib.h
+++ b/src/include/gnunet_bandwidth_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -29,6 +33,10 @@
  * @{
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_BANDWIDTH_LIB_H
 #define GNUNET_BANDWIDTH_LIB_H
 
@@ -39,7 +47,7 @@ extern "C" {
 #endif
 #endif
 
-#include "gnunet_common.h"
+
 #include "gnunet_time_lib.h"
 
 GNUNET_NETWORK_STRUCT_BEGIN
@@ -351,4 +359,6 @@ GNUNET_BANDWIDTH_tracker_update_quota (
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_bandwidth_lib.h */
diff --git a/src/include/gnunet_bio_lib.h b/src/include/gnunet_bio_lib.h
index 142f1b088..73550db7e 100644
--- a/src/include/gnunet_bio_lib.h
+++ b/src/include/gnunet_bio_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -29,9 +33,15 @@
  * @{
  */
 
+#include "gnunet_common.h"
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_BIO_LIB_H
 #define GNUNET_BIO_LIB_H
 
+
 #include "gnunet_container_lib.h"
 
 #ifdef __cplusplus
@@ -79,9 +89,18 @@ GNUNET_BIO_read_open_buffer (void *buffer, size_t size);
  * @param emsg set to the error message
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_close (struct GNUNET_BIO_ReadHandle *h, char **emsg);
 
+/**
+ * Set read error to handle
+ *
+ * @param h the handle
+ * @param emsg the message
+ */
+void
+GNUNET_BIO_read_set_error (struct GNUNET_BIO_ReadHandle *h, const char* emsg);
+
 
 /**
  * Read some contents into a buffer.
@@ -92,7 +111,7 @@ GNUNET_BIO_read_close (struct GNUNET_BIO_ReadHandle *h, char **emsg);
  * @param len the number of bytes to read
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read (struct GNUNET_BIO_ReadHandle *h,
                  const char *what,
                  void *result,
@@ -109,26 +128,13 @@ GNUNET_BIO_read (struct GNUNET_BIO_ReadHandle *h,
  * @param max_length maximum allowed length for the string
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_string (struct GNUNET_BIO_ReadHandle *h,
                         const char *what,
                         char **result,
                         size_t max_length);
 
 
-/**
- * Read a metadata container.
- *
- * @param h handle to an open file
- * @param what describes what is being read (for error message creation)
- * @param result the buffer to store a pointer to the (allocated) metadata
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
- */
-int
-GNUNET_BIO_read_meta_data (struct GNUNET_BIO_ReadHandle *h,
-                           const char *what,
-                           struct GNUNET_CONTAINER_MetaData **result);
-
 
 /**
  * Read a float.
@@ -137,7 +143,7 @@ GNUNET_BIO_read_meta_data (struct GNUNET_BIO_ReadHandle *h,
  * @param what describes what is being read (for error message creation)
  * @param f address of float to read
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_float (struct GNUNET_BIO_ReadHandle *h,
                        const char *what,
                        float *f);
@@ -150,7 +156,7 @@ GNUNET_BIO_read_float (struct GNUNET_BIO_ReadHandle *h,
  * @param what describes what is being read (for error message creation)
  * @param f address of double to read
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_double (struct GNUNET_BIO_ReadHandle *h,
                         const char *what,
                         double *f);
@@ -164,7 +170,7 @@ GNUNET_BIO_read_double (struct GNUNET_BIO_ReadHandle *h,
  * @param i where to store the data
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_int32 (struct GNUNET_BIO_ReadHandle *h,
                        const char *what,
                        int32_t *i);
@@ -178,7 +184,7 @@ GNUNET_BIO_read_int32 (struct GNUNET_BIO_ReadHandle *h,
  * @param i where to store the data
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_int64 (struct GNUNET_BIO_ReadHandle *h,
                        const char *what,
                        int64_t *i);
@@ -219,7 +225,7 @@ GNUNET_BIO_write_open_buffer (void);
  * @return #GNUNET_OK upon success.  Upon failure #GNUNET_SYSERR is returned
  *         and the file is closed
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_flush (struct GNUNET_BIO_WriteHandle *h);
 
 
@@ -235,7 +241,7 @@ GNUNET_BIO_flush (struct GNUNET_BIO_WriteHandle *h);
  * @param size where to store the size of @e contents
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_get_buffer_contents (struct GNUNET_BIO_WriteHandle *h,
                                 char **emsg,
                                 void **contents,
@@ -251,7 +257,7 @@ GNUNET_BIO_get_buffer_contents (struct GNUNET_BIO_WriteHandle *h,
  *        if the handle has an error message, the return value is #GNUNET_SYSERR
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_close (struct GNUNET_BIO_WriteHandle *h, char **emsg);
 
 
@@ -264,7 +270,7 @@ GNUNET_BIO_write_close (struct GNUNET_BIO_WriteHandle *h, char **emsg);
  * @param n number of bytes to write
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write (struct GNUNET_BIO_WriteHandle *h,
                   const char *what,
                   const void *buffer,
@@ -279,25 +285,12 @@ GNUNET_BIO_write (struct GNUNET_BIO_WriteHandle *h,
  * @param s string to write (can be NULL)
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_string (struct GNUNET_BIO_WriteHandle *h,
                          const char *what,
                          const char *s);
 
 
-/**
- * Write a metadata container.
- *
- * @param h the IO handle to write to
- * @param what what is being written (for error message creation)
- * @param m metadata to write
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_BIO_write_meta_data (struct GNUNET_BIO_WriteHandle *h,
-                            const char *what,
-                            const struct GNUNET_CONTAINER_MetaData *m);
-
 
 /**
  * Write a float.
@@ -306,7 +299,7 @@ GNUNET_BIO_write_meta_data (struct GNUNET_BIO_WriteHandle *h,
  * @param what what is being written (for error message creation)
  * @param f float to write (must be a variable)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_float (struct GNUNET_BIO_WriteHandle *h,
                         const char *what,
                         float f);
@@ -318,7 +311,7 @@ GNUNET_BIO_write_float (struct GNUNET_BIO_WriteHandle *h,
  * @param what what is being written (for error message creation)
  * @param f double to write (must be a variable)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_double (struct GNUNET_BIO_WriteHandle *h,
                          const char *what,
                          double f);
@@ -332,7 +325,7 @@ GNUNET_BIO_write_double (struct GNUNET_BIO_WriteHandle *h,
  * @param i 32-bit integer to write
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_int32 (struct GNUNET_BIO_WriteHandle *h,
                         const char *what,
                         int32_t i);
@@ -346,7 +339,7 @@ GNUNET_BIO_write_int32 (struct GNUNET_BIO_WriteHandle *h,
  * @param i 64-bit integer to write
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_int64 (struct GNUNET_BIO_WriteHandle *h,
                         const char *what,
                         int64_t i);
@@ -444,17 +437,6 @@ GNUNET_BIO_read_spec_string (const char *what,
                              size_t max_length);
 
 
-/**
- * Create the specification to read a metadata container.
- *
- * @param what describes what is being read (for error message creation)
- * @param result the buffer to store a pointer to the (allocated) metadata
- * @return the read spec
- */
-struct GNUNET_BIO_ReadSpec
-GNUNET_BIO_read_spec_meta_data (const char *what,
-                                struct GNUNET_CONTAINER_MetaData **result);
-
 
 /**
  * Create the specification to read an (u)int32_t.
@@ -508,7 +490,7 @@ GNUNET_BIO_read_spec_double (const char *what, double *f);
  *        the last element must be #GNUNET_BIO_read_spec_end
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_read_spec_commit (struct GNUNET_BIO_ReadHandle *h,
                              struct GNUNET_BIO_ReadSpec *rs);
 
@@ -601,18 +583,6 @@ GNUNET_BIO_write_spec_string (const char *what,
 
 
 /**
- * Create the specification to write a metadata container.
- *
- * @param what what is being written (for error message creation)
- * @param m metadata to write
- * @return the write spec
- */
-struct GNUNET_BIO_WriteSpec
-GNUNET_BIO_write_spec_meta_data (const char *what,
-                                 const struct GNUNET_CONTAINER_MetaData *m);
-
-
-/**
  * Create the specification to write an (u)int32_t.
  *
  * @param what describes what is being written (for error message creation)
@@ -666,7 +636,7 @@ GNUNET_BIO_write_spec_double (const char *what, double *f);
  *        the last element must be #GNUNET_BIO_write_spec_end
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BIO_write_spec_commit (struct GNUNET_BIO_WriteHandle *h,
                               struct GNUNET_BIO_WriteSpec *ws);
 
@@ -683,4 +653,6 @@ GNUNET_BIO_write_spec_commit (struct GNUNET_BIO_WriteHandle *h,
 
 /** @} */  /* end of group bio */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_bio_lib.h */
diff --git a/src/include/gnunet_block_group_lib.h b/src/include/gnunet_block_group_lib.h
index 6cb601757..b1f59899e 100644
--- a/src/include/gnunet_block_group_lib.h
+++ b/src/include/gnunet_block_group_lib.h
@@ -31,6 +31,7 @@
 #ifndef GNUNET_BLOCK_GROUP_LIB_H
 #define GNUNET_BLOCK_GROUP_LIB_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 
@@ -68,7 +69,6 @@ GNUNET_BLOCK_GROUP_compute_bloomfilter_size (unsigned int entry_count,
  * @param bf_size size of the Bloom filter
  * @param bf_k K-value for the Bloom filter
  * @param type block type
- * @param nonce random value used to seed the group creation
  * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
  * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
  * @return block group handle, NULL if block groups are not supported
@@ -79,7 +79,6 @@ GNUNET_BLOCK_GROUP_bf_create (void *cls,
                               size_t bf_size,
                               unsigned int bf_k,
                               enum GNUNET_BLOCK_Type type,
-                              uint32_t nonce,
                               const void *raw_data,
                               size_t raw_data_size);
 
@@ -92,9 +91,9 @@ GNUNET_BLOCK_GROUP_bf_create (void *cls,
  * @param bg block group to use for testing
  * @param hc hash of element to evaluate
  * @return #GNUNET_YES if @a hc is (likely) a duplicate
- *         #GNUNET_NO if @a hc was definitively not in @bg (but now is)
+ *         #GNUNET_NO if @a hc was definitively not in @a bg (but now is)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_GROUP_bf_test_and_set (struct GNUNET_BLOCK_Group *bg,
                                     const struct GNUNET_HashCode *hc);
 
diff --git a/src/include/gnunet_block_lib.h b/src/include/gnunet_block_lib.h
index 73b51252e..fdccbab78 100644
--- a/src/include/gnunet_block_lib.h
+++ b/src/include/gnunet_block_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup dht_libs  DHT and support libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,7 +34,10 @@
 #ifndef GNUNET_BLOCK_LIB_H
 #define GNUNET_BLOCK_LIB_H
 
+
 #include "gnunet_util_lib.h"
+#include "gnunet_dht_block_types.h"
+
 #ifdef __cplusplus
 extern "C"
 {
@@ -42,181 +48,36 @@ extern "C"
 
 
 /**
- * Blocks in the datastore and the datacache must have a unique type.
- */
-enum GNUNET_BLOCK_Type
-{
-  /**
-   * Any type of block, used as a wildcard when searching.  Should
-   * never be attached to a specific block.
-   */
-  GNUNET_BLOCK_TYPE_ANY = 0,
-
-  /**
-   * Data block (leaf) in the CHK tree.
-   */
-  GNUNET_BLOCK_TYPE_FS_DBLOCK = 1,
-
-  /**
-   * Inner block in the CHK tree.
-   */
-  GNUNET_BLOCK_TYPE_FS_IBLOCK = 2,
-
-  /**
-   * Legacy type, no longer in use.
-   */
-  GNUNET_BLOCK_TYPE_FS_KBLOCK = 3,
-
-  /**
-   * Legacy type, no longer in use.
-   */
-  GNUNET_BLOCK_TYPE_FS_SBLOCK = 4,
-
-  /**
-   * Legacy type, no longer in use.
-   */
-  GNUNET_BLOCK_TYPE_FS_NBLOCK = 5,
-
-  /**
-   * Type of a block representing a block to be encoded on demand from disk.
-   * Should never appear on the network directly.
-   */
-  GNUNET_BLOCK_TYPE_FS_ONDEMAND = 6,
-
-  /**
-   * Type of a block that contains a HELLO for a peer (for
-   * DHT and CADET find-peer operations).
-   */
-  GNUNET_BLOCK_TYPE_DHT_HELLO = 7,
-
-  /**
-   * Block for testing.
-   */
-  GNUNET_BLOCK_TYPE_TEST = 8,
-
-  /**
-   * Type of a block representing any type of search result
-   * (universal).  Implemented in the context of #2564, replaces
-   * SBLOCKS, KBLOCKS and NBLOCKS.
-   */
-  GNUNET_BLOCK_TYPE_FS_UBLOCK = 9,
-
-  /**
-   * Block for storing DNS exit service advertisements.
-   */
-  GNUNET_BLOCK_TYPE_DNS = 10,
-
-  /**
-   * Block for storing record data
-   */
-  GNUNET_BLOCK_TYPE_GNS_NAMERECORD = 11,
-
-  /**
-   * Block type for a revocation message by which a key is revoked.
-   */
-  GNUNET_BLOCK_TYPE_REVOCATION = 12,
-
-  /**
-   * Block to store a cadet regex state
-   */
-  GNUNET_BLOCK_TYPE_REGEX = 22,
-
-  /**
-   * Block to store a cadet regex accepting state
-   */
-  GNUNET_BLOCK_TYPE_REGEX_ACCEPT = 23,
-
-  /**
-   * Block for testing set/consensus.  If first byte of the block
-   * is non-zero, the block is considered invalid.
-   */
-  GNUNET_BLOCK_TYPE_SET_TEST = 24,
-
-  /**
-   * Block type for consensus elements.
-   * Contains either special marker elements or a nested block.
-   */
-  GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT = 25,
-
-  /**
-   * Block for testing set intersection.  If first byte of the block
-   * is non-zero, the block is considered invalid.
-   */
-  GNUNET_BLOCK_TYPE_SETI_TEST = 24,
-
-  /**
-   * Block for testing set union.  If first byte of the block
-   * is non-zero, the block is considered invalid.
-   */
-  GNUNET_BLOCK_TYPE_SETU_TEST = 24,
-
-};
-
-
-/**
- * Flags that can be set to control the evaluation.
- */
-enum GNUNET_BLOCK_EvaluationOptions
-{
-  /**
-   * Default behavior.
-   */
-  GNUNET_BLOCK_EO_NONE = 0,
-
-  /**
-   * The block is obtained from the local database, skip cryptographic
-   * checks.
-   */
-  GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO = 1
-};
-
-
-/**
  * Possible ways for how a block may relate to a query.
  */
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 {
-  /**
-   * Valid result, and there may be more.
-   */
-  GNUNET_BLOCK_EVALUATION_OK_MORE = 0,
 
   /**
-   * Last possible valid result.
+   * Specified block type not supported by any plugin.
    */
-  GNUNET_BLOCK_EVALUATION_OK_LAST = 1,
+  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
 
   /**
    * Valid result, but suppressed because it is a duplicate.
    */
-  GNUNET_BLOCK_EVALUATION_OK_DUPLICATE = 2,
-
-  /**
-   * Block does not match query (invalid result)
-   */
-  GNUNET_BLOCK_EVALUATION_RESULT_INVALID = 3,
+  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
 
   /**
    * Block does not match xquery (valid result, not relevant for the request)
    */
-  GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT = 4,
+  GNUNET_BLOCK_REPLY_IRRELEVANT = 1,
 
   /**
-   * Query is valid, no reply given.
+   * Valid result, and there may be more.
    */
-  GNUNET_BLOCK_EVALUATION_REQUEST_VALID = 10,
+  GNUNET_BLOCK_REPLY_OK_MORE = 2,
 
   /**
-   * Query format does not match block type (invalid query).  For
-   * example, xquery not given or xquery_size not appropriate for
-   * type.
+   * Last possible valid result.
    */
-  GNUNET_BLOCK_EVALUATION_REQUEST_INVALID = 11,
+  GNUNET_BLOCK_REPLY_OK_LAST = 3
 
-  /**
-   * Specified block type not supported by this plugin.
-   */
-  GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED = 20
 };
 
 
@@ -271,7 +132,6 @@ struct GNUNET_BLOCK_Group;
  *
  * @param ctx block context in which the block group is created
  * @param type type of the block for which we are creating the group
- * @param nonce random value used to seed the group creation
  * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
  * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
  * @param ... type-specific additional data, can be empty
@@ -281,7 +141,6 @@ struct GNUNET_BLOCK_Group;
 struct GNUNET_BLOCK_Group *
 GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
                            enum GNUNET_BLOCK_Type type,
-                           uint32_t nonce,
                            const void *raw_data,
                            size_t raw_data_size,
                            ...);
@@ -291,15 +150,13 @@ GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
  * Serialize state of a block group.
  *
  * @param bg group to serialize
- * @param[out] nonce set to the nonce of the @a bg
  * @param[out] raw_data set to the serialized state
  * @param[out] raw_data_size set to the number of bytes in @a raw_data
  * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
  *         supported, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_serialize (struct GNUNET_BLOCK_Group *bg,
-                              uint32_t *nonce,
                               void **raw_data,
                               size_t *raw_data_size);
 
@@ -314,16 +171,12 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg);
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
+ * Function called to validate if a reply is good for a
+ * particular query.
  *
  * @param ctx block contxt
  * @param type block type
- * @param group block group to use for evaluation
- * @param eo evaluation options to control evaluation
+ * @param[in,out] group block group to use for evaluation
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
  * @param xquery_size number of bytes in @a xquery
@@ -331,20 +184,57 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg);
  * @param reply_block_size number of bytes in @a reply_block
  * @return characterization of result
  */
-enum GNUNET_BLOCK_EvaluationResult
-GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
-                       enum GNUNET_BLOCK_Type type,
-                       struct GNUNET_BLOCK_Group *group,
-                       enum GNUNET_BLOCK_EvaluationOptions eo,
-                       const struct GNUNET_HashCode *query,
-                       const void *xquery,
-                       size_t xquery_size,
-                       const void *reply_block,
-                       size_t reply_block_size);
+enum GNUNET_BLOCK_ReplyEvaluationResult
+GNUNET_BLOCK_check_reply (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          struct GNUNET_BLOCK_Group *group,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size,
+                          const void *reply_block,
+                          size_t reply_block_size);
 
 
 /**
- * Function called to obtain the key for a block.
+ * Function called to validate a request.
+ *
+ * @param ctx block contxt
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
+ *   #GNUNET_SYSERR if @a type is not supported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size);
+
+
+/**
+ * Function called to validate a block.
+ *
+ * @param ctx block contxt
+ * @param type block type
+ * @param block payload to put
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
+ *   #GNUNET_SYSERR if @a type is not supported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const void *block,
+                          size_t block_size);
+
+
+/**
+ * Function called to obtain the @a key for a @a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param ctx block context
  * @param type block type
@@ -352,11 +242,10 @@ GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
  * @param block_size number of bytes in @a block
  * @param key set to the key (query) for the given block
  * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
- *         #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ *         #GNUNET_NO if extracting a key from a block of this @a type does not work
+ *         #GNUNET_SYSERR if @a type not supported
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
                       enum GNUNET_BLOCK_Type type,
                       const void *block,
@@ -375,7 +264,7 @@ GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
  * @param seen_results_count number of entries in @a seen_results
  * @return #GNUNET_SYSERR if not supported, #GNUNET_OK on success
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
                              const struct GNUNET_HashCode *seen_results,
                              unsigned int seen_results_count);
@@ -383,7 +272,7 @@ GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
 
 /**
  * Try merging two block groups.  Afterwards, @a bg1 should remain
- * valid and contain the rules from both @a bg1 and @bg2, and
+ * valid and contain the rules from both @a bg1 and @a bg2, and
  * @a bg2 should be destroyed (as part of this call).  The latter
  * should happen even if merging is not supported.
  *
@@ -393,7 +282,7 @@ GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
  *         #GNUNET_NO if merge failed due to different nonce
  *         #GNUNET_SYSERR if merging is not supported
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_merge (struct GNUNET_BLOCK_Group *bg1,
                           struct GNUNET_BLOCK_Group *bg2);
 
@@ -410,4 +299,6 @@ GNUNET_BLOCK_group_merge (struct GNUNET_BLOCK_Group *bg1,
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_block_lib.h */
diff --git a/src/include/gnunet_block_plugin.h b/src/include/gnunet_block_plugin.h
index ee237ac03..16e93c780 100644
--- a/src/include/gnunet_block_plugin.h
+++ b/src/include/gnunet_block_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010,2013,2017 GNUnet e.V.
+     Copyright (C) 2010, 2013, 2017, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup dht_libs  DHT and support libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -35,6 +38,7 @@
 #ifndef PLUGIN_BLOCK_H
 #define PLUGIN_BLOCK_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 
@@ -48,10 +52,10 @@
  * @param seen_results_count number of entries in @a seen_results
  */
 typedef void
-(*GNUNET_BLOCK_GroupMarkSeenFunction)(struct GNUNET_BLOCK_Group *bg,
-                                      const struct
-                                      GNUNET_HashCode *seen_results,
-                                      unsigned int seen_results_count);
+(*GNUNET_BLOCK_GroupMarkSeenFunction)(
+  struct GNUNET_BLOCK_Group *bg,
+  const struct GNUNET_HashCode *seen_results,
+  unsigned int seen_results_count);
 
 
 /**
@@ -63,7 +67,7 @@ typedef void
  * @return #GNUNET_OK on success, #GNUNET_NO if the nonces were different and thus
  *         we failed.
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GroupMergeFunction)(struct GNUNET_BLOCK_Group *bg1,
                                    const struct GNUNET_BLOCK_Group *bg2);
 
@@ -72,15 +76,13 @@ typedef int
  * Serialize state of a block group.
  *
  * @param bg group to serialize
- * @param[out] nonce set to the nonce of the @a bg
  * @param[out] raw_data set to the serialized state
  * @param[out] raw_data_size set to the number of bytes in @a raw_data
  * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
  *         supported, #GNUNET_SYSERR on error
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GroupSerializeFunction)(struct GNUNET_BLOCK_Group *bg,
-                                       uint32_t *nonce,
                                        void **raw_data,
                                        size_t *raw_data_size);
 
@@ -156,24 +158,54 @@ struct GNUNET_BLOCK_Group
 typedef struct GNUNET_BLOCK_Group *
 (*GNUNET_BLOCK_GroupCreateFunction)(void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    uint32_t nonce,
                                     const void *raw_data,
                                     size_t raw_data_size,
                                     va_list va);
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_BLOCK_QueryEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        const struct GNUNET_HashCode *query,
+                                        const void *xquery,
+                                        size_t xquery_size);
+
+
+/**
+ * Function called to validate a @a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the @a block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if the @a type is not supported
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_BLOCK_BlockEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        const void *block,
+                                        size_t block_size);
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
  *
  * @param cls closure
- * @param ctx block context
  * @param type block type
  * @param group which block group to use for evaluation
- * @param eo evaluation options to control evaluation
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
  * @param xquery_size number of bytes in @a xquery
@@ -181,38 +213,37 @@ typedef struct GNUNET_BLOCK_Group *
  * @param reply_block_size number of bytes in @a reply_block
  * @return characterization of result
  */
-typedef enum GNUNET_BLOCK_EvaluationResult
-(*GNUNET_BLOCK_EvaluationFunction)(void *cls,
-                                   struct GNUNET_BLOCK_Context *ctx,
-                                   enum GNUNET_BLOCK_Type type,
-                                   struct GNUNET_BLOCK_Group *group,
-                                   enum GNUNET_BLOCK_EvaluationOptions eo,
-                                   const struct GNUNET_HashCode *query,
-                                   const void *xquery,
-                                   size_t xquery_size,
-                                   const void *reply_block,
-                                   size_t reply_block_size);
+typedef enum GNUNET_BLOCK_ReplyEvaluationResult
+(*GNUNET_BLOCK_ReplyEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        struct GNUNET_BLOCK_Group *group,
+                                        const struct GNUNET_HashCode *query,
+                                        const void *xquery,
+                                        size_t xquery_size,
+                                        const void *reply_block,
+                                        size_t reply_block_size);
 
 
 /**
- * Function called to obtain the key for a block.
+ * Function called to obtain the @a key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param cls closure
  * @param type block type
- * @param block block to get the key for
+ * @param block block to get the @a key for
  * @param block_size number of bytes in @a block
- * @param key set to the key (query) for the given block
+ * @param[out] key set to the key (query) for the given block
  * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
- *         #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ *         #GNUNET_NO if extracting a key for this @a type does not work
+ *         #GNUNET_SYSERR if @a type not supported
  */
-typedef int
-(*GNUNET_BLOCK_GetKeyFunction) (void *cls,
-                                enum GNUNET_BLOCK_Type type,
-                                const void *block,
-                                size_t block_size,
-                                struct GNUNET_HashCode *key);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_BLOCK_GetKeyFunction)(void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *block,
+                               size_t block_size,
+                               struct GNUNET_HashCode *key);
 
 
 /**
@@ -232,12 +263,6 @@ struct GNUNET_BLOCK_PluginFunctions
   const enum GNUNET_BLOCK_Type *types;
 
   /**
-   * Main function of a block plugin.  Allows us to check if a
-   * block matches a query.
-   */
-  GNUNET_BLOCK_EvaluationFunction evaluate;
-
-  /**
    * Obtain the key for a given block (if possible).
    */
   GNUNET_BLOCK_GetKeyFunction get_key;
@@ -247,8 +272,26 @@ struct GNUNET_BLOCK_PluginFunctions
    * context (i.e. to detect duplicates).
    */
   GNUNET_BLOCK_GroupCreateFunction create_group;
+
+  /**
+   * Check that a query is well-formed.
+   */
+  GNUNET_BLOCK_QueryEvaluationFunction check_query;
+
+  /**
+   * Check that a block is well-formed.
+   */
+  GNUNET_BLOCK_BlockEvaluationFunction check_block;
+
+  /**
+   * Check that a reply block matches a query.
+   */
+  GNUNET_BLOCK_ReplyEvaluationFunction check_reply;
+
 };
 
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_buffer_lib.h b/src/include/gnunet_buffer_lib.h
index 7239eccfb..e65981206 100644
--- a/src/include/gnunet_buffer_lib.h
+++ b/src/include/gnunet_buffer_lib.h
@@ -19,11 +19,19 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * Common buffer management functions.
  *
  * @author Florian Dold
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_BUFFER_LIB_H
 #define GNUNET_BUFFER_LIB_H
 
@@ -203,3 +211,5 @@ GNUNET_buffer_clear (struct GNUNET_Buffer *buf);
 
 
 #endif
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_cadet_service.h b/src/include/gnunet_cadet_service.h
index f08c1572a..ab53d2bd8 100644
--- a/src/include/gnunet_cadet_service.h
+++ b/src/include/gnunet_cadet_service.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  * @author Bart Polot
  *
@@ -42,8 +45,8 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
-#include "gnunet_transport_service.h"
 
 /**
  * Version number of GNUnet-cadet API.
@@ -309,7 +312,9 @@ union GNUNET_CADET_ChannelInfo
  * Get information about a channel.
  *
  * @param channel Channel handle.
+ * @param option Query (GNUNET_CADET_OPTION_*)
  * @param ... dependent on option, currently not used
+ *
  * @return Union with an answer to the query.
  */
 const union GNUNET_CADET_ChannelInfo *
@@ -627,4 +632,6 @@ GNUNET_CADET_list_tunnels_cancel (struct GNUNET_CADET_ListTunnels *lt);
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_cadet_service.h */
diff --git a/src/include/gnunet_child_management_lib.h b/src/include/gnunet_child_management_lib.h
index a35b37865..ab0ab93eb 100644
--- a/src/include/gnunet_child_management_lib.h
+++ b/src/include/gnunet_child_management_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @file include/gnunet_child_management_lib.h
  * @brief GNUnet child management api
  * @author Christian Grothoff
@@ -41,8 +49,7 @@ struct GNUNET_ChildWaitHandle;
  * @param cls handle for the callback
  * @param type type of the process
  * @param exit_code status code of the process
- *
-*/
+ */
 typedef void
 (*GNUNET_ChildCompletedCallback)(void *cls,
                                  enum GNUNET_OS_ProcessStatusType type,
@@ -70,3 +77,5 @@ void
 GNUNET_wait_child_cancel (struct GNUNET_ChildWaitHandle *cwh);
 
 #endif
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_client_lib.h b/src/include/gnunet_client_lib.h
index 2ecd38b04..ab4c7d088 100644
--- a/src/include/gnunet_client_lib.h
+++ b/src/include/gnunet_client_lib.h
@@ -19,6 +19,13 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
+ * @addtogroup networking
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -32,6 +39,10 @@
  * @{
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_CLIENT_LIB_H
 #define GNUNET_CLIENT_LIB_H
 
@@ -43,6 +54,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_mq_lib.h"
 
 
@@ -67,7 +79,8 @@ GNUNET_CLIENT_test (const struct GNUNET_CONFIGURATION_Handle *cfg,
  * Create a message queue to connect to a GNUnet service.
  * If handlers are specified, receive messages from the connection.
  *
- * @param connection the client connection
+ * @param cfg our configuration
+ * @param service_name name of the service to connect to
  * @param handlers handlers for receiving messages, can be NULL
  * @param error_handler error handler
  * @param error_handler_cls closure for the @a error_handler
@@ -93,4 +106,8 @@ GNUNET_CLIENT_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
 
 /** @} */ /* end of group client */
 
+/** @} */ /* end of group addition */
+
+/** @} */ /* end of group addition */
+
 /* end of gnunet_client_lib.h */
diff --git a/src/include/gnunet_common.h b/src/include/gnunet_common.h
index 4472d3ee8..c5885e7c4 100644
--- a/src/include/gnunet_common.h
+++ b/src/include/gnunet_common.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2006-2021 GNUnet e.V.
+     Copyright (C) 2006-2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @file include/gnunet_common.h
  * @brief commonly used definitions; globals in this file
  *        are exempt from the rule that the module name ("common")
@@ -36,28 +40,38 @@
 #ifndef GNUNET_COMMON_H
 #define GNUNET_COMMON_H
 
+#include "gnunet_config.h"
+
+#include <stdbool.h>
 #include <stdlib.h>
-#if HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
-#endif
-#if HAVE_NETINET_IN_H
+#include <sys/un.h>
 #include <netinet/in.h>
-#endif
-#ifdef HAVE_STDINT_H
+#include <arpa/inet.h>
 #include <stdint.h>
-#endif
-#ifdef HAVE_STDARG_H
 #include <stdarg.h>
-#endif
-#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_SOCKET_H
-#include <sys/socket.h>
-#endif
 
+#if defined(__FreeBSD__)
+
+#include <sys/endian.h>
+#define bswap_32(x) bswap32 (x)
+#define bswap_64(x) bswap64 (x)
+
+#elif defined(__OpenBSD__)
+
+#define bswap_32(x) swap32 (x)
+#define bswap_64(x) swap64 (x)
 
-#ifdef HAVE_BYTESWAP_H
+#elif defined(__NetBSD__)
+
+#include <machine/bswap.h>
+#if defined(__BSWAP_RENAME) && ! defined(__bswap_32)
+#define bswap_32(x) bswap32 (x)
+#define bswap_64(x) bswap64 (x)
+#endif
+
+#elif defined(__linux__) || defined(GNU)
 #include <byteswap.h>
 #endif
 
@@ -132,12 +146,6 @@ enum GNUNET_GenericReturnValue
 #endif
 
 /**
- * wrap va_arg for enums
- */
-#define GNUNET_VA_ARG_ENUM(va, X) ((enum X) va_arg (va, int))
-
-
-/**
  * @ingroup logging
  * define #GNUNET_EXTRA_LOGGING if using this header outside the GNUnet source
  * tree where gnunet_config.h is unavailable
@@ -150,8 +158,7 @@ enum GNUNET_GenericReturnValue
  * Endian operations
  */
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-#ifdef HAVE_BYTESWAP_H
+#if defined(bswap_16) || defined(bswap_32) || defined(bswap_64)
 #define BYTE_SWAP_16(x) bswap_16 (x)
 #define BYTE_SWAP_32(x) bswap_32 (x)
 #define BYTE_SWAP_64(x) bswap_64 (x)
@@ -159,17 +166,22 @@ enum GNUNET_GenericReturnValue
 #define BYTE_SWAP_16(x) ((((x) & 0x00ff) << 8) | (((x) & 0xff00) >> 8))
 
 #define BYTE_SWAP_32(x)                                   \
-  ((((x) & 0x000000ffU) << 24) | (((x) & 0x0000ff00U) << 8)   \
-   | (((x) & 0x00ff0000U) >> 8) | (((x) & 0xff000000U) >> 24))
+        ((((x) & 0x000000ffU) << 24) | (((x) & 0x0000ff00U) << 8)   \
+         | (((x) & 0x00ff0000U) >> 8) | (((x) & 0xff000000U) >> 24))
 
 #define BYTE_SWAP_64(x)                                                      \
-  ((((x) & 0x00000000000000ffUL) << 56) | (((x) & 0x000000000000ff00UL) << 40)   \
-   | (((x) & 0x0000000000ff0000UL) << 24) | (((x) & 0x00000000ff000000UL) << 8)    \
-   | (((x) & 0x000000ff00000000UL) >> 8) | (((x) & 0x0000ff0000000000UL) >> 24)    \
-   | (((x) & 0x00ff000000000000UL) >> 40) | (((x) & 0xff00000000000000UL) >> \
-                                             56))
+        ((((x) & 0x00000000000000ffUL) << 56) | (((x) & 0x000000000000ff00UL) << \
+                                                 40)   \
+         | (((x) & 0x0000000000ff0000UL) << 24) | (((x) & 0x00000000ff000000UL) \
+                                                   << 8)    \
+         | (((x) & 0x000000ff00000000UL) >> 8) | (((x) & 0x0000ff0000000000UL) \
+                                                  >> 24)    \
+         | (((x) & 0x00ff000000000000UL) >> 40) | (((x) & 0xff00000000000000UL) \
+                                                   >> \
+                                                   56))
 #endif
 
+#if __BYTE_ORDER == __LITTLE_ENDIAN
 #define GNUNET_htobe16(x) BYTE_SWAP_16 (x)
 #define GNUNET_htole16(x) (x)
 #define GNUNET_be16toh(x) BYTE_SWAP_16 (x)
@@ -471,7 +483,7 @@ GNUNET_get_log_call_status (int caller_level,
 
 #endif
 
-
+/* *INDENT-OFF* */
 /**
  * @ingroup logging
  * Main log function.
@@ -481,13 +493,15 @@ GNUNET_get_log_call_status (int caller_level,
  * @param ... arguments for format string
  */
 void
-GNUNET_log_nocheck (enum GNUNET_ErrorType kind, const char *message, ...)
+GNUNET_log_nocheck (enum GNUNET_ErrorType kind,
+                    const char *message,
+                    ...)
 __attribute__ ((format (printf, 2, 3)));
 
 /* from glib */
 #if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
 #define _GNUNET_BOOLEAN_EXPR(expr) \
-  __extension__ ({                  \
+  __extension__ ({                 \
     int _gnunet_boolean_var_;      \
     if (expr)                      \
       _gnunet_boolean_var_ = 1;    \
@@ -505,6 +519,7 @@ __attribute__ ((format (printf, 2, 3)));
 #if ! defined(GNUNET_LOG_CALL_STATUS)
 #define GNUNET_LOG_CALL_STATUS -1
 #endif
+/* *INDENT-ON* */
 
 
 /**
@@ -526,56 +541,56 @@ __attribute__ ((format (printf, 3, 4)));
 
 #if ! defined(GNUNET_CULL_LOGGING)
 #define GNUNET_log_from(kind, comp, ...)                                  \
-  do                                                                      \
-  {                                                                       \
-    static int log_call_enabled = GNUNET_LOG_CALL_STATUS;                 \
-    if ((GNUNET_EXTRA_LOGGING > 0) ||                                     \
-        ((GNUNET_ERROR_TYPE_DEBUG & (kind)) == 0))                        \
-    {                                                                     \
-      if (GN_UNLIKELY (log_call_enabled == -1))                           \
-        log_call_enabled =                                                \
-          GNUNET_get_log_call_status ((kind) & (~GNUNET_ERROR_TYPE_BULK), \
-                                      (comp),                             \
-                                      __FILE__,                           \
-                                      __FUNCTION__,                       \
-                                      __LINE__);                          \
-      if (GN_UNLIKELY (GNUNET_get_log_skip () > 0))                       \
-      {                                                                   \
-        GNUNET_log_skip (-1, GNUNET_NO);                                  \
-      }                                                                   \
-      else                                                                \
-      {                                                                   \
-        if (GN_UNLIKELY (log_call_enabled))                               \
-          GNUNET_log_from_nocheck ((kind), comp, __VA_ARGS__);            \
-      }                                                                   \
-    }                                                                     \
-  } while (0)
+        do                                                                      \
+        {                                                                       \
+          static int log_call_enabled = GNUNET_LOG_CALL_STATUS;                 \
+          if ((GNUNET_EXTRA_LOGGING > 0) ||                                     \
+              ((GNUNET_ERROR_TYPE_DEBUG & (kind)) == 0))                        \
+          {                                                                     \
+            if (GN_UNLIKELY (log_call_enabled == -1))                           \
+            log_call_enabled =                                                \
+              GNUNET_get_log_call_status ((kind) & (~GNUNET_ERROR_TYPE_BULK), \
+                                          (comp),                             \
+                                          __FILE__,                           \
+                                          __FUNCTION__,                       \
+                                          __LINE__);                          \
+            if (GN_UNLIKELY (GNUNET_get_log_skip () > 0))                       \
+            {                                                                   \
+              GNUNET_log_skip (-1, GNUNET_NO);                                  \
+            }                                                                   \
+            else                                                                \
+            {                                                                   \
+              if (GN_UNLIKELY (log_call_enabled))                               \
+              GNUNET_log_from_nocheck ((kind), comp, __VA_ARGS__);            \
+            }                                                                   \
+          }                                                                     \
+        } while (0)
 
 #define GNUNET_log(kind, ...)                                             \
-  do                                                                      \
-  {                                                                       \
-    static int log_call_enabled = GNUNET_LOG_CALL_STATUS;                 \
-    if ((GNUNET_EXTRA_LOGGING > 0) ||                                     \
-        ((GNUNET_ERROR_TYPE_DEBUG & (kind)) == 0))                        \
-    {                                                                     \
-      if (GN_UNLIKELY (log_call_enabled == -1))                           \
-        log_call_enabled =                                                \
-          GNUNET_get_log_call_status ((kind) & (~GNUNET_ERROR_TYPE_BULK), \
-                                      NULL,                               \
-                                      __FILE__,                           \
-                                      __FUNCTION__,                       \
-                                      __LINE__);                          \
-      if (GN_UNLIKELY (GNUNET_get_log_skip () > 0))                       \
-      {                                                                   \
-        GNUNET_log_skip (-1, GNUNET_NO);                                  \
-      }                                                                   \
-      else                                                                \
-      {                                                                   \
-        if (GN_UNLIKELY (log_call_enabled))                               \
-          GNUNET_log_nocheck ((kind), __VA_ARGS__);                       \
-      }                                                                   \
-    }                                                                     \
-  } while (0)
+        do                                                                      \
+        {                                                                       \
+          static int log_call_enabled = GNUNET_LOG_CALL_STATUS;                 \
+          if ((GNUNET_EXTRA_LOGGING > 0) ||                                     \
+              ((GNUNET_ERROR_TYPE_DEBUG & (kind)) == 0))                        \
+          {                                                                     \
+            if (GN_UNLIKELY (log_call_enabled == -1))                           \
+            log_call_enabled =                                                \
+              GNUNET_get_log_call_status ((kind) & (~GNUNET_ERROR_TYPE_BULK), \
+                                          NULL,                               \
+                                          __FILE__,                           \
+                                          __FUNCTION__,                       \
+                                          __LINE__);                          \
+            if (GN_UNLIKELY (GNUNET_get_log_skip () > 0))                       \
+            {                                                                   \
+              GNUNET_log_skip (-1, GNUNET_NO);                                  \
+            }                                                                   \
+            else                                                                \
+            {                                                                   \
+              if (GN_UNLIKELY (log_call_enabled))                               \
+              GNUNET_log_nocheck ((kind), __VA_ARGS__);                       \
+            }                                                                   \
+          }                                                                     \
+        } while (0)
 #else
 #define GNUNET_log(...)
 #define GNUNET_log_from(...)
@@ -623,6 +638,31 @@ GNUNET_abort_ (void) GNUNET_NORETURN;
 
 
 /**
+ * Convert a buffer to an 8-character string
+ * representative of the contents. This is used
+ * for logging binary data when debugging.
+ *
+ * @param buf buffer to log
+ * @param buf_size number of bytes in @a buf
+ * @return text representation of buf, valid until next
+ *         call to this function
+ */
+const char *
+GNUNET_b2s (const void *buf,
+            size_t buf_size);
+
+
+/**
+ * Convert a fixed-sized object to a string using
+ * #GNUNET_b2s().
+ *
+ * @param obj address of object to convert
+ * @return string representing the binary obj buffer
+ */
+#define GNUNET_B2S(obj) GNUNET_b2s ((obj), sizeof (*(obj)))
+
+
+/**
  * @ingroup logging
  * Ignore the next @a n calls to the log function.
  *
@@ -642,8 +682,10 @@ GNUNET_log_skip (int n, int check_reset);
  * @param logfile change logging to logfile (use NULL to keep stderr)
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if logfile could not be opened
  */
-int
-GNUNET_log_setup (const char *comp, const char *loglevel, const char *logfile);
+enum GNUNET_GenericReturnValue
+GNUNET_log_setup (const char *comp,
+                  const char *loglevel,
+                  const char *logfile);
 
 
 /**
@@ -657,7 +699,8 @@ GNUNET_log_setup (const char *comp, const char *loglevel, const char *logfile);
  * @param logger_cls closure for @a logger
  */
 void
-GNUNET_logger_add (GNUNET_Logger logger, void *logger_cls);
+GNUNET_logger_add (GNUNET_Logger logger,
+                   void *logger_cls);
 
 
 /**
@@ -668,7 +711,8 @@ GNUNET_logger_add (GNUNET_Logger logger, void *logger_cls);
  * @param logger_cls closure for @a logger
  */
 void
-GNUNET_logger_remove (GNUNET_Logger logger, void *logger_cls);
+GNUNET_logger_remove (GNUNET_Logger logger,
+                      void *logger_cls);
 
 
 /**
@@ -883,36 +927,37 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * @ingroup logging
  * Use this for fatal errors that cannot be handled
  */
-#if __GNUC__ >= 6  || __clang_major__ >= 6
+#if __GNUC__ >= 6 || __clang_major__ >= 6
 #define GNUNET_assert(cond)                                     \
-  do                                                            \
-  {                                                             \
- _Pragma("GCC diagnostic push")                                 \
- _Pragma("GCC diagnostic ignored \"-Wtautological-compare\"")   \
-    if (! (cond))                                               \
-    {                                                           \
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
-                  dgettext ("gnunet", "Assertion failed at %s:%d. Aborting.\n"), \
-                  __FILE__,                                     \
-                  __LINE__);                                    \
-      GNUNET_abort_ ();                                         \
-    }                                                           \
- _Pragma("GCC diagnostic pop")                                  \
-  } while (0)
+        do                                                            \
+        {                                                             \
+          _Pragma("GCC diagnostic push")                                 \
+          _Pragma("GCC diagnostic ignored \"-Wtautological-compare\"")   \
+          if (! (cond))                                               \
+          {                                                           \
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
+          dgettext ("gnunet", "Assertion failed at %s:%d. Aborting.\n"), \
+          __FILE__,                                     \
+          __LINE__);                                    \
+          GNUNET_abort_ ();                                         \
+          }                                                           \
+          _Pragma("GCC diagnostic pop")                                  \
+          } while (0)
 #else
 /* older GCC/clangs do not support -Wtautological-compare */
 #define GNUNET_assert(cond)                                     \
-  do                                                            \
-  {                                                             \
-    if (! (cond))                                               \
-    {                                                           \
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
-                  dgettext ("gnunet", "Assertion failed at %s:%d. Aborting.\n"), \
-                  __FILE__,                                     \
-                  __LINE__);                                    \
-      GNUNET_abort_ ();                                         \
-    }                                                           \
-  } while (0)
+        do                                                            \
+        {                                                             \
+          if (! (cond))                                               \
+          {                                                           \
+            GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
+                        dgettext ("gnunet", \
+                                  "Assertion failed at %s:%d. Aborting.\n"), \
+                        __FILE__,                                     \
+                        __LINE__);                                    \
+            GNUNET_abort_ ();                                         \
+          }                                                           \
+        } while (0)
 #endif
 
 /**
@@ -920,17 +965,18 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * Use this for fatal errors that cannot be handled
  */
 #define GNUNET_assert_at(cond, f, l)                            \
-  do                                                            \
-  {                                                             \
-    if (! (cond))                                               \
-    {                                                           \
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
-                  dgettext ("gnunet", "Assertion failed at %s:%d. Aborting.\n"), \
-                  f,                                            \
-                  l);                                           \
-      GNUNET_abort_ ();                                         \
-    }                                                           \
-  } while (0)
+        do                                                            \
+        {                                                             \
+          if (! (cond))                                               \
+          {                                                           \
+            GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                      \
+                        dgettext ("gnunet", \
+                                  "Assertion failed at %s:%d. Aborting.\n"), \
+                        f,                                            \
+                        l);                                           \
+            GNUNET_abort_ ();                                         \
+          }                                                           \
+        } while (0)
 
 
 /**
@@ -941,21 +987,23 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * @param comp Component string to use for logging
  */
 #define GNUNET_assert_from(cond, comp)                               \
-  do                                                                 \
-  {                                                                  \
-    if (! (cond))                                                    \
-    {                                                                \
-      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,                      \
-                       comp,                                         \
-                       dgettext ("gnunet", "Assertion failed at %s:%d. Aborting.\n"), \
-                       __FILE__,                                     \
-                       __LINE__);                                    \
-      GNUNET_abort_ ();                                              \
-    }                                                                \
-  } while (0)
-
-
-#if HAVE_STATIC_ASSERT
+        do                                                                 \
+        {                                                                  \
+          if (! (cond))                                                    \
+          {                                                                \
+            GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,                      \
+                             comp,                                         \
+                             dgettext ("gnunet", \
+                                       "Assertion failed at %s:%d. Aborting.\n") \
+                             , \
+                             __FILE__,                                     \
+                             __LINE__);                                    \
+            GNUNET_abort_ ();                                              \
+          }                                                                \
+        } while (0)
+
+
+#ifdef _Static_assert
 /**
  * Assertion to be checked (if supported by C compiler) at
  * compile time, otherwise checked at runtime and resulting
@@ -983,16 +1031,16 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * not fatal (can be handled) but should not occur.
  */
 #define GNUNET_break(cond)                            \
-  do                                                  \
-  {                                                   \
-    if (! (cond))                                     \
-    {                                                 \
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,            \
-                  dgettext ("gnunet", "Assertion failed at %s:%d.\n"),   \
-                  __FILE__,                           \
-                  __LINE__);                          \
-    }                                                 \
-  } while (0)
+        do                                                  \
+        {                                                   \
+          if (! (cond))                                     \
+          {                                                 \
+            GNUNET_log (GNUNET_ERROR_TYPE_ERROR,            \
+                        dgettext ("gnunet", "Assertion failed at %s:%d.\n"),   \
+                        __FILE__,                           \
+                        __LINE__);                          \
+          }                                                 \
+        } while (0)
 
 
 /**
@@ -1005,16 +1053,17 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * development and testing.  "OP == other peer".
  */
 #define GNUNET_break_op(cond)                                             \
-  do                                                                      \
-  {                                                                       \
-    if (! (cond))                                                         \
-    {                                                                     \
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,     \
-                  dgettext ("gnunet", "External protocol violation detected at %s:%d.\n"), \
-                  __FILE__,                                               \
-                  __LINE__);                                              \
-    }                                                                     \
-  } while (0)
+        do                                                                      \
+        {                                                                       \
+          if (! (cond))                                                         \
+          {                                                                     \
+            GNUNET_log (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,     \
+                        dgettext ("gnunet", \
+                                  "External protocol violation detected at %s:%d.\n"), \
+                        __FILE__,                                               \
+                        __LINE__);                                              \
+          }                                                                     \
+        } while (0)
 
 
 /**
@@ -1024,15 +1073,16 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * by strerror(errno).
  */
 #define GNUNET_log_strerror(level, cmd)                      \
-  do                                                         \
-  {                                                          \
-    GNUNET_log (level,                                       \
-                dgettext ("gnunet", "`%s' failed at %s:%d with error: %s\n"), \
-                cmd,                                         \
-                __FILE__,                                    \
-                __LINE__,                                    \
-                strerror (errno));                           \
-  } while (0)
+        do                                                         \
+        {                                                          \
+          GNUNET_log (level,                                       \
+                      dgettext ("gnunet", \
+                                "`%s' failed at %s:%d with error: %s\n"), \
+                      cmd,                                         \
+                      __FILE__,                                    \
+                      __LINE__,                                    \
+                      strerror (errno));                           \
+        } while (0)
 
 
 /**
@@ -1042,16 +1092,17 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * by strerror(errno).
  */
 #define GNUNET_log_from_strerror(level, component, cmd)           \
-  do                                                              \
-  {                                                               \
-    GNUNET_log_from (level,                                       \
-                     component,                                   \
-                     dgettext ("gnunet", "`%s' failed at %s:%d with error: %s\n"), \
-                     cmd,                                         \
-                     __FILE__,                                    \
-                     __LINE__,                                    \
-                     strerror (errno));                           \
-  } while (0)
+        do                                                              \
+        {                                                               \
+          GNUNET_log_from (level,                                       \
+                           component,                                   \
+                           dgettext ("gnunet", \
+                                     "`%s' failed at %s:%d with error: %s\n"), \
+                           cmd,                                         \
+                           __FILE__,                                    \
+                           __LINE__,                                    \
+                           strerror (errno));                           \
+        } while (0)
 
 
 /**
@@ -1061,16 +1112,17 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * by strerror(errno).
  */
 #define GNUNET_log_strerror_file(level, cmd, filename)                    \
-  do                                                                      \
-  {                                                                       \
-    GNUNET_log (level,                                                    \
-                dgettext ("gnunet", "`%s' failed on file `%s' at %s:%d with error: %s\n"), \
-                cmd,                                                      \
-                filename,                                                 \
-                __FILE__,                                                 \
-                __LINE__,                                                 \
-                strerror (errno));                                        \
-  } while (0)
+        do                                                                      \
+        {                                                                       \
+          GNUNET_log (level,                                                    \
+                      dgettext ("gnunet", \
+                                "`%s' failed on file `%s' at %s:%d with error: %s\n"), \
+                      cmd,                                                      \
+                      filename,                                                 \
+                      __FILE__,                                                 \
+                      __LINE__,                                                 \
+                      strerror (errno));                                        \
+        } while (0)
 
 
 /**
@@ -1080,17 +1132,18 @@ GNUNET_error_type_to_string (enum GNUNET_ErrorType kind);
  * by strerror(errno).
  */
 #define GNUNET_log_from_strerror_file(level, component, cmd, filename)         \
-  do                                                                           \
-  {                                                                            \
-    GNUNET_log_from (level,                                                    \
-                     component,                                                \
-                     dgettext ("gnunet", "`%s' failed on file `%s' at %s:%d with error: %s\n"), \
-                     cmd,                                                      \
-                     filename,                                                 \
-                     __FILE__,                                                 \
-                     __LINE__,                                                 \
-                     strerror (errno));                                        \
-  } while (0)
+        do                                                                           \
+        {                                                                            \
+          GNUNET_log_from (level,                                                    \
+                           component,                                                \
+                           dgettext ("gnunet", \
+                                     "`%s' failed on file `%s' at %s:%d with error: %s\n"), \
+                           cmd,                                                      \
+                           filename,                                                 \
+                           __FILE__,                                                 \
+                           __LINE__,                                                 \
+                           strerror (errno));                                        \
+        } while (0)
 
 /* ************************* endianness conversion ****************** */
 
@@ -1183,7 +1236,7 @@ GNUNET_ntoh_double (double d);
  * the first element!
  */
 #define GNUNET_memcmp(a, b)       \
-  ({                              \
+        ({                              \
     const typeof (*b) * _a = (a);  \
     const typeof (*a) * _b = (b);  \
     memcmp (_a, _b, sizeof(*a)); \
@@ -1212,7 +1265,7 @@ GNUNET_memcmp_ct_ (const void *b1,
  * the first element!
  */
 #define GNUNET_memcmp_priv(a, b)       \
-  ({                              \
+        ({                              \
     const typeof (*b) * _a = (a);  \
     const typeof (*a) * _b = (b);  \
     GNUNET_memcmp_ct_ (_a, _b, sizeof(*a)); \
@@ -1225,9 +1278,9 @@ GNUNET_memcmp_ct_ (const void *b1,
  * @param a pointer to @a n bytes which should be tested for the
  *          entire memory being zero'ed out.
  * @param n number of bytes in @a to be tested
- * @return GNUNET_YES if a is zero, GNUNET_NO otherwise
+ * @return true if @a a is zero, false_NO otherwise
  */
-enum GNUNET_GenericReturnValue
+bool
 GNUNET_is_zero_ (const void *a,
                  size_t n);
 
@@ -1240,7 +1293,7 @@ GNUNET_is_zero_ (const void *a,
  * @return GNUNET_YES if a is zero, GNUNET_NO otherwise
  */
 #define GNUNET_is_zero(a)           \
-  GNUNET_is_zero_ (a, sizeof (*a))
+        GNUNET_is_zero_ ((a), sizeof (*(a)))
 
 
 /**
@@ -1253,15 +1306,16 @@ GNUNET_is_zero_ (const void *a,
  * @param n number of bytes to copy
  */
 #define GNUNET_memcpy(dst, src, n) \
-  do                               \
-  {                                \
-    if (0 != n)                    \
-    {                              \
-      (void) memcpy (dst, src, n); \
-    }                              \
-  } while (0)
+        do                               \
+        {                                \
+          if (0 != n)                    \
+          {                              \
+            (void) memcpy (dst, src, n); \
+          }                              \
+        } while (0)
 
 
+/* *INDENT-OFF* */
 /**
  * @ingroup memory
  * Allocate a size @a n array with structs or unions of the given @a type.
@@ -1275,6 +1329,7 @@ GNUNET_is_zero_ (const void *a,
     GNUNET_assert (SIZE_MAX / sizeof (type) >= n);     \
     (type *) GNUNET_malloc ((n) * sizeof(type));   \
   })
+/* *INDENT-ON* */
 
 /**
  * @ingroup memory
@@ -1286,7 +1341,7 @@ GNUNET_is_zero_ (const void *a,
  * @param type name of the struct or union, i.e. pass 'struct Foo'.
  */
 #define GNUNET_new_array_2d(n, m, type) \
-  (type **) GNUNET_xnew_array_2d_ (n, m, sizeof(type), __FILE__, __LINE__)
+        (type **) GNUNET_xnew_array_2d_ (n, m, sizeof(type), __FILE__, __LINE__)
 
 /**
  * @ingroup memory
@@ -1299,7 +1354,8 @@ GNUNET_is_zero_ (const void *a,
  * @param type name of the struct or union, i.e. pass 'struct Foo'.
  */
 #define GNUNET_new_array_3d(n, m, o, type) \
-  (type ***) GNUNET_xnew_array_3d_ (n, m, o, sizeof(type), __FILE__, __LINE__)
+        (type ***) GNUNET_xnew_array_3d_ (n, m, o, sizeof(type), __FILE__, \
+                                          __LINE__)
 
 /**
  * @ingroup memory
@@ -1331,7 +1387,7 @@ GNUNET_is_zero_ (const void *a,
  * @return pointer to size bytes of memory, NULL if we do not have enough memory
  */
 #define GNUNET_malloc_large(size) \
-  GNUNET_xmalloc_unchecked_ (size, __FILE__, __LINE__)
+        GNUNET_xmalloc_unchecked_ (size, __FILE__, __LINE__)
 
 
 /**
@@ -1344,7 +1400,7 @@ GNUNET_is_zero_ (const void *a,
  * @return pointer to size bytes of memory
  */
 #define GNUNET_realloc(ptr, size) \
-  GNUNET_xrealloc_ (ptr, size, __FILE__, __LINE__)
+        GNUNET_xrealloc_ (ptr, size, __FILE__, __LINE__)
 
 
 /**
@@ -1371,8 +1427,8 @@ GNUNET_is_zero_ (const void *a,
  *     been returned by #GNUNET_strdup, #GNUNET_strndup, #GNUNET_malloc or #GNUNET_array_grow earlier.  NULL is allowed.
  */
 #define GNUNET_free(ptr) do { \
-    GNUNET_xfree_ (ptr, __FILE__, __LINE__); \
-    ptr = NULL; \
+          GNUNET_xfree_ (ptr, __FILE__, __LINE__); \
+          ptr = NULL; \
 } while (0)
 
 
@@ -1386,6 +1442,7 @@ GNUNET_is_zero_ (const void *a,
  */
 #define GNUNET_strdup(a) GNUNET_xstrdup_ (a, __FILE__, __LINE__)
 
+
 /**
  * @ingroup memory
  * Wrapper around #GNUNET_xstrndup_.  Makes a partial copy of the string
@@ -1396,7 +1453,7 @@ GNUNET_is_zero_ (const void *a,
  * @return a partial copy of the string including zero-termination
  */
 #define GNUNET_strndup(a, length) \
-  GNUNET_xstrndup_ (a, length, __FILE__, __LINE__)
+        GNUNET_xstrndup_ (a, length, __FILE__, __LINE__)
 
 /**
  * @ingroup memory
@@ -1434,12 +1491,12 @@ GNUNET_is_zero_ (const void *a,
  *        free the vector (then, arr will be NULL afterwards).
  */
 #define GNUNET_array_grow(arr, size, tsize) \
-  GNUNET_xgrow_ ((void **) &(arr),          \
-                 sizeof((arr)[0]),         \
-                 &size,                     \
-                 tsize,                     \
-                 __FILE__,                  \
-                 __LINE__)
+        GNUNET_xgrow_ ((void **) &(arr),          \
+                       sizeof((arr)[0]),         \
+                       &size,                     \
+                       tsize,                     \
+                       __FILE__,                  \
+                       __LINE__)
 
 /**
  * @ingroup memory
@@ -1455,12 +1512,12 @@ GNUNET_is_zero_ (const void *a,
  * @param element the element that will be appended to the array
  */
 #define GNUNET_array_append(arr, len, element) \
-  do                                            \
-  {                                             \
-    GNUNET_assert ((len) + 1 > (len)); \
-    GNUNET_array_grow (arr, len, len + 1);    \
-    (arr) [len - 1] = element;                  \
-  } while (0)
+        do                                            \
+        {                                             \
+          GNUNET_assert ((len) + 1 > (len)); \
+          GNUNET_array_grow (arr, len, len + 1);    \
+          (arr) [len - 1] = element;                  \
+        } while (0)
 
 
 /**
@@ -1481,21 +1538,21 @@ GNUNET_is_zero_ (const void *a,
  *        will be updated to reflect the new address. The TYPE of
  *        arr is important since size is the number of elements and
  *        not the size in bytes
- * @param len the number of elements in the existing vector (number
+ * @param len2 the number of elements in the existing vector (number
  *        of elements to copy over), will be updated with the new
  *        array size
 
  */
 #define GNUNET_array_concatenate(arr1, len1, arr2, len2)   \
-  do                                            \
-  {                                             \
-    const typeof (*arr2) * _a1 = (arr1);  \
-    const typeof (*arr1) * _a2 = (arr2);  \
-    GNUNET_assert ((len1) + (len2) >= (len1));                    \
-    GNUNET_assert (SIZE_MAX / sizeof (*_a1) >= ((len1) + (len2))); \
-    GNUNET_array_grow (arr1, len1, (len1) + (len2));            \
-    memcpy (&(arr1) [(len1) - (len2)], _a2, (len2) * sizeof (*arr1));    \
-  } while (0)
+        do                                            \
+        {                                             \
+          const typeof (*arr2) * _a1 = (arr1);  \
+          const typeof (*arr1) * _a2 = (arr2);  \
+          GNUNET_assert ((len1) + (len2) >= (len1));                    \
+          GNUNET_assert (SIZE_MAX / sizeof (*_a1) >= ((len1) + (len2))); \
+          GNUNET_array_grow (arr1, len1, (len1) + (len2));            \
+          memcpy (&(arr1) [(len1) - (len2)], _a2, (len2) * sizeof (*arr1));    \
+        } while (0)
 
 
 /**
@@ -1546,7 +1603,9 @@ __attribute__ ((format (printf, 2, 3)));
  * @return allocated memory, never NULL
  */
 void *
-GNUNET_xmalloc_ (size_t size, const char *filename, int linenumber);
+GNUNET_xmalloc_ (size_t size,
+                 const char *filename,
+                 int linenumber);
 
 
 /**
@@ -1626,7 +1685,9 @@ GNUNET_xmemdup_ (const void *buf,
  * @return pointer to size bytes of memory, NULL if we do not have enough memory
  */
 void *
-GNUNET_xmalloc_unchecked_ (size_t size, const char *filename, int linenumber);
+GNUNET_xmalloc_unchecked_ (size_t size,
+                           const char *filename,
+                           int linenumber);
 
 
 /**
@@ -1634,7 +1695,10 @@ GNUNET_xmalloc_unchecked_ (size_t size, const char *filename, int linenumber);
  * memory is available.
  */
 void *
-GNUNET_xrealloc_ (void *ptr, size_t n, const char *filename, int linenumber);
+GNUNET_xrealloc_ (void *ptr,
+                  size_t n,
+                  const char *filename,
+                  int linenumber);
 
 
 /**
@@ -1647,7 +1711,9 @@ GNUNET_xrealloc_ (void *ptr, size_t n, const char *filename, int linenumber);
  * @param linenumber line where this call is being made (for debugging)
  */
 void
-GNUNET_xfree_ (void *ptr, const char *filename, int linenumber);
+GNUNET_xfree_ (void *ptr,
+               const char *filename,
+               int linenumber);
 
 
 /**
@@ -1658,7 +1724,9 @@ GNUNET_xfree_ (void *ptr, const char *filename, int linenumber);
  * @return the duplicated string
  */
 char *
-GNUNET_xstrdup_ (const char *str, const char *filename, int linenumber);
+GNUNET_xstrdup_ (const char *str,
+                 const char *filename,
+                 int linenumber);
 
 /**
  * Dup partially a string. Don't call GNUNET_xstrndup_ directly. Use the #GNUNET_strndup macro.
@@ -1714,7 +1782,7 @@ GNUNET_copy_message (const struct GNUNET_MessageHeader *msg);
  * Set the async scope for the current thread.
  *
  * @param aid the async scope identifier
- * @param old_scope[out] location to save the old scope
+ * @param[out] old_scope location to save the old scope
  */
 void
 GNUNET_async_scope_enter (const struct GNUNET_AsyncScopeId *aid,
@@ -1828,6 +1896,8 @@ enum GNUNET_SCHEDULER_Priority
 };
 
 
+/* *INDENT-OFF* */
+
 #if 0 /* keep Emacsens' auto-indent happy */
 {
 #endif
diff --git a/src/include/gnunet_config.h.in b/src/include/gnunet_config.h.in
new file mode 100644
index 000000000..5dff759ae
--- /dev/null
+++ b/src/include/gnunet_config.h.in
@@ -0,0 +1,58 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+#ifndef GNUNET_CONFIG_H
+#define GNUNET_CONFIG_H
+
+/**
+ * @author Martin Schanzenbach
+ *
+ * @file
+ * Convenience header including public (!) information on the
+ * installed GNUnet configuration.
+ *
+ */
+
+/* The version of GNUnet */
+#define GNUNET_VERSION "@gnunet_version@"
+
+/* Major version */
+#define GNUNET_MAJOR_VERSION @gnunet_major_version@
+
+/* Micro version */
+#define GNUNET_MINOR_VERSION @gnunet_minor_version@
+
+/* Mico version */
+#define GNUNET_MICRO_VERSION @gnunet_micro_version@
+
+/* Set to 1 is this is an experimental build */
+#define GNUNET_EXPERIMENTAL @enable_experimental@
+
+/* Set to 1 if GnuTLS has DANE support */
+#define GNUNET_CURL_GNUTLS @curl_gnutls@
+
+/**
+ * Set to 1 if file-sharing meta data parsing is built with
+ * libextractor, which means that callers to the API must use also use
+ * libextractor.
+ */
+#define GNUNET_FS_EXTRACTOR_ENABLED @extractor@
+
+#endif
diff --git a/src/include/gnunet_configuration_lib.h b/src/include/gnunet_configuration_lib.h
index 570546b68..132172516 100644
--- a/src/include/gnunet_configuration_lib.h
+++ b/src/include/gnunet_configuration_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +35,7 @@
 #ifndef GNUNET_CONFIGURATION_LIB_H
 #define GNUNET_CONFIGURATION_LIB_H
 
+
 #include "gnunet_time_lib.h"
 
 #ifdef __cplusplus
@@ -61,7 +66,8 @@ GNUNET_CONFIGURATION_create (void);
  * @return duplicate configuration
  */
 struct GNUNET_CONFIGURATION_Handle *
-GNUNET_CONFIGURATION_dup (const struct GNUNET_CONFIGURATION_Handle *cfg);
+GNUNET_CONFIGURATION_dup (
+  const struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
@@ -70,7 +76,8 @@ GNUNET_CONFIGURATION_dup (const struct GNUNET_CONFIGURATION_Handle *cfg);
  * @param cfg configuration to destroy
  */
 void
-GNUNET_CONFIGURATION_destroy (struct GNUNET_CONFIGURATION_Handle *cfg);
+GNUNET_CONFIGURATION_destroy (
+  struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
@@ -83,8 +90,9 @@ GNUNET_CONFIGURATION_destroy (struct GNUNET_CONFIGURATION_Handle *cfg);
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_load (struct GNUNET_CONFIGURATION_Handle *cfg,
-                           const char *filename);
+GNUNET_CONFIGURATION_load (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *filename);
 
 
 /**
@@ -96,8 +104,9 @@ GNUNET_CONFIGURATION_load (struct GNUNET_CONFIGURATION_Handle *cfg,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_load_from (struct GNUNET_CONFIGURATION_Handle *cfg,
-                                const char *defaults_d);
+GNUNET_CONFIGURATION_load_from (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *defaults_d);
 
 
 /**
@@ -133,8 +142,9 @@ GNUNET_CONFIGURATION_default_filename (void);
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_parse (struct GNUNET_CONFIGURATION_Handle *cfg,
-                            const char *filename);
+GNUNET_CONFIGURATION_parse (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *filename);
 
 
 /**
@@ -146,8 +156,9 @@ GNUNET_CONFIGURATION_parse (struct GNUNET_CONFIGURATION_Handle *cfg,
  *           present. This memory should be freed by the caller
  */
 char *
-GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                                size_t *size);
+GNUNET_CONFIGURATION_serialize (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  size_t *size);
 
 
 /**
@@ -160,8 +171,9 @@ GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
  *           present. This memory should be freed by the caller
  */
 char *
-GNUNET_CONFIGURATION_serialize_diagnostics (const struct
-                                            GNUNET_CONFIGURATION_Handle *cfg);
+GNUNET_CONFIGURATION_serialize_diagnostics (
+  const struct GNUNET_CONFIGURATION_Handle *cfg);
+
 
 /**
  * De-serializes configuration
@@ -170,14 +182,15 @@ GNUNET_CONFIGURATION_serialize_diagnostics (const struct
  * @param mem the memory block of serialized configuration
  * @param size the size of the memory block
  * @param source_filename source filename, will be used
- *        to resolve relative @INLINE@ statements
+ *        to resolve relative \@INLINE\@ statements
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
-                                  const char *mem,
-                                  size_t size,
-                                  const char *source_filename);
+GNUNET_CONFIGURATION_deserialize (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *mem,
+  size_t size,
+  const char *source_filename);
 
 
 /**
@@ -188,8 +201,9 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_write (struct GNUNET_CONFIGURATION_Handle *cfg,
-                            const char *filename);
+GNUNET_CONFIGURATION_write (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *filename);
 
 
 /**
@@ -228,7 +242,8 @@ GNUNET_CONFIGURATION_get_diff (
  * @return #GNUNET_NO if clean, #GNUNET_YES if dirty, #GNUNET_SYSERR on error (i.e. last save failed)
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_is_dirty (const struct GNUNET_CONFIGURATION_Handle *cfg);
+GNUNET_CONFIGURATION_is_dirty (
+  const struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
@@ -239,8 +254,9 @@ GNUNET_CONFIGURATION_is_dirty (const struct GNUNET_CONFIGURATION_Handle *cfg);
  * @return status code
  */
 typedef enum GNUNET_GenericReturnValue
-(*GNUNET_CONFIGURATION_Callback)(void *cls,
-                                 const struct GNUNET_CONFIGURATION_Handle *cfg);
+(*GNUNET_CONFIGURATION_Callback)(
+  void *cls,
+  const struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
@@ -255,9 +271,10 @@ typedef enum GNUNET_GenericReturnValue
  *   otherwise return value from @a cb.
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_parse_and_run (const char *filename,
-                                    GNUNET_CONFIGURATION_Callback cb,
-                                    void *cb_cls);
+GNUNET_CONFIGURATION_parse_and_run (
+  const char *filename,
+  GNUNET_CONFIGURATION_Callback cb,
+  void *cb_cls);
 
 /**
  * Enable extra diagnostics.  Will produce more log output
@@ -266,8 +283,8 @@ GNUNET_CONFIGURATION_parse_and_run (const char *filename,
  * @param cfg configuration handle
  */
 void
-GNUNET_CONFIGURATION_enable_diagnostics (struct
-                                         GNUNET_CONFIGURATION_Handle *cfg);
+GNUNET_CONFIGURATION_enable_diagnostics (
+  struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
@@ -292,8 +309,8 @@ typedef void
  * @param section name of the section
  */
 typedef void
-(*GNUNET_CONFIGURATION_Section_Iterator) (void *cls,
-                                          const char *section);
+(*GNUNET_CONFIGURATION_SectionIterator) (void *cls,
+                                         const char *section);
 
 
 /**
@@ -304,9 +321,10 @@ typedef void
  * @param iter_cls closure for @a iter
  */
 void
-GNUNET_CONFIGURATION_iterate (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                              GNUNET_CONFIGURATION_Iterator iter,
-                              void *iter_cls);
+GNUNET_CONFIGURATION_iterate (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  GNUNET_CONFIGURATION_Iterator iter,
+  void *iter_cls);
 
 
 /**
@@ -317,11 +335,10 @@ GNUNET_CONFIGURATION_iterate (const struct GNUNET_CONFIGURATION_Handle *cfg,
  * @param iter_cls closure for @a iter
  */
 void
-GNUNET_CONFIGURATION_iterate_sections (const struct
-                                       GNUNET_CONFIGURATION_Handle *cfg,
-                                       GNUNET_CONFIGURATION_Section_Iterator
-                                       iter,
-                                       void *iter_cls);
+GNUNET_CONFIGURATION_iterate_sections (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  GNUNET_CONFIGURATION_SectionIterator iter,
+  void *iter_cls);
 
 
 /**
@@ -331,8 +348,9 @@ GNUNET_CONFIGURATION_iterate_sections (const struct
  * @param section name of the section to remove
  */
 void
-GNUNET_CONFIGURATION_remove_section (struct GNUNET_CONFIGURATION_Handle *cfg,
-                                     const char *section);
+GNUNET_CONFIGURATION_remove_section (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section);
 
 
 /**
@@ -345,11 +363,11 @@ GNUNET_CONFIGURATION_remove_section (struct GNUNET_CONFIGURATION_Handle *cfg,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_number (const struct
-                                       GNUNET_CONFIGURATION_Handle *cfg,
-                                       const char *section,
-                                       const char *option,
-                                       unsigned long long *number);
+GNUNET_CONFIGURATION_get_value_number (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  unsigned long long *number);
 
 
 /**
@@ -362,11 +380,11 @@ GNUNET_CONFIGURATION_get_value_number (const struct
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_float (const struct
-                                      GNUNET_CONFIGURATION_Handle *cfg,
-                                      const char *section,
-                                      const char *option,
-                                      float *number);
+GNUNET_CONFIGURATION_get_value_float (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  float *number);
 
 
 /**
@@ -379,11 +397,11 @@ GNUNET_CONFIGURATION_get_value_float (const struct
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_time (const struct
-                                     GNUNET_CONFIGURATION_Handle *cfg,
-                                     const char *section,
-                                     const char *option,
-                                     struct GNUNET_TIME_Relative *time);
+GNUNET_CONFIGURATION_get_value_time (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  struct GNUNET_TIME_Relative *time);
 
 
 /**
@@ -396,11 +414,11 @@ GNUNET_CONFIGURATION_get_value_time (const struct
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_size (const struct
-                                     GNUNET_CONFIGURATION_Handle *cfg,
-                                     const char *section,
-                                     const char *option,
-                                     unsigned long long *size);
+GNUNET_CONFIGURATION_get_value_size (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  unsigned long long *size);
 
 
 /**
@@ -447,11 +465,11 @@ GNUNET_CONFIGURATION_get_value_string (
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_filename (const struct
-                                         GNUNET_CONFIGURATION_Handle *cfg,
-                                         const char *section,
-                                         const char *option,
-                                         char **value);
+GNUNET_CONFIGURATION_get_value_filename (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  char **value);
 
 
 /**
@@ -465,12 +483,13 @@ GNUNET_CONFIGURATION_get_value_filename (const struct
  * @return number of filenames iterated over, -1 on error
  */
 int
-GNUNET_CONFIGURATION_iterate_value_filenames (const struct
-                                              GNUNET_CONFIGURATION_Handle *cfg,
-                                              const char *section,
-                                              const char *option,
-                                              GNUNET_FileNameCallback cb,
-                                              void *cb_cls);
+GNUNET_CONFIGURATION_iterate_value_filenames (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  GNUNET_FileNameCallback cb,
+  void *cb_cls);
+
 
 /**
  * Iterate over values of a section in the configuration.
@@ -481,11 +500,12 @@ GNUNET_CONFIGURATION_iterate_value_filenames (const struct
  * @param iter_cls closure for @a iter
  */
 void
-GNUNET_CONFIGURATION_iterate_section_values (const struct
-                                             GNUNET_CONFIGURATION_Handle *cfg,
-                                             const char *section,
-                                             GNUNET_CONFIGURATION_Iterator iter,
-                                             void *iter_cls);
+GNUNET_CONFIGURATION_iterate_section_values (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  GNUNET_CONFIGURATION_Iterator iter,
+  void *iter_cls);
+
 
 /**
  * Get a configuration value that should be in a set of
@@ -500,12 +520,13 @@ GNUNET_CONFIGURATION_iterate_section_values (const struct
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_choice (const struct
-                                       GNUNET_CONFIGURATION_Handle *cfg,
-                                       const char *section,
-                                       const char *option,
-                                       const char *const *choices,
-                                       const char **value);
+GNUNET_CONFIGURATION_get_value_choice (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *const *choices,
+  const char **value);
+
 
 /**
  * Get a configuration value that should be in a set of
@@ -517,10 +538,10 @@ GNUNET_CONFIGURATION_get_value_choice (const struct
  * @return #GNUNET_YES, #GNUNET_NO or if option has no valid value, #GNUNET_SYSERR
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_get_value_yesno (const struct
-                                      GNUNET_CONFIGURATION_Handle *cfg,
-                                      const char *section,
-                                      const char *option);
+GNUNET_CONFIGURATION_get_value_yesno (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option);
 
 
 /**
@@ -589,10 +610,11 @@ GNUNET_CONFIGURATION_set_value_number (struct GNUNET_CONFIGURATION_Handle *cfg,
  * @param value value to set
  */
 void
-GNUNET_CONFIGURATION_set_value_string (struct GNUNET_CONFIGURATION_Handle *cfg,
-                                       const char *section,
-                                       const char *option,
-                                       const char *value);
+GNUNET_CONFIGURATION_set_value_string (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *value);
 
 
 /**
@@ -607,11 +629,11 @@ GNUNET_CONFIGURATION_set_value_string (struct GNUNET_CONFIGURATION_Handle *cfg,
  *         #GNUNET_SYSERR if the filename is not in the list
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_remove_value_filename (struct
-                                            GNUNET_CONFIGURATION_Handle *cfg,
-                                            const char *section,
-                                            const char *option,
-                                            const char *value);
+GNUNET_CONFIGURATION_remove_value_filename (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *value);
 
 
 /**
@@ -626,11 +648,11 @@ GNUNET_CONFIGURATION_remove_value_filename (struct
  *         #GNUNET_SYSERR if the filename already in the list
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_append_value_filename (struct
-                                            GNUNET_CONFIGURATION_Handle *cfg,
-                                            const char *section,
-                                            const char *option,
-                                            const char *value);
+GNUNET_CONFIGURATION_append_value_filename (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *value);
 
 
 /**
@@ -642,10 +664,8 @@ struct GNUNET_CONFIGURATION_ConfigSettings
 {
 
   /**
-   * Must be set to the API version, i.e.
-   * #GNUNET_UTIL_VERSION. Used to detect
-   * which version of the struct the client
-   * is using.
+   * Must be set to the API version, i.e.  #GNUNET_UTIL_VERSION. Used to
+   * detect which version of the struct the client is using.
    */
   unsigned int api_version;
 
@@ -689,7 +709,6 @@ struct GNUNET_CONFIGURATION_ConfigSettings
    */
   int full;
 
-
   /**
    * Return value from the operation, to be returned
    * from 'main'.
@@ -707,50 +726,52 @@ struct GNUNET_CONFIGURATION_ConfigSettings
  * @param cs configuration settings to initialize
  */
 #define GNUNET_CONFIGURATION_CONFIG_OPTIONS(cs) \
-  GNUNET_GETOPT_option_flag ( \
-    'F', \
-    "full", \
-    gettext_noop ( \
-      "write the full configuration file, including default values"), \
-    &(cs)->full), \
-  GNUNET_GETOPT_option_flag ( \
-    'f', \
-    "filename", \
-    gettext_noop ("interpret option value as a filename (with $-expansion)"), \
-    &(cs)->is_filename), \
-  GNUNET_GETOPT_option_string ('o', \
-                               "option", \
-                               "OPTION", \
-                               gettext_noop ("name of the option to access"), \
-                               &(cs)->option), \
-  GNUNET_GETOPT_option_flag ( \
-    'r', \
-    "rewrite", \
-    gettext_noop ( \
-      "rewrite the configuration file, even if nothing changed"), \
-    &(cs)->rewrite), \
-  GNUNET_GETOPT_option_flag ( \
-    'd', \
-    "diagnostics", \
-    gettext_noop ( \
-      "output extra diagnostics"), \
-    &(cs)->diagnostics), \
-  GNUNET_GETOPT_option_flag ('S', \
-                             "list-sections", \
-                             gettext_noop ( \
-                               "print available configuration sections"), \
-                             &(cs)->list_sections), \
-  GNUNET_GETOPT_option_string ('s', \
-                               "section", \
-                               "SECTION", \
-                               gettext_noop ( \
-                                 "name of the section to access"), \
-                               &(cs)->section), \
-  GNUNET_GETOPT_option_string ('V', \
-                               "value", \
-                               "VALUE", \
-                               gettext_noop ("value to set"), \
-                               &(cs)->value)
+        GNUNET_GETOPT_option_flag ( \
+          'F', \
+          "full", \
+          gettext_noop ( \
+            "write the full configuration file, including default values"), \
+          &(cs)->full), \
+        GNUNET_GETOPT_option_flag ( \
+          'f', \
+          "filename", \
+          gettext_noop ( \
+            "interpret option value as a filename (with $-expansion)"), \
+          &(cs)->is_filename), \
+        GNUNET_GETOPT_option_string ('o', \
+                                     "option", \
+                                     "OPTION", \
+                                     gettext_noop ( \
+                                       "name of the option to access"), \
+                                     &(cs)->option), \
+        GNUNET_GETOPT_option_flag ( \
+          'r', \
+          "rewrite", \
+          gettext_noop ( \
+            "rewrite the configuration file, even if nothing changed"), \
+          &(cs)->rewrite), \
+        GNUNET_GETOPT_option_flag ( \
+          'd', \
+          "diagnostics", \
+          gettext_noop ( \
+            "output extra diagnostics"), \
+          &(cs)->diagnostics), \
+        GNUNET_GETOPT_option_flag ('S', \
+                                   "list-sections", \
+                                   gettext_noop ( \
+                                     "print available configuration sections"), \
+                                   &(cs)->list_sections), \
+        GNUNET_GETOPT_option_string ('s', \
+                                     "section", \
+                                     "SECTION", \
+                                     gettext_noop ( \
+                                       "name of the section to access"), \
+                                     &(cs)->section), \
+        GNUNET_GETOPT_option_string ('V', \
+                                     "value", \
+                                     "VALUE", \
+                                     gettext_noop ("value to set"), \
+                                     &(cs)->value)
 
 
 /**
@@ -793,3 +814,5 @@ GNUNET_CONFIGURATION_config_tool_run (
 #endif
 
 /** @} */ /* end of group configuration */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_consensus_service.h b/src/include/gnunet_consensus_service.h
index 9387aa095..47a928d9c 100644
--- a/src/include/gnunet_consensus_service.h
+++ b/src/include/gnunet_consensus_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Sets
+ * @{
+ *
  * @author Florian Dold
  *
  * @file
@@ -40,6 +43,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 #include "gnunet_configuration_lib.h"
@@ -78,8 +82,8 @@ struct GNUNET_CONSENSUS_Handle;
  * Create a consensus session.  The set being reconciled is initially
  * empty.
  *
- * @param cfg
- * @param num_peers
+ * @param cfg configuration to use for connecting to the consensus service
+ * @param num_peers number of peers in the peers array
  * @param peers array of peers participating in this consensus session
  *              Inclusion of the local peer is optional.
  * @param session_id session identifier
@@ -180,3 +184,5 @@ GNUNET_CONSENSUS_destroy (struct GNUNET_CONSENSUS_Handle *consensus);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_container_lib.h b/src/include/gnunet_container_lib.h
index 3eb80595c..8f36f1c61 100644
--- a/src/include/gnunet_container_lib.h
+++ b/src/include/gnunet_container_lib.h
@@ -19,35 +19,57 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  * @author Nils Durner
  *
  * @file
  * Container classes for GNUnet
  *
- * @defgroup hashmap  Container library: MultiHashMap
+ * @addtogroup container
+ * Common data structures in GNUnet programs
+ * @{
+ *
+ * @defgroup hashmap  MultiHashMap
  * Hash map with multiple values per key.
  *
  * @see [Documentation](https://gnunet.org/util_multihashmap)
  *
- * @defgroup heap  Container library: Heap
+ * @defgroup heap  Heap
  * Min- or max-heap with arbitrary element removal
  *
- * @defgroup bloomfilter  Container library: Bloom filter
+ * @defgroup bloomfilter  Bloom filter
  * Probabilistic set tests
  *
- * @defgroup dll  Container library: Doubly-linked list
+ * @defgroup dll  Doubly-linked list
  *
  * @see [Documentation](https://gnunet.org/mdll-api)
  *
- * @defgroup metadata  Container library: Metadata
- * GNU libextractor key-value pairs
+ *
+ * @}
  */
 
+#include "gnunet_common.h"
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_CONTAINER_LIB_H
 #define GNUNET_CONTAINER_LIB_H
 
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+
 /* add error and config prototypes */
+
 #include "gnunet_crypto_lib.h"
 
 
@@ -87,114 +109,6 @@ char *
 GNUNET_decompress (const char *input, size_t input_size, size_t output_size);
 
 
-#if HAVE_EXTRACTOR_H
-
-#include <extractor.h>
-
-#else
-
-/* definitions from extractor.h we need for the build */
-
-/**
- * Enumeration defining various sources of keywords.  See also
- * http://dublincore.org/documents/1998/09/dces/
- */
-enum EXTRACTOR_MetaType
-{
-  EXTRACTOR_METATYPE_RESERVED = 0,
-  EXTRACTOR_METATYPE_MIMETYPE = 1,
-  EXTRACTOR_METATYPE_FILENAME = 2,
-  EXTRACTOR_METATYPE_COMMENT = 3,
-  EXTRACTOR_METATYPE_TITLE = 4,
-  EXTRACTOR_METATYPE_BOOK_TITLE = 5,
-  EXTRACTOR_METATYPE_JOURNAL_NAME = 8,
-  EXTRACTOR_METATYPE_AUTHOR_NAME = 13,
-  EXTRACTOR_METATYPE_PUBLICATION_DATE = 24,
-  EXTRACTOR_METATYPE_URL = 29,
-  EXTRACTOR_METATYPE_URI = 30,
-  EXTRACTOR_METATYPE_ISRC = 31,
-  EXTRACTOR_METATYPE_UNKNOWN = 45,
-  EXTRACTOR_METATYPE_DESCRIPTION = 46,
-  EXTRACTOR_METATYPE_KEYWORDS = 49,
-  EXTRACTOR_METATYPE_SUBJECT = 52,
-  EXTRACTOR_METATYPE_PACKAGE_NAME = 69,
-  EXTRACTOR_METATYPE_THUMBNAIL = 114,
-  EXTRACTOR_METATYPE_ALBUM = 129,
-  EXTRACTOR_METATYPE_ARTIST = 130,
-  EXTRACTOR_METATYPE_ORIGINAL_TITLE = 162,
-  EXTRACTOR_METATYPE_GNUNET_FULL_DATA = 174,
-  EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME = 180,
-};
-
-/**
- * Format in which the extracted meta data is presented.
- */
-enum EXTRACTOR_MetaFormat
-{
-  /**
-   * Format is unknown.
-   */
-  EXTRACTOR_METAFORMAT_UNKNOWN = 0,
-
-  /**
-   * 0-terminated, UTF-8 encoded string.  "data_len"
-   * is strlen(data)+1.
-   */
-  EXTRACTOR_METAFORMAT_UTF8 = 1,
-
-  /**
-   * Some kind of binary format, see given Mime type.
-   */
-  EXTRACTOR_METAFORMAT_BINARY = 2,
-
-  /**
-   * 0-terminated string.  The specific encoding is unknown.
-   * "data_len" is strlen (data)+1.
-   */
-  EXTRACTOR_METAFORMAT_C_STRING = 3
-};
-
-
-/**
- * Type of a function that libextractor calls for each
- * meta data item found.
- *
- * @param cls closure (user-defined)
- * @param plugin_name name of the plugin that produced this value;
- *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
- *        used in the main libextractor library and yielding
- *        meta data).
- * @param type libextractor-type describing the meta data
- * @param format basic format information about @a data
- * @param data_mime_type mime-type of @a data (not of the original file);
- *        can be NULL (if mime-type is not known)
- * @param data actual meta-data found
- * @param data_len number of bytes in @a data
- * @return 0 to continue extracting, 1 to abort
- */
-typedef int (*EXTRACTOR_MetaDataProcessor) (void *cls,
-                                            const char *plugin_name,
-                                            enum EXTRACTOR_MetaType type,
-                                            enum EXTRACTOR_MetaFormat format,
-                                            const char *data_mime_type,
-                                            const char *data,
-                                            size_t data_len);
-
-#endif
-
-#ifndef EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME
-/* hack for LE < 0.6.3 */
-#define EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME 180
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#if 0 /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
 /* ******************* bloomfilter ***************** */
 
 /**
@@ -264,7 +178,7 @@ GNUNET_CONTAINER_bloomfilter_init (const char *data,
  * @param size the size of the given @a data array
  * @return #GNUNET_SYSERR if the data array of the wrong size
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_bloomfilter_get_raw_data (
   const struct GNUNET_CONTAINER_BloomFilter *bf,
   char *data,
@@ -277,9 +191,9 @@ GNUNET_CONTAINER_bloomfilter_get_raw_data (
  *
  * @param e the element
  * @param bf the filter
- * @return #GNUNET_YES if the element is in the filter, #GNUNET_NO if not
+ * @return true if the element is in the filter, false if not
  */
-int
+bool
 GNUNET_CONTAINER_bloomfilter_test (
   const struct GNUNET_CONTAINER_BloomFilter *bf,
   const struct GNUNET_HashCode *e);
@@ -378,7 +292,7 @@ GNUNET_CONTAINER_bloomfilter_clear (struct GNUNET_CONTAINER_BloomFilter *bf);
  * @param size size of @a data
  * @return #GNUNET_OK on success
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_bloomfilter_or (struct GNUNET_CONTAINER_BloomFilter *bf,
                                  const char *data,
                                  size_t size);
@@ -394,7 +308,7 @@ GNUNET_CONTAINER_bloomfilter_or (struct GNUNET_CONTAINER_BloomFilter *bf,
  * @param to_or the bloomfilter to or-in
  * @return #GNUNET_OK on success
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_bloomfilter_or2 (
   struct GNUNET_CONTAINER_BloomFilter *bf,
   const struct GNUNET_CONTAINER_BloomFilter *to_or);
@@ -420,285 +334,6 @@ GNUNET_CONTAINER_bloomfilter_resize (struct GNUNET_CONTAINER_BloomFilter *bf,
                                      unsigned int k);
 
 
-/* ****************** metadata ******************* */
-
-/**
- * @ingroup metadata
- * Meta data to associate with a file, directory or namespace.
- */
-struct GNUNET_CONTAINER_MetaData;
-
-
-/**
- * @ingroup metadata
- * Create a fresh meta data container.
- *
- * @return empty meta-data container
- */
-struct GNUNET_CONTAINER_MetaData *
-GNUNET_CONTAINER_meta_data_create (void);
-
-
-/**
- * @ingroup metadata
- * Duplicate a MetaData token.
- *
- * @param md what to duplicate
- * @return duplicate meta-data container
- */
-struct GNUNET_CONTAINER_MetaData *
-GNUNET_CONTAINER_meta_data_duplicate (
-  const struct GNUNET_CONTAINER_MetaData *md);
-
-
-/**
- * @ingroup metadata
- * Free meta data.
- *
- * @param md what to free
- */
-void
-GNUNET_CONTAINER_meta_data_destroy (struct GNUNET_CONTAINER_MetaData *md);
-
-
-/**
- * @ingroup metadata
- * Test if two MDs are equal. We consider them equal if
- * the meta types, formats and content match (we do not
- * include the mime types and plugins names in this
- * consideration).
- *
- * @param md1 first value to check
- * @param md2 other value to check
- * @return #GNUNET_YES if they are equal
- */
-int
-GNUNET_CONTAINER_meta_data_test_equal (
-  const struct GNUNET_CONTAINER_MetaData *md1,
-  const struct GNUNET_CONTAINER_MetaData *md2);
-
-
-/**
- * @ingroup metadata
- * Extend metadata.
- *
- * @param md metadata to extend
- * @param plugin_name name of the plugin that produced this value;
- *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
- *        used in the main libextractor library and yielding
- *        meta data).
- * @param type libextractor-type describing the meta data
- * @param format basic format information about data
- * @param data_mime_type mime-type of data (not of the original file);
- *        can be NULL (if mime-type is not known)
- * @param data actual meta-data found
- * @param data_size number of bytes in data
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if this entry already exists
- *         data_mime_type and plugin_name are not considered for "exists" checks
- */
-int
-GNUNET_CONTAINER_meta_data_insert (struct GNUNET_CONTAINER_MetaData *md,
-                                   const char *plugin_name,
-                                   enum EXTRACTOR_MetaType type,
-                                   enum EXTRACTOR_MetaFormat format,
-                                   const char *data_mime_type,
-                                   const char *data,
-                                   size_t data_size);
-
-
-/**
- * @ingroup metadata
- * Extend metadata.  Merges the meta data from the second argument
- * into the first, discarding duplicate key-value pairs.
- *
- * @param md metadata to extend
- * @param in metadata to merge
- */
-void
-GNUNET_CONTAINER_meta_data_merge (struct GNUNET_CONTAINER_MetaData *md,
-                                  const struct GNUNET_CONTAINER_MetaData *in);
-
-
-/**
- * @ingroup metadata
- * Remove an item.
- *
- * @param md metadata to manipulate
- * @param type type of the item to remove
- * @param data specific value to remove, NULL to remove all
- *        entries of the given type
- * @param data_size number of bytes in data
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the item does not exist in md
- */
-int
-GNUNET_CONTAINER_meta_data_delete (struct GNUNET_CONTAINER_MetaData *md,
-                                   enum EXTRACTOR_MetaType type,
-                                   const char *data,
-                                   size_t data_size);
-
-
-/**
- * @ingroup metadata
- * Remove all items in the container.
- *
- * @param md metadata to manipulate
- */
-void
-GNUNET_CONTAINER_meta_data_clear (struct GNUNET_CONTAINER_MetaData *md);
-
-
-/**
- * @ingroup metadata
- * Add the current time as the publication date
- * to the meta-data.
- *
- * @param md metadata to modify
- */
-void
-GNUNET_CONTAINER_meta_data_add_publication_date (
-  struct GNUNET_CONTAINER_MetaData *md);
-
-
-/**
- * @ingroup metadata
- * Iterate over MD entries.
- *
- * @param md metadata to inspect
- * @param iter function to call on each entry, return 0 to continue to iterate
- *             and 1 to abort iteration in this function (GNU libextractor API!)
- * @param iter_cls closure for @a iter
- * @return number of entries
- */
-int
-GNUNET_CONTAINER_meta_data_iterate (const struct GNUNET_CONTAINER_MetaData *md,
-                                    EXTRACTOR_MetaDataProcessor iter,
-                                    void *iter_cls);
-
-
-/**
- * @ingroup metadata
- * Get the first MD entry of the given type.  Caller
- * is responsible for freeing the return value.
- * Also, only meta data items that are strings (0-terminated)
- * are returned by this function.
- *
- * @param md metadata to inspect
- * @param type type to look for
- * @return NULL if no entry was found
- */
-char *
-GNUNET_CONTAINER_meta_data_get_by_type (
-  const struct GNUNET_CONTAINER_MetaData *md,
-  enum EXTRACTOR_MetaType type);
-
-
-/**
- * @ingroup metadata
- * Get the first matching MD entry of the given types. Caller is
- * responsible for freeing the return value.  Also, only meta data
- * items that are strings (0-terminated) are returned by this
- * function.
- *
- * @param md metadata to inspect
- * @param ... -1-terminated list of types
- * @return NULL if we do not have any such entry,
- *  otherwise client is responsible for freeing the value!
- */
-char *
-GNUNET_CONTAINER_meta_data_get_first_by_types (
-  const struct GNUNET_CONTAINER_MetaData *md,
-  ...);
-
-/**
- * @ingroup metadata
- * Get a thumbnail from the meta-data (if present).  Only matches meta
- * data with mime type "image" and binary format.
- *
- * @param md metadata to inspect
- * @param thumb will be set to the thumbnail data.  Must be
- *        freed by the caller!
- * @return number of bytes in thumbnail, 0 if not available
- */
-size_t
-GNUNET_CONTAINER_meta_data_get_thumbnail (
-  const struct GNUNET_CONTAINER_MetaData *md,
-  unsigned char **thumb);
-
-
-/**
- * @ingroup metadata
- * Options for metadata serialization.
- */
-enum GNUNET_CONTAINER_MetaDataSerializationOptions
-{
-  /**
-   * @ingroup metadata
-   * Serialize all of the data.
-   */
-  GNUNET_CONTAINER_META_DATA_SERIALIZE_FULL = 0,
-
-  /**
-   * @ingroup metadata
-   * If not enough space is available, it is acceptable
-   * to only serialize some of the metadata.
-   */
-  GNUNET_CONTAINER_META_DATA_SERIALIZE_PART = 1,
-
-  /**
-   * @ingroup metadata
-   * Speed is of the essence, do not allow compression.
-   */
-  GNUNET_CONTAINER_META_DATA_SERIALIZE_NO_COMPRESS = 2
-};
-
-
-/**
- * @ingroup metadata
- * Serialize meta-data to target.
- *
- * @param md metadata to serialize
- * @param target where to write the serialized metadata;
- *         *target can be NULL, in which case memory is allocated
- * @param max maximum number of bytes available
- * @param opt is it ok to just write SOME of the
- *        meta-data to match the size constraint,
- *        possibly discarding some data?
- * @return number of bytes written on success,
- *         -1 on error (typically: not enough
- *         space)
- */
-ssize_t
-GNUNET_CONTAINER_meta_data_serialize (
-  const struct GNUNET_CONTAINER_MetaData *md,
-  char **target,
-  size_t max,
-  enum GNUNET_CONTAINER_MetaDataSerializationOptions opt);
-
-
-/**
- * @ingroup metadata
- * Get the size of the full meta-data in serialized form.
- *
- * @param md metadata to inspect
- * @return number of bytes needed for serialization, -1 on error
- */
-ssize_t
-GNUNET_CONTAINER_meta_data_get_serialized_size (
-  const struct GNUNET_CONTAINER_MetaData *md);
-
-
-/**
- * @ingroup metadata
- * Deserialize meta-data.  Initializes md.
- *
- * @param input serialized meta-data.
- * @param size number of bytes available
- * @return MD on success, NULL on error (e.g.
- *         bad format)
- */
-struct GNUNET_CONTAINER_MetaData *
-GNUNET_CONTAINER_meta_data_deserialize (const char *input, size_t size);
-
 
 /* ******************************* HashMap **************************** */
 
@@ -766,7 +401,8 @@ enum GNUNET_CONTAINER_MultiHashMapOption
  *         iterate,
  *         #GNUNET_NO if not.
  */
-typedef int (*GNUNET_CONTAINER_MulitHashMapIteratorCallback) (
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_MultiHashMapIteratorCallback)(
   void *cls,
   const struct GNUNET_HashCode *key,
   void *value);
@@ -834,7 +470,7 @@ GNUNET_CONTAINER_multihashmap_get (
  * @return #GNUNET_YES on success, #GNUNET_NO if the key-value pair
  *  is not in the map
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_remove (struct GNUNET_CONTAINER_MultiHashMap *map,
                                       const struct GNUNET_HashCode *key,
                                       const void *value);
@@ -876,7 +512,7 @@ GNUNET_CONTAINER_multihashmap_clear (struct GNUNET_CONTAINER_MultiHashMap *map);
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_contains (
   const struct GNUNET_CONTAINER_MultiHashMap *map,
   const struct GNUNET_HashCode *key);
@@ -893,7 +529,7 @@ GNUNET_CONTAINER_multihashmap_contains (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_contains_value (
   const struct GNUNET_CONTAINER_MultiHashMap *map,
   const struct GNUNET_HashCode *key,
@@ -913,7 +549,7 @@ GNUNET_CONTAINER_multihashmap_contains_value (
  *         #GNUNET_SYSERR if #GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY was the option and the
  *                       value already exists
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_put (
   struct GNUNET_CONTAINER_MultiHashMap *map,
   const struct GNUNET_HashCode *key,
@@ -945,7 +581,7 @@ GNUNET_CONTAINER_multihashmap_size (
 int
 GNUNET_CONTAINER_multihashmap_iterate (
   struct GNUNET_CONTAINER_MultiHashMap *map,
-  GNUNET_CONTAINER_MulitHashMapIteratorCallback it,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
   void *it_cls);
 
 
@@ -982,7 +618,7 @@ GNUNET_CONTAINER_multihashmap_iterator_create (
  * @return #GNUNET_YES we returned an element,
  *         #GNUNET_NO if we are out of elements
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_iterator_next (
   struct GNUNET_CONTAINER_MultiHashMapIterator *iter,
   struct GNUNET_HashCode *key,
@@ -1011,11 +647,11 @@ GNUNET_CONTAINER_multihashmap_iterator_destroy (
  * @return the number of key value pairs processed,
  *         #GNUNET_SYSERR if it aborted iteration
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap_get_multiple (
   struct GNUNET_CONTAINER_MultiHashMap *map,
   const struct GNUNET_HashCode *key,
-  GNUNET_CONTAINER_MulitHashMapIteratorCallback it,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
   void *it_cls);
 
 
@@ -1033,7 +669,7 @@ GNUNET_CONTAINER_multihashmap_get_multiple (
 unsigned int
 GNUNET_CONTAINER_multihashmap_get_random (
   const struct GNUNET_CONTAINER_MultiHashMap *map,
-  GNUNET_CONTAINER_MulitHashMapIteratorCallback it,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
   void *it_cls);
 
 
@@ -1050,7 +686,8 @@ GNUNET_CONTAINER_multihashmap_get_random (
  *         iterate,
  *         #GNUNET_NO if not.
  */
-typedef int (*GNUNET_CONTAINER_PeerMapIterator) (
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_PeerMapIterator)(
   void *cls,
   const struct GNUNET_PeerIdentity *key,
   void *value);
@@ -1123,7 +760,7 @@ GNUNET_CONTAINER_multipeermap_get (
  * @return #GNUNET_YES on success, #GNUNET_NO if the key-value pair
  *  is not in the map
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multipeermap_remove (struct GNUNET_CONTAINER_MultiPeerMap *map,
                                       const struct GNUNET_PeerIdentity *key,
                                       const void *value);
@@ -1153,7 +790,7 @@ GNUNET_CONTAINER_multipeermap_remove_all (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multipeermap_contains (
   const struct GNUNET_CONTAINER_MultiPeerMap *map,
   const struct GNUNET_PeerIdentity *key);
@@ -1170,7 +807,7 @@ GNUNET_CONTAINER_multipeermap_contains (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multipeermap_contains_value (
   const struct GNUNET_CONTAINER_MultiPeerMap *map,
   const struct GNUNET_PeerIdentity *key,
@@ -1250,9 +887,12 @@ GNUNET_CONTAINER_multipeermap_iterator_create (
  * @ingroup hashmap
  * Retrieve the next element from the hash map at the iterator's
  * position.  If there are no elements left, #GNUNET_NO is returned,
- * and @a key and @a value are not modified.  This operation is only
- * allowed if no elements have been removed from the multihashmap
- * since the creation of @a iter, and the map has not been destroyed.
+ * and @a key and @a value are not modified.
+ *
+ * This operation is only allowed if no elements have been removed
+ * from the multihashmap since the creation of @a iter, and the map
+ * has not been destroyed.
+ *
  * Adding elements may result in repeating or skipping elements.
  *
  * @param iter the iterator to get the next element from
@@ -1261,7 +901,7 @@ GNUNET_CONTAINER_multipeermap_iterator_create (
  * @return #GNUNET_YES we returned an element,
  *         #GNUNET_NO if we are out of elements
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multipeermap_iterator_next (
   struct GNUNET_CONTAINER_MultiPeerMapIterator *iter,
   struct GNUNET_PeerIdentity *key,
@@ -1329,7 +969,8 @@ GNUNET_CONTAINER_multipeermap_get_random (
  *         iterate,
  *         #GNUNET_NO if not.
  */
-typedef int (*GNUNET_CONTAINER_ShortmapIterator) (
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_ShortmapIterator)(
   void *cls,
   const struct GNUNET_ShortHashCode *key,
   void *value);
@@ -1470,7 +1111,7 @@ GNUNET_CONTAINER_multishortmap_contains_value (
  *         #GNUNET_SYSERR if #GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY was the option and the
  *                       value already exists
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multishortmap_put (
   struct GNUNET_CONTAINER_MultiShortmap *map,
   const struct GNUNET_ShortHashCode *key,
@@ -1543,7 +1184,7 @@ GNUNET_CONTAINER_multishortmap_iterator_create (
  * @return #GNUNET_YES we returned an element,
  *         #GNUNET_NO if we are out of elements
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multishortmap_iterator_next (
   struct GNUNET_CONTAINER_MultiShortmapIterator *iter,
   struct GNUNET_ShortHashCode *key,
@@ -1612,7 +1253,8 @@ GNUNET_CONTAINER_multishortmap_get_random (
  *         iterate,
  *         #GNUNET_NO if not.
  */
-typedef int (*GNUNET_CONTAINER_MultiUuidmapIteratorCallback) (
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_MultiUuidmapIteratorCallback)(
   void *cls,
   const struct GNUNET_Uuid *key,
   void *value);
@@ -1685,7 +1327,7 @@ GNUNET_CONTAINER_multiuuidmap_get (
  * @return #GNUNET_YES on success, #GNUNET_NO if the key-value pair
  *  is not in the map
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_remove (struct GNUNET_CONTAINER_MultiUuidmap *map,
                                       const struct GNUNET_Uuid *key,
                                       const void *value);
@@ -1715,7 +1357,7 @@ GNUNET_CONTAINER_multiuuidmap_remove_all (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_contains (
   const struct GNUNET_CONTAINER_MultiUuidmap *map,
   const struct GNUNET_Uuid *key);
@@ -1732,7 +1374,7 @@ GNUNET_CONTAINER_multiuuidmap_contains (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_contains_value (
   const struct GNUNET_CONTAINER_MultiUuidmap *map,
   const struct GNUNET_Uuid *key,
@@ -1752,7 +1394,7 @@ GNUNET_CONTAINER_multiuuidmap_contains_value (
  *         #GNUNET_SYSERR if #GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY was the option and the
  *                       value already exists
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_put (
   struct GNUNET_CONTAINER_MultiUuidmap *map,
   const struct GNUNET_Uuid *key,
@@ -1782,7 +1424,7 @@ GNUNET_CONTAINER_multiuuidmap_size (
  * @return the number of key value pairs processed,
  *         #GNUNET_SYSERR if it aborted iteration
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_iterate (
   struct GNUNET_CONTAINER_MultiUuidmap *map,
   GNUNET_CONTAINER_MultiUuidmapIteratorCallback it,
@@ -1825,7 +1467,7 @@ GNUNET_CONTAINER_multiuuidmap_iterator_create (
  * @return #GNUNET_YES we returned an element,
  *         #GNUNET_NO if we are out of elements
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multiuuidmap_iterator_next (
   struct GNUNET_CONTAINER_MultiUuidmapIterator *iter,
   struct GNUNET_Uuid *key,
@@ -1908,9 +1550,11 @@ struct GNUNET_CONTAINER_MultiHashMap32Iterator;
  *         iterate,
  *         #GNUNET_NO if not.
  */
-typedef int (*GNUNET_CONTAINER_MulitHashMapIterator32Callback) (void *cls,
-                                                                uint32_t key,
-                                                                void *value);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_MultiHashMapIterator32Callback)(
+  void *cls,
+  uint32_t key,
+  void *value);
 
 
 /**
@@ -1978,7 +1622,7 @@ GNUNET_CONTAINER_multihashmap32_get (
 int
 GNUNET_CONTAINER_multihashmap32_iterate (
   struct GNUNET_CONTAINER_MultiHashMap32 *map,
-  GNUNET_CONTAINER_MulitHashMapIterator32Callback it,
+  GNUNET_CONTAINER_MultiHashMapIterator32Callback it,
   void *it_cls);
 
 
@@ -1994,7 +1638,7 @@ GNUNET_CONTAINER_multihashmap32_iterate (
  * @return #GNUNET_YES on success, #GNUNET_NO if the key-value pair
  *  is not in the map
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap32_remove (
   struct GNUNET_CONTAINER_MultiHashMap32 *map,
   uint32_t key,
@@ -2026,7 +1670,7 @@ GNUNET_CONTAINER_multihashmap32_remove_all (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap32_contains (
   const struct GNUNET_CONTAINER_MultiHashMap32 *map,
   uint32_t key);
@@ -2043,7 +1687,7 @@ GNUNET_CONTAINER_multihashmap32_contains (
  * @return #GNUNET_YES if such a value exists,
  *         #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap32_contains_value (
   const struct GNUNET_CONTAINER_MultiHashMap32 *map,
   uint32_t key,
@@ -2063,7 +1707,7 @@ GNUNET_CONTAINER_multihashmap32_contains_value (
  *         #GNUNET_SYSERR if #GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY was the option and the
  *                       value already exists
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap32_put (
   struct GNUNET_CONTAINER_MultiHashMap32 *map,
   uint32_t key,
@@ -2086,7 +1730,7 @@ int
 GNUNET_CONTAINER_multihashmap32_get_multiple (
   struct GNUNET_CONTAINER_MultiHashMap32 *map,
   uint32_t key,
-  GNUNET_CONTAINER_MulitHashMapIterator32Callback it,
+  GNUNET_CONTAINER_MultiHashMapIterator32Callback it,
   void *it_cls);
 
 
@@ -2121,7 +1765,7 @@ GNUNET_CONTAINER_multihashmap32_iterator_create (
  * @return #GNUNET_YES we returned an element,
  *         #GNUNET_NO if we are out of elements
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_multihashmap32_iterator_next (
   struct GNUNET_CONTAINER_MultiHashMap32Iterator *iter,
   uint32_t *key,
@@ -2568,7 +2212,7 @@ GNUNET_CONTAINER_heap_peek (const struct GNUNET_CONTAINER_Heap *heap);
  * @return #GNUNET_YES if an element is returned,
  *         #GNUNET_NO  if the heap is empty.
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CONTAINER_heap_peek2 (const struct GNUNET_CONTAINER_Heap *heap,
                              void **element,
                              GNUNET_CONTAINER_HeapCostType *cost);
@@ -2608,8 +2252,8 @@ GNUNET_CONTAINER_heap_node_get_cost (
  * @return #GNUNET_YES if we should continue to iterate,
  *         #GNUNET_NO if not.
  */
-typedef int
-(*GNUNET_CONTAINER_HeapIterator) (
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_CONTAINER_HeapIterator)(
   void *cls,
   struct GNUNET_CONTAINER_HeapNode *node,
   void *element,
@@ -2704,4 +2348,7 @@ GNUNET_CONTAINER_heap_update_cost (struct GNUNET_CONTAINER_HeapNode *node,
 
 /* ifndef GNUNET_CONTAINER_LIB_H */
 #endif
+
+/** @} */ /* end of group addition */
+
 /* end of gnunet_container_lib.h */
diff --git a/src/include/gnunet_conversation_service.h b/src/include/gnunet_conversation_service.h
index be5a81cfb..7857a49cf 100644
--- a/src/include/gnunet_conversation_service.h
+++ b/src/include/gnunet_conversation_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup conversation_l2  Conversation service and libraries
+ * @{
+ *
  * @author Simon Dieterle
  * @author Andreas Fuchs
  * @author Christian Grothoff
@@ -58,6 +61,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_identity_service.h"
 #include "gnunet_namestore_service.h"
@@ -147,7 +151,7 @@ typedef void
                                          struct GNUNET_CONVERSATION_Caller *
                                          caller,
                                          const struct
-                                         GNUNET_IDENTITY_PublicKey *caller_id);
+                                         GNUNET_CRYPTO_PublicKey *caller_id);
 
 
 /**
@@ -438,3 +442,5 @@ GNUNET_CONVERSATION_call_stop (struct GNUNET_CONVERSATION_Call *call);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_core_service.h b/src/include/gnunet_core_service.h
index 59d9613f8..c3069be81 100644
--- a/src/include/gnunet_core_service.h
+++ b/src/include/gnunet_core_service.h
@@ -20,6 +20,9 @@
 /**
  * @author Christian Grothoff
  *
+ * @addtogroup Backbone
+ * @{
+ *
  * @file include/gnunet_core_service.h
  * Core service; the main API for encrypted P2P communications
  *
@@ -40,8 +43,8 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
-#include "gnunet_transport_service.h"
 
 /**
  * Version number of GNUnet-core API.
@@ -441,4 +444,6 @@ GNUNET_CORE_mq_create (struct GNUNET_CORE_Handle *h,
 
 /** @} */ /* end of group core */
 
+/** @} */ /* end of backbone addition */
+
 /* end of gnunet_core_service.h */
diff --git a/src/include/gnunet_crypto_lib.h b/src/include/gnunet_crypto_lib.h
index edb4bb230..b74bbcd1e 100644
--- a/src/include/gnunet_crypto_lib.h
+++ b/src/include/gnunet_crypto_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2001-2013 GNUnet e.V.
+     Copyright (C) 2001-2023 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @file include/gnunet_crypto_lib.h
  * @brief cryptographic primitives for GNUnet
  *
@@ -40,6 +44,10 @@
  * @see [Documentation](https://gnunet.org/crypto-api)
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_CRYPTO_LIB_H
 #define GNUNET_CRYPTO_LIB_H
 
@@ -50,6 +58,8 @@ extern "C" {
 #endif
 #endif
 
+
+#include <stdbool.h>
 #include <sodium.h>
 
 /**
@@ -57,7 +67,6 @@ extern "C" {
  */
 struct GNUNET_PeerIdentity;
 
-#include "gnunet_common.h"
 #include <gcrypt.h>
 
 
@@ -286,6 +295,170 @@ struct GNUNET_CRYPTO_EddsaPrivateScalar
   unsigned char s[512 / 8];
 };
 
+/**
+ * Private ECC key material encoded for transmission.  To be used only for
+ * Edx25519 signatures.  An initial key corresponds to data from the key
+ * expansion and clamping in the EdDSA key generation.
+ */
+struct GNUNET_CRYPTO_Edx25519PrivateKey
+{
+  /**
+   * a is a value mod n, where n has at most 256 bits.  It is the first half of
+   * the seed-expansion of EdDSA and will be clamped.
+   */
+  unsigned char a[256 / 8];
+
+  /**
+   * b consists of 32 bytes which where originally the lower 32bytes of the key
+   * expansion.  Subsequent calls to derive_private will change this value, too.
+   */
+  unsigned char b[256 / 8];
+};
+
+
+/**
+ * Public ECC key (always for curve Ed25519) encoded in a format suitable for
+ * network transmission and Edx25519 (same as EdDSA) signatures.  Refer to
+ * section 5.1.3 of rfc8032, for a thorough explanation of how this value maps
+ * to the x- and y-coordinates.
+ */
+struct GNUNET_CRYPTO_Edx25519PublicKey
+{
+  /**
+   * Point Q consists of a y-value mod p (256 bits); the x-value is
+   * always positive. The point is stored in Ed25519 standard
+   * compact format.
+   */
+  unsigned char q_y[256 / 8];
+};
+
+/**
+ * @brief an ECC signature using Edx25519 (same as in EdDSA).
+ */
+struct GNUNET_CRYPTO_Edx25519Signature
+{
+  /**
+   * R value.
+   */
+  unsigned char r[256 / 8];
+
+  /**
+   * S value.
+   */
+  unsigned char s[256 / 8];
+};
+
+/**
+ * Elligator representative (always for Curve25519)
+ */
+struct GNUNET_CRYPTO_ElligatorRepresentative
+{
+  /**
+   * Represents an element of Curve25519 finite field.
+   * Always smaller than 2 ^ 254 - 10 -> Needs to be serialized into a random-looking byte stream before transmission.
+   */
+  unsigned char r[256 / 8];
+};
+
+/**
+ * Key type for the generic public key union
+ */
+enum GNUNET_CRYPTO_KeyType
+{
+  /**
+   * The identity type. The value is the same as the
+   * PKEY record type.
+   */
+  GNUNET_PUBLIC_KEY_TYPE_ECDSA = 65536,
+
+  /**
+   * EDDSA identity. The value is the same as the EDKEY
+   * record type.
+   */
+  GNUNET_PUBLIC_KEY_TYPE_EDDSA = 65556
+};
+
+/**
+ * A private key for an identity as per LSD0001.
+ * Note that these types are NOT packed and MUST NOT be used in RPC
+ * messages. Use the respective serialization functions.
+ */
+struct GNUNET_CRYPTO_PrivateKey
+{
+  /**
+   * Type of public key.
+   * Defined by the GNS zone type value.
+   * In NBO.
+   */
+  uint32_t type;
+
+  union
+  {
+    /**
+     * An ECDSA identity key.
+     */
+    struct GNUNET_CRYPTO_EcdsaPrivateKey ecdsa_key;
+
+    /**
+     * AN EdDSA identtiy key
+     */
+    struct GNUNET_CRYPTO_EddsaPrivateKey eddsa_key;
+  };
+};
+
+
+/**
+ * An identity key as per LSD0001.
+ */
+struct GNUNET_CRYPTO_PublicKey
+{
+  /**
+   * Type of public key.
+   * Defined by the GNS zone type value.
+   * In NBO.
+   */
+  uint32_t type;
+
+  union
+  {
+    /**
+     * An ECDSA identity key.
+     */
+    struct GNUNET_CRYPTO_EcdsaPublicKey ecdsa_key;
+
+    /**
+     * AN EdDSA identtiy key
+     */
+    struct GNUNET_CRYPTO_EddsaPublicKey eddsa_key;
+  };
+};
+
+
+/**
+ * An identity signature as per LSD0001.
+ */
+struct GNUNET_CRYPTO_Signature
+{
+  /**
+   * Type of signature.
+   * Defined by the GNS zone type value.
+   * In NBO.
+   */
+  uint32_t type;
+
+  union
+  {
+    /**
+     * An ECDSA signature
+     */
+    struct GNUNET_CRYPTO_EcdsaSignature ecdsa_signature;
+
+    /**
+     * AN EdDSA signature
+     */
+    struct GNUNET_CRYPTO_EddsaSignature eddsa_signature;
+  };
+};
 
 /**
  * @brief type for session keys
@@ -306,7 +479,7 @@ struct GNUNET_CRYPTO_SymmetricSessionKey
 /**
  * Type of a nonce used for challenges.
  */
-struct ChallengeNonceP
+struct GNUNET_CRYPTO_ChallengeNonceP
 {
   /**
    * The value of the nonce.  Note that this is NOT a hash.
@@ -392,6 +565,143 @@ struct GNUNET_CRYPTO_PaillierCiphertext
 };
 
 
+/**
+ * Curve25519 Scalar
+ */
+struct GNUNET_CRYPTO_Cs25519Scalar
+{
+  /**
+   * 32 byte scalar
+   */
+  unsigned char d[crypto_core_ed25519_SCALARBYTES];
+};
+
+
+/**
+ * Curve25519 point
+ */
+struct GNUNET_CRYPTO_Cs25519Point
+{
+  /**
+   * This is a point on the Curve25519.
+   * The x coordinate can be restored using the y coordinate
+   */
+  unsigned char y[crypto_core_ed25519_BYTES];
+};
+
+
+/**
+ * The private information of an Schnorr key pair.
+ */
+struct GNUNET_CRYPTO_CsPrivateKey
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar scalar;
+};
+
+
+/**
+ * The public information of an Schnorr key pair.
+ */
+struct GNUNET_CRYPTO_CsPublicKey
+{
+  struct GNUNET_CRYPTO_Cs25519Point point;
+};
+
+
+/**
+ * Secret used for blinding (alpha and beta).
+ */
+struct GNUNET_CRYPTO_CsBlindingSecret
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar alpha;
+  struct GNUNET_CRYPTO_Cs25519Scalar beta;
+};
+
+
+/**
+ * the private r used in the signature
+ */
+struct GNUNET_CRYPTO_CsRSecret
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar scalar;
+};
+
+
+/**
+ * the public R (derived from r) used in c
+ */
+struct GNUNET_CRYPTO_CsRPublic
+{
+  struct GNUNET_CRYPTO_Cs25519Point point;
+};
+
+
+/**
+ * Schnorr c to be signed
+ */
+struct GNUNET_CRYPTO_CsC
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar scalar;
+};
+
+
+/**
+ * s in the signature
+ */
+struct GNUNET_CRYPTO_CsS
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar scalar;
+};
+
+
+/**
+ * blinded s in the signature
+ */
+struct GNUNET_CRYPTO_CsBlindS
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar scalar;
+};
+
+
+/**
+ * CS Signtature containing scalar s and point R
+ */
+struct GNUNET_CRYPTO_CsSignature
+{
+  /**
+   * Schnorr signatures are composed of a scalar s and a curve point
+   */
+  struct GNUNET_CRYPTO_CsS s_scalar;
+
+  /**
+   * Curve point of the Schnorr signature.
+   */
+  struct GNUNET_CRYPTO_CsRPublic r_point;
+};
+
+
+/**
+ * Nonce for the session, picked by client,
+ * shared with the signer.
+ */
+struct GNUNET_CRYPTO_CsSessionNonce
+{
+  /*a nonce*/
+  unsigned char snonce[256 / 8];
+};
+
+
+/**
+ * Nonce for computing blinding factors. Not
+ * shared with the signer.
+ */
+struct GNUNET_CRYPTO_CsBlindingNonce
+{
+  /*a nonce*/
+  unsigned char bnonce[256 / 8];
+};
+
+
 /* **************** Functions and Macros ************* */
 
 /**
@@ -480,7 +790,7 @@ GNUNET_CRYPTO_zero_keys (void *buffer, size_t length);
  * Fill block with a random values.
  *
  * @param mode desired quality of the random number
- * @param buffer the buffer to fill
+ * @param[out] buffer the buffer to fill
  * @param length buffer length
  */
 void
@@ -497,7 +807,7 @@ GNUNET_CRYPTO_random_block (enum GNUNET_CRYPTO_Quality mode,
  * here is not a completely random number.
  *
  * @param mode desired quality of the random number
- * @param uuid the value to fill
+ * @param[out] uuid the value to fill
  */
 void
 GNUNET_CRYPTO_random_timeflake (enum GNUNET_CRYPTO_Quality mode,
@@ -518,7 +828,7 @@ GNUNET_CRYPTO_random_u32 (enum GNUNET_CRYPTO_Quality mode, uint32_t i);
 
 /**
  * @ingroup crypto
- * Random on unsigned 64-bit values.
+ * Generate a random unsigned 64-bit value.
  *
  * @param mode desired quality of the random number
  * @param max value returned will be in range [0,@a max) (exclusive)
@@ -781,7 +1091,7 @@ GNUNET_CRYPTO_hash_context_abort (struct GNUNET_HashContext *hc);
 
 /**
  * Calculate HMAC of a message (RFC 2104)
- * TODO: Shouldn' this be the standard hmac function and
+ * TODO: Shouldn't this be the standard hmac function and
  * the above be renamed?
  *
  * @param key secret key
@@ -916,61 +1226,38 @@ GNUNET_CRYPTO_hash_xor (const struct GNUNET_HashCode *a,
 
 
 /**
- * @ingroup hash
- * Convert a hashcode into a key.
+ * Count the number of leading 0 bits in @a h.
  *
- * @param hc hash code that serves to generate the key
- * @param skey set to a valid session key
- * @param iv set to a valid initialization vector
+ * @param h a hash
+ * @return number of leading 0 bits in @a h
  */
-void
-GNUNET_CRYPTO_hash_to_aes_key (
-  const struct GNUNET_HashCode *hc,
-  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
-  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv);
+unsigned int
+GNUNET_CRYPTO_hash_count_leading_zeros (const struct GNUNET_HashCode *h);
 
 
 /**
- * @ingroup hash
- * Obtain a bit from a hashcode.
+ * Count the number of tailing 0 bits in @a h.
  *
- * @param code the `struct GNUNET_HashCode` to index bit-wise
- * @param bit index into the hashcode, [0...159] where 0 is the leftmost bit
- *        (bytes in code interpreted big endian)
- * @return Bit \a bit from hashcode \a code, -1 for invalid index
- */
-int
-GNUNET_CRYPTO_hash_get_bit_ltr (const struct GNUNET_HashCode *code,
-                                unsigned int bit);
-
-
-/**
- * Obtain a bit from a hashcode.
- * @param code the GNUNET_CRYPTO_hash to index bit-wise
- * @param bit index into the hashcode, [0...511] where 0 is the rightmost bit
- *        (bytes in code interpreted little endian)
- * @return Bit \a bit from hashcode \a code, -1 for invalid index
+ * @param h a hash
+ * @return number of tailing 0 bits in @a h
  */
-int
-GNUNET_CRYPTO_hash_get_bit_rtl (const struct GNUNET_HashCode *code,
-                                unsigned int bit);
+unsigned int
+GNUNET_CRYPTO_hash_count_tailing_zeros (const struct GNUNET_HashCode *h);
 
 
 /**
  * @ingroup hash
- * Determine how many low order bits match in two
- * `struct GNUNET_HashCodes`.  e.g. - 010011 and 011111 share
- * the first two lowest order bits, and therefore the
- * return value is two (NOT XOR distance, nor how many
- * bits match absolutely!).
+ * Convert a hashcode into a key.
  *
- * @param first the first hashcode
- * @param second the hashcode to compare first to
- * @return the number of bits that match
+ * @param hc hash code that serves to generate the key
+ * @param skey set to a valid session key
+ * @param iv set to a valid initialization vector
  */
-unsigned int
-GNUNET_CRYPTO_hash_matching_bits (const struct GNUNET_HashCode *first,
-                                  const struct GNUNET_HashCode *second);
+void
+GNUNET_CRYPTO_hash_to_aes_key (
+  const struct GNUNET_HashCode *hc,
+  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv);
 
 
 /**
@@ -1180,6 +1467,17 @@ GNUNET_CRYPTO_eddsa_key_get_public (
   const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
   struct GNUNET_CRYPTO_EddsaPublicKey *pub);
 
+/**
+ * @ingroup crypto
+ * Extract the public key for the given private key.
+ *
+ * @param priv the private key
+ * @param pub where to write the public key
+ */
+void
+GNUNET_CRYPTO_edx25519_key_get_public (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  struct GNUNET_CRYPTO_Edx25519PublicKey *pub);
 
 /**
  * @ingroup crypto
@@ -1264,7 +1562,7 @@ enum GNUNET_GenericReturnValue
 GNUNET_CRYPTO_eddsa_private_key_from_string (
   const char *enc,
   size_t enclen,
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pub);
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
 
 
 /**
@@ -1366,7 +1664,34 @@ GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk);
 
 /**
  * @ingroup crypto
+ * Create a new private key.
+ *
+ * @param[out] pk private key to initialize
+ */
+void
+GNUNET_CRYPTO_edx25519_key_create (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk);
+
+/**
+ * @ingroup crypto
+ * Create a new private key for Edx25519 from a given seed.  After expanding
+ * the seed, the first half of the key will be clamped according to EdDSA.
+ *
+ * @param seed seed input
+ * @param seedsize size of the seed in bytes
+ * @param[out] pk private key to initialize
+ */
+void
+GNUNET_CRYPTO_edx25519_key_create_from_seed (
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PrivateKey *pk);
+
+/**
+ * @ingroup crypto
  * Create a new private key.  Clear with #GNUNET_CRYPTO_ecdhe_key_clear().
+ * This is X25519 DH (RFC 7748 Section 5) and corresponds to
+ * X25519(a,9).
+ * See #GNUNET_CRYPTO_ecc_ecdh for the DH function.
  *
  * @param[out] pk set to fresh private key;
  */
@@ -1393,6 +1718,14 @@ GNUNET_CRYPTO_eddsa_key_clear (struct GNUNET_CRYPTO_EddsaPrivateKey *pk);
 void
 GNUNET_CRYPTO_ecdsa_key_clear (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk);
 
+/**
+ * @ingroup crypto
+ * Clear memory that was used to store a private key.
+ *
+ * @param pk location of the key
+ */
+void
+GNUNET_CRYPTO_edx25519_key_clear (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk);
 
 /**
  * @ingroup crypto
@@ -1403,6 +1736,15 @@ GNUNET_CRYPTO_ecdsa_key_clear (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk);
 void
 GNUNET_CRYPTO_ecdhe_key_clear (struct GNUNET_CRYPTO_EcdhePrivateKey *pk);
 
+/**
+ * @ingroup crypto
+ * Clear memory that was used to store a private key.
+ *
+ * @param pk location of the key
+ */
+void
+GNUNET_CRYPTO_private_key_clear (struct GNUNET_CRYPTO_PrivateKey *pk);
+
 
 /**
  * @ingroup crypto
@@ -1436,12 +1778,49 @@ GNUNET_CRYPTO_eddsa_setup_hostkey (const char *cfg_name);
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if the identity
  *         could not be retrieved
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CRYPTO_get_peer_identity (const struct GNUNET_CONFIGURATION_Handle *cfg,
                                  struct GNUNET_PeerIdentity *dst);
 
 
 /**
+ * @ingroup crypto
+ * Sign a given block with a specific purpose using the host's peer identity.
+ *
+ * @param cfg configuration to use
+ * @param purpose what to sign (size, purpose)
+ * @param sig where to write the signature
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the identity
+ *         could not be retrieved
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_by_peer_identity (const struct
+                                     GNUNET_CONFIGURATION_Handle *cfg,
+                                     const struct
+                                     GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+                                     struct GNUNET_CRYPTO_EddsaSignature *sig);
+
+
+/**
+ * @ingroup crypto
+ * Verify a given signature with a peer's identity.
+ *
+ * @param purpose what is the purpose that the signature should have?
+ * @param validate block to validate (size, purpose, data)
+ * @param sig signature that is being validated
+ * @param identity the peer's identity to verify
+ * @return #GNUNET_OK if ok, #GNUNET_SYSERR if invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_verify_peer_identity (uint32_t purpose,
+                                    const struct
+                                    GNUNET_CRYPTO_EccSignaturePurpose *validate,
+                                    const struct
+                                    GNUNET_CRYPTO_EddsaSignature *sig,
+                                    const struct GNUNET_PeerIdentity *identity);
+
+
+/**
  * Internal structure used to cache pre-calculated values for DLOG calculation.
  */
 struct GNUNET_CRYPTO_EccDlogContext;
@@ -1484,7 +1863,7 @@ GNUNET_CRYPTO_ecc_dlog_prepare (unsigned int max,
  * Calculate ECC discrete logarithm for small factors.
  * Opposite of #GNUNET_CRYPTO_ecc_dexp().
  *
- * @param dlc precalculated values, determine range of factors
+ * @param edc precalculated values, determine range of factors
  * @param input point on the curve to factor
  * @return INT_MAX if dlog failed, otherwise the factor
  */
@@ -1607,6 +1986,9 @@ GNUNET_CRYPTO_ecc_scalar_from_int (int64_t val,
 /**
  * @ingroup crypto
  * Derive key material from a public and a private ECC key.
+ * This is X25519 DH (RFC 7748 Section 5) and corresponds to
+ * H(X25519(b,X25519(a,9))) where b := priv, pub := X25519(a,9),
+ * and a := #GNUNET_CRYPTO_ecdhe_key_create().
  *
  * @param priv private key to use for the ECDH (x)
  * @param pub public key to use for the ECDH (yG)
@@ -1623,6 +2005,10 @@ GNUNET_CRYPTO_ecc_ecdh (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
  * @ingroup crypto
  * Derive key material from a ECDH public key and a private EdDSA key.
  * Dual to #GNUNET_CRRYPTO_ecdh_eddsa.
+ * This uses the Ed25519 private seed as X25519 seed.
+ * As such, this also is a X25519 DH (see #GNUNET_CRYPTO_ecc_ecdh).
+ * NOTE: Whenever you can get away with it, use separate key pairs
+ * for signing and encryption (DH)!
  *
  * @param priv private key from EdDSA to use for the ECDH (x)
  * @param pub public key to use for the ECDH (yG)
@@ -1634,6 +2020,122 @@ GNUNET_CRYPTO_eddsa_ecdh (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
                           const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
                           struct GNUNET_HashCode *key_material);
 
+/**
+ * @ingroup crypto
+ * Decapsulate a key for a private EdDSA key.
+ * Dual to #GNUNET_CRRYPTO_eddsa_kem_encaps.
+ *
+ * @param priv private key from EdDSA to use for the ECDH (x)
+ * @param c the encapsulated key
+ * @param key_material where to write the key material H(h(x)yG)
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_kem_decaps (const struct
+                                GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                                const struct GNUNET_CRYPTO_EcdhePublicKey *c,
+                                struct GNUNET_HashCode *key_material);
+
+/**
+ * @ingroup crypto
+ * Encapsulate key material for a EdDSA public key.
+ * Dual to #GNUNET_CRRYPTO_eddsa_kem_decaps.
+ *
+ * @param priv private key to use for the ECDH (y)
+ * @param c public key from EdDSA to use for the ECDH (X=h(x)G)
+ * @param key_material where to write the key material H(yX)=H(h(x)yG)
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+                                struct GNUNET_CRYPTO_EcdhePublicKey *c,
+                                struct GNUNET_HashCode *key_material);
+
+/**
+ * This is the encapsulated key of our FO-KEM.
+ */
+struct GNUNET_CRYPTO_FoKemC
+{
+  /* The output of the FO-OWTF F(x) */
+  struct GNUNET_HashCode y;
+
+  /* The ephemeral public key from the DH in the KEM */
+  struct GNUNET_CRYPTO_EcdhePublicKey pub;
+};
+
+/**
+ * @ingroup crypto
+ * Encapsulate key material using a CCA-secure KEM.
+ * The KEM is using a OWTF with image oracle constructed from
+ * a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP).
+ * Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_decaps.
+ *
+ * @param pub public key to encapsulated for
+ * @param[out] c the encapsulation
+ * @param[out] key_material the encapsulated key
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_fo_kem_encaps (
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+  struct GNUNET_CRYPTO_FoKemC *c,
+  struct GNUNET_HashCode *key_material);
+
+
+/**
+ * @ingroup crypto
+ * Decapsulate key material using a CCA-secure KEM.
+ * The KEM is using a OWTF with image oracle constructed from
+ * a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP).
+ * Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_encaps.
+ *
+ * @param priv private key this encapsulation is for
+ * @param c the encapsulation
+ * @param[out] key_material the encapsulated key
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_fo_kem_decaps (const struct
+                                   GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                                   const struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material);
+
+/**
+ * @ingroup crypto
+ * Encapsulate key material using a CCA-secure KEM.
+ * The KEM is using a OWTF with image oracle constructed from
+ * a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP).
+ * Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_decaps.
+ *
+ * @param pub public key to encapsulated for
+ * @param[out] c the encapsulation
+ * @param[out] key_material the encapsulated key
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_fo_kem_encaps (const struct
+                                   GNUNET_CRYPTO_EcdsaPublicKey *pub,
+                                   struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material);
+
+
+/**
+ * @ingroup crypto
+ * Decapsulate key material using a CCA-secure KEM.
+ * The KEM is using a OWTF with image oracle constructed from
+ * a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP).
+ * Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_encaps.
+ *
+ * @param priv private key this encapsulation is for
+ * @param c the encapsulation
+ * @param[out] key_material the encapsulated key
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_fo_kem_decaps (const struct
+                                   GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+                                   struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material);
 
 /**
  * @ingroup crypto
@@ -1655,6 +2157,10 @@ GNUNET_CRYPTO_ecdsa_ecdh (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
  * @ingroup crypto
  * Derive key material from a EdDSA public key and a private ECDH key.
  * Dual to #GNUNET_CRRYPTO_eddsa_ecdh.
+ * This converts the Edwards25519 public key @a pub to a Curve25519
+ * public key before computing a X25519 DH (see #GNUNET_CRYPTO_ecc_ecdh).
+ * NOTE: Whenever you can get away with it, use separate key pairs
+ * for signing and encryption (DH)!
  *
  * @param priv private key to use for the ECDH (y)
  * @param pub public key from EdDSA to use for the ECDH (X=h(x)G)
@@ -1666,6 +2172,7 @@ GNUNET_CRYPTO_ecdh_eddsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
                           const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
                           struct GNUNET_HashCode *key_material);
 
+
 /**
  * @ingroup crypto
  * Derive key material from a EcDSA public key and a private ECDH key.
@@ -1750,6 +2257,21 @@ GNUNET_CRYPTO_ecdsa_sign_ (
   const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
   struct GNUNET_CRYPTO_EcdsaSignature *sig);
 
+/**
+ * @brief
+ *
+ * @param priv
+ * @param data
+ * @param size
+ * @param sig
+ * @return enum GNUNET_GenericReturnValue
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_sign_raw (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  void *data,
+  size_t size,
+  struct GNUNET_CRYPTO_EddsaSignature *sig);
 
 /**
  * @ingroup crypto
@@ -1775,6 +2297,53 @@ GNUNET_CRYPTO_ecdsa_sign_ (
                                               sig));               \
 } while (0)
 
+/**
+ * @ingroup crypto
+ * @brief Edx25519 sign a given block.
+ *
+ * The @a purpose data is the beginning of the data of which the signature is
+ * to be created. The `size` field in @a purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.  If possible,
+ * use #GNUNET_CRYPTO_edx25519_sign() instead of this function (only if @a
+ * validate is not fixed-size, you must use this function directly).
+ *
+ * @param priv private key to use for the signing
+ * @param purpose what to sign (size, purpose)
+ * @param[out] sig where to write the signature
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_edx25519_sign_ (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_Edx25519Signature *sig);
+
+
+/**
+ * @ingroup crypto
+ * @brief Edx25519 sign a given block.  The resulting signature is compatible
+ * with EdDSA.
+ *
+ * The @a ps data must be a fixed-size struct for which the signature is to be
+ * created. The `size` field in @a ps->purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.
+ *
+ * @param priv private key to use for the signing
+ * @param ps packed struct with what to sign, MUST begin with a purpose
+ * @param[out] sig where to write the signature
+ */
+#define GNUNET_CRYPTO_edx25519_sign(priv,ps,sig) do {              \
+    /* check size is set correctly */                              \
+    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
+    /* check 'ps' begins with the purpose */                       \
+    GNUNET_static_assert (((void*) (ps)) ==                        \
+                          ((void*) &(ps)->purpose));               \
+    GNUNET_assert (GNUNET_OK ==                                    \
+                   GNUNET_CRYPTO_edx25519_sign_ (priv,             \
+                                                 &(ps)->purpose,   \
+                                                 sig));            \
+} while (0)
+
 
 /**
  * @ingroup crypto
@@ -1818,7 +2387,7 @@ GNUNET_CRYPTO_eddsa_verify_ (
  */
 #define GNUNET_CRYPTO_eddsa_verify(purp,ps,sig,pub) ({             \
     /* check size is set correctly */                              \
-    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps))); \
+    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
     /* check 'ps' begins with the purpose */                       \
     GNUNET_static_assert (((void*) (ps)) ==                        \
                           ((void*) &(ps)->purpose));               \
@@ -1828,7 +2397,6 @@ GNUNET_CRYPTO_eddsa_verify_ (
                                  pub);                             \
   })
 
-
 /**
  * @ingroup crypto
  * @brief Verify ECDSA signature.
@@ -1883,6 +2451,58 @@ GNUNET_CRYPTO_ecdsa_verify_ (
 
 /**
  * @ingroup crypto
+ * @brief Verify Edx25519 signature.
+ *
+ * The @a validate data is the beginning of the data of which the signature
+ * is to be verified. The `size` field in @a validate must correctly indicate
+ * the number of bytes of the data structure, including its header.  If @a
+ * purpose does not match the purpose given in @a validate (the latter must be
+ * in big endian), signature verification fails.  If possible, use
+ * #GNUNET_CRYPTO_edx25519_verify() instead of this function (only if @a
+ * validate is not fixed-size, you must use this function directly).
+ *
+ * @param purpose what is the purpose that the signature should have?
+ * @param validate block to validate (size, purpose, data)
+ * @param sig signature that is being validated
+ * @param pub public key of the signer
+ * @returns #GNUNET_OK if ok, #GNUNET_SYSERR if invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_edx25519_verify_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const struct GNUNET_CRYPTO_Edx25519Signature *sig,
+  const struct GNUNET_CRYPTO_Edx25519PublicKey *pub);
+
+
+/**
+ * @ingroup crypto
+ * @brief Verify Edx25519 signature.
+ *
+ * The @a ps data must be a fixed-size struct for which the signature is to be
+ * created. The `size` field in @a ps->purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.
+ *
+ * @param purp purpose of the signature, must match 'ps->purpose.purpose'
+ *              (except in host byte order)
+ * @param priv private key to use for the signing
+ * @param ps packed struct with what to sign, MUST begin with a purpose
+ * @param sig where to write the signature
+ */
+#define GNUNET_CRYPTO_edx25519_verify(purp,ps,sig,pub) ({         \
+    /* check size is set correctly */                             \
+    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps))); \
+    /* check 'ps' begins with the purpose */                      \
+    GNUNET_static_assert (((void*) (ps)) ==                       \
+                          ((void*) &(ps)->purpose));              \
+    GNUNET_CRYPTO_edx25519_verify_ (purp,                         \
+                                    &(ps)->purpose,               \
+                                    sig,                          \
+                                    pub);                         \
+  })
+
+/**
+ * @ingroup crypto
  * Derive a private key from a given private key and a label.
  * Essentially calculates a private key 'h = H(l,P) * d mod n'
  * where n is the size of the ECC group and P is the public
@@ -1919,6 +2539,26 @@ GNUNET_CRYPTO_ecdsa_public_key_derive (
   const char *context,
   struct GNUNET_CRYPTO_EcdsaPublicKey *result);
 
+/**
+ * This is a signature function for ECDSA which takes a
+ * private key, derives/blinds it and signs the message.
+ *
+ * @param pkey original private key
+ * @param label label to use for key deriviation
+ * @param context additional context to use for HKDF of 'h';
+ *        typically the name of the subsystem/application
+ * @param purpose the signature purpose
+ * @param sig the resulting signature
+ * @return GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_sign_derived (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+  const char *label,
+  const char *context,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_EcdsaSignature *sig);
+
 
 /**
  * @ingroup crypto
@@ -1964,23 +2604,23 @@ GNUNET_CRYPTO_eddsa_public_key_derive (
 
 
 /**
- * This is a signature function for EdDSA which takes the
- * secret scalar sk instead of the private seed which is
- * usually the case for crypto APIs. We require this functionality
- * in order to use derived private keys for signatures we
- * cannot calculate the inverse of a sk to find the seed
- * efficiently.
+ * This is a signature function for EdDSA which takes a
+ * private key and derives it using the label and context
+ * before signing.
  *
- * The resulting signature is a standard EdDSA signature
- * which can be verified using the usual APIs.
- *
- * @param sk the secret scalar
- * @param purp the signature purpose
+ * @param pkey original private key
+ * @param label label to use for key deriviation
+ * @param context additional context to use for HKDF of 'h';
+ *        typically the name of the subsystem/application
+ * @param purpose the signature purpose
  * @param sig the resulting signature
+ * @return GNUNET_OK on success
  */
-void
-GNUNET_CRYPTO_eddsa_sign_with_scalar (
-  const struct GNUNET_CRYPTO_EddsaPrivateScalar *priv,
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_sign_derived (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *pkey,
+  const char *label,
+  const char *context,
   const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
   struct GNUNET_CRYPTO_EddsaSignature *sig);
 
@@ -1996,6 +2636,134 @@ GNUNET_CRYPTO_eddsa_key_get_public_from_scalar (
   const struct GNUNET_CRYPTO_EddsaPrivateScalar *s,
   struct GNUNET_CRYPTO_EddsaPublicKey *pkey);
 
+/**
+ * @ingroup crypto
+ * Derive a private scalar from a given private key and a label.
+ * Essentially calculates a private key 'h = H(l,P) * d mod n'
+ * where n is the size of the ECC group and P is the public
+ * key associated with the private key 'd'.
+ *
+ * @param priv original private key
+ * @param seed input seed
+ * @param seedsize size of the seed
+ * @param result derived private key
+ */
+void
+GNUNET_CRYPTO_edx25519_private_key_derive (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PrivateKey *result);
+
+
+/**
+ * @ingroup crypto
+ * Derive a public key from a given public key and a label.
+ * Essentially calculates a public key 'V = H(l,P) * P'.
+ *
+ * @param pub original public key
+ * @param seed input seed
+ * @param seedsize size of the seed
+ * @param result where to write the derived public key
+ */
+void
+GNUNET_CRYPTO_edx25519_public_key_derive (
+  const struct GNUNET_CRYPTO_Edx25519PublicKey *pub,
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PublicKey *result);
+
+
+/**
+ * @ingroup crypto
+ * Clears the most significant bit and second most significant bit of the serialized representaive before applying elligator direct map.
+ *
+ * @param representative serialized elligator representative of an element of Curves25519's finite field
+ * @param point destination for the calculated point on the curve
+ * @param high_y bool pointed to will be set to 'true' if corresponding y-coordinate is > 2 ^ 254 - 10, otherwise 0. Can be set to NULL if not needed.
+ */
+void
+GNUNET_CRYPTO_ecdhe_elligator_decoding (
+  struct GNUNET_CRYPTO_EcdhePublicKey *point,
+  bool *high_y,
+  const struct GNUNET_CRYPTO_ElligatorRepresentative *representative);
+
+/**
+ * @ingroup crypto
+ * Encodes a point on Curve25519 to a an element of the underlying finite field.
+ * This transformation is deterministic.
+ *
+ * @param r storage for the calculated representative
+ * @param pub a point on the curve
+ * @param high_y encodes if y-coordinate is > 2 ^254 - 10, which determines the representative value out of two
+ * @return 'true' if the given point can be encoded into a representative. Otherwise 'false' is returned and the content of the representative storage is undefined
+ */
+bool
+GNUNET_CRYPTO_ecdhe_elligator_encoding (
+  struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+  bool high_y);
+
+
+/**
+ * @ingroup crypto
+ * Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point.
+ * Following Method 1 in description https://elligator.org/key-exchange section Step 2: Generate a “special” public key.
+ *
+ * @param pub valid public key for elligator inverse map
+ * @param pk private key for generating valid public key
+ * @return GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (
+  struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+  struct GNUNET_CRYPTO_EcdhePrivateKey *pk);
+
+
+/**
+ * @ingroup crypto
+ * Generates a private key for Curve25519 and the elligator representative of the corresponding public key.
+ *
+ * @param repr representative of the public key
+ * @param pk Curve25519 private key
+ */
+void
+GNUNET_CRYPTO_ecdhe_elligator_key_create (
+  struct GNUNET_CRYPTO_ElligatorRepresentative *repr,
+  struct GNUNET_CRYPTO_EcdhePrivateKey *pk);
+
+/**
+ * @ingroup crypto
+ * Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair.
+ * Following the terminology in https://eprint.iacr.org/2021/509.pdf.
+ *
+ * @param pub given edwards curve public key (X)
+ * @param r representative of ephemeral public key A to use for the ECDH (direct_map(r)=A=aG)
+ * @param key_material where to write the key material H(aX)=H(x(aG))
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_elligator_kem_encaps (
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+  struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  struct GNUNET_HashCode *key_material);
+
+/**
+ * @ingroup crypto
+ * Carries out ecdh decapsulation with own private key and the representative of the received public key.
+ * Following the terminology in https://eprint.iacr.org/2021/509.pdf.
+ *
+ * @param priv own private key (x)
+ * @param r received representative r, from which we can obtain the public key A (direct_map(r)=A=aG)
+ * @param key_material where to write the key material H(xA)=H(a(xG))
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_elligator_kem_decaps (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  const struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  struct GNUNET_HashCode *key_material);
+
 
 /**
  * Output the given MPI value to the given buffer in network
@@ -2063,7 +2831,7 @@ GNUNET_CRYPTO_paillier_encrypt (
  * @param private_key Private key to use for decryption.
  * @param public_key Public key to use for decryption.
  * @param ciphertext Ciphertext to decrypt.
- * @param[out] m Decryption of @a ciphertext with @private_key.
+ * @param[out] m Decryption of @a ciphertext with @a private_key.
  */
 void
 GNUNET_CRYPTO_paillier_decrypt (
@@ -2074,7 +2842,8 @@ GNUNET_CRYPTO_paillier_decrypt (
 
 
 /**
- * Compute a ciphertext that represents the sum of the plaintext in @a x1 and @a x2
+ * Compute a ciphertext that represents the sum of the plaintext in @a c1
+ * and @a c2
  *
  * Note that this operation can only be done a finite number of times
  * before an overflow occurs.
@@ -2211,8 +2980,9 @@ GNUNET_CRYPTO_rsa_private_key_get_public (
  * @param hc where to store the hash code
  */
 void
-GNUNET_CRYPTO_rsa_public_key_hash (const struct GNUNET_CRYPTO_RsaPublicKey *key,
-                                   struct GNUNET_HashCode *hc);
+GNUNET_CRYPTO_rsa_public_key_hash (
+  const struct GNUNET_CRYPTO_RsaPublicKey *key,
+  struct GNUNET_HashCode *hc);
 
 
 /**
@@ -2317,53 +3087,83 @@ GNUNET_CRYPTO_rsa_public_key_cmp (const struct GNUNET_CRYPTO_RsaPublicKey *p1,
 
 
 /**
+ * @brief RSA Parameters to create blinded signature
+ */
+struct GNUNET_CRYPTO_RsaBlindedMessage
+{
+  /**
+   * Blinded message to be signed
+   * Note: is malloc()'ed!
+   */
+  void *blinded_msg;
+
+  /**
+   * Size of the @e blinded_msg to be signed.
+   */
+  size_t blinded_msg_size;
+};
+
+
+/**
  * Blinds the given message with the given blinding key
  *
- * @param hash hash of the message to sign
- * @param bkey the blinding key
+ * @param message the message to sign
+ * @param message_size number of bytes in @a message
+ * @param bks the blinding key
  * @param pkey the public key of the signer
- * @param[out] buf set to a buffer with the blinded message to be signed
- * @param[out] buf_size number of bytes stored in @a buf
+ * @param[out] bm set to the blinded message
  * @return #GNUNET_YES if successful, #GNUNET_NO if RSA key is malicious
  */
-int
-GNUNET_CRYPTO_rsa_blind (const struct GNUNET_HashCode *hash,
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_rsa_blind (const void *message,
+                         size_t message_size,
                          const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks,
                          struct GNUNET_CRYPTO_RsaPublicKey *pkey,
-                         void **buf,
-                         size_t *buf_size);
+                         struct GNUNET_CRYPTO_RsaBlindedMessage *bm);
 
 
 /**
  * Sign a blinded value, which must be a full domain hash of a message.
  *
  * @param key private key to use for the signing
- * @param msg the (blinded) message to sign
- * @param msg_len number of bytes in @a msg to sign
+ * @param bm the (blinded) message to sign
  * @return NULL on error, signature on success
  */
 struct GNUNET_CRYPTO_RsaSignature *
 GNUNET_CRYPTO_rsa_sign_blinded (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
-                                const void *msg,
-                                size_t msg_len);
+                                const struct
+                                GNUNET_CRYPTO_RsaBlindedMessage *bm);
 
 
 /**
  * Create and sign a full domain hash of a message.
  *
  * @param key private key to use for the signing
- * @param hash the hash of the message to sign
+ * @param message the message to sign
+ * @param message_size number of bytes in @a message
  * @return NULL on error, including a malicious RSA key, signature on success
  */
 struct GNUNET_CRYPTO_RsaSignature *
 GNUNET_CRYPTO_rsa_sign_fdh (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
-                            const struct GNUNET_HashCode *hash);
+                            const void *message,
+                            size_t message_size);
+
+
+/**
+ * Free memory occupied by blinded message. Only frees contents, not
+ * @a bm itself.
+ *
+ * @param[in] bm memory to free
+ */
+void
+GNUNET_CRYPTO_rsa_blinded_message_free (
+  struct GNUNET_CRYPTO_RsaBlindedMessage *bm);
 
 
 /**
  * Free memory occupied by signature.
  *
- * @param sig memory to free
+ * @param[in] sig memory to free
  */
 void
 GNUNET_CRYPTO_rsa_signature_free (struct GNUNET_CRYPTO_RsaSignature *sig);
@@ -2391,8 +3191,9 @@ GNUNET_CRYPTO_rsa_signature_encode (
  * @return NULL on error
  */
 struct GNUNET_CRYPTO_RsaSignature *
-GNUNET_CRYPTO_rsa_signature_decode (const void *buf,
-                                    size_t buf_size);
+GNUNET_CRYPTO_rsa_signature_decode (
+  const void *buf,
+  size_t buf_size);
 
 
 /**
@@ -2402,7 +3203,8 @@ GNUNET_CRYPTO_rsa_signature_decode (const void *buf,
  * @return the duplicate key; NULL upon error
  */
 struct GNUNET_CRYPTO_RsaSignature *
-GNUNET_CRYPTO_rsa_signature_dup (const struct GNUNET_CRYPTO_RsaSignature *sig);
+GNUNET_CRYPTO_rsa_signature_dup (
+  const struct GNUNET_CRYPTO_RsaSignature *sig);
 
 
 /**
@@ -2425,17 +3227,1267 @@ GNUNET_CRYPTO_rsa_unblind (const struct GNUNET_CRYPTO_RsaSignature *sig,
  * Verify whether the given hash corresponds to the given signature and the
  * signature is valid with respect to the given public key.
  *
- * @param hash the message to verify to match the @a sig
+ * @param message the message to sign
+ * @param message_size number of bytes in @a message
  * @param sig signature that is being validated
  * @param public_key public key of the signer
  * @returns #GNUNET_YES if ok, #GNUNET_NO if RSA key is malicious, #GNUNET_SYSERR if signature
  */
 enum GNUNET_GenericReturnValue
-GNUNET_CRYPTO_rsa_verify (const struct GNUNET_HashCode *hash,
+GNUNET_CRYPTO_rsa_verify (const void *message,
+                          size_t message_size,
                           const struct GNUNET_CRYPTO_RsaSignature *sig,
                           const struct GNUNET_CRYPTO_RsaPublicKey *public_key);
 
 
+/**
+ * Create a new random private key.
+ *
+ * @param[out] priv where to write the fresh private key
+ */
+void
+GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv);
+
+
+/**
+ * Extract the public key of the given private key.
+ *
+ * @param priv the private key
+ * @param[out] pub where to write the public key
+ */
+void
+GNUNET_CRYPTO_cs_private_key_get_public (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  struct GNUNET_CRYPTO_CsPublicKey *pub);
+
+
+/**
+ * Derive a new secret r pair r0 and r1.
+ * In original papers r is generated randomly
+ * To provide abort-idempotency, r needs to be derived but still needs to be UNPREDICTABLE
+ * To ensure unpredictability a new nonce should be used when a new r needs to be derived.
+ * Uses HKDF internally.
+ * Comment: Can be done in one HKDF shot and split output.
+ *
+ * @param nonce is a random nonce
+ * @param seed seed to use in derivation
+ * @param lts is a long-term-secret in form of a private key
+ * @param[out] r array containing derived secrets r0 and r1
+ */
+void
+GNUNET_CRYPTO_cs_r_derive (
+  const struct GNUNET_CRYPTO_CsSessionNonce *nonce,
+  const char *seed,
+  const struct GNUNET_CRYPTO_CsPrivateKey *lts,
+  struct GNUNET_CRYPTO_CsRSecret r[2]);
+
+
+/**
+ * Extract the public R of the given secret r.
+ *
+ * @param r_priv the private key
+ * @param[out] r_pub where to write the public key
+ */
+void
+GNUNET_CRYPTO_cs_r_get_public (
+  const struct GNUNET_CRYPTO_CsRSecret *r_priv,
+  struct GNUNET_CRYPTO_CsRPublic *r_pub);
+
+
+/**
+ * Derives new random blinding factors.
+ * In original papers blinding factors are generated randomly
+ * To provide abort-idempotency, blinding factors need to be derived but still need to be UNPREDICTABLE.
+ * To ensure unpredictability a new nonce has to be used.
+ * Uses HKDF internally.
+ *
+ * @param blind_seed is the blinding seed to derive blinding factors
+ * @param[out] bs array containing the two derived blinding secrets
+ */
+void
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
+  const struct GNUNET_CRYPTO_CsBlindingNonce *blind_seed,
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2]);
+
+
+/**
+ * @brief CS Parameters derived from the message
+ * during blinding to create blinded signature
+ */
+struct GNUNET_CRYPTO_CsBlindedMessage
+{
+  /**
+   * The Clause Schnorr c_0 and c_1 containing the blinded message
+   */
+  struct GNUNET_CRYPTO_CsC c[2];
+
+  /**
+   * Nonce used in initial request.
+   */
+  struct GNUNET_CRYPTO_CsSessionNonce nonce;
+
+};
+
+
+/**
+ * Pair of Public R values for Cs denominations
+ */
+struct GNUNET_CRYPTO_CSPublicRPairP
+{
+  struct GNUNET_CRYPTO_CsRPublic r_pub[2];
+};
+
+
+/**
+ * Calculate two blinded c's.
+ * Comment: One would be insecure due to Wagner's algorithm solving ROS
+ *
+ * @param bs array of the two blinding factor structs each containing alpha and beta
+ * @param r_pub array of the two signer's nonce R
+ * @param pub the public key of the signer
+ * @param msg the message to blind in preparation for signing
+ * @param msg_len length of message msg
+ * @param[out] blinded_c array of the two blinded c's
+ * @param[out] r_pub_blind array of the two blinded R
+ */
+void
+GNUNET_CRYPTO_cs_calc_blinded_c (
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const void *msg,
+  size_t msg_len,
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CSPublicRPairP *r_pub_blind);
+
+
+/**
+ * The Sign Answer for Clause Blind Schnorr signature.
+ * The sign operation returns a parameter @param b and the signature
+ * scalar @param s_scalar.
+ */
+struct GNUNET_CRYPTO_CsBlindSignature
+{
+  /**
+   * To make ROS problem harder, the signer chooses an unpredictable b and
+   * only calculates signature of c_b
+   */
+  unsigned int b;
+
+  /**
+   * The blinded s scalar calculated from c_b
+   */
+  struct GNUNET_CRYPTO_CsBlindS s_scalar;
+};
+
+
+/**
+ * Sign a blinded @a c.
+ * This function derives b from a nonce and a longterm secret.
+ * In the original papers b is generated randomly.
+ * To provide abort-idempotency, b needs to be derived but still need to be UNPREDICTABLE.
+ * To ensure unpredictability a new nonce has to be used for every signature.
+ * HKDF is used internally for derivation.
+ * r0 and r1 can be derived prior by using GNUNET_CRYPTO_cs_r_derive.
+ *
+ * @param priv private key to use for the signing and as LTS in HKDF
+ * @param r array of the two secret inputs from the signer
+ * @param bm blinded message, including array of the two blinded c to sign c_b and the random nonce
+ * @param[out] cs_blind_sig where to write the blind signature
+ */
+void
+GNUNET_CRYPTO_cs_sign_derive (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsBlindedMessage *bm,
+  struct GNUNET_CRYPTO_CsBlindSignature *cs_blind_sig);
+
+
+/**
+ * Unblind a blind-signed signature using a c that was blinded
+ *
+ * @param blinded_signature_scalar the signature made on the blinded c
+ * @param bs the blinding factors used in the blinding
+ * @param[out] signature_scalar where to write the unblinded signature
+ */
+void
+GNUNET_CRYPTO_cs_unblind (
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  struct GNUNET_CRYPTO_CsS *signature_scalar);
+
+
+/**
+ * Verify whether the given message corresponds to the given signature and the
+ * signature is valid with respect to the given public key.
+ *
+ * @param sig signature that is being validated
+ * @param pub public key of the signer
+ * @param msg is the message that should be signed by @a sig  (message is used to calculate c)
+ * @param msg_len is the message length
+ * @returns #GNUNET_YES on success, #GNUNET_SYSERR if signature invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_cs_verify (
+  const struct GNUNET_CRYPTO_CsSignature *sig,
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const void *msg,
+  size_t msg_len);
+
+
+/**
+ * Types of public keys used for blind signatures.
+ */
+enum GNUNET_CRYPTO_BlindSignatureAlgorithm
+{
+
+  /**
+   * Invalid type of signature.
+   */
+  GNUNET_CRYPTO_BSA_INVALID = 0,
+
+  /**
+   * RSA blind signature.
+   */
+  GNUNET_CRYPTO_BSA_RSA = 1,
+
+  /**
+   * Clause Blind Schnorr signature.
+   */
+  GNUNET_CRYPTO_BSA_CS = 2
+};
+
+
+/**
+ * @brief Type of (unblinded) signatures.
+ */
+struct GNUNET_CRYPTO_UnblindedSignature
+{
+
+  /**
+   * Type of the signature.
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     */
+    struct GNUNET_CRYPTO_CsSignature cs_signature;
+
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_RSA in @a cipher.
+     */
+    struct GNUNET_CRYPTO_RsaSignature *rsa_signature;
+
+  } details;
+
+};
+
+
+/**
+ * @brief Type for *blinded* signatures.
+ * Must be unblinded before it becomes valid.
+ */
+struct GNUNET_CRYPTO_BlindedSignature
+{
+
+  /**
+   * Type of the signature.
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     * At this point only the blinded s scalar is used.
+     * The final signature consisting of r,s is built after unblinding.
+     */
+    struct GNUNET_CRYPTO_CsBlindSignature blinded_cs_answer;
+
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_RSA in @a cipher.
+     */
+    struct GNUNET_CRYPTO_RsaSignature *blinded_rsa_signature;
+
+  } details;
+
+};
+
+
+/**
+ * @brief Type of public signing keys for blind signatures.
+ */
+struct GNUNET_CRYPTO_BlindSignPublicKey
+{
+
+  /**
+   * Type of the public key.
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Hash of the public key.
+   */
+  struct GNUNET_HashCode pub_key_hash;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     */
+    struct GNUNET_CRYPTO_CsPublicKey cs_public_key;
+
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_RSA in @a cipher.
+     */
+    struct GNUNET_CRYPTO_RsaPublicKey *rsa_public_key;
+
+  } details;
+};
+
+
+/**
+ * @brief Type of private signing keys for blind signing.
+ */
+struct GNUNET_CRYPTO_BlindSignPrivateKey
+{
+
+  /**
+   * Type of the public key.
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     */
+    struct GNUNET_CRYPTO_CsPrivateKey cs_private_key;
+
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_RSA in @a cipher.
+     */
+    struct GNUNET_CRYPTO_RsaPrivateKey *rsa_private_key;
+
+  } details;
+};
+
+
+/**
+ * @brief Blinded message ready for blind signing.
+ */
+struct GNUNET_CRYPTO_BlindedMessage
+{
+  /**
+   * Type of the sign blinded message
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     */
+    struct GNUNET_CRYPTO_CsBlindedMessage cs_blinded_message;
+
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_RSA in @a cipher.
+     */
+    struct GNUNET_CRYPTO_RsaBlindedMessage rsa_blinded_message;
+
+  } details;
+};
+
+
+/**
+ * Secret r for Cs denominations
+ */
+struct GNUNET_CRYPTO_CSPrivateRPairP
+{
+  struct GNUNET_CRYPTO_CsRSecret r[2];
+};
+
+
+/**
+ * @brief Input needed for blinding a message.
+ */
+struct GNUNET_CRYPTO_BlindingInputValues
+{
+
+  /**
+   * Type of the signature.
+   */
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher;
+
+  /**
+   * Reference counter.
+   */
+  unsigned int rc;
+
+  /**
+   * Details, depending on @e cipher.
+   */
+  union
+  {
+    /**
+     * If we use #GNUNET_CRYPTO_BSA_CS in @a cipher.
+     */
+    struct GNUNET_CRYPTO_CSPublicRPairP cs_values;
+
+  } details;
+
+};
+
+
+/**
+ * Nonce used to deterministiacally derive input values
+ * used in multi-round blind signature protocols.
+ */
+union GNUNET_CRYPTO_BlindSessionNonce
+{
+  /**
+   * Nonce used when signing with CS.
+   */
+  struct GNUNET_CRYPTO_CsSessionNonce cs_nonce;
+};
+
+
+/**
+ * Compute blinding input values for a given @a nonce and
+ * @a salt.
+ *
+ * @param bsign_priv private key to compute input values for
+ * @param nonce session nonce to derive input values from
+ * @param salt salt to include in derivation logic
+ * @return blinding input values
+ */
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_get_blinding_input_values (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const char *salt);
+
+
+/**
+ * Decrement reference counter of a @a bsign_pub, and free it if it reaches zero.
+ *
+ * @param[in] bsign_pub key to free
+ */
+void
+GNUNET_CRYPTO_blind_sign_pub_decref (
+  struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub);
+
+
+/**
+ * Decrement reference counter of a @a bsign_priv, and free it if it reaches zero.
+ *
+ * @param[in] bsign_priv key to free
+ */
+void
+GNUNET_CRYPTO_blind_sign_priv_decref (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv);
+
+
+/**
+ * Decrement reference counter of a @a ub_sig, and free it if it reaches zero.
+ *
+ * @param[in] ub_sig signature to free
+ */
+void
+GNUNET_CRYPTO_unblinded_sig_decref (
+  struct GNUNET_CRYPTO_UnblindedSignature *ub_sig);
+
+
+/**
+ * Decrement reference counter of a @a blind_sig, and free it if it reaches zero.
+ *
+ * @param[in] blind_sig signature to free
+ */
+void
+GNUNET_CRYPTO_blinded_sig_decref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig);
+
+
+/**
+ * Decrement reference counter of a @a bm, and free it if it reaches zero.
+ *
+ * @param[in] bm blinded message to free
+ */
+void
+GNUNET_CRYPTO_blinded_message_decref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm);
+
+
+/**
+ * Increment reference counter of the given @a bm.
+ *
+ * @param[in,out] bm blinded message to increment reference counter for
+ * @return alias of @a bm with RC incremented
+ */
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_blinded_message_incref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm);
+
+
+/**
+ * Increment reference counter of the given @a bi.
+ *
+ * @param[in,out] bi blinding input values to increment reference counter for
+ * @return alias of @a bi with RC incremented
+ */
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_blinding_input_values_incref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm);
+
+
+/**
+ * Decrement reference counter of the given @a bi, and free it if it reaches
+ * zero.
+ *
+ * @param[in,out] bi blinding input values to decrement reference counter for
+ */
+void
+GNUNET_CRYPTO_blinding_input_values_decref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm);
+
+
+/**
+ * Increment reference counter of the given @a bsign_pub.
+ *
+ * @param[in,out] bsign_pub public key to increment reference counter for
+ * @return alias of @a bsign_pub with RC incremented
+ */
+struct GNUNET_CRYPTO_BlindSignPublicKey *
+GNUNET_CRYPTO_bsign_pub_incref (
+  struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub);
+
+
+/**
+ * Increment reference counter of the given @a bsign_priv.
+ *
+ * @param[in,out] bsign_priv private key to increment reference counter for
+ * @return alias of @a bsign_priv with RC incremented
+ */
+struct GNUNET_CRYPTO_BlindSignPrivateKey *
+GNUNET_CRYPTO_bsign_priv_incref (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv);
+
+
+/**
+ * Increment reference counter of the given @a ub_sig.
+ *
+ * @param[in,out] ub_sig signature to increment reference counter for
+ * @return alias of @a ub_sig with RC incremented
+ */
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_ub_sig_incref (struct GNUNET_CRYPTO_UnblindedSignature *ub_sig);
+
+
+/**
+ * Increment reference counter of the given @a blind_sig.
+ *
+ * @param[in,out] blind_sig signature to increment reference counter for
+ * @return alias of @a blind_sig with RC incremented
+ */
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sig_incref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig);
+
+
+/**
+ * Compare two denomination public keys.
+ *
+ * @param bp1 first key
+ * @param bp2 second key
+ * @return 0 if the keys are equal, otherwise -1 or 1
+ */
+int
+GNUNET_CRYPTO_bsign_pub_cmp (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp1,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp2);
+
+
+/**
+ * Compare two denomination signatures.
+ *
+ * @param sig1 first signature
+ * @param sig2 second signature
+ * @return 0 if the keys are equal, otherwise -1 or 1
+ */
+int
+GNUNET_CRYPTO_ub_sig_cmp (const struct GNUNET_CRYPTO_UnblindedSignature *sig1,
+                          const struct GNUNET_CRYPTO_UnblindedSignature *sig2);
+
+
+/**
+ * Compare two blinded denomination signatures.
+ *
+ * @param sig1 first signature
+ * @param sig2 second signature
+ * @return 0 if the keys are equal, otherwise -1 or 1
+ */
+int
+GNUNET_CRYPTO_blind_sig_cmp (
+  const struct GNUNET_CRYPTO_BlindedSignature *sig1,
+  const struct GNUNET_CRYPTO_BlindedSignature *sig2);
+
+
+/**
+ * Compare two blinded messages.
+ *
+ * @param bp1 first blinded message
+ * @param bp2 second blinded message
+ * @return 0 if the keys are equal, otherwise -1 or 1
+ */
+int
+GNUNET_CRYPTO_blinded_message_cmp (
+  const struct GNUNET_CRYPTO_BlindedMessage *bp1,
+  const struct GNUNET_CRYPTO_BlindedMessage *bp2);
+
+
+/**
+ * Initialize public-private key pair for blind signatures.
+ *
+ * For #GNUNET_CRYPTO_BSA_RSA, an additional "unsigned int"
+ * argument with the number of bits for 'n' (e.g. 2048) must
+ * be passed.
+ *
+ * @param[out] bsign_priv where to write the private key with RC 1
+ * @param[out] bsign_pub where to write the public key with RC 1
+ * @param cipher which type of cipher to use
+ * @param ... RSA key size (eg. 2048/3072/4096)
+ * @return #GNUNET_OK on success, #GNUNET_NO if parameterst were invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  ...);
+
+
+/**
+ * Initialize public-private key pair for blind signatures.
+ *
+ * For #GNUNET_CRYPTO_BSA_RSA, an additional "unsigned int"
+ * argument with the number of bits for 'n' (e.g. 2048) must
+ * be passed.
+ *
+ * @param[out] bsign_priv where to write the private key with RC 1
+ * @param[out] bsign_pub where to write the public key with RC 1
+ * @param cipher which type of cipher to use
+ * @param ap RSA key size (eg. 2048/3072/4096)
+ * @return #GNUNET_OK on success, #GNUNET_NO if parameterst were invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create_va (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  va_list ap);
+
+
+/**
+ * @brief Type of blinding secrets.  Must be exactly 32 bytes (DB).
+ */
+union GNUNET_CRYPTO_BlindingSecretP
+{
+  /**
+   * Clause Schnorr nonce.
+   */
+  struct GNUNET_CRYPTO_CsBlindingNonce nonce;
+
+  /**
+   * Variant for RSA for blind signatures.
+   */
+  struct GNUNET_CRYPTO_RsaBlindingKeySecret rsa_bks;
+};
+
+
+/**
+ * Blind message for blind signing with @a dk using blinding secret @a coin_bks.
+ *
+ * @param bsign_pub public key to blind for
+ * @param bks blinding secret to use
+ * @param nonce nonce used to obtain @a alg_values
+ *        can be NULL if input values are not used for the cipher
+ * @param message message to sign
+ * @param message_size number of bytes in @a message
+ * @param alg_values algorithm specific values to blind the @a message
+ * @return blinded message to give to signer, NULL on error
+ */
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_message_blind_to_sign (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values);
+
+
+/**
+ * Create blind signature.
+ *
+ * @param bsign_priv private key to use for signing
+ * @param salt salt value to use for the HKDF,
+ *        can be NULL if input values are not used for the cipher
+ * @param blinded_message the already blinded message to sign
+ * @return blind signature with RC=1, NULL on failure
+ */
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sign (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const char *salt,
+  const struct GNUNET_CRYPTO_BlindedMessage *blinded_message);
+
+
+/**
+ * Unblind blind signature.
+ *
+ * @param blinded_sig the blind signature
+ * @param bks blinding secret to use
+ * @param message message that was supposedly signed
+ * @param message_size number of bytes in @a message
+ * @param alg_values algorithm specific values
+ * @param bsign_pub public key used for signing
+ * @return unblinded signature with RC=1, NULL on error
+ */
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_blind_sig_unblind (
+  const struct GNUNET_CRYPTO_BlindedSignature *blinded_sig,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub);
+
+
+/**
+ * Verify signature made blindly.
+ *
+ * @param bsign_pub public key
+ * @param ub_sig signature made blindly with the private key
+ * @param message message that was supposedly signed
+ * @param message_size number of bytes in @a message
+ * @return #GNUNET_OK if the signature is valid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sig_verify (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const struct GNUNET_CRYPTO_UnblindedSignature *ub_sig,
+  const void *message,
+  size_t message_size);
+
+
+/**
+ * Get the compacted length of a #GNUNET_CRYPTO_PublicKey.
+ * Compacted means that it returns the minimum number of bytes this
+ * key is long, as opposed to the union structure inside
+ * #GNUNET_CRYPTO_PublicKey.
+ * Useful for compact serializations.
+ *
+ * @param key the key.
+ * @return -1 on error, else the compacted length of the key.
+ */
+ssize_t
+GNUNET_CRYPTO_public_key_get_length (const struct
+                                     GNUNET_CRYPTO_PublicKey *key);
+
+/**
+ * Reads a #GNUNET_CRYPTO_PublicKey from a compact buffer.
+ * The buffer has to contain at least the compacted length of
+ * a #GNUNET_CRYPTO_PublicKey in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the buffer does not contain a valid key, it returns -2 as error.
+ *
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @param key the key
+ * @param the amount of bytes read from the buffer
+ * @return #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_read_public_key_from_buffer (
+  const void *buffer,
+  size_t len,
+  struct GNUNET_CRYPTO_PublicKey *key,
+  size_t *read);
+
+/**
+ * Get the compacted length of a #GNUNET_CRYPTO_PrivateKey.
+ * Compacted means that it returns the minimum number of bytes this
+ * key is long, as opposed to the union structure inside
+ * #GNUNET_CRYPTO_PrivateKey.
+ * Useful for compact serializations.
+ *
+ * @param key the key.
+ * @return -1 on error, else the compacted length of the key.
+ */
+ssize_t
+GNUNET_CRYPTO_private_key_get_length (
+  const struct GNUNET_CRYPTO_PrivateKey *key);
+
+
+/**
+ * Writes a #GNUNET_CRYPTO_PublicKey to a compact buffer.
+ * The buffer requires space for at least the compacted length of
+ * a #GNUNET_CRYPTO_PublicKey in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the key is not valid, it returns -2 as error.
+ *
+ * @param key the key
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @return -1 or -2 on error, else the amount of bytes written to the buffer
+ */
+ssize_t
+GNUNET_CRYPTO_write_public_key_to_buffer (const struct
+                                          GNUNET_CRYPTO_PublicKey *key,
+                                          void*buffer,
+                                          size_t len);
+
+
+/**
+ * Reads a #GNUNET_CRYPTO_PrivateKey from a compact buffer.
+ * The buffer has to contain at least the compacted length of
+ * a #GNUNET_CRYPTO_PrivateKey in bytes.
+ * If the buffer is too small, the function returns GNUNET_SYSERR as error.
+ *
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @param key the key
+ * @param the amount of bytes read from the buffer
+ * @return #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_read_private_key_from_buffer (
+  const void*buffer,
+  size_t len,
+  struct GNUNET_CRYPTO_PrivateKey *key,
+  size_t *read);
+
+
+/**
+ * Writes a #GNUNET_CRYPTO_PrivateKey to a compact buffer.
+ * The buffer requires space for at least the compacted length of
+ * a #GNUNET_CRYPTO_PrivateKey in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the key is not valid, it returns -2 as error.
+ *
+ * @param key the key
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @return -1 or -2 on error, else the amount of bytes written to the buffer
+ */
+ssize_t
+GNUNET_CRYPTO_write_private_key_to_buffer (
+  const struct GNUNET_CRYPTO_PrivateKey *key,
+  void*buffer,
+  size_t len);
+
+
+/**
+ * Get the compacted length of a #GNUNET_CRYPTO_Signature.
+ * Compacted means that it returns the minimum number of bytes this
+ * signature is long, as opposed to the union structure inside
+ * #GNUNET_CRYPTO_Signature.
+ * Useful for compact serializations.
+ *
+ * @param sig the signature.
+ * @return -1 on error, else the compacted length of the signature.
+ */
+ssize_t
+GNUNET_CRYPTO_signature_get_length (
+  const struct GNUNET_CRYPTO_Signature *sig);
+
+
+/**
+ * Get the compacted length of a signature by type.
+ * Compacted means that it returns the minimum number of bytes this
+ * signature is long, as opposed to the union structure inside
+ * #GNUNET_CRYPTO_Signature.
+ * Useful for compact serializations.
+ *
+ * @param sig the signature.
+ * @return -1 on error, else the compacted length of the signature.
+ */
+ssize_t
+GNUNET_CRYPTO_signature_get_raw_length_by_type (uint32_t type);
+
+
+/**
+ * Reads a #GNUNET_CRYPTO_Signature from a compact buffer.
+ * The buffer has to contain at least the compacted length of
+ * a #GNUNET_CRYPTO_Signature in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the buffer does not contain a valid key, it returns -2 as error.
+ *
+ * @param sig the signature
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @return -1 or -2 on error, else the amount of bytes read from the buffer
+ */
+ssize_t
+GNUNET_CRYPTO_read_signature_from_buffer (
+  struct GNUNET_CRYPTO_Signature *sig,
+  const void*buffer,
+  size_t len);
+
+
+/**
+ * Writes a #GNUNET_CRYPTO_Signature to a compact buffer.
+ * The buffer requires space for at least the compacted length of
+ * a #GNUNET_CRYPTO_Signature in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the key is not valid, it returns -2 as error.
+ *
+ * @param sig the signature
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @return -1 or -2 on error, else the amount of bytes written to the buffer
+ */
+ssize_t
+GNUNET_CRYPTO_write_signature_to_buffer (
+  const struct GNUNET_CRYPTO_Signature *sig,
+  void*buffer,
+  size_t len);
+
+
+/**
+ * @brief Sign a given block.
+ *
+ * The @a purpose data is the beginning of the data of which the signature is
+ * to be created. The `size` field in @a purpose must correctly indicate the
+ * number of bytes of the data structure, including its header. If possible,
+ * use #GNUNET_CRYPTO_sign() instead of this function.
+ *
+ * @param priv private key to use for the signing
+ * @param purpose what to sign (size, purpose)
+ * @param[out] sig where to write the signature
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_ (
+  const struct GNUNET_CRYPTO_PrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_Signature *sig);
+
+/**
+ * @brief Sign a given block.
+ *
+ * The @a purpose data is the beginning of the data of which the signature is
+ * to be created. The `size` field in @a purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.
+ * The signature payload and length depends on the key type.
+ *
+ * @param priv private key to use for the signing
+ * @param purpose what to sign (size, purpose)
+ * @param[out] sig where to write the signature
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_raw_ (
+  const struct GNUNET_CRYPTO_PrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  unsigned char *sig);
+
+
+/**
+ * @brief Sign a given block with #GNUNET_CRYPTO_PrivateKey.
+ *
+ * The @a ps data must be a fixed-size struct for which the signature is to be
+ * created. The `size` field in @a ps->purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.
+ *
+ * @param priv private key to use for the signing
+ * @param ps packed struct with what to sign, MUST begin with a purpose
+ * @param[out] sig where to write the signature
+ */
+#define GNUNET_CRYPTO_sign(priv,ps,sig) do {                \
+    /* check size is set correctly */                                     \
+    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));         \
+    /* check 'ps' begins with the purpose */                              \
+    GNUNET_static_assert (((void*) (ps)) ==                               \
+                          ((void*) &(ps)->purpose));                      \
+    GNUNET_assert (GNUNET_OK ==                                           \
+                   GNUNET_CRYPTO_sign_ (priv,               \
+                                        &(ps)->purpose,             \
+                                        sig));                      \
+} while (0)
+
+
+/**
+ * @brief Verify a given signature.
+ *
+ * The @a validate data is the beginning of the data of which the signature
+ * is to be verified. The `size` field in @a validate must correctly indicate
+ * the number of bytes of the data structure, including its header.  If @a
+ * purpose does not match the purpose given in @a validate (the latter must be
+ * in big endian), signature verification fails.  If possible,
+ * use #GNUNET_CRYPTO_signature_verify() instead of this function (only if @a validate
+ * is not fixed-size, you must use this function directly).
+ *
+ * @param purpose what is the purpose that the signature should have?
+ * @param validate block to validate (size, purpose, data)
+ * @param sig signature that is being validated
+ * @param pub public key of the signer
+ * @returns #GNUNET_OK if ok, #GNUNET_SYSERR if invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_signature_verify_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const struct GNUNET_CRYPTO_Signature *sig,
+  const struct GNUNET_CRYPTO_PublicKey *pub);
+
+/**
+ * @brief Verify a given signature.
+ *
+ * The @a validate data is the beginning of the data of which the signature
+ * is to be verified. The `size` field in @a validate must correctly indicate
+ * the number of bytes of the data structure, including its header.  If @a
+ * purpose does not match the purpose given in @a validate (the latter must be
+ * in big endian), signature verification fails.
+ *
+ * @param purpose what is the purpose that the signature should have?
+ * @param validate block to validate (size, purpose, data)
+ * @param sig signature that is being validated
+ * @param pub public key of the signer
+ * @returns #GNUNET_OK if ok, #GNUNET_SYSERR if invalid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_signature_verify_raw_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const unsigned char *sig,
+  const struct GNUNET_CRYPTO_PublicKey *pub);
+
+
+/**
+ * @brief Verify a given signature with #GNUNET_CRYPTO_PublicKey.
+ *
+ * The @a ps data must be a fixed-size struct for which the signature is to be
+ * created. The `size` field in @a ps->purpose must correctly indicate the
+ * number of bytes of the data structure, including its header.
+ *
+ * @param purp purpose of the signature, must match 'ps->purpose.purpose'
+ *              (except in host byte order)
+ * @param ps packed struct with what to sign, MUST begin with a purpose
+ * @param sig where to read the signature from
+ * @param pub public key to use for the verifying
+ */
+#define GNUNET_CRYPTO_signature_verify(purp,ps,sig,pub) ({             \
+    /* check size is set correctly */                                     \
+    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));         \
+    /* check 'ps' begins with the purpose */                              \
+    GNUNET_static_assert (((void*) (ps)) ==                               \
+                          ((void*) &(ps)->purpose));                      \
+    GNUNET_CRYPTO_signature_verify_ (purp,                              \
+                                     &(ps)->purpose,                    \
+                                     sig,                               \
+                                     pub);                              \
+  })
+
+
+/**
+ * Encrypt a block with #GNUNET_CRYPTO_PublicKey and derives a
+ * #GNUNET_CRYPTO_EcdhePublicKey which is required for decryption
+ * using ecdh to derive a symmetric key.
+ *
+ * @param block the block to encrypt
+ * @param size the size of the @a block
+ * @param pub public key to use for ecdh
+ * @param ecc where to write the ecc public key
+ * @param result the output parameter in which to store the encrypted result
+ *               can be the same or overlap with @c block
+ * @returns the size of the encrypted block, -1 for errors.
+ *          Due to the use of CFB and therefore an effective stream cipher,
+ *          this size should be the same as @c len.
+ */
+ssize_t
+GNUNET_CRYPTO_encrypt_old (const void *block,
+                           size_t size,
+                           const struct GNUNET_CRYPTO_PublicKey *pub,
+                           struct GNUNET_CRYPTO_EcdhePublicKey *ecc,
+                           void *result);
+
+
+/**
+ * Decrypt a given block with #GNUNET_CRYPTO_PrivateKey and a given
+ * #GNUNET_CRYPTO_EcdhePublicKey using ecdh to derive a symmetric key.
+ *
+ * @param block the data to decrypt, encoded as returned by encrypt
+ * @param size the size of the @a block to decrypt
+ * @param priv private key to use for ecdh
+ * @param ecc the ecc public key
+ * @param result address to store the result at
+ *               can be the same or overlap with @c block
+ * @return -1 on failure, size of decrypted block on success.
+ *         Due to the use of CFB and therefore an effective stream cipher,
+ *         this size should be the same as @c size.
+ */
+ssize_t
+GNUNET_CRYPTO_decrypt_old (
+  const void *block,
+  size_t size,
+  const struct GNUNET_CRYPTO_PrivateKey *priv,
+  const struct GNUNET_CRYPTO_EcdhePublicKey *ecc,
+  void *result);
+
+#define GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES (crypto_secretbox_MACBYTES \
+                                              + sizeof (struct \
+                                                        GNUNET_CRYPTO_FoKemC))
+
+/**
+ * Encrypt a block with #GNUNET_CRYPTO_PublicKey and derives a
+ * #GNUNET_CRYPTO_EcdhePublicKey which is required for decryption
+ * using ecdh to derive a symmetric key.
+ *
+ * Note that the result buffer for the ciphertext must be the length of
+ * the message to encrypt plus #GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES.
+ *
+ * @param block the block to encrypt
+ * @param size the size of the @a block
+ * @param pub public key to encrypt for
+ * @param result the output parameter in which to store the encrypted result
+ *               can be the same or overlap with @c block
+ * @returns GNUNET_OK on success.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_encrypt (const void *block,
+                       size_t size,
+                       const struct GNUNET_CRYPTO_PublicKey *pub,
+                       void *result,
+                       size_t result_size);
+
+
+/**
+ * Decrypt a given block with #GNUNET_CRYPTO_PrivateKey and a given
+ * #GNUNET_CRYPTO_EcdhePublicKey using ecdh to derive a symmetric key.
+ *
+ * @param block the data to decrypt, encoded as returned by encrypt
+ * @param size the size of the @a block to decrypt
+ * @param priv private key to use for ecdh
+ * @param result address to store the result at
+ *               can be the same or overlap with @c block
+ * @returns GNUNET_OK on success.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_decrypt (const void *block,
+                       size_t size,
+                       const struct GNUNET_CRYPTO_PrivateKey *priv,
+                       void *result,
+                       size_t result_size);
+
+
+/**
+ * Creates a (Base32) string representation of the public key.
+ * The resulting string encodes a compacted representation of the key.
+ * See also #GNUNET_CRYPTO_key_get_length.
+ *
+ * @param key the key.
+ * @return the string representation of the key, or NULL on error.
+ */
+char *
+GNUNET_CRYPTO_public_key_to_string (
+  const struct GNUNET_CRYPTO_PublicKey *key);
+
+
+/**
+ * Creates a (Base32) string representation of the private key.
+ * The resulting string encodes a compacted representation of the key.
+ * See also #GNUNET_CRYPTO_key_get_length.
+ *
+ * @param key the key.
+ * @return the string representation of the key, or NULL on error.
+ */
+char *
+GNUNET_CRYPTO_private_key_to_string (
+  const struct GNUNET_CRYPTO_PrivateKey *key);
+
+
+/**
+ * Parses a (Base32) string representation of the public key.
+ * See also #GNUNET_CRYPTO_public_key_to_string.
+ *
+ * @param str the encoded key.
+ * @param key where to write the key.
+ * @return GNUNET_SYSERR on error.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_public_key_from_string (const char*str,
+                                      struct GNUNET_CRYPTO_PublicKey *key);
+
+
+/**
+ * Parses a (Base32) string representation of the private key.
+ * See also #GNUNET_CRYPTO_private_key_to_string.
+ *
+ * @param str the encoded key.
+ * @param key where to write the key.
+ * @return GNUNET_SYSERR on error.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_private_key_from_string (const char*str,
+                                       struct GNUNET_CRYPTO_PrivateKey *key);
+
+
+/**
+ * Retrieves the public key representation of a private key.
+ *
+ * @param privkey the private key.
+ * @param key the public key result.
+ * @return GNUNET_SYSERR on error.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_key_get_public (const struct
+                              GNUNET_CRYPTO_PrivateKey *privkey,
+                              struct GNUNET_CRYPTO_PublicKey *key);
+
 #if 0 /* keep Emacsens' auto-indent happy */
 {
 #endif
@@ -2446,4 +4498,7 @@ GNUNET_CRYPTO_rsa_verify (const struct GNUNET_HashCode *hash,
 
 /* ifndef GNUNET_CRYPTO_LIB_H */
 #endif
+
+/** @} */ /* end of group addition */
+
 /* end of gnunet_crypto_lib.h */
diff --git a/src/include/gnunet_curl_lib.h b/src/include/gnunet_curl_lib.h
index 38acecc48..967170085 100644
--- a/src/include/gnunet_curl_lib.h
+++ b/src/include/gnunet_curl_lib.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup lib_extra Additional libraries
+ * @{
+ *
  * @file src/include/gnunet_curl_lib.h
  * @brief library to make it easy to download JSON replies over HTTP
  * @author Sree Harsha Totakura <sreeharsha@totakura.in>
@@ -29,13 +32,8 @@
  */
 #ifndef GNUNET_CURL_LIB_H
 #define GNUNET_CURL_LIB_H
-#if HAVE_LIBCURL
+
 #include <curl/curl.h>
-#elif HAVE_LIBGNURL
-#include <gnurl/curl.h>
-#else
-#error "needs curl or gnurl"
-#endif
 #include "gnunet_util_lib.h"
 
 
@@ -230,7 +228,7 @@ typedef void
  *           be executed AND cleaned up
  * @param jcc callback to invoke upon completion
  * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
+ * @return NULL on error (in this case, @a eh is still released!)
  */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add (struct GNUNET_CURL_Context *ctx,
@@ -252,7 +250,7 @@ GNUNET_CURL_job_add (struct GNUNET_CURL_Context *ctx,
  *           be executed AND cleaned up
  * @param jcc callback to invoke upon completion
  * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
+ * @return NULL on error (in this case, @a eh is still released!)
  */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add_with_ct_json (struct GNUNET_CURL_Context *ctx,
@@ -310,7 +308,7 @@ GNUNET_CURL_set_tlscert (struct GNUNET_CURL_Context *ctx,
  * @param job_headers extra headers to add for this request
  * @param jcc callback to invoke upon completion
  * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
+ * @return NULL on error (in this case, @a eh is still released!)
  */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add2 (struct GNUNET_CURL_Context *ctx,
@@ -330,10 +328,9 @@ GNUNET_CURL_job_add2 (struct GNUNET_CURL_Context *ctx,
  * @param eh curl easy handle for the request, will
  *           be executed AND cleaned up
  * @param job_headers extra headers to add for this request
- * @param max_reply_size largest acceptable response body
  * @param jcc callback to invoke upon completion
  * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
+ * @return NULL on error (in this case, @a eh is still released!)
  */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add_raw (struct GNUNET_CURL_Context *ctx,
@@ -436,11 +433,13 @@ GNUNET_CURL_enable_async_scope_header (struct GNUNET_CURL_Context *ctx,
  *
  * @returns #GNUNET_YES iff given a valid scope ID
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_CURL_is_valid_scope_id (const char *scope_id);
 
 
 #endif
 /** @} */  /* end of group */
 
+/** @} */  /* end of group addition to lib_extra */
+
 /* end of gnunet_curl_lib.h */
diff --git a/src/include/gnunet_datacache_lib.h b/src/include/gnunet_datacache_lib.h
index 40885803b..2c7bf1e8f 100644
--- a/src/include/gnunet_datacache_lib.h
+++ b/src/include/gnunet_datacache_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2015 GNUnet e.V.
+     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup dht_libs  DHT and support libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -37,8 +40,10 @@
 #ifndef GNUNET_DATACACHE_LIB_H
 #define GNUNET_DATACACHE_LIB_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
+#include "gnunet_dht_service.h"
 
 #ifdef __cplusplus
 extern "C"
@@ -50,6 +55,59 @@ extern "C"
 
 
 /**
+ * Information about a block stored in the datacache.
+ */
+struct GNUNET_DATACACHE_Block
+{
+  /**
+   * Key of the block.
+   */
+  struct GNUNET_HashCode key;
+
+  /**
+   * When does the block expire?
+   */
+  struct GNUNET_TIME_Absolute expiration_time;
+
+  /**
+   * If the path was truncated, this is the peer
+   * ID at which the path was truncated.
+   */
+  struct GNUNET_PeerIdentity trunc_peer;
+
+  /**
+   * PUT path taken by the block, array of peer identities.
+   */
+  const struct GNUNET_DHT_PathElement *put_path;
+
+  /**
+   * Actual block data.
+   */
+  const void *data;
+
+  /**
+   * Number of bytes in @a data.
+   */
+  size_t data_size;
+
+  /**
+   * Length of the @e put_path array.
+   */
+  unsigned int put_path_length;
+
+  /**
+   * Type of the block.
+   */
+  enum GNUNET_BLOCK_Type type;
+
+  /**
+   * Options for routing for the block.
+   */
+  enum GNUNET_DHT_RouteOption ro;
+};
+
+
+/**
  * Handle to the cache.
  */
 struct GNUNET_DATACACHE_Handle;
@@ -80,50 +138,26 @@ GNUNET_DATACACHE_destroy (struct GNUNET_DATACACHE_Handle *h);
  * An iterator over a set of items stored in the datacache.
  *
  * @param cls closure
- * @param key key for the content
- * @param data_size number of bytes in @a data
- * @param data content stored
- * @param type type of the content
- * @param exp when will the content expire?
- * @param path_info_len number of entries in @a path_info
- * @param path_info a path through the network
+ * @param block a block from the datacache
  * @return #GNUNET_OK to continue iterating, #GNUNET_SYSERR to abort
  */
-typedef int
-(*GNUNET_DATACACHE_Iterator) (void *cls,
-                              const struct GNUNET_HashCode *key,
-                              size_t data_size,
-                              const char *data,
-                              enum GNUNET_BLOCK_Type type,
-                              struct GNUNET_TIME_Absolute exp,
-                              unsigned int path_info_len,
-                              const struct GNUNET_PeerIdentity *path_info);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_DATACACHE_Iterator)(void *cls,
+                             const struct GNUNET_DATACACHE_Block *block);
 
 
 /**
  * Store an item in the datacache.
  *
  * @param h handle to the datacache
- * @param key key to store data under
- * @param how close is @a key to our pid?
- * @param data_size number of bytes in @a data
- * @param data data to store
- * @param type type of the value
- * @param discard_time when to discard the value in any case
- * @param path_info_len number of entries in @a path_info
- * @param path_info a path through the network
+ * @param xor_distance how close is the block's key to our pid?
+ * @param block actual block data to store
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error, #GNUNET_NO if duplicate
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_DATACACHE_put (struct GNUNET_DATACACHE_Handle *h,
-                      const struct GNUNET_HashCode *key,
                       uint32_t xor_distance,
-                      size_t data_size,
-                      const char *data,
-                      enum GNUNET_BLOCK_Type type,
-                      struct GNUNET_TIME_Absolute discard_time,
-                      unsigned int path_info_len,
-                      const struct GNUNET_PeerIdentity *path_info);
+                      const struct GNUNET_DATACACHE_Block *block);
 
 
 /**
@@ -146,20 +180,6 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 
 
 /**
- * Obtain a random element from the datacache.
- *
- * @param h handle to the datacache
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found (zero or 1)
- */
-unsigned int
-GNUNET_DATACACHE_get_random (struct GNUNET_DATACACHE_Handle *h,
-                             GNUNET_DATACACHE_Iterator iter,
-                             void *iter_cls);
-
-
-/**
  * Iterate over the results that are "close" to a particular key in
  * the datacache.  "close" is defined as numerically larger than @a
  * key (when interpreted as a circular address space), with small
@@ -167,6 +187,7 @@ GNUNET_DATACACHE_get_random (struct GNUNET_DATACACHE_Handle *h,
  *
  * @param h handle to the datacache
  * @param key area of the keyspace to look into
+ * @param type entries of which type are relevant?
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -175,6 +196,7 @@ GNUNET_DATACACHE_get_random (struct GNUNET_DATACACHE_Handle *h,
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                               const struct GNUNET_HashCode *key,
+                              enum GNUNET_BLOCK_Type type,
                               unsigned int num_results,
                               GNUNET_DATACACHE_Iterator iter,
                               void *iter_cls);
@@ -190,3 +212,5 @@ GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_datacache_plugin.h b/src/include/gnunet_datacache_plugin.h
index d7fa8fde0..e144e155e 100644
--- a/src/include/gnunet_datacache_plugin.h
+++ b/src/include/gnunet_datacache_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2015 GNUnet e.V.
+     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup dht_libs  DHT and support libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef PLUGIN_DATACACHE_H
 #define PLUGIN_DATACACHE_H
 
+
 #include "gnunet_datacache_lib.h"
 
 #ifdef __cplusplus
@@ -105,25 +109,15 @@ struct GNUNET_DATACACHE_PluginFunctions
    * Store an item in the datastore.
    *
    * @param cls closure (internal context for the plugin)
-   * @param key key to store the value under
    * @param xor_distance how close is @a key to our PID?
-   * @param size number of bytes in @a data
-   * @param data data to store
-   * @param type type of the value
-   * @param discard_time when to discard the value in any case
-   * @param path_info_len number of entries in @a path_info
-   * @param path_info a path through the network
+   * @param block data to store
    * @return 0 if duplicate, -1 on error, number of bytes used otherwise
    */
-  ssize_t (*put) (void *cls,
-                  const struct GNUNET_HashCode *key,
-                  uint32_t xor_distance,
-                  size_t size,
-                  const char *data,
-                  enum GNUNET_BLOCK_Type type,
-                  struct GNUNET_TIME_Absolute discard_time,
-                  unsigned int path_info_len,
-                  const struct GNUNET_PeerIdentity *path_info);
+  ssize_t
+  (*put) (void *cls,
+          uint32_t xor_distance,
+          const struct GNUNET_DATACACHE_Block *block);
+
 
   /**
    * Iterate over the results for a particular key
@@ -136,11 +130,13 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return the number of results found
    */
-  unsigned int (*get) (void *cls,
-                       const struct GNUNET_HashCode *key,
-                       enum GNUNET_BLOCK_Type type,
-                       GNUNET_DATACACHE_Iterator iter,
-                       void *iter_cls);
+  unsigned int
+  (*get) (void *cls,
+          const struct GNUNET_HashCode *key,
+          enum GNUNET_BLOCK_Type type,
+          GNUNET_DATACACHE_Iterator iter,
+          void *iter_cls);
+
 
   /**
    * Delete the entry with the lowest expiration value
@@ -149,39 +145,32 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param cls closure (internal context for the plugin)
    * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
    */
-  int (*del) (void *cls);
-
-  /**
-   * Return a random value from the datastore.
-   *
-   * @param cls closure (internal context for the plugin)
-   * @param iter maybe NULL (to just count)
-   * @param iter_cls closure for @a iter
-   * @return the number of results found (zero or one)
-   */
-  unsigned int (*get_random) (void *cls,
-                              GNUNET_DATACACHE_Iterator iter,
-                              void *iter_cls);
+  enum GNUNET_GenericReturnValue
+  (*del)(void *cls);
 
 
   /**
-   * Iterate over the results that are "close" to a particular key in
-   * the datacache.  "close" is defined as numerically larger than @a
-   * key (when interpreted as a circular address space), with small
-   * distance.
+   * Iterate over the results that are "close" to a particular key in the
+   * datacache.  "close" is defined as returning the @a num_results that are
+   * numerically closest and larger than @a key and also @a num_results that
+   * are numerically lower than @a key. Thus, the maximum number of results
+   * returned is actually twice @a num_results.
    *
    * @param cls closure (internal context for the plugin)
    * @param key area of the keyspace to look into
-   * @param num_results number of results that should be returned to @a iter
+   * @param type desired block type for the replies
+   * @param num_results half the number of results that should be returned to @a iter
    * @param iter maybe NULL (to just count)
    * @param iter_cls closure for @a iter
    * @return the number of results found
    */
-  unsigned int (*get_closest) (void *cls,
-                               const struct GNUNET_HashCode *key,
-                               unsigned int num_results,
-                               GNUNET_DATACACHE_Iterator iter,
-                               void *iter_cls);
+  unsigned int
+  (*get_closest) (void *cls,
+                  const struct GNUNET_HashCode *key,
+                  enum GNUNET_BLOCK_Type type,
+                  unsigned int num_results,
+                  GNUNET_DATACACHE_Iterator iter,
+                  void *iter_cls);
 };
 
 
@@ -195,3 +184,5 @@ struct GNUNET_DATACACHE_PluginFunctions
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_datastore_plugin.h b/src/include/gnunet_datastore_plugin.h
index 113f6b2f2..c4f31c7ce 100644
--- a/src/include/gnunet_datastore_plugin.h
+++ b/src/include/gnunet_datastore_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup fs_l2  File sharing and support services/libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef PLUGIN_DATASTORE_H
 #define PLUGIN_DATASTORE_H
 
+
 #include "gnunet_block_lib.h"
 #include "gnunet_configuration_lib.h"
 #include "gnunet_datastore_service.h"
@@ -98,17 +102,17 @@ struct GNUNET_DATASTORE_PluginEnvironment
  * @return #GNUNET_OK to keep the item
  *         #GNUNET_NO to delete the item
  */
-typedef int
-(*PluginDatumProcessor) (void *cls,
-                         const struct GNUNET_HashCode *key,
-                         uint32_t size,
-                         const void *data,
-                         enum GNUNET_BLOCK_Type type,
-                         uint32_t priority,
-                         uint32_t anonymity,
-                         uint32_t replication,
-                         struct GNUNET_TIME_Absolute expiration,
-                         uint64_t uid);
+typedef enum GNUNET_GenericReturnValue
+(*PluginDatumProcessor)(void *cls,
+                        const struct GNUNET_HashCode *key,
+                        uint32_t size,
+                        const void *data,
+                        enum GNUNET_BLOCK_Type type,
+                        uint32_t priority,
+                        uint32_t anonymity,
+                        uint32_t replication,
+                        struct GNUNET_TIME_Absolute expiration,
+                        uint64_t uid);
 
 
 /**
@@ -377,3 +381,5 @@ struct GNUNET_DATASTORE_PluginFunctions
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_datastore_service.h b/src/include/gnunet_datastore_service.h
index c99db67bc..153387238 100644
--- a/src/include/gnunet_datastore_service.h
+++ b/src/include/gnunet_datastore_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup fs_l2  File sharing and support services/libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -39,6 +42,7 @@
 #ifndef GNUNET_DATASTORE_SERVICE_H
 #define GNUNET_DATASTORE_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 
@@ -361,3 +365,5 @@ GNUNET_DATASTORE_cancel (struct GNUNET_DATASTORE_QueueEntry *qe);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_db_lib.h b/src/include/gnunet_db_lib.h
index e88e836f6..1ff665c2b 100644
--- a/src/include/gnunet_db_lib.h
+++ b/src/include/gnunet_db_lib.h
@@ -25,6 +25,7 @@
 #ifndef GNUNET_DB_LIB_H
 #define GNUNET_DB_LIB_H
 
+
 #include "gnunet_common.h"
 
 /**
diff --git a/src/include/gnunet_dht_block_types.h b/src/include/gnunet_dht_block_types.h
new file mode 100644
index 000000000..ab46af410
--- /dev/null
+++ b/src/include/gnunet_dht_block_types.h
@@ -0,0 +1,156 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012-2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+#ifndef GNUNET_DHT_BLOCK_TYPES_H
+#define GNUNET_DHT_BLOCK_TYPES_H
+
+/**
+ * WARNING:
+ * This header is generated!
+ * In order to add DHT block types, you must register
+ * them in GANA, and then use the header generation script
+ * to create an update of this file. You may then replace this
+ * file with the update.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+/**
+ * Blocks in the datastore and the datacache must have a unique type.
+ */
+enum GNUNET_BLOCK_Type
+{
+
+
+  /**
+   * Identifier for any block.
+   */
+  GNUNET_BLOCK_TYPE_ANY = 0,
+
+
+  /**
+   * Data block (leaf) in the CHK tree.
+   */
+  GNUNET_BLOCK_TYPE_FS_DBLOCK = 1,
+
+
+  /**
+   * Inner block in the CHK tree.
+   */
+  GNUNET_BLOCK_TYPE_FS_IBLOCK = 2,
+
+
+  /**
+   * Type of a block representing a block to be encoded on demand from disk. Should never appear on the network directly.
+   */
+  GNUNET_BLOCK_TYPE_FS_ONDEMAND = 6,
+
+
+  /**
+   * Legacy type of a block that contains a HELLO for a peer.
+   */
+  GNUNET_BLOCK_TYPE_LEGACY_HELLO = 7,
+
+
+  /**
+   * Block for testing.
+   */
+  GNUNET_BLOCK_TYPE_TEST = 8,
+
+
+  /**
+   * Type of a block representing any type of search result (universal).
+   */
+  GNUNET_BLOCK_TYPE_FS_UBLOCK = 9,
+
+
+  /**
+   * Block for storing DNS exit service advertisements.
+   */
+  GNUNET_BLOCK_TYPE_DNS = 10,
+
+
+  /**
+   * Block for storing GNS record data.
+   */
+  GNUNET_BLOCK_TYPE_GNS_NAMERECORD = 11,
+
+
+  /**
+   * Block type for a revocation message by which a key is revoked.
+   */
+  GNUNET_BLOCK_TYPE_REVOCATION = 12,
+
+
+  /**
+   * Type of a block that contains a DHT-NG HELLO for a peer.
+   */
+  GNUNET_BLOCK_TYPE_DHT_HELLO = 13,
+
+
+  /**
+   * Block to store a cadet regex state
+   */
+  GNUNET_BLOCK_TYPE_REGEX = 22,
+
+
+  /**
+   * Block to store a cadet regex accepting state
+   */
+  GNUNET_BLOCK_TYPE_REGEX_ACCEPT = 23,
+
+
+  /**
+   * Block for testing set/consensus.  If first byte of the block is non-zero, the block is considered invalid.
+   */
+  GNUNET_BLOCK_TYPE_SET_TEST = 24,
+
+
+  /**
+   * Block type for consensus elements. Contains either special marker elements or a nested block.
+   */
+  GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT = 25,
+
+
+  /**
+   * Block for testing set intersection.  If first byte of the block is non-zero, the block is considered invalid.
+   */
+  GNUNET_BLOCK_TYPE_SETI_TEST = 26,
+
+
+  /**
+   * Block for testing set union.  If first byte of the block is non-zero, the block is considered invalid.
+   */
+  GNUNET_BLOCK_TYPE_SETU_TEST = 27,
+};
+
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index d4a4ed7d2..a1ea31c25 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -1,6 +1,6 @@
 /*
       This file is part of GNUnet
-      Copyright (C) 2004-2013, 2016 GNUnet e.V.
+      Copyright (C) 2004-2013, 2016, 2022 GNUnet e.V.
 
       GNUnet is free software: you can redistribute it and/or modify it
       under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,11 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ * @addtogroup dht_libs  DHT and support libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -35,9 +40,9 @@
 #ifndef GNUNET_DHT_SERVICE_H
 #define GNUNET_DHT_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
-#include "gnunet_hello_lib.h"
 
 #ifdef __cplusplus
 extern "C"
@@ -56,6 +61,12 @@ extern "C"
 
 
 /**
+ * Maximum allowed replication level for all requests.
+ */
+#define GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL 16
+
+
+/**
  * Connection to the DHT service.
  */
 struct GNUNET_DHT_Handle;
@@ -95,18 +106,88 @@ enum GNUNET_DHT_RouteOption
   GNUNET_DHT_RO_RECORD_ROUTE = 2,
 
   /**
-   * This is a 'FIND-PEER' request, so approximate results are fine.
+   * Approximate results are fine.
+   */
+  GNUNET_DHT_RO_FIND_APPROXIMATE = 4,
+
+  /**
+   * Flag set if the path was truncated.
+   */
+  GNUNET_DHT_RO_TRUNCATED = 8,
+
+  /**
+   * Flag given to monitors if this was the last hop for a GET/PUT.
+   * This is only used for internal processing.
+   */
+  GNUNET_DHT_RO_LAST_HOP = 32768
+};
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Message signed by a peer when doing path tracking.
+ */
+struct GNUNET_DHT_HopSignature
+{
+  /**
+   * Must be #GNUNET_SIGNATURE_PURPOSE_DHT_HOP.
    */
-  GNUNET_DHT_RO_FIND_PEER = 4,
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
   /**
-    * Flag given to monitors if this was the last hop for a GET/PUT.
-    * This is only used for internal processing.
-    */
-  GNUNET_DHT_RO_LAST_HOP = 65535
+   * Expiration time of the block.
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /**
+   * Hash over the payload of the block.
+   */
+  struct GNUNET_HashCode h_data GNUNET_PACKED;
+
+  /**
+   * Previous hop the message was received from.  All zeros
+   * if this peer was the initiator.
+   */
+  struct GNUNET_PeerIdentity pred;
+
+  /**
+   * Next hop the message was forwarded to.
+   */
+  struct GNUNET_PeerIdentity succ;
+};
+
+
+/**
+ * A (signed) path tracking a block's flow through the DHT is represented by
+ * an array of path elements, each consisting of a peer on the path and a
+ * signature by which the peer affirms its routing decision.
+ */
+struct GNUNET_DHT_PathElement
+{
+  /**
+   * Signature affirming the hop of type
+   * #GNUNET_SIGNATURE_PURPOSE_DHT_HOP.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+
+  /**
+   * Previous peer on the path (matches "pred" in the signed field).
+   *
+   * The public key used to create the @e sig is in the *next* path element,
+   * or is the sender of the message if this was the last path element.
+   *
+   * The "succ" field can be found in 'pred' if there are two more path
+   * elements in the path, is the sender if there is only one more path
+   * element, or the recipient if this was the last element on the path.
+   */
+  struct GNUNET_PeerIdentity pred;
+
 };
 
 
+GNUNET_NETWORK_STRUCT_END
+
 /**
  * Initialize the connection with the DHT service.
  *
@@ -190,13 +271,16 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
  *
  * @param cls closure
  * @param exp when will this value expire
- * @param key key of the result
+ * @param query_hash key of the query
+ * @param trunc_peer peer where the path was truncated, or NULL if the path is complete
  * @param get_path peers on reply path (or NULL if not recorded)
  *                 [0] = datastore's first neighbor, [length - 1] = local peer
  * @param get_path_length number of entries in @a get_path
  * @param put_path peers on the PUT path (or NULL if not recorded)
  *                 [0] = origin, [length - 1] = datastore
- * @param put_path_length number of entries in @a put_path
+ * @param put_path_length number of entries in @a put_path,
+ *        note that the last signature will be all zeros as
+ *        we did not forward and thus did not sign!
  * @param type type of the result
  * @param size number of bytes in @a data
  * @param data pointer to the result data
@@ -204,10 +288,11 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
 typedef void
 (*GNUNET_DHT_GetIterator) (void *cls,
                            struct GNUNET_TIME_Absolute exp,
-                           const struct GNUNET_HashCode *key,
-                           const struct GNUNET_PeerIdentity *get_path,
+                           const struct GNUNET_HashCode *query_hash,
+                           const struct GNUNET_PeerIdentity *trunc_peer,
+                           const struct GNUNET_DHT_PathElement *get_path,
                            unsigned int get_path_length,
-                           const struct GNUNET_PeerIdentity *put_path,
+                           const struct GNUNET_DHT_PathElement *put_path,
                            unsigned int put_path_length,
                            enum GNUNET_BLOCK_Type type,
                            size_t size,
@@ -280,8 +365,6 @@ struct GNUNET_DHT_MonitorHandle;
  * @param options Options, for instance RecordRoute, DemultiplexEverywhere.
  * @param type The type of data in the request.
  * @param hop_count Hop count so far.
- * @param path_length number of entries in @a path (or 0 if not recorded).
- * @param path peers on the GET path (or NULL if not recorded).
  * @param desired_replication_level Desired replication level.
  * @param key Key of the requested data.
  */
@@ -291,8 +374,6 @@ typedef void
                             enum GNUNET_BLOCK_Type type,
                             uint32_t hop_count,
                             uint32_t desired_replication_level,
-                            unsigned int path_length,
-                            const struct GNUNET_PeerIdentity *path,
                             const struct GNUNET_HashCode *key);
 
 
@@ -301,7 +382,10 @@ typedef void
  *
  * @param cls Closure.
  * @param type The type of data in the result.
+ * @param trunc_peer peer where the path was truncated, or NULL if the path is complete
  * @param get_path Peers on GET path (or NULL if not recorded).
+ *        note that the last signature will be all zeros as
+ *        we did not forward and thus did not sign!
  * @param get_path_length number of entries in @a get_path.
  * @param put_path peers on the PUT path (or NULL if not recorded).
  * @param put_path_length number of entries in @a get_path.
@@ -313,9 +397,10 @@ typedef void
 typedef void
 (*GNUNET_DHT_MonitorGetRespCB) (void *cls,
                                 enum GNUNET_BLOCK_Type type,
-                                const struct GNUNET_PeerIdentity *get_path,
+                                const struct GNUNET_PeerIdentity *trunc_peer,
+                                const struct GNUNET_DHT_PathElement *get_path,
                                 unsigned int get_path_length,
-                                const struct GNUNET_PeerIdentity *put_path,
+                                const struct GNUNET_DHT_PathElement *put_path,
                                 unsigned int put_path_length,
                                 struct GNUNET_TIME_Absolute exp,
                                 const struct GNUNET_HashCode *key,
@@ -330,9 +415,12 @@ typedef void
  * @param options Options, for instance RecordRoute, DemultiplexEverywhere.
  * @param type The type of data in the request.
  * @param hop_count Hop count so far.
+ * @param desired_replication_level Desired replication level.
+ * @param trunc_peer peer where the path was truncated, or NULL if the path is complete
  * @param path_length number of entries in @a path (or 0 if not recorded).
  * @param path peers on the PUT path (or NULL if not recorded).
- * @param desired_replication_level Desired replication level.
+ *        note that the last signature will be all zeros as
+ *        we did not forward and thus did not sign!
  * @param exp Expiration time of the data.
  * @param key Key under which data is to be stored.
  * @param data Pointer to the data carried.
@@ -344,8 +432,9 @@ typedef void
                             enum GNUNET_BLOCK_Type type,
                             uint32_t hop_count,
                             uint32_t desired_replication_level,
+                            const struct GNUNET_PeerIdentity *trunc_peer,
                             unsigned int path_length,
-                            const struct GNUNET_PeerIdentity *path,
+                            const struct GNUNET_DHT_PathElement *path,
                             struct GNUNET_TIME_Absolute exp,
                             const struct GNUNET_HashCode *key,
                             const void *data,
@@ -385,6 +474,107 @@ void
 GNUNET_DHT_monitor_stop (struct GNUNET_DHT_MonitorHandle *handle);
 
 
+/**
+ * Convert a peer path to a human-readable string.
+ *
+ * @param path array of path elements to convert to a string
+ * @param path_len length of the @a path array
+ * @return string representing the array of @a pids
+ */
+char *
+GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
+                 unsigned int path_len);
+
+
+/**
+ * Verify signatures on a path consisting of @a put_path and @a get_path in
+ * reverse order (starting at the last element of the @a get_path).  Note that
+ * the last signature on the path is never verified as that is the slot where
+ * our peer (@a me) would need to sign.
+ *
+ * @param data payload (the block)
+ * @param data_size number of bytes in @a data
+ * @param exp_time expiration time of @a data
+ * @param trunc_peer peer which signature was broken or where the path was truncated,
+ *                  NULL if path is not truncated
+ * @param get_path array of path elements to verify
+ * @param get_path_len length of the @a get_path array
+ * @param put_path array of path elements to verify
+ * @param put_path_len length of the @a put_path array
+ * @param me our own peer identity (needed to verify the last element)
+ * @return 0 on success, otherwise the index of
+ *         the last path element that succeeded with verification;
+ *         @a get_path_len + @a put_path_len if no signature was valid
+ */
+unsigned int
+GNUNET_DHT_verify_path (const void *data,
+                        size_t data_size,
+                        struct GNUNET_TIME_Absolute exp_time,
+                        const struct GNUNET_PeerIdentity *trunc_peer,
+                        const struct GNUNET_DHT_PathElement *put_path,
+                        unsigned int put_path_len,
+                        const struct GNUNET_DHT_PathElement *get_path,
+                        unsigned int get_path_len,
+                        const struct GNUNET_PeerIdentity *me);
+
+
+/**
+ * Handle to get a HELLO URL from the DHT for manual bootstrapping.
+ */
+struct GNUNET_DHT_HelloGetHandle;
+
+
+/**
+ * Signature called with the result of a HELLO GET operation.
+ *
+ * @param cls closure
+ * @param hello_url the resulting HELLO URL, NULL on error
+ */
+typedef void
+(*GNUNET_DHT_HelloGetCallback)(void *cls,
+                               const char *hello_url);
+
+
+/**
+ * Obtain HELLO URL of the DHT identified by @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param cb function to call with the result
+ * @param cb_cls closure for @a cb
+ * @return NULL on failure
+ */
+struct GNUNET_DHT_HelloGetHandle *
+GNUNET_DHT_hello_get (struct GNUNET_DHT_Handle *dht_handle,
+                      GNUNET_DHT_HelloGetCallback cb,
+                      void *cb_cls);
+
+
+/**
+ * Cancel hello get operation.
+ *
+ * @param[in] hgh operation to cancel.
+ */
+void
+GNUNET_DHT_hello_get_cancel (struct GNUNET_DHT_HelloGetHandle *hgh);
+
+
+/**
+ * Offer HELLO URL of the DHT identified by @a dht_handle.
+ * Callback may be invoked once, only way to cancel is to
+ * disconnect @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param url URL with a HELLO to offer to the DHT
+ * @param cb function called when done
+ * @param cb_cls closure for @a cb
+ */
+void
+GNUNET_DHT_hello_offer (struct GNUNET_DHT_Handle *dht_handle,
+                        const char *url,
+                        GNUNET_SCHEDULER_TaskCallback cb,
+                        void *cb_cls);
+
+
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
 #endif
@@ -395,3 +585,7 @@ GNUNET_DHT_monitor_stop (struct GNUNET_DHT_MonitorHandle *handle);
 #endif
 
 /** @} */  /* end of group dht */
+
+/** @} */ /* end of group addition */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_dhtu_plugin.h b/src/include/gnunet_dhtu_plugin.h
index e65318fb5..0503dda1c 100644
--- a/src/include/gnunet_dhtu_plugin.h
+++ b/src/include/gnunet_dhtu_plugin.h
@@ -27,6 +27,7 @@
 #ifndef PLUGIN_DHTU_H
 #define PLUGIN_DHTU_H
 
+
 #include "gnunet_util_lib.h"
 
 
@@ -57,38 +58,6 @@ struct GNUNET_DHTU_Target;
  */
 struct GNUNET_DHTU_PreferenceHandle;
 
-/**
- * Opaque handle for a private key used by this underlay.
- */
-struct GNUNET_DHTU_PrivateKey;
-
-/**
- * Handle for a public key used by another peer.  Note that
- * the underlay used must be communicated separately.
- */
-struct GNUNET_DHTU_PublicKey
-{
-  /**
-   * How long is the public key, in network byte order.
-   */
-  uint16_t size;
-
-  /* followed by size-2 bytes of the actual public key */
-};
-
-
-/**
- * Hash used by the DHT for keys and peers.
- */
-struct GNUNET_DHTU_Hash
-{
-
-  /**
-   * For now, use a 512 bit hash. (To be discussed).
-   */
-  struct GNUNET_HashCode hc;
-};
-
 
 /**
  * The datastore service will pass a pointer to a struct
@@ -111,9 +80,6 @@ struct GNUNET_DHTU_PluginEnvironment
    * Function to call with new addresses of this peer.
    *
    * @param cls the closure
-   * @param my_id hash position of this address in the DHT
-   * @param pk private key of this peer used at @a address,
-   *           pointer will remain valid until @e address_del_cb is called
    * @param address address under which we are likely reachable,
    *           pointer will remain valid until @e address_del_cb is called; to be used for HELLOs. Example: "ip+udp://1.1.1.1:2086/"
    * @param source handle for sending from this address, NULL if we can only receive
@@ -121,8 +87,6 @@ struct GNUNET_DHTU_PluginEnvironment
    */
   void
   (*address_add_cb)(void *cls,
-                    const struct GNUNET_DHTU_Hash *my_id,
-                    const struct GNUNET_DHTU_PrivateKey *pk,
                     const char *address,
                     struct GNUNET_DHTU_Source *source,
                     void **ctx);
@@ -154,21 +118,19 @@ struct GNUNET_DHTU_PluginEnvironment
    * that peer.
    *
    * @param cls the closure
-   * @param pk public key of the target,
-   *    pointer will remain valid until @e disconnect_cb is called
-   * @para peer_id hash position of the peer,
-   *    pointer will remain valid until @e disconnect_cb is called
    * @param target handle to the target,
    *    pointer will remain valid until @e disconnect_cb is called
+   * @param pid peer identity,
+   *    pointer will remain valid until @e disconnect_cb is called
    * @param[out] ctx storage space for DHT to use in association with this target
    */
   void
   (*connect_cb)(void *cls,
-                const struct GNUNET_DHTU_PublicKey *pk,
-                const struct GNUNET_DHTU_Hash *peer_id,
                 struct GNUNET_DHTU_Target *target,
+                const struct GNUNET_PeerIdentity *pid,
                 void **ctx);
 
+
   /**
    * Function to call when we disconnected from a peer and can henceforth
    * cannot transmit to that peer anymore.
@@ -209,50 +171,18 @@ struct GNUNET_DHTU_PluginFunctions
   void *cls;
 
   /**
-   * Use our private key to sign a message.
-   *
-   * @param cls closure
-   * @param pk our private key to sign with
-   * @param purpose what to sign
-   * @param[out] signature, allocated on heap and returned
-   * @return -1 on error, otherwise number of bytes in @a sig
-   */
-  ssize_t
-  (*sign)(void *cls,
-          const struct GNUNET_DHTU_PrivateKey *pk,
-          const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
-          void **sig);
-
-  /**
-   * Verify signature in @a sig over @a purpose.
-   *
-   * @param cls closure
-   * @param pk public key to verify signature of
-   * @param purpose what was being signed
-   * @param sig signature data
-   * @param sig_size number of bytes in @a sig
-   * @return #GNUNET_OK if signature is valid
-   *         #GNUNET_NO if signatures are not supported
-   *         #GNUNET_SYSERR if signature is invalid
-   */
-  enum GNUNET_GenericReturnValue
-  (*verify)(void *cls,
-            const struct GNUNET_DHTU_PublicKey *pk,
-            const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
-            const void *sig,
-            size_t sig_size);
-
-
-  /**
    * Request creation of a session with a peer at the given @a address.
    *
    * @param cls closure (internal context for the plugin)
-   * @param address target address to connect to
+   * @param pid target identity of the peer to connect to
+   * @param address target address URI to connect to
    */
   void
   (*try_connect) (void *cls,
+                  const struct GNUNET_PeerIdentity *pid,
                   const char *address);
 
+
   /**
    * Request underlay to keep the connection to @a target alive if possible.
    * Hold may be called multiple times to express a strong preference to
@@ -266,7 +196,7 @@ struct GNUNET_DHTU_PluginFunctions
           struct GNUNET_DHTU_Target *target);
 
   /**
-   * Do no long request underlay to keep the connection alive.
+   * Do no longer request underlay to keep the connection alive.
    *
    * @param cls closure
    * @param target connection to keep alive
diff --git a/src/include/gnunet_disk_lib.h b/src/include/gnunet_disk_lib.h
index 7dfd9ccf1..2aec55851 100644
--- a/src/include/gnunet_disk_lib.h
+++ b/src/include/gnunet_disk_lib.h
@@ -18,6 +18,10 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -27,6 +31,11 @@
  * Disk IO APIs
  * @{
  */
+
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_DISK_LIB_H
 #define GNUNET_DISK_LIB_H
 
@@ -72,6 +81,7 @@ struct GNUNET_DISK_FileHandle
    or unsigned long long, this IS platform dependent;
    but "stdlib.h" should be portable 'enough' to be
    unconditionally available... */
+
 #include <stdlib.h>
 #include "gnunet_configuration_lib.h"
 #include "gnunet_scheduler_lib.h"
@@ -670,7 +680,7 @@ GNUNET_DISK_directory_scan (const char *dir_name,
  * Currently, the glob_pattern only supports asterisks in the last
  * path component.
  *
- * @param glob_patterb the glob pattern to search for
+ * @param glob_pattern the glob pattern to search for
  * @param callback the method to call for each file
  * @param callback_cls closure for @a callback
  * @return the number of files found, -1 on error
@@ -815,4 +825,6 @@ GNUNET_DISK_file_sync (const struct GNUNET_DISK_FileHandle *h);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_disk_lib.h */
diff --git a/src/include/gnunet_dns_service.h b/src/include/gnunet_dns_service.h
index 20f0f13ee..b5741a7e2 100644
--- a/src/include/gnunet_dns_service.h
+++ b/src/include/gnunet_dns_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup vpn_suite  VPN services and libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -33,6 +36,7 @@
 #ifndef GNUNET_DNS_SERVICE_H
 #define GNUNET_DNS_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 
 
@@ -191,3 +195,5 @@ GNUNET_DNS_disconnect (struct GNUNET_DNS_Handle *dh);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_dnsparser_lib.h b/src/include/gnunet_dnsparser_lib.h
index f77073264..9a84f346f 100644
--- a/src/include/gnunet_dnsparser_lib.h
+++ b/src/include/gnunet_dnsparser_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
+
 /**
+ * @addtogroup libgnunetutil
+ * @{
+ *
  * @author Philipp Toelke
  * @author Christian Grothoff
  *
@@ -32,8 +40,6 @@
 #ifndef GNUNET_DNSPARSER_LIB_H
 #define GNUNET_DNSPARSER_LIB_H
 
-#include "gnunet_util_lib.h"
-
 /**
  * Maximum length of a label in DNS.
  */
@@ -78,6 +84,7 @@
 #define GNUNET_DNSPARSER_TYPE_NSEC3 50
 #define GNUNET_DNSPARSER_TYPE_NSEC3PARAM 51
 #define GNUNET_DNSPARSER_TYPE_TLSA 52
+#define GNUNET_DNSPARSER_TYPE_SMIMEA 53
 #define GNUNET_DNSPARSER_TYPE_HIP 55
 #define GNUNET_DNSPARSER_TYPE_CDS 59
 #define GNUNET_DNSPARSER_TYPE_CDNSKEY 60
@@ -172,6 +179,33 @@ struct GNUNET_DNSPARSER_SrvRecord
 
 
 /**
+ * Information from URI records (RFC 7553).
+ */
+struct GNUNET_DNSPARSER_UriRecord
+{
+  /**
+   * URI of the target,
+   * where the URI is as specified in RFC 3986.
+   */
+  char *target;
+
+  /**
+   * Preference for this entry (lower value is higher preference).  Clients
+   * will contact hosts from the lowest-priority group first and fall back
+   * to higher priorities if the low-priority entries are unavailable.
+   */
+  uint16_t priority;
+
+  /**
+   * Relative weight for records with the same priority.  Clients will use
+   * the hosts of the same (lowest) priority with a probability proportional
+   * to the weight given.
+   */
+  uint16_t weight;
+};
+
+
+/**
  * DNS CERT types as defined in RFC 4398.
  */
 enum GNUNET_DNSPARSER_CertType
@@ -473,6 +507,11 @@ struct GNUNET_DNSPARSER_Record
     struct GNUNET_DNSPARSER_SrvRecord *srv;
 
     /**
+     * URI data for URI records.
+     */
+    struct GNUNET_DNSPARSER_UriRecord *uri;
+
+    /**
      * Raw data for all other types.
      */
     struct GNUNET_DNSPARSER_RawRecord raw;
@@ -737,6 +776,25 @@ GNUNET_DNSPARSER_builder_add_srv (char *dst,
                                   size_t *off,
                                   const struct GNUNET_DNSPARSER_SrvRecord *srv);
 
+
+/**
+ * Add an URI record to the UDP packet at the given location.
+ *
+ * @param dst where to write the URI record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the URI information (increment by bytes used)
+ *            can also change if there was an error
+ * @param uri URI information to write
+ * @return #GNUNET_SYSERR if @a uri is invalid
+ *         #GNUNET_NO if @a uri did not fit
+ *         #GNUNET_OK if @a uri was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_uri (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_UriRecord *uri);
+
 /* ***************** low-level parsing API ******************** */
 
 /**
@@ -847,6 +905,21 @@ GNUNET_DNSPARSER_parse_srv (const char *udp_payload,
                             size_t udp_payload_length,
                             size_t *off);
 
+
+/**
+ * Parse a DNS URI record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the URI record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed URI record, NULL on error
+ */
+struct GNUNET_DNSPARSER_UriRecord *
+GNUNET_DNSPARSER_parse_uri (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off);
+
 /* ***************** low-level duplication API ******************** */
 
 /**
@@ -903,6 +976,16 @@ GNUNET_DNSPARSER_duplicate_srv_record (const struct
                                        GNUNET_DNSPARSER_SrvRecord *r);
 
 
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_UriRecord *
+GNUNET_DNSPARSER_duplicate_uri_record (const struct
+                                       GNUNET_DNSPARSER_UriRecord *r);
+
 /* ***************** low-level deallocation API ******************** */
 
 /**
@@ -933,6 +1016,15 @@ GNUNET_DNSPARSER_free_srv (struct GNUNET_DNSPARSER_SrvRecord *srv);
 
 
 /**
+ * Free URI information record.
+ *
+ * @param uri record to free
+ */
+void
+GNUNET_DNSPARSER_free_uri (struct GNUNET_DNSPARSER_UriRecord *uri);
+
+
+/**
  * Free SOA information record.
  *
  * @param soa record to free
@@ -978,3 +1070,5 @@ GNUNET_DNSPARSER_hex_to_bin (const char *hex,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_dnsstub_lib.h b/src/include/gnunet_dnsstub_lib.h
index 4e93105bb..fa5151a8c 100644
--- a/src/include/gnunet_dnsstub_lib.h
+++ b/src/include/gnunet_dnsstub_lib.h
@@ -18,7 +18,14 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +38,7 @@
 #ifndef GNUNET_DNSSTUB_LIB_H
 #define GNUNET_DNSSTUB_LIB_H
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -86,7 +94,7 @@ GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
  * Only effective for requests issued after this call.
  *
  * @param ctx resolver context to modify
- * @param retry_frequ how long to wait between retries
+ * @param retry_freq how long to wait between retries
  */
 void
 GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
@@ -147,3 +155,5 @@ GNUNET_DNSSTUB_resolve_cancel (struct GNUNET_DNSSTUB_RequestSocket *rs);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_error_codes.h b/src/include/gnunet_error_codes.h
new file mode 100644
index 000000000..aa897afe0
--- /dev/null
+++ b/src/include/gnunet_error_codes.h
@@ -0,0 +1,242 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012-2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+ /**
+  * @file include/taler_error_codes.h
+  * @brief GNUnet error codes, generated via https://gana.gnunet.org/
+  *
+  * Do NOT edit this file, it is generated!
+  */
+#ifndef GNUNET_ERROR_CODES_H
+#define GNUNET_ERROR_CODES_H
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+#include <limits.h>
+
+
+/**
+ * Taler error codes.
+ */
+enum GNUNET_ErrorCode
+{
+
+
+  /**
+   * No error (success).
+   * Returned with an HTTP status code of #MHD_HTTP_UNINITIALIZED (0).
+   */
+  GNUNET_EC_NONE = 0,
+
+
+  /**
+   * Unknown and unspecified error.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_UNKNOWN = 1,
+
+
+  /**
+   * Communication with service failed.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_SERVICE_COMMUNICATION_FAILED = 101,
+
+
+  /**
+   * Ego not found.
+   * Returned with an HTTP status code of #MHD_HTTP_NOT_FOUND (404).
+   */
+  GNUNET_EC_IDENTITY_NOT_FOUND = 200,
+
+
+  /**
+   * Identifier already in use for another ego.
+   * Returned with an HTTP status code of #MHD_HTTP_CONFLICT (409).
+   */
+  GNUNET_EC_IDENTITY_NAME_CONFLICT = 201,
+
+
+  /**
+   * The given ego is invalid or malformed.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_IDENTITY_INVALID = 202,
+
+
+  /**
+   * Unknown namestore error.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_UNKNOWN = 5000,
+
+
+  /**
+   * Zone iteration failed.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_ITERATION_FAILED = 5001,
+
+
+  /**
+   * Zone not found.
+   * Returned with an HTTP status code of #MHD_HTTP_NOT_FOUND (404).
+   */
+  GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND = 5002,
+
+
+  /**
+   * Record not found.
+   * Returned with an HTTP status code of #MHD_HTTP_NOT_FOUND (404).
+   */
+  GNUNET_EC_NAMESTORE_RECORD_NOT_FOUND = 5003,
+
+
+  /**
+   * Zone iteration failed.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_RECORD_DELETE_FAILED = 5004,
+
+
+  /**
+   * Zone does not contain any records.
+   * Returned with an HTTP status code of #MHD_HTTP_NOT_FOUND (404).
+   */
+  GNUNET_EC_NAMESTORE_ZONE_EMPTY = 5005,
+
+
+  /**
+   * Failed to lookup record.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_LOOKUP_ERROR = 5006,
+
+
+  /**
+   * No records given.
+   * Returned with an HTTP status code of #MHD_HTTP_BAD_REQUEST (400).
+   */
+  GNUNET_EC_NAMESTORE_NO_RECORDS_GIVEN = 5007,
+
+
+  /**
+   * Record data invalid.
+   * Returned with an HTTP status code of #MHD_HTTP_BAD_REQUEST (400).
+   */
+  GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID = 5008,
+
+
+  /**
+   * No label given.
+   * Returned with an HTTP status code of #MHD_HTTP_BAD_REQUEST (400).
+   */
+  GNUNET_EC_NAMESTORE_NO_LABEL_GIVEN = 5009,
+
+
+  /**
+   * No results given.
+   * Returned with an HTTP status code of #MHD_HTTP_NOT_FOUND (404).
+   */
+  GNUNET_EC_NAMESTORE_NO_RESULTS = 5010,
+
+
+  /**
+   * Record already exists.
+   * Returned with an HTTP status code of #MHD_HTTP_CONFLICT (409).
+   */
+  GNUNET_EC_NAMESTORE_RECORD_EXISTS = 5011,
+
+
+  /**
+   * Record size exceeds maximum limit.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_RECORD_TOO_BIG = 5012,
+
+
+  /**
+   * There was an error in the database backend.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_BACKEND_FAILED = 5013,
+
+
+  /**
+   * Failed to store the given records.
+   * Returned with an HTTP status code of #MHD_HTTP_INTERNAL_SERVER_ERROR (500).
+   */
+  GNUNET_EC_NAMESTORE_STORE_FAILED = 5014,
+
+
+  /**
+   * Label invalid or malformed.
+   * Returned with an HTTP status code of #MHD_HTTP_BAD_REQUEST (400).
+   */
+  GNUNET_EC_NAMESTORE_LABEL_INVALID = 5015,
+
+
+};
+
+
+/**
+ * Returns a hint for a given error code.
+ *
+ * @param ec the error code.
+ * @return the hint if it could be found, otherwise "<no hint found>"
+ */
+const char *
+GNUNET_ErrorCode_get_hint (enum GNUNET_ErrorCode ec);
+
+
+/**
+ * Return HTTP status for a given error code.
+ *
+ * @param ec the error code.
+ * @return the HTTP status code for the given @a ec, UINT_MAX if not found
+ */
+unsigned int
+GNUNET_ErrorCode_get_http_status (enum GNUNET_ErrorCode ec);
+
+
+/**
+ * Return HTTP status for a given error code that is guaranteed
+ * to work (no corner cases).
+ *
+ * @param ec the error code.
+ * @return the HTTP status code for the given @a ec, 500 if
+ *         the @a ec is not found or is a client-side code
+ */
+unsigned int
+GNUNET_ErrorCode_get_http_status_safe (enum GNUNET_ErrorCode ec);
+
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/include/gnunet_fragmentation_lib.h b/src/include/gnunet_fragmentation_lib.h
deleted file mode 100644
index c964b5434..000000000
--- a/src/include/gnunet_fragmentation_lib.h
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2009, 2011, 2015 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Christian Grothoff
- *
- * @file
- * Library to help fragment messages
- *
- * @defgroup fragmentation  Fragmentation library
- * Library to help fragment messages
- * @{
- *
- * @todo Consider additional flow-control for sending from
- *       fragmentation based on continuations.
- */
-
-#ifndef GNUNET_FRAGMENTATION_LIB_H
-#define GNUNET_FRAGMENTATION_LIB_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_bandwidth_lib.h"
-#include "gnunet_statistics_service.h"
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
-/**
- * Fragmentation context.
- */
-struct GNUNET_FRAGMENT_Context;
-
-
-/**
- * Function that is called with messages created by the fragmentation
- * module.  In the case of the 'proc' callback of the
- * #GNUNET_FRAGMENT_context_create() function, this function must
- * eventually call #GNUNET_FRAGMENT_context_transmission_done().
- *
- * @param cls closure
- * @param msg the message that was created
- */
-typedef void
-(*GNUNET_FRAGMENT_MessageProcessor) (void *cls,
-                                     const struct GNUNET_MessageHeader *msg);
-
-
-/**
- * Create a fragmentation context for the given message.
- * Fragments the message into fragments of size @a mtu or
- * less.  Calls @a proc on each un-acknowledged fragment,
- * using both the expected @a msg_delay between messages and
- * acknowledgements and the given @a tracker to guide the
- * frequency of calls to @a proc.
- *
- * @param stats statistics context
- * @param mtu the maximum message size for each fragment
- * @param tracker bandwidth tracker to use for flow control (can be NULL)
- * @param msg_delay initial delay to insert between fragment transmissions
- *              based on previous messages
- * @param ack_delay expected delay between fragment transmission
- *              and ACK based on previous messages
- * @param msg the message to fragment
- * @param proc function to call for each fragment to transmit
- * @param proc_cls closure for proc
- * @return the fragmentation context
- */
-struct GNUNET_FRAGMENT_Context *
-GNUNET_FRAGMENT_context_create (struct GNUNET_STATISTICS_Handle *stats,
-                                uint16_t mtu,
-                                struct GNUNET_BANDWIDTH_Tracker *tracker,
-                                struct GNUNET_TIME_Relative msg_delay,
-                                struct GNUNET_TIME_Relative ack_delay,
-                                const struct GNUNET_MessageHeader *msg,
-                                GNUNET_FRAGMENT_MessageProcessor proc,
-                                void *proc_cls);
-
-
-/**
- * Continuation to call from the 'proc' function after the fragment
- * has been transmitted (and hence the next fragment can now be
- * given to proc).
- *
- * @param fc fragmentation context
- */
-void
-GNUNET_FRAGMENT_context_transmission_done (struct GNUNET_FRAGMENT_Context *fc);
-
-
-/**
- * Process an acknowledgement message we got from the other
- * side (to control re-transmits).
- *
- * @param fc fragmentation context
- * @param msg acknowledgement message we received
- * @return #GNUNET_OK if this ack completes the work of the 'fc'
- *                   (all fragments have been received);
- *         #GNUNET_NO if more messages are pending
- *         #GNUNET_SYSERR if this ack is not valid for this fc
- */
-int
-GNUNET_FRAGMENT_process_ack (struct GNUNET_FRAGMENT_Context *fc,
-                             const struct GNUNET_MessageHeader *msg);
-
-
-/**
- * Destroy the given fragmentation context (stop calling 'proc', free
- * resources).
- *
- * @param fc fragmentation context
- * @param msg_delay where to store average delay between individual message transmissions the
- *         last message (OUT only)
- * @param ack_delay where to store average delay between transmission and ACK for the
- *         last message, set to FOREVER if the message was not fully transmitted (OUT only)
- */
-void
-GNUNET_FRAGMENT_context_destroy (struct GNUNET_FRAGMENT_Context *fc,
-                                 struct GNUNET_TIME_Relative *msg_delay,
-                                 struct GNUNET_TIME_Relative *ack_delay);
-
-
-/**
- * Convert an ACK message to a printable format suitable for logging.
- *
- * @param ack message to print
- * @return ack in human-readable format
- */
-const char *
-GNUNET_FRAGMENT_print_ack (const struct GNUNET_MessageHeader *ack);
-
-
-/**
- * Defragmentation context (one per connection).
- */
-struct GNUNET_DEFRAGMENT_Context;
-
-
-/**
- * Function that is called with acknowledgement messages created by
- * the fragmentation module.  Acknowledgements are cumulative,
- * so it is OK to only transmit the 'latest' ack message for the same
- * message ID.
- *
- * @param cls closure
- * @param id unique message ID (modulo collisions)
- * @param msg the message that was created
- */
-typedef void
-(*GNUNET_DEFRAGMENT_AckProcessor) (void *cls,
-                                   uint32_t id,
-                                   const struct GNUNET_MessageHeader *msg);
-
-
-/**
- * Create a defragmentation context.
- *
- * @param stats statistics context
- * @param mtu the maximum message size for each fragment
- * @param num_msgs how many fragmented messages
- *                 to we defragment at most at the same time?
- * @param cls closure for @a proc and @a ackp
- * @param proc function to call with defragmented messages
- * @param ackp function to call with acknowledgements (to send
- *             back to the other side)
- * @return the defragmentation context
- */
-struct GNUNET_DEFRAGMENT_Context *
-GNUNET_DEFRAGMENT_context_create (struct GNUNET_STATISTICS_Handle *stats,
-                                  uint16_t mtu,
-                                  unsigned int num_msgs,
-                                  void *cls,
-                                  GNUNET_FRAGMENT_MessageProcessor proc,
-                                  GNUNET_DEFRAGMENT_AckProcessor ackp);
-
-
-/**
- * Destroy the given defragmentation context.
- *
- * @param dc defragmentation context
- */
-void
-GNUNET_DEFRAGMENT_context_destroy (struct GNUNET_DEFRAGMENT_Context *dc);
-
-
-/**
- * We have received a fragment.  Process it.
- *
- * @param dc the context
- * @param msg the message that was received
- * @return #GNUNET_OK on success,
- *         #GNUNET_NO if this was a duplicate,
- *         #GNUNET_SYSERR on error
- */
-int
-GNUNET_DEFRAGMENT_process_fragment (struct GNUNET_DEFRAGMENT_Context *dc,
-                                    const struct GNUNET_MessageHeader *msg);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_friends_lib.h b/src/include/gnunet_friends_lib.h
deleted file mode 100644
index d591ea082..000000000
--- a/src/include/gnunet_friends_lib.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2013 Christian Grothoff
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * Library to read and write the FRIENDS file
- *
- * @defgroup friends  Friends library
- * Library to read and write the FRIENDS file
- * @{
- */
-#ifndef GNUNET_FRIENDS_LIB_H
-#define GNUNET_FRIENDS_LIB_H
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-
-
-/**
- * Signature of a function called on each friend found.
- *
- * @param cls closure
- * @param friend_id peer identity of the friend
- */
-typedef void (*GNUNET_FRIENDS_Callback)(void *cls,
-                                        const struct
-                                        GNUNET_PeerIdentity *friend_id);
-
-
-/**
- * Parse the FRIENDS file.
- *
- * @param cfg our configuration
- * @param cb function to call on each friend found
- * @param cb_cls closure for @a cb
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on parsing errors
- */
-int
-GNUNET_FRIENDS_parse (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                      GNUNET_FRIENDS_Callback cb,
-                      void *cb_cls);
-
-
-/**
- * Handle for writing a friends file.
- */
-struct GNUNET_FRIENDS_Writer;
-
-
-/**
- * Start writing a fresh FRIENDS file.  Will make a backup of the
- * old one.
- *
- * @param cfg configuration to use.
- * @return NULL on error
- */
-struct GNUNET_FRIENDS_Writer *
-GNUNET_FRIENDS_write_start (const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Finish writing out the friends file.
- *
- * @param w write handle
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_FRIENDS_write_stop (struct GNUNET_FRIENDS_Writer *w);
-
-
-/**
- * Add a friend to the friends file.
- *
- * @param w write handle
- * @param friend_id friend to add
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_FRIENDS_write (struct GNUNET_FRIENDS_Writer *w,
-                      const struct GNUNET_PeerIdentity *friend_id);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_fs_service.h b/src/include/gnunet_fs_service.h
index 686035e2c..a05e07ac5 100644
--- a/src/include/gnunet_fs_service.h
+++ b/src/include/gnunet_fs_service.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup fs_l2  File sharing and support services/libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -33,6 +36,8 @@
 #ifndef GNUNET_FS_LIB_H
 #define GNUNET_FS_LIB_H
 
+
+#include "gnunet_common.h"
 #include "gnunet_util_lib.h"
 
 #ifdef __cplusplus
@@ -66,6 +71,106 @@ extern "C"
  */
 #define GNUNET_FS_VERSION 0x00090300
 
+#if GNUNET_FS_EXTRACTOR_ENABLED
+
+#include <extractor.h>
+
+#else
+
+/* definitions from extractor.h we need for the build */
+
+/**
+ * Enumeration defining various sources of keywords.  See also
+ * http://dublincore.org/documents/1998/09/dces/
+ */
+enum EXTRACTOR_MetaType
+{
+  EXTRACTOR_METATYPE_RESERVED = 0,
+  EXTRACTOR_METATYPE_MIMETYPE = 1,
+  EXTRACTOR_METATYPE_FILENAME = 2,
+  EXTRACTOR_METATYPE_COMMENT = 3,
+  EXTRACTOR_METATYPE_TITLE = 4,
+  EXTRACTOR_METATYPE_BOOK_TITLE = 5,
+  EXTRACTOR_METATYPE_JOURNAL_NAME = 8,
+  EXTRACTOR_METATYPE_AUTHOR_NAME = 13,
+  EXTRACTOR_METATYPE_PUBLICATION_DATE = 24,
+  EXTRACTOR_METATYPE_URL = 29,
+  EXTRACTOR_METATYPE_URI = 30,
+  EXTRACTOR_METATYPE_ISRC = 31,
+  EXTRACTOR_METATYPE_UNKNOWN = 45,
+  EXTRACTOR_METATYPE_DESCRIPTION = 46,
+  EXTRACTOR_METATYPE_KEYWORDS = 49,
+  EXTRACTOR_METATYPE_SUBJECT = 52,
+  EXTRACTOR_METATYPE_PACKAGE_NAME = 69,
+  EXTRACTOR_METATYPE_THUMBNAIL = 114,
+  EXTRACTOR_METATYPE_ALBUM = 129,
+  EXTRACTOR_METATYPE_ARTIST = 130,
+  EXTRACTOR_METATYPE_ORIGINAL_TITLE = 162,
+  EXTRACTOR_METATYPE_GNUNET_FULL_DATA = 174,
+  EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME = 180,
+};
+
+/**
+ * Format in which the extracted meta data is presented.
+ */
+enum EXTRACTOR_MetaFormat
+{
+  /**
+   * Format is unknown.
+   */
+  EXTRACTOR_METAFORMAT_UNKNOWN = 0,
+
+  /**
+   * 0-terminated, UTF-8 encoded string.  "data_len"
+   * is strlen(data)+1.
+   */
+  EXTRACTOR_METAFORMAT_UTF8 = 1,
+
+  /**
+   * Some kind of binary format, see given Mime type.
+   */
+  EXTRACTOR_METAFORMAT_BINARY = 2,
+
+  /**
+   * 0-terminated string.  The specific encoding is unknown.
+   * "data_len" is strlen (data)+1.
+   */
+  EXTRACTOR_METAFORMAT_C_STRING = 3
+};
+
+
+/**
+ * Type of a function that libextractor calls for each
+ * meta data item found.
+ *
+ * @param cls closure (user-defined)
+ * @param plugin_name name of the plugin that produced this value;
+ *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
+ *        used in the main libextractor library and yielding
+ *        meta data).
+ * @param type libextractor-type describing the meta data
+ * @param format basic format information about @a data
+ * @param data_mime_type mime-type of @a data (not of the original file);
+ *        can be NULL (if mime-type is not known)
+ * @param data actual meta-data found
+ * @param data_len number of bytes in @a data
+ * @return 0 to continue extracting, 1 to abort
+ */
+typedef int (*EXTRACTOR_MetaDataProcessor) (void *cls,
+                                            const char *plugin_name,
+                                            enum EXTRACTOR_MetaType type,
+                                            enum EXTRACTOR_MetaFormat format,
+                                            const char *data_mime_type,
+                                            const char *data,
+                                            size_t data_len);
+
+#endif
+
+#ifndef EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME
+/* hack for LE < 0.6.3 */
+#define EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME 180
+#endif
+
 
 /* ******************** URI API *********************** */
 
@@ -88,6 +193,12 @@ extern "C"
  */
 struct GNUNET_FS_Uri;
 
+/**
+ * @ingroup metadata
+ * Meta data to associate with a file, directory or namespace.
+ */
+struct GNUNET_FS_MetaData;
+
 
 /**
  * Iterator over keywords
@@ -108,7 +219,7 @@ typedef int
  * into HashMaps.  The key may change between FS implementations.
  *
  * @param uri uri to convert to a unique key
- * @param key wherer to store the unique key
+ * @param key where to store the unique key
  * @return #GNUNET_OK on success
  */
 int
@@ -414,6 +525,17 @@ GNUNET_FS_uri_chk_get_file_size (const struct GNUNET_FS_Uri *uri);
 
 
 /**
+ * What is the hash of the original file's content
+ * that this URI refers to?
+ *
+ * @param uri the CHK URI to inspect
+ * @return hash of the file as specified in the CHK URI
+ */
+const struct GNUNET_HashCode*
+GNUNET_FS_uri_chk_get_file_hash (const struct GNUNET_FS_Uri *uri);
+
+
+/**
  * Is this a location URI?
  *
  * @param uri the uri to check
@@ -432,7 +554,7 @@ GNUNET_FS_uri_test_loc (const struct GNUNET_FS_Uri *uri);
  * @return NULL on error, otherwise a KSK URI
  */
 struct GNUNET_FS_Uri *
-GNUNET_FS_uri_ksk_create_from_meta_data (const struct GNUNET_CONTAINER_MetaData
+GNUNET_FS_uri_ksk_create_from_meta_data (const struct GNUNET_FS_MetaData
                                          *md);
 
 
@@ -461,14 +583,14 @@ GNUNET_FS_GETOPT_KEYWORDS (char shortName,
  * @param name long name of the option
  * @param argumentHelp help text for the option argument
  * @param description long help text for the option
- * @param[out] metadata set to the desired value
+ * @param[out] meta metadata set to the desired value
  */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_FS_GETOPT_METADATA (char shortName,
                            const char *name,
                            const char *argumentHelp,
                            const char *description,
-                           struct GNUNET_CONTAINER_MetaData **meta);
+                           struct GNUNET_FS_MetaData **meta);
 
 /**
  * Command-line option parser function that allows the user to specify
@@ -477,7 +599,7 @@ GNUNET_FS_GETOPT_METADATA (char shortName,
  * the metadata must be passed as the "scls" argument.
  *
  * @param ctx command line processor context
- * @param scls must be of type `struct GNUNET_CONTAINER_MetaData **`
+ * @param scls must be of type `struct GNUNET_FS_MetaData **`
  * @param option name of the option (typically 'k')
  * @param value command line argument given
  * @return #GNUNET_OK on success
@@ -1095,7 +1217,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Known metadata for the download.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
         } start;
 
         /**
@@ -1107,7 +1229,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Known metadata for the download.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * Error message, NULL if we have not encountered any error yet.
@@ -1192,7 +1314,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the search result.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * URI for the search result.
@@ -1220,7 +1342,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the search result.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * URI for the search result.
@@ -1267,7 +1389,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the search result.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * URI for the search result.
@@ -1319,7 +1441,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the search result.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * URI for the search result.
@@ -1347,7 +1469,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the search result.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * URI for the search result.
@@ -1402,7 +1524,7 @@ struct GNUNET_FS_ProgressInfo
           /**
            * Metadata for the namespace.
            */
-          const struct GNUNET_CONTAINER_MetaData *meta;
+          const struct GNUNET_FS_MetaData *meta;
 
           /**
            * Public key of the namespace.
@@ -1702,7 +1824,7 @@ typedef int
 (*GNUNET_FS_FileInformationProcessor) (void *cls,
                                        struct GNUNET_FS_FileInformation *fi,
                                        uint64_t length,
-                                       struct GNUNET_CONTAINER_MetaData *meta,
+                                       struct GNUNET_FS_MetaData *meta,
                                        struct GNUNET_FS_Uri **uri,
                                        struct GNUNET_FS_BlockOptions *bo,
                                        int *do_index,
@@ -1729,7 +1851,8 @@ GNUNET_FS_file_information_get_id (struct GNUNET_FS_FileInformation *s);
  * @return "filename" field of the structure (can be NULL)
  */
 const char *
-GNUNET_FS_file_information_get_filename (struct GNUNET_FS_FileInformation *s);
+GNUNET_FS_file_information_get_filename (const struct
+                                         GNUNET_FS_FileInformation *s);
 
 
 /**
@@ -1766,7 +1889,7 @@ GNUNET_FS_file_information_create_from_file (struct GNUNET_FS_Handle *h,
                                              const struct
                                              GNUNET_FS_Uri *keywords,
                                              const struct
-                                             GNUNET_CONTAINER_MetaData *meta,
+                                             GNUNET_FS_MetaData *meta,
                                              int do_index,
                                              const struct
                                              GNUNET_FS_BlockOptions *bo);
@@ -1796,7 +1919,7 @@ GNUNET_FS_file_information_create_from_data (struct GNUNET_FS_Handle *h,
                                              const struct
                                              GNUNET_FS_Uri *keywords,
                                              const struct
-                                             GNUNET_CONTAINER_MetaData *meta,
+                                             GNUNET_FS_MetaData *meta,
                                              int do_index,
                                              const struct
                                              GNUNET_FS_BlockOptions *bo);
@@ -1855,7 +1978,7 @@ GNUNET_FS_file_information_create_from_reader (struct GNUNET_FS_Handle *h,
                                                const struct GNUNET_FS_Uri
                                                *keywords,
                                                const struct
-                                               GNUNET_CONTAINER_MetaData *meta,
+                                               GNUNET_FS_MetaData *meta,
                                                int do_index,
                                                const struct
                                                GNUNET_FS_BlockOptions *bo);
@@ -1879,7 +2002,7 @@ GNUNET_FS_file_information_create_empty_directory (struct GNUNET_FS_Handle *h,
                                                    const struct GNUNET_FS_Uri
                                                    *keywords,
                                                    const struct
-                                                   GNUNET_CONTAINER_MetaData
+                                                   GNUNET_FS_MetaData
                                                    *meta,
                                                    const struct
                                                    GNUNET_FS_BlockOptions *bo,
@@ -2038,7 +2161,7 @@ struct GNUNET_FS_PublishKskContext;
 struct GNUNET_FS_PublishKskContext *
 GNUNET_FS_publish_ksk (struct GNUNET_FS_Handle *h,
                        const struct GNUNET_FS_Uri *ksk_uri,
-                       const struct GNUNET_CONTAINER_MetaData *meta,
+                       const struct GNUNET_FS_MetaData *meta,
                        const struct GNUNET_FS_Uri *uri,
                        const struct GNUNET_FS_BlockOptions *bo,
                        enum GNUNET_FS_PublishOptions options,
@@ -2080,7 +2203,7 @@ GNUNET_FS_publish_sks (struct GNUNET_FS_Handle *h,
                        const struct GNUNET_CRYPTO_EcdsaPrivateKey *ns,
                        const char *identifier,
                        const char *update,
-                       const struct GNUNET_CONTAINER_MetaData *meta,
+                       const struct GNUNET_FS_MetaData *meta,
                        const struct GNUNET_FS_Uri *uri,
                        const struct GNUNET_FS_BlockOptions *bo,
                        enum GNUNET_FS_PublishOptions options,
@@ -2176,7 +2299,7 @@ typedef void (*GNUNET_FS_IdentifierProcessor) (void *cls,
                                                const struct
                                                GNUNET_FS_Uri *last_uri,
                                                const struct
-                                               GNUNET_CONTAINER_MetaData *
+                                               GNUNET_FS_MetaData *
                                                last_meta,
                                                const char *next_id);
 
@@ -2286,7 +2409,7 @@ GNUNET_FS_search_stop (struct GNUNET_FS_SearchContext *sc);
 struct GNUNET_FS_SearchResult *
 GNUNET_FS_probe (struct GNUNET_FS_Handle *h,
                  const struct GNUNET_FS_Uri *uri,
-                 const struct GNUNET_CONTAINER_MetaData *meta,
+                 const struct GNUNET_FS_MetaData *meta,
                  void *client_info,
                  uint32_t anonymity);
 
@@ -2374,7 +2497,7 @@ enum GNUNET_FS_DownloadOptions
 struct GNUNET_FS_DownloadContext *
 GNUNET_FS_download_start (struct GNUNET_FS_Handle *h,
                           const struct GNUNET_FS_Uri *uri,
-                          const struct GNUNET_CONTAINER_MetaData *meta,
+                          const struct GNUNET_FS_MetaData *meta,
                           const char *filename, const char *tempname,
                           uint64_t offset, uint64_t length, uint32_t anonymity,
                           enum GNUNET_FS_DownloadOptions options, void *cctx,
@@ -2468,7 +2591,7 @@ GNUNET_FS_download_resume (struct GNUNET_FS_DownloadContext *dc);
  *  we have no mime-type information (treat as #GNUNET_NO)
  */
 int
-GNUNET_FS_meta_data_test_for_directory (const struct GNUNET_CONTAINER_MetaData
+GNUNET_FS_meta_data_test_for_directory (const struct GNUNET_FS_MetaData
                                         *md);
 
 
@@ -2479,7 +2602,7 @@ GNUNET_FS_meta_data_test_for_directory (const struct GNUNET_CONTAINER_MetaData
  * @param md metadata to add mimetype to
  */
 void
-GNUNET_FS_meta_data_make_directory (struct GNUNET_CONTAINER_MetaData *md);
+GNUNET_FS_meta_data_make_directory (struct GNUNET_FS_MetaData *md);
 
 
 /**
@@ -2490,7 +2613,7 @@ GNUNET_FS_meta_data_make_directory (struct GNUNET_CONTAINER_MetaData *md);
  */
 char *
 GNUNET_FS_meta_data_suggest_filename (const struct
-                                      GNUNET_CONTAINER_MetaData *md);
+                                      GNUNET_FS_MetaData *md);
 
 
 /**
@@ -2513,7 +2636,7 @@ typedef void (*GNUNET_FS_DirectoryEntryProcessor) (void *cls,
                                                    const struct GNUNET_FS_Uri *
                                                    uri,
                                                    const struct
-                                                   GNUNET_CONTAINER_MetaData *
+                                                   GNUNET_FS_MetaData *
                                                    meta, size_t length,
                                                    const void *data);
 
@@ -2556,7 +2679,7 @@ struct GNUNET_FS_DirectoryBuilder;
  * @param mdir metadata for the directory
  */
 struct GNUNET_FS_DirectoryBuilder *
-GNUNET_FS_directory_builder_create (const struct GNUNET_CONTAINER_MetaData
+GNUNET_FS_directory_builder_create (const struct GNUNET_FS_MetaData
                                     *mdir);
 
 
@@ -2573,7 +2696,7 @@ GNUNET_FS_directory_builder_create (const struct GNUNET_CONTAINER_MetaData
 void
 GNUNET_FS_directory_builder_add (struct GNUNET_FS_DirectoryBuilder *bld,
                                  const struct GNUNET_FS_Uri *uri,
-                                 const struct GNUNET_CONTAINER_MetaData *md,
+                                 const struct GNUNET_FS_MetaData *md,
                                  const void *data);
 
 
@@ -2688,7 +2811,7 @@ struct GNUNET_FS_ShareTreeItem
   /**
    * Metadata for this file or directory
    */
-  struct GNUNET_CONTAINER_MetaData *meta;
+  struct GNUNET_FS_MetaData *meta;
 
   /**
    * Keywords for this file or directory (derived from metadata).
@@ -2777,6 +2900,336 @@ GNUNET_FS_share_tree_trim (struct GNUNET_FS_ShareTreeItem *toplevel);
 void
 GNUNET_FS_share_tree_free (struct GNUNET_FS_ShareTreeItem *toplevel);
 
+/**
+ * Meta data processing
+ * @defgroup metadata  Metadata
+ * GNU libextractor key-value pairs
+ */
+
+
+/* ****************** metadata ******************* */
+
+
+/**
+ * @ingroup metadata
+ * Create a fresh meta data container.
+ *
+ * @return empty meta-data container
+ */
+struct GNUNET_FS_MetaData *
+GNUNET_FS_meta_data_create (void);
+
+
+/**
+ * @ingroup metadata
+ * Duplicate a MetaData token.
+ *
+ * @param md what to duplicate
+ * @return duplicate meta-data container
+ */
+struct GNUNET_FS_MetaData *
+GNUNET_FS_meta_data_duplicate (
+  const struct GNUNET_FS_MetaData *md);
+
+
+/**
+ * @ingroup metadata
+ * Free meta data.
+ *
+ * @param md what to free
+ */
+void
+GNUNET_FS_meta_data_destroy (struct GNUNET_FS_MetaData *md);
+
+
+/**
+ * @ingroup metadata
+ * Test if two MDs are equal. We consider them equal if
+ * the meta types, formats and content match (we do not
+ * include the mime types and plugins names in this
+ * consideration).
+ *
+ * @param md1 first value to check
+ * @param md2 other value to check
+ * @return #GNUNET_YES if they are equal
+ */
+int
+GNUNET_FS_meta_data_test_equal (
+  const struct GNUNET_FS_MetaData *md1,
+  const struct GNUNET_FS_MetaData *md2);
+
+
+/**
+ * @ingroup metadata
+ * Extend metadata.
+ *
+ * @param md metadata to extend
+ * @param plugin_name name of the plugin that produced this value;
+ *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
+ *        used in the main libextractor library and yielding
+ *        meta data).
+ * @param type libextractor-type describing the meta data
+ * @param format basic format information about data
+ * @param data_mime_type mime-type of data (not of the original file);
+ *        can be NULL (if mime-type is not known)
+ * @param data actual meta-data found
+ * @param data_size number of bytes in data
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if this entry already exists
+ *         data_mime_type and plugin_name are not considered for "exists" checks
+ */
+int
+GNUNET_FS_meta_data_insert (struct GNUNET_FS_MetaData *md,
+                                   const char *plugin_name,
+                                   enum EXTRACTOR_MetaType type,
+                                   enum EXTRACTOR_MetaFormat format,
+                                   const char *data_mime_type,
+                                   const char *data,
+                                   size_t data_size);
+
+
+/**
+ * @ingroup metadata
+ * Extend metadata.  Merges the meta data from the second argument
+ * into the first, discarding duplicate key-value pairs.
+ *
+ * @param md metadata to extend
+ * @param in metadata to merge
+ */
+void
+GNUNET_FS_meta_data_merge (struct GNUNET_FS_MetaData *md,
+                                  const struct GNUNET_FS_MetaData *in);
+
+
+/**
+ * @ingroup metadata
+ * Remove an item.
+ *
+ * @param md metadata to manipulate
+ * @param type type of the item to remove
+ * @param data specific value to remove, NULL to remove all
+ *        entries of the given type
+ * @param data_size number of bytes in data
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the item does not exist in md
+ */
+int
+GNUNET_FS_meta_data_delete (struct GNUNET_FS_MetaData *md,
+                                   enum EXTRACTOR_MetaType type,
+                                   const char *data,
+                                   size_t data_size);
+
+
+/**
+ * @ingroup metadata
+ * Remove all items in the container.
+ *
+ * @param md metadata to manipulate
+ */
+void
+GNUNET_FS_meta_data_clear (struct GNUNET_FS_MetaData *md);
+
+
+/**
+ * @ingroup metadata
+ * Add the current time as the publication date
+ * to the meta-data.
+ *
+ * @param md metadata to modify
+ */
+void
+GNUNET_FS_meta_data_add_publication_date (
+  struct GNUNET_FS_MetaData *md);
+
+
+/**
+ * @ingroup metadata
+ * Iterate over MD entries.
+ *
+ * @param md metadata to inspect
+ * @param iter function to call on each entry, return 0 to continue to iterate
+ *             and 1 to abort iteration in this function (GNU libextractor API!)
+ * @param iter_cls closure for @a iter
+ * @return number of entries
+ */
+int
+GNUNET_FS_meta_data_iterate (const struct GNUNET_FS_MetaData *md,
+                                    EXTRACTOR_MetaDataProcessor iter,
+                                    void *iter_cls);
+
+
+/**
+ * @ingroup metadata
+ * Get the first MD entry of the given type.  Caller
+ * is responsible for freeing the return value.
+ * Also, only meta data items that are strings (0-terminated)
+ * are returned by this function.
+ *
+ * @param md metadata to inspect
+ * @param type type to look for
+ * @return NULL if no entry was found
+ */
+char *
+GNUNET_FS_meta_data_get_by_type (
+  const struct GNUNET_FS_MetaData *md,
+  enum EXTRACTOR_MetaType type);
+
+
+/**
+ * @ingroup metadata
+ * Get the first matching MD entry of the given types. Caller is
+ * responsible for freeing the return value.  Also, only meta data
+ * items that are strings (0-terminated) are returned by this
+ * function.
+ *
+ * @param md metadata to inspect
+ * @param ... -1-terminated list of types
+ * @return NULL if we do not have any such entry,
+ *  otherwise client is responsible for freeing the value!
+ */
+char *
+GNUNET_FS_meta_data_get_first_by_types (
+  const struct GNUNET_FS_MetaData *md,
+  ...);
+
+/**
+ * @ingroup metadata
+ * Get a thumbnail from the meta-data (if present).  Only matches meta
+ * data with mime type "image" and binary format.
+ *
+ * @param md metadata to inspect
+ * @param thumb will be set to the thumbnail data.  Must be
+ *        freed by the caller!
+ * @return number of bytes in thumbnail, 0 if not available
+ */
+size_t
+GNUNET_FS_meta_data_get_thumbnail (
+  const struct GNUNET_FS_MetaData *md,
+  unsigned char **thumb);
+
+
+/**
+ * @ingroup metadata
+ * Options for metadata serialization.
+ */
+enum GNUNET_FS_MetaDataSerializationOptions
+{
+  /**
+   * @ingroup metadata
+   * Serialize all of the data.
+   */
+  GNUNET_FS_META_DATA_SERIALIZE_FULL = 0,
+
+  /**
+   * @ingroup metadata
+   * If not enough space is available, it is acceptable
+   * to only serialize some of the metadata.
+   */
+  GNUNET_FS_META_DATA_SERIALIZE_PART = 1,
+
+  /**
+   * @ingroup metadata
+   * Speed is of the essence, do not allow compression.
+   */
+  GNUNET_FS_META_DATA_SERIALIZE_NO_COMPRESS = 2
+};
+
+
+/**
+ * @ingroup metadata
+ * Serialize meta-data to target.
+ *
+ * @param md metadata to serialize
+ * @param target where to write the serialized metadata;
+ *         *target can be NULL, in which case memory is allocated
+ * @param max maximum number of bytes available
+ * @param opt is it ok to just write SOME of the
+ *        meta-data to match the size constraint,
+ *        possibly discarding some data?
+ * @return number of bytes written on success,
+ *         -1 on error (typically: not enough
+ *         space)
+ */
+ssize_t
+GNUNET_FS_meta_data_serialize (
+  const struct GNUNET_FS_MetaData *md,
+  char **target,
+  size_t max,
+  enum GNUNET_FS_MetaDataSerializationOptions opt);
+
+
+/**
+ * @ingroup metadata
+ * Get the size of the full meta-data in serialized form.
+ *
+ * @param md metadata to inspect
+ * @return number of bytes needed for serialization, -1 on error
+ */
+ssize_t
+GNUNET_FS_meta_data_get_serialized_size (
+  const struct GNUNET_FS_MetaData *md);
+
+
+/**
+ * @ingroup metadata
+ * Deserialize meta-data.  Initializes md.
+ *
+ * @param input serialized meta-data.
+ * @param size number of bytes available
+ * @return MD on success, NULL on error (e.g.
+ *         bad format)
+ */
+struct GNUNET_FS_MetaData *
+GNUNET_FS_meta_data_deserialize (const char *input, size_t size);
+
+/**
+ * Write a metadata container.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param m metadata to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_FS_write_meta_data (struct GNUNET_BIO_WriteHandle *h,
+                            const char *what,
+                            const struct GNUNET_FS_MetaData *m);
+
+/**
+ * Create the specification to read a metadata container.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to store a pointer to the (allocated) metadata
+ * @return the read spec
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_FS_read_spec_meta_data (const char *what,
+                                struct GNUNET_FS_MetaData **result);
+
+
+
+/**
+ * Create the specification to write a metadata container.
+ *
+ * @param what what is being written (for error message creation)
+ * @param m metadata to write
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_FS_write_spec_meta_data (const char *what,
+                                 const struct GNUNET_FS_MetaData *m);
+
+/**
+ * Read a metadata container.
+ *
+ * @param h handle to an open file
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to store a pointer to the (allocated) metadata
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_FS_read_meta_data (struct GNUNET_BIO_ReadHandle *h,
+                           const char *what,
+                           struct GNUNET_FS_MetaData **result);
+
 
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
@@ -2788,3 +3241,5 @@ GNUNET_FS_share_tree_free (struct GNUNET_FS_ShareTreeItem *toplevel);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_getopt_lib.h b/src/include/gnunet_getopt_lib.h
index 731be4159..451ddf12b 100644
--- a/src/include/gnunet_getopt_lib.h
+++ b/src/include/gnunet_getopt_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -29,6 +33,10 @@
  * @{
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_GETOPT_LIB_H
 #define GNUNET_GETOPT_LIB_H
 
@@ -39,6 +47,7 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_configuration_lib.h"
 
 /**
@@ -266,12 +275,12 @@ GNUNET_GETOPT_option_base32_fixed_size (char shortName,
                                          argumentHelp,  \
                                          description,   \
                                          val)           \
-  GNUNET_GETOPT_option_base32_fixed_size (shortName,    \
-                                          name,         \
-                                          argumentHelp, \
-                                          description,  \
-                                          val,          \
-                                          sizeof(*val))
+        GNUNET_GETOPT_option_base32_fixed_size (shortName,    \
+                                                name,         \
+                                                argumentHelp, \
+                                                description,  \
+                                                val,          \
+                                                sizeof(*val))
 
 
 /**
@@ -378,12 +387,29 @@ GNUNET_GETOPT_option_absolute_time (char shortName,
 
 
 /**
- * Increment @a val each time the option flag is given by one.
+ * Allow user to specify a `struct GNUNET_TIME_Timestamp`
+ * (using human-readable "fancy" time).
  *
  * @param shortName short name of the option
  * @param name long name of the option
  * @param argumentHelp help text for the option argument
  * @param description long help text for the option
+ * @param[out] val set to the time specified at the command line
+ */
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_timestamp (char shortName,
+                                const char *name,
+                                const char *argumentHelp,
+                                const char *description,
+                                struct GNUNET_TIME_Timestamp *val);
+
+
+/**
+ * Increment @a val each time the option flag is given by one.
+ *
+ * @param shortName short name of the option
+ * @param name long name of the option
+ * @param description long help text for the option
  * @param[out] val set to 1 if the option is present
  */
 struct GNUNET_GETOPT_CommandLineOption
@@ -414,15 +440,6 @@ GNUNET_GETOPT_option_verbose (unsigned int *level);
 
 
 /**
- * Allow user to specify log file name (-l option)
- *
- * @param[out] logfn set to the name of the logfile
- */
-struct GNUNET_GETOPT_CommandLineOption
-GNUNET_GETOPT_option_logfile (char **logfn);
-
-
-/**
  * Allow user to specify configuration file name (-c option)
  *
  * @param[out] fn set to the name of the configuration file
@@ -455,9 +472,9 @@ GNUNET_GETOPT_option_exclusive (struct GNUNET_GETOPT_CommandLineOption opt);
  * Marker for the end of the list of options.
  */
 #define GNUNET_GETOPT_OPTION_END                      \
-  {                                                   \
-    '\0', NULL, NULL, NULL, 0, 0, 0, NULL, NULL, NULL \
-  }
+        {                                                   \
+          '\0', NULL, NULL, NULL, 0, 0, 0, NULL, NULL, NULL \
+        }
 
 
 /**
@@ -489,4 +506,6 @@ GNUNET_GETOPT_run (const char *binaryOptions,
 
 /** @} */ /* end of group getopt */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_getopt_lib.h */
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index 3f6c9b9aa..e7ed2d3c2 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
@@ -34,8 +37,8 @@
 #ifndef GNUNET_GNS_SERVICE_H
 #define GNUNET_GNS_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
-#include "gnunet_dnsparser_lib.h"
 #include "gnunet_identity_service.h"
 #include "gnunet_namestore_service.h"
 
@@ -48,12 +51,6 @@ extern "C" {
 
 
 /**
- * String we use to indicate an empty label (top-level
- * entry in the zone).  DNS uses "@", so do we.
- */
-#define GNUNET_GNS_EMPTY_LABEL_AT "@"
-
-/**
  * Connection to the GNS service.
  */
 struct GNUNET_GNS_Handle;
@@ -140,7 +137,7 @@ enum GNUNET_GNS_LocalOptions
 struct GNUNET_GNS_LookupRequest *
 GNUNET_GNS_lookup (struct GNUNET_GNS_Handle *handle,
                    const char *name,
-                   const struct GNUNET_IDENTITY_PublicKey *zone,
+                   const struct GNUNET_CRYPTO_PublicKey *zone,
                    uint32_t type,
                    enum GNUNET_GNS_LocalOptions options,
                    GNUNET_GNS_LookupResultProcessor proc,
@@ -164,7 +161,7 @@ GNUNET_GNS_lookup (struct GNUNET_GNS_Handle *handle,
 struct GNUNET_GNS_LookupRequest *
 GNUNET_GNS_lookup_limited (struct GNUNET_GNS_Handle *handle,
                            const char *name,
-                           const struct GNUNET_IDENTITY_PublicKey *zone,
+                           const struct GNUNET_CRYPTO_PublicKey *zone,
                            uint32_t type,
                            enum GNUNET_GNS_LocalOptions options,
                            uint16_t recursion_depth_limit,
@@ -230,6 +227,16 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle *handle,
 void *
 GNUNET_GNS_lookup_with_tld_cancel (struct GNUNET_GNS_LookupWithTldRequest *ltr);
 
+/**
+ * Try to parse the zTLD into a public key.
+ *
+ * @param[in] name the name to parse
+ * @param[out] ztld_key the identity key (must be allocated by caller). Only set of #GNUNET_OK is returned.
+ * @return GNUNET_OK on success.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNS_parse_ztld (const char *name,
+                       struct GNUNET_CRYPTO_PublicKey *ztld_key);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
@@ -241,3 +248,5 @@ GNUNET_GNS_lookup_with_tld_cancel (struct GNUNET_GNS_LookupWithTldRequest *ltr);
 #endif
 
 /** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_gnsrecord_json_lib.h b/src/include/gnunet_gnsrecord_json_lib.h
index 966461705..5bc48034b 100644
--- a/src/include/gnunet_gnsrecord_json_lib.h
+++ b/src/include/gnunet_gnsrecord_json_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
@@ -34,6 +37,7 @@
 #ifndef GNUNET_GNSRECORD_JSON_LIB_H
 #define GNUNET_GNSRECORD_JSON_LIB_H
 
+
 #include "gnunet_gnsrecord_lib.h"
 #include "gnunet_json_lib.h"
 
@@ -69,5 +73,15 @@ GNUNET_GNSRECORD_JSON_from_gnsrecord (const char*rname,
                             const struct GNUNET_GNSRECORD_Data *rd,
                             unsigned int rd_count);
 
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
 
 #endif
+
+/** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index f00a5d0f8..b4e45727b 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -34,6 +37,8 @@
 #ifndef GNUNET_GNSRECORD_LIB_H
 #define GNUNET_GNSRECORD_LIB_H
 
+
+#include "gnunet_common.h"
 #include "gnunet_identity_service.h"
 
 #ifdef __cplusplus
@@ -44,6 +49,12 @@ extern "C" {
 #endif
 
 /**
+ * String we use to indicate an empty label (top-level
+ * entry in the zone).  DNS uses "@", so do we.
+ */
+#define GNUNET_GNS_EMPTY_LABEL_AT "@"
+
+/**
  * Maximum size of a value that can be stored in a GNS block.
  */
 #define GNUNET_GNSRECORD_MAX_BLOCK_SIZE (63 * 1024)
@@ -60,50 +71,102 @@ extern "C" {
 #include "gnu_name_system_record_types.h"
 
 /**
+ * When comparing flags for record equality for removal,
+ * which flags should must match (in addition to the type,
+ * name, expiration value and data of the record)?  All flags
+ * that are not listed here will be ignored for this purpose.
+ * (for example, we don't expect that users will remember to
+ * pass the '--private' option when removing a record from
+ * the namestore, hence we don't require this particular option
+ * to match upon removal).  See also
+ * #GNUNET_GNSRECORD_records_cmp.
+ */
+#define GNUNET_GNSRECORD_RF_RCMP_FLAGS (GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)
+
+
+/**
  * Flags that can be set for a record.
+ * The numbers in the registry correspond to the bit index as specified in
+ * LSD0001 Chapter "Resource Records".
+ * Each enum member represents the 16-bit integer value of the flags field if
+ * only that particular flag was set.
+ * The value can be used to efficiently compare the bitmask setting for the
+ * record flag in C.
+ * WARNING: The values are in host byte order! In order to correctly check
+ * against the flags field a record, the respective fields must
+ * also be converted to HBO (or the enum value to NBO).
  */
 enum GNUNET_GNSRECORD_Flags
 {
   /**
-   * No special options.
+   * Entry for no flags / cleared flags.
    */
   GNUNET_GNSRECORD_RF_NONE = 0,
 
+
+  /**
+   * This record is critical. If it cannot be processed (for example because the record type is unknown) resolution MUST fail
+   */
+  GNUNET_GNSRECORD_RF_CRITICAL = 1 << (15 - 15),
+
+
   /**
-   * This is a private record of this peer and it should
-   * thus not be handed out to other peers.
+   * This record should not be used unless all (other) records in the set with an absolute expiration time have expired.
    */
-  GNUNET_GNSRECORD_RF_PRIVATE = 2,
+  GNUNET_GNSRECORD_RF_SHADOW = 1 << (15 - 14),
+
 
   /**
    * This is a supplemental record.
    */
-  GNUNET_GNSRECORD_RF_SUPPLEMENTAL = 4,
+  GNUNET_GNSRECORD_RF_SUPPLEMENTAL = 1 << (15 - 13),
 
   /**
-   * This expiration time of the record is a relative
-   * time (not an absolute time).
+   * Maintenance records. E.g. TOMBSTONEs
    */
-  GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION = 8,
+  GNUNET_GNSRECORD_RF_MAINTENANCE = 1 << (15 - 2),
 
   /**
-   * This record should not be used unless all (other) records with an absolute
-   * expiration time have expired.
+   * This expiration time of the record is a relative time (not an absolute time). Used in GNUnet implementation.
    */
-  GNUNET_GNSRECORD_RF_SHADOW_RECORD = 16
+  GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION = 1 << (15 - 1),
+
+
+  /**
+   * This is a private record of this peer and it should thus not be published.
+   */
+  GNUNET_GNSRECORD_RF_PRIVATE = 1 << (15 - 0),
+
+};
+
 
 /**
- * When comparing flags for record equality for removal,
- * which flags should must match (in addition to the type,
- * name, expiration value and data of the record)?  All flags
- * that are not listed here will be ignored for this purpose.
- * (for example, we don't expect that users will remember to
- * pass the '--private' option when removing a record from
- * the namestore, hence we don't require this particular option
- * to match upon removal).  See also
- * #GNUNET_GNSRECORD_records_cmp.
+ * Filter for GNUNET_GNSRECORD_normalize_record_set().
  */
-#define GNUNET_GNSRECORD_RF_RCMP_FLAGS (GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)
+enum GNUNET_GNSRECORD_Filter
+{
+  /**
+   * No filter flags set.
+   * Private and public records are returned,
+   * maintenance records (TOMBSTONE etc) are not.
+   */
+  GNUNET_GNSRECORD_FILTER_NONE = 0,
+
+  /**
+   * Include maintenance records (TOMBSTONE etc).
+   */
+  GNUNET_GNSRECORD_FILTER_INCLUDE_MAINTENANCE = 1,
+
+  /**
+   * Filter private records
+   */
+  GNUNET_GNSRECORD_FILTER_OMIT_PRIVATE = 2,
+
+  /**
+   * Filter public records.
+   * FIXME: Not implemented
+   */
+  // GNUNET_NAMESTORE_FILTER_OMIT_PUBLIC = 4,
 };
 
 
@@ -184,12 +247,6 @@ struct GNUNET_GNSRECORD_EcdsaBlock
   struct GNUNET_CRYPTO_EcdsaSignature signature;
 
   /**
-   * Number of bytes signed; also specifies the number of bytes
-   * of encrypted data that follow.
-   */
-  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
-
-  /**
    * Expiration time of the block.
    */
   struct GNUNET_TIME_AbsoluteNBO expiration_time;
@@ -214,22 +271,25 @@ struct GNUNET_GNSRECORD_EddsaBlock
   struct GNUNET_CRYPTO_EddsaSignature signature;
 
   /**
-   * Number of bytes signed; also specifies the number of bytes
-   * of encrypted data that follow.
-   */
-  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
-
-  /**
    * Expiration time of the block.
    */
   struct GNUNET_TIME_AbsoluteNBO expiration_time;
 
+
   /* followed by encrypted data */
 };
 
 
 struct GNUNET_GNSRECORD_Block
 {
+  /**
+   * Size of the block.
+   */
+  uint32_t size;
+
+  /**
+   * The zone type (GNUNET_GNSRECORD_TYPE_PKEY)
+   */
   uint32_t type;
 
   union
@@ -271,6 +331,31 @@ struct GNUNET_GNSRECORD_BoxRecord
   /* followed by the 'original' record */
 };
 
+
+/**
+ * Record type used to box up SMIMEA records.  For example, a
+ * SMIMEA record for "c93f1e400f26708f98cb19d936620da35eec8f72e57
+ * f9eec01c1afd6._smimecert.foo.gnu" will be stored under
+ * "foo.gnu" as a SBOX record with the local-path of the associated
+ * e-mails hash turnicated to 28 octets encoded as hex and protocol _smimecert
+ * and record_type "SMIMEA".  When a BOX record is received, GNS
+ * unboxes it if the name contained "hash._PROTO", otherwise GNS
+ * leaves it untouched.  This is done to ensure that SMIMEA
+ * records do not require a separate network request, thus making SMIMEA
+ * records inseparable from the "main" A/AAAA/VPN/etc. records.
+ */
+struct GNUNET_GNSRECORD_SBoxRecord
+{
+  /**
+   * GNS record type of the boxed record. In NBO.
+   */
+  uint32_t record_type GNUNET_PACKED;
+
+  /* followed by the zero terminated hostname prefix */
+  /* followed by the 'original' record */
+};
+
+
 /**
  * Record type used internally to keep track of reverse mappings into a
  * namespace.
@@ -283,7 +368,7 @@ struct GNUNET_GNSRECORD_ReverseRecord
   /**
    * The public key of the namespace the is delegating to our namespace
    */
-  struct GNUNET_IDENTITY_PublicKey pkey;
+  struct GNUNET_CRYPTO_PublicKey pkey;
 
   /**
    * The expiration time of the delegation
@@ -293,8 +378,6 @@ struct GNUNET_GNSRECORD_ReverseRecord
   /* followed by the name the delegator uses to refer to our namespace */
 };
 
-GNUNET_NETWORK_STRUCT_END
-
 
 /**
  * Process a records that were decrypted from a block.
@@ -387,6 +470,9 @@ GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
                                     const struct GNUNET_GNSRECORD_Data *rd,
                                     size_t dest_size, char *dest);
 
+unsigned int
+GNUNET_GNSRECORD_records_deserialize_get_size (size_t len,
+                                               const char *src);
 
 /**
  * Deserialize the given records to the given destination.
@@ -418,12 +504,13 @@ GNUNET_GNSRECORD_is_expired (const struct GNUNET_GNSRECORD_Data *rd);
 
 
 /**
- * Convert a UTF-8 string to UTF-8 lowercase
+ * Normalize a UTF-8 string to a GNS name
+ *
  * @param src source string
  * @return converted result
  */
 char *
-GNUNET_GNSRECORD_string_to_lowercase (const char *src);
+GNUNET_GNSRECORD_string_normalize (const char *src);
 
 
 /**
@@ -436,7 +523,7 @@ GNUNET_GNSRECORD_string_to_lowercase (const char *src);
  * #GNUNET_GNSRECORD_z2s.
  */
 const char *
-GNUNET_GNSRECORD_z2s (const struct GNUNET_IDENTITY_PublicKey *z);
+GNUNET_GNSRECORD_z2s (const struct GNUNET_CRYPTO_PublicKey *z);
 
 
 /**
@@ -450,7 +537,7 @@ GNUNET_GNSRECORD_z2s (const struct GNUNET_IDENTITY_PublicKey *z);
  *         key in an encoding suitable for DNS labels.
  */
 const char *
-GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_IDENTITY_PublicKey *pkey);
+GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_CRYPTO_PublicKey *pkey);
 
 
 /**
@@ -464,7 +551,7 @@ GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_IDENTITY_PublicKey *pkey);
  */
 int
 GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
-                               struct GNUNET_IDENTITY_PublicKey *pkey);
+                               struct GNUNET_CRYPTO_PublicKey *pkey);
 
 
 /**
@@ -476,12 +563,13 @@ GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
  */
 void
 GNUNET_GNSRECORD_query_from_private_key (
-  const struct GNUNET_IDENTITY_PrivateKey *zone, const char *label,
+  const struct GNUNET_CRYPTO_PrivateKey *zone, const char *label,
   struct GNUNET_HashCode *query);
 
 
 /**
  * Calculate the DHT query for a given @a label in a given @a zone.
+ * FIXME: We may want to plugin-ize this at some point.
  *
  * @param pub public key of the zone
  * @param label label of the record
@@ -489,11 +577,39 @@ GNUNET_GNSRECORD_query_from_private_key (
  */
 void
 GNUNET_GNSRECORD_query_from_public_key (
-  const struct GNUNET_IDENTITY_PublicKey *pub, const char *label,
+  const struct GNUNET_CRYPTO_PublicKey *pub, const char *label,
   struct GNUNET_HashCode *query);
 
 
 /**
+ * Get size of buffer for block creation.
+ *
+ * @param key the zone key
+ * @param rd record data
+ * @param rd_count number of records
+ * @return -1 on error (otherwise the length of the block)
+ */
+ssize_t
+GNUNET_GNSRECORD_block_calculate_size (const struct
+                                       GNUNET_CRYPTO_PrivateKey *key,
+                                       const struct GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count);
+
+/**
+ * Sign a block create with #GNUNET_GNSRECORD_block_create_unsigned
+ *
+ * @param key the private key
+ * @param label the label of the block
+ * @param block the unsigned block
+ * @return GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_sign (const struct
+                             GNUNET_CRYPTO_PrivateKey *key,
+                             const char *label,
+                             struct GNUNET_GNSRECORD_Block *block);
+
+/**
  * Sign name and records
  *
  * @param key the private key
@@ -501,13 +617,41 @@ GNUNET_GNSRECORD_query_from_public_key (
  * @param label the name for the records
  * @param rd record data
  * @param rd_count number of records in @a rd
+ * @param result the block buffer. Will be allocated.
+ * @return GNUNET_OK on success
  */
-struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create (const struct GNUNET_IDENTITY_PrivateKey *key,
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_PrivateKey *key,
                                struct GNUNET_TIME_Absolute expire,
                                const char *label,
                                const struct GNUNET_GNSRECORD_Data *rd,
-                               unsigned int rd_count);
+                               unsigned int rd_count,
+                               struct GNUNET_GNSRECORD_Block **block);
+
+
+/**
+ * Create name and records but do not sign!
+ * Sign later with #GNUNET_GNSRECORD_block_sign().
+ * Cache derived public key (also keeps the
+ * private key in static memory, so do not use this function if
+ * keeping the private key in the process'es RAM is a major issue).
+ *
+ * @param key the private key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records in @a rd
+ * @param result the block buffer. Will be allocated.
+ * @return GNUNET_OK on success.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create_unsigned (const struct
+                                        GNUNET_CRYPTO_PrivateKey *key,
+                                        struct GNUNET_TIME_Absolute expire,
+                                        const char *label,
+                                        const struct GNUNET_GNSRECORD_Data *rd,
+                                        unsigned int rd_count,
+                                        struct GNUNET_GNSRECORD_Block **result);
 
 
 /**
@@ -520,13 +664,16 @@ GNUNET_GNSRECORD_block_create (const struct GNUNET_IDENTITY_PrivateKey *key,
  * @param label the name for the records
  * @param rd record data
  * @param rd_count number of records in @a rd
+ * @param result the block buffer. Will be allocated.
+ * @return GNUNET_OK on success.
  */
-struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create2 (const struct GNUNET_IDENTITY_PrivateKey *key,
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_PrivateKey *key,
                                 struct GNUNET_TIME_Absolute expire,
                                 const char *label,
                                 const struct GNUNET_GNSRECORD_Data *rd,
-                                unsigned int rd_count);
+                                unsigned int rd_count,
+                                struct GNUNET_GNSRECORD_Block **result);
 
 
 /**
@@ -536,7 +683,7 @@ GNUNET_GNSRECORD_block_create2 (const struct GNUNET_IDENTITY_PrivateKey *key,
  * @param block block to verify
  * @return #GNUNET_OK if the signature is valid
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block);
 
 
@@ -551,10 +698,10 @@ GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block);
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if the block was
  *        not well-formed
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_block_decrypt (
   const struct GNUNET_GNSRECORD_Block *block,
-  const struct GNUNET_IDENTITY_PublicKey *zone_key, const char *label,
+  const struct GNUNET_CRYPTO_PublicKey *zone_key, const char *label,
   GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls);
 
 
@@ -565,7 +712,7 @@ GNUNET_GNSRECORD_block_decrypt (
  * @param b another record
  * @return #GNUNET_YES if the records are equal, or #GNUNET_NO if not.
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
                               const struct GNUNET_GNSRECORD_Data *b);
 
@@ -577,11 +724,14 @@ GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
  *
  * @param rd_count number of records given in @a rd
  * @param rd array of records
+ * @param min minimum expiration time
  * @return absolute expiration time
  */
 struct GNUNET_TIME_Absolute
-GNUNET_GNSRECORD_record_get_expiration_time (
-  unsigned int rd_count, const struct GNUNET_GNSRECORD_Data *rd);
+GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min);
 
 
 /**
@@ -631,7 +781,7 @@ enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_identity_from_data (const char *data,
                                      size_t data_size,
                                      uint32_t type,
-                                     struct GNUNET_IDENTITY_PublicKey *key);
+                                     struct GNUNET_CRYPTO_PublicKey *key);
 
 
 /**
@@ -645,7 +795,7 @@ GNUNET_GNSRECORD_identity_from_data (const char *data,
  */
 enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_data_from_identity (const struct
-                                     GNUNET_IDENTITY_PublicKey *key,
+                                     GNUNET_CRYPTO_PublicKey *key,
                                      char **data,
                                      size_t *data_size,
                                      uint32_t *type);
@@ -661,6 +811,181 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_is_zonekey_type (uint32_t type);
 
+/**
+ * Check if this type is a critical record.
+ *
+ * @param type the type to check
+ * @return GNUNET_YES if it is critical.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type);
+
+/**
+ * Normalize namestore records: Check for consistency and
+ * expirations. Purge expired records. Returns a "clean" record set.
+ * Also returns the minimum expiration time this block should be
+ * published under.
+ * Also checks rules with respect to labels (e.g. no delegations under
+ * the empty label)
+ *
+ * @param label the label under which this set (supposed to be) stored.
+ * @param rd input records
+ * @param rd_count size of the @a rd and @a rd_public arrays
+ * @param rd_public where to write the converted records
+ * @param rd_count_public number of records written to @a rd_public
+ * @param min_expiry the minimum expiration of this set
+ * @param filter the record set filter, see GNUNET_GNSRECORD_Filter.
+ * @param emsg the error message if something went wrong
+ * @return GNUNET_OK if set could be normalized and is consistent
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *min_expiry,
+                                       enum GNUNET_GNSRECORD_Filter filter,
+                                       char **emsg);
+
+/**
+ * Check label for invalid characters.
+ *
+ * @param label the label to check
+ * @param emsg an error message (NULL if label is valid). Will be allocated.
+ * @return GNUNET_OK if label is valid.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg);
+
+/**
+ * Maximum length of a revocation
+ */
+#define GNUNET_MAX_POW_SIZE sizeof(struct GNUNET_GNSRECORD_PowP)  \
+  + sizeof(struct GNUNET_CRYPTO_PublicKey)  \
+  + 1024                                      // FIXME max sig_len
+
+/**
+ * The proof-of-work narrowing factor.
+ * The number of PoWs that are calculates as part of revocation.
+ */
+#define POW_COUNT 32
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Struct for a proof of work as part of the revocation.
+ */
+struct GNUNET_GNSRECORD_PowP
+{
+  /**
+   * The timestamp of the revocation
+   */
+  struct GNUNET_TIME_AbsoluteNBO timestamp;
+
+  /**
+   * The TTL of this revocation (purely informational)
+   */
+  struct GNUNET_TIME_RelativeNBO ttl;
+
+  /**
+   * The PoWs
+   */
+  uint64_t pow[POW_COUNT] GNUNET_PACKED;
+
+  /** followed by the public key type, the key and a signature **/
+};
+
+
+/**
+ * The signature object we use for the PoW
+ */
+struct GNUNET_GNSRECORD_SignaturePurposePS
+{
+  /**
+   * The signature purpose
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * The timestamp of the revocation
+   */
+  struct GNUNET_TIME_AbsoluteNBO timestamp;
+
+  /** Followed by the zone public key type and key **/
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Handle to a running proof-of-work calculation.
+ */
+struct GNUNET_GNSRECORD_PowCalculationHandle;
+
+
+/**
+ * Check if the given proof-of-work is valid.
+ *
+ * @param pow proof of work
+ * @param matching_bits how many bits must match (configuration)
+ * @param epoch_duration length of single epoch in configuration
+ * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_check_pow (const struct GNUNET_GNSRECORD_PowP *pow,
+                            unsigned int matching_bits,
+                            struct GNUNET_TIME_Relative epoch_duration);
+
+
+/**
+ * Initializes a fresh PoW computation.
+ *
+ * @param key the key to calculate the PoW for.
+ * @param pow the pow object to work with in the calculation.
+ */
+void
+GNUNET_GNSRECORD_pow_init (const struct GNUNET_CRYPTO_PrivateKey *key,
+                           struct GNUNET_GNSRECORD_PowP *pow);
+
+
+/**
+ * Starts a proof-of-work calculation given the pow object as well as
+ * target epochs and difficulty.
+ *
+ * @param pow the PoW to based calculations on.
+ * @param epochs the number of epochs for which the PoW must be valid.
+ * @param difficulty the base difficulty of the PoW.
+ * @return a handle for use in PoW rounds
+ */
+struct GNUNET_GNSRECORD_PowCalculationHandle*
+GNUNET_GNSRECORD_pow_start (struct GNUNET_GNSRECORD_PowP *pow,
+                            int epochs,
+                            unsigned int difficulty);
+
+
+/**
+ * Calculate a single round in the key revocation PoW.
+ *
+ * @param pc handle to the PoW, initially called with NULL.
+ * @return GNUNET_YES if the @a pow is acceptable, GNUNET_NO if not
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_pow_round (struct GNUNET_GNSRECORD_PowCalculationHandle *pc);
+
+size_t
+GNUNET_GNSRECORD_proof_get_size (const struct GNUNET_GNSRECORD_PowP *pow);
+
+/**
+ * Stop a PoW calculation
+ *
+ * @param pc the calculation to clean up
+ * @return #GNUNET_YES if pow valid, #GNUNET_NO if pow was set but is not
+ * valid
+ */
+void
+GNUNET_GNSRECORD_pow_stop (struct GNUNET_GNSRECORD_PowCalculationHandle *pc);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
@@ -672,3 +997,5 @@ GNUNET_GNSRECORD_is_zonekey_type (uint32_t type);
 #endif
 
 /** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_gnsrecord_plugin.h b/src/include/gnunet_gnsrecord_plugin.h
index aec22c3af..f55934b60 100644
--- a/src/include/gnunet_gnsrecord_plugin.h
+++ b/src/include/gnunet_gnsrecord_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -105,6 +108,18 @@ typedef const char *
 (*GNUNET_GNSRECORD_NumberToTypenameFunction) (void *cls,
                                               uint32_t type);
 
+/**
+ * Function called to check for critical records.
+ *
+ * @param cls closure
+ * @param type number of a type to check
+ * @return GNUNET_YES if critical, otherwise GNUNET_NO
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_GNSRECORD_IsCriticalFunction) (void *cls,
+                                        uint32_t type);
+
+
 
 /**
  * Each plugin is required to return a pointer to a struct of this
@@ -136,10 +151,17 @@ struct GNUNET_GNSRECORD_PluginFunctions
    * Number to typename.
    */
   GNUNET_GNSRECORD_NumberToTypenameFunction number_to_typename;
+
+  /**
+   * Is critical.
+   */
+  GNUNET_GNSRECORD_IsCriticalFunction is_critical;
 };
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
 #endif
diff --git a/src/include/gnunet_hello_lib.h b/src/include/gnunet_hello_lib.h
deleted file mode 100644
index 74eca999d..000000000
--- a/src/include/gnunet_hello_lib.h
+++ /dev/null
@@ -1,539 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2010, 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- * @file
- * Helper library for handling HELLOs
- *
- * @defgroup hello  Hello library
- * Helper library for handling HELLOs
- *
- * @see [Documentation](https://gnunet.org/gnunets-hostlist-subsystem)
- *
- * @{
- */
-
-#ifndef GNUNET_HELLO_LIB_H
-#define GNUNET_HELLO_LIB_H
-
-#ifdef __cplusplus
-extern "C" {
-#if 0 /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-
-/**
- * Prefix that every HELLO URI must start with.
- */
-#define GNUNET_HELLO_URI_PREFIX "gnunet://hello/"
-
-/**
- * Prefix that every FRIEND HELLO URI must start with.
- */
-#define GNUNET_FRIEND_HELLO_URI_PREFIX "gnunet://friend-hello/"
-
-/**
- * Separator used in HELLO URI
- */
-#define GNUNET_HELLO_URI_SEP '+'
-
-
-/**
- * Additional local information about an address
- *
- * These information are only valid for the local peer and are not serialized
- * when a #GNUNET_HELLO_Message is created
- */
-enum GNUNET_HELLO_AddressInfo
-{
-  /**
-   * No additional information
-   */
-  GNUNET_HELLO_ADDRESS_INFO_NONE = 0,
-
-  /**
-   * This is an inbound address and cannot be used to initiate an outbound
-   * connection to another peer
-   */
-  GNUNET_HELLO_ADDRESS_INFO_INBOUND = 1
-};
-
-
-/**
- * An address for communicating with a peer.  We frequently
- * need this tuple and the components cannot really be
- * separated.  This is NOT the format that would be used
- * on the wire.
- */
-struct GNUNET_HELLO_Address
-{
-  /**
-   * For which peer is this an address?
-   */
-  struct GNUNET_PeerIdentity peer;
-
-  /**
-   * Name of the transport plugin enabling the communication using
-   * this address.
-   */
-  const char *transport_name;
-
-  /**
-   * Binary representation of the address (plugin-specific).
-   */
-  const void *address;
-
-  /**
-   * Number of bytes in @e address.
-   */
-  size_t address_length;
-
-  /**
-   * Extended information about address
-   *
-   * This field contains additional #GNUNET_HELLO_AddressInfo flags e.g.
-   * to indicate an address is inbound and cannot be used to initiate an
-   * outbound connection.
-   *
-   * These information are only valid for the local peer and are not serialized
-   * when a #GNUNET_HELLO_Message is created
-   */
-  enum GNUNET_HELLO_AddressInfo local_info;
-};
-
-
-/**
- * Allocate an address struct.
- *
- * @param peer the peer
- * @param transport_name plugin name
- * @param address binary address
- * @param address_length number of bytes in @a address
- * @param local_info additional local information for the address
- * @return the address struct
- */
-struct GNUNET_HELLO_Address *
-GNUNET_HELLO_address_allocate (const struct GNUNET_PeerIdentity *peer,
-                               const char *transport_name,
-                               const void *address,
-                               size_t address_length,
-                               enum GNUNET_HELLO_AddressInfo local_info);
-
-
-/**
- * Copy an address struct.
- *
- * @param address address to copy
- * @return a copy of the address struct
- */
-struct GNUNET_HELLO_Address *
-GNUNET_HELLO_address_copy (const struct GNUNET_HELLO_Address *address);
-
-
-/**
- * Compare two addresses.  Does NOT compare the peer identity,
- * that is assumed already to match!
- *
- * @param a1 first address
- * @param a2 second address
- * @return 0 if the addresses are equal, -1 if @a a1< @a a2, 1 if @a a1> @a a2.
- */
-int
-GNUNET_HELLO_address_cmp (const struct GNUNET_HELLO_Address *a1,
-                          const struct GNUNET_HELLO_Address *a2);
-
-
-/**
- * Get the size of an address struct.
- *
- * @param address address
- * @return the size
- */
-size_t
-GNUNET_HELLO_address_get_size (const struct GNUNET_HELLO_Address *address);
-
-
-/**
- * Check if an address has a local option set
- *
- * @param address the address to check
- * @param option the respective option to check for
- * @return #GNUNET_YES or #GNUNET_NO
- */
-int
-GNUNET_HELLO_address_check_option (const struct GNUNET_HELLO_Address *address,
-                                   enum GNUNET_HELLO_AddressInfo option);
-
-
-/**
- * Free an address.
- *
- * @param addr address to free
- */
-#define GNUNET_HELLO_address_free(addr) GNUNET_free (addr)
-
-
-GNUNET_NETWORK_STRUCT_BEGIN
-
-/**
- * A HELLO message is used to exchange information about
- * transports with other peers.  This struct is always
- * followed by the actual network addresses which have
- * the format:
- *
- * 1) transport-name (0-terminated)
- * 2) address-length (uint16_t, network byte order; possibly
- *    unaligned!)
- * 3) address expiration (`struct GNUNET_TIME_AbsoluteNBO`); possibly
- *    unaligned!)
- * 4) address (address-length bytes; possibly unaligned!)
- */
-struct GNUNET_HELLO_Message
-{
-  /**
-   * Type will be #GNUNET_MESSAGE_TYPE_HELLO.
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * Use in F2F mode: Do not gossip this HELLO message
-   */
-  uint32_t friend_only GNUNET_PACKED;
-
-  /**
-   * The public key of the peer.
-   */
-  struct GNUNET_CRYPTO_EddsaPublicKey publicKey;
-};
-GNUNET_NETWORK_STRUCT_END
-
-
-/**
- * Return HELLO type
- *
- * @param h HELLO Message to test
- * @return #GNUNET_YES for friend-only or #GNUNET_NO otherwise
- */
-int
-GNUNET_HELLO_is_friend_only (const struct GNUNET_HELLO_Message *h);
-
-
-/**
- * Copy the given address information into
- * the given buffer using the format of HELLOs.
- *
- * @param address address to add
- * @param expiration expiration for the address
- * @param target where to copy the address
- * @param max maximum number of bytes to copy to @a target
- * @return number of bytes copied, 0 if
- *         the target buffer was not big enough.
- */
-size_t
-GNUNET_HELLO_add_address (const struct GNUNET_HELLO_Address *address,
-                          struct GNUNET_TIME_Absolute expiration,
-                          char *target,
-                          size_t max);
-
-
-/**
- * Callback function used to fill a buffer of max bytes with a list of
- * addresses in the format used by HELLOs.  Should use
- * #GNUNET_HELLO_add_address() as a helper function.
- *
- * @param cls closure
- * @param max maximum number of bytes that can be written to @a buf
- * @param buf where to write the address information
- * @return number of bytes written or 0, #GNUNET_SYSERR to signal the
- *         end of the iteration.
- */
-typedef ssize_t
-(*GNUNET_HELLO_GenerateAddressListCallback) (void *cls,
-                                             size_t max,
-                                             void *buf);
-
-
-/**
- * Construct a HELLO message given the public key,
- * expiration time and an iterator that spews the
- * transport addresses.
- *
- * If friend only is set to #GNUNET_YES we create a FRIEND_HELLO which
- * will not be gossiped to other peers.
- *
- * @param public_key public key to include in the HELLO
- * @param addrgen callback to invoke to get addresses
- * @param addrgen_cls closure for @a addrgen
- * @param friend_only should the returned HELLO be only visible to friends?
- * @return the hello message
- */
-struct GNUNET_HELLO_Message *
-GNUNET_HELLO_create (const struct GNUNET_CRYPTO_EddsaPublicKey *public_key,
-                     GNUNET_HELLO_GenerateAddressListCallback addrgen,
-                     void *addrgen_cls,
-                     int friend_only);
-
-
-/**
- * Return the size of the given HELLO message.
- *
- * @param hello to inspect
- * @return the size, 0 if HELLO is invalid
- */
-uint16_t
-GNUNET_HELLO_size (const struct GNUNET_HELLO_Message *hello);
-
-
-/**
- * Construct a HELLO message by merging the
- * addresses in two existing HELLOs (which
- * must be for the same peer).
- *
- * @param h1 first HELLO message
- * @param h2 the second HELLO message
- * @return the combined hello message
- */
-struct GNUNET_HELLO_Message *
-GNUNET_HELLO_merge (const struct GNUNET_HELLO_Message *h1,
-                    const struct GNUNET_HELLO_Message *h2);
-
-
-/**
- * Test if two HELLO messages contain the same addresses.
- * If they only differ in expiration time, the lowest
- * expiration time larger than 'now' where they differ
- * is returned.
- *
- * @param h1 first HELLO message
- * @param h2 the second HELLO message
- * @param now time to use for deciding which addresses have
- *            expired and should not be considered at all
- * @return absolute time forever if the two HELLOs are
- *         totally identical; smallest timestamp >= now if
- *         they only differ in timestamps;
- *         zero if the some addresses with expirations >= now
- *         do not match at all
- */
-struct GNUNET_TIME_Absolute
-GNUNET_HELLO_equals (const struct GNUNET_HELLO_Message *h1,
-                     const struct GNUNET_HELLO_Message *h2,
-                     struct GNUNET_TIME_Absolute now);
-
-
-/**
- * Iterator callback to go over all addresses.
- *
- * @param cls closure
- * @param address the address
- * @param expiration expiration time
- * @return #GNUNET_OK to keep the address,
- *         #GNUNET_NO to delete it from the HELLO
- *         #GNUNET_SYSERR to stop iterating (but keep current address)
- */
-typedef int (*GNUNET_HELLO_AddressIterator) (
-  void *cls,
-  const struct GNUNET_HELLO_Address *address,
-  struct GNUNET_TIME_Absolute expiration);
-
-
-/**
- * When does the last address in the given HELLO expire?
- *
- * @param msg HELLO to inspect
- * @return time the last address expires, 0 if there are no addresses in the HELLO
- */
-struct GNUNET_TIME_Absolute
-GNUNET_HELLO_get_last_expiration (const struct GNUNET_HELLO_Message *msg);
-
-
-/**
- * Iterate over all of the addresses in the HELLO.
- *
- * @param msg HELLO to iterate over; client does not need to
- *        have verified that msg is well-formed (beyond starting
- *        with a GNUNET_MessageHeader of the right type).
- * @param return_modified if a modified copy should be returned,
- *         otherwise NULL will be returned
- * @param it iterator to call on each address
- * @param it_cls closure for @a it
- * @return the modified HELLO or NULL
- */
-struct GNUNET_HELLO_Message *
-GNUNET_HELLO_iterate_addresses (const struct GNUNET_HELLO_Message *msg,
-                                int return_modified,
-                                GNUNET_HELLO_AddressIterator it,
-                                void *it_cls);
-
-
-/**
- * Iterate over addresses in @a new_hello that are NOT already present
- * in @a old_hello. Note that if the address is present in @a old_hello
- * but the expiration time in @a new_hello is more recent, the
- * iterator is also called.
- *
- * @param new_hello a HELLO message
- * @param old_hello a HELLO message
- * @param expiration_limit ignore addresses in old_hello
- *        that expired before the given time stamp
- * @param it iterator to call on each address
- * @param it_cls closure for @a it
- */
-void
-GNUNET_HELLO_iterate_new_addresses (
-  const struct GNUNET_HELLO_Message *new_hello,
-  const struct GNUNET_HELLO_Message *old_hello,
-  struct GNUNET_TIME_Absolute expiration_limit,
-  GNUNET_HELLO_AddressIterator it,
-  void *it_cls);
-
-
-/**
- * Get the peer identity from a HELLO message.
- *
- * @param hello the hello message
- * @param peer where to store the peer's identity
- * @return #GNUNET_SYSERR if the HELLO was malformed
- */
-int
-GNUNET_HELLO_get_id (const struct GNUNET_HELLO_Message *hello,
-                     struct GNUNET_PeerIdentity *peer);
-
-
-/**
- * Get the header from a HELLO message, used so other code
- * can correctly send HELLO messages.
- *
- * @param hello the hello message
- *
- * @return header or NULL if the HELLO was malformed
- */
-struct GNUNET_MessageHeader *
-GNUNET_HELLO_get_header (struct GNUNET_HELLO_Message *hello);
-
-
-/**
- * Helper function to load/access transport plugins.
- * FIXME: pass closure!
- *
- * @param name name of the transport plugin to load
- * @return NULL if a plugin with name @a name is not known/loadable
- */
-typedef struct GNUNET_TRANSPORT_PluginFunctions *(
-*GNUNET_HELLO_TransportPluginsFind) (const char *name);
-
-
-/**
- * Compose a hello URI string from a hello message.
- *
- * @param hello Hello message
- * @param plugins_find Function to find transport plugins by name
- * @return Hello URI string
- */
-char *
-GNUNET_HELLO_compose_uri (const struct GNUNET_HELLO_Message *hello,
-                          GNUNET_HELLO_TransportPluginsFind plugins_find);
-
-
-/**
- * Parse a hello URI string to a hello message.
- *
- * @param uri URI string to parse
- * @param pubkey Pointer to struct where public key is parsed
- * @param hello Pointer to struct where hello message is parsed
- * @param plugins_find Function to find transport plugins by name
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the URI was invalid, #GNUNET_NO on other errors
- */
-int
-GNUNET_HELLO_parse_uri (const char *uri,
-                        struct GNUNET_CRYPTO_EddsaPublicKey *pubkey,
-                        struct GNUNET_HELLO_Message **hello,
-                        GNUNET_HELLO_TransportPluginsFind plugins_find);
-
-
-/* NG API */
-#include "gnunet_nt_lib.h"
-
-
-/**
- * Build address record by signing raw information with private key.
- *
- * @param address text address to sign
- * @param nt network type of @a address
- * @param mono_time when was @a address valid
- * @param private_key signing key to use
- * @param result[out] where to write address record (allocated)
- * @param result_size[out] set to size of @a result
- */
-void
-GNUNET_HELLO_sign_address (
-  const char *address,
-  enum GNUNET_NetworkType nt,
-  struct GNUNET_TIME_Absolute mono_time,
-  const struct GNUNET_CRYPTO_EddsaPrivateKey *private_key,
-  void **result,
-  size_t *result_size);
-
-
-/**
- * Check signature and extract address record.
- *
- * @param raw raw signed address
- * @param raw_size size of @a raw
- * @param pid public key to use for signature verification
- * @param nt[out] set to network type
- * @param mono_time[out] when was the address generated
- * @return NULL on error, otherwise the address
- */
-char *
-GNUNET_HELLO_extract_address (const void *raw,
-                              size_t raw_size,
-                              const struct GNUNET_PeerIdentity *pid,
-                              enum GNUNET_NetworkType *nt,
-                              struct GNUNET_TIME_Absolute *mono_time);
-
-
-/**
- * Given an address as a string, extract the prefix that identifies
- * the communicator offering transmissions to that address.
- *
- * @param address a peer's address
- * @return NULL if the address is mal-formed, otherwise the prefix
- */
-char *
-GNUNET_HELLO_address_to_prefix (const char *address);
-
-
-#if 0 /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef GNUNET_HELLO_LIB_H */
-#endif
-
-/** @} */ /* end of group */
-
-/* end of gnunet_hello_lib.h */
diff --git a/src/include/gnunet_hello_uri_lib.h b/src/include/gnunet_hello_uri_lib.h
new file mode 100644
index 000000000..aecda0885
--- /dev/null
+++ b/src/include/gnunet_hello_uri_lib.h
@@ -0,0 +1,304 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @addtogroup Backbone
+ * @{
+ *
+ * @author Christian Grothoff
+ * @file
+ * Helper library for handling HELLO URIs
+ *
+ * @defgroup hello_uri  Hello_Uri library
+ * Helper library for handling HELLO URIs
+ *
+ * @{
+ */
+
+#ifndef GNUNET_HELLO_URI_LIB_H
+#define GNUNET_HELLO_URI_LIB_H
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder;
+
+
+/**
+ * For how long are HELLO signatures valid?
+ */
+#define GNUNET_HELLO_ADDRESS_EXPIRATION GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_DAYS, 2)
+
+
+/**
+ * Allocate builder.
+ *
+ * @param pid peer the builder is for
+ * @return new builder
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid);
+
+
+/**
+ * Get the PeerIdentity for this builder.
+ */
+const struct GNUNET_PeerIdentity *
+GNUNET_HELLO_builder_get_id (const struct GNUNET_HELLO_Builder *builder);
+
+
+/**
+ * Release resources of a @a builder.
+ *
+ * @param[in] builder to free
+ */
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder);
+
+
+/**
+ * Parse @a msg into builder.
+ *
+ * @param msg message to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * Parse @a block into builder.
+ *
+ * @param block DHT block to parse
+ * @param block_size number of bytes in @a block
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size);
+
+
+/**
+ * Parse GNUnet HELLO @a url into builder.
+ *
+ * @param url URL to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url);
+
+
+/**
+ * Get the expiration time for this HELLO.
+ *
+ * @param  msg The hello msg.
+ * @return The expiration time.
+ */
+struct GNUNET_TIME_Absolute
+GNUNET_HELLO_builder_get_expiration_time (const struct
+                                          GNUNET_MessageHeader *msg);
+
+
+/**
+ * Generate envelope with GNUnet HELLO message (including
+ * peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                             struct GNUNET_TIME_Relative expiration_time);
+
+
+/**
+ * Generate DHT HELLO message (without peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  struct GNUNET_TIME_Relative expiration_time);
+
+
+/**
+ * Generate GNUnet HELLO URI from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return hello URI
+ */
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+
+/**
+ * Generate DHT block from a @a builder
+ *
+ * @param builder the builder to serialize
+ * @param priv private key to use to sign the result
+ * @param[out] block where to write the block, NULL to only calculate @a block_size
+ * @param[in,out] block_size input is number of bytes available in @a block,
+ *                           output is number of bytes needed in @a block
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a block_size was too small
+ *      or if @a block was NULL
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Relative expiration_time);
+
+
+/**
+ * Add individual @a address to the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to add
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was already
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+
+
+/**
+ * Remove individual @a address from the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to remove
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was not
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+
+
+/**
+ * Callback function used to extract URIs from a builder.
+ *
+ * @param cls closure
+ * @param uri one of the URIs
+ */
+typedef void
+(*GNUNET_HELLO_UriCallback) (void *cls,
+                             const struct GNUNET_PeerIdentity* pid,
+                             const char *uri);
+
+
+/**
+ * Iterate over URIs in a builder.
+ *
+ * @param builder builder to iterate over
+ * @param uc callback invoked for each URI, can be NULL
+ * @param uc_cls closure for @a addrgen
+ * @return pid of the peer the @a builder is for, can be NULL
+ */
+const struct GNUNET_PeerIdentity *
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls);
+
+
+/**
+ * Convert a DHT @a hello message to a HELLO @a block.
+ *
+ * @param hello the HELLO message
+ * @param pid peer that created the @a hello
+ * @param[out] block set to the HELLO block
+ * @param[out] block_size set to number of bytes in @a block
+ * @param[out] block_expiration set to expiration time of @a block
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if the @a hello is expired (@a block is set!)
+ *         #GNUNET_SYSERR if @a hello is invalid (@a block will be set to NULL)
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration);
+
+
+/**
+ * Given an address as a string, extract the prefix that identifies
+ * the communicator offering transmissions to that address.
+ *
+ * @param address a peer's address
+ * @return NULL if the address is mal-formed, otherwise the prefix
+ */
+char *
+GNUNET_HELLO_address_to_prefix (const char *address);
+
+/**
+ * Build address record by signing raw information with private key.
+ *
+ * @param address text address to sign
+ * @param nt network type of @a address
+ * @param mono_time when was @a address valid
+ * @param private_key signing key to use
+ * @param[out] result where to write address record (allocated)
+ * @param[out] result_size set to size of @a result
+ */
+void
+GNUNET_HELLO_sign_address (
+  const char *address,
+  enum GNUNET_NetworkType nt,
+  struct GNUNET_TIME_Absolute mono_time,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *private_key,
+  void **result,
+  size_t *result_size);
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+/* ifndef GNUNET_HELLO_URI_LIB_H */
+#endif
+
+/** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
+
+/* end of gnunet_hello_uri_lib.h */
diff --git a/src/include/gnunet_helper_lib.h b/src/include/gnunet_helper_lib.h
index b54120204..57630c45c 100644
--- a/src/include/gnunet_helper_lib.h
+++ b/src/include/gnunet_helper_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Philipp Toelke
  * @author Christian Grothoff
  *
@@ -34,10 +38,14 @@
  * @{
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_HELPER_LIB_H
 #define GNUNET_HELPER_LIB_H
 
-#include "gnunet_scheduler_lib.h"
+
 #include "gnunet_mst_lib.h"
 
 
@@ -91,8 +99,9 @@ GNUNET_HELPER_start (int with_control_pipe,
  *          stdin; #GNUNET_NO to signal termination by sending SIGTERM to helper
  * @return #GNUNET_OK on success; #GNUNET_SYSERR on error
  */
-int
-GNUNET_HELPER_kill (struct GNUNET_HELPER_Handle *h, int soft_kill);
+enum GNUNET_GenericReturnValue
+GNUNET_HELPER_kill (struct GNUNET_HELPER_Handle *h,
+                    int soft_kill);
 
 
 /**
@@ -103,7 +112,7 @@ GNUNET_HELPER_kill (struct GNUNET_HELPER_Handle *h, int soft_kill);
  * @param h the helper handle
  * @return #GNUNET_OK on success; #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_HELPER_wait (struct GNUNET_HELPER_Handle *h);
 
 
@@ -136,8 +145,10 @@ GNUNET_HELPER_stop (struct GNUNET_HELPER_Handle *h, int soft_kill);
  *               #GNUNET_NO if helper process died
  *               #GNUNET_SYSERR during GNUNET_HELPER_destroy
  */
-typedef void (*GNUNET_HELPER_Continuation)(void *cls,
-                                           int result);
+typedef void
+(*GNUNET_HELPER_Continuation)(
+  void *cls,
+  enum GNUNET_GenericReturnValue result);
 
 
 /**
@@ -162,7 +173,7 @@ struct GNUNET_HELPER_SendHandle;
 struct GNUNET_HELPER_SendHandle *
 GNUNET_HELPER_send (struct GNUNET_HELPER_Handle *h,
                     const struct GNUNET_MessageHeader *msg,
-                    int can_drop,
+                    bool can_drop,
                     GNUNET_HELPER_Continuation cont,
                     void *cont_cls);
 
@@ -181,3 +192,5 @@ GNUNET_HELPER_send_cancel (struct GNUNET_HELPER_SendHandle *sh);
 /* end of include guard: GNUNET_HELPER_LIB_H */
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_identity_service.h b/src/include/gnunet_identity_service.h
index c123983e2..270f4d26f 100644
--- a/src/include/gnunet_identity_service.h
+++ b/src/include/gnunet_identity_service.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2013 GNUnet e.V.
+     Copyright (C) 2013--2023 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup egos  Ego management
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -42,6 +45,7 @@
 #ifndef GNUNET_IDENTITY_SERVICE_H
 #define GNUNET_IDENTITY_SERVICE_H
 
+#include "gnunet_common.h"
 #ifdef __cplusplus
 extern "C" {
 #if 0 /* keep Emacsens' auto-indent happy */
@@ -49,6 +53,7 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 
@@ -57,20 +62,6 @@ extern "C" {
  */
 #define GNUNET_IDENTITY_VERSION 0x00000100
 
-enum GNUNET_IDENTITY_KeyType
-{
-  /**
-   * The identity type. The value is the same as the
-   * PKEY record type.
-   */
-  GNUNET_IDENTITY_TYPE_ECDSA = 65536,
-
-  /**
-   * EDDSA identity. The value is the same as the EDKEY
-   * record type.
-   */
-  GNUNET_IDENTITY_TYPE_EDDSA = 65556
-};
 
 /**
  * Handle to access the identity service.
@@ -82,88 +73,6 @@ struct GNUNET_IDENTITY_Handle;
  */
 struct GNUNET_IDENTITY_Ego;
 
-
-/**
- * A private key for an identity as per LSD0001.
- */
-struct GNUNET_IDENTITY_PrivateKey
-{
-  /**
-   * Type of public key.
-   * Defined by the GNS zone type value.
-   * In NBO.
-   */
-  uint32_t type;
-
-  union
-  {
-    /**
-     * An ECDSA identity key.
-     */
-    struct GNUNET_CRYPTO_EcdsaPrivateKey ecdsa_key;
-
-    /**
-     * AN EdDSA identtiy key
-     */
-    struct GNUNET_CRYPTO_EddsaPrivateKey eddsa_key;
-  };
-};
-
-
-/**
- * An identity key as per LSD0001.
- */
-struct GNUNET_IDENTITY_PublicKey
-{
-  /**
-   * Type of public key.
-   * Defined by the GNS zone type value.
-   * In NBO.
-   */
-  uint32_t type;
-
-  union
-  {
-    /**
-     * An ECDSA identity key.
-     */
-    struct GNUNET_CRYPTO_EcdsaPublicKey ecdsa_key;
-
-    /**
-     * AN EdDSA identtiy key
-     */
-    struct GNUNET_CRYPTO_EddsaPublicKey eddsa_key;
-  };
-};
-
-
-/**
- * An identity signature as per LSD0001.
- */
-struct GNUNET_IDENTITY_Signature
-{
-  /**
-   * Type of signature.
-   * Defined by the GNS zone type value.
-   * In NBO.
-   */
-  uint32_t type;
-
-  union
-  {
-    /**
-     * An ECDSA signature
-     */
-    struct GNUNET_CRYPTO_EcdsaSignature ecdsa_signature;
-
-    /**
-     * AN EdDSA signature
-     */
-    struct GNUNET_CRYPTO_EddsaSignature eddsa_signature;
-  };
-};
-
-
 /**
  * Handle for an operation with the identity service.
  */
@@ -176,7 +85,7 @@ struct GNUNET_IDENTITY_Operation;
  * @param ego the ego
  * @return associated ECC key, valid as long as the ego is valid
  */
-const struct GNUNET_IDENTITY_PrivateKey *
+const struct GNUNET_CRYPTO_PrivateKey *
 GNUNET_IDENTITY_ego_get_private_key (const struct GNUNET_IDENTITY_Ego *ego);
 
 
@@ -197,7 +106,17 @@ GNUNET_IDENTITY_ego_get_anonymous (void);
  */
 void
 GNUNET_IDENTITY_ego_get_public_key (struct GNUNET_IDENTITY_Ego *ego,
-                                    struct GNUNET_IDENTITY_PublicKey *pk);
+                                    struct GNUNET_CRYPTO_PublicKey *pk);
+
+
+/**
+ * Obtain the name associated with an ego.
+ *
+ * @param ego the ego
+ * @return associated name, valid as long as the ego is valid
+ */
+const char*
+GNUNET_IDENTITY_ego_get_name (const struct GNUNET_IDENTITY_Ego *ego);
 
 
 /**
@@ -275,11 +194,11 @@ GNUNET_IDENTITY_get (struct GNUNET_IDENTITY_Handle *id,
  * been completed.
  *
  * @param cls closure
- * @param emsg NULL on success, otherwise an error message
+ * @param ec the #GNUNET_ErrorCode
  */
 typedef void
 (*GNUNET_IDENTITY_Continuation) (void *cls,
-                                 const char *emsg);
+                                 enum GNUNET_ErrorCode ec);
 
 
 /**
@@ -315,13 +234,13 @@ GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle *h);
  *
  * @param cls closure
  * @param pk private key, NULL on error
- * @param emsg error message, NULL on success
+ * @param ec the #GNUNET_ErrorCode
  */
 typedef void
 (*GNUNET_IDENTITY_CreateContinuation) (
   void *cls,
-  const struct GNUNET_IDENTITY_PrivateKey *pk,
-  const char *emsg);
+  const struct GNUNET_CRYPTO_PrivateKey *pk,
+  enum GNUNET_ErrorCode ec);
 
 
 /**
@@ -338,8 +257,8 @@ typedef void
 struct GNUNET_IDENTITY_Operation *
 GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *id,
                         const char *name,
-                        const struct GNUNET_IDENTITY_PrivateKey *privkey,
-                        enum GNUNET_IDENTITY_KeyType ktype,
+                        const struct GNUNET_CRYPTO_PrivateKey *privkey,
+                        enum GNUNET_CRYPTO_KeyType ktype,
                         GNUNET_IDENTITY_CreateContinuation cont,
                         void *cont_cls);
 
@@ -390,319 +309,6 @@ void
 GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation *op);
 
 
-/**
- * Get the compacted length of a #GNUNET_IDENTITY_PublicKey.
- * Compacted means that it returns the minimum number of bytes this
- * key is long, as opposed to the union structure inside
- * #GNUNET_IDENTITY_PublicKey.
- * Useful for compact serializations.
- *
- * @param key the key.
- * @return -1 on error, else the compacted length of the key.
- */
-ssize_t
-GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key);
-
-
-/**
- * Reads a #GNUNET_IDENTITY_PublicKey from a compact buffer.
- * The buffer has to contain at least the compacted length of
- * a #GNUNET_IDENTITY_PublicKey in bytes.
- * If the buffer is too small, the function returns -1 as error.
- * If the buffer does not contain a valid key, it returns -2 as error.
- *
- * @param key the key
- * @param buffer the buffer
- * @param len the length of buffer
- * @return -1 or -2 on error, else the amount of bytes read from the buffer
- */
-ssize_t
-GNUNET_IDENTITY_read_key_from_buffer (struct GNUNET_IDENTITY_PublicKey *key,
-                                      const void*buffer,
-                                      size_t len);
-
-
-/**
- * Writes a #GNUNET_IDENTITY_PublicKey to a compact buffer.
- * The buffer requires space for at least the compacted length of
- * a #GNUNET_IDENTITY_PublicKey in bytes.
- * If the buffer is too small, the function returns -1 as error.
- * If the key is not valid, it returns -2 as error.
- *
- * @param key the key
- * @param buffer the buffer
- * @param len the length of buffer
- * @return -1 or -2 on error, else the amount of bytes written to the buffer
- */
-ssize_t
-GNUNET_IDENTITY_write_key_to_buffer (const struct
-                                     GNUNET_IDENTITY_PublicKey *key,
-                                     void*buffer,
-                                     size_t len);
-
-
-/**
- * Get the compacted length of a #GNUNET_IDENTITY_Signature.
- * Compacted means that it returns the minimum number of bytes this
- * signature is long, as opposed to the union structure inside
- * #GNUNET_IDENTITY_Signature.
- * Useful for compact serializations.
- *
- * @param sig the signature.
- * @return -1 on error, else the compacted length of the signature.
- */
-ssize_t
-GNUNET_IDENTITY_signature_get_length (const struct
-                                      GNUNET_IDENTITY_Signature *sig);
-
-
-/**
- * Reads a #GNUNET_IDENTITY_Signature from a compact buffer.
- * The buffer has to contain at least the compacted length of
- * a #GNUNET_IDENTITY_Signature in bytes.
- * If the buffer is too small, the function returns -1 as error.
- * If the buffer does not contain a valid key, it returns -2 as error.
- *
- * @param sig the signature
- * @param buffer the buffer
- * @param len the length of buffer
- * @return -1 or -2 on error, else the amount of bytes read from the buffer
- */
-ssize_t
-GNUNET_IDENTITY_read_signature_from_buffer (struct
-                                            GNUNET_IDENTITY_Signature *sig,
-                                            const void*buffer,
-                                            size_t len);
-
-
-/**
- * Writes a #GNUNET_IDENTITY_Signature to a compact buffer.
- * The buffer requires space for at least the compacted length of
- * a #GNUNET_IDENTITY_Signature in bytes.
- * If the buffer is too small, the function returns -1 as error.
- * If the key is not valid, it returns -2 as error.
- *
- * @param sig the signature
- * @param buffer the buffer
- * @param len the length of buffer
- * @return -1 or -2 on error, else the amount of bytes written to the buffer
- */
-ssize_t
-GNUNET_IDENTITY_write_signature_to_buffer (const struct
-                                           GNUNET_IDENTITY_Signature *sig,
-                                           void*buffer,
-                                           size_t len);
-
-
-/**
- * @brief Sign a given block.
- *
- * The @a purpose data is the beginning of the data of which the signature is
- * to be created. The `size` field in @a purpose must correctly indicate the
- * number of bytes of the data structure, including its header. If possible,
- * use #GNUNET_IDENTITY_sign() instead of this function.
- *
- * @param priv private key to use for the signing
- * @param purpose what to sign (size, purpose)
- * @param[out] sig where to write the signature
- * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
- */
-int
-GNUNET_IDENTITY_sign_ (const struct
-                       GNUNET_IDENTITY_PrivateKey *priv,
-                       const struct
-                       GNUNET_CRYPTO_EccSignaturePurpose *purpose,
-                       struct GNUNET_IDENTITY_Signature *sig);
-
-
-/**
- * @brief Sign a given block with #GNUNET_IDENTITY_PrivateKey.
- *
- * The @a ps data must be a fixed-size struct for which the signature is to be
- * created. The `size` field in @a ps->purpose must correctly indicate the
- * number of bytes of the data structure, including its header.
- *
- * @param priv private key to use for the signing
- * @param ps packed struct with what to sign, MUST begin with a purpose
- * @param[out] sig where to write the signature
- */
-#define GNUNET_IDENTITY_sign(priv,ps,sig) do {                \
-    /* check size is set correctly */                                     \
-    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));         \
-    /* check 'ps' begins with the purpose */                              \
-    GNUNET_static_assert (((void*) (ps)) ==                               \
-                          ((void*) &(ps)->purpose));                      \
-    GNUNET_assert (GNUNET_OK ==                                           \
-                   GNUNET_IDENTITY_sign_ (priv,               \
-                                          &(ps)->purpose,             \
-                                          sig));                      \
-} while (0)
-
-
-/**
- * @brief Verify a given signature.
- *
- * The @a validate data is the beginning of the data of which the signature
- * is to be verified. The `size` field in @a validate must correctly indicate
- * the number of bytes of the data structure, including its header.  If @a
- * purpose does not match the purpose given in @a validate (the latter must be
- * in big endian), signature verification fails.  If possible,
- * use #GNUNET_IDENTITY_signature_verify() instead of this function (only if @a validate
- * is not fixed-size, you must use this function directly).
- *
- * @param purpose what is the purpose that the signature should have?
- * @param validate block to validate (size, purpose, data)
- * @param sig signature that is being validated
- * @param pub public key of the signer
- * @returns #GNUNET_OK if ok, #GNUNET_SYSERR if invalid
- */
-int
-GNUNET_IDENTITY_signature_verify_ (uint32_t purpose,
-                                   const struct
-                                   GNUNET_CRYPTO_EccSignaturePurpose *validate,
-                                   const struct GNUNET_IDENTITY_Signature *sig,
-                                   const struct
-                                   GNUNET_IDENTITY_PublicKey *pub);
-
-
-/**
- * @brief Verify a given signature with #GNUNET_IDENTITY_PublicKey.
- *
- * The @a ps data must be a fixed-size struct for which the signature is to be
- * created. The `size` field in @a ps->purpose must correctly indicate the
- * number of bytes of the data structure, including its header.
- *
- * @param purp purpose of the signature, must match 'ps->purpose.purpose'
- *              (except in host byte order)
- * @param ps packed struct with what to sign, MUST begin with a purpose
- * @param sig where to read the signature from
- * @param pub public key to use for the verifying
- */
-#define GNUNET_IDENTITY_signature_verify(purp,ps,sig,pub) ({             \
-    /* check size is set correctly */                                     \
-    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));         \
-    /* check 'ps' begins with the purpose */                              \
-    GNUNET_static_assert (((void*) (ps)) ==                               \
-                          ((void*) &(ps)->purpose));                      \
-    GNUNET_IDENTITY_signature_verify_ (purp,                              \
-                                       &(ps)->purpose,                    \
-                                       sig,                               \
-                                       pub);                              \
-  })
-
-
-/**
- * Encrypt a block with #GNUNET_IDENTITY_PublicKey and derives a
- * #GNUNET_CRYPTO_EcdhePublicKey which is required for decryption
- * using ecdh to derive a symmetric key.
- *
- * @param block the block to encrypt
- * @param size the size of the @a block
- * @param pub public key to use for ecdh
- * @param ecc where to write the ecc public key
- * @param result the output parameter in which to store the encrypted result
- *               can be the same or overlap with @c block
- * @returns the size of the encrypted block, -1 for errors.
- *          Due to the use of CFB and therefore an effective stream cipher,
- *          this size should be the same as @c len.
- */
-ssize_t
-GNUNET_IDENTITY_encrypt (const void *block,
-                         size_t size,
-                         const struct GNUNET_IDENTITY_PublicKey *pub,
-                         struct GNUNET_CRYPTO_EcdhePublicKey *ecc,
-                         void *result);
-
-
-/**
- * Decrypt a given block with #GNUNET_IDENTITY_PrivateKey and a given
- * #GNUNET_CRYPTO_EcdhePublicKey using ecdh to derive a symmetric key.
- *
- * @param block the data to decrypt, encoded as returned by encrypt
- * @param size the size of the @a block to decrypt
- * @param priv private key to use for ecdh
- * @param ecc the ecc public key
- * @param result address to store the result at
- *               can be the same or overlap with @c block
- * @return -1 on failure, size of decrypted block on success.
- *         Due to the use of CFB and therefore an effective stream cipher,
- *         this size should be the same as @c size.
- */
-ssize_t
-GNUNET_IDENTITY_decrypt (const void *block,
-                         size_t size,
-                         const struct
-                         GNUNET_IDENTITY_PrivateKey *priv,
-                         const struct
-                         GNUNET_CRYPTO_EcdhePublicKey *ecc,
-                         void *result);
-
-
-/**
- * Creates a (Base32) string representation of the public key.
- * The resulting string encodes a compacted representation of the key.
- * See also #GNUNET_IDENTITY_key_get_length.
- *
- * @param key the key.
- * @return the string representation of the key, or NULL on error.
- */
-char *
-GNUNET_IDENTITY_public_key_to_string (const struct
-                                      GNUNET_IDENTITY_PublicKey *key);
-
-
-/**
- * Creates a (Base32) string representation of the private key.
- * The resulting string encodes a compacted representation of the key.
- * See also #GNUNET_IDENTITY_key_get_length.
- *
- * @param key the key.
- * @return the string representation of the key, or NULL on error.
- */
-char *
-GNUNET_IDENTITY_private_key_to_string (const struct
-                                       GNUNET_IDENTITY_PrivateKey *key);
-
-
-/**
- * Parses a (Base32) string representation of the public key.
- * See also #GNUNET_IDENTITY_public_key_to_string.
- *
- * @param str the encoded key.
- * @param key where to write the key.
- * @return GNUNET_SYSERR on error.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_IDENTITY_public_key_from_string (const char*str,
-                                        struct GNUNET_IDENTITY_PublicKey *key);
-
-
-/**
- * Parses a (Base32) string representation of the private key.
- * See also #GNUNET_IDENTITY_private_key_to_string.
- *
- * @param str the encoded key.
- * @param key where to write the key.
- * @return GNUNET_SYSERR on error.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_IDENTITY_private_key_from_string (const char*str,
-                                         struct GNUNET_IDENTITY_PrivateKey *key);
-
-
-/**
- * Retrieves the public key representation of a private key.
- *
- * @param privkey the private key.
- * @param key the public key result.
- * @return GNUNET_SYSERR on error.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_IDENTITY_key_get_public (const struct
-                                GNUNET_IDENTITY_PrivateKey *privkey,
-                                struct GNUNET_IDENTITY_PublicKey *key);
-
-
 /* ************* convenience API to lookup an ego ***************** */
 
 /**
@@ -755,7 +361,7 @@ GNUNET_IDENTITY_ego_lookup_cancel (struct GNUNET_IDENTITY_EgoLookup *el);
 typedef void
 (*GNUNET_IDENTITY_EgoSuffixCallback) (
   void *cls,
-  const struct GNUNET_IDENTITY_PrivateKey *priv,
+  const struct GNUNET_CRYPTO_PrivateKey *priv,
   const char *ego_name);
 
 
@@ -778,11 +384,11 @@ struct GNUNET_IDENTITY_EgoSuffixLookup;
  * @return handle to abort the operation
  */
 struct GNUNET_IDENTITY_EgoSuffixLookup *
-GNUNET_IDENTITY_ego_lookup_by_suffix (const struct
-                                      GNUNET_CONFIGURATION_Handle *cfg,
-                                      const char *suffix,
-                                      GNUNET_IDENTITY_EgoSuffixCallback cb,
-                                      void *cb_cls);
+GNUNET_IDENTITY_ego_lookup_by_suffix (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *suffix,
+  GNUNET_IDENTITY_EgoSuffixCallback cb,
+  void *cb_cls);
 
 
 /**
@@ -807,4 +413,6 @@ GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (
 
 /** @} */ /* end of group identity */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_identity_service.h */
diff --git a/src/include/gnunet_json_lib.h b/src/include/gnunet_json_lib.h
index 5ef4592e5..5f4d5134d 100644
--- a/src/include/gnunet_json_lib.h
+++ b/src/include/gnunet_json_lib.h
@@ -27,6 +27,7 @@
 #ifndef GNUNET_JSON_LIB_H
 #define GNUNET_JSON_LIB_H
 
+
 #include "gnunet_util_lib.h"
 #include <jansson.h>
 #include <microhttpd.h>
@@ -48,10 +49,10 @@ struct GNUNET_JSON_Specification;
  * @return #GNUNET_SYSERR on error,
  *         #GNUNET_OK on success
  */
-typedef int
-(*GNUNET_JSON_Parser) (void *cls,
-                       json_t *root,
-                       struct GNUNET_JSON_Specification *spec);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_JSON_Parser)(void *cls,
+                      json_t *root,
+                      struct GNUNET_JSON_Specification *spec);
 
 
 /**
@@ -97,9 +98,10 @@ struct GNUNET_JSON_Specification
   void *ptr;
 
   /**
-   * Number of bytes available in @e ptr.
+   * Pointer to set to true if this argument is
+   * indeed missing. Can be NULL.
    */
-  size_t ptr_size;
+  bool *missing;
 
   /**
    * Where should we store the final size of @e ptr.
@@ -107,6 +109,11 @@ struct GNUNET_JSON_Specification
   size_t *size_ptr;
 
   /**
+   * Number of bytes available in @e ptr.
+   */
+  size_t ptr_size;
+
+  /**
    * Set to true if this component is optional.
    */
   bool is_optional;
@@ -123,7 +130,7 @@ struct GNUNET_JSON_Specification
  * @param root the JSON node to start the navigation at.
  * @param spec parse specification array
  * @param[out] error_json_name which JSON field was problematic
- * @param[out] which index into @a spec did we encounter an error
+ * @param[out] error_line which index into @a spec did we encounter an error
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
 enum GNUNET_GenericReturnValue
@@ -135,7 +142,13 @@ GNUNET_JSON_parse (const json_t *root,
 
 /**
  * Frees all elements allocated during a #GNUNET_JSON_parse()
- * operation.
+ * operation.  Convenience function to be called if cleaning
+ * up all heap-allocated data from a #GNUNET_JSON_parse() is
+ * desired. The function does not have to be called if no data
+ * was heap-allocated (e.g. only integers, strings and fixed-sized
+ * data was used), or if the application calls the respective
+ * code to free the heap (not always #GNUNET_free(), depends
+ * on the data type!) on the returned heap-allocated data itself.
  *
  * @param spec specification of the parse operation
  */
@@ -157,10 +170,12 @@ GNUNET_JSON_spec_end (void);
  * Set the "optional" flag for a parser specification entry.
  *
  * @param spec specification to modify
+ * @param[out] missing set to true if the argument is missing, NULL is allowed.
  * @return spec copy of @a spec with optional bit set
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_mark_optional (struct GNUNET_JSON_Specification spec);
+GNUNET_JSON_spec_mark_optional (struct GNUNET_JSON_Specification spec,
+                                bool *missing);
 
 
 /**
@@ -189,6 +204,29 @@ GNUNET_JSON_spec_fixed (const char *name,
 
 
 /**
+ * Variable size object (in network byte order, encoded using base64 encoding).
+ *
+ * @param name name of the JSON field
+ * @param[out] obj pointer where to write the data, must have @a size bytes
+ * @param size number of bytes expected in @a obj
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_fixed64 (const char *name,
+                          void *obj,
+                          size_t size);
+
+
+/**
+ * Fixed size object (in network byte order, encoded using base64 encoding).
+ *
+ * @param name name of the JSON field
+ * @param obj pointer where to write the data (type of `*obj` will determine size)
+ */
+#define GNUNET_JSON_spec_fixed64_auto(name, obj) \
+  GNUNET_JSON_spec_fixed (name, obj, sizeof(*obj))
+
+
+/**
  * Variable size object (in network byte order, encoded using
  * Crockford Base32hex encoding).
  *
@@ -214,7 +252,8 @@ GNUNET_JSON_spec_string (const char *name,
 
 
 /**
- * JSON object.
+ * JSON object or array. Reference counter is
+ * incremented.
  *
  * @param name name of the JSON field
  * @param[out] jsonp where to store the JSON found under @a name
@@ -225,6 +264,28 @@ GNUNET_JSON_spec_json (const char *name,
 
 
 /**
+ * JSON object, reference counter not incremented.
+ *
+ * @param name name of the JSON field
+ * @param[out] jsonp where to store the JSON found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_object_const (const char *name,
+                               const json_t **jsonp);
+
+
+/**
+ * JSON array, reference counter not incremented.
+ *
+ * @param name name of the JSON field
+ * @param[out] jsonp where to store the JSON found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_array_const (const char *name,
+                              const json_t **jsonp);
+
+
+/**
  * boolean.
  *
  * @param name name of the JSON field
@@ -236,6 +297,17 @@ GNUNET_JSON_spec_bool (const char *name,
 
 
 /**
+ * double.
+ *
+ * @param name name of the JSON field
+ * @param[out] f where to store the double found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_double (const char *name,
+                         double *f);
+
+
+/**
  * 8-bit integer.
  *
  * @param name name of the JSON field
@@ -304,25 +376,25 @@ GNUNET_JSON_spec_boolean (const char *name,
 /* ************ GNUnet-specific parser specifications ******************* */
 
 /**
- * Absolute time.
+ * Timestamp.
  *
  * @param name name of the JSON field
- * @param[out] at where to store the absolute time found under @a name
+ * @param[out] t at where to store the absolute time found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time (const char *name,
-                                struct GNUNET_TIME_Absolute *at);
+GNUNET_JSON_spec_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp *t);
 
 
 /**
- * Absolute time in network byte order.
+ * Timestamp in network byte order.
  *
  * @param name name of the JSON field
- * @param[out] at where to store the absolute time found under @a name
+ * @param[out] tn where to store the absolute time found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time_nbo (const char *name,
-                                    struct GNUNET_TIME_AbsoluteNBO *at);
+GNUNET_JSON_spec_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO *tn);
 
 
 /**
@@ -358,6 +430,39 @@ GNUNET_JSON_spec_rsa_signature (const char *name,
                                 struct GNUNET_CRYPTO_RsaSignature **sig);
 
 
+/**
+ * Specification for parsing a blinded message.
+ *
+ * @param name name of the JSON field
+ * @param sig where to store the blinded message found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_blinded_message (const char *name,
+                                  struct GNUNET_CRYPTO_BlindedMessage **msg);
+
+
+/**
+ * Specification for parsing a blinded signature.
+ *
+ * @param name name of the JSON field
+ * @param sig where to store the blinded signature found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_blinded_signature (const char *field,
+                                    struct GNUNET_CRYPTO_BlindedSignature **b_sig);
+
+
+/**
+ * Specification for parsing an unblinded signature.
+ *
+ * @param name name of the JSON field
+ * @param sig where to store the unblinded signature found under @a name
+ */
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_unblinded_signature (const char *field,
+                                     struct GNUNET_CRYPTO_UnblindedSignature **ub_sig);
+
+
 /* ****************** Generic generator interface ******************* */
 
 
@@ -370,7 +475,21 @@ GNUNET_JSON_spec_rsa_signature (const char *name,
  * @return json string that encodes @a data
  */
 json_t *
-GNUNET_JSON_from_data (const void *data, size_t size);
+GNUNET_JSON_from_data (const void *data,
+                       size_t size);
+
+
+/**
+ * Convert binary data to a JSON string with base64
+ * encoding.
+ *
+ * @param data binary data
+ * @param size size of @a data in bytes
+ * @return json string that encodes @a data
+ */
+json_t *
+GNUNET_JSON_from_data64 (const void *data,
+                         size_t size);
 
 
 /**
@@ -385,23 +504,34 @@ GNUNET_JSON_from_data (const void *data, size_t size);
 
 
 /**
- * Convert absolute timestamp to a json string.
+ * Convert binary data to a JSON string with base64
+ * encoding.
+ *
+ * @param ptr binary data, sizeof (*ptr) must yield correct size
+ * @return json string that encodes @a data
+ */
+#define GNUNET_JSON_from_data64_auto(ptr) \
+  GNUNET_JSON_from_data64 (ptr, sizeof(*ptr))
+
+
+/**
+ * Convert timestamp to a json string.
  *
  * @param stamp the time stamp
  * @return a json string with the timestamp in @a stamp
  */
 json_t *
-GNUNET_JSON_from_time_abs (struct GNUNET_TIME_Absolute stamp);
+GNUNET_JSON_from_timestamp (struct GNUNET_TIME_Timestamp stamp);
 
 
 /**
- * Convert absolute timestamp to a json string.
+ * Convert timestamp to a json string.
  *
  * @param stamp the time stamp
  * @return a json string with the timestamp in @a stamp
  */
 json_t *
-GNUNET_JSON_from_time_abs_nbo (struct GNUNET_TIME_AbsoluteNBO stamp);
+GNUNET_JSON_from_timestamp_nbo (struct GNUNET_TIME_TimestampNBO stamp);
 
 
 /**
@@ -624,6 +754,19 @@ GNUNET_JSON_pack_bool (const char *name,
 
 /**
  * Generate packer instruction for a JSON field of type
+ * double.
+ *
+ * @param name name of the field to add to the object
+ * @param f double value
+ * @return json pack specification
+ */
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_double (const char *name,
+                         double f);
+
+
+/**
+ * Generate packer instruction for a JSON field of type
  * string.
  *
  * @param name name of the field to add to the object
@@ -747,30 +890,61 @@ GNUNET_JSON_pack_data_varsize (const char *name,
 
 /**
  * Generate packer instruction for a JSON field of type
- * absolute time.
+ * variable size binary blob.
+ * Use base64-encoding, instead of the more common
+ * Crockford base32-encoding.
+ *
+ * @param name name of the field to add to the object
+ * @param blob binary data to pack
+ * @param blob_size number of bytes in @a blob
+ * @return json pack specification
+ */
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_data64_varsize (const char *name,
+                                 const void *blob,
+                                 size_t blob_size);
+
+
+/**
+ * Generate packer instruction for a JSON field where the
+ * size is automatically determined from the argument.
+ * Use base64-encoding, instead of the more common
+ * Crockford base32-encoding.
+ *
+ * @param name name of the field to add to the object
+ * @param blob data to pack, must not be an array
+ * @return json pack specification
+ */
+#define GNUNET_JSON_pack_data64_auto(name,blob) \
+  GNUNET_JSON_pack_data64_varsize (name, blob, sizeof (*blob))
+
+
+/**
+ * Generate packer instruction for a JSON field of type
+ * timestamp.
  *
  * @param name name of the field to add to the object
- * @param at absolute time to pack, a value of 0 is only
+ * @param at timestamp pack, a value of 0 is only
  *        allowed with #GNUNET_JSON_pack_allow_null()!
  * @return json pack specification
  */
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs (const char *name,
-                           struct GNUNET_TIME_Absolute at);
+GNUNET_JSON_pack_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp at);
 
 
 /**
  * Generate packer instruction for a JSON field of type
- * absolute time in network byte order.
+ * timestamp in network byte order.
  *
  * @param name name of the field to add to the object
- * @param at absolute time to pack, a value of 0 is only
+ * @param at timestamp to pack, a value of 0 is only
  *        allowed with #GNUNET_JSON_pack_allow_null()!
  * @return json pack specification
  */
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs_nbo (const char *name,
-                               struct GNUNET_TIME_AbsoluteNBO at);
+GNUNET_JSON_pack_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO at);
 
 
 /**
@@ -825,6 +999,44 @@ GNUNET_JSON_pack_rsa_signature (const char *name,
                                 const struct GNUNET_CRYPTO_RsaSignature *sig);
 
 
+/**
+ * Generate packer instruction for a JSON field of type
+ * unblinded signature.
+ *
+ * @param name name of the field to add to the object
+ * @param sig unblinded signature
+ * @return json pack specification
+ */
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_unblinded_signature (const char *name,
+                                      const struct GNUNET_CRYPTO_UnblindedSignature *sig);
+
+
+/**
+ * Generate packer instruction for a JSON field of type
+ * blinded message.
+ *
+ * @param name name of the field to add to the object
+ * @param msg blinded message
+ * @return json pack specification
+ */
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_blinded_message (const char *name,
+                                  const struct GNUNET_CRYPTO_BlindedMessage *msg);
+
+
+/**
+ * Generate packer instruction for a JSON field of type
+ * blinded signature.
+ *
+ * @param name name of the field to add to the object
+ * @param sig blinded signature
+ * @return json pack specification
+ */
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_blinded_sig (const char *name,
+                              const struct GNUNET_CRYPTO_BlindedSignature *sig);
+
 #endif
 
 /* end of gnunet_json_lib.h */
diff --git a/src/include/gnunet_load_lib.h b/src/include/gnunet_load_lib.h
index ef596807a..56cacfbbb 100644
--- a/src/include/gnunet_load_lib.h
+++ b/src/include/gnunet_load_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -40,6 +43,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 
@@ -124,4 +128,6 @@ GNUNET_LOAD_update (struct GNUNET_LOAD_Value *load, uint64_t data);
 
 /** @} */  /* end of group */
 
+/** @} */  /* end of group addition to libgnunetutil */
+
 /* end of gnunet_load_lib.h */
diff --git a/src/include/gnunet_messenger_service.h b/src/include/gnunet_messenger_service.h
index 96d48b411..3f039f944 100644
--- a/src/include/gnunet_messenger_service.h
+++ b/src/include/gnunet_messenger_service.h
@@ -1,6 +1,6 @@
 /*
    This file is part of GNUnet.
-   Copyright (C) 2020--2021 GNUnet e.V.
+   Copyright (C) 2020--2024 GNUnet e.V.
 
    GNUnet is free software: you can redistribute it and/or modify it
    under the terms of the GNU Affero General Public License as published
@@ -39,21 +39,14 @@ extern "C" {
 #endif
 #endif
 
-#include "platform.h"
-#include "gnunet_configuration_lib.h"
-#include "gnunet_crypto_lib.h"
-#include "gnunet_identity_service.h"
-#include "gnunet_mq_lib.h"
-#include "gnunet_protocols.h"
-#include "gnunet_scheduler_lib.h"
-#include "gnunet_time_lib.h"
+#include "gnunet_util_lib.h"
 
 /**
  * Version number of GNUnet Messenger API.
  *
- * Current version of the Messenger: 0.1
+ * Current version of the Messenger: 0.4
  */
-#define GNUNET_MESSENGER_VERSION 0x00000001
+#define GNUNET_MESSENGER_VERSION 0x00000004
 
 /**
  * Identifier of GNUnet MESSENGER Service.
@@ -91,7 +84,28 @@ struct GNUNET_MESSENGER_RoomEntryRecord
   /**
    * The hash identifying the port of the room.
    */
-  struct GNUNET_HashCode key;
+  struct GNUNET_HashCode key GNUNET_PACKED;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+  GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * A room details record specifies a custom name for a given room and
+ * some additional space for flags.
+ */
+struct GNUNET_MESSENGER_RoomDetailsRecord
+{
+  /**
+   * The custom name for the room.
+   */
+  char name[256];
+
+  /**
+   * The flags of the room.
+   */
+  uint32_t flags;
 };
 
 GNUNET_NETWORK_STRUCT_END
@@ -177,6 +191,26 @@ enum GNUNET_MESSENGER_MessageKind
   GNUNET_MESSENGER_KIND_DELETE = 15,
 
   /**
+   * The connection kind. The message contains a #GNUNET_MESSENGER_MessageConnection body.
+   */
+  GNUNET_MESSENGER_KIND_CONNECTION = 16,
+
+  /**
+   * The ticket kind. The message contains a #GNUNET_MESSENGER_MessageTicket body.
+   */
+  GNUNET_MESSENGER_KIND_TICKET = 17,
+
+  /**
+   * The transcript kind. The message contains a #GNUNET_MESSENGER_MessageTranscript body.
+   */
+  GNUNET_MESSENGER_KIND_TRANSCRIPT = 18,
+
+  /**
+   * The tag kind. The message contains a #GNUNET_MESSENGER_MessageTag body.
+   */
+  GNUNET_MESSENGER_KIND_TAG = 19,
+
+  /**
    * The unknown kind. The message contains an unknown body.
    */
   GNUNET_MESSENGER_KIND_UNKNOWN = 0
@@ -204,7 +238,7 @@ struct GNUNET_MESSENGER_MessageHeader
   /**
    * The signature of the senders private key.
    */
-  struct GNUNET_IDENTITY_Signature signature;
+  struct GNUNET_CRYPTO_Signature signature;
 
   /**
    * The timestamp of the message.
@@ -236,11 +270,6 @@ struct GNUNET_MESSENGER_MessageHeader
 struct GNUNET_MESSENGER_MessageInfo
 {
   /**
-   * The senders key to verify its signatures.
-   */
-  struct GNUNET_IDENTITY_PublicKey host_key;
-
-  /**
    * The version of GNUnet Messenger API.
    *
    * The sixteen lower bits represent the lower version number while the sixteen higher bits
@@ -261,7 +290,7 @@ struct GNUNET_MESSENGER_MessageJoin
   /**
    * The senders public key to verify its signatures.
    */
-  struct GNUNET_IDENTITY_PublicKey key;
+  struct GNUNET_CRYPTO_PublicKey key;
 };
 
 /**
@@ -299,7 +328,7 @@ struct GNUNET_MESSENGER_MessageKey
   /**
    * The new public key which replaces the current senders public key.
    */
-  struct GNUNET_IDENTITY_PublicKey key;
+  struct GNUNET_CRYPTO_PublicKey key;
 };
 
 /**
@@ -478,6 +507,87 @@ struct GNUNET_MESSENGER_MessageDelete
 };
 
 /**
+ * A connection message body
+ * This allows to tell others about connection information about a peer.
+ *
+ * Message-body-size: 8 bytes
+ */
+struct GNUNET_MESSENGER_MessageConnection
+{
+  /**
+   * The amount of connections of a peer.
+   */
+  uint32_t amount;
+
+  /**
+   * The flags about the connections of a peer.
+   */
+  uint32_t flags;
+};
+
+/**
+ * A ticket message body
+ * This allows to exchange ticket identifiers with an audience.
+ *
+ * Message-body-size: 0+ bytes
+ */
+struct GNUNET_MESSENGER_MessageTicket
+{
+  /**
+   * The identifier of a ticket.
+   */
+  char *identifier;
+};
+
+/**
+ * A transcript message body
+ * This allows reading the content of a sent private message.
+ *
+ * Message-body-size: 68+
+ */
+struct GNUNET_MESSENGER_MessageTranscript
+{
+  /**
+   * The hash of the original message.
+   */
+  struct GNUNET_HashCode hash;
+
+  /**
+   * The key from the recipient of the original message.
+   */
+  struct GNUNET_CRYPTO_PublicKey key;
+
+  /**
+   * The length of the transcribed message.
+   */
+  uint16_t length;
+
+  /**
+   * The data of the transcribed message.
+   */
+  char *data;
+};
+
+/**
+ * A tag message body
+ * This allows tagging a message with a custom tag.
+ *
+ * Message-body-size: 32+
+ */
+struct GNUNET_MESSENGER_MessageTag
+{
+  /**
+   * The hash of the message to tag.
+   */
+  struct GNUNET_HashCode hash;
+
+  /**
+   * The custom tag.
+   */
+  char *tag;
+};
+
+/**
  * The unified body of a #GNUNET_MESSENGER_Message.
  */
 struct GNUNET_MESSENGER_MessageBody
@@ -499,6 +609,10 @@ struct GNUNET_MESSENGER_MessageBody
     struct GNUNET_MESSENGER_MessageFile file;
     struct GNUNET_MESSENGER_MessagePrivate privacy;
     struct GNUNET_MESSENGER_MessageDelete deletion;
+    struct GNUNET_MESSENGER_MessageConnection connection;
+    struct GNUNET_MESSENGER_MessageTicket ticket;
+    struct GNUNET_MESSENGER_MessageTranscript transcript;
+    struct GNUNET_MESSENGER_MessageTag tag;
   };
 };
 
@@ -519,7 +633,7 @@ struct GNUNET_MESSENGER_Message
 };
 
 /**
- * Enum for the different supported flags used by message handling
+ * Enum for the different supported flags used by message handling.
  * Compatible flags can be OR'ed together.
  */
 enum GNUNET_MESSENGER_MessageFlags
@@ -538,18 +652,44 @@ enum GNUNET_MESSENGER_MessageFlags
    * The private flag. The flag indicates that the message was privately encrypted.
    */
   GNUNET_MESSENGER_FLAG_PRIVATE = 2,
+
+  /**
+   * The peer flag. The flag indicates that the message was sent by a peer and not a member.
+   */
+  GNUNET_MESSENGER_FLAG_PEER = 4,
+
+  /**
+   * The recent flag. The flag indicates that the message was recently handled by the service.
+   */
+  GNUNET_MESSENGER_FLAG_RECENT = 8,
+
+  /**
+   * The update flag. The flag indicates that the message was updated by the client.
+   */
+  GNUNET_MESSENGER_FLAG_UPDATE = 16,
+
+  /**
+   * The delete flag. The flag indicates that the message was deleted by the service.
+   */
+  GNUNET_MESSENGER_FLAG_DELETE = 32,
 };
 
 /**
- * Method called whenever the EGO of a <i>handle</i> changes or if the first connection fails
- * to load a valid EGO and the anonymous key pair will be used instead.
- *
- * @param[in/out] cls Closure from #GNUNET_MESSENGER_connect
- * @param[in/out] handle Messenger handle
+ * Enum for the different supported flags used to specify connection handling.
+ * Compatible flags can be OR'ed together.
  */
-typedef void
-(*GNUNET_MESSENGER_IdentityCallback) (void *cls,
-                                      struct GNUNET_MESSENGER_Handle *handle);
+enum GNUNET_MESSENGER_ConnectionFlags
+{
+  /**
+   * The none flag. The flag indicates that the connection is not affected by any modifications.
+   */
+  GNUNET_MESSENGER_FLAG_CONNECTION_NONE = 0,/**< GNUNET_MESSENGER_FLAG_CONNECTION_NONE */
+
+  /**
+   * The auto flag. The flag indicates that a peer will automatically handle routing.
+   */
+  GNUNET_MESSENGER_FLAG_CONNECTION_AUTO = 1,/**< GNUNET_MESSENGER_FLAG_CONNECTION_AUTO */
+};
 
 /**
  * Method called whenever a message is sent or received from a <i>room</i>.
@@ -560,6 +700,7 @@ typedef void
  * @param[in/out] cls Closure from #GNUNET_MESSENGER_connect
  * @param[in] room Room handle
  * @param[in] sender Sender of message
+ * @param[in] recipient Recipient of message
  * @param[in] message Newly received or sent message
  * @param[in] hash Hash identifying the message
  * @param[in] flags Flags of the message
@@ -567,8 +708,12 @@ typedef void
 typedef void
 (*GNUNET_MESSENGER_MessageCallback) (void *cls,
                                      struct GNUNET_MESSENGER_Room *room,
-                                     const struct GNUNET_MESSENGER_Contact *sender,
-                                     const struct GNUNET_MESSENGER_Message *message,
+                                     const struct
+                                     GNUNET_MESSENGER_Contact *sender,
+                                     const struct
+                                     GNUNET_MESSENGER_Contact *recipient,
+                                     const struct
+                                     GNUNET_MESSENGER_Message *message,
                                      const struct GNUNET_HashCode *hash,
                                      enum GNUNET_MESSENGER_MessageFlags flags);
 
@@ -580,49 +725,34 @@ typedef void
  * @param[in] room Room handle
  * @param[in] contact Contact handle
  */
-typedef int
-(*GNUNET_MESSENGER_MemberCallback) (void* cls,
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_MESSENGER_MemberCallback) (void *cls,
                                     struct GNUNET_MESSENGER_Room *room,
-                                    const struct GNUNET_MESSENGER_Contact *contact);
+                                    const struct
+                                    GNUNET_MESSENGER_Contact *contact);
 
 /**
- * Set up a handle for the messenger related functions and connects to all necessary services. It will look up the ego
- * key identified by its <i>name</i> and use it for signing all messages from the handle.
+ * Set up a handle for the messenger related functions and connects to all necessary services. It will use the
+ * a custom name in combination of a private key provided for signing all messages from the handle.
  *
  * @param[in] cfg Configuration to use
- * @param[in] name Name to look up an ego or NULL to stay anonymous
- * @param[in] identity_callback Function called when the EGO of the handle changes
- * @param[in/out] identity_cls Closure for the <i>identity_callback</i> handler
+ * @param[in] name Name or NULL
+ * @param[in] key Private key or NULL to stay anonymous
  * @param[in] msg_callback Function called when a new message is sent or received
- * @param[in/out] msg_cls Closure for the <i>msg_callback</i> handler
+ * @param[in,out] msg_cls Closure for the <i>msg_callback</i> handler
  * @return Messenger handle to use, NULL on error
  */
 struct GNUNET_MESSENGER_Handle*
 GNUNET_MESSENGER_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
                           const char *name,
-                          GNUNET_MESSENGER_IdentityCallback identity_callback,
-                          void *identity_cls,
+                          const struct GNUNET_CRYPTO_PrivateKey *key,
                           GNUNET_MESSENGER_MessageCallback msg_callback,
                           void *msg_cls);
 
 /**
- * Update a handle of the messenger to use a different ego key and replace the old one with a newly generated one. All
- * participated rooms get informed about the key renewal. The handle requires a set name for this function to work and
- * it needs to be unused by other egos.
- *
- * Keep in mind that this will fully delete the old ego key (if any is used) even if any other service wants to use it
- * as default.
- *
- * @param[in/out] handle Messenger handle to use
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
- */
-int
-GNUNET_MESSENGER_update (struct GNUNET_MESSENGER_Handle *handle);
-
-/**
  * Disconnect all of the messengers used services and clears up its used memory.
  *
- * @param[in/out] handle Messenger handle to use
+ * @param[in,out] handle Messenger handle to use
  */
 void
 GNUNET_MESSENGER_disconnect (struct GNUNET_MESSENGER_Handle *handle);
@@ -637,15 +767,14 @@ const char*
 GNUNET_MESSENGER_get_name (const struct GNUNET_MESSENGER_Handle *handle);
 
 /**
- * Set the name for the messenger. This will rename the currently used ego and move all stored files related to the current
- * name to its new directory. If anything fails during this process the function returns #GNUNET_NO and the name for
- * the messenger won't change as specified.
+ * Set the name for the messenger handle and sends messages renaming your contact in currently
+ * open rooms.
  *
- * @param[in/out] handle Messenger handle to use
+ * @param[in,out] handle Messenger handle to use
  * @param[in] name Name for the messenger to change to
  * @return #GNUNET_YES on success, #GNUNET_NO on failure and #GNUNET_SYSERR if <i>handle</i> is NULL
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_MESSENGER_set_name (struct GNUNET_MESSENGER_Handle *handle,
                            const char *name);
 
@@ -653,12 +782,25 @@ GNUNET_MESSENGER_set_name (struct GNUNET_MESSENGER_Handle *handle,
  * Get the public key used by the messenger or NULL if the anonymous key was used.
  *
  * @param[in] handle Messenger handle to use
- * @return Used ego's public key or NULL
+ * @return Used public key or NULL
  */
-const struct GNUNET_IDENTITY_PublicKey*
+const struct GNUNET_CRYPTO_PublicKey*
 GNUNET_MESSENGER_get_key (const struct GNUNET_MESSENGER_Handle *handle);
 
 /**
+ * Set the private key used by the messenger or NULL if the anonymous key should be
+ * used instead. The currently used key will be replaced and the change will get signed
+ * accordingly to be verified by all contacts.
+ *
+ * @param[in,out] handle Messenger handle to use
+ * @param[in] key Private key to change to or NULL
+ * @return #GNUNET_YES on success, #GNUNET_NO on failure and #GNUNET_SYSERR if <i>handle</i> is NULL
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_MESSENGER_set_key (struct GNUNET_MESSENGER_Handle *handle,
+                          const struct GNUNET_CRYPTO_PrivateKey *key);
+
+/**
  * Open a room to send and receive messages. The room will use the specified <i>key</i> as port for the underlying cadet
  * service. Opening a room results in opening the port for incoming connections as possible <b>door</b>.
  *
@@ -670,7 +812,7 @@ GNUNET_MESSENGER_get_key (const struct GNUNET_MESSENGER_Handle *handle);
  *
  * ( All <b>doors</b> form a ring structured network to shorten the latency sending and receiving messages. )
  *
- * @param[in/out] handle Messenger handle to use
+ * @param[in,out] handle Messenger handle to use
  * @param[in] key Hash identifying the port
  * @return Room handle, NULL on error
  */
@@ -691,7 +833,7 @@ GNUNET_MESSENGER_open_room (struct GNUNET_MESSENGER_Handle *handle,
  *
  * ( All <b>doors</b> form a ring structured network to shorten the latency sending and receiving messages. )
  *
- * @param[in/out] handle Messenger handle to use
+ * @param[in,out] handle Messenger handle to use
  * @param[in] door Peer identity of an open <b>door</b>
  * @param[in] key Hash identifying the port
  * @return Room handle, NULL on error
@@ -708,7 +850,7 @@ GNUNET_MESSENGER_enter_room (struct GNUNET_MESSENGER_Handle *handle,
  * ( After a member closes a <b>door</b>, all members entered through that specific <b>door</b> have to use another one
  * or open the room on their own. )
  *
- * @param[in/out] room Room handle
+ * @param[in,out] room Room handle
  */
 void
 GNUNET_MESSENGER_close_room (struct GNUNET_MESSENGER_Room *room);
@@ -753,25 +895,51 @@ GNUNET_MESSENGER_get_sender (const struct GNUNET_MESSENGER_Room *room,
                              const struct GNUNET_HashCode *hash);
 
 /**
+ * Get the contact of a member in a <i>room</i> which has been targeted as recipient of a specific message identified
+ * with a given <i>hash</i>.
+ *
+ * Notice that contacts are independent of rooms but will be removed if all rooms containing these contacts get closed.
+ *
+ * @param[in] room Room handle
+ * @param[in] hash Hash identifying a message
+ * @return Contact handle, NULL otherwise
+ */
+const struct GNUNET_MESSENGER_Contact*
+GNUNET_MESSENGER_get_recipient (const struct GNUNET_MESSENGER_Room *room,
+                                const struct GNUNET_HashCode *hash);
+
+/**
  * Get the name used by the <i>contact</i>.
  *
  * @param[in] contact Contact handle
  * @return Name of <i>contact</i> or NULL
  */
 const char*
-GNUNET_MESSENGER_contact_get_name (const struct GNUNET_MESSENGER_Contact *contact);
+GNUNET_MESSENGER_contact_get_name (const struct
+                                   GNUNET_MESSENGER_Contact *contact);
 
 /**
  * Get the public key used by the <i>contact</i> or NULL if the anonymous key was used.
  *
  * @param[in] contact Contact handle
- * @return Public key of the ego used by <i>contact</i> or NULL
+ * @return Public key used by <i>contact</i> or NULL
  */
-const struct GNUNET_IDENTITY_PublicKey*
-GNUNET_MESSENGER_contact_get_key (const struct GNUNET_MESSENGER_Contact *contact);
+const struct GNUNET_CRYPTO_PublicKey*
+GNUNET_MESSENGER_contact_get_key (const struct
+                                  GNUNET_MESSENGER_Contact *contact);
 
 /**
- * Send a <i>message</i> into a </i>room</i>. If you opened the <i>room</i> all entered members will receive the
+ * Get the locally unique id of the <i>contact</i>.
+ *
+ * @param[in] contact Contact handle
+ * @return Locally unique contact id or zero
+ */
+size_t
+GNUNET_MESSENGER_contact_get_id (const struct
+                                 GNUNET_MESSENGER_Contact *contact);
+
+/**
+ * Send a <i>message</i> into a <i>room</i>. If you opened the <i>room</i> all entered members will receive the
  * <i>message</i>. If you entered the <i>room</i> through a <b>door</b> all so entered <b>doors</b> will receive the
  * <i>message</i> as well. All members receiving the <i>message</i> will also propagate this <i>message</i> recursively
  * as long as the <i>message</i> is unknown to them.
@@ -784,14 +952,30 @@ GNUNET_MESSENGER_contact_get_key (const struct GNUNET_MESSENGER_Contact *contact
  *
  * Sending a message to all members in a given room can be done by providing NULL as contact.
  *
- * @param[in/out] room Room handle
- * @param[in] message New message to send
+ * @param[in,out] room Room handle
+ * @param[in,out] message New message to send
  * @param[in] contact Contact or NULL
  */
 void
 GNUNET_MESSENGER_send_message (struct GNUNET_MESSENGER_Room *room,
                                const struct GNUNET_MESSENGER_Message *message,
-                               const struct GNUNET_MESSENGER_Contact* contact);
+                               const struct GNUNET_MESSENGER_Contact *contact);
+
+/**
+ * Delete a message identified by its <i>hash</i> from a <i>room</i>. A deletion will be propagated to all members
+ * of the room as with any other sent message. Notice that a deletion will only request other members of the room
+ * to delete the selected message. If you are not permitted to delete the message, the deletion will be ignored.
+ *
+ * Depending on the implementation other clients may also ignore your deletion request in other circumstances.
+ *
+ * @param[in,out] room Room handle
+ * @param[in] message Message to delete
+ * @param[in] delay Delay to delete the message
+ */
+void
+GNUNET_MESSENGER_delete_message (struct GNUNET_MESSENGER_Room *room,
+                                 const struct GNUNET_HashCode *hash,
+                                 const struct GNUNET_TIME_Relative delay);
 
 /**
  * Get the message in a <i>room</i> identified by its <i>hash</i>.
@@ -817,7 +1001,7 @@ GNUNET_MESSENGER_get_message (const struct GNUNET_MESSENGER_Room *room,
 int
 GNUNET_MESSENGER_iterate_members (struct GNUNET_MESSENGER_Room *room,
                                   GNUNET_MESSENGER_MemberCallback callback,
-                                  void* cls);
+                                  void *cls);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/include/gnunet_mhd_compat.h b/src/include/gnunet_mhd_compat.h
index 0cfcc6445..7ef297c2f 100644
--- a/src/include/gnunet_mhd_compat.h
+++ b/src/include/gnunet_mhd_compat.h
@@ -25,6 +25,7 @@
  * MHD compatibility definitions for warning-less compile of
  * our code against MHD before and after #MHD_VERSION 0x00097002.
  */
+
 #include <microhttpd.h>
 
 #if MHD_VERSION >= 0x00097002
@@ -35,7 +36,7 @@
 
 #else
 
-/**
+**
  * Data type to use for functions return an "MHD result".
  */
 #define MHD_RESULT int
diff --git a/src/include/gnunet_microphone_lib.h b/src/include/gnunet_microphone_lib.h
index 2b08bcd71..394caed68 100644
--- a/src/include/gnunet_microphone_lib.h
+++ b/src/include/gnunet_microphone_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup conversation_l2  Conversation service and libraries
+ * @{
+ *
  * @author Simon Dieterle
  * @author Andreas Fuchs
  * @author Christian Grothoff
@@ -41,6 +44,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -141,4 +145,6 @@ GNUNET_MICROPHONE_destroy (struct GNUNET_MICROPHONE_Handle *microphone);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_microphone_lib.h */
diff --git a/src/include/gnunet_mq_lib.h b/src/include/gnunet_mq_lib.h
index a1c5c4957..b40693cdb 100644
--- a/src/include/gnunet_mq_lib.h
+++ b/src/include/gnunet_mq_lib.h
@@ -18,7 +18,17 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#include "gnunet_common.h"
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Florian Dold
  * @author Christian Grothoff
  *
@@ -35,6 +45,7 @@
 #ifndef GNUNET_MQ_LIB_H
 #define GNUNET_MQ_LIB_H
 
+
 #include "gnunet_scheduler_lib.h"
 
 /**
@@ -50,9 +61,9 @@
  * @return the MQ message
  */
 #define GNUNET_MQ_msg_extra(mvar, esize, type)                \
-  GNUNET_MQ_msg_ (((struct GNUNET_MessageHeader **) &(mvar)), \
-                  (esize) + sizeof *(mvar),                   \
-                  (type))
+        GNUNET_MQ_msg_ (((struct GNUNET_MessageHeader **) &(mvar)), \
+                        (esize) + sizeof *(mvar),                   \
+                        (type))
 
 /**
  * Allocate a GNUNET_MQ_Envelope.
@@ -74,7 +85,7 @@
  * @param type type of the message
  */
 #define GNUNET_MQ_msg_header(type) \
-  GNUNET_MQ_msg_ (NULL, sizeof(struct GNUNET_MessageHeader), type)
+        GNUNET_MQ_msg_ (NULL, sizeof(struct GNUNET_MessageHeader), type)
 
 
 /**
@@ -86,7 +97,8 @@
  * @param type type of the message
  */
 #define GNUNET_MQ_msg_header_extra(mh, esize, type) \
-  GNUNET_MQ_msg_ (&mh, (esize) + sizeof(struct GNUNET_MessageHeader), type)
+        GNUNET_MQ_msg_ (&mh, (esize) + sizeof(struct GNUNET_MessageHeader), type \
+                        )
 
 
 /**
@@ -100,7 +112,7 @@
  * @return a newly allocated 'struct GNUNET_MQ_Envelope *'
  */
 #define GNUNET_MQ_msg_nested_mh(mvar, type, mh)                               \
-  ({                                                                          \
+        ({                                                                          \
     struct GNUNET_MQ_Envelope *_ev;                                           \
     _ev = GNUNET_MQ_msg_nested_mh_ ((struct GNUNET_MessageHeader **) &(mvar), \
                                     sizeof(*(mvar)),                         \
@@ -120,8 +132,8 @@
  *         or NULL if the given message in @a var does not have any space after the message struct
  */
 #define GNUNET_MQ_extract_nested_mh(var)                               \
-  GNUNET_MQ_extract_nested_mh_ ((struct GNUNET_MessageHeader *) (var), \
-                                sizeof(*(var)))
+        GNUNET_MQ_extract_nested_mh_ ((struct GNUNET_MessageHeader *) (var), \
+                                      sizeof(*(var)))
 
 
 /**
@@ -319,7 +331,7 @@ typedef void
  * @return #GNUNET_OK if the message is well-formed,
  *         #GNUNET_SYSERR if not
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_MQ_MessageValidationCallback) (
   void *cls,
   const struct GNUNET_MessageHeader *msg);
@@ -386,9 +398,9 @@ typedef void
  * FIFO of envelopes independent of MQ itself and wants to
  * re-use the pointers internal to @a env.  Use with caution.
  *
- * @param[in|out] env_head of envelope DLL
- * @param[in|out] env_tail tail of envelope DLL
- * @param[in|out] env element to insert at the tail
+ * @param[in,out] env_head of envelope DLL
+ * @param[in,out] env_tail tail of envelope DLL
+ * @param[in,out] env element to insert at the tail
  */
 void
 GNUNET_MQ_dll_insert_head (struct GNUNET_MQ_Envelope **env_head,
@@ -404,9 +416,9 @@ GNUNET_MQ_dll_insert_head (struct GNUNET_MQ_Envelope **env_head,
  * FIFO of envelopes independent of MQ itself and wants to
  * re-use the pointers internal to @a env.  Use with caution.
  *
- * @param[in|out] env_head of envelope DLL
- * @param[in|out] env_tail tail of envelope DLL
- * @param[in|out] env element to insert at the tail
+ * @param[in,out] env_head of envelope DLL
+ * @param[in,out] env_tail tail of envelope DLL
+ * @param[in,out] env element to insert at the tail
  */
 void
 GNUNET_MQ_dll_insert_tail (struct GNUNET_MQ_Envelope **env_head,
@@ -422,9 +434,9 @@ GNUNET_MQ_dll_insert_tail (struct GNUNET_MQ_Envelope **env_head,
  * FIFO of envelopes independent of MQ itself and wants to
  * re-use the pointers internal to @a env.  Use with caution.
  *
- * @param[in|out] env_head of envelope DLL
- * @param[in|out] env_tail tail of envelope DLL
- * @param[in|out] env element to remove from the DLL
+ * @param[in,out] env_head of envelope DLL
+ * @param[in,out] env_tail tail of envelope DLL
+ * @param[in,out] env element to remove from the DLL
  */
 void
 GNUNET_MQ_dll_remove (struct GNUNET_MQ_Envelope **env_head,
@@ -519,9 +531,9 @@ struct GNUNET_MQ_MessageHandler
  * End-marker for the handlers array
  */
 #define GNUNET_MQ_handler_end() \
-  {                             \
-    NULL, NULL, NULL, 0, 0      \
-  }
+        {                             \
+          NULL, NULL, NULL, 0, 0      \
+        }
 
 
 /**
@@ -553,7 +565,7 @@ struct GNUNET_MQ_MessageHandler
  * @param ctx context for the callbacks
  */
 #define GNUNET_MQ_hd_fixed_size(name, code, str, ctx)                   \
-  ({                                                                    \
+        ({                                                                    \
     void (*_cb)(void *cls, const str *msg) = &handle_ ## name;           \
     ((struct GNUNET_MQ_MessageHandler){ NULL,                            \
                                         (GNUNET_MQ_MessageCallback) _cb, \
@@ -597,6 +609,7 @@ struct GNUNET_MQ_MessageHandler
  *                         "context"),
  *   GNUNET_MQ_handler_end()
  * };
+ * </code>
  *
  * @param name unique basename for the functions
  * @param code message type constant
@@ -604,7 +617,7 @@ struct GNUNET_MQ_MessageHandler
  * @param ctx context for the callbacks
  */
 #define GNUNET_MQ_hd_var_size(name, code, str, ctx)                          \
-  __extension__ ({                                                            \
+        __extension__ ({                                                            \
     int (*_mv)(void *cls, const str *msg) = &check_ ## name;                  \
     void (*_cb)(void *cls, const str *msg) = &handle_ ## name;                \
     ((struct GNUNET_MQ_MessageHandler){ (GNUNET_MQ_MessageValidationCallback) \
@@ -627,17 +640,17 @@ struct GNUNET_MQ_MessageHandler
  *  the size, starting with a `struct GNUNET_MessageHeader`
  */
 #define GNUNET_MQ_check_zero_termination(m)                       \
-  {                                                               \
-    const char *str = (const char *) &m[1];                       \
-    const struct GNUNET_MessageHeader *hdr =                      \
-      (const struct GNUNET_MessageHeader *) m;                    \
-    uint16_t slen = ntohs (hdr->size) - sizeof(*m);              \
-    if ((0 == slen) || (memchr (str, 0, slen) != &str[slen - 1])) \
-    {                                                             \
-      GNUNET_break (0);                                           \
-      return GNUNET_NO;                                           \
-    }                                                             \
-  }
+        {                                                               \
+          const char *str = (const char *) &m[1];                       \
+          const struct GNUNET_MessageHeader *hdr =                      \
+            (const struct GNUNET_MessageHeader *) m;                    \
+          uint16_t slen = ntohs (hdr->size) - sizeof(*m);              \
+          if ((0 == slen) || (memchr (str, 0, slen) != &str[slen - 1])) \
+          {                                                             \
+            GNUNET_break (0);                                           \
+            return GNUNET_NO;                                           \
+          }                                                             \
+        }
 
 
 /**
@@ -653,19 +666,19 @@ struct GNUNET_MQ_MessageHandler
  *  the size, starting with a `struct GNUNET_MessageHeader`
  */
 #define GNUNET_MQ_check_boxed_message(m)                 \
-  {                                                      \
-    const struct GNUNET_MessageHeader *inbox =           \
-      (const struct GNUNET_MessageHeader *) &m[1];       \
-    const struct GNUNET_MessageHeader *hdr =             \
-      (const struct GNUNET_MessageHeader *) m;           \
-    uint16_t slen = ntohs (hdr->size) - sizeof(*m);     \
-    if ((slen < sizeof(struct GNUNET_MessageHeader)) || \
-        (slen != ntohs (inbox->size)))                   \
-    {                                                    \
-      GNUNET_break (0);                                  \
-      return GNUNET_NO;                                  \
-    }                                                    \
-  }
+        {                                                      \
+          const struct GNUNET_MessageHeader *inbox =           \
+            (const struct GNUNET_MessageHeader *) &m[1];       \
+          const struct GNUNET_MessageHeader *hdr =             \
+            (const struct GNUNET_MessageHeader *) m;           \
+          uint16_t slen = ntohs (hdr->size) - sizeof(*m);     \
+          if ((slen < sizeof(struct GNUNET_MessageHeader)) || \
+              (slen != ntohs (inbox->size)))                   \
+          {                                                    \
+            GNUNET_break (0);                                  \
+            return GNUNET_NO;                                  \
+          }                                                    \
+        }
 
 
 /**
@@ -680,7 +693,7 @@ struct GNUNET_MQ_MessageHandler
  * @return #GNUNET_OK on success, #GNUNET_NO if no handler matched,
  *         #GNUNET_SYSERR if message was rejected by check function
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_MQ_handle_message (const struct GNUNET_MQ_MessageHandler *handlers,
                           const struct GNUNET_MessageHeader *mh);
 
@@ -983,7 +996,7 @@ GNUNET_MQ_destroy_notify_cancel (
  * Call the message message handler that was registered
  * for the type of the given message in the given message queue.
  *
- * This function is indented to be used for the implementation
+ * This function is intended to be used for the implementation
  * of message queues.
  *
  * @param mq message queue with the handlers
@@ -1120,3 +1133,5 @@ GNUNET_MQ_preference_to_string (enum GNUNET_MQ_PreferenceKind type);
 #endif
 
 /** @} */ /* end of group mq */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_mst_lib.h b/src/include/gnunet_mst_lib.h
index 9f3431b98..5b848bbd6 100644
--- a/src/include/gnunet_mst_lib.h
+++ b/src/include/gnunet_mst_lib.h
@@ -19,6 +19,13 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
+ * @addtogroup networking
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -32,6 +39,10 @@
  * @{
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_MST_LIB_H
 #define GNUNET_MST_LIB_H
 
@@ -43,8 +54,6 @@ extern "C"
 #endif
 #endif
 
-#include "gnunet_common.h"
-
 
 /**
  * Handle to a message stream tokenizer.
@@ -96,7 +105,7 @@ GNUNET_MST_create (GNUNET_MessageTokenizerCallback cb,
  *         #GNUNET_NO if one_shot was set and we have another message ready
  *         #GNUNET_SYSERR if the data stream is corrupt
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_MST_from_buffer (struct GNUNET_MessageStreamTokenizer *mst,
                         const char *buf,
                         size_t size,
@@ -118,7 +127,7 @@ GNUNET_MST_from_buffer (struct GNUNET_MessageStreamTokenizer *mst,
  *         #GNUNET_NO if one_shot was set and we have another message ready
  *         #GNUNET_SYSERR if the data stream is corrupt
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_MST_read (struct GNUNET_MessageStreamTokenizer *mst,
                  struct GNUNET_NETWORK_Handle *sock,
                  int purge,
@@ -136,7 +145,7 @@ GNUNET_MST_read (struct GNUNET_MessageStreamTokenizer *mst,
  *         #GNUNET_NO if one_shot was set and we have another message ready
  *         #GNUNET_SYSERR if the data stream is corrupt
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_MST_next (struct GNUNET_MessageStreamTokenizer *mst,
                  int one_shot);
 
@@ -161,4 +170,8 @@ GNUNET_MST_destroy (struct GNUNET_MessageStreamTokenizer *mst);
 
 /** @} */  /* end of group server */
 
+/** @} */ /* end of group addition to networking */
+
+/** @} */ /* end of group addition to libgnunetutil*/
+
 /* end of gnunet_mst_lib.h */
diff --git a/src/include/gnunet_my_lib.h b/src/include/gnunet_my_lib.h
deleted file mode 100644
index 0c95d50d0..000000000
--- a/src/include/gnunet_my_lib.h
+++ /dev/null
@@ -1,500 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2016 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Christian Grothoff
- * @author Christophe Genevey
- *
- * @file
- * Helper library to access a MySQL database
- *
- * @defgroup mysql  MySQL library
- * Helper library to access a MySQL database.
- * @{
- */
-#ifndef GNUNET_MY_LIB_H
-#define GNUNET_MY_LIB_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_mysql_lib.h"
-#include <mysql/mysql.h>
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
-/**
- * Information we pass to #GNUNET_MY_exec_prepared() to
- * initialize the arguments of the prepared statement.
- */
-struct GNUNET_MY_QueryParam;
-
-
-/**
- * Function called to convert input argument into SQL parameters.
- *
- * @param cls closure
- * @param pq data about the query
- * @param qbind array of parameters to initialize
- * @return -1 on error
- */
-typedef int
-(*GNUNET_MY_QueryConverter)(void *cls,
-                            const struct GNUNET_MY_QueryParam *qp,
-                            MYSQL_BIND *qbind);
-
-
-/**
- * Function called to cleanup result data.
- *
- * @param cls closure
- * @param rs spec to clean up
- */
-typedef void
-(*GNUNET_MY_QueryCleanup)(void *cls,
-                          MYSQL_BIND *qbind);
-/**
- * Information we pass to #GNUNET_MY_exec_prepared() to
- * initialize the arguments of the prepared statement.
- */
-
-
-struct GNUNET_MY_QueryParam
-{
-  /**
-   * Function to call for the type conversion.
-   */
-  GNUNET_MY_QueryConverter conv;
-
-  /**
-   * Function to call for cleaning up the query. Can be NULL.
-   */
-  GNUNET_MY_QueryCleanup cleaner;
-
-  /**
-   * Closure for @e conv.
-   */
-  void *conv_cls;
-
-  /**
-   * Number of arguments the @a conv converter expects to initialize.
-   */
-  unsigned int num_params;
-
-  /**
-   * Information to pass to @e conv.
-   */
-  const void *data;
-
-  /**
-   * Information to pass to @e conv.  Size of @a data.
-   */
-  unsigned long data_len;
-};
-
-/**
- * End of query parameter specification.
- *
- * @return array last entry for the result specification to use
- */
-#define GNUNET_MY_query_param_end { NULL, NULL, NULL, 0, NULL, 0 }
-
-
-/**
- * Generate query parameter for a buffer @a ptr of
- * @a ptr_size bytes.FG
- *
- * @param ptr pointer to the query parameter to pass
- * @oaran ptr_size number of bytes in @a ptr
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_fixed_size (const void *ptr,
-                                  size_t ptr_size);
-
-
-/**
- * Run a prepared SELECT statement.
- *
- * @param mc mysql context
- * @param sh handle to SELECT statement
- * @param params parameters to the statement
- * @return TBD
- */
-int
-GNUNET_MY_exec_prepared (struct GNUNET_MYSQL_Context *mc,
-                         struct GNUNET_MYSQL_StatementHandle *sh,
-                         struct GNUNET_MY_QueryParam *params);
-
-
-/**
- * Information we pass to #GNUNET_MY_extract_result() to
- * initialize the arguments of the prepared statement.
- */
-struct GNUNET_MY_ResultParam;
-
-/**
- * Information we pass to #GNUNET_MY_extract_result() to
- * initialize the arguments of the prepared statement.
- */
-struct GNUNET_MY_ResultSpec;
-
-/**
- * Function called to convert input argument into SQL parameters.
- *
- * @param cls closure
- * @param[in,out] rs
- * @param stmt the mysql statement that is being run
- * @param column the column that is being processed
- * @param[out] results
- * @return -1 on error
- */
-typedef int
-(*GNUNET_MY_ResultConverter)(void *cls,
-                             struct GNUNET_MY_ResultSpec *rs,
-                             MYSQL_STMT *stmt,
-                             unsigned int column,
-                             MYSQL_BIND *results);
-
-/**
- * Function called to cleanup result data.
- *
- * @param cls closure
- * @param rs spec to clean up
- */
-typedef void
-(*GNUNET_MY_ResultCleanup)(void *cls,
-                           struct GNUNET_MY_ResultSpec *rs);
-
-
-/**
- * Information we pass to #GNUNET_MY_extract_result() to
- * initialize the arguments of the prepared statement.
- */
-struct GNUNET_MY_ResultSpec
-{
-  /**
-   * Function to call to initialize the MYSQL_BIND array.
-   */
-  GNUNET_MY_ResultConverter pre_conv;
-
-  /**
-   * Function to call for converting the result. Can be NULL.
-   */
-  GNUNET_MY_ResultConverter post_conv;
-
-  /**
-   * Function to call for cleaning up the result. Can be NULL.
-   */
-  GNUNET_MY_ResultCleanup cleaner;
-
-  /**
-   * Closure for @e conv.
-   */
-  void *conv_cls;
-
-  /**
-   * Destination for the data.
-   */
-  void *dst;
-
-  /**
-   * Allowed size for the data, 0 for variable-size
-   * (in this case, the type of @e dst is a `void **`
-   * and we need to allocate a buffer of the right size).
-   */
-  size_t dst_size;
-
-  /**
-   * Where to store actual size of the result.
-   */
-  size_t *result_size;
-
-  /**
-   * How many fields does this result specification occupy
-   * in the result returned by MySQL.
-   */
-  unsigned int num_fields;
-
-  /**
-   * Location where we temporarily store the output buffer
-   * length from MySQL.  Internal to libgnunetmy.
-   */
-  unsigned long mysql_bind_output_length;
-
-  /**
-   * Memory for MySQL to notify us about NULL values.
-   */
-  MYSQL_BOOL is_null;
-};
-
-
-/**
- * End of result speceter specification.
- *
- * @return array last entry for the result specification to use
- */
-#define GNUNET_MY_result_spec_end { NULL, NULL, NULL, 0, NULL, 0, 0 }
-
-
-/**
- * Obtain fixed size result of @a ptr_size bytes from
- * MySQL, store in already allocated buffer at @a ptr.
- *
- * @spec ptr where to write the result
- * @oaran ptr_size number of bytes available at @a ptr
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_fixed_size (void *ptr,
-                                  size_t ptr_size);
-
-/**
- * Generate query parameter for a string
- *
- *@param ptr pointer to the string query parameter to pass
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_string (const char *ptr);
-
-/**
- * Generate fixed-size query parameter with size determined
- * by variable type.
- *
- * @param x pointer to the query parameter to pass
- */
-#define GNUNET_MY_query_param_auto_from_type( \
-    x) GNUNET_MY_query_param_fixed_size ((x), sizeof(*(x)))
-
-/**
- * Generate query parameter for an RSA public key. The
- * database must contain a BLOB type in the respective position.
- *
- * @param x the query parameter to pass
- * @return array entry for the query parameters to use
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_rsa_public_key (const struct
-                                      GNUNET_CRYPTO_RsaPublicKey *x);
-
-/**
- * Generate query parameter for an RSA signature. The
- * database must contain a BLOB type in the respective position
- *
- *@param x the query parameter to pass
- *@return array entry for the query parameters to use
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_rsa_signature (const struct
-                                     GNUNET_CRYPTO_RsaSignature *x);
-
-/**
- * Generate query parameter for an absolute time value.
- * The database must store a 64-bit integer.
- *
- *@param x pointer to the query parameter to pass
- *@return array entry for the query parameters to use
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x);
-
-
-/**
- * Generate query parameter for an absolute time value.
- * The database must store a 64-bit integer.
- *
- *@param x pointer to the query parameter to pass
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_absolute_time_nbo (const struct
-                                         GNUNET_TIME_AbsoluteNBO *x);
-
-/**
- * Generate query parameter for an uint16_t in host byte order.
- *
- * @param x pointer to the query parameter to pass
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_uint16 (const uint16_t *x);
-
-/**
- * Generate query parameter for an uint32_t in host byte order
- *
- *@param x pointer to the query parameter to pass
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_uint32 (const uint32_t *x);
-
-/**
- * Generate query parameter for an uint64_t in host byte order
- *
- *@param x pointer to the query parameter to pass
- */
-struct GNUNET_MY_QueryParam
-GNUNET_MY_query_param_uint64 (const uint64_t *x);
-
-/**
- * We expect a fixed-size result, with size determined by the type of `* dst`
- *
- * @spec name name of the field in the table
- * @spec dst point to where to store the result, type fits expected result size
- * @return array entry for the result specification to use
- */
-#define GNUNET_MY_result_spec_auto_from_type( \
-    dst) GNUNET_MY_result_spec_fixed_size ((dst), sizeof(*(dst)))
-
-
-/**
- * Variable-size result expected
- *
- * @param[out] dst where to store the result, allocated
- * @param[out] sptr where to store the size of @a dst
- * @return array entru for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_variable_size (void **dst,
-                                     size_t *ptr_size);
-
-/**
- * RSA public key expected
- *
- * @param name name of the field in the table
- * @param[out] rsa where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_rsa_public_key (struct GNUNET_CRYPTO_RsaPublicKey **rsa);
-
-
-/**
- * RSA signature expected.
- *
- * @param[out] sig where to store the result;
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_rsa_signature (struct GNUNET_CRYPTO_RsaSignature **sig);
-
-/**
- * 0- terminated string exprected.
- *
- * @param[out] dst where to store the result, allocated
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_string (char **dst);
-
-/**
- * Absolute time expected
- *
- * @param name name of the field in the table
- * @param[out] at where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_absolute_time (struct GNUNET_TIME_Absolute *at);
-
-/**
- * Absolute time in network byte order expected
- *
- * @param[out] at where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_absolute_time_nbo (struct GNUNET_TIME_AbsoluteNBO *at);
-
-/**
- * uint16_t expected
- *
- * @param[out] u16 where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_uint16 (uint16_t *u16);
-
-/**
- * uint32_t expected
- *
- * @param[out] u32 where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_uint32 (uint32_t *u32);
-
-/**
- * uint64_t expected.
- *
- * @param[out] u64 where to store the result
- * @return array entry for the result specification to use
- */
-struct GNUNET_MY_ResultSpec
-GNUNET_MY_result_spec_uint64 (uint64_t *u64);
-
-
-/**
- * Extract results from a query result according to the given
- * specification.  Always fetches the next row.
- *
- * @param sh statement that returned results
- * @param rs specification to extract for
- * @return
- *  #GNUNET_YES if all results could be extracted
- *  #GNUNET_NO if there is no more data in the result set
- *  #GNUNET_SYSERR if a result was invalid
- */
-int
-GNUNET_MY_extract_result (struct GNUNET_MYSQL_StatementHandle *sh,
-                          struct GNUNET_MY_ResultSpec *specs);
-
-
-/**
- * Free all memory that was allocated in @a qp during
- * #GNUNET_MY_exect_prepared().
- *
- * @param qp query specification to clean up
- * @param qbind mysql query
- */
-void
-GNUNET_MY_cleanup_query (struct GNUNET_MY_QueryParam *qp,
-                         MYSQL_BIND *qbind);
-
-
-/**
- * Free all memory that was allocated in @a rs during
- * #GNUNET_MY_extract_result().
- *
- * @param rs reult specification to clean up
- */
-void
-GNUNET_MY_cleanup_result (struct GNUNET_MY_ResultSpec *rs);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_mysql_lib.h b/src/include/gnunet_mysql_lib.h
deleted file mode 100644
index 843d3ccb3..000000000
--- a/src/include/gnunet_mysql_lib.h
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2012 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Christian Grothoff
- *
- * @file
- * Helper library to access a MySQL database
- *
- * @defgroup mysql  MySQL library
- * Helper library to access a MySQL database.
- * @{
- */
-#ifndef GNUNET_MYSQL_LIB_H
-#define GNUNET_MYSQL_LIB_H
-
-#include "gnunet_util_lib.h"
-#include <mysql/mysql.h>
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#ifdef HAVE_MYSQL8
-  typedef bool MYSQL_BOOL;
-#else
-  typedef my_bool MYSQL_BOOL; //MySQL < 8 wants this
-#endif
-
-
-/**
- * Mysql context.
- */
-struct GNUNET_MYSQL_Context;
-
-
-/**
- * Handle for a prepared statement.
- */
-struct GNUNET_MYSQL_StatementHandle;
-
-
-/**
- * Type of a callback that will be called for each
- * data set returned from MySQL.
- *
- * @param cls user-defined argument
- * @param num_values number of elements in values
- * @param values values returned by MySQL
- * @return #GNUNET_OK to continue iterating, #GNUNET_SYSERR to abort
- */
-typedef int
-(*GNUNET_MYSQL_DataProcessor) (void *cls,
-                               unsigned int num_values,
-                               MYSQL_BIND *values);
-
-
-/**
- * Create a mysql context.
- *
- * @param cfg configuration
- * @param section configuration section to use to get MySQL configuration options
- * @return the mysql context
- */
-struct GNUNET_MYSQL_Context *
-GNUNET_MYSQL_context_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                             const char *section);
-
-
-/**
- * Destroy a mysql context.  Also frees all associated prepared statements.
- *
- * @param mc context to destroy
- */
-void
-GNUNET_MYSQL_context_destroy (struct GNUNET_MYSQL_Context *mc);
-
-
-/**
- * Close database connection and all prepared statements (we got a DB
- * error).  The connection will automatically be re-opened and
- * statements will be re-prepared if they are needed again later.
- *
- * @param mc mysql context
- */
-void
-GNUNET_MYSQL_statements_invalidate (struct GNUNET_MYSQL_Context *mc);
-
-
-/**
- * Get internal handle for a prepared statement.  This function should rarely
- * be used, and if, with caution!  On failures during the interaction with
- * the handle, you must call #GNUNET_MYSQL_statements_invalidate()!
- *
- * @param sh prepared statement to introspect
- * @return MySQL statement handle, NULL on error
- */
-MYSQL_STMT *
-GNUNET_MYSQL_statement_get_stmt (struct GNUNET_MYSQL_StatementHandle *sh);
-
-
-/**
- * Prepare a statement.  Prepared statements are automatically discarded
- * when the MySQL context is destroyed.
- *
- * @param mc mysql context
- * @param query query text
- * @return prepared statement, NULL on error
- */
-struct GNUNET_MYSQL_StatementHandle *
-GNUNET_MYSQL_statement_prepare (struct GNUNET_MYSQL_Context *mc,
-                                const char *query);
-
-
-/**
- * Run a SQL statement.
- *
- * @param mc mysql context
- * @param sql SQL statement to run
- * @return #GNUNET_OK on success
- *         #GNUNET_SYSERR if there was a problem
- */
-int
-GNUNET_MYSQL_statement_run (struct GNUNET_MYSQL_Context *mc,
-                            const char *sql);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_namecache_plugin.h b/src/include/gnunet_namecache_plugin.h
index 7c218fbeb..a3848bf4e 100644
--- a/src/include/gnunet_namecache_plugin.h
+++ b/src/include/gnunet_namecache_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -34,6 +37,7 @@
 #ifndef GNUNET_NAMECACHE_PLUGIN_H
 #define GNUNET_NAMECACHE_PLUGIN_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_namecache_service.h"
 #include "gnunet_namestore_service.h"
@@ -106,3 +110,5 @@ struct GNUNET_NAMECACHE_PluginFunctions
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_namecache_service.h b/src/include/gnunet_namecache_service.h
index 07b26aec3..669386c37 100644
--- a/src/include/gnunet_namecache_service.h
+++ b/src/include/gnunet_namecache_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -38,6 +41,7 @@
 #ifndef GNUNET_NAMECACHE_SERVICE_H
 #define GNUNET_NAMECACHE_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_namestore_service.h"
@@ -173,3 +177,5 @@ GNUNET_NAMECACHE_cancel (struct GNUNET_NAMECACHE_QueueEntry *qe);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_namestore_plugin.h b/src/include/gnunet_namestore_plugin.h
index 9cc8abc6e..b7bcc4eb6 100644
--- a/src/include/gnunet_namestore_plugin.h
+++ b/src/include/gnunet_namestore_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef GNUNET_NAMESTORE_PLUGIN_H
 #define GNUNET_NAMESTORE_PLUGIN_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_namestore_service.h"
 
@@ -49,6 +53,7 @@ extern "C"
  * @param cls closure
  * @param serial unique serial number of the record, MUST NOT BE ZERO,
  *               and must be monotonically increasing while iterating
+ * @param editor_hint content of the editor field when record was read (may be NULL)
  * @param zone_key private key of the zone
  * @param label name that is being mapped (at most 255 characters long)
  * @param rd_count number of entries in @a rd array
@@ -57,8 +62,9 @@ extern "C"
 typedef void
 (*GNUNET_NAMESTORE_RecordIterator) (void *cls,
                                     uint64_t serial,
+                                    const char *editor_hint,
                                     const struct
-                                    GNUNET_IDENTITY_PrivateKey *private_key,
+                                    GNUNET_CRYPTO_PrivateKey *private_key,
                                     const char *label,
                                     unsigned int rd_count,
                                     const struct GNUNET_GNSRECORD_Data *rd);
@@ -85,12 +91,12 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param rd array of records with data to store
    * @return #GNUNET_OK on success, else #GNUNET_SYSERR
    */
-  int
-  (*store_records) (void *cls,
-                    const struct GNUNET_IDENTITY_PrivateKey *zone,
-                    const char *label,
-                    unsigned int rd_count,
-                    const struct GNUNET_GNSRECORD_Data *rd);
+  enum GNUNET_GenericReturnValue
+  (*store_records)(void *cls,
+                   const struct GNUNET_CRYPTO_PrivateKey *zone,
+                   const char *label,
+                   unsigned int rd_count,
+                   const struct GNUNET_GNSRECORD_Data *rd);
 
   /**
    * Lookup records in the datastore for which we are the authority.
@@ -102,12 +108,12 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
    */
-  int
-  (*lookup_records) (void *cls,
-                     const struct GNUNET_IDENTITY_PrivateKey *zone,
-                     const char *label,
-                     GNUNET_NAMESTORE_RecordIterator iter,
-                     void *iter_cls);
+  enum GNUNET_GenericReturnValue
+  (*lookup_records)(void *cls,
+                    const struct GNUNET_CRYPTO_PrivateKey *zone,
+                    const char *label,
+                    GNUNET_NAMESTORE_RecordIterator iter,
+                    void *iter_cls);
 
 
   /**
@@ -124,13 +130,13 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
    */
-  int
-  (*iterate_records) (void *cls,
-                      const struct GNUNET_IDENTITY_PrivateKey *zone,
-                      uint64_t serial,
-                      uint64_t limit,
-                      GNUNET_NAMESTORE_RecordIterator iter,
-                      void *iter_cls);
+  enum GNUNET_GenericReturnValue
+  (*iterate_records)(void *cls,
+                     const struct GNUNET_CRYPTO_PrivateKey *zone,
+                     uint64_t serial,
+                     uint64_t limit,
+                     GNUNET_NAMESTORE_RecordIterator iter,
+                     void *iter_cls);
 
 
   /**
@@ -144,12 +150,77 @@ struct GNUNET_NAMESTORE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
    */
-  int
-  (*zone_to_name) (void *cls,
-                   const struct GNUNET_IDENTITY_PrivateKey *zone,
-                   const struct GNUNET_IDENTITY_PublicKey *value_zone,
-                   GNUNET_NAMESTORE_RecordIterator iter,
-                   void *iter_cls);
+  enum GNUNET_GenericReturnValue
+  (*zone_to_name)(void *cls,
+                  const struct GNUNET_CRYPTO_PrivateKey *zone,
+                  const struct GNUNET_CRYPTO_PublicKey *value_zone,
+                  GNUNET_NAMESTORE_RecordIterator iter,
+                  void *iter_cls);
+
+  /** Transaction-based API draft **/
+
+  /**
+   * Edit records in the namestore.
+   * This modifies the editor hint, an advisory lock entry.
+   * The record iterator will be called with the old editor hint (if any).
+   *
+   * @param cls closure (internal context for the plugin)
+   * @param zone private key of the zone
+   * @param editor_hint the new value for the advisory lock field
+   * @param label name of the record in the zone
+   * @param iter function to call with the result
+   * @param iter_cls closure for @a iter
+   * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+   */
+  enum GNUNET_GenericReturnValue
+  (*edit_records)(void *cls,
+                  const char *editor_hint,
+                  const struct GNUNET_CRYPTO_PrivateKey *zone,
+                  const char *label,
+                  GNUNET_NAMESTORE_RecordIterator iter,
+                  void *iter_cls);
+
+  /**
+   * This clears the editor hint, unless it does not match the
+   * given editor hint, in which case this is a NOP.
+   * If a replacement hint is given, it hint is not cleared, but
+   * set to the replacement.
+   *
+   * @param cls closure (internal context for the plugin)
+   * @param zone private key of the zone
+   * @param editor_hint the new value for the advisory lock field
+   * @param editor_hint_replacement an optional value to use instead of a clear
+   * @param label name of the record in the zone
+   * @param iter function to call with the result
+   * @param iter_cls closure for @a iter
+   * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+   */
+  enum GNUNET_GenericReturnValue
+  (*clear_editor_hint)(void *cls,
+                  const char *editor_hint,
+                  const char *editor_hint_replacement,
+                  const struct GNUNET_CRYPTO_PrivateKey *zone,
+                       const char *label);
+
+  /**
+   * Setup the database.
+   *
+   * @param cls closure (internal context for the plugin)
+   * @return #GNUNET_OK on success, else fails with #GNUNET_SYSERR
+   */
+  enum GNUNET_GenericReturnValue
+  (*create_tables)(void *cls);
+
+
+  /**
+   * Drop existing tables.
+   * DANGEROUS: All existing data in the dabase will be lost!
+   *
+   * @param cls closure (internal context for the plugin)
+   * @return #GNUNET_OK on success, else fails with #GNUNET_SYSERR
+   */
+  enum GNUNET_GenericReturnValue
+  (*drop_tables)(void *cls);
 };
 
 
@@ -163,3 +234,5 @@ struct GNUNET_NAMESTORE_PluginFunctions
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_namestore_service.h b/src/include/gnunet_namestore_service.h
index 2482b97a5..0f9be8b10 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup GNS
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -38,10 +41,10 @@
 #ifndef GNUNET_NAMESTORE_SERVICE_H
 #define GNUNET_NAMESTORE_SERVICE_H
 
+
+#include "gnunet_error_codes.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_block_lib.h"
 #include "gnunet_gnsrecord_lib.h"
-#include "gnunet_identity_service.h"
 
 #ifdef __cplusplus
 extern "C"
@@ -67,6 +70,28 @@ struct GNUNET_NAMESTORE_Handle;
  */
 struct GNUNET_NAMESTORE_ZoneIterator;
 
+/**
+ * Transaction control types.
+ * They roughly correspond to DB transaction controls
+ */
+enum GNUNET_NAMESTORE_TxControl
+{
+  GNUNET_NAMESTORE_TX_BEGIN = 0,
+  GNUNET_NAMESTORE_TX_COMMIT = 1,
+  GNUNET_NAMESTORE_TX_ROLLBACK = 2,
+};
+
+/**
+ * A struct for record bulk import.
+ * The fields are arrays pointing to individual GNS records and names.
+ */
+struct GNUNET_NAMESTORE_RecordInfo
+{
+  const char *a_label;
+  unsigned int a_rd_count;
+  struct GNUNET_GNSRECORD_Data *a_rd;
+};
+
 
 /**
  * Connect to the namestore service.
@@ -97,12 +122,11 @@ GNUNET_NAMESTORE_disconnect (struct GNUNET_NAMESTORE_Handle *h);
  * @param success #GNUNET_SYSERR on failure (including timeout/queue drop/failure to validate)
  *                #GNUNET_NO if content was already there or not found
  *                #GNUNET_YES (or other positive value) on success
- * @param emsg NULL on success, otherwise an error message
+ * @param ec the #GNUNET_ErrorCode, #GNUNET_EC_NONE on success.
  */
 typedef void
 (*GNUNET_NAMESTORE_ContinuationWithStatus) (void *cls,
-                                            int32_t success,
-                                            const char *emsg);
+                                            enum GNUNET_ErrorCode ec);
 
 
 /**
@@ -116,6 +140,9 @@ typedef void
  * keep up with the changes, calling @a cont will be delayed until the
  * monitors do keep up.
  *
+ * This always overwrites the record set and unsets any advisory
+ * lock inrrespective of the currently set editor hint/advisory lock value.
+ *
  * @param h handle to the namestore
  * @param pkey private key of the zone
  * @param label name that is being mapped
@@ -126,13 +153,81 @@ typedef void
  * @return handle to abort the request
  */
 struct GNUNET_NAMESTORE_QueueEntry *
-GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
-                                const struct GNUNET_IDENTITY_PrivateKey *pkey,
-                                const char *label,
-                                unsigned int rd_count,
-                                const struct GNUNET_GNSRECORD_Data *rd,
-                                GNUNET_NAMESTORE_ContinuationWithStatus cont,
-                                void *cont_cls);
+GNUNET_NAMESTORE_record_set_store (struct GNUNET_NAMESTORE_Handle *h,
+                                   const struct GNUNET_CRYPTO_PrivateKey *pkey,
+                                   const char *label,
+                                   unsigned int rd_count,
+                                   const struct GNUNET_GNSRECORD_Data *rd,
+                                   GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                   void *cont_cls);
+
+/**
+ * Store one or more record sets in the namestore. If any item is already present,
+ * it is replaced with the new record.  Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the records have been stored in the
+ * database. They may not yet have been commited. Monitors may be notified
+ * asynchronously (basically with a buffer when commited).
+ * However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ * Uncommited store requests within a transaction (GNUNET_NAMESTORE_transaction_begin)
+ * cause @a cont to be called immediately before the commit and before
+ * notification of monitors.
+ *
+ * This always overwrites the record set and unsets any advisory
+ * lock inrrespective of the currently set editor hint/advisory lock value.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param rd_set_count the number of record sets
+ * @param record_info the records to add containing @a rd_set_count records
+ * @param cont continuation to call when done
+ * @param rds_sent set to how many record sets could actually be sent
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_store (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_CRYPTO_PrivateKey *pkey,
+  unsigned int rd_set_count,
+  const struct GNUNET_NAMESTORE_RecordInfo *record_info,
+  unsigned int *rds_sent,
+  GNUNET_NAMESTORE_ContinuationWithStatus cont,
+  void *cont_cls);
+
+/**
+ * Store an item in the namestore.  If the item is already present,
+ * it is replaced with the new record.  Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the value has been stored in the
+ * database. Monitors may be notified asynchronously (basically with
+ * a buffer). However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param rd_count number of records in the 'rd' array
+ * @param rd array of records with data to store
+ * @param is_zonemaster update tombstones, do not process monitors
+ * @param cont continuation to call when done
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_record_set_store_ (struct GNUNET_NAMESTORE_Handle *h,
+                                    const struct GNUNET_CRYPTO_PrivateKey *pkey,
+                                    const char *label,
+                                    unsigned int rd_count,
+                                    const struct GNUNET_GNSRECORD_Data *rd,
+                                    int is_zonemaster,
+                                    GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                    void *cont_cls);
 
 
 /**
@@ -147,10 +242,48 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
 typedef void
 (*GNUNET_NAMESTORE_RecordMonitor) (void *cls,
                                    const struct
-                                   GNUNET_IDENTITY_PrivateKey *zone,
+                                   GNUNET_CRYPTO_PrivateKey *zone,
                                    const char *label,
                                    unsigned int rd_count,
                                    const struct GNUNET_GNSRECORD_Data *rd);
+/**
+ * Process a record that was stored in the namestore.
+ *
+ * @param cls closure
+ * @param ec the error code. #GNUNET_EC_NONE on success.
+ * @param rd_count number of entries in @a rd array, 0 if label was deleted
+ * @param rd array of records with data to store
+ * @param editor_hint the advisory lock value that was replaced. NULL of not advisory lock
+                      was set or if lock was equal to provided editor hint.
+ */
+typedef void
+(*GNUNET_NAMESTORE_EditRecordSetBeginCallback) (void *cls,
+                                                enum GNUNET_ErrorCode ec,
+                                                unsigned int rd_count,
+                                                const struct
+                                                GNUNET_GNSRECORD_Data *rd,
+                                                const char *editor_hint);
+
+/**
+ * Process a record set that was stored in the namestore.
+ * The record set expiration value takes existing TOMBSTONE records
+ * into account even if those are not returned.
+ *
+ * @param cls closure
+ * @param zone private key of the zone
+ * @param label label of the records
+ * @param rd_count number of entries in @a rd array, 0 if label was deleted
+ * @param rd array of records with data to store
+ * @param expiry the expiration of this record set.
+ */
+typedef void
+(*GNUNET_NAMESTORE_RecordSetMonitor) (void *cls,
+                                      const struct
+                                      GNUNET_CRYPTO_PrivateKey *zone,
+                                      const char *label,
+                                      unsigned int rd_count,
+                                      const struct GNUNET_GNSRECORD_Data *rd,
+                                      struct GNUNET_TIME_Absolute expiry);
 
 
 /**
@@ -170,13 +303,39 @@ typedef void
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_records_lookup (struct GNUNET_NAMESTORE_Handle *h,
                                  const struct
-                                 GNUNET_IDENTITY_PrivateKey *pkey,
+                                 GNUNET_CRYPTO_PrivateKey *pkey,
                                  const char *label,
                                  GNUNET_SCHEDULER_TaskCallback error_cb,
                                  void *error_cb_cls,
                                  GNUNET_NAMESTORE_RecordMonitor rm,
                                  void *rm_cls);
 
+/**
+ * Lookup an item in the namestore with GNSRECORD filter.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param error_cb function to call on error (i.e. disconnect)
+ *        the handle is afterwards invalid
+ * @param error_cb_cls closure for @a error_cb
+ * @param rm function to call with the result (with 0 records if we don't have that label);
+ *        the handle is afterwards invalid
+ * @param rm_cls closure for @a rm
+ *  @param filter the record set filter to use
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_lookup2 (struct GNUNET_NAMESTORE_Handle *h,
+                                  const struct
+                                  GNUNET_CRYPTO_PrivateKey *pkey,
+                                  const char *label,
+                                  GNUNET_SCHEDULER_TaskCallback error_cb,
+                                  void *error_cb_cls,
+                                  GNUNET_NAMESTORE_RecordMonitor rm,
+                                  void *rm_cls,
+                                  enum GNUNET_GNSRECORD_Filter filter);
+
 
 /**
  * Look for an existing PKEY delegation record for a given public key.
@@ -197,9 +356,9 @@ GNUNET_NAMESTORE_records_lookup (struct GNUNET_NAMESTORE_Handle *h,
  */
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_zone_to_name (struct GNUNET_NAMESTORE_Handle *h,
-                               const struct GNUNET_IDENTITY_PrivateKey *zone,
+                               const struct GNUNET_CRYPTO_PrivateKey *zone,
                                const struct
-                               GNUNET_IDENTITY_PublicKey *value_zone,
+                               GNUNET_CRYPTO_PublicKey *value_zone,
                                GNUNET_SCHEDULER_TaskCallback error_cb,
                                void *error_cb_cls,
                                GNUNET_NAMESTORE_RecordMonitor proc,
@@ -219,6 +378,9 @@ GNUNET_NAMESTORE_cancel (struct GNUNET_NAMESTORE_QueueEntry *qe);
 
 
 /**
+ * @deprecated since 0.16.7 will be replaced in 0.18
+ * @see GNUNET_NAMESTORE_zone_iteration_start2()
+ *
  * Starts a new zone iteration (used to periodically PUT all of our
  * records into our DHT). This MUST lock the `struct GNUNET_NAMESTORE_Handle`
  * for any other calls than #GNUNET_NAMESTORE_zone_iterator_next() and
@@ -246,7 +408,7 @@ GNUNET_NAMESTORE_cancel (struct GNUNET_NAMESTORE_QueueEntry *qe);
 struct GNUNET_NAMESTORE_ZoneIterator *
 GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
                                        const struct
-                                       GNUNET_IDENTITY_PrivateKey *zone,
+                                       GNUNET_CRYPTO_PrivateKey *zone,
                                        GNUNET_SCHEDULER_TaskCallback error_cb,
                                        void *error_cb_cls,
                                        GNUNET_NAMESTORE_RecordMonitor proc,
@@ -254,6 +416,44 @@ GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
                                        GNUNET_SCHEDULER_TaskCallback finish_cb,
                                        void *finish_cb_cls);
 
+/**
+ * Starts a new zone iteration (used to periodically PUT all of our
+ * records into our DHT). This MUST lock the `struct GNUNET_NAMESTORE_Handle`
+ * for any other calls than #GNUNET_NAMESTORE_zone_iterator_next() and
+ * #GNUNET_NAMESTORE_zone_iteration_stop. @a proc will be called once
+ * immediately, and then again after
+ * #GNUNET_NAMESTORE_zone_iterator_next() is invoked.
+ *
+ * On error (disconnect), @a error_cb will be invoked.
+ * On normal completion, @a finish_cb proc will be
+ * invoked.
+ *
+ * @param h handle to the namestore
+ * @param zone zone to access, NULL for all zones
+ * @param error_cb function to call on error (i.e. disconnect),
+ *        the handle is afterwards invalid
+ * @param error_cb_cls closure for @a error_cb
+ * @param proc function to call on each name from the zone; it
+ *        will be called repeatedly with a value (if available)
+ * @param proc_cls closure for @a proc
+ * @param finish_cb function to call on completion
+ *        the handle is afterwards invalid
+ * @param finish_cb_cls closure for @a finish_cb
+ * @param filter the record set filter to use
+ * @return an iterator handle to use for iteration
+ */
+struct GNUNET_NAMESTORE_ZoneIterator *
+GNUNET_NAMESTORE_zone_iteration_start2 (struct GNUNET_NAMESTORE_Handle *h,
+                                        const struct
+                                        GNUNET_CRYPTO_PrivateKey *zone,
+                                        GNUNET_SCHEDULER_TaskCallback error_cb,
+                                        void *error_cb_cls,
+                                        GNUNET_NAMESTORE_RecordSetMonitor proc,
+                                        void *proc_cls,
+                                        GNUNET_SCHEDULER_TaskCallback finish_cb,
+                                        void *finish_cb_cls,
+                                        enum GNUNET_GNSRECORD_Filter filter);
+
 
 /**
  * Calls the record processor specified in #GNUNET_NAMESTORE_zone_iteration_start
@@ -286,6 +486,9 @@ struct GNUNET_NAMESTORE_ZoneMonitor;
 
 
 /**
+ * @deprecated since 0.16.7 will be replaced in 0.18
+ * @see GNUNET_NAMESTORE_zone_monitor_start2()
+ *
  * Begin monitoring a zone for changes.  Will first call the @a
  * monitor function on all existing records in the selected zone(s) if
  * @a iterate_first is #GNUNET_YES.  In any case, we will then call @a
@@ -315,7 +518,7 @@ struct GNUNET_NAMESTORE_ZoneMonitor;
 struct GNUNET_NAMESTORE_ZoneMonitor *
 GNUNET_NAMESTORE_zone_monitor_start (
   const struct GNUNET_CONFIGURATION_Handle *cfg,
-  const struct GNUNET_IDENTITY_PrivateKey *zone,
+  const struct GNUNET_CRYPTO_PrivateKey *zone,
   int iterate_first,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
@@ -324,6 +527,47 @@ GNUNET_NAMESTORE_zone_monitor_start (
   GNUNET_SCHEDULER_TaskCallback sync_cb,
   void *sync_cb_cls);
 
+/**
+ * Begin monitoring a zone for changes.  Will first call the @a
+ * monitor function on all existing records in the selected zone(s) if
+ * @a iterate_first is #GNUNET_YES.  In any case, we will then call @a
+ * sync_cb, and then afterwards call the @a monitor whenever a record
+ * changes.  If the namestore disconnects, the @a error_cb function is
+ * called with a disconnect event. Once the connection is
+ * re-established, the process begins from the start (depending on @a
+ * iterate_first, we will again first do all existing records, then @a
+ * sync, then updates).
+ *
+ * @param cfg configuration to use to connect to namestore
+ * @param zone zone to monitor, NULL for all zones
+ * @param iterate_first #GNUNET_YES to first iterate over all existing records,
+ *                      #GNUNET_NO to only return changes that happen from now on
+ * @param error_cb function to call on error (i.e. disconnect); note that
+ *         unlike the other error callbacks in this API, a call to this
+ *         function does NOT destroy the monitor handle, it merely signals
+ *         that monitoring is down. You need to still explicitly call
+ *         #GNUNET_NAMESTORE_zone_monitor_stop().
+ * @param error_cb_cls closure for @a error_cb
+ * @param monitor function to call on zone changes, with an initial limit of 1
+ * @param monitor_cls closure for @a monitor
+ * @param sync_cb function called when we're in sync with the namestore
+ * @param sync_cb_cls closure for @a sync_cb
+ * @param filter the record set filter to use
+ * @return handle to stop monitoring
+ */
+struct GNUNET_NAMESTORE_ZoneMonitor *
+GNUNET_NAMESTORE_zone_monitor_start2 (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const struct GNUNET_CRYPTO_PrivateKey *zone,
+  int iterate_first,
+  GNUNET_SCHEDULER_TaskCallback error_cb,
+  void *error_cb_cls,
+  GNUNET_NAMESTORE_RecordSetMonitor monitor,
+  void *monitor_cls,
+  GNUNET_SCHEDULER_TaskCallback sync_cb,
+  void *sync_cb_cls,
+  enum GNUNET_GNSRECORD_Filter filter);
+
 
 /**
  * Calls the monitor processor specified in #GNUNET_NAMESTORE_zone_monitor_start
@@ -360,6 +604,68 @@ void
 GNUNET_NAMESTORE_zone_monitor_stop (struct GNUNET_NAMESTORE_ZoneMonitor *zm);
 
 
+/**
+ * New API draft. Experimental
+ */
+
+/**
+ * This function is used to initiate the editing
+ * of a record set under #label.
+ * It will set the editor hint of the record set to #editor_hint.
+ * The editor hint serves as an advisory lock that is used in
+ * #GNUNET_NAMESTORE_EdtirRecordSetBeginCallback if #editor_hint
+ * differs from the currently set advisory lock in the database.
+ *
+ * @param h handle to the namestore
+ * @param pkey the private key of the zone to edit
+ * @param label the label of the record set to edit
+ * @param editor_hint the editor hint to set as advisory lock
+ * @param error_cb the error callback
+ * @param error_cb_cls closure to #error_cb
+ * @param edit_cb the #GNUNET_NAMESTORE_EditRecordSetBeginCallback
+ * @param edit_cb_cls closure to #edit_cb
+ * @return handle to the operation
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_record_set_edit_begin (struct GNUNET_NAMESTORE_Handle *h,
+                                        const struct
+                                        GNUNET_CRYPTO_PrivateKey *pkey,
+                                        const char *label,
+                                        const char *editor_hint,
+                                        GNUNET_NAMESTORE_EditRecordSetBeginCallback
+                                        edit_cb,
+                                        void *edit_cb_cls);
+
+/**
+ * If the current advisory lock is set to the provided editor hint,
+ * this API cancels the editing of a record set and unsets the advisory lock in database.
+ * Optionally, a new editor hint can be provided: For example,
+ * the value that was returned in in the callback to
+ * #GNUNET_NAMESTORE_record_set_edit_begin.
+ *
+ * If provided editor hint does not match the current advisory lock,
+ * this function is not doing anything (NOP).
+ *
+ * @param h handle to the namestore
+ * @param pkey the private key of the zone to edit
+ * @param label the label of the record set to edit
+ * @param editor_hint the editor hint to set as advisory lock
+ * @param editor_hint_replacement the editor hint to set as advisory lock instead of clearing it
+ * @param finished_cb the callback called when cancelled
+ * @param finished_cb_cls closure to #finished_cb
+ * @return handle to the operation
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_record_set_edit_cancel (struct GNUNET_NAMESTORE_Handle *h,
+                                         const struct
+                                         GNUNET_CRYPTO_PrivateKey *pkey,
+                                         const char *label,
+                                         const char *editor_hint,
+                                         const char *editor_hint_replacement,
+                                         GNUNET_NAMESTORE_ContinuationWithStatus
+                                         finished_cb,
+                                         void *finished_cls);
+
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
 #endif
@@ -370,3 +676,5 @@ GNUNET_NAMESTORE_zone_monitor_stop (struct GNUNET_NAMESTORE_ZoneMonitor *zm);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_nat_auto_service.h b/src/include/gnunet_nat_auto_service.h
index 78284dc01..1c511cac3 100644
--- a/src/include/gnunet_nat_auto_service.h
+++ b/src/include/gnunet_nat_auto_service.h
@@ -26,7 +26,7 @@
  * Service for testing and autoconfiguration of
  * NAT traversal functionality
  *
- * @defgroup nat  NAT testing library
+ * @defgroup nat  NAT library
  *
  * @{
  */
@@ -34,6 +34,7 @@
 #ifndef GNUNET_NAT_AUTO_SERVICE_H
 #define GNUNET_NAT_AUTO_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_nat_service.h"
 
diff --git a/src/include/gnunet_nat_service.h b/src/include/gnunet_nat_service.h
index e39e2c016..ba9f252a0 100644
--- a/src/include/gnunet_nat_service.h
+++ b/src/include/gnunet_nat_service.h
@@ -36,6 +36,7 @@
 #ifndef GNUNET_NAT_SERVICE_H
 #define GNUNET_NAT_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 
 
@@ -344,6 +345,19 @@ GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
 
 
 /**
+ * Add global address to the list of addresses and notify clients.
+ *
+ * @param nh the handle returned by register
+ * @param addr IP address to add.
+ * @param address_length number of bytes in @a addr
+ */
+void
+GNUNET_NAT_add_global_address (struct GNUNET_NAT_Handle *nh,
+                               char *addr,
+                               unsigned int address_length);
+
+
+/**
  * Test if the given address is (currently) a plausible IP address for
  * this peer.  Mostly a convenience function so that clients do not
  * have to explicitly track all IPs that the #GNUNET_NAT_AddressCallback
@@ -385,6 +399,12 @@ GNUNET_NAT_request_reversal (struct GNUNET_NAT_Handle *nh,
  * handle.  This frees the handle, after having sent the needed
  * commands to close open ports.
  *
+ * FIXME: No, the implementation of this API does not do anything beyond
+ * cleaning up the handle.
+ * This is a problem for applications that use #GNUNET_NAT_AddressCallback
+ * and use the app_ctx to store objects, because the callback will never be
+ * called for cleanup on unregister.
+ *
  * @param nh the handle to unregister
  */
 void
diff --git a/src/include/gnunet_nc_lib.h b/src/include/gnunet_nc_lib.h
index bd22fd6e2..8f4d9a16f 100644
--- a/src/include/gnunet_nc_lib.h
+++ b/src/include/gnunet_nc_lib.h
@@ -17,7 +17,17 @@
 
      SPDX-License-Identifier: AGPL3.0-or-later
  */
+
+
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -99,3 +109,7 @@ unsigned int
 GNUNET_notification_context_get_size (struct GNUNET_NotificationContext *nc);
 
 #endif
+
+/** @} */ /* end of group mq */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_network_lib.h b/src/include/gnunet_network_lib.h
index ff1e853f5..764b7b29d 100644
--- a/src/include/gnunet_network_lib.h
+++ b/src/include/gnunet_network_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009-2013 GNUnet e.V.
+     Copyright (C) 2009-2013, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,7 +19,15 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
+ * @addtogroup networking
+ * @{
+ *
  * @author Nils Durner
+ * @author Tobias Frisch
  *
  * @file
  * Basic low-level networking interface
@@ -31,6 +39,7 @@
 #ifndef GNUNET_NETWORK_LIB_H
 #define GNUNET_NETWORK_LIB_H
 
+#include "gnunet_common.h"
 #ifdef __cplusplus
 extern "C"
 {
@@ -39,6 +48,14 @@ extern "C"
 #endif
 #endif
 
+//#ifdef HAVE_SYS_SELECT_H
+/*
+ * Include "sys/select.h" because it is required to use
+ * "fd_set" in "struct GNUNET_NETWORK_FDSet"!
+ */
+
+#include <sys/select.h>
+//#endif
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
@@ -141,7 +158,7 @@ GNUNET_NETWORK_socket_box_native (int fd);
  * @param doBlock blocking mode
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_NETWORK_socket_set_blocking (struct GNUNET_NETWORK_Handle *fd,
                                     int doBlock);
 
@@ -580,3 +597,7 @@ GNUNET_NETWORK_test_port_free (int ipproto,
 #endif /* GNUNET_NETWORK_LIB_H */
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_nse_service.h b/src/include/gnunet_nse_service.h
index 0401e0cbc..fe9e1f853 100644
--- a/src/include/gnunet_nse_service.h
+++ b/src/include/gnunet_nse_service.h
@@ -22,6 +22,9 @@
 #define GNUNET_NSE_SERVICE_H_
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Nathan Evans
  *
  * @file
@@ -47,6 +50,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -116,4 +120,6 @@ GNUNET_NSE_disconnect (struct GNUNET_NSE_Handle *h);
 
 /** @} */ /* end of group nse */
 
+/** @} */ /* end of group addition */
+
 #endif /* GNUNET_NSE_SERVICE_H_ */
diff --git a/src/include/gnunet_nt_lib.h b/src/include/gnunet_nt_lib.h
index 18419a7b8..014b4fbe0 100644
--- a/src/include/gnunet_nt_lib.h
+++ b/src/include/gnunet_nt_lib.h
@@ -17,12 +17,20 @@
 
      SPDX-License-Identifier: AGPL3.0-or-later
  */
+
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @file network type characterization
  * @author Christian Grothoff
  * @author Matthias Wachs
  *
- * @defgroup nt  network type characterization
+ * @defgroup nt  Network type characterization
  *
  * @{
  */
@@ -122,3 +130,5 @@ GNUNET_NT_scanner_done (struct GNUNET_NT_InterfaceScanner *is);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */  /* end of group addition to backbone */
diff --git a/src/include/gnunet_op_lib.h b/src/include/gnunet_op_lib.h
index 77fa7f955..e028fb7fb 100644
--- a/src/include/gnunet_op_lib.h
+++ b/src/include/gnunet_op_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @file
  * Asynchronous operations; register callbacks for operations and call them when a response arrives.
  *
@@ -28,6 +36,7 @@
 #ifndef GNUNET_OP_H
 #define GNUNET_OP_H
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -153,3 +162,5 @@ GNUNET_OP_remove (struct GNUNET_OP_Handle *h,
 
 
 #endif // GNUNET_OP_H
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_os_lib.h b/src/include/gnunet_os_lib.h
index eddf97dab..93296c96b 100644
--- a/src/include/gnunet_os_lib.h
+++ b/src/include/gnunet_os_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  * @author Krista Bennett
  * @author Gerd Knorr <kraxel@bytesex.org>
@@ -56,10 +64,6 @@ extern "C"
 #endif
 #endif
 
-#include "gnunet_common.h"
-#include "gnunet_configuration_lib.h"
-#include "gnunet_scheduler_lib.h"
-
 
 /**
  * Flags that determine which of the standard streams
@@ -379,14 +383,14 @@ GNUNET_OS_get_suid_binary_path (const struct GNUNET_CONFIGURATION_Handle *cfg,
  * @param addrlen length of the address
  * @return #GNUNET_OK to continue iteration, #GNUNET_SYSERR to abort
  */
-typedef int
-(*GNUNET_OS_NetworkInterfaceProcessor) (void *cls,
-                                        const char *name,
-                                        int isDefault,
-                                        const struct sockaddr *addr,
-                                        const struct sockaddr *broadcast_addr,
-                                        const struct sockaddr *netmask,
-                                        socklen_t addrlen);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_OS_NetworkInterfaceProcessor)(void *cls,
+                                       const char *name,
+                                       int isDefault,
+                                       const struct sockaddr *addr,
+                                       const struct sockaddr *broadcast_addr,
+                                       const struct sockaddr *netmask,
+                                       socklen_t addrlen);
 
 
 /**
@@ -399,6 +403,10 @@ void
 GNUNET_OS_network_interfaces_list (GNUNET_OS_NetworkInterfaceProcessor proc,
                                    void *proc_cls);
 
+#ifndef HAVE_SYSCONF
+#define HAVE_SYSCONF 0
+#endif
+
 /**
  * @brief Get maximum string length returned by gethostname()
  */
@@ -469,12 +477,13 @@ GNUNET_OS_process_get_pid (struct GNUNET_OS_Process *proc);
  * @return pointer to process structure of the new process, NULL on error
  */
 struct GNUNET_OS_Process *
-GNUNET_OS_start_process_vap (enum GNUNET_OS_InheritStdioFlags std_inheritance,
-                             struct GNUNET_DISK_PipeHandle *pipe_stdin,
-                             struct GNUNET_DISK_PipeHandle *pipe_stdout,
-                             struct GNUNET_DISK_PipeHandle *pipe_stderr,
-                             const char *filename,
-                             char *const argv[]);
+GNUNET_OS_start_process_vap (
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  struct GNUNET_DISK_PipeHandle *pipe_stdin,
+  struct GNUNET_DISK_PipeHandle *pipe_stdout,
+  struct GNUNET_DISK_PipeHandle *pipe_stderr,
+  const char *filename,
+  char *const argv[]);
 
 
 /**
@@ -489,11 +498,13 @@ GNUNET_OS_start_process_vap (enum GNUNET_OS_InheritStdioFlags std_inheritance,
  * @return pointer to process structure of the new process, NULL on error
  */
 struct GNUNET_OS_Process *
-GNUNET_OS_start_process (enum GNUNET_OS_InheritStdioFlags std_inheritance,
-                         struct GNUNET_DISK_PipeHandle *pipe_stdin,
-                         struct GNUNET_DISK_PipeHandle *pipe_stdout,
-                         struct GNUNET_DISK_PipeHandle *pipe_stderr,
-                         const char *filename, ...);
+GNUNET_OS_start_process (
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  struct GNUNET_DISK_PipeHandle *pipe_stdin,
+  struct GNUNET_DISK_PipeHandle *pipe_stdout,
+  struct GNUNET_DISK_PipeHandle *pipe_stderr,
+  const char *filename,
+  ...);
 
 
 /**
@@ -508,11 +519,14 @@ GNUNET_OS_start_process (enum GNUNET_OS_InheritStdioFlags std_inheritance,
  * @return pointer to process structure of the new process, NULL on error
  */
 struct GNUNET_OS_Process *
-GNUNET_OS_start_process_va (enum GNUNET_OS_InheritStdioFlags std_inheritance,
-                            struct GNUNET_DISK_PipeHandle *pipe_stdin,
-                            struct GNUNET_DISK_PipeHandle *pipe_stdout,
-                            struct GNUNET_DISK_PipeHandle *pipe_stderr,
-                            const char *filename, va_list va);
+GNUNET_OS_start_process_va (
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  struct GNUNET_DISK_PipeHandle *pipe_stdin,
+  struct GNUNET_DISK_PipeHandle *pipe_stdout,
+  struct GNUNET_DISK_PipeHandle *pipe_stderr,
+  const char *filename,
+  va_list va);
+
 
 /**
  * Start a process.
@@ -526,10 +540,11 @@ GNUNET_OS_start_process_va (enum GNUNET_OS_InheritStdioFlags std_inheritance,
  * @return pointer to process structure of the new process, NULL on error
  */
 struct GNUNET_OS_Process *
-GNUNET_OS_start_process_v (enum GNUNET_OS_InheritStdioFlags std_inheritance,
-                           const int *lsocks,
-                           const char *filename,
-                           char *const argv[]);
+GNUNET_OS_start_process_v (
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  const int *lsocks,
+  const char *filename,
+  char *const argv[]);
 
 
 /**
@@ -550,9 +565,11 @@ GNUNET_OS_start_process_v (enum GNUNET_OS_InheritStdioFlags std_inheritance,
  * @return pointer to process structure of the new process, NULL on error
  */
 struct GNUNET_OS_Process *
-GNUNET_OS_start_process_s (enum GNUNET_OS_InheritStdioFlags std_inheritance,
-                           const int *lsocks,
-                           const char *filename, ...);
+GNUNET_OS_start_process_s (
+  enum GNUNET_OS_InheritStdioFlags std_inheritance,
+  const int *lsocks,
+  const char *filename,
+  ...);
 
 
 /**
@@ -592,11 +609,12 @@ GNUNET_OS_command_stop (struct GNUNET_OS_CommandHandle *cmd);
  * @return NULL on error
  */
 struct GNUNET_OS_CommandHandle *
-GNUNET_OS_command_run (GNUNET_OS_LineProcessor proc,
-                       void *proc_cls,
-                       struct GNUNET_TIME_Relative timeout,
-                       const char *binary,
-                       ...);
+GNUNET_OS_command_run (
+  GNUNET_OS_LineProcessor proc,
+  void *proc_cls,
+  struct GNUNET_TIME_Relative timeout,
+  const char *binary,
+  ...);
 
 
 /**
@@ -608,7 +626,7 @@ GNUNET_OS_command_run (GNUNET_OS_LineProcessor proc,
  * @param code return code/signal number
  * @return #GNUNET_OK on success, #GNUNET_NO if the process is still running, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_OS_process_status (struct GNUNET_OS_Process *proc,
                           enum GNUNET_OS_ProcessStatusType *type,
                           unsigned long *code);
@@ -624,7 +642,7 @@ GNUNET_OS_process_status (struct GNUNET_OS_Process *proc,
  * @param proc pointer to process structure of the process to wait for
  * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_OS_process_wait (struct GNUNET_OS_Process *proc);
 
 
@@ -637,7 +655,7 @@ GNUNET_OS_process_wait (struct GNUNET_OS_Process *proc);
  * @param code return code/signal number
  * @return #GNUNET_OK on success, #GNUNET_NO if the process is still running, #GNUNET_SYSERR otherwise
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_OS_process_wait_status (struct GNUNET_OS_Process *proc,
                                enum GNUNET_OS_ProcessStatusType *type,
                                unsigned long *code);
@@ -690,4 +708,6 @@ GNUNET_OS_check_helper_binary (const char *binary,
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_os_lib.h */
diff --git a/src/include/gnunet_peer_lib.h b/src/include/gnunet_peer_lib.h
index f94b883f8..4a67878b9 100644
--- a/src/include/gnunet_peer_lib.h
+++ b/src/include/gnunet_peer_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -32,6 +40,7 @@
 #ifndef GNUNET_PEER_LIB_H
 #define GNUNET_PEER_LIB_H
 
+
 #include "gnunet_util_lib.h"
 
 #ifdef __cplusplus
@@ -126,4 +135,6 @@ GNUNET_PEER_resolve2 (GNUNET_PEER_Id id);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_peer_lib.h */
diff --git a/src/include/gnunet_peerinfo_service.h b/src/include/gnunet_peerinfo_service.h
deleted file mode 100644
index cdea1a95f..000000000
--- a/src/include/gnunet_peerinfo_service.h
+++ /dev/null
@@ -1,210 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2009, 2010 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Christian Grothoff
- *
- * @file
- * Maintain the list of currently known hosts
- *
- * @defgroup peerinfo  Peer Info service
- * Maintain the list of currently known hosts.
- *
- * Holds an in-memory structure of data/hosts.
- *
- * @see [Documentation](https://gnunet.org/gnunets-peerinfo-subsystem)
- *
- * @{
- */
-
-#ifndef GNUNET_PEERINFO_SERVICE_H
-#define GNUNET_PEERINFO_SERVICE_H
-
-#include "gnunet_common.h"
-#include "gnunet_configuration_lib.h"
-#include "gnunet_crypto_lib.h"
-#include "gnunet_hello_lib.h"
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
-/**
- * Handle to the peerinfo service.
- */
-struct GNUNET_PEERINFO_Handle;
-
-
-/**
- * Connect to the peerinfo service.
- *
- * @param cfg configuration to use
- * @return NULL on error (configuration related, actual connection
- *         etablishment may happen asynchronously).
- */
-struct GNUNET_PEERINFO_Handle *
-GNUNET_PEERINFO_connect (const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Disconnect from the peerinfo service.  Note that all iterators must
- * have completed or have been cancelled by the time this function is
- * called (otherwise, calling this function is a serious error).
- * Furthermore, if #GNUNET_PEERINFO_add_peer() operations are still
- * pending, they will be cancelled silently on disconnect.
- *
- * @param h handle to disconnect
- */
-void
-GNUNET_PEERINFO_disconnect (struct GNUNET_PEERINFO_Handle *h);
-
-
-/**
- * Add a host to the persistent list.  This method operates in
- * semi-reliable mode: if the transmission is not completed by
- * the time #GNUNET_PEERINFO_disconnect() is called, it will be
- * aborted.  Furthermore, if a second HELLO is added for the
- * same peer before the first one was transmitted, PEERINFO may
- * merge the two HELLOs prior to transmission to the service.
- *
- * @param h handle to the peerinfo service
- * @param hello the verified (!) HELLO message
- * @param cont continuation to call when done, NULL is allowed
- * @param cont_cls closure for @a cont
- * @return handle to cancel add operation; all pending
- *         'add' operations will be cancelled automatically
- *        on disconnect, so it is not necessary to keep this
- *        handle (unless @a cont is non-NULL and at some point
- *        calling @a cont must be prevented)
- */
-struct GNUNET_MQ_Envelope *
-GNUNET_PEERINFO_add_peer (struct GNUNET_PEERINFO_Handle *h,
-                          const struct GNUNET_HELLO_Message *hello,
-                          GNUNET_SCHEDULER_TaskCallback cont,
-                          void *cont_cls);
-
-
-/**
- * Type of an iterator over the hosts.  Note that each
- * host will be called with each available protocol.
- *
- * @param cls closure
- * @param peer id of the peer, NULL for last call
- * @param hello hello message for the peer (can be NULL)
- * @param error message
- */
-typedef void
-(*GNUNET_PEERINFO_Processor) (void *cls,
-                              const struct GNUNET_PeerIdentity *peer,
-                              const struct GNUNET_HELLO_Message *hello,
-                              const char *err_msg);
-
-
-/**
- * Handle for cancellation of iteration over peers.
- */
-struct GNUNET_PEERINFO_IteratorContext;
-
-
-/**
- * Call a method for each known matching host.  The callback method
- * will be invoked once for each matching host and then finally once
- * with a NULL pointer.  After that final invocation, the iterator
- * context must no longer be used.
- *
- * Instead of calling this function with `peer == NULL` it is often
- * better to use #GNUNET_PEERINFO_notify().
- *
- * @param h handle to the peerinfo service
- * @param include_friend_only include HELLO messages for friends only
- * @param peer restrict iteration to this peer only (can be NULL)
- * @param timeout how long to wait until timing out
- * @param callback the method to call for each peer
- * @param callback_cls closure for @a callback
- * @return iterator context
- */
-struct GNUNET_PEERINFO_IteratorContext *
-GNUNET_PEERINFO_iterate (struct GNUNET_PEERINFO_Handle *h,
-                         int include_friend_only,
-                         const struct GNUNET_PeerIdentity *peer,
-                         GNUNET_PEERINFO_Processor callback,
-                         void *callback_cls);
-
-
-/**
- * Cancel an iteration over peer information.
- *
- * @param ic context of the iterator to cancel
- */
-void
-GNUNET_PEERINFO_iterate_cancel (struct GNUNET_PEERINFO_IteratorContext *ic);
-
-
-/**
- * Handle for notifications about changes to the set of known peers.
- */
-struct GNUNET_PEERINFO_NotifyContext;
-
-
-/**
- * Call a method whenever our known information about peers
- * changes.  Initially calls the given function for all known
- * peers and then only signals changes.
- *
- * If @a include_friend_only is set to #GNUNET_YES peerinfo will include HELLO
- * messages which are intended for friend to friend mode and which do not
- * have to be gossiped. Otherwise these messages are skipped.
- *
- * @param cfg configuration to use
- * @param include_friend_only include HELLO messages for friends only
- * @param callback the method to call for each peer
- * @param callback_cls closure for @a callback
- * @return NULL on error
- */
-struct GNUNET_PEERINFO_NotifyContext *
-GNUNET_PEERINFO_notify (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                        int include_friend_only,
-                        GNUNET_PEERINFO_Processor callback,
-                        void *callback_cls);
-
-
-/**
- * Stop notifying about changes.
- *
- * @param nc context to stop notifying
- */
-void
-GNUNET_PEERINFO_notify_cancel (struct GNUNET_PEERINFO_NotifyContext *nc);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_peerstore_plugin.h b/src/include/gnunet_peerstore_plugin.h
index 90190e5b5..6ecb9135a 100644
--- a/src/include/gnunet_peerstore_plugin.h
+++ b/src/include/gnunet_peerstore_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Omar Tarabai
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef GNUNET_PEERSTORE_PLUGIN_H
 #define GNUNET_PEERSTORE_PLUGIN_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_peerstore_service.h"
 
@@ -42,6 +46,19 @@ extern "C"
 #endif
 #endif
 
+/**
+ * Function called by PEERSTORE for each matching record.
+ *
+ * @param cls closure
+ * @param seq sequence in interation
+ * @param record peerstore record information
+ * @param emsg error message, or NULL if no errors
+ */
+typedef void (*GNUNET_PEERSTORE_PluginProcessor) (
+  void *cls,
+  uint64_t seq,
+  const struct GNUNET_PEERSTORE_Record *record,
+  const char *emsg);
 
 /**
  * @brief struct returned by the initialization function of the plugin
@@ -89,6 +106,7 @@ struct GNUNET_PEERSTORE_PluginFunctions
    * @param sub_system name of sub system
    * @param peer Peer identity (can be NULL)
    * @param key entry key string (can be NULL)
+   * @param limit max number of results to give
    * @param iter function to call asynchronously with the results, terminated
    * by a NULL result
    * @param iter_cls closure for @a iter
@@ -100,7 +118,9 @@ struct GNUNET_PEERSTORE_PluginFunctions
                       const char *sub_system,
                       const struct GNUNET_PeerIdentity *peer,
                       const char *key,
-                      GNUNET_PEERSTORE_Processor iter,
+                      uint64_t serial,
+                      uint64_t limit,
+                      GNUNET_PEERSTORE_PluginProcessor iter,
                       void *iter_cls);
 
   /**
@@ -131,3 +151,5 @@ struct GNUNET_PEERSTORE_PluginFunctions
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_peerstore_service.h b/src/include/gnunet_peerstore_service.h
index 91a8f2e66..3fb9df82a 100644
--- a/src/include/gnunet_peerstore_service.h
+++ b/src/include/gnunet_peerstore_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Omar Tarabai
  *
  * @file
@@ -33,6 +36,7 @@
 #ifndef GNUNET_PEERSTORE_SERVICE_H
 #define GNUNET_PEERSTORE_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 
 #ifdef __cplusplus
@@ -42,6 +46,10 @@ extern "C" {
 #endif
 #endif
 
+/**
+ * Key used for storing HELLO in the peerstore
+ */
+#define GNUNET_PEERSTORE_HELLO_KEY "peerstore-peer-hello-uri"
 
 /**
  * Key used for storing addresses in URL format in the peerstore
@@ -58,32 +66,32 @@ extern "C" {
  * messages.
  */
 #define GNUNET_PEERSTORE_TRANSPORT_BACKCHANNEL_MONOTIME \
-  "transport-backchannel-monotonic-time"
+        "transport-backchannel-monotonic-time"
 
 /**
  * Key used to store sender's monotonic time from DV learn
  * messages.
  */
 #define GNUNET_PEERSTORE_TRANSPORT_DVLEARN_MONOTIME \
-  "transport-dv-learn-monotonic-time"
+        "transport-dv-learn-monotonic-time"
 
 /**
  * Key used to store sender's monotonic time from handshake message.
  */
 #define GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_HANDSHAKE \
-  "transport-tcp-communicator-handshake"
+        "transport-tcp-communicator-handshake"
 
 /**
  * Key used to store sender's monotonic time from handshake ack message.
  */
 #define GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_HANDSHAKE_ACK \
-  "transport-tcp-communicator-handshake-ack"
+        "transport-tcp-communicator-handshake-ack"
 
 /**
  * Key used to store sender's monotonic time from rekey message.
  */
 #define GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_REKEY \
-  "transport-tcp-communicator-rekey"
+        "transport-tcp-communicator-rekey"
 
 
 /**
@@ -100,7 +108,8 @@ enum GNUNET_PEERSTORE_StoreOption
    * Delete any previous values for the given key before
    * storing the given value.
    */
-  GNUNET_PEERSTORE_STOREOPTION_REPLACE = 1
+  GNUNET_PEERSTORE_STOREOPTION_REPLACE = 1,
+
 };
 
 /**
@@ -114,6 +123,11 @@ struct GNUNET_PEERSTORE_Handle;
 struct GNUNET_PEERSTORE_StoreContext;
 
 /**
+ * Context for the info handler.
+ */
+struct GNUNET_PEERSTORE_NotifyContext;
+
+/**
  * Single PEERSTORE record
  */
 struct GNUNET_PEERSTORE_Record
@@ -148,11 +162,6 @@ struct GNUNET_PEERSTORE_Record
    */
   struct GNUNET_TIME_Absolute expiry;
 
-  /**
-   * Client from which this record originated.
-   * NOTE: This is internal to the service.
-   */
-  struct GNUNET_SERVICE_Client *client;
 };
 
 
@@ -166,9 +175,16 @@ typedef void (*GNUNET_PEERSTORE_Continuation) (void *cls, int success);
 
 
 /**
+ * Context for a add hello uri request.
+ */
+struct GNUNET_PEERSTORE_StoreHelloContext;
+
+
+/**
  * Function called by PEERSTORE for each matching record.
  *
  * @param cls closure
+ * @param seq sequence in interation
  * @param record peerstore record information
  * @param emsg error message, or NULL if no errors
  */
@@ -177,6 +193,43 @@ typedef void (*GNUNET_PEERSTORE_Processor) (
   const struct GNUNET_PEERSTORE_Record *record,
   const char *emsg);
 
+/**
+ * Function called by PEERSTORE when notifying a client about a changed hello.
+ *
+ * @param cls closure
+ * @param hello_uri Hello uri.
+ */
+typedef void (*GNUNET_PEERSTORE_hello_notify_cb) (
+  void *cls,
+  const struct GNUNET_PeerIdentity *peer,
+  const struct GNUNET_MessageHeader *hello,
+  const char *err_msg);
+
+/**
+ * Add hello to peerstore.
+ *
+ * @param h handle for peerstore.
+ * @param msg The hello to add.
+ * @param cont The continuation function to execute after storing.
+ * @param cont_cls The continuation function closure.
+ * @return The context for storing.
+ */
+struct GNUNET_PEERSTORE_StoreHelloContext *
+GNUNET_PEERSTORE_hello_add (struct GNUNET_PEERSTORE_Handle *h,
+                            const struct GNUNET_MessageHeader *msg,
+                            GNUNET_PEERSTORE_Continuation cont,
+                            void *cont_cls);
+
+
+/**
+ * Cancel the request to add a hello.
+ *
+ * @param huc The context for storing a hello.
+ */
+void
+GNUNET_PEERSTORE_hello_add_cancel (struct
+                                   GNUNET_PEERSTORE_StoreHelloContext *huc);
+
 
 /**
  * Connect to the PEERSTORE service.
@@ -188,15 +241,13 @@ GNUNET_PEERSTORE_connect (const struct GNUNET_CONFIGURATION_Handle *cfg);
 
 
 /**
- * Disconnect from the PEERSTORE service. Any pending ITERATE and WATCH requests
- * will be canceled.
- * Any pending STORE requests will depend on @e snyc_first flag.
+ * Disconnect from the PEERSTORE service. Any pending ITERATE and WATCH and
+ * STORE requests will be canceled.
  *
  * @param h handle to disconnect
- * @param sync_first send any pending STORE requests before disconnecting
  */
 void
-GNUNET_PEERSTORE_disconnect (struct GNUNET_PEERSTORE_Handle *h, int sync_first);
+GNUNET_PEERSTORE_disconnect (struct GNUNET_PEERSTORE_Handle *h);
 
 
 /**
@@ -238,63 +289,130 @@ GNUNET_PEERSTORE_store_cancel (struct GNUNET_PEERSTORE_StoreContext *sc);
 
 
 /**
- * Iterate over records matching supplied key information
+ * Iterate over peerstore entries.
+ * The iteration can be filtered to contain only records
+ * matching @a peer and/or @a key.
+ * The @a sub_system to match must be provided.
+ * @a callback will be called with (each) matching record.
+ * #GNUNET_PEERSTORE_iteration_next() must be invoked
+ * to continue processing until the end of the iteration is
+ * reached.
  *
  * @param h handle to the PEERSTORE service
  * @param sub_system name of sub system
  * @param peer Peer identity (can be NULL)
  * @param key entry key string (can be NULL)
- * @param callback function called with each matching record, all NULL's on end
+ * @param callback function called with each matching record. The record will be NULL to indicate end.
  * @param callback_cls closure for @a callback
+ * @return Handle to iteration request
  */
 struct GNUNET_PEERSTORE_IterateContext *
-GNUNET_PEERSTORE_iterate (struct GNUNET_PEERSTORE_Handle *h,
-                          const char *sub_system,
-                          const struct GNUNET_PeerIdentity *peer,
-                          const char *key,
-                          GNUNET_PEERSTORE_Processor callback,
-                          void *callback_cls);
+GNUNET_PEERSTORE_iteration_start (struct GNUNET_PEERSTORE_Handle *h,
+                                  const char *sub_system,
+                                  const struct GNUNET_PeerIdentity *peer,
+                                  const char *key,
+                                  GNUNET_PEERSTORE_Processor callback,
+                                  void *callback_cls);
 
 
 /**
- * Cancel an iterate request
- * Please do not call after the iterate request is done
+ * Continue an iteration.
+ * Do NOT call after the iterate request is done.
  *
- * @param ic Iterate request context as returned by GNUNET_PEERSTORE_iterate()
+ * @param ic Iterate request context as returned by #GNUNET_PEERSTORE_iteration_start()
+ * @param limit how many records to return max until #GNUNET_PEERSTORE_iterate_next() needs to be called again.
  */
 void
-GNUNET_PEERSTORE_iterate_cancel (struct GNUNET_PEERSTORE_IterateContext *ic);
+GNUNET_PEERSTORE_iteration_next (struct GNUNET_PEERSTORE_IterateContext *ic,
+                                 uint64_t limit);
 
 
 /**
+ * Cancel an iteration.
+ * Do NOT call after the iterate request is done
+ *
+ * @param ic Iterate request context as returned by #GNUNET_PEERSTORE_iteration_start()
+ */
+void
+GNUNET_PEERSTORE_iteration_stop (struct GNUNET_PEERSTORE_IterateContext *ic);
+
+/**
  * Request watching a given key
- * User will be notified with any new values added to key.
+ * The monitoring can be filtered to contain only records
+ * matching @a peer and/or @a key.
+ * The @a sub_system to match must be provided.
+ * @a callback will be called with (each) matching new record.
+ * #GNUNET_PEERSTORE_monitor_next() must be invoked
+ * to continue processing until @a sync_cb is
+ * called, indicating that the caller should be up-to-date.
+ * The caller will be notified with any new values added to key
+ * through @a callback.
+ * If @a iterate_first is set to GNUNET_YES, the monitor will first
+ * iterate over all existing, matching records. In any case,
+ * after @a sync_cb is called the first time monitoring starts.
  *
  * @param h handle to the PEERSTORE service
+ * @param iterate_first first iterated of all results if GNUNET_YES
  * @param sub_system name of sub system
  * @param peer Peer identity
  * @param key entry key string
+ * @param error_cb function to call on error (i.e. disconnect); note that
+ *         unlike the other error callbacks in this API, a call to this
+ *         function does NOT destroy the monitor handle, it merely signals
+ *         that monitoring is down. You need to still explicitly call
+ *         #GNUNET_PEERSTORE_monitor_stop().
+ * @param error_cb_cls closure for @a error_cb
+ * @param sync_cb function called when we're in sync with the peerstore
+ * @param sync_cb_cls closure for @a sync_cb
  * @param callback function called with each new value
  * @param callback_cls closure for @a callback
  * @return Handle to watch request
  */
-struct GNUNET_PEERSTORE_WatchContext *
-GNUNET_PEERSTORE_watch (struct GNUNET_PEERSTORE_Handle *h,
-                        const char *sub_system,
-                        const struct GNUNET_PeerIdentity *peer,
-                        const char *key,
-                        GNUNET_PEERSTORE_Processor callback,
-                        void *callback_cls);
-
+struct GNUNET_PEERSTORE_Monitor *
+GNUNET_PEERSTORE_monitor_start (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                                int iterate_first,
+                                const char *sub_system,
+                                const struct GNUNET_PeerIdentity *peer,
+                                const char *key,
+                                GNUNET_SCHEDULER_TaskCallback error_cb,
+                                void *error_cb_cls,
+                                GNUNET_SCHEDULER_TaskCallback sync_cb,
+                                void *sync_cb_cls,
+                                GNUNET_PEERSTORE_Processor callback,
+                                void *callback_cls);
 
 /**
- * Cancel a watch request
+ * Calls the monitor processor specified in #GNUNET_PEERSTORE_monitor_start
+ * for the next record(s).  This function is used to allow clients that merely
+ * monitor the NAMESTORE to still throttle namestore operations, so we can be
+ * sure that the monitors can keep up.
+ *
+ * Note that #GNUNET_PEERSTORE_store() only waits for this
+ * call if the previous limit set by the client was already reached.
+ * Thus, by using a @a limit greater than 1, monitors basically enable
+ * a queue of notifications to be processed asynchronously with some
+ * delay.  Note that even with a limit of 1 the
+ * #GNUNET_PEERSTORE_store() function will run asynchronously
+ * and the continuation may be invoked before the monitors completed
+ * (or even started) processing the notification.  Thus, monitors will
+ * only closely track the current state of the peerstore, but not
+ * be involved in the transactions.
  *
- * @param wc handle to the watch request
+ * @param zm the monitor
+ * @param limit number of records to return to the iterator in one shot
+ *        (before #GNUNET_PEERSTORE_monitor_next is to be called again)
  */
 void
-GNUNET_PEERSTORE_watch_cancel (struct GNUNET_PEERSTORE_WatchContext *wc);
+GNUNET_PEERSTORE_monitor_next (struct GNUNET_PEERSTORE_Monitor *zm,
+                               uint64_t limit);
 
+/**
+ * Stop monitoring.
+ *
+ * @param zm handle to the monitor activity to stop
+ */
+void
+GNUNET_PEERSTORE_monitor_stop (struct GNUNET_PEERSTORE_Monitor *zm);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
@@ -306,3 +424,5 @@ GNUNET_PEERSTORE_watch_cancel (struct GNUNET_PEERSTORE_WatchContext *wc);
 #endif
 
 /** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_plugin_lib.h b/src/include/gnunet_plugin_lib.h
index d265eb343..2a9cde47f 100644
--- a/src/include/gnunet_plugin_lib.h
+++ b/src/include/gnunet_plugin_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -40,9 +48,6 @@ extern "C"
 #endif
 #endif
 
-#include "gnunet_common.h"
-#include "gnunet_configuration_lib.h"
-
 
 /**
  * Signature of any function exported by a plugin.
@@ -65,7 +70,7 @@ typedef void *
  * @param library_name name of the plugin to test if it is installed
  * @return #GNUNET_YES if the plugin exists, #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_PLUGIN_test (const char *library_name);
 
 
@@ -169,4 +174,6 @@ GNUNET_PLUGIN_unload (const char *library_name,
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_plugin_lib.h */
diff --git a/src/include/gnunet_pq_lib.h b/src/include/gnunet_pq_lib.h
index 6a374f7e2..5f698058a 100644
--- a/src/include/gnunet_pq_lib.h
+++ b/src/include/gnunet_pq_lib.h
@@ -1,6 +1,6 @@
 /*
    This file is part of GNUnet
-   Copyright (C) 2016, 2017, 2020, 2021 GNUnet e.V.
+   Copyright (C) 2016, 2017, 2020-2022 GNUnet e.V.
 
    GNUnet is free software: you can redistribute it and/or modify it
    under the terms of the GNU Affero General Public License as published
@@ -25,9 +25,19 @@
 #ifndef GNUNET_PQ_LIB_H
 #define GNUNET_PQ_LIB_H
 
+
 #include <libpq-fe.h>
+#include <stdint.h>
+#include "gnunet_common.h"
+#include "gnunet_time_lib.h"
 #include "gnunet_util_lib.h"
 #include "gnunet_db_lib.h"
+#include "postgres_ext.h"
+
+/**
+ * Postgres context.
+ */
+struct GNUNET_PQ_Context;
 
 /* ************************* pq_query_helper.c functions ************************ */
 
@@ -57,6 +67,14 @@ typedef int
                              void *scratch[],
                              unsigned int scratch_length);
 
+/**
+ * Function called to cleanup the closure of SQL parameters converter. Will be
+ * called with GNUNET_PQ_query_params_cleanup
+ *
+ * @param cls closure
+ */
+typedef void
+(*GNUNET_PQ_QueryConverter_Cleanup)(void *cls);
 
 /**
  * @brief Description of a DB query parameter.
@@ -70,10 +88,20 @@ struct GNUNET_PQ_QueryParam
 
   /**
    * Closure for @e conv.
+   * The function @conv_cls_cleanup can be set to cleanup the closure.
+   * The cleanup of the closure MUST be triggered manually by a call to
+   * GNUNET_PQ_query_params_cleanup.
    */
   void *conv_cls;
 
   /**
+   * Function to cleanup the closure @a conv_cls, may be NULL.
+   * The cleanup of the closure MUST be triggered manually by a call to
+   * GNUNET_PQ_query_params_cleanup.
+   */
+  GNUNET_PQ_QueryConverter_Cleanup conv_cls_cleanup;
+
+  /**
    * Data or NULL.
    */
   const void *data;
@@ -90,13 +118,26 @@ struct GNUNET_PQ_QueryParam
 
 };
 
+/**
+ * Must be called to cleanup memory from closures after the query parameters
+ * have been used as much as needed.
+ *
+ * @param params Array of GNUNET_PQ_QueryParam which must terminate with a GNUNET_PQ_query_param_end
+ */
+void
+GNUNET_PQ_cleanup_query_params_closures (
+  const struct GNUNET_PQ_QueryParam *params);
 
 /**
  * End of query parameter specification.
  */
 #define GNUNET_PQ_query_param_end \
   {                               \
-    NULL, NULL, NULL, 0, 0        \
+    .conv = NULL,                 \
+    .conv_cls = NULL,             \
+    .data = NULL,                 \
+    .size = 0,                    \
+    .num_params = 0               \
   }
 
 
@@ -114,7 +155,7 @@ GNUNET_PQ_query_param_null (void);
  * @a ptr_size bytes.
  *
  * @param ptr pointer to the query parameter to pass
- * @oaran ptr_size number of bytes in @a ptr
+ * @param ptr_size number of bytes in @a ptr
  * @return query parameter to use
  */
 struct GNUNET_PQ_QueryParam
@@ -133,6 +174,220 @@ GNUNET_PQ_query_param_string (const char *ptr);
 
 
 /**
+ * Pass a boolean into a query.
+ *
+ * @param b boolean bit to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_bool (bool b);
+
+/**
+ * Returns the oid for a given datatype by name.
+ *
+ * @param db The db-connection
+ * @param name The name of the datatype
+ * @param[out] oid The OID of the datatype.
+ * @return GNUNET_OK when the datatype was found, GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_get_oid_by_name (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  Oid *oid);
+
+
+/**
+ * The header for a postgresql array in binary format. note that this a
+ * simplified special case of the general structure (which contains pointers),
+ * as we only support one-dimensional arrays.
+ *
+ * Note that all values must be in network-byte-order.
+ */
+struct GNUNET_PQ_ArrayHeader_P
+{
+  uint32_t ndim;     /* number of dimensions. we only support ndim = 1 */
+  uint32_t has_null;
+  uint32_t oid;      /* oid of the elements */
+  uint32_t dim;      /* size of the array */
+  uint32_t lbound;   /* index value of first element in the db (default: 1). */
+} __attribute__((packed));
+
+
+/**
+ * Generate query parameter for an array of bool in host byte order.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous array of @a num boolean elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bool (
+  unsigned int num,
+  const bool *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of uint16_t in host byte order.
+ * Note that the (unsigend) elements are not checked to wrap over INT2_MAX
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous array of @a num uint16 elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint16 (
+  unsigned int num,
+  const uint16_t *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of uint32_t in host byte order.
+ * Note that the (unsigend) elements are not checked to wrap over INT4_MAX
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous Array of @a num uint32_t elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint32 (
+  unsigned int num,
+  const uint32_t *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of uint64 in host byte order.
+ * Note that the (unsigend) elements are not checked to wrap over INT8_MAX
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous array of @a num uint64_t elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint64 (
+  unsigned int num,
+  const uint64_t *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of buffers @a elements, each of
+ * corresponding size given in @a sizes.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continous array of @a num buffers, each of corresponding size given in @a sizes.
+ * @param sizes Pointer to sizes in bytes of each element in @a elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bytes (
+  unsigned int num,
+  const void *elements,
+  const size_t *sizes,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of buffers @a elements,
+ * each of the same size @a size.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continous array of @a num buffers, each with the same size @a same_size
+ * @param same_size Size in bytes of each element in @a elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bytes_same_size (
+  unsigned int num,
+  const void *elements,
+  size_t same_size,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate array of equal-sized query parameter with size determined
+ * by variable type from a pointer to an continuous array.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous array of the query parameter to pass.
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+#define GNUNET_PQ_query_param_array_auto_from_type(num, elements, db) \
+  GNUNET_PQ_query_param_array_bytes_same_size ((num), \
+                                               (elements), \
+                                               sizeof(*(elements)), \
+                                               (db))
+
+/**
+ * Generate query parameter for an array of pointers to buffers @a elements,
+ * each of the same size @a size.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num pointers to buffers, each with the same size @a same_size
+ * @param same_size Size in bytes of each element in @a elements
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_bytes_same_size (
+  unsigned int num,
+  const void *elements[static num],
+  size_t same_size,
+  struct GNUNET_PQ_Context *db);
+
+
+/**
+ * Generate array of equal-sized query parameter with size determined by
+ * variable type from a pointer to an array of pointers to objects of the same
+ * type.
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Continuous array of the query parameter to pass.
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+#define GNUNET_PQ_query_param_array_ptrs_auto_from_type(num, elements, db) \
+  GNUNET_PQ_query_param_array_ptrs_bytes_same_size ((num), \
+                                                    (const void **) (elements), \
+                                                    sizeof(*(elements[0])), \
+                                                    (db))
+
+
+/**
+ * Generate query parameter for an array of strings (continuous)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num continuous strings (zero-terminated each)
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_string (
+  unsigned int num,
+  const char *elements,
+  struct GNUNET_PQ_Context *db);
+
+
+/**
+ * Generate query parameter for an array of strings (pointers)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num pointer to strings
+ * @param db Database context, needed for database-depending encoding of @a elements
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_string (
+  unsigned int num,
+  const char *elements[static num],
+  struct GNUNET_PQ_Context *db);
+
+
+/**
  * Generate fixed-size query parameter with size determined
  * by variable type.
  *
@@ -142,6 +397,83 @@ GNUNET_PQ_query_param_string (const char *ptr);
 #define GNUNET_PQ_query_param_auto_from_type(x) \
   GNUNET_PQ_query_param_fixed_size ((x), sizeof(*(x)))
 
+/**
+ * Generate query parameter for an array of absolute time stamps (continuous)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num absolute timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_abs_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Absolute *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of absolute time stamps (pointers)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num pointers to absolute timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_abs_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Absolute *elements[],
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of relative time stamps (continuous)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num relative timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_rel_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Relative *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of relative time stamps (pointers)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num pointers to relative timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_rel_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Relative *elements[],
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of time stamps (continuous)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_timestamp (
+  unsigned int num,
+  const struct GNUNET_TIME_Timestamp *elements,
+  struct GNUNET_PQ_Context *db);
+
+/**
+ * Generate query parameter for an array of time stamps (pointers)
+ *
+ * @param num Number of elements in @a elements
+ * @param elements Array of @a num pointers to relative timestamps
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_timestamp (
+  unsigned int num,
+  const struct GNUNET_TIME_Timestamp *elements[],
+  struct GNUNET_PQ_Context *db);
 
 /**
  * Generate query parameter for an RSA public key.  The
@@ -190,6 +522,17 @@ GNUNET_PQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x);
 
 
 /**
+ * Generate query parameter for a timestamp.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp (const struct GNUNET_TIME_Timestamp *x);
+
+
+/**
  * Generate query parameter for an absolute time value.
  * The database must store a 64-bit integer.
  *
@@ -202,6 +545,18 @@ GNUNET_PQ_query_param_absolute_time_nbo (
 
 
 /**
+ * Generate query parameter for a timestamp in NBO.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp_nbo (
+  const struct GNUNET_TIME_TimestampNBO *x);
+
+
+/**
  * Generate query parameter for an uint16_t in host byte order.
  *
  * @param x pointer to the query parameter to pass
@@ -222,7 +577,7 @@ GNUNET_PQ_query_param_uint32 (const uint32_t *x);
 
 
 /**
- * Generate query parameter for an uint16_t in host byte order.
+ * Generate query parameter for an uint64_t in host byte order.
  *
  * @param x pointer to the query parameter to pass
  * @return query parameter to use
@@ -231,6 +586,57 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_uint64 (const uint64_t *x);
 
 
+/**
+ * Generate query parameter for an int64_t in host byte order.
+ *
+ * @param x pointer to the query parameter to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_int64 (const int64_t *x);
+
+/**
+ * Generate query parameter for a blind sign public key.
+ * Internally, the various attributes of the public key
+ * will be serialized into on variable-size BLOB.
+ *
+ * @param pub pointer to the query parameter to pass
+ *
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_blind_sign_pub (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *pub);
+
+/**
+ * Generate query parameter for a blind sign private key of variable size.
+ *
+ * @param priv pointer to the query parameter to pass
+ *
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_blind_sign_priv (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *priv);
+
+/**
+ * Generate query parameter for an unblinded signature of variable size.
+ *
+ * @param sig pointer to the query parameter to pass
+ *
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_unblinded_sig (
+  const struct GNUNET_CRYPTO_UnblindedSignature *sig);
+
+/**
+ * Generate query parameter for a blinded signature of variable size.
+ *
+ * @param b_sig pointer to the query parameter to pass
+ *
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_blinded_sig (
+  const struct GNUNET_CRYPTO_BlindedSignature *b_sig);
+
 /* ************************* pq_result_helper.c functions ************************ */
 
 
@@ -280,8 +686,7 @@ struct GNUNET_PQ_ResultSpec
   GNUNET_PQ_ResultConverter conv;
 
   /**
-   * Function to clean up result data, NULL if cleanup is
-   * not necessary.
+   * Function to clean up result data, NULL if cleanup is not necessary.
    */
   GNUNET_PQ_ResultCleanup cleaner;
 
@@ -296,9 +701,9 @@ struct GNUNET_PQ_ResultSpec
   void *dst;
 
   /**
-   * Allowed size for the data, 0 for variable-size
-   * (in this case, the type of @e dst is a `void **`
-   * and we need to allocate a buffer of the right size).
+   * Allowed size for the data, 0 for variable-size (in this case, the type of
+   * @e dst is a `void **` and we need to allocate a buffer of the right
+   * size).
    */
   size_t dst_size;
 
@@ -318,10 +723,8 @@ struct GNUNET_PQ_ResultSpec
   bool is_nullable;
 
   /**
-   * Points to a location where we should store
-   * "true" if the result found is NULL, and
-   * otherwise "false". Only used if @e is_nullable
-   * is true.
+   * Points to a location where we should store "true" if the result found is
+   * NULL, and otherwise "false". Only used if @e is_nullable is true.
    */
   bool *is_null;
 
@@ -348,8 +751,7 @@ struct GNUNET_PQ_ResultSpec
 
 
 /**
- * Allow NULL value to be found in the database
- * for the given value.
+ * Allow NULL value to be found in the database for the given value.
  *
  * @param rs result spec entry to modify
  * @param[out] is_null location set to 'true' if the
@@ -414,6 +816,18 @@ GNUNET_PQ_result_spec_string (const char *name,
 
 
 /**
+ * boolean expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] dst where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_bool (const char *name,
+                            bool *dst);
+
+
+/**
  * RSA public key expected.
  *
  * @param name name of the field in the table
@@ -450,6 +864,18 @@ GNUNET_PQ_result_spec_absolute_time (const char *name,
 
 
 /**
+ * Timestamp expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] t where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp (const char *name,
+                                 struct GNUNET_TIME_Timestamp *t);
+
+
+/**
  * Relative time expected.
  *
  * @param name name of the field in the table
@@ -474,6 +900,18 @@ GNUNET_PQ_result_spec_absolute_time_nbo (const char *name,
 
 
 /**
+ * Timestamp expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] tn where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp_nbo (const char *name,
+                                     struct GNUNET_TIME_TimestampNBO *tn);
+
+
+/**
  * uint16_t expected.
  *
  * @param name name of the field in the table
@@ -509,15 +947,233 @@ GNUNET_PQ_result_spec_uint64 (const char *name,
                               uint64_t *u64);
 
 
-/* ************************* pq.c functions ************************ */
+/**
+ * int64_t expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] i64 where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_int64 (const char *name,
+                             int64_t *i64);
+
 
 /**
- * Postgres context.
+ * array of bool expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a bools.
+ * @param[out] bools pointer to where to store the result, an array of @a num bool's. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
  */
-struct GNUNET_PQ_Context;
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_bool (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  bool **bools);
+
+/**
+ * array of uint16_t expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u16s.
+ * @param[out] dst pointer to where to store the an array of @a num uint16_t's. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint16 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint16_t **dst);
+
+/**
+ * array of uint32_t expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u32s.
+ * @param[out] dst pointer to where to store the array of @a num uint32_t's. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint32 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint32_t **dst);
+
+/**
+ * array of uint64_t expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u64s.
+ * @param[out] dst pointer to where to store the array of @a num uint64_t's. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint64 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint64_t **dst);
+
+
+/**
+ * array of absolute time expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u64s.
+ * @param[out] dst pointer to where to store the array of @a num absolute time. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_abs_time (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Absolute **dst);
+
+/**
+ * array of relative time expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u64s.
+ * @param[out] dst pointer to where to store the array of @a num relate time. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_rel_time (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Relative **dst);
+
+/**
+ * array of relative time expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements in the array @a u64s.
+ * @param[out] dst pointer to where to store the array of @a num timestamps. Allocated by the function, MUST be freed with GNUNET_free.
+ * @return array entry for the result specification to use
+ */
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_timestamp (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Timestamp **dst);
+
+/**
+ * Array of variable-size result expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements
+ * @param[out] sizes where to store the @a num size's of byte-buffers in @a dst
+ * @param[out] dst where to store the continuous array of @a num byte-buffers , allocated
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_variable_size (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  size_t **sizes,
+  void **dst);
+
+
+/**
+ * Array of fixed-size result expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param size number of bytes expected in each element of @a dst
+ * @param[out] num where to store the number of elements
+ * @param[out] dst where to store the results, an continuous array of fixed-size elements
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_fixed_size (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t size,
+  size_t *num,
+  void **dst);
 
 
 /**
+ * We expect a fixed-size result, with size determined by the type of `* dst`
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param num pointer to where to store the number of elements
+ * @param dst pointer to where to store the results, type fits expected result size
+ * @return array entry for the result specification to use
+ */
+#define GNUNET_PQ_result_spec_auto_array_from_type(db, name, num, dst) \
+  GNUNET_PQ_result_spec_array_fixed_size ( \
+    (db), \
+    (name), \
+    sizeof(*(dst)), \
+    (num), \
+    (void *) &(dst))
+
+
+/**
+ * Array of 0-terminated strings expected.
+ *
+ * @param db Database context, needed for OID lookup for the correct type
+ * @param name name of the field in the table
+ * @param[out] num where to store the number of elements
+ * @param[out] dst where to store the allocated continous array of @a num 0-terminated strings
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_string (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  char **dst);
+
+
+/**
+ * Blind sign public key expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] public_key where to store the denomination signature
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_blind_sign_pub (
+  const char *name,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **public_key);
+
+
+/**
+ * Blind sign private key expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] private_key where to store the denomination signature
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_blind_sign_priv (
+  const char *name,
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **private_key);
+
+/* ************************* pq.c functions ************************ */
+
+/**
  * Execute a prepared statement.
  *
  * @param db database context
@@ -681,11 +1337,6 @@ struct GNUNET_PQ_PreparedStatement
    */
   const char *sql;
 
-  /**
-   * Number of arguments included in @e sql.
-   */
-  unsigned int num_arguments;
-
 };
 
 
@@ -694,7 +1345,7 @@ struct GNUNET_PQ_PreparedStatement
  */
 #define GNUNET_PQ_PREPARED_STATEMENT_END \
   {                                      \
-    NULL, NULL, 0                        \
+    NULL, NULL                           \
   }
 
 
@@ -703,13 +1354,11 @@ struct GNUNET_PQ_PreparedStatement
  *
  * @param name name of the statement
  * @param sql actual SQL statement
- * @param num_args number of arguments in the statement
  * @return initialized struct
  */
 struct GNUNET_PQ_PreparedStatement
 GNUNET_PQ_make_prepare (const char *name,
-                        const char *sql,
-                        unsigned int num_args);
+                        const char *sql);
 
 
 /**
@@ -726,6 +1375,22 @@ GNUNET_PQ_prepare_statements (struct GNUNET_PQ_Context *db,
                               const struct GNUNET_PQ_PreparedStatement *ps);
 
 
+/**
+ * Request creation of prepared statements @a ps from Postgres, but do not
+ * automatically re-prepare the statement if we are disconnected from the
+ * database.
+ *
+ * @param db database to prepare the statements for
+ * @param ps #GNUNET_PQ_PREPARED_STATEMENT_END-terminated array of prepared
+ *            statements.
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_prepare_once (struct GNUNET_PQ_Context *db,
+                        const struct GNUNET_PQ_PreparedStatement *ps);
+
+
 /* ******************** pq_exec.c functions ************** */
 
 
@@ -780,7 +1445,7 @@ GNUNET_PQ_make_try_execute (const char *sql);
 /**
  * Request execution of an array of statements @a es from Postgres.
  *
- * @param pq database to execute the statements in
+ * @param db database to execute the statements in
  * @param es #GNUNET_PQ_PREPARED_STATEMENT_END-terminated array of prepared
  *            statements.
  * @return #GNUNET_OK on success (modulo statements where errors can be ignored)
@@ -822,14 +1487,14 @@ enum GNUNET_PQ_Options
  * configuration.  Initialize logging via GNUnet's log routines and disable
  * Postgres's logger.  Also ensures that the statements in @a load_path and @a
  * es are executed whenever we (re)connect to the database, and that the
- * prepared statements in @a ps are "ready".  If statements in @es fail that
+ * prepared statements in @a ps are "ready".  If statements in @a es fail that
  * were created with #GNUNET_PQ_make_execute(), then the entire operation
  * fails.
  *
  * In @a load_path, a list of "$XXXX.sql" files is expected where $XXXX
  * must be a sequence of contiguous integer values starting at 0000.
  * These files are then loaded in sequence using "psql $config_str" before
- * running statements from @e es.  The directory is inspected again on
+ * running statements from @a es.  The directory is inspected again on
  * reconnect.
  *
  * @param config_str configuration to use
@@ -847,11 +1512,26 @@ GNUNET_PQ_connect (const char *config_str,
 
 
 /**
+ * Execute SQL statements from @a buf against @a db.
+ * The given filename infix in @a buf is prefixed with
+ * the "load_path" and ".sql" is appended to construct
+ * the full filename.
+ *
+ * @param db database context to use
+ * @param buf filename infix (!) with the SQL code to run
+ * @return #GNUNET_OK on success, #GNUNET_NO if patch @a buf does not exist, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_exec_sql (struct GNUNET_PQ_Context *db,
+                    const char *buf);
+
+
+/**
  * Create a connection to the Postgres database using @a config_str for the
  * configuration.  Initialize logging via GNUnet's log routines and disable
  * Postgres's logger.  Also ensures that the statements in @a load_path and @a
  * es are executed whenever we (re)connect to the database, and that the
- * prepared statements in @a ps are "ready".  If statements in @es fail that
+ * prepared statements in @a ps are "ready".  If statements in @a es fail that
  * were created with #GNUNET_PQ_make_execute(), then the entire operation
  * fails.
  *
@@ -863,6 +1543,7 @@ GNUNET_PQ_connect (const char *config_str,
  *
  * @param config_str configuration to use
  * @param load_path path to directory with SQL transactions to run, can be NULL
+ * @param auto_suffix infix of SQL series to run on every reconnect; runs multiple (!) files, of the form auto_suffix-XXXX where XXXX is from 0 to 9999 (consequtive).
  * @param es #GNUNET_PQ_PREPARED_STATEMENT_END-terminated
  *            array of statements to execute upon EACH connection, can be NULL
  * @param ps array of prepared statements to prepare, can be NULL
@@ -872,16 +1553,17 @@ GNUNET_PQ_connect (const char *config_str,
 struct GNUNET_PQ_Context *
 GNUNET_PQ_connect2 (const char *config_str,
                     const char *load_path,
+                    const char *auto_suffix,
                     const struct GNUNET_PQ_ExecuteStatement *es,
                     const struct GNUNET_PQ_PreparedStatement *ps,
                     enum GNUNET_PQ_Options flags);
 
 
 /**
- * Connect to a postgres database using the configuration
- * option "CONFIG" in @a section.  Also ensures that the
- * statements in @a es are executed whenever we (re)connect to the
- * database, and that the prepared statements in @a ps are "ready".
+ * Connect to a postgres database using the configuration option "CONFIG" in
+ * @a section.  Also ensures that the statements in @a es are executed
+ * whenever we (re)connect to the database, and that the prepared statements
+ * in @a ps are "ready".
  *
  * The caller does not have to ensure that @a es and @a ps remain allocated
  * and initialized in memory until #GNUNET_PQ_disconnect() is called, as a copy will be made.
@@ -909,7 +1591,8 @@ GNUNET_PQ_connect_with_cfg (const struct GNUNET_CONFIGURATION_Handle *cfg,
  * database, and that the prepared statements in @a ps are "ready".
  *
  * The caller does not have to ensure that @a es and @a ps remain allocated
- * and initialized in memory until #GNUNET_PQ_disconnect() is called, as a copy will be made.
+ * and initialized in memory until #GNUNET_PQ_disconnect() is called, as a
+ * copy will be made.
  *
  * @param cfg configuration
  * @param section configuration section to use to get Postgres configuration options
@@ -988,12 +1671,24 @@ GNUNET_PQ_event_listen_cancel (struct GNUNET_DB_EventHandler *eh);
 
 
 /**
+ * Poll for events right now. Useful if we may have
+ * triggered an event for ourselves.  Not needed when
+ * using GNUNET_PQ_event_notify(), but useful when
+ * stored procedures may have triggered events.
+ * Does nothing if there are no events.
+ *
+ * @param[in,out] db database to check for events
+ */
+void
+GNUNET_PQ_event_do_poll (struct GNUNET_PQ_Context *db);
+
+
+/**
  * Notify all that listen on @a es of an event.
  *
- * Unlike many other calls, this function is thread-safe
- * and may be called from threads that are different
- * from the one that setup @a db. However, the @a cb
- * will always be called from the thread that runs
+ * Unlike many other calls, this function is thread-safe and may be called
+ * from threads that are different from the one that setup @a db. However, the
+ * @a cb will always be called from the thread that runs
  * #GNUNET_PQ_event_do_poll() or the GNUnet scheduler.
  *
  * @param db database context to use
@@ -1009,6 +1704,17 @@ GNUNET_PQ_event_notify (struct GNUNET_PQ_Context *db,
 
 
 /**
+ * Compute the channel that one should notify upon for the given event
+ * specification.
+ *
+ * @param es event specification
+ * @return channel to notify upon
+ */
+char *
+GNUNET_PQ_get_event_notify_channel (const struct GNUNET_DB_EventHeaderP *es);
+
+
+/**
  * Within the @a db context, run all the SQL files
  * from the @a load_path from 0000-9999.sql (as long
  * as the files exist contiguously).
diff --git a/src/include/gnunet_program_lib.h b/src/include/gnunet_program_lib.h
index 4167060c0..f06d95422 100644
--- a/src/include/gnunet_program_lib.h
+++ b/src/include/gnunet_program_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -40,6 +48,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_configuration_lib.h"
 #include "gnunet_getopt_lib.h"
 #include "gnunet_scheduler_lib.h"
@@ -113,6 +122,45 @@ GNUNET_PROGRAM_run (int argc,
                     GNUNET_PROGRAM_Main task,
                     void *task_cls);
 
+enum GNUNET_GenericReturnValue
+GNUNET_DAEMON_register (const char *daemon_name,
+                        const char *daemon_desc,
+                        GNUNET_PROGRAM_Main task);
+
+#ifndef HAVE_GNUNET_MONOLITH
+#define GNUNET_DAEMON_MAIN(daemon_name, daemon_help, init_cb) \
+        int \
+        main (int argc, \
+              char *const *argv) \
+        { \
+          int ret; \
+          struct GNUNET_GETOPT_CommandLineOption options[] = { \
+            GNUNET_GETOPT_OPTION_END \
+          }; \
+          if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv, &argc, \
+                                                         &argv)) \
+            return 2; \
+          ret =  GNUNET_PROGRAM_run (argc, \
+                                     argv, \
+                                     daemon_name, \
+                                     daemon_help, \
+                                     options, \
+                                     init_cb, \
+                                     NULL); \
+          GNUNET_free_nz ((void*) argv); \
+          return ret; \
+        }
+#else
+#define GNUNET_DAEMON_MAIN(daemon_name, daemon_help, init_cb) \
+        static int __attribute__ ((constructor)) \
+        init (void) \
+        { \
+          return GNUNET_DAEMON_register (daemon_name, \
+                                         daemon_help, \
+                                         init_cb); \
+        }
+#endif
+
 
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
@@ -126,4 +174,6 @@ GNUNET_PROGRAM_run (int argc,
 
 /** @} */  /* end of group program */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_program_lib.h */
diff --git a/src/include/gnunet_protocols.h b/src/include/gnunet_protocols.h
index 9e278eb92..9fce48386 100644
--- a/src/include/gnunet_protocols.h
+++ b/src/include/gnunet_protocols.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2001--2020 GNUnet e.V.
+     Copyright (C) 2001--2024 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  * @author Tobias Frisch
  *
@@ -153,10 +157,10 @@ extern "C" {
  ******************************************************************************/
 
 /**
- * Previously used for HELLO messages used for communicating peer addresses.
+ * Latest HELLO messages used for communicating peer addresses.
  * Managed by libgnunethello.
  */
-#define GNUNET_MESSAGE_TYPE_HELLO_LEGACY 16
+#define GNUNET_MESSAGE_TYPE_HELLO_URI 16
 
 /**
  * HELLO message with friend only flag used for communicating peer addresses.
@@ -660,13 +664,26 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN 156
 
 /**
- * DHT wants to use CORE to transmit data.
+ * HELLO advertising a neighbours addresses.
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO 157
+
+/**
+ * Encapsulation of DHT messages in CORE service.
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_CORE 158
+
+/**
+ * HELLO URL send between client and service (in
+ * either direction).
  */
-#define GNUNET_MESSAGE_TYPE_DHT_CORE 143
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL 159
 
 /**
- * Further X-VINE DHT messages continued from 880
+ * Client requests DHT service's HELLO URL.
  */
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET 161
+
 
 /*******************************************************************************
  * HOSTLIST message types
@@ -1310,7 +1327,7 @@ extern "C" {
 /**
  * Service to client: result of store operation.
  */
-#define GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE 436
+#define GNUNET_MESSAGE_TYPE_NAMESTORE_GENERIC_RESPONSE 436
 
 /**
  * Client to service: lookup label
@@ -1796,7 +1813,6 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_SETU_P2P_SEND_FULL 710
 
 
-
 /*******************************************************************************
  * SETI message types
  ******************************************************************************/
@@ -2336,7 +2352,7 @@ extern "C" {
 /** M<->S<->C: PSYC message which contains a header and one or more message
  * parts. */
 #define GNUNET_MESSAGE_TYPE_PSYC_MESSAGE_HEADER \
-  692 // FIXME: start using this where appropriate
+        692 // FIXME: start using this where appropriate
 
 /** Message part: method */
 #define GNUNET_MESSAGE_TYPE_PSYC_MESSAGE_METHOD 693
@@ -2583,14 +2599,14 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_PEERSTORE_STORE 820
 
 /**
- * Iteration request
+ * Iteration request (see also 828, 829)
  */
-#define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE 821
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE_START 821
 
 /**
- * Iteration record message
+ * Record result message
  */
-#define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE_RECORD 822
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_RECORD 822
 
 /**
  * Iteration end message
@@ -2598,19 +2614,34 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE_END 823
 
 /**
- * Watch request
+ * Monitor request
+ */
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_MONITOR_START 824
+
+/**
+ * Monitor sync
+ */
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_MONITOR_SYNC 825
+
+/**
+ * Monitor next request
+ */
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_MONITOR_NEXT 826
+
+/**
+ * Store result message
  */
-#define GNUNET_MESSAGE_TYPE_PEERSTORE_WATCH 824
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_STORE_RESULT 827
 
 /**
- * Watch response
+ * Iteration request (see also 821, 829)
  */
-#define GNUNET_MESSAGE_TYPE_PEERSTORE_WATCH_RECORD 825
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE_NEXT 828
 
 /**
- * Watch cancel request
+ * Iteration request (see also 821, 828)
  */
-#define GNUNET_MESSAGE_TYPE_PEERSTORE_WATCH_CANCEL 826
+#define GNUNET_MESSAGE_TYPE_PEERSTORE_ITERATE_STOP 829
 
 /*******************************************************************************
  * SOCIAL message types
@@ -2747,19 +2778,6 @@ extern "C" {
  */
 #define GNUNET_MESSAGE_TYPE_XDHT_P2P_NOTIFY_SUCCESSOR_CONFIRMATION 892
 
-#if ENABLE_MALICIOUS
-/**
- * Turn X-VINE DHT service malicious
- */
-#define GNUNET_MESSAGE_TYPE_DHT_ACT_MALICIOUS 893
-
-/**
- * Acknowledge receiving ACT MALICIOUS request
- */
-#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_ACT_MALICIOUS_OK 894
-
-#endif
-
 
 /*******************************************************************************
  * Whanau DHT messages
@@ -2844,6 +2862,10 @@ extern "C" {
  */
 #define GNUNET_MESSAGE_TYPE_RPS_CS_SEED 954
 
+#ifndef ENABLE_MALICIOUS
+#define ENABLE_MALICIOUS 0
+#endif
+
 #if ENABLE_MALICIOUS
 /**
  * Turn RPS service malicious
@@ -3185,6 +3207,11 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_NAT_ADDRESS_CHANGE 1064
 
 /**
+ * Message to ask NAT service to notify all clients about a new global address.
+ */
+#define GNUNET_MESSAGE_TYPE_NAT_ADD_GLOBAL_ADDRESS 1065
+
+/**
  * Message to ask NAT service to request autoconfiguration.
  */
 #define GNUNET_MESSAGE_TYPE_NAT_AUTO_REQUEST_CFG 1067
@@ -3514,6 +3541,11 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_PAD 1461
 
 /**
+ * UDP Rekey.
+ */
+#define GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_REKEY 1462
+
+/**
  * Next available: 1500
  */
 #define GNUNET_MESSAGE_TYPE_RECLAIM_REFERENCE_DELETE 1500
@@ -3533,17 +3565,9 @@ extern "C" {
 
 #define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_CREATE 1600
 
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_UPDATE 1601
-
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_DESTROY 1602
-
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_GET_NAME 1603
+#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_DESTROY 1601
 
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_SET_NAME 1604
-
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_GET_KEY 1605
-
-#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_MEMBER_ID 1606
+#define GNUNET_MESSAGE_TYPE_MESSENGER_CONNECTION_MEMBER_ID 1602
 
 /************************************  Room  *************************************/
 
@@ -3559,6 +3583,10 @@ extern "C" {
 
 #define GNUNET_MESSAGE_TYPE_MESSENGER_ROOM_GET_MESSAGE 1616
 
+#define GNUNET_MESSAGE_TYPE_MESSENGER_ROOM_SYNC 1617
+
+#define GNUNET_MESSAGE_TYPE_MESSENGER_ROOM_LINK 1618
+
 /*********************************************************************************/
 
 /*********************************************************************************/
@@ -3585,7 +3613,36 @@ extern "C" {
 
 #define GNUNET_MESSAGE_TYPE_CMDS_HELPER_LOCAL_FINISHED 1706
 
+#define GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_REACHED 1707
+
+#define GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_ATTACH 1708
+
+#define GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_CROSSABLE 1709
+
+#define GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_ATTACHED 1710
+
+/*********************************************************************************/
+
+/*********************************************************************************/
+/**********************************  NAMESTORE (cont.)  **************************/
 /*********************************************************************************/
+/* NAMESTORE: message types 1750-1800
+ */
+
+/**
+ * Message type for start of record edit with advisory lock
+ */
+#define GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_SET_EDIT 1750
+
+/**
+ * Return record set to edit with previous editor hint/advisory lock
+ */
+#define GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_SET_EDIT_RESPONSE 1751
+
+/**
+ * Message type for cancellation/reset of editor hint/advisory lock
+ */
+#define GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_SET_EDIT_CANCEL 1752
 
 /**
  * Type used to match 'all' message types.
@@ -3605,4 +3662,6 @@ extern "C" {
 
 /** @} */ /* end of group protocols */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_protocols.h */
diff --git a/src/include/gnunet_reclaim_lib.h b/src/include/gnunet_reclaim_lib.h
index bbf1c3ad3..e4dec14fa 100644
--- a/src/include/gnunet_reclaim_lib.h
+++ b/src/include/gnunet_reclaim_lib.h
@@ -19,12 +19,15 @@
  */
 
 /**
+ * @addtogroup reclaim_suite  RECLAIM services and libraries
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
  * Identity attribute definitions
  *
- * @defgroup reclaim-attribute reclaim attributes
+ * @defgroup reclaim-attribute Reclaim attributes
  * @{
  */
 #ifndef GNUNET_RECLAIM_ATTRIBUTE_LIB_H
@@ -37,6 +40,7 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 enum GNUNET_RECLAIM_AttributeType {
@@ -512,7 +516,7 @@ GNUNET_RECLAIM_attribute_number_to_typename (uint32_t type);
 /**
  * Get required size for serialization buffer
  *
- * @param attrs the attribute list to serialize
+ * @param credentials the attribute list to serialize
  * @return the required buffer size
  */
 size_t
@@ -521,9 +525,9 @@ GNUNET_RECLAIM_credential_list_serialize_get_size (
 
 
 /**
- * Destroy claim list
+ * Destroy credential list
  *
- * @param attrs list to destroy
+ * @param credentials list to destroy
  */
 void
 GNUNET_RECLAIM_credential_list_destroy (
@@ -548,15 +552,15 @@ GNUNET_RECLAIM_credential_list_add (
 
 
 /**
- * Serialize an attribute list
+ * Serialize a credential list
  *
- * @param attrs the attribute list to serialize
- * @param result the serialized attribute
+ * @param credentials the credential list to serialize
+ * @param result the serialized credential
  * @return length of serialized data
  */
 size_t
 GNUNET_RECLAIM_credential_list_serialize (
-  const struct GNUNET_RECLAIM_CredentialList *attrs,
+  const struct GNUNET_RECLAIM_CredentialList *credentials,
   char *result);
 
 
@@ -858,4 +862,6 @@ GNUNET_RECLAIM_credential_get_presentation (
 
 /** @} */ /* end of group reclaim-attribute */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_reclaim_attribute_lib.h */
diff --git a/src/include/gnunet_reclaim_plugin.h b/src/include/gnunet_reclaim_plugin.h
index 11d5d76f7..f8b2084d2 100644
--- a/src/include/gnunet_reclaim_plugin.h
+++ b/src/include/gnunet_reclaim_plugin.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup reclaim_suite  RECLAIM services and libraries
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
@@ -30,6 +33,7 @@
 #ifndef GNUNET_RECLAIM_PLUGIN_H
 #define GNUNET_RECLAIM_PLUGIN_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_reclaim_lib.h"
 
@@ -439,3 +443,5 @@ struct GNUNET_RECLAIM_CredentialPluginFunctions
 #endif
 
 /** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_reclaim_service.h b/src/include/gnunet_reclaim_service.h
index 38e1c8735..086c3f021 100644
--- a/src/include/gnunet_reclaim_service.h
+++ b/src/include/gnunet_reclaim_service.h
@@ -19,13 +19,16 @@
  */
 
 /**
+ * @addtogroup reclaim_suite  RECLAIM services and libraries
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
  * reclaim service; implements identity and personal data sharing
  * for GNUnet
  *
- * @defgroup reclaim service
+ * @defgroup reclaim  Reclaim service
  * @{
  */
 #ifndef GNUNET_RECLAIM_SERVICE_H
@@ -38,6 +41,7 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_identity_service.h"
 #include "gnunet_reclaim_lib.h"
 #include "gnunet_util_lib.h"
@@ -45,7 +49,7 @@ extern "C" {
 /**
  * Version number of the re:claimID API.
  */
-#define GNUNET_RECLAIM_VERSION 0x00000001
+#define GNUNET_RECLAIM_VERSION 0x00000002
 
 /**
  * Opaque handle to access the service.
@@ -58,6 +62,9 @@ struct GNUNET_RECLAIM_Handle;
  */
 struct GNUNET_RECLAIM_Operation;
 
+#define GNUNET_RECLAIM_TICKET_RP_URI_MAX_LEN 256
+
+#define GNUNET_RECLAIM_TICKET_RP_URI_URN_PREFIX "urn:gns:"
 
 /**
  * The authorization ticket. This ticket is meant to be transferred
@@ -68,19 +75,30 @@ struct GNUNET_RECLAIM_Operation;
 struct GNUNET_RECLAIM_Ticket
 {
   /**
-   * The ticket issuer (= the user)
+   * The ticket. A GNS name ending in the
+   * zTLD for identity.
+   * Base32(rnd).zTLD(identity)
+   * 0-terminated string.
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  char gns_name[GNUNET_DNSPARSER_MAX_LABEL_LENGTH * 2 + 2];
 
   /**
-   * The ticket audience (= relying party)
+   * The ticket issuer (= the user)
    */
-  struct GNUNET_IDENTITY_PublicKey audience;
+  //struct GNUNET_CRYPTO_PublicKey identity;
 
   /**
    * The ticket random identifier
    */
-  struct GNUNET_RECLAIM_Identifier rnd;
+  //struct GNUNET_RECLAIM_Identifier rnd;
+
+
+  /**
+   * Followed by the ticket audience (= relying party) URI.
+   * 0-terminated string.
+   * Example: "urn:gns:000G002B4RF1XPBXDPGZA0PT16BHQCS427YQK4NC84KZMK7TK8C2Z5GMK8"
+   */
+  //char rp_uri[GNUNET_RECLAIM_TICKET_RP_URI_MAX_LEN];
 };
 
 
@@ -91,10 +109,12 @@ struct GNUNET_RECLAIM_Ticket
  *
  * @param cls closure
  * @param ticket the ticket
+ * @param rp_uri the RP URI of the ticket
  */
 typedef void (*GNUNET_RECLAIM_TicketCallback) (
   void *cls,
-  const struct GNUNET_RECLAIM_Ticket *ticket);
+  const struct GNUNET_RECLAIM_Ticket *ticket,
+  const char* rp_uri);
 
 /**
  * Method called when a token has been issued.
@@ -130,7 +150,7 @@ typedef void (*GNUNET_RECLAIM_ContinuationWithStatus) (void *cls,
  * @param attr The attribute
  */
 typedef void (*GNUNET_RECLAIM_AttributeResult) (
-  void *cls, const struct GNUNET_IDENTITY_PublicKey *identity,
+  void *cls, const struct GNUNET_CRYPTO_PublicKey *identity,
   const struct GNUNET_RECLAIM_Attribute *attr);
 
 /**
@@ -142,7 +162,7 @@ typedef void (*GNUNET_RECLAIM_AttributeResult) (
  * @param presentation The presentation for the credential (may be NULL)
  */
 typedef void (*GNUNET_RECLAIM_AttributeTicketResult) (
-  void *cls, const struct GNUNET_IDENTITY_PublicKey *identity,
+  void *cls, const struct GNUNET_CRYPTO_PublicKey *identity,
   const struct GNUNET_RECLAIM_Attribute *attr,
   const struct GNUNET_RECLAIM_Presentation *presentation);
 
@@ -156,7 +176,7 @@ typedef void (*GNUNET_RECLAIM_AttributeTicketResult) (
  * @param attributes the parsed attributes
  */
 typedef void (*GNUNET_RECLAIM_CredentialResult) (
-  void *cls, const struct GNUNET_IDENTITY_PublicKey *identity,
+  void *cls, const struct GNUNET_CRYPTO_PublicKey *identity,
   const struct GNUNET_RECLAIM_Credential *credential);
 
 
@@ -185,7 +205,7 @@ GNUNET_RECLAIM_connect (const struct GNUNET_CONFIGURATION_Handle *cfg);
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_store (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const struct GNUNET_CRYPTO_PrivateKey *pkey,
   const struct GNUNET_RECLAIM_Attribute *attr,
   const struct GNUNET_TIME_Relative *exp_interval,
   GNUNET_RECLAIM_ContinuationWithStatus cont, void *cont_cls);
@@ -197,7 +217,7 @@ GNUNET_RECLAIM_attribute_store (
    *
    * @param h handle to the re:claimID service
    * @param pkey private key of the identity
-   * @param attr the credential value
+   * @param credential the credential value
    * @param exp_interval the relative expiration interval for the credential
    * @param cont continuation to call when done
    * @param cont_cls closure for @a cont
@@ -206,7 +226,7 @@ GNUNET_RECLAIM_attribute_store (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_credential_store (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const struct GNUNET_CRYPTO_PrivateKey *pkey,
   const struct GNUNET_RECLAIM_Credential *credential,
   const struct GNUNET_TIME_Relative *exp_interval,
   GNUNET_RECLAIM_ContinuationWithStatus cont,
@@ -227,12 +247,12 @@ GNUNET_RECLAIM_credential_store (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_delete (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const struct GNUNET_CRYPTO_PrivateKey *pkey,
   const struct GNUNET_RECLAIM_Attribute *attr,
   GNUNET_RECLAIM_ContinuationWithStatus cont, void *cont_cls);
 
 /**
- * Delete a credential. Tickets used to share use a presentation of this
+ * Delete a credential. Tickets used to share a presentation of this
  * credential are updated accordingly.
  *
  * @param h handle to the re:claimID service
@@ -245,7 +265,7 @@ GNUNET_RECLAIM_attribute_delete (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_credential_delete (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const struct GNUNET_CRYPTO_PrivateKey *pkey,
   const struct GNUNET_RECLAIM_Credential *cred,
   GNUNET_RECLAIM_ContinuationWithStatus cont,
   void *cont_cls);
@@ -277,7 +297,7 @@ GNUNET_RECLAIM_credential_delete (
 struct GNUNET_RECLAIM_AttributeIterator *
 GNUNET_RECLAIM_get_attributes_start (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *identity,
+  const struct GNUNET_CRYPTO_PrivateKey *identity,
   GNUNET_SCHEDULER_TaskCallback error_cb, void *error_cb_cls,
   GNUNET_RECLAIM_AttributeResult proc, void *proc_cls,
   GNUNET_SCHEDULER_TaskCallback finish_cb, void *finish_cb_cls);
@@ -333,7 +353,7 @@ GNUNET_RECLAIM_get_attributes_stop (
 struct GNUNET_RECLAIM_CredentialIterator *
 GNUNET_RECLAIM_get_credentials_start (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *identity,
+  const struct GNUNET_CRYPTO_PrivateKey *identity,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
   GNUNET_RECLAIM_CredentialResult proc,
@@ -346,7 +366,7 @@ GNUNET_RECLAIM_get_credentials_start (
  * Calls the record processor specified in #GNUNET_RECLAIM_get_credentials_start
  * for the next record.
  *
- * @param it the iterator
+ * @param ait the iterator
  */
 void
 GNUNET_RECLAIM_get_credentials_next (
@@ -358,7 +378,7 @@ GNUNET_RECLAIM_get_credentials_next (
  * be called on any iteration that has not yet completed prior to calling
  * #GNUNET_RECLAIM_disconnect.
  *
- * @param it the iterator
+ * @param ait the iterator
  */
 void
 GNUNET_RECLAIM_get_credentials_stop (
@@ -372,7 +392,7 @@ GNUNET_RECLAIM_get_credentials_stop (
  *
  * @param h the identity provider to use
  * @param iss the issuing identity (= the user)
- * @param rp the subject of the ticket (= the relying party)
+ * @param rp_uri the subject of the ticket (= the relying party) see #GNUNET_RECLAIM_Ticket
  * @param attrs the attributes that the relying party is given access to
  * @param cb the callback
  * @param cb_cls the callback closure
@@ -381,8 +401,8 @@ GNUNET_RECLAIM_get_credentials_stop (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_ticket_issue (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *iss,
-  const struct GNUNET_IDENTITY_PublicKey *rp,
+  const struct GNUNET_CRYPTO_PrivateKey *iss,
+  const char *rp_uri,
   const struct GNUNET_RECLAIM_AttributeList *attrs,
   GNUNET_RECLAIM_IssueTicketCallback cb, void *cb_cls);
 
@@ -403,7 +423,7 @@ GNUNET_RECLAIM_ticket_issue (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_ticket_revoke (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *identity,
+  const struct GNUNET_CRYPTO_PrivateKey *identity,
   const struct GNUNET_RECLAIM_Ticket *ticket,
   GNUNET_RECLAIM_ContinuationWithStatus cb, void *cb_cls);
 
@@ -413,9 +433,8 @@ GNUNET_RECLAIM_ticket_revoke (
  * information from the issuer
  *
  * @param h the identity provider to use
- * @param identity the identity that is the subject of the issued ticket (the
- * relying party)
  * @param ticket the issued ticket to consume
+ * @param rp_uri the RP URI
  * @param cb the callback to call
  * @param cb_cls the callback closure
  * @return handle to abort the operation
@@ -423,8 +442,8 @@ GNUNET_RECLAIM_ticket_revoke (
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_ticket_consume (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *identity,
   const struct GNUNET_RECLAIM_Ticket *ticket,
+  const char *rp_uri,
   GNUNET_RECLAIM_AttributeTicketResult cb, void *cb_cls);
 
 
@@ -448,7 +467,7 @@ GNUNET_RECLAIM_ticket_consume (
 struct GNUNET_RECLAIM_TicketIterator *
 GNUNET_RECLAIM_ticket_iteration_start (
   struct GNUNET_RECLAIM_Handle *h,
-  const struct GNUNET_IDENTITY_PrivateKey *identity,
+  const struct GNUNET_CRYPTO_PrivateKey *identity,
   GNUNET_SCHEDULER_TaskCallback error_cb, void *error_cb_cls,
   GNUNET_RECLAIM_TicketCallback proc, void *proc_cls,
   GNUNET_SCHEDULER_TaskCallback finish_cb, void *finish_cb_cls);
@@ -495,7 +514,6 @@ GNUNET_RECLAIM_disconnect (struct GNUNET_RECLAIM_Handle *h);
 void
 GNUNET_RECLAIM_cancel (struct GNUNET_RECLAIM_Operation *op);
 
-
 #if 0 /* keep Emacsens' auto-indent happy */
 {
 #endif
@@ -509,4 +527,6 @@ GNUNET_RECLAIM_cancel (struct GNUNET_RECLAIM_Operation *op);
 
 /** @} */ /* end of group reclaim */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_reclaim_service.h */
diff --git a/src/include/gnunet_regex_service.h b/src/include/gnunet_regex_service.h
index a875eab90..093bf2d6a 100644
--- a/src/include/gnunet_regex_service.h
+++ b/src/include/gnunet_regex_service.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Maximilian Szengel
  * @author Christian Grothoff
  *
@@ -36,6 +39,7 @@
 #ifndef GNUNET_REGEX_SERVICE_H
 #define GNUNET_REGEX_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 
 #ifdef __cplusplus
@@ -149,3 +153,5 @@ GNUNET_REGEX_search_cancel (struct GNUNET_REGEX_Search *s);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_resolver_service.h b/src/include/gnunet_resolver_service.h
index 956e4d67e..89fec24f5 100644
--- a/src/include/gnunet_resolver_service.h
+++ b/src/include/gnunet_resolver_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup vpn_suite
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -40,6 +43,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_configuration_lib.h"
 #include "gnunet_scheduler_lib.h"
 #include "gnunet_time_lib.h"
@@ -178,4 +182,6 @@ GNUNET_RESOLVER_request_cancel (struct GNUNET_RESOLVER_RequestHandle *rh);
 
 /** @} */  /* end of group resolver */
 
+/** @} */  /* end of group addition to vpn_suite */
+
 /* end of gnunet_resolver_service.h */
diff --git a/src/include/gnunet_rest_lib.h b/src/include/gnunet_rest_lib.h
index 7e74bee76..f70500de5 100644
--- a/src/include/gnunet_rest_lib.h
+++ b/src/include/gnunet_rest_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup rest_l2  REST service and libraries
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef GNUNET_REST_LIB_H
 #define GNUNET_REST_LIB_H
 
+
 #include "gnunet_util_lib.h"
 #include <microhttpd.h>
 
@@ -137,3 +141,5 @@ GNUNET_REST_handle_request (struct GNUNET_REST_RequestHandle *conn,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_rest_plugin.h b/src/include/gnunet_rest_plugin.h
index 96454f66b..3a8af5389 100644
--- a/src/include/gnunet_rest_plugin.h
+++ b/src/include/gnunet_rest_plugin.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup rest_l2  REST service and libraries
+ * @{
+ *
  * @author Martin Schanzenbach
  *
  * @file
@@ -29,6 +32,7 @@
 #ifndef GNUNET_REST_PLUGIN_H
 #define GNUNET_REST_PLUGIN_H
 
+
 #include "gnunet_util_lib.h"
 #include "gnunet_rest_lib.h"
 #include "microhttpd.h"
@@ -59,24 +63,13 @@ struct GNUNET_REST_Plugin
    * e.g. http://hostname:port/name
    */
   char *name;
-
-  /**
-   * Function to process a REST call
-   *
-   * @param method the HTTP method called
-   * @param url the relative url accessed
-   * @param data the REST data (can be NULL)
-   * @param data_size the length of the data
-   * @param proc the callback for result
-   * @param proc_cls closure for callback
-   * @return GNUNET_YES if the request was processed
-   */
-  enum GNUNET_GenericReturnValue (*process_request)(
-    struct GNUNET_REST_RequestHandle *handle,
-    GNUNET_REST_ResultProcessor proc,
-    void *proc_cls);
 };
 
+typedef enum GNUNET_GenericReturnValue (*GNUNET_REST_ProcessingFunction)(
+  void *plugin,
+  struct GNUNET_REST_RequestHandle *handle,
+  GNUNET_REST_ResultProcessor proc,
+  void *proc_cls);
 
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
@@ -88,3 +81,5 @@ struct GNUNET_REST_Plugin
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_revocation_service.h b/src/include/gnunet_revocation_service.h
index 8cff948e2..427be62ac 100644
--- a/src/include/gnunet_revocation_service.h
+++ b/src/include/gnunet_revocation_service.h
@@ -21,9 +21,14 @@
 #ifndef GNUNET_REVOCATION_SERVICE_H_
 #define GNUNET_REVOCATION_SERVICE_H_
 
+
+#include "gnunet_gnsrecord_lib.h"
 #include "gnunet_identity_service.h"
 
 /**
+ * @addtogroup egos  Ego management
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -52,71 +57,6 @@ extern "C"
  */
 #define GNUNET_REVOCATION_VERSION 0x00000001
 
-/**
- * Maximum length of a revocation
- */
-#define GNUNET_REVOCATION_MAX_PROOF_SIZE sizeof(struct GNUNET_REVOCATION_PowP) +\
-                                         sizeof(struct GNUNET_IDENTITY_PublicKey) +\
-                                         1024 //FIXME max sig_len
-
-/**
- * The proof-of-work narrowing factor.
- * The number of PoWs that are calculates as part of revocation.
- */
-#define POW_COUNT 32
-
-
-GNUNET_NETWORK_STRUCT_BEGIN
-
-/**
- * Struct for a proof of work as part of the revocation.
- */
-struct GNUNET_REVOCATION_PowP
-{
-  /**
-   * The timestamp of the revocation
-   */
-  struct GNUNET_TIME_AbsoluteNBO timestamp;
-
-  /**
-   * The TTL of this revocation (purely informational)
-   */
-  struct GNUNET_TIME_RelativeNBO ttl;
-
-  /**
-   * The PoWs
-   */
-  uint64_t pow[POW_COUNT] GNUNET_PACKED;
-
-  /** followed by the public key type, the key and a signature **/
-};
-
-
-/**
- * The signature object we use for the PoW
- */
-struct GNUNET_REVOCATION_SignaturePurposePS
-{
-  /**
-   * The signature purpose
-   */
-  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
-
-  /**
-   * The timestamp of the revocation
-   */
-  struct GNUNET_TIME_AbsoluteNBO timestamp;
-
-  /** Followed by the zone public key type and key **/
-};
-
-GNUNET_NETWORK_STRUCT_END
-
-
-/**
- * Handle to a running proof-of-work calculation.
- */
-struct GNUNET_REVOCATION_PowCalculationHandle;
 
 /**
  * Handle for the key revocation query.
@@ -148,7 +88,7 @@ typedef void (*GNUNET_REVOCATION_Callback) (void *cls,
  */
 struct GNUNET_REVOCATION_Query *
 GNUNET_REVOCATION_query (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                         const struct GNUNET_IDENTITY_PublicKey *key,
+                         const struct GNUNET_CRYPTO_PublicKey *key,
                          GNUNET_REVOCATION_Callback func, void *func_cls);
 
 
@@ -172,7 +112,7 @@ struct GNUNET_REVOCATION_Handle;
  *
  * @param cfg the configuration to use
  * @param pow proof of work to use (should have been created by
- *            iteratively calling #GNUNET_REVOCATION_pow_round)
+ *            iteratively calling #GNUNET_CRYPTO_pow_round)
  * @param func function to call with the result of the check
  *             (called with `is_valid` being #GNUNET_NO if
  *              the revocation worked).
@@ -181,7 +121,7 @@ struct GNUNET_REVOCATION_Handle;
  */
 struct GNUNET_REVOCATION_Handle *
 GNUNET_REVOCATION_revoke (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                          const struct GNUNET_REVOCATION_PowP *pow,
+                          const struct GNUNET_GNSRECORD_PowP *pow,
                           GNUNET_REVOCATION_Callback func, void *func_cls);
 
 
@@ -194,68 +134,6 @@ void
 GNUNET_REVOCATION_revoke_cancel (struct GNUNET_REVOCATION_Handle *h);
 
 
-/**
- * Check if the given proof-of-work is valid.
- *
- * @param pow proof of work
- * @param matching_bits how many bits must match (configuration)
- * @param epoch_duration length of single epoch in configuration
- * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
- */
-enum GNUNET_GenericReturnValue
-GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
-                             unsigned int matching_bits,
-                             struct GNUNET_TIME_Relative epoch_duration);
-
-
-/**
- * Initializes a fresh PoW computation.
- *
- * @param key the key to calculate the PoW for.
- * @param pow the pow object to work with in the calculation.
- */
-void
-GNUNET_REVOCATION_pow_init (const struct GNUNET_IDENTITY_PrivateKey *key,
-                            struct GNUNET_REVOCATION_PowP *pow);
-
-
-/**
- * Starts a proof-of-work calculation given the pow object as well as
- * target epochs and difficulty.
- *
- * @param pow the PoW to based calculations on.
- * @param epochs the number of epochs for which the PoW must be valid.
- * @param difficulty the base difficulty of the PoW.
- * @return a handle for use in PoW rounds
- */
-struct GNUNET_REVOCATION_PowCalculationHandle*
-GNUNET_REVOCATION_pow_start (struct GNUNET_REVOCATION_PowP *pow,
-                             int epochs,
-                             unsigned int difficulty);
-
-
-/**
- * Calculate a single round in the key revocation PoW.
- *
- * @param pc handle to the PoW, initially called with NULL.
- * @return GNUNET_YES if the @a pow is acceptable, GNUNET_NO if not
- */
-enum GNUNET_GenericReturnValue
-GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc);
-
-
-/**
- * Stop a PoW calculation
- *
- * @param pc the calculation to clean up
- * @return #GNUNET_YES if pow valid, #GNUNET_NO if pow was set but is not
- * valid
- */
-void
-GNUNET_REVOCATION_pow_stop (struct GNUNET_REVOCATION_PowCalculationHandle *pc);
-
-size_t
-GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow);
 
 
 #if 0                           /* keep Emacsens' auto-indent happy */
@@ -268,3 +146,5 @@ GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow);
 #endif /* GNUNET_REVOCATION_SERVICE_H_ */
 
 /** @} */ /* end of group revocation */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_rps_service.h b/src/include/gnunet_rps_service.h
index a0ed675f7..85c085111 100644
--- a/src/include/gnunet_rps_service.h
+++ b/src/include/gnunet_rps_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Julius Bünger
  *
  * @file
@@ -262,3 +265,5 @@ GNUNET_RPS_disconnect (struct GNUNET_RPS_Handle *h);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_scalarproduct_service.h b/src/include/gnunet_scalarproduct_service.h
index 1d775f659..96d12db3f 100644
--- a/src/include/gnunet_scalarproduct_service.h
+++ b/src/include/gnunet_scalarproduct_service.h
@@ -31,6 +31,7 @@
 #ifndef GNUNET_SCALARPRODUCT_SERVICE_H
 #define GNUNET_SCALARPRODUCT_SERVICE_H
 #define GCRYPT_NO_DEPRECATED
+
 #include <gcrypt.h>
 
 #ifdef __cplusplus
@@ -179,7 +180,7 @@ GNUNET_SCALARPRODUCT_start_computation (
 struct GNUNET_SCALARPRODUCT_ComputationHandle *
 GNUNET_SCALARPRODUCT_accept_computation (
   const struct GNUNET_CONFIGURATION_Handle *cfg,
-  const struct GNUNET_HashCode *key,
+  const struct GNUNET_HashCode *session_key,
   const struct GNUNET_SCALARPRODUCT_Element *elements,
   uint32_t element_count,
   GNUNET_SCALARPRODUCT_ContinuationWithStatus cont,
diff --git a/src/include/gnunet_scheduler_lib.h b/src/include/gnunet_scheduler_lib.h
index 158f1d83b..0118a1535 100644
--- a/src/include/gnunet_scheduler_lib.h
+++ b/src/include/gnunet_scheduler_lib.h
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -92,6 +96,7 @@ enum GNUNET_SCHEDULER_Reason
 };
 
 
+
 #include "gnunet_time_lib.h"
 #include "gnunet_network_lib.h"
 
@@ -929,3 +934,5 @@ GNUNET_SCHEDULER_begin_async_scope (struct GNUNET_AsyncScopeId *aid);
 #endif
 
 /** @} */ /* end of group scheduler */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_secretsharing_service.h b/src/include/gnunet_secretsharing_service.h
index c13cf482a..de629b308 100644
--- a/src/include/gnunet_secretsharing_service.h
+++ b/src/include/gnunet_secretsharing_service.h
@@ -40,6 +40,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 #include "gnunet_configuration_lib.h"
diff --git a/src/include/gnunet_service_lib.h b/src/include/gnunet_service_lib.h
index ad238a0fa..0ad4fcc3c 100644
--- a/src/include/gnunet_service_lib.h
+++ b/src/include/gnunet_service_lib.h
@@ -18,7 +18,19 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
+ * @addtogroup networking
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -43,8 +55,8 @@ extern "C"
 #endif
 #endif
 
+#include "gnunet_util_lib.h"
 #include "gnunet_configuration_lib.h"
-#include "gnunet_mq_lib.h"
 
 
 /**
@@ -191,7 +203,6 @@ GNUNET_SERVICE_start (const char *service_name,
 void
 GNUNET_SERVICE_stop (struct GNUNET_SERVICE_Handle *srv);
 
-
 /**
  * Creates the "main" function for a GNUnet service.  You
  * should almost always use the #GNUNET_SERVICE_MAIN macro
@@ -246,6 +257,56 @@ GNUNET_SERVICE_run_ (int argc,
 
 
 /**
+ * Registers the GNUnet service to be scheduled as part of a monilithic
+ * libgnunet.
+ * You should almost always use the #GNUNET_SERVICE_MAIN macro
+ * instead of calling this function directly.
+ *
+ * The function will launch the service with the name @a service_name
+ * using the @a service_options to configure its shutdown
+ * behavior. Once the service is ready, the @a init_cb will be called
+ * for service-specific initialization.  @a init_cb will be given the
+ * service handler which can be used to control the service's
+ * availability.  When clients connect or disconnect, the respective
+ * @a connect_cb or @a disconnect_cb functions will be called. For
+ * messages received from the clients, the respective @a handlers will
+ * be invoked; for the closure of the handlers we use the return value
+ * from the @a connect_cb invocation of the respective client.
+ *
+ * Each handler MUST call #GNUNET_SERVICE_client_continue() after each
+ * message to receive further messages from this client.  If
+ * #GNUNET_SERVICE_client_continue() is not called within a short
+ * time, a warning will be logged. If delays are expected, services
+ * should call #GNUNET_SERVICE_client_disable_continue_warning() to
+ * disable the warning.
+ *
+ * Clients sending invalid messages (based on @a handlers) will be
+ * dropped. Additionally, clients can be dropped at any time using
+ * #GNUNET_SERVICE_client_drop().
+ *
+ * @param service_name name of the service to run
+ * @param options options controlling shutdown of the service
+ * @param service_init_cb function to call once the service is ready
+ * @param connect_cb function to call whenever a client connects
+ * @param disconnect_cb function to call whenever a client disconnects
+ * @param cls closure argument for @a service_init_cb, @a connect_cb and @a disconnect_cb
+ * @param handlers NULL-terminated array of message handlers for the service,
+ *                 the closure will be set to the value returned by
+ *                 the @a connect_cb for the respective connection
+ * @return 0 on success, non-zero on error
+ */
+int
+GNUNET_SERVICE_register_ (
+  const char *service_name,
+  enum GNUNET_SERVICE_Options options,
+  GNUNET_SERVICE_InitCallback service_init_cb,
+  GNUNET_SERVICE_ConnectHandler connect_cb,
+  GNUNET_SERVICE_DisconnectHandler disconnect_cb,
+  void *cls,
+  const struct GNUNET_MQ_MessageHandler *handlers);
+
+
+/**
  * Creates the "main" function for a GNUnet service.  You
  * MUST use this macro to define GNUnet services (except
  * for ARM, which MUST NOT use the macro).  The reason is
@@ -275,8 +336,8 @@ GNUNET_SERVICE_run_ (int argc,
  * #GNUNET_SERVICE_client_drop().
  *
  * @param service_name name of the service to run
- * @param options options controlling shutdown of the service
- * @param service_init_cb function to call once the service is ready
+ * @param service_options options controlling shutdown of the service
+ * @param init_cb function to call once the service is ready
  * @param connect_cb function to call whenever a client connects
  * @param disconnect_cb function to call whenever a client disconnects
  * @param cls closure argument for @a service_init_cb, @a connect_cb and @a disconnect_cb
@@ -302,26 +363,51 @@ GNUNET_SERVICE_run_ (int argc,
  *  GNUNET_MQ_handler_end ());
  * </code>
  */
+#ifndef HAVE_GNUNET_MONOLITH
+#define GNUNET_SERVICE_MAIN(service_name, service_options, init_cb, connect_cb, \
+                            disconnect_cb, cls, ...) \
+        int \
+        main (int argc, \
+              char *const *argv) \
+        { \
+          struct GNUNET_MQ_MessageHandler mh[] = { \
+            __VA_ARGS__ \
+          };                        \
+          return GNUNET_SERVICE_run_ (argc, \
+                                      argv, \
+                                      service_name, \
+                                      service_options, \
+                                      init_cb, \
+                                      connect_cb, \
+                                      disconnect_cb, \
+                                      cls, \
+                                      mh); \
+        }
+#else
 #define GNUNET_SERVICE_MAIN(service_name, service_options, init_cb, connect_cb, \
                             disconnect_cb, cls, ...) \
-  int \
-  main (int argc, \
-        char *const *argv) \
-  { \
-    struct GNUNET_MQ_MessageHandler mh[] = { \
-      __VA_ARGS__ \
-    };                        \
-    return GNUNET_SERVICE_run_ (argc, \
-                                argv, \
-                                service_name, \
-                                service_options, \
-                                init_cb, \
-                                connect_cb, \
-                                disconnect_cb, \
-                                cls, \
-                                mh); \
-  }
+        static int __attribute__ ((constructor)) \
+        init (void) \
+        { \
+          struct GNUNET_MQ_MessageHandler mh[] = { \
+            __VA_ARGS__ \
+          };                        \
+          return GNUNET_SERVICE_register_ (service_name, \
+                                           service_options, \
+                                           init_cb, \
+                                           connect_cb, \
+                                           disconnect_cb, \
+                                           cls, \
+                                           mh); \
+        }
+#endif
 
+/**
+ * Run the mainloop in a monolithic libgnunet.
+ * Must be called such that services are actually launched.
+ */
+void
+GNUNET_SERVICE_main (int argc, char *const *argv);
 
 /**
  * Suspend accepting connections from the listen socket temporarily.
@@ -442,4 +528,8 @@ GNUNET_SERVICE_client_persist (struct GNUNET_SERVICE_Client *c);
 
 /** @} */  /* end of group service */
 
+/** @} */ /* end of group addition to networking*/
+
+/** @} */ /* end of group addition to libgnunetutil */
+
 /* end of gnunet_service_lib.h */
diff --git a/src/include/gnunet_set_service.h b/src/include/gnunet_set_service.h
index 802a979cd..6874c9ec4 100644
--- a/src/include/gnunet_set_service.h
+++ b/src/include/gnunet_set_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Sets
+ * @{
+ *
  * @author Florian Dold
  * @author Christian Grothoff
  *
@@ -44,6 +47,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 #include "gnunet_configuration_lib.h"
@@ -365,10 +369,10 @@ GNUNET_SET_add_element (struct GNUNET_SET_Handle *set,
 
 
 /**
- * Remove an element to the given set.
- * After the element has been removed (in the sense of the
- * request being transmitted to the set service), cont will be called.
- * Calls to remove_element can be queued
+ * Remove an element to the given set. 
+ * After the element has been removed (in the sense of the request 
+ * being transmitted to the set service), @a cont will be called.  
+ * Multiple calls to GNUNET_SET_remove_element() can be queued
  *
  * @param set set to remove element from
  * @param element element to remove from the set
@@ -556,7 +560,7 @@ GNUNET_SET_element_dup (const struct GNUNET_SET_Element *element);
  * Hash a set element.
  *
  * @param element the element that should be hashed
- * @param ret_hash a pointer to where the hash of @a element
+ * @param[out] ret_hash a pointer to where the hash of @a element
  *        should be stored
  */
 void
@@ -574,3 +578,5 @@ GNUNET_SET_element_hash (const struct GNUNET_SET_Element *element,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_seti_service.h b/src/include/gnunet_seti_service.h
index 5cf35e0cd..9125ae825 100644
--- a/src/include/gnunet_seti_service.h
+++ b/src/include/gnunet_seti_service.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Sets
+ * @{
+ *
  * @author Florian Dold
  * @author Christian Grothoff
  *
@@ -41,6 +44,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 #include "gnunet_configuration_lib.h"
@@ -367,3 +371,5 @@ GNUNET_SETI_element_hash (const struct GNUNET_SETI_Element *element,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_setu_service.h b/src/include/gnunet_setu_service.h
index 1d7e48402..89a50f138 100644
--- a/src/include/gnunet_setu_service.h
+++ b/src/include/gnunet_setu_service.h
@@ -18,6 +18,9 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Sets
+ * @{
+ *
  * @author Florian Dold
  * @author Christian Grothoff
  *
@@ -41,6 +44,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 #include "gnunet_time_lib.h"
 #include "gnunet_configuration_lib.h"
@@ -288,9 +292,9 @@ GNUNET_SETU_destroy (struct GNUNET_SETU_Handle *set);
 
 
 /**
- * Prepare a set operation to be evaluated with another peer.  The evaluation
- * will not start until the client provides a local set with
- * GNUNET_SETU_commit().
+ * Prepare a set operation to be evaluated with another peer.
+ * The evaluation will not start until the client provides a 
+ * local set with GNUNET_SETU_commit().
  *
  * @param other_peer peer with the other set
  * @param app_id hash for the application using the set
@@ -412,3 +416,5 @@ GNUNET_SETU_element_hash (const struct GNUNET_SETU_Element *element,
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_signal_lib.h b/src/include/gnunet_signal_lib.h
index 5a14a2d9e..02fbbf005 100644
--- a/src/include/gnunet_signal_lib.h
+++ b/src/include/gnunet_signal_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -105,4 +113,6 @@ GNUNET_SIGNAL_raise (const int sig);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_signal_lib.h */
diff --git a/src/include/gnunet_signatures.h b/src/include/gnunet_signatures.h
index 7c0c1d104..6ec30bf71 100644
--- a/src/include/gnunet_signatures.h
+++ b/src/include/gnunet_signatures.h
@@ -1,6 +1,6 @@
 /*
-     This file is part of GNUnet.
-     Copyright (C) 2009 GNUnet e.V.
+     This file is part of GNUnet
+     Copyright (C) 2012-2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -17,250 +17,238 @@
 
      SPDX-License-Identifier: AGPL3.0-or-later
  */
+#ifndef GNUNET_SIGNATURES_H
+#define GNUNET_SIGNATURES_H
 
 /**
- * @author Christian Grothoff
- *
- * @file
- * Constants for network signatures
- *
- * @defgroup signatures  Network signature definitions
- * @{
+ * WARNING:
+ * This header is generated!
+ * In order to add a signature purpose, you must register
+ * them in GANA, and then use the header generation script
+ * to create an update of this file. You may then replace this
+ * file with the update.
  */
 
-#ifndef GNUNET_SIGNATURES_H
-#define GNUNET_SIGNATURES_H
+
 
 #ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
 }
 #endif
 #endif
 
+
 /**
- * Test signature, not valid for anything other than writing
- * a test. (Note that the signature verification code will
- * accept this value).
+ * Network signature purpose definitions.  Note that all values
+ * must be uint32_t and encoded in network byte order in the structs.
+ */
+
+
+
+/**
+ * Test signature, not valid for anything other than writing a test. (Note that the signature verification code will accept this value). (GNUnet)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TEST 0
 
+
 /**
- * Signature for confirming that this peer uses a particular address.
+ * Signature for confirming that this peer uses a particular address. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN 1
 
+
 /**
- * Signature for confirming that this peer intends to disconnect.
+ * Signature for confirming that this peer intends to disconnect. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DISCONNECT 2
 
+
 /**
- * Signature for confirming a key revocation.
+ * GNS zone key revocation (GNS)
  */
-#define GNUNET_SIGNATURE_PURPOSE_REVOCATION 3
+#define GNUNET_SIGNATURE_PURPOSE_GNS_REVOCATION 3
+
 
 /**
- * Signature for a namespace/pseudonym advertisement (by
- * the namespace owner).
+ * Signature for a namespace/pseudonym advertisement (by the namespace owner). (GNUnet-FS)
  */
 #define GNUNET_SIGNATURE_PURPOSE_NAMESPACE_ADVERTISEMENT 4
 
+
 /**
- * Signature by which a peer affirms that it is
- * providing a certain bit of content (used
- * in LOCation URIs).
+ * Signature by which a peer affirms that it is providing a certain bit of content for use in LOCation URIs. (GNUnet-FS)
  */
 #define GNUNET_SIGNATURE_PURPOSE_PEER_PLACEMENT 5
 
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_KBLOCK 6
 
 /**
- * Obsolete, legacy value.
+ * Signature by which a peer affirms that it forwarded a message in the DHT. (GNUnet-DHT)
  */
-#define GNUNET_SIGNATURE_PURPOSE_FS_SBLOCK 7
+#define GNUNET_SIGNATURE_PURPOSE_DHT_HOP 6
 
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_NBLOCK 8
 
 /**
- * Obsolete, legacy value.
+ * Signature by which a peer affirms its address. (GNUnet-HELLO)
  */
-#define GNUNET_SIGNATURE_PURPOSE_FS_NBLOCK_KSIG 9
+#define GNUNET_SIGNATURE_PURPOSE_HELLO 7
 
-/**
- *
- */
-#define GNUNET_SIGNATURE_PURPOSE_RESOLVER_RESPONSE 10
 
 /**
- * Signature of an GNUNET_DNS_Advertisement
+ * Signature on a GNUNET_DNS_Advertisement. (GNUnet-DNS+Exit)
  */
 #define GNUNET_SIGNATURE_PURPOSE_DNS_RECORD 11
 
+
 /**
- * Signature of a chat message.
+ * Signature of a chat message. (GNUnet-MESSENGER)
  */
 #define GNUNET_SIGNATURE_PURPOSE_CHAT_MESSAGE 12
 
+
 /**
- * Signature of confirmation receipt for a chat message.
+ * Signature of confirmation receipt for a chat message. (GNUnet-MESSENGER)
  */
 #define GNUNET_SIGNATURE_PURPOSE_CHAT_RECEIPT 13
 
+
 /**
- * Signature of a network size estimate message.
+ * Signature of a network size estimate message. (GNUnet-NSE)
  */
 #define GNUNET_SIGNATURE_PURPOSE_NSE_SEND 14
 
+
 /**
- * Signature of a gnunet naming system record block
+ * GNS record set signature (GNS)
  */
 #define GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN 15
 
+
 /**
- * Purpose is to set a session key.
+ * Purpose is to set a session key. (GNUnet-CORE)
  */
 #define GNUNET_SIGNATURE_PURPOSE_SET_ECC_KEY 16
 
+
 /**
- * UBlock Signature, done using DSS, not ECC
+ * UBlock Signature, done using DSS, not ECC (GNUnet-FS)
  */
 #define GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK 17
 
+
 /**
- * Accept state in regex DFA.  Peer affirms that
- * it offers the matching service.
+ * Accept state in regex DFA.  Peer affirms that it offers the matching service. (GNUnet-REGEX)
  */
 #define GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT 18
 
-/**
- * Signature of a multicast message sent by the origin.
- */
-#define GNUNET_SIGNATURE_PURPOSE_MULTICAST_MESSAGE 19
 
 /**
- * Signature of a conversation ring.
+ * Signature of a conversation ring. (GNUnet-CONVERSATION)
  */
 #define GNUNET_SIGNATURE_PURPOSE_CONVERSATION_RING 20
 
+
 /**
- * Signature for the first round of distributed key generation.
+ * Signature for the first round of distributed key generation. (GNUnet-SECRETSHARING)
  */
 #define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG1 21
 
-/**
- * Signature for the second round of distributed key generation.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG2 22
 
 /**
- * Signature for cooperatice decryption.
+ * Signature for the second round of distributed key generation. (GNUnet-SECRETSHARING)
  */
-#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DECRYPTION 23
+#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG2 22
 
-/**
- * Signature of a multicast request sent by a member.
- */
-#define GNUNET_SIGNATURE_PURPOSE_MULTICAST_REQUEST 24
 
 /**
- * Signature for a sensor anomaly report message.
+ * Signature for the cooperative decryption. (GNUnet-SECRETSHARING)
  */
-#define GNUNET_SIGNATURE_PURPOSE_SENSOR_ANOMALY_REPORT 25
+#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DECRYPTION 23
 
-/**
- * Signature for a GNUid Token
- */
-#define GNUNET_SIGNATURE_PURPOSE_GNUID_TOKEN 26
 
 /**
- * Signature for a GNUid Ticket
+ * Signature for a GNUid Ticket (Reclaim)
  */
 #define GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN 27
 
+
 /**
- * Signature for a GNUnet credential
+ * Signature for a GNUnet credential (Reclaim)
  */
 #define GNUNET_SIGNATURE_PURPOSE_DELEGATE 28
 
+
 /**
- * Signature by a peer affirming that this is one of its
- * addresses (for the given time period).
+ * Signature by a peer affirming that this is one of its addresses for the given time period. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS 29
 
+
 /**
- * Signature by a peer affirming that the given ephemeral
- * key is currently in use by that peer's transport service.
+ * Signature by a peer affirming that the given ephemeral key is currently in use by that peer's transport service. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL 30
 
+
 /**
- * Signature used by TCP communicator handshake,
+ * Signature used by TCP communicator handshake. (GNUnet-TRANSPORT-TCP)
  */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE 31
+#define GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE 31
+
 
 /**
- * Signature used by TCP communicator rekey.
+ * Signature used by TCP communicator rekey. (GNUnet-TRANSPORT-TCP)
  */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY 32
+#define GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY 32
+
 
 /**
- * Signature used by UDP communicator handshake
+ * Signature used by UDP communicator handshake. (GNUnet-TRANSPORT-UDP)
  */
-#define GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE 33
+#define GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE 33
+
 
 /**
- * Signature used by UDP broadcasts.
+ * Signature used by UDP broadcasts. (GNUnet-TRANSPORT-UDP)
  */
-#define GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST 34
+#define GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST 34
+
 
 /**
- * Signature by a peer affirming that it received a
- * challenge (and stating how long it expects the
- * address on which the challenge was received to
- * remain valid).
+ * Signature by a peer affirming that it received a challenge (and stating how long it expects the address on which the challenge was received to remain valid). (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_CHALLENGE 35
 
+
 /**
- * Signature by a peer affirming that it is on a DV path.
+ * Signature by a peer affirming that it is on a DV path. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_HOP 36
 
+
 /**
- * Signature by a peer affirming that it originated the
- * DV path.
+ * Signature by a peer affirming that it originated the DV path. (GNUnet-TRANSPORT)
  */
 #define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_INITIATOR 37
 
+
 /**
- * Signature by a peer that like to create a connection.
+ * Signature by a peer that like to create a connection. (GNUnet-CADET)
  */
 #define GNUNET_SIGNATURE_PURPOSE_CADET_CONNECTION_INITIATOR 38
 
+
 /**
- * Signature by a peer sending back the nonce received at initial handshake.
+ * Signature by a peer sending back the nonce received at initial handshake. (GNUnet-TRANSPORT-TCP)
  */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK 39
+#define GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK 39
 
-#if 0                           /* keep Emacsens' auto-indent happy */
+
+#if 0 /* keep Emacsens' auto-indent happy */
 {
 #endif
 #ifdef __cplusplus
 }
 #endif
 
-/* ifndef GNUNET_SIGNATURES_H */
 #endif
-
-/** @} */  /* end of group */
-
-/* end of gnunet_signatures.h */
diff --git a/src/include/gnunet_socks.h b/src/include/gnunet_socks.h
index 1a6ae1119..98a27cd1a 100644
--- a/src/include/gnunet_socks.h
+++ b/src/include/gnunet_socks.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * @{
+ *
  * @author Jeffrey Burdges
  *
  * @file
@@ -40,6 +43,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 
 
@@ -81,4 +85,6 @@ GNUNET_SOCKS_do_connect (const char *service_name,
 
 /** @} */  /* end of group */
 
+/** @} */  /* end of group addition to libgnunetutil */
+
 /* end of gnunet_socks.h */
diff --git a/src/include/gnunet_speaker_lib.h b/src/include/gnunet_speaker_lib.h
index 71a7c2166..c6bb128dd 100644
--- a/src/include/gnunet_speaker_lib.h
+++ b/src/include/gnunet_speaker_lib.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup conversation_l2  Conversation service and libraries
+ * @{
+ *
  * @author Simon Dieterle
  * @author Andreas Fuchs
  * @author Christian Grothoff
@@ -41,6 +44,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -142,4 +146,6 @@ GNUNET_SPEAKER_destroy (struct GNUNET_SPEAKER_Handle *speaker);
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_speaker_lib.h */
diff --git a/src/include/gnunet_sq_lib.h b/src/include/gnunet_sq_lib.h
index 21ce5b393..b84e6759a 100644
--- a/src/include/gnunet_sq_lib.h
+++ b/src/include/gnunet_sq_lib.h
@@ -25,6 +25,7 @@
 #ifndef GNUNET_SQ_LIB_H
 #define GNUNET_SQ_LIB_H
 
+
 #include <sqlite3.h>
 #include "gnunet_util_lib.h"
 
@@ -40,7 +41,7 @@
  *            so immediately suitable for passing to `sqlite3_bind`-functions.
  * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_SQ_QueryConverter)(void *cls,
                             const void *data,
                             size_t data_len,
@@ -91,7 +92,7 @@ struct GNUNET_SQ_QueryParam
  * @a ptr_size bytes.
  *
  * @param ptr pointer to the query parameter to pass
- * @oaran ptr_size number of bytes in @a ptr
+ * @param ptr_size number of bytes in @a ptr
  */
 struct GNUNET_SQ_QueryParam
 GNUNET_SQ_query_param_fixed_size (const void *ptr,
@@ -156,8 +157,8 @@ GNUNET_SQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x);
  * @param x pointer to the query parameter to pass
  */
 struct GNUNET_SQ_QueryParam
-GNUNET_SQ_query_param_absolute_time_nbo (const struct
-                                         GNUNET_TIME_AbsoluteNBO *x);
+GNUNET_SQ_query_param_absolute_time_nbo (
+  const struct GNUNET_TIME_AbsoluteNBO *x);
 
 
 /**
@@ -194,7 +195,7 @@ GNUNET_SQ_query_param_uint64 (const uint64_t *x);
  * @param params parameters to the statement
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_SQ_bind (sqlite3_stmt *stmt,
                 const struct GNUNET_SQ_QueryParam *params);
 
@@ -222,7 +223,7 @@ GNUNET_SQ_reset (sqlite3 *dbh,
  *   #GNUNET_YES if all results could be extracted
  *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_SQ_ResultConverter)(void *cls,
                              sqlite3_stmt *result,
                              unsigned int column,
@@ -436,7 +437,7 @@ GNUNET_SQ_result_spec_uint64 (uint64_t *u64);
  *   #GNUNET_OK if all results could be extracted
  *   #GNUNET_SYSERR if a result was invalid (non-existing field)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_SQ_extract_result (sqlite3_stmt *result,
                           struct GNUNET_SQ_ResultSpec *rs);
 
@@ -498,7 +499,7 @@ GNUNET_SQ_make_prepare (const char *sql,
  * @param ps array of statements to prepare
  * @return #GNUNET_OK on success
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_SQ_prepare (sqlite3 *dbh,
                    const struct GNUNET_SQ_PrepareStatement *ps);
 
@@ -520,7 +521,7 @@ struct GNUNET_SQ_ExecuteStatement
   /**
    * Should we ignore errors?
    */
-  int ignore_errors;
+  bool ignore_errors;
 };
 
 
@@ -560,7 +561,7 @@ GNUNET_SQ_make_try_execute (const char *sql);
  * @return #GNUNET_OK on success (modulo statements where errors can be ignored)
  *         #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_SQ_exec_statements (sqlite3 *dbh,
                            const struct GNUNET_SQ_ExecuteStatement *es);
 
diff --git a/src/include/gnunet_statistics_service.h b/src/include/gnunet_statistics_service.h
index 20e958865..0fe09e69a 100644
--- a/src/include/gnunet_statistics_service.h
+++ b/src/include/gnunet_statistics_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -47,6 +50,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -227,4 +231,6 @@ GNUNET_STATISTICS_update (struct GNUNET_STATISTICS_Handle *handle,
 
 /** @} */ /* end of group statistics */
 
+/** @} */ /* end of group addition */
+
 #endif
diff --git a/src/include/gnunet_strings_lib.h b/src/include/gnunet_strings_lib.h
index 977c2ead7..df70c5e8f 100644
--- a/src/include/gnunet_strings_lib.h
+++ b/src/include/gnunet_strings_lib.h
@@ -18,7 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  * @author Krista Bennett
  * @author Gerd Knorr <kraxel@bytesex.org>
@@ -33,6 +41,10 @@
  * @{
  */
 
+#if ! defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 #ifndef GNUNET_STRINGS_LIB_H
 #define GNUNET_STRINGS_LIB_H
 
@@ -40,6 +52,7 @@
    or unsigned long long, this IS platform dependent;
    but "stdlib.h" should be portable 'enough' to be
    unconditionally available... */
+
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
@@ -63,7 +76,7 @@ extern "C"
  * @param size set to the size in bytes
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
                                     unsigned long long *size);
 
@@ -76,7 +89,7 @@ GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
  * @param rtime set to the relative time
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
                                        struct GNUNET_TIME_Relative *rtime);
 
@@ -91,12 +104,27 @@ GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
  * @param atime set to the absolute time
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_absolute (const char *fancy_time,
                                        struct GNUNET_TIME_Absolute *atime);
 
 
 /**
+ * @ingroup time
+ * Convert a given fancy human-readable time to our internal
+ * representation.  The human-readable time is expected to be
+ * in local time, whereas the returned value will be in UTC.
+ *
+ * @param fancy_time human readable string (e.g. %Y-%m-%d %H:%M:%S)
+ * @param atime set to the absolute time
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_timestamp (const char *fancy_time,
+                                        struct GNUNET_TIME_Timestamp *atime);
+
+
+/**
  * Convert a given filesize into a fancy human-readable format.
  *
  * @param size number of bytes
@@ -143,6 +171,16 @@ GNUNET_STRINGS_to_utf8 (const char *input,
 
 
 /**
+ * Normalize the utf-8 input string to NFC.
+ *
+ * @param input input string
+ * @return result (freshly allocated) or NULL on error.
+ */
+char*
+GNUNET_STRINGS_utf8_normalize (const char *input);
+
+
+/**
  * Convert the len bytes-long UTF-8 string
  * given in input to the given charset.
  *
@@ -165,8 +203,9 @@ GNUNET_STRINGS_from_utf8 (const char *input,
  *
  * @param input input string
  * @param output output buffer
+ * @return GNUNET_OK on success
  */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_tolower (const char *input,
                              char *output);
 
@@ -177,8 +216,9 @@ GNUNET_STRINGS_utf8_tolower (const char *input,
  *
  * @param input input string
  * @param output output buffer
+ * @return #GNUNET_OK on success
  */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_toupper (const char *input,
                              char *output);
 
@@ -370,15 +410,19 @@ GNUNET_STRINGS_base64_encode (const void *in,
 /**
  * url/percent encode (RFC3986).
  *
+ * FIXME: awkward API, @a len is not actually used
+ * @a out is 0-terminated, should probably be changed
+ * to only input @a data and directly return @out or NULL.
+ *
  * @param data the data to decode
  * @param len the length of the input
- * @param output where to write the output (*output should be NULL,
+ * @param out where to write the output (*out should be NULL,
  *   is allocated)
  * @return the size of the output
  */
 size_t
-GNUNET_STRINGS_urlencode (const char *data,
-                          size_t len,
+GNUNET_STRINGS_urlencode (size_t len,
+                          const char data[static len],
                           char **out);
 
 
@@ -417,7 +461,7 @@ GNUNET_STRINGS_base64_decode (const char *data,
  *
  * @param data the data to decode
  * @param len the length of the input
- * @param output where to write the output (*output should be NULL,
+ * @param out where to write the output (*out should be NULL,
  *   is allocated)
  * @return the size of the output
  */
@@ -431,7 +475,7 @@ GNUNET_STRINGS_base64url_decode (const char *data,
  *
  * @param data the data to encode
  * @param len the length of the input
- * @param output where to write the output (*output should be NULL,
+ * @param[out] out where to write the output (*output should be NULL,
  *   is allocated)
  * @return the size of the output
  */
@@ -442,18 +486,6 @@ GNUNET_STRINGS_urldecode (const char *data,
 
 
 /**
- * Convert a peer path to a human-readable string.
- *
- * @param pids array of PIDs to convert to a string
- * @param num_pids length of the @a pids array
- * @return string representing the array of @a pids
- */
-char *
-GNUNET_STRINGS_pp2s (const struct GNUNET_PeerIdentity *pids,
-                     unsigned int num_pids);
-
-
-/**
  * Parse a path that might be an URI.
  *
  * @param path path to parse. Must be NULL-terminated.
@@ -550,7 +582,7 @@ GNUNET_STRINGS_check_filename (const char *filename,
  */
 enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_to_address_ipv6 (const char *zt_addr,
-                                uint16_t addrlen,
+                                size_t addrlen,
                                 struct sockaddr_in6 *r_buf);
 
 
@@ -566,7 +598,7 @@ GNUNET_STRINGS_to_address_ipv6 (const char *zt_addr,
  */
 enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_to_address_ipv4 (const char *zt_addr,
-                                uint16_t addrlen,
+                                size_t addrlen,
                                 struct sockaddr_in *r_buf);
 
 
@@ -642,6 +674,23 @@ GNUNET_strlcpy (char *dst,
                 size_t n);
 
 
+/**
+ * Sometimes we use the binary name to determine which specific
+ * test to run.  In those cases, the string after the last "_"
+ * in 'argv[0]' specifies a string that determines the configuration
+ * file or plugin to use.
+ *
+ * This function returns the respective substring, taking care
+ * of issues such as binaries ending in '.exe' on W32.
+ *
+ * @param argv0 the name of the binary
+ * @return string between the last '_' and the '.exe' (or the end of the string),
+ *         NULL if argv0 has no '_'
+ */
+char *
+GNUNET_STRINGS_get_suffix_from_binary_name (const char *argv0);
+
+
 /* ***************** IPv4/IPv6 parsing ****************** */
 
 struct GNUNET_STRINGS_PortPolicy
@@ -750,4 +799,6 @@ GNUNET_STRINGS_parse_ipv6_policy (const char *routeListX);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_util_string.h */
diff --git a/src/include/gnunet_testbed_lib.h b/src/include/gnunet_testbed_lib.h
new file mode 100644
index 000000000..e33f31ee1
--- /dev/null
+++ b/src/include/gnunet_testbed_lib.h
@@ -0,0 +1,130 @@
+#ifndef GNUNET_TESTBED_LIB_H
+#define GNUNET_TESTBED_LIB_H
+
+/**
+ * FIXME.
+ */
+struct GNUNET_TESTBED_System;
+
+#define GNUNET_TESTBED_PREFIX "GNUNET_TESTBED_PREFIX"
+
+/**
+ * Create a system handle.  There must only be one system
+ * handle per operating system.
+ *
+ * @param testdir only the directory name without any path. This is used for
+ *          all service homes; the directory will be created in a temporary
+ *          location depending on the underlying OS.  This variable will be
+ *          overridden with the value of the environmental variable
+ *          GNUNET_TESTBED_PREFIX, if it exists.
+ * @param trusted_ip the ip address which will be set as TRUSTED HOST in all
+ *          service configurations generated to allow control connections from
+ *          this ip. This can either be a single ip address or a network address
+ *          in CIDR notation.
+ * @param hostname the hostname of the system we are using for testing; NULL for
+ *          localhost
+ * @param lowport lowest port number this system is allowed to allocate (inclusive)
+ * @param highport highest port number this system is allowed to allocate (exclusive)
+ * @return handle to this system, NULL on error
+ */
+struct GNUNET_TESTBED_System *
+GNUNET_TESTBED_system_create_with_portrange (
+  const char *testdir,
+  const char *trusted_ip,
+  const char *hostname,
+  uint16_t lowport,
+  uint16_t highport);
+
+
+/**
+ * Create a system handle.  There must only be one system handle per operating
+ * system.  Uses a default range for allowed ports.  Ports are still tested for
+ * availability.
+ *
+ * @param testdir only the directory name without any path. This is used for all
+ *          service homes; the directory will be created in a temporary location
+ *          depending on the underlying OS.  This variable will be
+ *          overridden with the value of the environmental variable
+ *          GNUNET_TESTBED_PREFIX, if it exists.
+ * @param trusted_ip the ip address which will be set as TRUSTED HOST in all
+ *          service configurations generated to allow control connections from
+ *          this ip. This can either be a single ip address or a network address
+ *          in CIDR notation.
+ * @param hostname the hostname of the system we are using for testing; NULL for
+ *          localhost
+ * @param shared_services NULL terminated array describing services that are to
+ *          be shared among peers
+ * @return handle to this system, NULL on error
+ */
+struct GNUNET_TESTBED_System *
+GNUNET_TESTBED_system_create (
+  const char *testdir,
+  const char *trusted_ip,
+  const char *hostname);
+
+
+/**
+ * Free system resources.
+ *
+ * @param system system to be freed
+ * @param remove_paths should the 'testdir' and all subdirectories
+ *        be removed (clean up on shutdown)?
+ */
+void
+GNUNET_TESTBED_system_destroy (
+  struct GNUNET_TESTBED_System *system,
+  bool remove_paths);
+
+
+/**
+ * Reserve a TCP or UDP port for a peer.
+ *
+ * @param system system to use for reservation tracking
+ * @return 0 if no free port was available
+ */
+uint16_t
+GNUNET_TESTBED_reserve_port (
+  struct GNUNET_TESTBED_System *system);
+
+
+/**
+ * Release reservation of a TCP or UDP port for a peer
+ * (used during #GNUNET_TESTBED_peer_destroy()).
+ *
+ * @param system system to use for reservation tracking
+ * @param port reserved port to release
+ */
+void
+GNUNET_TESTBED_release_port (
+  struct GNUNET_TESTBED_System *system,
+  uint16_t port);
+
+
+/**
+ * Create a new configuration using the given configuration as a template;
+ * ports and paths will be modified to select available ports on the local
+ * system. The default configuration will be available in PATHS section under
+ * the option DEFAULTCONFIG after the call. GNUNET_HOME is also set in PATHS
+ * section to the temporary directory specific to this configuration. If we run
+ * out of "*port" numbers, return #GNUNET_SYSERR.
+ *
+ * This is primarily a helper function used internally
+ * by 'GNUNET_TESTBED_peer_configure'.
+ *
+ * @param system system to use to coordinate resource usage
+ * @param cfg template configuration to update
+ * @param ports array with port numbers used in the created configuration.
+ *          Will be updated upon successful return.  Can be NULL
+ * @param nports the size of the `ports' array.  Will be updated.
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error - the configuration will
+ *           be incomplete and should not be used there upon
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_TESTBED_configuration_create (
+  struct GNUNET_TESTBED_System *system,
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  uint16_t **ports,
+  unsigned int *nports);
+
+
+#endif
diff --git a/src/include/gnunet_testbed_logger_service.h b/src/include/gnunet_testbed_logger_service.h
deleted file mode 100644
index 72b5ab364..000000000
--- a/src/include/gnunet_testbed_logger_service.h
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
-      This file is part of GNUnet
-      Copyright (C) 2008--2013 GNUnet e.V.
-
-      GNUnet is free software: you can redistribute it and/or modify it
-      under the terms of the GNU Affero General Public License as published
-      by the Free Software Foundation, either version 3 of the License,
-      or (at your option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      Affero General Public License for more details.
-
-      You should have received a copy of the GNU Affero General Public License
-      along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Sree Harsha Totakura <sreeharsha@totakura.in>
- *
- * @file
- * API for submitting data to the testbed logger service
- *
- * @defgroup testbed-logger  Testbed Logger service
- * Submit data to the testbed logger service.
- * @{
- */
-
-#ifndef GNUNET_TESTBED_LOGGER_SERVICE_H
-#define GNUNET_TESTBED_LOGGER_SERVICE_H
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-
-/**
- * Opaque handle for the logging service
- */
-struct GNUNET_TESTBED_LOGGER_Handle;
-
-
-/**
- * Connect to the testbed logger service
- *
- * @param cfg configuration to use
- * @return the handle which can be used for sending data to the service; NULL
- *           upon any error
- */
-struct GNUNET_TESTBED_LOGGER_Handle *
-GNUNET_TESTBED_LOGGER_connect (const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Disconnect from the logger service.  Also cancels any pending send handles.
- *
- * @param h the logger handle
- */
-void
-GNUNET_TESTBED_LOGGER_disconnect (struct GNUNET_TESTBED_LOGGER_Handle *h);
-
-
-/**
- * Functions of this type are called to notify a successful transmission of the
- * message to the logger service.
- *
- * @param cls the closure given to GNUNET_TESTBED_LOGGER_send()
- * @param size the amount of data sent
- */
-typedef void
-(*GNUNET_TESTBED_LOGGER_FlushCompletion) (void *cls,
-                                          size_t size);
-
-
-/**
- * Send data to be logged to the logger service.  The data will be buffered and
- * will be sent upon an explicit call to GNUNET_TESTBED_LOGGER_flush() or upon
- * exceeding a threshold size.
- *
- * @param h the logger handle
- * @param data the data to send;
- * @param size how many bytes of @a data to send
- */
-void
-GNUNET_TESTBED_LOGGER_write (struct GNUNET_TESTBED_LOGGER_Handle *h,
-                             const void *data,
-                             size_t size);
-
-
-/**
- * Flush the buffered data to the logger service
- *
- * @param h the logger handle
- * @param cb the callback to call after the data is flushed
- * @param cb_cls the closure for @a cb
- */
-void
-GNUNET_TESTBED_LOGGER_flush (struct GNUNET_TESTBED_LOGGER_Handle *h,
-                             GNUNET_TESTBED_LOGGER_FlushCompletion cb,
-                             void *cb_cls);
-
-
-/**
- * Cancel notification upon flush.  Should only be used when the flush
- * completion callback given to GNUNET_TESTBED_LOGGER_flush() is not already
- * called.
- *
- * @param h the logger handle
- */
-void
-GNUNET_TESTBED_LOGGER_flush_cancel (struct GNUNET_TESTBED_LOGGER_Handle *h);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif  /* GNUNET_TESTBED_LOGGER_SERVICE_H */
-
-/** @} */  /* end of group */
-
-/* End of gnunet_testbed_logger_service.h */
diff --git a/src/include/gnunet_testbed_service.h b/src/include/gnunet_testbed_service.h
deleted file mode 100644
index 888c6e391..000000000
--- a/src/include/gnunet_testbed_service.h
+++ /dev/null
@@ -1,1729 +0,0 @@
-/*
-      This file is part of GNUnet
-      Copyright (C) 2008--2013 GNUnet e.V.
-
-      GNUnet is free software: you can redistribute it and/or modify it
-      under the terms of the GNU Affero General Public License as published
-      by the Free Software Foundation, either version 3 of the License,
-      or (at your option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      Affero General Public License for more details.
-
-      You should have received a copy of the GNU Affero General Public License
-      along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * API for writing tests and creating large-scale emulation testbeds for GNUnet.
- *
- * @defgroup testbed  Testbed service
- * Writing tests and creating large-scale emulation testbeds for GNUnet.
- *
- * @see [Documentation](https://docs.gnunet.org/handbook/gnunet.html#TESTBED-Subsystem)
- *
- * @{
- */
-
-#ifndef GNUNET_TESTBED_SERVICE_H
-#define GNUNET_TESTBED_SERVICE_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_testing_lib.h"
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
-/**
- * Opaque handle to a host running experiments managed by the testbed framework.
- * The master process must be able to SSH to this host without password (via
- * ssh-agent).
- */
-struct GNUNET_TESTBED_Host;
-
-/**
- * Opaque handle to a peer controlled by the testbed framework.  A peer runs
- * at a particular host.
- */
-struct GNUNET_TESTBED_Peer;
-
-/**
- * Opaque handle to an abstract operation to be executed by the testbed framework.
- */
-struct GNUNET_TESTBED_Operation;
-
-/**
- * Handle to interact with a GNUnet testbed controller.  Each
- * controller has at least one master handle which is created when the
- * controller is created; this master handle interacts with the
- * controller process, destroying it destroys the controller (by
- * closing stdin of the controller process).  Additionally,
- * controllers can interact with each other (in a P2P fashion); those
- * links are established via TCP/IP on the controller's service port.
- */
-struct GNUNET_TESTBED_Controller;
-
-
-/**
- * Create a host to run peers and controllers on.
- *
- * @param hostname name of the host, use "NULL" for localhost
- * @param username username to use for the login; may be NULL
- * @param cfg the configuration to use as a template while starting a controller
- *          on this host.  Operation queue sizes specific to a host are also
- *          read from this configuration handle
- * @param port port number to use for ssh; use 0 to let ssh decide
- * @return handle to the host, NULL on error
- */
-struct GNUNET_TESTBED_Host *
-GNUNET_TESTBED_host_create (const char *hostname,
-                            const char *username,
-                            const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            uint16_t port);
-
-
-/**
- * Create a host to run peers and controllers on.  This function is used
- * if a peer learns about a host via IPC between controllers (and thus
- * some higher-level controller has already determined the unique IDs).
- *
- * @param id global host ID assigned to the host; 0 is
- *        reserved to always mean 'localhost'
- * @param hostname name of the host, use "NULL" for localhost
- * @param username username to use for the login; may be NULL
- * @param cfg the configuration to use as a template while starting a controller
- *          on this host.  Operation queue sizes specific to a host are also
- *          read from this configuration handle
- * @param port port number to use for ssh; use 0 to let ssh decide
- * @return handle to the host, NULL on error
- */
-struct GNUNET_TESTBED_Host *
-GNUNET_TESTBED_host_create_with_id (uint32_t id,
-                                    const char *hostname,
-                                    const char *username,
-                                    const struct GNUNET_CONFIGURATION_Handle
-                                    *cfg,
-                                    uint16_t port);
-
-
-/**
- * Load a set of hosts from a configuration file.  The hostfile format is
- * specified at https://gnunet.org/content/hosts-file-format
- *
- * @param filename file with the host specification
- * @param cfg the configuration to use as a template while starting a controller
- *          on any of the loaded hosts.  Operation queue sizes specific to a host
- *          are also read from this configuration handle
- * @param hosts set to the hosts found in the file; caller must free this if
- *          number of hosts returned is greater than 0
- * @return number of hosts returned in 'hosts', 0 on error
- */
-unsigned int
-GNUNET_TESTBED_hosts_load_from_file (const char *filename,
-                                     const struct GNUNET_CONFIGURATION_Handle
-                                     *cfg,
-                                     struct GNUNET_TESTBED_Host ***hosts);
-
-
-/**
- * Destroy a host handle.  Must only be called once everything
- * running on that host has been stopped.
- *
- * @param host handle to destroy
- */
-void
-GNUNET_TESTBED_host_destroy (struct GNUNET_TESTBED_Host *host);
-
-
-/**
- * The handle for whether a host is habitable or not
- */
-struct GNUNET_TESTBED_HostHabitableCheckHandle;
-
-
-/**
- * Callbacks of this type are called by GNUNET_TESTBED_is_host_habitable to
- * inform whether the given host is habitable or not. The Handle returned by
- * GNUNET_TESTBED_is_host_habitable() is invalid after this callback is called
- *
- * @param cls the closure given to GNUNET_TESTBED_is_host_habitable()
- * @param host the host whose status is being reported; will be NULL if the host
- *          given to GNUNET_TESTBED_is_host_habitable() is NULL
- * @param status GNUNET_YES if it is habitable; GNUNET_NO if not
- */
-typedef void
-(*GNUNET_TESTBED_HostHabitableCallback) (void *cls,
-                                         const struct GNUNET_TESTBED_Host *host,
-                                         int status);
-
-
-/**
- * Checks whether a host can be used to start testbed service
- *
- * @param host the host to check
- * @param config the configuration handle to lookup the path of the testbed
- *          helper
- * @param cb the callback to call to inform about habitability of the given host
- * @param cb_cls the closure for the callback
- * @return NULL upon any error or a handle which can be passed to
- *           GNUNET_TESTBED_is_host_habitable_cancel()
- */
-struct GNUNET_TESTBED_HostHabitableCheckHandle *
-GNUNET_TESTBED_is_host_habitable (const struct GNUNET_TESTBED_Host *host,
-                                  const struct GNUNET_CONFIGURATION_Handle
-                                  *config,
-                                  GNUNET_TESTBED_HostHabitableCallback cb,
-                                  void *cb_cls);
-
-
-/**
- * Function to cancel a request started using GNUNET_TESTBED_is_host_habitable()
- *
- * @param handle the habitability check handle
- */
-void
-GNUNET_TESTBED_is_host_habitable_cancel (struct
-                                         GNUNET_TESTBED_HostHabitableCheckHandle
-                                         *handle);
-
-/**
- * Obtain the host's hostname.
- *
- * @param host handle to the host, NULL means 'localhost'
- * @return hostname of the host
- */
-const char *
-GNUNET_TESTBED_host_get_hostname (const struct GNUNET_TESTBED_Host *host);
-
-
-/**
- * Enumeration with (at most 64) possible event types that
- * can be monitored using the testbed framework.
- */
-enum GNUNET_TESTBED_EventType
-{
-  /**
-   * A peer has been started.
-   */
-  GNUNET_TESTBED_ET_PEER_START = 0,
-
-  /**
-   * A peer has been stopped.
-   */
-  GNUNET_TESTBED_ET_PEER_STOP = 1,
-
-  /**
-   * A connection between two peers was established.
-   */
-  GNUNET_TESTBED_ET_CONNECT = 2,
-
-  /**
-   * A connection between two peers was torn down.
-   */
-  GNUNET_TESTBED_ET_DISCONNECT = 3,
-
-  /**
-   * A requested testbed operation has been completed.
-   */
-  GNUNET_TESTBED_ET_OPERATION_FINISHED = 4,
-};
-
-
-/**
- * Types of information that can be requested about a peer.
- */
-enum GNUNET_TESTBED_PeerInformationType
-{
-  /**
-   * Special value (not valid for requesting information)
-   * that is used in the event struct if a 'generic' pointer
-   * is returned (for other operations not related to this
-   * enumeration).
-   */
-  GNUNET_TESTBED_PIT_GENERIC = 0,
-
-  /**
-   * What configuration is the peer using?  Returns a 'const struct
-   * GNUNET_CONFIGURATION_Handle *'.  Valid until
-   * 'GNUNET_TESTNIG_operation_done' is called.  However, the
-   * values may be inaccurate if the peer is reconfigured in
-   * the meantime.
-   */
-  GNUNET_TESTBED_PIT_CONFIGURATION,
-
-  /**
-   * What is the identity of the peer?  Returns a
-   * 'const struct GNUNET_PeerIdentity *'.  Valid until
-   * 'GNUNET_TESTNIG_operation_done' is called.
-   */
-  GNUNET_TESTBED_PIT_IDENTITY
-};
-
-
-/**
- * Argument to GNUNET_TESTBED_ControllerCallback with details about
- * the event.
- */
-struct GNUNET_TESTBED_EventInformation
-{
-  /**
-   * Type of the event.
-   */
-  enum GNUNET_TESTBED_EventType type;
-
-  /**
-   * Handle for the corresponding operation that generated this event
-   */
-  struct GNUNET_TESTBED_Operation *op;
-
-  /**
-   * Closure given while creating the above operation
-   */
-  void *op_cls;
-
-  /**
-   * Details about the event.
-   */
-  union
-  {
-    /**
-     * Details about peer start event.
-     */
-    struct
-    {
-      /**
-       * Handle for the host where the peer
-       * was started.
-       */
-      struct GNUNET_TESTBED_Host *host;
-
-      /**
-       * Handle for the peer that was started.
-       */
-      struct GNUNET_TESTBED_Peer *peer;
-    } peer_start;
-
-    /**
-     * Details about peer stop event.
-     */
-    struct
-    {
-      /**
-       * Handle for the peer that was started.
-       */
-      struct GNUNET_TESTBED_Peer *peer;
-    } peer_stop;
-
-    /**
-     * Details about connect event.
-     */
-    struct
-    {
-      /**
-       * Handle for one of the connected peers.
-       */
-      struct GNUNET_TESTBED_Peer *peer1;
-
-      /**
-       * Handle for one of the connected peers.
-       */
-      struct GNUNET_TESTBED_Peer *peer2;
-    } peer_connect;
-
-    /**
-     * Details about disconnect event.
-     */
-    struct
-    {
-      /**
-       * Handle for one of the disconnected peers.
-       */
-      struct GNUNET_TESTBED_Peer *peer1;
-
-      /**
-       * Handle for one of the disconnected peers.
-       */
-      struct GNUNET_TESTBED_Peer *peer2;
-    } peer_disconnect;
-
-    /**
-     * Details about an operation finished event.
-     */
-    struct
-    {
-      /**
-       * Error message for the operation, NULL on success.
-       */
-      const char *emsg;
-
-      /**
-       * No result (NULL pointer) or generic result
-       * (whatever the GNUNET_TESTBED_ConnectAdapter returned).
-       */
-      void *generic;
-    } operation_finished;
-  } details;
-};
-
-
-/**
- * Signature of the event handler function called by the
- * respective event controller.
- *
- * @param cls closure
- * @param event information about the event
- */
-typedef void
-(*GNUNET_TESTBED_ControllerCallback)(void *cls,
-                                     const struct
-                                     GNUNET_TESTBED_EventInformation *event);
-
-
-/**
- * Opaque Handle for Controller process
- */
-struct GNUNET_TESTBED_ControllerProc;
-
-
-/**
- * Callback to signal successful startup of the controller process
- *
- * @param cls the closure from GNUNET_TESTBED_controller_start()
- * @param cfg the configuration with which the controller has been started;
- *          NULL if status is not #GNUNET_OK
- * @param status #GNUNET_OK if the startup is successful; #GNUNET_SYSERR if not,
- *          GNUNET_TESTBED_controller_stop() shouldn't be called in this case
- */
-typedef void
-(*GNUNET_TESTBED_ControllerStatusCallback) (void *cls,
-                                            const struct
-                                            GNUNET_CONFIGURATION_Handle *cfg,
-                                            int status);
-
-
-/**
- * Starts a controller process at the given host.  The given host's configuration
- * is used as a Template configuration to use for the remote controller; the
- * remote controller will be started with a slightly modified configuration
- * (port numbers, unix domain sockets and service home values are changed as per
- * TESTING library on the remote host).  The modified configuration replaces the
- * host's existing configuration before signalling success through the
- * GNUNET_TESTBED_ControllerStatusCallback()
- *
- * @param trusted_ip the ip address of the controller which will be set as TRUSTED
- *          HOST(all connections form this ip are permitted by the testbed) when
- *          starting testbed controller at host. This can either be a single ip
- *          address or a network address in CIDR notation.
- * @param host the host where the controller has to be started.  CANNOT be NULL.
- * @param cb function called when the controller is successfully started or
- *          dies unexpectedly; GNUNET_TESTBED_controller_stop shouldn't be
- *          called if cb is called with GNUNET_SYSERR as status. Will never be
- *          called in the same task as 'GNUNET_TESTBED_controller_start'
- *          (synchronous errors will be signalled by returning NULL). This
- *          parameter cannot be NULL.
- * @param cls closure for above callbacks
- * @return the controller process handle, NULL on errors
- */
-struct GNUNET_TESTBED_ControllerProc *
-GNUNET_TESTBED_controller_start (const char *trusted_ip,
-                                 struct GNUNET_TESTBED_Host *host,
-                                 GNUNET_TESTBED_ControllerStatusCallback cb,
-                                 void *cls);
-
-
-/**
- * Stop the controller process (also will terminate all peers and controllers
- * dependent on this controller).  This function blocks until the testbed has
- * been fully terminated (!). The controller status cb from
- * GNUNET_TESTBED_controller_start() will not be called.
- *
- * @param cproc the controller process handle
- */
-void
-GNUNET_TESTBED_controller_stop (struct GNUNET_TESTBED_ControllerProc *cproc);
-
-
-/**
- * Connect to a controller process.  The configuration to use for the connection
- * is retrieved from the given host where a controller is started using
- * GNUNET_TESTBED_controller_start().
- *
- * @param host host to run the controller on; This should be the same host if
- *          the controller was previously started with
- *          GNUNET_TESTBED_controller_start()
- * @param event_mask bit mask with set of events to call 'cc' for;
- *                   or-ed values of "1LL" shifted by the
- *                   respective 'enum GNUNET_TESTBED_EventType'
- *                   (e.g.  "(1LL << GNUNET_TESTBED_ET_CONNECT) | ...")
- * @param cc controller callback to invoke on events
- * @param cc_cls closure for cc
- * @return handle to the controller
- */
-struct GNUNET_TESTBED_Controller *
-GNUNET_TESTBED_controller_connect (struct GNUNET_TESTBED_Host *host,
-                                   uint64_t event_mask,
-                                   GNUNET_TESTBED_ControllerCallback cc,
-                                   void *cc_cls);
-
-
-/**
- * Stop the given controller (also will terminate all peers and
- * controllers dependent on this controller).  This function
- * blocks until the testbed has been fully terminated (!).
- *
- * @param c handle to controller to stop
- */
-void
-GNUNET_TESTBED_controller_disconnect (struct GNUNET_TESTBED_Controller *c);
-
-
-/**
- * Opaque handle for host registration
- */
-struct GNUNET_TESTBED_HostRegistrationHandle;
-
-
-/**
- * Callback which will be called to after a host registration succeeded or failed
- *
- * @param cls the closure
- * @param emsg the error message; NULL if host registration is successful
- */
-typedef void
-(*GNUNET_TESTBED_HostRegistrationCompletion) (void *cls,
-                                              const char *emsg);
-
-
-/**
- * Register a host with the controller. This makes the controller aware of the
- * host. A host should be registered at the controller before starting a
- * sub-controller on that host using GNUNET_TESTBED_controller_link().
- *
- * @param controller the controller handle
- * @param host the host to register
- * @param cc the completion callback to call to inform the status of
- *          registration. After calling this callback the registration handle
- *          will be invalid. Cannot be NULL
- * @param cc_cls the closure for the cc
- * @return handle to the host registration which can be used to cancel the
- *           registration; NULL if another registration handle is present and
- *           is not cancelled
- */
-struct GNUNET_TESTBED_HostRegistrationHandle *
-GNUNET_TESTBED_register_host (struct GNUNET_TESTBED_Controller *controller,
-                              struct GNUNET_TESTBED_Host *host,
-                              GNUNET_TESTBED_HostRegistrationCompletion cc,
-                              void *cc_cls);
-
-
-/**
- * Cancel the pending registration. Note that the registration message will
- * already be queued to be sent to the service, cancellation has only the
- * effect that the registration completion callback for the registration is
- * never called and from our perspective the host is not registered until the
- * completion callback is called.
- *
- * @param handle the registration handle to cancel
- */
-void
-GNUNET_TESTBED_cancel_registration (struct GNUNET_TESTBED_HostRegistrationHandle
-                                    *handle);
-
-
-/**
- * Callback to be called when an operation is completed
- *
- * @param cls the callback closure from functions generating an operation
- * @param op the operation that has been finished
- * @param emsg error message in case the operation has failed; will be NULL if
- *          operation has executed successfully.
- */
-typedef void
-(*GNUNET_TESTBED_OperationCompletionCallback) (void *cls,
-                                               struct GNUNET_TESTBED_Operation *
-                                               op,
-                                               const char *emsg);
-
-
-/**
- * Create a link from slave controller to delegated controller. Whenever the
- * master controller is asked to start a peer at the delegated controller the
- * request will be routed towards slave controller (if a route exists). The
- * slave controller will then route it to the delegated controller. The
- * configuration of the delegated controller is given and is used to either
- * create the delegated controller or to connect to an existing controller. Note
- * that while starting the delegated controller the configuration will be
- * modified to accommodate available free ports.  the 'is_subordinate' specifies
- * if the given delegated controller should be started and managed by the slave
- * controller, or if the delegated controller already has a master and the slave
- * controller connects to it as a non master controller. The success or failure
- * of this operation will be signalled through the
- * GNUNET_TESTBED_ControllerCallback() with an event of type
- * #GNUNET_TESTBED_ET_OPERATION_FINISHED
- *
- * @param op_cls the operation closure for the event which is generated to
- *          signal success or failure of this operation
- * @param master handle to the master controller who creates the association
- * @param delegated_host requests to which host should be delegated; cannot be NULL
- * @param slave_host which host is used to run the slave controller; use NULL to
- *          make the master controller connect to the delegated host
- * @param is_subordinate #GNUNET_YES if the controller at delegated_host should
- *          be started by the slave controller; #GNUNET_NO if the slave
- *          controller has to connect to the already started delegated
- *          controller via TCP/IP
- * @return the operation handle
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_controller_link (void *op_cls,
-                                struct GNUNET_TESTBED_Controller *master,
-                                struct GNUNET_TESTBED_Host *delegated_host,
-                                struct GNUNET_TESTBED_Host *slave_host,
-                                int is_subordinate);
-
-
-/**
- * Function to acquire the configuration of a running slave controller. The
- * completion of the operation is signalled through the controller_cb from
- * GNUNET_TESTBED_controller_connect(). If the operation is successful the
- * handle to the configuration is available in the generic pointer of
- * operation_finished field of `struct GNUNET_TESTBED_EventInformation`.
- *
- * @param op_cls the closure for the operation
- * @param master the handle to master controller
- * @param slave_host the host where the slave controller is running; the handle
- *          to the slave_host should remain valid until this operation is
- *          cancelled or marked as finished
- * @return the operation handle; NULL if the slave_host is not registered at
- *           master
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_get_slave_config (void *op_cls,
-                                 struct GNUNET_TESTBED_Controller *master,
-                                 struct GNUNET_TESTBED_Host *slave_host);
-
-
-/**
- * Functions of this signature are called when a peer has been successfully
- * created
- *
- * @param cls the closure from GNUNET_TESTBED_peer_create()
- * @param peer the handle for the created peer; NULL on any error during
- *          creation
- * @param emsg NULL if peer is not NULL; else MAY contain the error description
- */
-typedef void
-(*GNUNET_TESTBED_PeerCreateCallback) (void *cls,
-                                      struct GNUNET_TESTBED_Peer *peer,
-                                      const char *emsg);
-
-
-/**
- * Create the given peer at the specified host using the given
- * controller.  If the given controller is not running on the target
- * host, it should find or create a controller at the target host and
- * delegate creating the peer.  Explicit delegation paths can be setup
- * using 'GNUNET_TESTBED_controller_link'.  If no explicit delegation
- * path exists, a direct link with a subordinate controller is setup
- * for the first delegated peer to a particular host; the subordinate
- * controller is then destroyed once the last peer that was delegated
- * to the remote host is stopped.
- *
- * Creating the peer only creates the handle to manipulate and further
- * configure the peer; use #GNUNET_TESTBED_peer_start and
- * #GNUNET_TESTBED_peer_stop to actually start/stop the peer's
- * processes.
- *
- * Note that the given configuration will be adjusted by the
- * controller to avoid port/path conflicts with other peers.
- * The "final" configuration can be obtained using
- * #GNUNET_TESTBED_peer_get_information.
- *
- * @param controller controller process to use
- * @param host host to run the peer on; cannot be NULL
- * @param cfg Template configuration to use for the peer. Should exist until
- *          operation is cancelled or GNUNET_TESTBED_operation_done() is called
- * @param cb the callback to call when the peer has been created
- * @param cls the closure to the above callback
- * @return the operation handle
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_create (struct GNUNET_TESTBED_Controller *controller,
-                            struct GNUNET_TESTBED_Host *host,
-                            const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            GNUNET_TESTBED_PeerCreateCallback cb,
-                            void *cls);
-
-
-/**
- * Functions of this signature are called when a peer has been successfully
- * started or stopped.
- *
- * @param cls the closure from GNUNET_TESTBED_peer_start/stop()
- * @param emsg NULL on success; otherwise an error description
- */
-typedef void
-(*GNUNET_TESTBED_PeerChurnCallback) (void *cls,
-                                     const char *emsg);
-
-
-/**
- * Start the given peer.
- *
- * @param op_cls the closure for this operation; will be set in the event
- *          information
- * @param peer peer to start
- * @param pcc function to call upon completion
- * @param pcc_cls closure for 'pcc'
- * @return handle to the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_start (void *op_cls,
-                           struct GNUNET_TESTBED_Peer *peer,
-                           GNUNET_TESTBED_PeerChurnCallback pcc,
-                           void *pcc_cls);
-
-
-/**
- * Stop the given peer.  The handle remains valid (use
- * #GNUNET_TESTBED_peer_destroy to fully clean up the
- * state of the peer).
- *
- * @param op_cls the closure for this operation; will be set in the event
- *          information
- * @param peer peer to stop
- * @param pcc function to call upon completion
- * @param pcc_cls closure for 'pcc'
- * @return handle to the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_stop (void *op_cls,
-                          struct GNUNET_TESTBED_Peer *peer,
-                          GNUNET_TESTBED_PeerChurnCallback pcc,
-                          void *pcc_cls);
-
-
-/**
- * Data returned from GNUNET_TESTBED_peer_get_information
- */
-struct GNUNET_TESTBED_PeerInformation
-{
-  /**
-   * Peer information type; captures which of the types
-   * in the 'op_result' is actually in use.
-   */
-  enum GNUNET_TESTBED_PeerInformationType pit;
-
-  /**
-   * The result of the get information operation; Choose according to the pit
-   */
-  union
-  {
-    /**
-     * The configuration of the peer
-     */
-    struct GNUNET_CONFIGURATION_Handle *cfg;
-
-    /**
-     * The identity of the peer
-     */
-    struct GNUNET_PeerIdentity *id;
-  } result;
-};
-
-
-/**
- * Callback to be called when the requested peer information is available
- * The peer information in the callback is valid until the operation 'op' is canceled.
- *
- * @param cb_cls the closure from GNUNET_TETSBED_peer_get_information()
- * @param op the operation this callback corresponds to
- * @param pinfo the result; will be NULL if the operation has failed
- * @param emsg error message if the operation has failed; will be NULL if the
- *          operation is successful
- */
-typedef void
-(*GNUNET_TESTBED_PeerInfoCallback) (void *cb_cls,
-                                    struct GNUNET_TESTBED_Operation *op,
-                                    const struct
-                                    GNUNET_TESTBED_PeerInformation *pinfo,
-                                    const char *emsg);
-
-
-/**
- * Request information about a peer. The controller callback will not be called
- * with event type #GNUNET_TESTBED_ET_OPERATION_FINISHED when result for this
- * operation is available. Instead, the GNUNET_TESTBED_PeerInfoCallback() will
- * be called.
- * The peer information in the callback is valid until the operation is canceled.
- *
- * @param peer peer to request information about
- * @param pit desired information
- * @param cb the convenience callback to be called when results for this
- *          operation are available
- * @param cb_cls the closure for @a cb
- * @return handle to the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_get_information (struct GNUNET_TESTBED_Peer *peer,
-                                     enum GNUNET_TESTBED_PeerInformationType
-                                     pit,
-                                     GNUNET_TESTBED_PeerInfoCallback cb,
-                                     void *cb_cls);
-
-
-/**
- * Change @a peer configuration.  Ports and paths cannot be changed this
- * way.
- *
- * @param peer peer to change configuration for
- * @param cfg new configuration
- * @return handle to the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_update_configuration (struct GNUNET_TESTBED_Peer *peer,
-                                          const struct
-                                          GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Destroy the given peer; the peer should have been
- * stopped first (if it was started).
- *
- * @param peer peer to stop
- * @return handle to the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_destroy (struct GNUNET_TESTBED_Peer *peer);
-
-
-/**
- * Start or stop given service at a peer.  This should not be called to
- * start/stop the peer's ARM service.  Use GNUNET_TESTBED_peer_start(),
- * GNUNET_TESTBED_peer_stop() for starting/stopping peer's ARM service.  Success
- * or failure of the generated operation is signalled through the controller
- * event callback and/or operation completion callback.
- *
- * @param op_cls the closure for the operation
- * @param peer the peer whose service is to be started/stopped
- * @param service_name the name of the service
- * @param cb the operation completion callback
- * @param cb_cls the closure for @a cb
- * @param start 1 to start the service; 0 to stop the service
- * @return an operation handle; NULL upon error (peer not running)
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_peer_manage_service (void *op_cls,
-                                    struct GNUNET_TESTBED_Peer *peer,
-                                    const char *service_name,
-                                    GNUNET_TESTBED_OperationCompletionCallback
-                                    cb,
-                                    void *cb_cls,
-                                    unsigned int start);
-
-
-/**
- * Stops and destroys all peers.  Is equivalent of calling
- * GNUNET_TESTBED_peer_stop() and GNUNET_TESTBED_peer_destroy() on all peers,
- * except that the peer stop event and operation finished event corresponding to
- * the respective functions are not generated.  This function should be called
- * when there are no other pending operations.  If there are pending operations,
- * it will return NULL
- *
- * @param c the controller to send this message to
- * @param op_cls closure for the operation
- * @param cb the callback to call when all peers are stopped and destroyed
- * @param cb_cls the closure for the callback
- * @return operation handle on success; NULL if any pending operations are
- *           present
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_shutdown_peers (struct GNUNET_TESTBED_Controller *c,
-                               void *op_cls,
-                               GNUNET_TESTBED_OperationCompletionCallback cb,
-                               void *cb_cls);
-
-
-/**
- * Options for peer connections.
- */
-enum GNUNET_TESTBED_ConnectOption
-{
-  /**
-   * No option (not valid as an argument).
-   */
-  GNUNET_TESTBED_CO_NONE = 0,
-
-  /**
-   * Allow or disallow a connection between the specified peers.
-   * Followed by #GNUNET_NO (int) if a connection is disallowed
-   * or #GNUNET_YES if a connection is allowed.  Note that the
-   * default (all connections allowed or disallowed) is
-   * specified in the configuration of the controller.
-   */
-  GNUNET_TESTBED_CO_ALLOW = 1,
-
-  /**
-   * FIXME: add (and implement) options to limit connection to
-   * particular transports, force simulation of particular latencies
-   * or message loss rates, or set bandwidth limitations.
-   */
-};
-
-
-/**
- * Manipulate the P2P underlay topology by configuring a link
- * between two peers.
- *
- * @param op_cls closure argument to give with the operation event
- * @param p1 first peer
- * @param p2 second peer
- * @param co option to change
- * @param ap option-specific values
- * @return handle to the operation, NULL if configuring the link at this
- *         time is not allowed
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_underlay_configure_link_va (void *op_cls,
-                                           struct GNUNET_TESTBED_Peer *p1,
-                                           struct GNUNET_TESTBED_Peer *p2,
-                                           enum GNUNET_TESTBED_ConnectOption co,
-                                           va_list ap);
-
-
-/**
- * Manipulate the P2P underlay topology by configuring a link
- * between two peers.
- *
- * @param op_cls closure argument to give with the operation event
- * @param p1 first peer
- * @param p2 second peer
- * @param co option to change
- * @param ... option-specific values
- * @return handle to the operation, NULL if configuring the link at this
- *         time is not allowed
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_underlay_configure_link (void *op_cls,
-                                        struct GNUNET_TESTBED_Peer *p1,
-                                        struct GNUNET_TESTBED_Peer *p2,
-                                        enum GNUNET_TESTBED_ConnectOption co,
-                                        ...);
-
-
-/**
- * Topologies and topology options supported for testbeds. Options should always
- * end with #GNUNET_TESTBED_TOPOLOGY_OPTION_END
- */
-enum GNUNET_TESTBED_TopologyOption
-{
-  /**
-   * A clique (everyone connected to everyone else).  No options. If there are N
-   * peers this topology results in (N * (N -1)) connections.
-   */
-  GNUNET_TESTBED_TOPOLOGY_CLIQUE,
-
-  /**
-   * Small-world network (2d torus plus random links).  Followed
-   * by the number of random links to add (unsigned int).
-   */
-  GNUNET_TESTBED_TOPOLOGY_SMALL_WORLD,
-
-  /**
-   * Small-world network (ring plus random links).  Followed
-   * by the number of random links to add (unsigned int).
-   */
-  GNUNET_TESTBED_TOPOLOGY_SMALL_WORLD_RING,
-
-  /**
-   * Ring topology.  No options.
-   */
-  GNUNET_TESTBED_TOPOLOGY_RING,
-
-  /**
-   * Star topology.  No options.
-   */
-  GNUNET_TESTBED_TOPOLOGY_STAR,
-
-  /**
-   * 2-d torus.  No options.
-   */
-  GNUNET_TESTBED_TOPOLOGY_2D_TORUS,
-
-  /**
-   * Random graph.  Followed by the number of random links to be established
-   * (unsigned int)
-   */
-  GNUNET_TESTBED_TOPOLOGY_ERDOS_RENYI,
-
-  /**
-   * Certain percentage of peers are unable to communicate directly
-   * replicating NAT conditions.  Followed by the fraction of
-   * NAT'ed peers (float).
-   */
-  GNUNET_TESTBED_TOPOLOGY_INTERNAT,
-
-  /**
-   * Scale free topology.  It is generated according to the method described in
-   * "Emergence of Scaling in Random Networks." Science 286, 509-512, 1999.
-   *
-   * This options takes two arguments in the following order: an uint16_t to
-   * determine the maximum number of edges a peer is permitted to have while
-   * generating scale free topology, a good value for this argument is 70; and
-   * an uint8_t to determine the number of edges to be established when adding a
-   * new node to the scale free network, a good value for this argument is 4.
-   */
-  GNUNET_TESTBED_TOPOLOGY_SCALE_FREE,
-
-  /**
-   * Straight line topology.  No options.
-   */
-  GNUNET_TESTBED_TOPOLOGY_LINE,
-
-  /**
-   * Read a topology from a given file.  Followed by the name of the file (const char *).
-   */
-  GNUNET_TESTBED_TOPOLOGY_FROM_FILE,
-
-  /**
-   * All peers are disconnected.  No options.
-   */
-  GNUNET_TESTBED_TOPOLOGY_NONE,
-
-  /**
-   * The options should always end with this
-   */
-  GNUNET_TESTBED_TOPOLOGY_OPTION_END,
-
-  /* The following are not topologies but influence how the topology has to be
-     setup. These options should follow the topology specific options (if
-     required by the chosen topology). Note that these should be given before
-     GNUNET_TESTBED_TOPOLOGY_OPTION_END */
-
-  /**
-   * How many times should the failed overlay connect operations be retried
-   * before giving up.  The default if this option is not specified is to retry
-   * 3 times.  This option takes and unsigned integer as a parameter.  Use this
-   * option with parameter 0 to disable retrying of failed overlay connect
-   * operations.
-   */
-  GNUNET_TESTBED_TOPOLOGY_RETRY_CNT
-};
-
-
-/**
- * Configure overall network topology to have a particular shape.
- *
- * @param op_cls closure argument to give with the operation event
- * @param num_peers number of peers in 'peers'
- * @param peers array of 'num_peers' with the peers to configure
- * @param topo desired underlay topology to use
- * @param ap topology-specific options
- * @return handle to the operation, NULL if configuring the topology
- *         is not allowed at this time
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_underlay_configure_topology_va (void *op_cls,
-                                               unsigned int num_peers,
-                                               struct GNUNET_TESTBED_Peer **
-                                               peers,
-                                               enum
-                                               GNUNET_TESTBED_TopologyOption
-                                               topo,
-                                               va_list ap);
-
-
-/**
- * Configure overall network topology to have a particular shape.
- *
- * @param op_cls closure argument to give with the operation event
- * @param num_peers number of peers in 'peers'
- * @param peers array of 'num_peers' with the peers to configure
- * @param topo desired underlay topology to use
- * @param ... topology-specific options
- * @return handle to the operation, NULL if configuring the topology
- *         is not allowed at this time
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_underlay_configure_topology (void *op_cls,
-                                            unsigned int num_peers,
-                                            struct GNUNET_TESTBED_Peer **peers,
-                                            enum GNUNET_TESTBED_TopologyOption
-                                            topo,
-                                            ...);
-
-
-/**
- * Both peers must have been started before calling this function.
- * This function then obtains a HELLO from @a p1, gives it to @a p2
- * and asks @a p2 to connect to @a p1.
- *
- * @param op_cls closure argument to give with the operation event
- * @param cb the callback to call when this operation has finished
- * @param cb_cls the closure for @a cb
- * @param p1 first peer
- * @param p2 second peer
- * @return handle to the operation, NULL if connecting these two
- *         peers is fundamentally not possible at this time (peers
- *         not running or underlay disallows)
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_overlay_connect (void *op_cls,
-                                GNUNET_TESTBED_OperationCompletionCallback cb,
-                                void *cb_cls,
-                                struct GNUNET_TESTBED_Peer *p1,
-                                struct GNUNET_TESTBED_Peer *p2);
-
-
-/**
- * Callbacks of this type are called when topology configuration is completed
- *
- * @param cls the operation closure given to
- *          GNUNET_TESTBED_overlay_configure_topology_va() and
- *          GNUNET_TESTBED_overlay_configure() calls
- * @param nsuccess the number of successful overlay connects
- * @param nfailures the number of overlay connects which failed
- */
-typedef void (*GNUNET_TESTBED_TopologyCompletionCallback) (void *cls,
-                                                           unsigned int
-                                                           nsuccess,
-                                                           unsigned int
-                                                           nfailures);
-
-
-/**
- * All peers must have been started before calling this function.
- * This function then connects the given peers in the P2P overlay
- * using the given topology.
- *
- * @param op_cls closure argument to give with the peer connect operation events
- *          generated through this function
- * @param num_peers number of peers in 'peers'
- * @param peers array of 'num_peers' with the peers to configure
- * @param max_connections the maximums number of overlay connections that will
- *          be made to achieve the given topology
- * @param comp_cb the completion callback to call when the topology generation
- *          is completed
- * @param comp_cb_cls closure for the @a comp_cb
- * @param topo desired underlay topology to use
- * @param va topology-specific options
- * @return handle to the operation, NULL if connecting these
- *         peers is fundamentally not possible at this time (peers
- *         not running or underlay disallows) or if num_peers is less than 2
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_overlay_configure_topology_va (void *op_cls,
-                                              unsigned int num_peers,
-                                              struct GNUNET_TESTBED_Peer **peers,
-                                              unsigned int *max_connections,
-                                              GNUNET_TESTBED_TopologyCompletionCallback
-                                              comp_cb,
-                                              void *comp_cb_cls,
-                                              enum GNUNET_TESTBED_TopologyOption
-                                              topo,
-                                              va_list va);
-
-
-/**
- * All peers must have been started before calling this function.
- * This function then connects the given peers in the P2P overlay
- * using the given topology.
- *
- * @param op_cls closure argument to give with the peer connect operation events
- *          generated through this function
- * @param num_peers number of peers in 'peers'
- * @param peers array of 'num_peers' with the peers to configure
- * @param max_connections the maximums number of overlay connections that will
- *          be made to achieve the given topology
- * @param comp_cb the completion callback to call when the topology generation
- *          is completed
- * @param comp_cb_cls closure for the above completion callback
- * @param topo desired underlay topology to use
- * @param ... topology-specific options
- * @return handle to the operation, NULL if connecting these
- *         peers is fundamentally not possible at this time (peers
- *         not running or underlay disallows) or if num_peers is less than 2
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_overlay_configure_topology (void *op_cls,
-                                           unsigned int num_peers,
-                                           struct GNUNET_TESTBED_Peer **peers,
-                                           unsigned int *max_connections,
-                                           GNUNET_TESTBED_TopologyCompletionCallback
-                                           comp_cb,
-                                           void *comp_cb_cls,
-                                           enum GNUNET_TESTBED_TopologyOption
-                                           topo,
-                                           ...);
-
-
-/**
- * Ask the testbed controller to write the current overlay topology to
- * a file.  Naturally, the file will only contain a snapshot as the
- * topology may evolve all the time.
- * FIXME: needs continuation!?
- *
- * @param controller overlay controller to inspect
- * @param filename name of the file the topology should
- *        be written to.
- */
-void
-GNUNET_TESTBED_overlay_write_topology_to_file (struct
-                                               GNUNET_TESTBED_Controller *
-                                               controller,
-                                               const char *filename);
-
-
-/**
- * Adapter function called to establish a connection to
- * a service.
- *
- * @param cls closure
- * @param cfg configuration of the peer to connect to; will be available until
- *          GNUNET_TESTBED_operation_done() is called on the operation returned
- *          from GNUNET_TESTBED_service_connect()
- * @return service handle to return in 'op_result', NULL on error
- */
-typedef void *
-(*GNUNET_TESTBED_ConnectAdapter)(void *cls,
-                                 const struct GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Adapter function called to destroy a connection to
- * a service.
- *
- * @param cls closure
- * @param op_result service handle returned from the connect adapter
- */
-typedef void
-(*GNUNET_TESTBED_DisconnectAdapter)(void *cls,
-                                    void *op_result);
-
-
-/**
- * Callback to be called when a service connect operation is completed
- *
- * @param cls the callback closure from functions generating an operation
- * @param op the operation that has been finished
- * @param ca_result the service handle returned from GNUNET_TESTBED_ConnectAdapter()
- * @param emsg error message in case the operation has failed; will be NULL if
- *          operation has executed successfully.
- */
-typedef void
-(*GNUNET_TESTBED_ServiceConnectCompletionCallback) (void *cls,
-                                                    struct
-                                                    GNUNET_TESTBED_Operation *op,
-                                                    void *ca_result,
-                                                    const char *emsg);
-
-
-/**
- * Connect to a service offered by the given peer.  Will ensure that
- * the request is queued to not overwhelm our ability to create and
- * maintain connections with other systems.  The actual service
- * handle is then returned via the 'op_result' member in the event
- * callback.  The @a ca callback is used to create the connection
- * when the time is right; the @a da callback will be used to
- * destroy the connection (upon #GNUNET_TESTBED_operation_done).
- * #GNUNET_TESTBED_operation_done can be used to abort this
- * operation until the event callback has been called.
- *
- * @param op_cls closure to pass in operation event // FIXME: didn't we say we'd no longer use the global callback for these? -CG
- * @param peer peer that runs the service
- * @param service_name name of the service to connect to
- * @param cb the callback to call when this operation is ready (that is,
- *        right after the connect adapter returns)
- * @param cb_cls closure for @a cb
- * @param ca helper function to establish the connection
- * @param da helper function to close the connection
- * @param cada_cls closure for @a ca and @a da
- * @return handle for the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_service_connect (void *op_cls,
-                                struct GNUNET_TESTBED_Peer *peer,
-                                const char *service_name,
-                                GNUNET_TESTBED_ServiceConnectCompletionCallback
-                                cb,
-                                void *cb_cls,
-                                GNUNET_TESTBED_ConnectAdapter ca,
-                                GNUNET_TESTBED_DisconnectAdapter da,
-                                void *cada_cls);
-
-
-/**
- * This function is used to signal that the event information (struct
- * GNUNET_TESTBED_EventInformation) from an operation has been fully processed
- * i.e. if the event callback is ever called for this operation. If the event
- * callback for this operation has not yet been called, calling this function
- * cancels the operation, frees its resources and ensures the no event is
- * generated with respect to this operation. Note that however cancelling an
- * operation does NOT guarantee that the operation will be fully undone (or that
- * nothing ever happened).
- *
- * This function MUST be called for every operation to fully remove the
- * operation from the operation queue.  After calling this function, if
- * operation is completed and its event information is of type
- * GNUNET_TESTBED_ET_OPERATION_FINISHED, the 'op_result' becomes invalid (!).
-
- * If the operation is generated from GNUNET_TESTBED_service_connect() then
- * calling this function on such as operation calls the disconnect adapter if
- * the connect adapter was ever called.
- *
- * @param operation operation to signal completion or cancellation
- */
-void
-GNUNET_TESTBED_operation_done (struct GNUNET_TESTBED_Operation *operation);
-
-
-/**
- * Callback function to process statistic values from all peers.
- *
- * @param cls closure
- * @param peer the peer the statistic belong to
- * @param subsystem name of subsystem that created the statistic
- * @param name the name of the datum
- * @param value the current value
- * @param is_persistent #GNUNET_YES if the value is persistent, #GNUNET_NO if not
- * @return #GNUNET_OK to continue, #GNUNET_SYSERR to abort iteration
- */
-typedef int
-(*GNUNET_TESTBED_StatisticsIterator) (void *cls,
-                                      const struct GNUNET_TESTBED_Peer *peer,
-                                      const char *subsystem,
-                                      const char *name,
-                                      uint64_t value,
-                                      int is_persistent);
-
-
-/**
- * Convenience method that iterates over all (running) peers
- * and retrieves all statistics from each peer.
- *
- * @param num_peers number of peers to iterate over
- * @param peers array of peers to iterate over
- * @param subsystem limit to the specified subsystem, NULL for all subsystems
- * @param name name of the statistic value, NULL for all values
- * @param proc processing function for each statistic retrieved
- * @param cont continuation to call once call is completed.  The completion of this
- *          operation is *ONLY* signalled through this callback -- no
- *          GNUNET_TESTBED_ET_OPERATION_FINISHED is generated
- * @param cls closure to pass to proc and cont
- * @return operation handle to cancel the operation
- */
-struct GNUNET_TESTBED_Operation *
-GNUNET_TESTBED_get_statistics (unsigned int num_peers,
-                               struct GNUNET_TESTBED_Peer **peers,
-                               const char *subsystem, const char *name,
-                               GNUNET_TESTBED_StatisticsIterator proc,
-                               GNUNET_TESTBED_OperationCompletionCallback cont,
-                               void *cls);
-
-
-/**
- * Return the index of the peer inside of the total peer array,
- * aka. the peer's "unique ID".
- *
- * @param peer Peer handle.
- *
- * @return The peer's unique ID.
- */
-uint32_t
-GNUNET_TESTBED_get_index (const struct GNUNET_TESTBED_Peer *peer);
-
-
-/**
- * Handle for testbed run helper functions
- */
-struct GNUNET_TESTBED_RunHandle;
-
-
-/**
- * Signature of a main function for a testcase.
- *
- * @param cls closure
- * @param h the run handle
- * @param num_peers number of peers in 'peers'
- * @param peers handle to peers run in the testbed.  NULL upon timeout (see
- *          GNUNET_TESTBED_test_run()).
- * @param links_succeeded the number of overlay link connection attempts that
- *          succeeded
- * @param links_failed the number of overlay link connection attempts that
- *          failed
- * @see GNUNET_TESTBED_test_run()
- */
-typedef void
-(*GNUNET_TESTBED_TestMaster)(void *cls,
-                             struct GNUNET_TESTBED_RunHandle *h,
-                             unsigned int num_peers,
-                             struct GNUNET_TESTBED_Peer **peers,
-                             unsigned int links_succeeded,
-                             unsigned int links_failed);
-
-
-/**
- * Convenience method for running a testbed with
- * a single call.  Underlay and overlay topology
- * are configured using the "UNDERLAY" and "OVERLAY"
- * options in the "[testbed]" section of the configuration\
- * (with possible options given in "UNDERLAY_XXX" and/or
- * "OVERLAY_XXX").
- *
- * The test_master callback will be called once the testbed setup is finished or
- * upon a timeout.  This timeout is given through the configuration file by
- * setting the option "SETUP_TIMEOUT" in "[TESTBED]" section.
- *
- * The testbed is to be terminated using a call to
- * "GNUNET_SCHEDULER_shutdown".
- *
- * @param host_filename name of the file with the 'hosts', NULL
- *        to run everything on 'localhost'
- * @param cfg configuration to use (for testbed, controller and peers)
- * @param num_peers number of peers to start; FIXME: maybe put that ALSO into
- *        cfg?; should be greater than 0
- * @param event_mask bit mask with set of events to call 'cc' for;
- *                   or-ed values of "1LL" shifted by the
- *                   respective 'enum GNUNET_TESTBED_EventType'
- *                   (e.g.  "(1LL << GNUNET_TESTBED_ET_CONNECT) || ...")
- * @param cc controller callback to invoke on events; This callback is called
- *        for all peer start events even if GNUNET_TESTBED_ET_PEER_START isn't
- *        set in the event_mask as this is the only way get access to the
- *        handle of each peer
- * @param cc_cls closure for cc
- * @param test_master this callback will be called once the test is ready or
- *          upon timeout
- * @param test_master_cls closure for 'test_master'.
- */
-void
-GNUNET_TESTBED_run (const char *host_filename,
-                    const struct GNUNET_CONFIGURATION_Handle *cfg,
-                    unsigned int num_peers,
-                    uint64_t event_mask,
-                    GNUNET_TESTBED_ControllerCallback cc,
-                    void *cc_cls,
-                    GNUNET_TESTBED_TestMaster test_master,
-                    void *test_master_cls);
-
-
-/**
- * Convenience method for running a "simple" test on the local system
- * with a single call from 'main'.  Underlay and overlay topology are
- * configured using the "UNDERLAY" and "OVERLAY" options in the
- * "[TESTBED]" section of the configuration (with possible options
- * given in "UNDERLAY_XXX" and/or "OVERLAY_XXX").
- *
- * The test_master callback will be called once the testbed setup is finished or
- * upon a timeout.  This timeout is given through the configuration file by
- * setting the option "SETUP_TIMEOUT" in "[TESTBED]" section.
- *
- * The test is to be terminated using a call to
- * "GNUNET_SCHEDULER_shutdown".  If starting the test fails,
- * the program is stopped without 'master' ever being run.
- *
- * NOTE: this function should be called from 'main', NOT from
- * within a GNUNET_SCHEDULER-loop.  This function will initialize
- * the scheduler loop, the testbed and then pass control to
- * 'master'.
- *
- * @param testname name of the testcase (to configure logging, etc.)
- * @param cfg_filename configuration filename to use
- *              (for testbed, controller and peers)
- * @param num_peers number of peers to start; should be greter than 0
- * @param event_mask bit mask with set of events to call 'cc' for;
- *                   or-ed values of "1LL" shifted by the
- *                   respective 'enum GNUNET_TESTBED_EventType'
- *                   (e.g.  "(1LL << GNUNET_TESTBED_ET_CONNECT) || ...")
- * @param cc controller callback to invoke on events; This callback is called
- *        for all peer start events even if #GNUNET_TESTBED_ET_PEER_START isn't
- *        set in the event_mask as this is the only way get access to the
- *        handle of each peer
- * @param cc_cls closure for @a cc
- * @param test_master this callback will be called once the test is ready or
- *          upon timeout
- * @param test_master_cls closure for @a test_master.
- * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
- */
-int
-GNUNET_TESTBED_test_run (const char *testname,
-                         const char *cfg_filename,
-                         unsigned int num_peers,
-                         uint64_t event_mask,
-                         GNUNET_TESTBED_ControllerCallback cc,
-                         void *cc_cls,
-                         GNUNET_TESTBED_TestMaster test_master,
-                         void *test_master_cls);
-
-
-/**
- * Obtain handle to the master controller from a testbed run.  The handle
- * returned should not be disconnected.
- *
- * @param h the testbed run handle
- * @return handle to the master controller
- */
-struct GNUNET_TESTBED_Controller *
-GNUNET_TESTBED_run_get_controller_handle (struct GNUNET_TESTBED_RunHandle *h);
-
-
-/**
- * Opaque handle for barrier
- */
-struct GNUNET_TESTBED_Barrier;
-
-
-/**
- * Status of a barrier
- */
-enum GNUNET_TESTBED_BarrierStatus
-{
-  /**
-   * Barrier initialised successfully
-   */
-  GNUNET_TESTBED_BARRIERSTATUS_INITIALISED = 1,
-
-  /**
-   * Barrier is crossed
-   */
-  GNUNET_TESTBED_BARRIERSTATUS_CROSSED,
-
-  /**
-   * Error status
-   */
-  GNUNET_TESTBED_BARRIERSTATUS_ERROR,
-};
-
-
-/**
- * Functions of this type are to be given as callback argument to
- * GNUNET_TESTBED_barrier_init().  The callback will be called when status
- * information is available for the barrier.
- *
- * @param cls the closure given to GNUNET_TESTBED_barrier_init()
- * @param name the name of the barrier
- * @param barrier the barrier handle
- * @param status status of the barrier.  The barrier is removed once it has been
- *          crossed or an error occurs while processing it.  Therefore it is
- *          invalid to call GNUNET_TESTBED_barrier_cancel() on a crossed or
- *          errored barrier.
- * @param emsg if the status were to be #GNUNET_SYSERR, this parameter has the
- *   error message
- */
-typedef void
-(*GNUNET_TESTBED_barrier_status_cb) (void *cls,
-                                     const char *name,
-                                     struct GNUNET_TESTBED_Barrier *barrier,
-                                     enum GNUNET_TESTBED_BarrierStatus status,
-                                     const char *emsg);
-
-
-/**
- * Initialise a barrier and call the given callback when the required percentage
- * of peers (quorum) reach the barrier.
- *
- * @param controller the handle to the controller
- * @param name identification name of the barrier
- * @param quorum the percentage of peers that is required to reach the barrier.
- *   Peers signal reaching a barrier by calling
- *   GNUNET_TESTBED_barrier_reached().
- * @param cb the callback to call when the barrier is reached or upon error.
- *   Cannot be NULL.
- * @param cb_cls closure for @a cb
- * @return barrier handle
- */
-struct GNUNET_TESTBED_Barrier *
-GNUNET_TESTBED_barrier_init (struct GNUNET_TESTBED_Controller *controller,
-                             const char *name,
-                             unsigned int quorum,
-                             GNUNET_TESTBED_barrier_status_cb cb,
-                             void *cb_cls);
-
-
-/**
- * Cancel a barrier.
- *
- * @param barrier the barrier handle
- */
-void
-GNUNET_TESTBED_barrier_cancel (struct GNUNET_TESTBED_Barrier *barrier);
-
-
-/**
- * Opaque handle for barrier wait
- */
-struct GNUNET_TESTBED_BarrierWaitHandle;
-
-
-/**
- * Functions of this type are to be given as acallback argument to
- * GNUNET_TESTBED_barrier_wait().  The callback will be called when the barrier
- * corresponding given in GNUNET_TESTBED_barrier_wait() is crossed or cancelled.
- *
- * @param cls closure pointer given to GNUNET_TESTBED_barrier_wait()
- * @param name the barrier name
- * @param status #GNUNET_SYSERR in case of error while waiting for the barrier;
- *   #GNUNET_OK if the barrier is crossed
- */
-typedef void
-(*GNUNET_TESTBED_barrier_wait_cb) (void *cls,
-                                   const char *name,
-                                   int status);
-
-
-/**
- * Wait for a barrier to be crossed.  This function should be called by the
- * peers which have been started by the testbed.  If the peer is not started by
- * testbed this function may return error
- *
- * @param name the name of the barrier
- * @param cb the barrier wait callback
- * @param cls the closure for the above callback
- * @return barrier wait handle which can be used to cancel the waiting at
- *   anytime before the callback is called.  NULL upon error.
- */
-struct GNUNET_TESTBED_BarrierWaitHandle *
-GNUNET_TESTBED_barrier_wait (const char *name,
-                             GNUNET_TESTBED_barrier_wait_cb cb,
-                             void *cls);
-
-
-/**
- * Cancel a barrier wait handle.  Should not be called in or after the callback
- * given to GNUNET_TESTBED_barrier_wait() has been called.
- *
- * @param h the barrier wait handle
- */
-void
-GNUNET_TESTBED_barrier_wait_cancel (struct GNUNET_TESTBED_BarrierWaitHandle *h);
-
-
-/**
- * Model for configuring underlay links of a peer
- * @ingroup underlay
- */
-struct GNUNET_TESTBED_UnderlayLinkModel;
-
-
-/**
- * The type of GNUNET_TESTBED_UnderlayLinkModel
- * @ingroup underlay
- */
-enum GNUNET_TESTBED_UnderlayLinkModelType
-{
-  /**
-   * The model is based on white listing of peers to which underlay connections
-   * are permitted.  Underlay connections to all other peers will not be
-   * permitted.
-   */
-  GNUNET_TESTBED_UNDERLAYLINKMODELTYPE_BLACKLIST,
-
-  /**
-   * The model is based on black listing of peers to which underlay connections
-   * are not permitted.  Underlay connections to all other peers will be
-   * permitted
-   */
-  GNUNET_TESTBED_UNDERLAYLINKMODELTYPE_WHITELIST
-};
-
-
-/**
- * Create a GNUNET_TESTBED_UnderlayLinkModel for the given peer.  A peer can
- * have ONLY ONE model and it can be either a blacklist or whitelist based one.
- *
- * @ingroup underlay
- * @param peer the peer for which the model has to be created
- * @param type the type of the model
- * @return the model
- */
-struct GNUNET_TESTBED_UnderlayLinkModel *
-GNUNET_TESTBED_underlaylinkmodel_create (struct GNUNET_TESTBED_Peer *peer,
-                                         enum
-                                         GNUNET_TESTBED_UnderlayLinkModelType
-                                         type);
-
-
-/**
- * Add a peer to the given model.  Underlay connections to the given peer will
- * be permitted if the model is whitelist based; otherwise they will not be
- * permitted.
- *
- * @ingroup underlay
- * @param model the model
- * @param peer the peer to add
- */
-void
-GNUNET_TESTBED_underlaylinkmodel_add_peer (struct
-                                           GNUNET_TESTBED_UnderlayLinkModel *
-                                           model,
-                                           struct GNUNET_TESTBED_Peer *peer);
-
-
-/**
- * Set the metrics for a link to the given peer in the underlay model.  The link
- * SHOULD be permittable according to the given model.
- *
- * @ingroup underlay
- * @param model the model
- * @param peer the other end peer of the link
- * @param latency latency of the link in microseconds
- * @param loss data loss of the link expressed as a percentage
- * @param bandwidth bandwidth of the link in kilobytes per second [kB/s]
- */
-void
-GNUNET_TESTBED_underlaylinkmodel_set_link (struct
-                                           GNUNET_TESTBED_UnderlayLinkModel *
-                                           model,
-                                           struct GNUNET_TESTBED_Peer *peer,
-                                           uint32_t latency,
-                                           uint32_t loss,
-                                           uint32_t bandwidth);
-
-
-/**
- * Commit the model.  The model is freed in this function(!).
- *
- * @ingroup underlay
- * @param model the model to commit
- */
-void
-GNUNET_TESTBED_underlaylinkmodel_commit (struct
-                                         GNUNET_TESTBED_UnderlayLinkModel *model);
-
-
-/**
- * Free the resources of the model.  Use this function only if the model has not
- * be committed and has to be unallocated.  The peer can then have another model
- * created.
- *
- * @ingroup underlay
- * @param model the model to unallocate
- */
-void
-GNUNET_TESTBED_underlaylinkmodel_free (struct
-                                       GNUNET_TESTBED_UnderlayLinkModel *model);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
-
-/** @} */  /* end of group */
diff --git a/src/include/gnunet_testing_arm_lib.h b/src/include/gnunet_testing_arm_lib.h
new file mode 100644
index 000000000..66852b506
--- /dev/null
+++ b/src/include/gnunet_testing_arm_lib.h
@@ -0,0 +1,47 @@
+#ifndef GNUNET_TESTING_ARM_LIB_H
+#define GNUNET_TESTING_ARM_LIB_H
+
+#include "gnunet_arm_service.h"
+
+/**
+ * Create command.
+ *
+ * @param label name for command.
+ * @param system_label Label of the cmd to setup a test environment.
+ * @param cfgname Configuration file name for this peer.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_ARM_cmd_start_peer (
+  const char *label,
+  const char *system_label,
+  const char *cfgname);
+
+
+/**
+ * Create command.
+ *
+ * @param label name for command.
+ * @param start_label Label of the cmd to start the peer.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_stop_peer (
+  const char *label,
+  const char *start_label);
+
+
+/**
+ * Call #op on all simple traits.
+ */
+#define GNUNET_TESTING_ARM_SIMPLE_TRAITS(op, prefix) \
+        op (prefix,                                  \
+            arm_handle,                              \
+            struct GNUNET_ARM_Handle)
+
+
+GNUNET_TESTING_ARM_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                                  GNUNET_TESTING_ARM)
+
+
+#endif
diff --git a/src/include/gnunet_testing_core_lib.h b/src/include/gnunet_testing_core_lib.h
new file mode 100644
index 000000000..cf96b395d
--- /dev/null
+++ b/src/include/gnunet_testing_core_lib.h
@@ -0,0 +1,159 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021-2023 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @brief API for cmds working with core sub system provided by libgnunetcoretesting
+ * @author t3sserakt
+ */
+#ifndef GNUNET_TESTING_CORE_LIB_H
+#define GNUNET_TESTING_CORE_LIB_H
+
+
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+
+/**
+ * Struct to store information needed in callbacks.
+ */
+// FIXME: breaks naming conventions
+struct GNUNET_TESTING_ConnectPeersState
+{
+  /**
+   * Receive callback
+   */
+  struct GNUNET_MQ_MessageHandler *handlers;
+
+  /**
+   * A map with struct GNUNET_MQ_Handle values for each peer this peer
+   * is connected to.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *connected_peers_map;
+
+  /**
+   * Handle for transport.
+   */
+  struct GNUNET_TRANSPORT_ApplicationHandle *ah;
+
+  /**
+   * Core handle.
+   */
+  struct GNUNET_TRANSPORT_CoreHandle *th;
+
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * The testing system of this node.
+   */
+  const struct GNUNET_TESTING_System *tl_system;
+
+  // Label of the cmd which started the test system.
+  const char *create_label;
+
+  /**
+   * Number globally identifying the node.
+   *
+   */
+  uint32_t num;
+
+  /**
+   * Label of the cmd to start a peer.
+   *
+   */
+  const char *start_peer_label;
+
+  /**
+   * The topology of the test setup.
+   */
+  struct GNUNET_TESTING_NetjailTopology *topology;
+
+  /**
+   * Connections to other peers.
+   */
+  struct GNUNET_TESTING_NodeConnection *node_connections_head;
+
+  struct GNUNET_TESTING_Interpreter *is;
+
+  /**
+   * Number of connections.
+   */
+  unsigned int con_num;
+
+  /**
+   * Number of additional connects this cmd will wait for not triggered by this cmd.
+   */
+  unsigned int additional_connects;
+
+  /**
+ * Number of connections we already have a notification for.
+ */
+  unsigned int con_num_notified;
+
+  /**
+   * Number of additional connects this cmd will wait for not triggered by this cmd we already have a notification for.
+   */
+  unsigned int additional_connects_notified;
+
+  /**
+   * Flag indicating, whether the command is waiting for peers to connect that are configured to connect.
+   */
+  unsigned int wait_for_connect;
+};
+
+
+/**
+ * FIXME: document properly!
+ * Create command
+ *
+ * @param label name for command
+ * @param start_peer_label Label of the cmd to start a peer.
+ * @param create_label Label of the cmd which started the test system.
+ * @param num Number globally identifying the node.
+ * @param topology The topology for the test setup.
+ * @param additional_connects Number of additional connects this cmd will wait for not triggered by this cmd.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_CORE_cmd_connect_peers (
+  const char *label,
+  const char *start_peer_label,
+  const char *create_label,
+  uint32_t num,
+  struct GNUNET_TESTING_NetjailTopology *topology,
+  unsigned int additional_connects,
+  unsigned int wait_for_connect,
+  struct GNUNET_MQ_MessageHandler *handlers);
+
+
+/**
+ * Call #op on all simple traits.
+ */
+#define GNUNET_CORE_TESTING_SIMPLE_TRAITS(op, prefix)   \
+        op (prefix, connect_peer_state, const struct \
+            GNUNET_TESTING_ConnectPeersState)
+
+GNUNET_CORE_TESTING_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                                   GNUNET_CORE_TESTING)
+
+
+#endif
diff --git a/src/include/gnunet_testing_lib.h b/src/include/gnunet_testing_lib.h
index 664e20ac3..95961b640 100644
--- a/src/include/gnunet_testing_lib.h
+++ b/src/include/gnunet_testing_lib.h
@@ -1,6 +1,6 @@
 /*
       This file is part of GNUnet
-      Copyright (C) 2008, 2009, 2012 GNUnet e.V.
+      Copyright (C) 2021, 2023, 2024 GNUnet e.V.
 
       GNUnet is free software: you can redistribute it and/or modify it
       under the terms of the GNU Affero General Public License as published
@@ -19,456 +19,959 @@
  */
 
 /**
- * @author Christian Grothoff
- *
- * @file
- * Convenience API for writing testcases for GNUnet
+ * @brief Central interpreter and command loop for writing an interpreter to test asynchronous systems
+ * @author Christian Grothoff <christian@grothoff.org>
+ * @author Marcello Stanisci
+ * @author t3sserakt
+ */
+#ifndef GNUNET_TESTING_LIB_H
+#define GNUNET_TESTING_LIB_H
+
+#include "gnunet_util_lib.h"
+
+/**
+ * Maximum length of label in command
+ */
+#define GNUNET_TESTING_CMD_MAX_LABEL_LENGTH 127
+
+/* ********************* Helper functions ********************* */
+
+/**
+ * Print failing line number and trigger shutdown.  Useful
+ * quite any time after the command "run" method has been called.
+ * Returns from the current function.
+ */
+#define GNUNET_TESTING_FAIL(is)                 \
+        do {                                    \
+          GNUNET_break (0);                     \
+          GNUNET_TESTING_interpreter_fail (is); \
+          return;                               \
+        } while (0)
+
+
+/**
+ * Log an error message about a command not having run to completion.
  *
- * @defgroup testing  Testing library
- * Library for writing testcases for GNUnet.
+ * @param is interpreter
+ * @param label command label of the incomplete command
+ */
+#define GNUNET_TESTING_command_incomplete(is,label)                       \
+        do {                                                              \
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                            \
+                      "Command %s (%s:%u) did not complete (at %s)\n",    \
+                      label,                                              \
+                      __FILE__,                                           \
+                      __LINE__,                                           \
+                      GNUNET_TESTING_interpreter_current_cmd_get_label (is)); \
+        } while (0)
+
+
+/* ******************* Generic interpreter logic ************ */
+
+/**
+ * Global state of the interpreter, used by a command
+ * to access information about other commands.
+ */
+struct GNUNET_TESTING_Interpreter;
+
+/**
+ * State each asynchronous command must have in its closure.
+ */
+struct GNUNET_TESTING_AsyncContext
+{
+
+  /**
+   * Interpreter we are part of.  Initialized when
+   * the global interpreter starts.
+   */
+  struct GNUNET_TESTING_Interpreter *is;
+
+  /**
+   * Function to call when async operation is done.
+   */
+  GNUNET_SCHEDULER_TaskCallback notify_finished;
+
+  /**
+   * Closure for @e notify_finished.
+   */
+  void *notify_finished_cls;
+
+  /**
+   * Indication if the command finished (#GNUNET_OK).
+   * #GNUNET_NO if it did not finish,
+   * #GNUNET_SYSERR if it failed.
+   */
+  enum GNUNET_GenericReturnValue finished;
+
+  /**
+   * Set to true if interpreter_next() has already been
+   * called for this command.
+   */
+  bool next_called;
+};
+
+
+/**
+ * The asynchronous command of @a ac has failed.
  *
- * It can start/stop one or more peers on a system; testing is responsible for
- * managing private keys, ports and paths; it is a low-level library that does
- * not support higher-level functions such as P2P connection, topology
- * management or distributed testbed maintenance (those are provided by the
- * [Testbed service](@ref testbed))
+ * @param ac command-specific context
+ */
+void
+GNUNET_TESTING_async_fail (
+  struct GNUNET_TESTING_AsyncContext *ac);
+
+
+/**
+ * The asynchronous command of @a ac has finished.
  *
- * @see [Documentation](https://gnunet.org/writing_testcases)
+ * @param ac command-specific context
+ */
+void
+GNUNET_TESTING_async_finish (
+  struct GNUNET_TESTING_AsyncContext *ac);
+
+
+/**
+ * Signature of a function used to start executing a command of a test.  Runs
+ * the command.  Note that upon return, the interpreter will not automatically
+ * run the next command if this is an asynchronous command unless the command
+ * was wrapped in #GNUNET_TESTING_cmd_make_unblocking(), as the command may
+ * then continue asynchronously in other scheduler tasks.  In this case,
+ * #GNUNET_TESTING_async_finish() must be called to run the next task.
  *
- * @{
+ * @param cls closure
+ * @param is interpreter running the command
  */
+typedef void
+(*GNUNET_TESTING_CommandRunRoutine)(
+  void *cls,
+  struct GNUNET_TESTING_Interpreter *is);
 
-#ifndef GNUNET_TESTING_LIB_H
-#define GNUNET_TESTING_LIB_H
 
-#include "gnunet_util_lib.h"
-#include "gnunet_statistics_service.h"
-#include "gnunet_arm_service.h"
+/**
+ * Signature of a function used to clean up resources allocated
+ * by a command.
+ *
+ * @param cls closure
+ */
+typedef void
+(*GNUNET_TESTING_CommandCleanupRoutine)(void *cls);
 
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
 
 /**
- * Size of each hostkey in the hostkey file (in BYTES).
+ * Signature of a function used to extract traits exposed by a
+ * command.
+ *
+ * @param cls closure
+ * @param[out] ret where to return the trait data
+ * @param trait name of the trait to return
+ * @param index index of the trait (for traits that are indexed)
+ * @return #GNUNET_OK on success
  */
-#define GNUNET_TESTING_HOSTKEYFILESIZE sizeof(struct \
-                                              GNUNET_CRYPTO_EddsaPrivateKey)
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_TESTING_CommandGetTraits) (void *cls,
+                                    const void **ret,
+                                    const char *trait,
+                                    unsigned int index);
 
 /**
- * The environmental variable, if set, that dictates where testing should place
- * generated peer configurations
+ * Create a new command that may be asynchronous.
+ *
+ * @param cls the closure
+ * @param label the Label. Maximum length is #GNUNET_TESTING_CMD_MAX_LABEL_LENGTH
+ * @param run the run routing
+ * @param cleanup the cleanup function
+ * @param traits the traits function (optional)
+ * @param ac the async context, NULL if command is always
+ *           synchronous
+ * @return the command the function cannot fail
  */
-#define GNUNET_TESTING_PREFIX "GNUNET_TESTING_PREFIX"
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_command_new_ac (
+  void *cls,
+  const char *label,
+  GNUNET_TESTING_CommandRunRoutine run,
+  GNUNET_TESTING_CommandCleanupRoutine cleanup,
+  GNUNET_TESTING_CommandGetTraits traits,
+  struct GNUNET_TESTING_AsyncContext *ac);
 
 
 /**
- * Handle for a system on which GNUnet peers are executed;
- * a system is used for reserving unique paths and ports.
+ * Create a new command
+ *
+ * @param cls the closure
+ * @param label the Label. Maximum length is #GNUNET_TESTING_CMD_MAX_LABEL_LENGTH
+ * @param run the run routing
+ * @param cleanup the cleanup function
+ * @param traits the traits function (optional)
+ * @return the command the function cannot fail
  */
-struct GNUNET_TESTING_System;
+#define GNUNET_TESTING_command_new(cls,label,run,cleanup,traits) \
+        GNUNET_TESTING_command_new_ac (cls,label,run,cleanup,traits,NULL)
 
 
 /**
- * Handle for a GNUnet peer controlled by testing.
+ * Structure with storage space for a label.
  */
-struct GNUNET_TESTING_Peer;
+struct GNUNET_TESTING_CommandLabel
+{
+  char value[GNUNET_TESTING_CMD_MAX_LABEL_LENGTH + 1];
+};
 
 
 /**
- * Specification of a service that is to be shared among peers
+ * Set @a label to @a value. Asserts that @a value is
+ * not longer than #GNUNET_TESTING_CMD_MAX_LABEL_LENGTH.
+ *
+ * @param[out] label label to initialize
+ * @param value value to store into @a label
  */
-struct GNUNET_TESTING_SharedService
+void
+GNUNET_TESTING_set_label (
+  struct GNUNET_TESTING_CommandLabel *label,
+  const char *value);
+
+
+/**
+ * A command to be run by the interpreter.
+ */
+struct GNUNET_TESTING_Command
 {
+
+  /**
+   * Label for the command.
+   */
+  struct GNUNET_TESTING_CommandLabel label;
+
+  /**
+   * Closure for all commands with command-specific context information.
+   */
+  void *cls;
+
+  /**
+   * Variable name for the command, NULL for none.
+   */
+  const char *name;
+
+  /**
+   * Runs the command.  Note that upon return, the interpreter
+   * will not automatically run the next command, as the command
+   * may continue asynchronously in other scheduler tasks.  Thus,
+   * the command must ensure to eventually call
+   * #GNUNET_TESTING_interpreter_next() or
+   * #GNUNET_TESTING_interpreter_fail().
+   *
+   * If this function creates some asynchronous activity, it should
+   * initialize @e finish to a function that can be used to wait for
+   * the asynchronous activity to terminate.
+   *
+   * @param cls closure
+   * @param is interpreter state
+   */
+  GNUNET_TESTING_CommandRunRoutine run;
+
+  /**
+   * Pointer to the asynchronous context in the command's
+   * closure. Used by the
+   * #GNUNET_TESTING_async_finish() and
+   * #GNUNET_TESTING_async_fail() functions.
+   *
+   * Must be NULL if a command is synchronous.
+   */
+  struct GNUNET_TESTING_AsyncContext *ac;
+
+  /**
+   * Clean up after the command.  Run during forced termination
+   * (CTRL-C) or test failure or test success.
+   *
+   * @param cls closure
+   */
+  GNUNET_TESTING_CommandCleanupRoutine cleanup;
+
+  /**
+   * Extract information from a command that is useful for other
+   * commands. Can be NULL if a command has no traits.
+   *
+   * @param cls closure
+   * @param[out] ret result (could be anything)
+   * @param trait name of the trait
+   * @param index index number of the object to extract.
+   * @return #GNUNET_OK on success,
+   *         #GNUNET_NO if no trait was found
+   */
+  GNUNET_TESTING_CommandGetTraits traits;
+
   /**
-   * The name of the service.
+   * When did the execution of this command start?
    */
-  const char *service;
+  struct GNUNET_TIME_Absolute start_time;
 
   /**
-   * The configuration template for the service.  Cannot be NULL
+   * When did the execution of this command finish?
    */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_TIME_Absolute finish_time;
 
   /**
-   * The number of peers which share an instance of the service.  0 for sharing
-   * among all peers
+   * When did we start the last run of this command?  Delta to @e finish_time
+   * gives the latency for the last successful run.  Useful in case @e
+   * num_tries was positive and the command was run multiple times.  In that
+   * case, the @e start_time gives the time when we first tried to run the
+   * command, so the difference between @e start_time and @e finish_time would
+   * be the time all of the @e num_tries took, while the delta to @e
+   * last_req_time is the time the last (successful) execution took.
    */
-  unsigned int share;
+  struct GNUNET_TIME_Absolute last_req_time;
+
+  /**
+   * How often did we try to execute this command? (In case it is a request
+   * that is repated.)  Note that a command must have some built-in retry
+   * mechanism for this value to be useful.
+   */
+  unsigned int num_tries;
+
+  /**
+   * If "true", the interpreter should not immediately run the next command,
+   * even if this command did not complete via #GNUNET_TESTING_async_finish().
+   * Otherwise, #GNUNET_TESTING_cmd_finish() must be used to ensure that a
+   * command actually completed.
+   */
+  bool asynchronous_finish;
+
 };
 
 
 /**
- * Create a system handle.  There must only be one system handle per operating
- * system.  Uses a default range for allowed ports.  Ports are still tested for
- * availability.
- *
- * @param testdir only the directory name without any path. This is used for all
- *          service homes; the directory will be created in a temporary location
- *          depending on the underlying OS.  This variable will be
- *          overridden with the value of the environmental variable
- *          GNUNET_TESTING_PREFIX, if it exists.
- * @param trusted_ip the ip address which will be set as TRUSTED HOST in all
- *          service configurations generated to allow control connections from
- *          this ip. This can either be a single ip address or a network address
- *          in CIDR notation.
- * @param hostname the hostname of the system we are using for testing; NULL for
- *          localhost
- * @param shared_services NULL terminated array describing services that are to
- *          be shared among peers
- * @return handle to this system, NULL on error
- */
-struct GNUNET_TESTING_System *
-GNUNET_TESTING_system_create (const char *testdir,
-                              const char *trusted_ip,
-                              const char *hostname,
-                              const struct GNUNET_TESTING_SharedService *
-                              shared_services);
-
-
-/**
- * Create a system handle.  There must only be one system
- * handle per operating system.  Use this function directly
- * if multiple system objects are created for the same host
- * (only really useful when testing --- or to make the port
- * range configurable).
- *
- * @param testdir only the directory name without any path. This is used for
- *          all service homes; the directory will be created in a temporary
- *          location depending on the underlying OS.  This variable will be
- *          overridden with the value of the environmental variable
- *          GNUNET_TESTING_PREFIX, if it exists.
- * @param trusted_ip the ip address which will be set as TRUSTED HOST in all
- *          service configurations generated to allow control connections from
- *          this ip. This can either be a single ip address or a network address
- *          in CIDR notation.
- * @param hostname the hostname of the system we are using for testing; NULL for
- *          localhost
- * @param shared_services NULL terminated array describing services that are to
- *          be shared among peers
- * @param lowport lowest port number this system is allowed to allocate (inclusive)
- * @param highport highest port number this system is allowed to allocate (exclusive)
- * @return handle to this system, NULL on error
- */
-struct GNUNET_TESTING_System *
-GNUNET_TESTING_system_create_with_portrange (const char *testdir,
-                                             const char *trusted_ip,
-                                             const char *hostname,
-                                             const struct
-                                             GNUNET_TESTING_SharedService *
-                                             shared_services,
-                                             uint16_t lowport,
-                                             uint16_t highport);
-
-
-/**
- * Free system resources.
- *
- * @param system system to be freed
- * @param remove_paths should the 'testdir' and all subdirectories
- *        be removed (clean up on shutdown)?
+ * Lookup command by label.
+ *
+ * @param is interpreter to lookup command in
+ * @param label label of the command to lookup.
+ * @return the command, if it is found, or NULL.
+ */
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_lookup_command (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *label);
+
+
+/**
+ * Get command from hash map by variable name.
+ *
+ * @param is interpreter state.
+ * @param name name of the variable to get command by
+ * @return the command, if it is found, or NULL.
+ */
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_get_command (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *name);
+
+
+/**
+ * Update the last request time of the current command
+ * to the current time.
+ *
+ * @param[in,out] is interpreter state where to show
+ *       that we are doing something
+ */
+void
+GNUNET_TESTING_interpreter_current_cmd_touch (
+  struct GNUNET_TESTING_Interpreter *is);
+
+
+/**
+ * Increment the 'num_tries' counter for the current command.
+ *
+ * @param[in,out] is interpreter state where to
+ *   increment the counter
  */
 void
-GNUNET_TESTING_system_destroy (struct GNUNET_TESTING_System *system,
-                               int remove_paths);
+GNUNET_TESTING_interpreter_current_cmd_inc_tries (
+  struct GNUNET_TESTING_Interpreter *is);
+
+
+/**
+ * Obtain label of the command being now run.
+ *
+ * @param is interpreter state.
+ * @return the label.
+ */
+const char *
+GNUNET_TESTING_interpreter_current_cmd_get_label (
+  struct GNUNET_TESTING_Interpreter *is);
 
 
 /**
- * Testing includes a number of pre-created hostkeys for
- * faster peer startup.  This function can be used to
- * access the n-th key of those pre-created hostkeys; note
- * that these keys are ONLY useful for testing and not
- * secure as the private keys are part of the public
- * GNUnet source code.
+ * Current command failed, clean up and fail the test case.
  *
- * This is primarily a helper function used internally
- * by #GNUNET_TESTING_peer_configure().
+ * @param is interpreter state.
+ */
+void
+GNUNET_TESTING_interpreter_fail (
+  struct GNUNET_TESTING_Interpreter *is);
+
+
+/**
+ * Skips the current test, the environment is
+ * not prepared correctly.
  *
- * @param system the testing system handle
- * @param key_number desired pre-created hostkey to obtain
- * @param id set to the peer's identity (hash of the public
- *        key; if NULL, #GNUNET_SYSERR is returned immediately
- * @return NULL on error (not enough keys)
+ * @param is interpreter state.
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *
-GNUNET_TESTING_hostkey_get (const struct GNUNET_TESTING_System *system,
-                            uint32_t key_number,
-                            struct GNUNET_PeerIdentity *id);
+void
+GNUNET_TESTING_interpreter_skip (
+  struct GNUNET_TESTING_Interpreter *is);
 
 
 /**
- * Reserve a port for a peer.
+ * Callback over commands of an interpreter.
  *
- * @param system system to use for reservation tracking
- * @return 0 if no free port was available
+ * @param cls closure
+ * @param cmd a command to process
  */
-uint16_t
-GNUNET_TESTING_reserve_port (struct GNUNET_TESTING_System *system);
+typedef void
+(*GNUNET_TESTING_CommandIterator)(
+  void *cls,
+  const struct GNUNET_TESTING_Command *cmd);
 
 
 /**
- * Release reservation of a TCP or UDP port for a peer
- * (used during GNUNET_TESTING_peer_destroy).
+ * Iterates over all of the top-level commands of an
+ * interpreter.
  *
- * @param system system to use for reservation tracking
- * @param port reserved port to release
+ * @param[in] is interpreter to iterate over
+ * @param asc true in execution order, false for reverse execution order
+ * @param cb function to call on each command
+ * @param cb_cls closure for cb
  */
 void
-GNUNET_TESTING_release_port (struct GNUNET_TESTING_System *system,
-                             uint16_t port);
+GNUNET_TESTING_interpreter_commands_iterate (
+  struct GNUNET_TESTING_Interpreter *is,
+  bool asc,
+  GNUNET_TESTING_CommandIterator cb,
+  void *cb_cls);
+
+
+/* ************** Fundamental interpreter commands ************ */
 
 
 /**
- * Create a new configuration using the given configuration as a template;
- * ports and paths will be modified to select available ports on the local
- * system. The default configuration will be available in PATHS section under
- * the option DEFAULTCONFIG after the call. SERVICE_HOME is also set in PATHS
- * section to the temporary directory specific to this configuration. If we run
- * out of "*port" numbers, return #GNUNET_SYSERR.
+ * Create command array terminator.
  *
- * This is primarily a helper function used internally
- * by #GNUNET_TESTING_peer_configure().
+ * @return a end-command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_end (void);
+
+
+/**
+ * Create a "batch" command.  Such command takes a end_CMD-terminated array of
+ * CMDs and executed them.  Once it hits the end CMD, it passes the control to
+ * the next top-level CMD, regardless of it being another batch or ordinary
+ * CMD.
  *
- * @param system system to use to coordinate resource usage
- * @param cfg template configuration to update
- * @return #GNUNET_OK on success,
- *         #GNUNET_SYSERR on error - the configuration will
- *           be incomplete and should not be used there upon
+ * @param label the command label.
+ * @param batch array of CMDs to execute.
+ * @return the command.
  */
-int
-GNUNET_TESTING_configuration_create (struct GNUNET_TESTING_System *system,
-                                     struct GNUNET_CONFIGURATION_Handle *cfg);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_batch (
+  const char *label,
+  struct GNUNET_TESTING_Command *batch);
+
+
+/**
+ * Performance counter.
+ */
+struct GNUNET_TESTING_Timer
+{
+  /**
+   * For which type of commands.
+   */
+  const char *prefix;
 
-// FIXME: add dual to 'release' ports again...
+  /**
+   * Total time spend in all commands of this type.
+   */
+  struct GNUNET_TIME_Relative total_duration;
 
+  /**
+   * Total time spend waiting for the *successful* exeuction
+   * in all commands of this type.
+   */
+  struct GNUNET_TIME_Relative success_latency;
+
+  /**
+   * Number of commands summed up.
+   */
+  unsigned int num_commands;
+
+  /**
+   * Number of retries summed up.
+   */
+  unsigned int num_retries;
+};
 
 /**
- * Configure a GNUnet peer.  GNUnet must be installed on the local
- * system and available in the PATH.
+ * Obtain performance data from the interpreter.
  *
- * @param system system to use to coordinate resource usage
- * @param cfg configuration to use; will be UPDATED (to reflect needed
- *            changes in port numbers and paths)
- * @param key_number number of the hostkey to use for the peer
- * @param id identifier for the daemon, will be set, can be NULL
- * @param emsg set to freshly allocated error message (set to NULL on success),
- *          can be NULL
- * @return handle to the peer, NULL on error
+ * @param label command label.
+ * @param[in,out] timers NULL-prefix terminated array that specifies what commands (by label) to obtain runtimes for
+ * @return the command
  */
-struct GNUNET_TESTING_Peer *
-GNUNET_TESTING_peer_configure (struct GNUNET_TESTING_System *system,
-                               struct GNUNET_CONFIGURATION_Handle *cfg,
-                               uint32_t key_number,
-                               struct GNUNET_PeerIdentity *id,
-                               char **emsg);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_stat (
+  const char *label,
+  struct GNUNET_TESTING_Timer *timers);
 
 
 /**
- * Obtain the peer identity from a peer handle.
+ * Set variable to command as side-effect of
+ * running a command.
  *
- * @param peer peer handle for which we want the peer's identity
- * @param id identifier for the daemon, will be set
+ * @param name name of the variable to set
+ * @param cmd command to set to variable when run
+ * @return modified command
  */
-void
-GNUNET_TESTING_peer_get_identity (struct GNUNET_TESTING_Peer *peer,
-                                  struct GNUNET_PeerIdentity *id);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_set_var (
+  const char *name,
+  struct GNUNET_TESTING_Command cmd);
 
 
 /**
- * Start the peer.
+ * Command to create a barrier.
  *
- * @param peer peer to start
- * @return #GNUNET_OK on success,
- *         #GNUNET_SYSERR on error (i.e. peer already running)
+ * @param label The label of this command.
+ * @param number_to_be_reached If this number of processes reached
+ *                             this barrier, all processes waiting at
+ *                             this barrier can pass it.
  */
-int
-GNUNET_TESTING_peer_start (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_barrier_create (
+  const char *label,
+  unsigned int number_to_be_reached);
 
 
 /**
- * Stop the peer. This call is blocking as it kills the peer's main ARM process
- * by sending a SIGTERM and waits on it.  For asynchronous shutdown of peer, see
- * GNUNET_TESTING_peer_stop_async().
+ * If this command is executed the the process is signaling the master process
+ * that it reached a barrier. If this command is synchronous it will block.
  *
- * @param peer peer to stop
- * @return #GNUNET_OK on success,
- *         #GNUNET_SYSERR on error (i.e. peer not running)
+ * @param label name for command.
+ * @param barrier_label The name of the barrier we waited for and which was reached.
+ * @return command.
  */
-int
-GNUNET_TESTING_peer_stop (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_barrier_reached (
+  const char *label,
+  const char *barrier_label);
+
+
+#define GNUNET_TESTING_NETJAIL_START_SCRIPT "netjail_start_new.sh"
 
+#define GNUNET_TESTING_NETJAIL_STOP_SCRIPT "netjail_stop.sh"
 
 /**
- * Destroy the peer.  Releases resources locked during peer configuration.
- * If the peer is still running, it will be stopped AND a warning will be
- * printed (users of the API should stop the peer explicitly first).
+ * Create command.
  *
- * @param peer peer to destroy
+ * @param label Name for the command.
+ * @param topology_data topology data
+ * @param timeout Before this timeout is reached this cmd MUST finish.
+ * @return command.
  */
-void
-GNUNET_TESTING_peer_destroy (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_netjail_start_helpers (
+  const char *label,
+  const char *topology_cmd_label,
+  struct GNUNET_TIME_Relative timeout);
 
 
 /**
- * Sends SIGTERM to the peer's main process
+ * This command executes a shell script to setup the netjail environment.
  *
- * @param peer the handle to the peer
- * @return #GNUNET_OK if successful; #GNUNET_SYSERR if the main process is NULL
- *           or upon any error while sending SIGTERM
+ * @param label name for command.
+ * @param script which script to run, e.g. #GNUNET_TESTING_NETJAIL_START_SCRIPT
+ * @param topology_config Configuration file for the test topology.
+ * @param read_file Flag indicating if the the name of the topology file is send to the helper, or a string with the topology data.
+ * @return command.
  */
-int
-GNUNET_TESTING_peer_kill (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_netjail_setup (
+  const char *label,
+  const char *script,
+  const char *topology_cmd_label);
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_load_topology_from_file (
+  const char *label,
+  const char *filename);
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_load_topology_from_string (
+  const char *label,
+  const char *topology_data);
 
 
 /**
- * Waits for a peer to terminate. The peer's main process will also be destroyed.
+ * Turn asynchronous command into non-blocking command by setting
+ * asynchronous_finish to true.  Modifies (and then returns) @a cmd simply
+ * setting the bit. By default, most commands are blocking, and by wrapping
+ * the command construction in this function a blocking command can be turned
+ * into an asynchronous command where the interpreter continues after
+ * initiating the asynchronous action. Does nothing if the command is
+ * fundamentally synchronous.
  *
- * @param peer the handle to the peer
- * @return #GNUNET_OK if successful; #GNUNET_SYSERR if the main process is NULL
- *           or upon any error while waiting
+ * @param[in,out] cmd command to make non-blocking
+ * @return a finish-command.
  */
-int
-GNUNET_TESTING_peer_wait (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_make_unblocking (
+  struct GNUNET_TESTING_Command cmd);
 
 
 /**
- * Callback to inform whether the peer is running or stopped.
+ * Create (synchronous) command that waits for another command to finish.
+ * If @a cmd_ref did not finish after @a timeout, this command will fail
+ * the test case.
  *
- * @param cls the closure given to GNUNET_TESTING_peer_stop_async()
- * @param peer the respective peer whose status is being reported
- * @param success #GNUNET_YES if the peer is stopped; #GNUNET_SYSERR upon any
- *          error
+ * @param finish_label label for this command
+ * @param cmd_ref reference to a previous command which we should
+ *        wait for (call `finish()` on)
+ * @param timeout how long to wait at most for @a cmd_ref to finish
+ * @return a finish-command.
  */
-typedef void
-(*GNUNET_TESTING_PeerStopCallback) (void *cls,
-                                    struct GNUNET_TESTING_Peer *peer,
-                                    int success);
+const struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_finish (
+  const char *finish_label,
+  const char *cmd_ref,
+  struct GNUNET_TIME_Relative timeout);
 
 
 /**
- * Stop a peer asynchronously using ARM API.  Peer's shutdown is signaled
- * through the GNUNET_TESTING_PeerStopCallback().
+ * Create a "signal" CMD.
  *
- * @param peer the peer to stop
- * @param cb the callback to signal peer shutdown
- * @param cb_cls closure for the @a cb
- * @return #GNUNET_OK upon successfully giving the request to the ARM API (this
- *           does not mean that the peer is successfully stopped); #GNUNET_SYSERR
- *           upon any error.
+ * @param label command label.
+ * @param process_label label of a command that has a process trait
+ * @param signal signal to send to @a process.
+ * @return the command.
  */
-int
-GNUNET_TESTING_peer_stop_async (struct GNUNET_TESTING_Peer *peer,
-                                GNUNET_TESTING_PeerStopCallback cb,
-                                void *cb_cls);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_signal (
+  const char *label,
+  const char *process_label,
+  int signal);
 
 
 /**
- * Cancel a previous asynchronous peer stop request.
- * GNUNET_TESTING_peer_stop_async() should have been called before on the given
- * peer.  It is an error to call this function if the peer stop callback was
- * already called
+ * Sleep for @a duration.
  *
- * @param peer the peer on which GNUNET_TESTING_peer_stop_async() was called
- *          before.
+ * @param label command label.
+ * @param duration time to sleep
+ * @return the command.
  */
-void
-GNUNET_TESTING_peer_stop_async_cancel (struct GNUNET_TESTING_Peer *peer);
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_sleep (
+  const char *label,
+  struct GNUNET_TIME_Relative duration);
 
 
 /**
- * Signature of the 'main' function for a (single-peer) testcase that
- * is run using #GNUNET_TESTING_peer_run().
+ * Command to execute a command.
+ *
+ * @param label Label of the command.
+*/
+const struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_exec (
+  const char *label,
+  enum GNUNET_OS_ProcessStatusType expected_type,
+  unsigned long int expected_exit_code,
+  char *const script_argv[]);
+
+
+/**
+ * Command to execute a command.
+ *
+ * @param label Label of the command.
+*/
+const struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_exec_va (
+  const char *label,
+  enum GNUNET_OS_ProcessStatusType expected_type,
+  unsigned long int expected_exit_code,
+  ...);
+
+
+/**
+ * Make the instruction pointer point to @a target_label
+ * only if @a counter is greater than zero.  Note that
+ * the command that will be executed next in this case
+ * is the one AFTER @a target_label, as the command we
+ * jump to is skipped by the advancing IP after the
+ * rewind.
+ *
+ * @param label command label
+ * @param target_label label of the new instruction pointer's destination after the jump;
+ *                     must be before the current instruction (and the command at the @a target_label itself will not be run, but the one afterwards)
+ * @param counter counts how many times the rewinding is to happen.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_rewind_ip (
+  const char *label,
+  const char *target_label,
+  unsigned int counter);
+
+
+/* ***************** main loop logic ************* */
+
+/**
+ * Function called with the final result of the test.
  *
  * @param cls closure
- * @param cfg configuration of the peer that was started
- * @param peer identity of the peer that was created
+ * @param rv #GNUNET_OK if the test passed
  */
 typedef void
-(*GNUNET_TESTING_TestMain) (void *cls,
-                            const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            struct GNUNET_TESTING_Peer *peer);
+(*GNUNET_TESTING_ResultCallback)(
+  void *cls,
+  enum GNUNET_GenericReturnValue rv);
+
+
+/**
+ * Run the testsuite.  Note, CMDs are copied into the interpreter state
+ * because they are _usually_ defined into the "run" method that returns after
+ * having scheduled the test interpreter.
+ *
+ * @param commands the array of command to execute
+ * @param timeout how long to wait for each command to execute
+ * @param rc function to call with the final result
+ * @param rc_cls closure for @a rc
+ * @return The interpreter.
+ */
+struct GNUNET_TESTING_Interpreter *
+GNUNET_TESTING_run (
+  const struct GNUNET_TESTING_Command *commands,
+  struct GNUNET_TIME_Relative timeout,
+  GNUNET_TESTING_ResultCallback rc,
+  void *rc_cls);
 
 
 /**
- * Start a single peer and run a test using the testing library.
- * Starts a peer using the given configuration and then invokes the
- * given callback.  This function ALSO initializes the scheduler loop
- * and should thus be called directly from "main".  The testcase
- * should self-terminate by invoking 'GNUNET_SCHEDULER_shutdown'.
+ * Start a GNUnet scheduler event loop and run the testsuite.  Return 0 upon
+ * success.  Expected to be called directly from main().
  *
- * @param testdir only the directory name without any path. This is used for
- *          all service homes; the directory will be created in a temporary
- *          location depending on the underlying OS
- * @param cfgfilename name of the configuration file to use;
- *         use NULL to only run with defaults
- * @param tm main function of the testcase
- * @param tm_cls closure for 'tm'
- * @return 0 on success, 1 on error
+ * @param commands the list of command to execute
+ * @param timeout how long to wait for each command to execute
+ * @return EXIT_SUCCESS on success, EXIT_FAILURE on failure
  */
 int
-GNUNET_TESTING_peer_run (const char *testdir,
-                         const char *cfgfilename,
-                         GNUNET_TESTING_TestMain tm,
-                         void *tm_cls);
+GNUNET_TESTING_main (
+  const struct GNUNET_TESTING_Command *commands,
+  struct GNUNET_TIME_Relative timeout);
+
+
+/* ***************** plugin logic ************* */
+
+
+/**
+ * The plugin API every test case plugin has to implement.
+ */
+struct GNUNET_TESTING_PluginFunctions;
+
+
+struct GNUNET_TESTING_PluginFunctions *
+GNUNET_TESTING_make_plugin (
+  const struct GNUNET_TESTING_Command *commands);
+
+#define GNUNET_TESTING_MAKE_PLUGIN(prefix,name,...)            \
+        void *                                                 \
+        prefix ## _plugin_ ## name ## _init (void *cls) { \
+          const char *my_node_id = cls; (void) my_node_id;     \
+          struct GNUNET_TESTING_Command commands[] = {         \
+            __VA_ARGS__,                                       \
+            GNUNET_TESTING_cmd_end ()                          \
+          };                                                   \
+          return GNUNET_TESTING_make_plugin (commands);        \
+        }                                                      \
+        void *                                                 \
+        prefix ## _plugin_ ## name ## _done (void *cls) {      \
+          struct GNUNET_TESTING_PluginFunctions *api = cls;    \
+          GNUNET_free (api);                                   \
+          return NULL;                                         \
+        }
+
+
+/* *** Generic trait logic for implementing traits ********* */
+
+/**
+ * A `struct GNUNET_TESTING_Trait` can be used to exchange data between cmds.
+ *
+ * Therefor the cmd which like to provide data to other cmds has to implement
+ * the trait function, where an array of traits is defined with the help of
+ * the #GNUNET_TESTING_make_trait_ macro. The data can be retrieved with the
+ * help of the #GNUNET_TESTING_get_trait_ macro. Traits name and type must be
+ * defined to make use of the macros.
+ */
+struct GNUNET_TESTING_Trait
+{
+  /**
+   * Index number associated with the trait.  This gives the
+   * possibility to have _multiple_ traits on offer under the
+   * same name.
+   */
+  unsigned int index;
+
+  /**
+   * Trait type, for example "reserve-pub" or "coin-priv".
+   */
+  const char *trait_name;
+
+  /**
+   * Pointer to the piece of data to offer.
+   */
+  const void *ptr;
+};
+
+
+/**
+ * "end" of traits array.  Because traits are offered into arrays, this type
+ * of trait is used to mark the end of such arrays; useful when iterating over
+ * those.
+ */
+struct GNUNET_TESTING_Trait
+GNUNET_TESTING_trait_end (void);
 
 
 /**
- * Start a single service (no ARM, except of course if the given
- * service name is 'arm') and run a test using the testing library.
- * Starts a service using the given configuration and then invokes the
- * given callback.  This function ALSO initializes the scheduler loop
- * and should thus be called directly from "main".  The testcase
- * should self-terminate by invoking 'GNUNET_SCHEDULER_shutdown'.
+ * Obtain value of a trait from a command.
  *
- * This function is useful if the testcase is for a single service
- * and if that service doesn't itself depend on other services.
+ * @param traits the array of all the traits.
+ * @param[out] ret where to store the result.
+ * @param trait type of the trait to extract.
+ * @param index index number of the trait to extract.
+ * @return #GNUNET_OK when the trait is found.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_TESTING_get_trait (
+  const struct GNUNET_TESTING_Trait *traits,
+  const void **ret,
+  const char *trait,
+  unsigned int index);
+
+
+/**
+ * Create headers for a trait with name @a name for
+ * statically allocated data of type @a type.
  *
- * @param testdir only the directory name without any path. This is used for
- *          all service homes; the directory will be created in a temporary
- *          location depending on the underlying OS
- * @param service_name name of the service to run
- * @param cfgfilename name of the configuration file to use;
- *         use NULL to only run with defaults
- * @param tm main function of the testcase
- * @param tm_cls closure for @a tm
- * @return 0 on success, 1 on error
+ * @param prefix symbol prefix to use
+ * @param name name of the trait
+ * @param type data type for the trait
  */
-int
-GNUNET_TESTING_service_run (const char *testdir,
-                            const char *service_name,
-                            const char *cfgfilename,
-                            GNUNET_TESTING_TestMain tm,
-                            void *tm_cls);
+#define GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT(prefix,name,type)  \
+        enum GNUNET_GenericReturnValue                           \
+        prefix ## _get_trait_ ## name (                          \
+          const struct GNUNET_TESTING_Command *cmd,              \
+          type * *ret);                                          \
+        struct GNUNET_TESTING_Trait                              \
+        prefix ## _make_trait_ ## name (                         \
+          type * value);
 
 
 /**
- * Sometimes we use the binary name to determine which specific
- * test to run.  In those cases, the string after the last "_"
- * in 'argv[0]' specifies a string that determines the configuration
- * file or plugin to use.
+ * Create C implementation for a trait with name @a name for statically
+ * allocated data of type @a type.
  *
- * This function returns the respective substring, taking care
- * of issues such as binaries ending in '.exe' on W32.
+ * @param prefix symbol prefix to use
+ * @param name name of the trait
+ * @param type data type for the trait
+ */
+#define GNUNET_TESTING_MAKE_IMPL_SIMPLE_TRAIT(prefix,name,type) \
+        enum GNUNET_GenericReturnValue                          \
+        prefix ## _get_trait_ ## name (                         \
+          const struct GNUNET_TESTING_Command *cmd,             \
+          type * *ret)                                          \
+        {                                                       \
+          if (NULL == cmd->traits) return GNUNET_SYSERR;        \
+          return cmd->traits (cmd->cls,                         \
+                              (const void **) ret,              \
+                              GNUNET_S (name),                  \
+                              0);                               \
+        }                                                       \
+        struct GNUNET_TESTING_Trait                             \
+        prefix ## _make_trait_ ## name (                        \
+          type * value)                                         \
+        {                                                       \
+          struct GNUNET_TESTING_Trait ret = {                   \
+            .trait_name = GNUNET_S (name),                      \
+            .ptr = (const void *) value                         \
+          };                                                    \
+          return ret;                                           \
+        }
+
+
+/**
+ * Create headers for a trait with name @a name for
+ * statically allocated data of type @a type.
  *
- * @param argv0 the name of the binary
- * @return string between the last '_' and the '.exe' (or the end of the string),
- *         NULL if argv0 has no '_'
+ * @param prefix symbol prefix to use
+ * @param name name of the trait
+ * @param type data type for the trait
  */
-char *
-GNUNET_TESTING_get_testname_from_underscore (const char *argv0);
+#define GNUNET_TESTING_MAKE_DECL_INDEXED_TRAIT(prefix,name,type) \
+        enum GNUNET_GenericReturnValue                           \
+        prefix ## _get_trait_ ## name (                          \
+          const struct GNUNET_TESTING_Command *cmd,              \
+          unsigned int index,                                    \
+          type * *ret);                                          \
+        struct GNUNET_TESTING_Trait                              \
+        prefix ## _make_trait_ ## name (                         \
+          unsigned int index,                                    \
+          type * value);
 
 
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
+/**
+ * Create C implementation for a trait with name @a name for statically
+ * allocated data of type @a type.
+ */
+#define GNUNET_TESTING_MAKE_IMPL_INDEXED_TRAIT(prefix,name,type)    \
+        enum GNUNET_GenericReturnValue                          \
+        prefix ## _get_trait_ ## name (                         \
+          const struct GNUNET_TESTING_Command *cmd,             \
+          unsigned int index,                                   \
+          type * *ret)                                          \
+        {                                                       \
+          if (NULL == cmd->traits) return GNUNET_SYSERR;        \
+          return cmd->traits (cmd->cls,                         \
+                              (const void **) ret,              \
+                              GNUNET_S (name),                  \
+                              index);                           \
+        }                                                       \
+        struct GNUNET_TESTING_Trait                             \
+        prefix ## _make_trait_ ## name (                        \
+          unsigned int index,                                   \
+          type * value)                                         \
+        {                                                       \
+          struct GNUNET_TESTING_Trait ret = {                   \
+            .index = index,                                     \
+            .trait_name = GNUNET_S (name),                      \
+            .ptr = (const void *) value                         \
+          };                                                    \
+          return ret;                                           \
+        }
 
-#endif
 
-/** @} */  /* end of group */
+/**
+ * Call #op on all simple traits needed by testing core logic.
+ *
+ * @param op operation to perform
+ * @param prefix prefix to pass to @e op
+ */
+#define GNUNET_TESTING_SIMPLE_TRAITS(op,prefix)                  \
+        op (prefix, process, struct GNUNET_OS_Process *)         \
+        op (prefix, cmd, const struct GNUNET_TESTING_Command)    \
+        op (prefix, batch_cmds, struct GNUNET_TESTING_Command *)
+
+
+GNUNET_TESTING_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                              GNUNET_TESTING)
+
+
+#endif
diff --git a/src/include/gnunet_testing_netjail_lib.h b/src/include/gnunet_testing_netjail_lib.h
deleted file mode 100644
index 011db00f8..000000000
--- a/src/include/gnunet_testing_netjail_lib.h
+++ /dev/null
@@ -1,492 +0,0 @@
-/*
-      This file is part of GNUnet
-      Copyright (C) 2021 GNUnet e.V.
-
-      GNUnet is free software: you can redistribute it and/or modify it
-      under the terms of the GNU Affero General Public License as published
-      by the Free Software Foundation, either version 3 of the License,
-      or (at your option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      Affero General Public License for more details.
-
-      You should have received a copy of the GNU Affero General Public License
-      along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @brief API for writing an interpreter to test GNUnet components
- * @author Christian Grothoff <christian@grothoff.org>
- * @author Marcello Stanisci
- * @author t3sserakt
- */
-#ifndef GNUNET_TESTING_NETJAIL_LIB_H
-#define GNUNET_TESTING_NETJAIL_LIB_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_testing_plugin.h"
-#include "gnunet_testing_ng_lib.h"
-
-
-/**
- * Router of a netjail subnet.
- */
-struct GNUNET_TESTING_NetjailRouter
-{
-  /**
-   * Will tcp be forwarded?
-   */
-  unsigned int tcp_port;
-
-  /**
-   * Will udp be forwarded?
-   */
-  unsigned int udp_port;
-};
-
-
-/**
- * Enum for the different types of nodes.
- */
-enum GNUNET_TESTING_NODE_TYPE
-{
-  /**
-   * Node in a subnet.
-   */
-  GNUNET_TESTING_SUBNET_NODE,
-
-  /**
-   * Global known node.
-   */
-  GNUNET_TESTING_GLOBAL_NODE
-};
-
-/**
- * Protocol address prefix für a connection between nodes.
- */
-struct GNUNET_TESTING_AddressPrefix
-{
-  /**
-   * Pointer to the previous prefix in the DLL.
-   */
-  struct GNUNET_TESTING_AddressPrefix *prev;
-
-  /**
-   * Pointer to the next prefix in the DLL.
-   */
-  struct GNUNET_TESTING_AddressPrefix *next;
-
-  /**
-   * The address prefix.
-   */
-  char *address_prefix;
-};
-
-
-/**
- * Node in a netjail topology.
- */
-struct GNUNET_TESTING_NetjailNode;
-
-/**
- * Connection to another node.
- */
-struct GNUNET_TESTING_NodeConnection
-{
-  /**
-   * Pointer to the previous connection in the DLL.
-   */
-  struct GNUNET_TESTING_NodeConnection *prev;
-
-  /**
-   * Pointer to the next connection in the DLL.
-   */
-  struct GNUNET_TESTING_NodeConnection *next;
-
-  /**
-   * The number of the subnet of the node this connection points to. This is 0,
-   * if the node is a global known node.
-   */
-  unsigned int namespace_n;
-
-  /**
-   * The number of the node this connection points to.
-   */
-  unsigned int node_n;
-
-  /**
-   * The type of the node this connection points to.
-   */
-  enum GNUNET_TESTING_NODE_TYPE node_type;
-
-  /**
-   * The node which establish the connection
-   */
-  struct GNUNET_TESTING_NetjailNode *node;
-
-  /**
-   * Head of the DLL with the address prefixes for the protocolls this node is reachable.
-   */
-  struct GNUNET_TESTING_AddressPrefix *address_prefixes_head;
-
-  /**
-   * Tail of the DLL with the address prefixes for the protocolls this node is reachable.
-   */
-  struct GNUNET_TESTING_AddressPrefix *address_prefixes_tail;
-};
-
-/**
- * Node in the netjail topology.
- */
-struct GNUNET_TESTING_NetjailNode
-{
-  /**
-   * Plugin for the test case to be run on this node.
-   */
-  char *plugin;
-
-  /**
-   * Flag indicating if this node is a global known node.
-   */
-  unsigned int is_global;
-
-  /**
-   * The number of the subnet this node is running in.
-   */
-  unsigned int namespace_n;
-
-  /**
-   * The number of this node in the subnet.
-   */
-  unsigned int node_n;
-
-  /**
-   * Head of the DLL with the connections which shall be established to other nodes.
-   */
-  struct GNUNET_TESTING_NodeConnection *node_connections_head;
-
-  /**
-   * Tail of the DLL with the connections which shall be established to other nodes.
-   */
-  struct GNUNET_TESTING_NodeConnection *node_connections_tail;
-};
-
-
-/**
- * Subnet in a topology.
- */
-struct GNUNET_TESTING_NetjailNamespace
-{
-  /**
-   * The number of the subnet.
-   */
-  unsigned int namespace_n;
-
-  /**
-   * Router of the subnet.
-   */
-  struct GNUNET_TESTING_NetjailRouter *router;
-
-  /**
-   * Hash map containing the nodes in this subnet.
-   */
-  struct GNUNET_CONTAINER_MultiShortmap *nodes;
-};
-
-/**
- * Toplogy of our netjail setup.
- */
-struct GNUNET_TESTING_NetjailTopology
-{
-
-  /**
-   * Default plugin for the test case to be run on nodes.
-   */
-  char *plugin;
-
-  /**
-   * Number of subnets.
-   */
-  unsigned int namespaces_n;
-
-  /**
-   * Number of nodes per subnet.
-   */
-  unsigned int nodes_m;
-
-  /**
-   * Number of global known nodes.
-   */
-  unsigned int nodes_x;
-
-  /**
-   * Hash map containing the subnets (for natted nodes) of the topology.
-   */
-  struct GNUNET_CONTAINER_MultiShortmap *map_namespaces;
-
-  /**
-   * Hash map containing the global known nodes which are not natted.
-   */
-  struct GNUNET_CONTAINER_MultiShortmap *map_globals;
-};
-
-/**
- * Getting the topology from file.
- *
- * @param filename The name of the topology file.
- * @return The GNUNET_TESTING_NetjailTopology
- */
-struct GNUNET_TESTING_NetjailTopology *
-GNUNET_TESTING_get_topo_from_file (const char *filename);
-
-
-/**
- * Parse the topology data.
- *
- * @param data The topology data.
- * @return The GNUNET_TESTING_NetjailTopology
- */
-struct GNUNET_TESTING_NetjailTopology *
-GNUNET_TESTING_get_topo_from_string (char *data);
-
-
-/**
- * Get the connections to other nodes for a specific node.
- *
- * @param num The specific node we want the connections for.
- * @param topology The topology we get the connections from.
- * @return The connections of the node.
- */
-struct GNUNET_TESTING_NodeConnection *
-GNUNET_TESTING_get_connections (unsigned int num, struct
-                                GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Get the address for a specific communicator from a connection.
- *
- * @param connection The connection we like to have the address from.
- * @param prefix The communicator protocol prefix.
- * @return The address of the communicator.
- */
-char *
-GNUNET_TESTING_get_address (struct GNUNET_TESTING_NodeConnection *connection,
-                            char *prefix);
-
-
-/**
- * Deallocate memory of the struct GNUNET_TESTING_NetjailTopology.
- *
- * @param topology The GNUNET_TESTING_NetjailTopology to be deallocated.
- */
-void
-GNUNET_TESTING_free_topology (struct GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Calculate the unique id identifying a node from a given connction.
- *
- * @param node_connection The connection we calculate the id from.
- * @param topology The topology we get all needed information from.
- * @return The unique id of the node from the connection.
- */
-unsigned int
-GNUNET_TESTING_calculate_num (struct
-                              GNUNET_TESTING_NodeConnection *node_connection,
-                              struct GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Struct with information for callbacks.
- *
- */
-struct BlockState
-{
-  /**
-   * Context for our asynchronous completion.
-   */
-  struct GNUNET_TESTING_AsyncContext ac;
-
-  /**
-   * The label of this command.
-   */
-  const char *label;
-
-  /**
-   * If this command will block.
-   */
-  unsigned int asynchronous_finish;
-};
-
-/**
- * Struct to hold information for callbacks.
- *
- */
-struct LocalPreparedState
-{
-  /**
-   * Context for our asynchronous completion.
-   */
-  struct GNUNET_TESTING_AsyncContext ac;
-
-  /**
-   * Callback to write messages to the master loop.
-   *
-   */
-  TESTING_CMD_HELPER_write_cb write_message;
-};
-
-
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_system_destroy (const char *label,
-                                   const char *create_label);
-
-
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_system_create (const char *label,
-                                  const char *testdir);
-
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param topology_config Configuration file for the test topology.
- * @param read_file Flag indicating if the the name of the topology file is send to the helper, or a string with the topology data.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_netjail_start (const char *label,
-                                  char *topology_config,
-                                  unsigned int *read_file);
-
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param topology_config Configuration file for the test topology.
- * @param read_file Flag indicating if the the name of the topology file is send to the helper, or a string with the topology data.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_netjail_stop (const char *label,
-                                 char *topology_config,
-                                 unsigned int *read_file);
-
-
-/**
- * Create command.
- *
- * @param label Name for the command.
- * @param topology The complete topology information.
- * @param read_file Flag indicating if the the name of the topology file is send to the helper, or a string with the topology data.
- * @param topology_data If read_file is GNUNET_NO, topology_data holds the string with the topology.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_netjail_start_testing_system (
-  const char *label,
-  struct GNUNET_TESTING_NetjailTopology *topology,
-  unsigned int *read_file,
-  char *topology_data);
-
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param helper_start_label label of the cmd to start the test system.
- * @param topology The complete topology information.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_stop_testing_system (
-  const char *label,
-  const char *helper_start_label,
-  struct GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Create a GNUNET_CMDS_LOCAL_FINISHED message.
- *
- * @param rv The result of the local test as GNUNET_GenericReturnValue.
- * @return The GNUNET_CMDS_LOCAL_FINISHED message.
-*/
-struct GNUNET_MessageHeader *
-GNUNET_TESTING_send_local_test_finished_msg (enum GNUNET_GenericReturnValue rv);
-
-
-
-
-
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_block_until_all_peers_started (
-  const char *label,
-  unsigned int *all_peers_started);
-
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param all_peers_started Flag which will be set from outside.
- * @param asynchronous_finish If GNUNET_YES this command will not block.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_block_until_external_trigger (
-  const char *label);
-
-
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_send_peer_ready (const char *label,
-                                    TESTING_CMD_HELPER_write_cb write_message);
-
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param write_message Callback to write messages to the master loop.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_local_test_finished (
-  const char *label,
-  TESTING_CMD_HELPER_write_cb write_message);
-
-/**
- * Create command.
- *
- * @param label name for command.
- * @param write_message Callback to write messages to the master loop.
- * @param all_local_tests_prepared Flag which will be set from outside.
- * @return command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_local_test_prepared (const char *label,
-                                        TESTING_CMD_HELPER_write_cb
-                                        write_message);
-
-
-/* ***** Netjail trait support ***** */
-
-
-/**
- * Call #op on all simple traits.
- */
-#define GNUNET_TESTING_SIMPLE_NETJAIL_TRAITS(op) \
-  op (test_system, const struct GNUNET_TESTING_System) \
-  op (async_context, const struct GNUNET_TESTING_AsyncContext) \
-  op (helper_handles, const struct GNUNET_HELPER_Handle *) \
-  op (local_prepared_state, const struct LocalPreparedState) \
-  op (block_state, const struct BlockState)
-
-GNUNET_TESTING_SIMPLE_NETJAIL_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT)
-
-#endif
diff --git a/src/include/gnunet_testing_ng_lib.h b/src/include/gnunet_testing_ng_lib.h
deleted file mode 100644
index c0e534594..000000000
--- a/src/include/gnunet_testing_ng_lib.h
+++ /dev/null
@@ -1,769 +0,0 @@
-/*
-      This file is part of GNUnet
-      Copyright (C) 2021 GNUnet e.V.
-
-      GNUnet is free software: you can redistribute it and/or modify it
-      under the terms of the GNU Affero General Public License as published
-      by the Free Software Foundation, either version 3 of the License,
-      or (at your option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      Affero General Public License for more details.
-
-      You should have received a copy of the GNU Affero General Public License
-      along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @brief API for writing an interpreter to test GNUnet components
- * @author Christian Grothoff <christian@grothoff.org>
- * @author Marcello Stanisci
- * @author t3sserakt
- */
-#ifndef GNUNET_TESTING_NG_LIB_H
-#define GNUNET_TESTING_NG_LIB_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_testing_plugin.h"
-#include "gnunet_testing_lib.h"
-
-/**
- * Stringify operator.
- *
- * @param a some expression to stringify. Must NOT be a macro.
- * @return same expression as a constant string.
- */
-#define GNUNET_S(a) #a
-
-
-/* ********************* Helper functions ********************* */
-
-/**
- * Print failing line number and trigger shutdown.  Useful
- * quite any time after the command "run" method has been called.
- */
-#define GNUNET_TESTING_FAIL(is) \
-  do \
-  { \
-    GNUNET_break (0); \
-    GNUNET_TESTING_interpreter_fail (is); \
-    return; \
-  } while (0)
-
-
-/* ******************* Generic interpreter logic ************ */
-
-/**
- * Global state of the interpreter, used by a command
- * to access information about other commands.
- */
-struct GNUNET_TESTING_Interpreter;
-
-/**
- * State each asynchronous command must have in its closure.
- */
-struct GNUNET_TESTING_AsyncContext
-{
-
-  /**
-   * Interpreter we are part of.
-   */
-  struct GNUNET_TESTING_Interpreter *is;
-
-  /**
-   * Function to call when done.
-   */
-  GNUNET_SCHEDULER_TaskCallback cont;
-
-  /**
-   * Closure for @e cont.
-   */
-  void *cont_cls;
-
-  /**
-   * Indication if the command finished (#GNUNET_OK).
-   * #GNUNET_NO if it did not finish,
-   * #GNUNET_SYSERR if it failed.
-   */
-  enum GNUNET_GenericReturnValue finished;
-};
-
-
-/**
- * A command to be run by the interpreter.
- */
-struct GNUNET_TESTING_Command
-{
-
-  /**
-   * Closure for all commands with command-specific context information.
-   */
-  void *cls;
-
-  /**
-   * Label for the command.
-   */
-  const char *label;
-
-  /**
-   * Runs the command.  Note that upon return, the interpreter
-   * will not automatically run the next command, as the command
-   * may continue asynchronously in other scheduler tasks.  Thus,
-   * the command must ensure to eventually call
-   * #GNUNET_TESTING_interpreter_next() or
-   * #GNUNET_TESTING_interpreter_fail().
-   *
-   * If this function creates some asynchronous activity, it should
-   * initialize @e finish to a function that can be used to wait for
-   * the asynchronous activity to terminate.
-   *
-   * @param cls closure
-   * @param is interpreter state
-   */
-  void
-  (*run)(void *cls,
-         struct GNUNET_TESTING_Interpreter *is);
-
-  /**
-   * Pointer to the asynchronous context in the command's
-   * closure. Used by the
-   * #GNUNET_TESTING_async_finish() and
-   * #GNUNET_TESTING_async_fail() functions.
-   *
-   * Must be NULL if a command is synchronous.
-   */
-  struct GNUNET_TESTING_AsyncContext *ac;
-
-  /**
-   * Clean up after the command.  Run during forced termination
-   * (CTRL-C) or test failure or test success.
-   *
-   * @param cls closure
-   */
-  void
-  (*cleanup)(void *cls);
-
-  /**
-   * Extract information from a command that is useful for other
-   * commands. Can be NULL if a command has no traits.
-   *
-   * @param cls closure
-   * @param[out] ret result (could be anything)
-   * @param trait name of the trait
-   * @param index index number of the object to extract.
-   * @return #GNUNET_OK on success,
-   *         #GNUNET_NO if no trait was found
-   */
-  enum GNUNET_GenericReturnValue
-  (*traits)(void *cls,
-            const void **ret,
-            const char *trait,
-            unsigned int index);
-
-  /**
-   * When did the execution of this command start?
-   */
-  struct GNUNET_TIME_Absolute start_time;
-
-  /**
-   * When did the execution of this command finish?
-   */
-  struct GNUNET_TIME_Absolute finish_time;
-
-  /**
-   * When did we start the last run of this command?  Delta to @e finish_time
-   * gives the latency for the last successful run.  Useful in case @e
-   * num_tries was positive and the command was run multiple times.  In that
-   * case, the @e start_time gives the time when we first tried to run the
-   * command, so the difference between @e start_time and @e finish_time would
-   * be the time all of the @e num_tries took, while the delta to @e
-   * last_req_time is the time the last (successful) execution took.
-   */
-  struct GNUNET_TIME_Absolute last_req_time;
-
-  /**
-   * In case @e asynchronous_finish is true, how long should we wait for this
-   * command to complete? If @e finish did not complete after this amount of
-   * time, the interpreter will fail.  Should be set generously to ensure
-   * tests do not fail on slow systems.
-   */
-  struct GNUNET_TIME_Relative default_timeout;
-
-  /**
-   * How often did we try to execute this command? (In case it is a request
-   * that is repated.)  Note that a command must have some built-in retry
-   * mechanism for this value to be useful.
-   */
-  unsigned int num_tries;
-
-  /**
-   * If "true", the interpreter should not immediately call
-   * @e finish, even if @e finish is non-NULL.  Otherwise,
-   * #GNUNET_TESTING_cmd_finish() must be used
-   * to ensure that a command actually completed.
-   */
-  bool asynchronous_finish;
-
-};
-
-
-/**
- * Lookup command by label.
- * Only future commands are looked up.
- *
- * @param is interpreter to lookup command in
- * @param label label of the command to lookup.
- * @return the command, if it is found, or NULL.
- */
-const struct GNUNET_TESTING_Command *
-GNUNET_TESTING_interpreter_lookup_future_command (
-  struct GNUNET_TESTING_Interpreter *is,
-  const char *label);
-
-
-/**
- * Lookup command by label.
- *
- * @param is interpreter to lookup command in
- * @param label label of the command to lookup.
- * @return the command, if it is found, or NULL.
- */
-const struct GNUNET_TESTING_Command *
-GNUNET_TESTING_interpreter_lookup_command (
-  struct GNUNET_TESTING_Interpreter *is,
-  const char *label);
-
-
-/**
- * Lookup command by label.
- * All commands, first into the past, then into the furture are looked up.
- *
- * @param is interpreter to lookup command in
- * @param label label of the command to lookup.
- * @return the command, if it is found, or NULL.
- */
-const struct GNUNET_TESTING_Command *
-GNUNET_TESTING_interpreter_lookup_command_all (
-  struct GNUNET_TESTING_Interpreter *is,
-  const char *label);
-
-
-/**
- * Obtain label of the command being now run.
- *
- * @param is interpreter state.
- * @return the label.
- */
-const char *
-GNUNET_TESTING_interpreter_get_current_label (
-  struct GNUNET_TESTING_Interpreter *is);
-
-
-/**
- * Current command failed, clean up and fail the test case.
- *
- * @param is interpreter state.
- */
-void
-GNUNET_TESTING_interpreter_fail (struct GNUNET_TESTING_Interpreter *is);
-
-
-/**
- * The asynchronous command of @a ac has failed.
- *
- * @param ac command-specific context
- */
-void
-GNUNET_TESTING_async_fail (struct GNUNET_TESTING_AsyncContext *ac);
-
-
-/**
- * The asynchronous command of @a ac has finished.
- *
- * @param ac command-specific context
- */
-void
-GNUNET_TESTING_async_finish (struct GNUNET_TESTING_AsyncContext *ac);
-
-
-/**
- * Create command array terminator.
- *
- * @return a end-command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_end (void);
-
-
-/**
- * Turn asynchronous command into non blocking command by setting asynchronous_finish to true.
- *
- * @param cmd command to make synchronous.
- * @return a finish-command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_make_unblocking (struct GNUNET_TESTING_Command cmd);
-
-
-/**
- * Create (synchronous) command that waits for another command to finish.
- * If @a cmd_ref did not finish after @a timeout, this command will fail
- * the test case.
- *
- * @param finish_label label for this command
- * @param cmd_ref reference to a previous command which we should
- *        wait for (call `finish()` on)
- * @param timeout how long to wait at most for @a cmd_ref to finish
- * @return a finish-command.
- */
-const struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_finish (const char *finish_label,
-                           const char *cmd_ref,
-                           struct GNUNET_TIME_Relative timeout);
-
-
-/**
- * Make the instruction pointer point to @a target_label
- * only if @a counter is greater than zero.
- *
- * @param label command label
- * @param target_label label of the new instruction pointer's destination after the jump;
- *                     must be before the current instruction
- * @param counter counts how many times the rewinding is to happen.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_rewind_ip (const char *label,
-                              const char *target_label,
-                              unsigned int counter);
-
-
-/**
- * Function called with the final result of the test.
- *
- * @param cls closure
- * @param rv #GNUNET_OK if the test passed
- */
-typedef void
-(*GNUNET_TESTING_ResultCallback)(void *cls,
-                                 enum GNUNET_GenericReturnValue rv);
-
-
-/**
- * Run the testsuite.  Note, CMDs are copied into
- * the interpreter state because they are _usually_
- * defined into the "run" method that returns after
- * having scheduled the test interpreter.
- *
- * @param commands the list of command to execute
- * @param timeout how long to wait for each command to execute
- * @param rc function to call with the final result
- * @param rc_cls closure for @a rc
- */
-void
-GNUNET_TESTING_run (struct GNUNET_TESTING_Command *commands,
-                    struct GNUNET_TIME_Relative timeout,
-                    GNUNET_TESTING_ResultCallback rc,
-                    void *rc_cls);
-
-
-/**
- * Start a GNUnet scheduler event loop and
- * run the testsuite.  Return 0 upon success.
- * Expected to be called directly from main().
- *
- * @param commands the list of command to execute
- * @param timeout how long to wait for each command to execute
- * @return EXIT_SUCCESS on success, EXIT_FAILURE on failure
- */
-int
-GNUNET_TESTING_main (struct GNUNET_TESTING_Command *commands,
-                     struct GNUNET_TIME_Relative timeout);
-
-
-/**
- * Look for substring in a programs' name.
- *
- * @param prog program's name to look into
- * @param marker chunk to find in @a prog
- * // FIXME: this does not belong here! => libgnunetutil, maybe?
- * // FIXME: return bool? document return value!
- */
-int
-GNUNET_TESTING_has_in_name (const char *prog,
-                            const char *marker);
-
-
-/* ************** Specific interpreter commands ************ */
-
-
-/**
- * Returns the actual running command.
- *
- * @param is Global state of the interpreter, used by a command
- *        to access information about other commands.
- * @return The actual running command.
- */
-struct GNUNET_TESTING_Command *
-GNUNET_TESTING_interpreter_get_current_command (
-  struct GNUNET_TESTING_Interpreter *is);
-
-
-/**
- * Check if the command is running.
- *
- * @param cmd The command to check.
- * @return GNUNET_NO if the command is not running, GNUNET_YES if it is running.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_TESTING_running (const struct GNUNET_TESTING_Command *command);
-
-
-/**
- * Check if a command is finished.
- *
- * @param cmd The command to check.
- * @return GNUNET_NO if the command is not finished, GNUNET_YES if it is finished.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_TESTING_finished (struct GNUNET_TESTING_Command *command);
-
-
-/**
- * Create a "signal" CMD.
- *
- * @param label command label.
- * @param process_label label of a command that has a process trait
- * @param process_index index of the process trait at @a process_label // FIXME: enum? needed?
- * @param signal signal to send to @a process.
- * @return the command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_signal (const char *label,
-                           const char *process_label,
-                           unsigned int process_index,
-                           int signal);
-
-
-/**
- * Sleep for @a duration.
- *
- * @param label command label.
- * @param duration time to sleep
- * @return the command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_sleep (const char *label,
-                          struct GNUNET_TIME_Relative duration);
-
-
-/**
- * Create a "batch" command.  Such command takes a end_CMD-terminated array of
- * CMDs and executed them.  Once it hits the end CMD, it passes the control to
- * the next top-level CMD, regardless of it being another batch or ordinary
- * CMD.
- *
- * @param label the command label.
- * @param batch array of CMDs to execute.
- * @return the command.
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_batch (const char *label,
-                          struct GNUNET_TESTING_Command *batch);
-
-
-/**
- * Performance counter.
- * // FIXME: this might not belong here!
- */
-struct GNUNET_TESTING_Timer
-{
-  /**
-   * For which type of commands.
-   */
-  const char *prefix;
-
-  /**
-   * Total time spend in all commands of this type.
-   */
-  struct GNUNET_TIME_Relative total_duration;
-
-  /**
-   * Total time spend waiting for the *successful* exeuction
-   * in all commands of this type.
-   */
-  struct GNUNET_TIME_Relative success_latency;
-
-  /**
-   * Number of commands summed up.
-   */
-  unsigned int num_commands;
-
-  /**
-   * Number of retries summed up.
-   */
-  unsigned int num_retries;
-};
-
-
-/**
- * Getting the topology from file.
- *
- * @param filename The name of the topology file.
- * @return The GNUNET_TESTING_NetjailTopology
- */
-struct GNUNET_TESTING_NetjailTopology *
-GNUNET_TESTING_get_topo_from_file (const char *filename);
-
-
-/**
- * Parse the topology data.
- *
- * @param data The topology data.
- * @return The GNUNET_TESTING_NetjailTopology
- */
-struct GNUNET_TESTING_NetjailTopology *
-GNUNET_TESTING_get_topo_from_string (char *data);
-
-
-/**
- * Get the connections to other nodes for a specific node.
- *
- * @param num The specific node we want the connections for.
- * @param topology The topology we get the connections from.
- * @return The connections of the node.
- */
-struct GNUNET_TESTING_NodeConnection *
-GNUNET_TESTING_get_connections (unsigned int num, struct
-                                GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Get the address for a specific communicator from a connection.
- *
- * @param connection The connection we like to have the address from.
- * @param prefix The communicator protocol prefix.
- * @return The address of the communicator.
- */
-char *
-GNUNET_TESTING_get_address (struct GNUNET_TESTING_NodeConnection *connection,
-                            char *prefix);
-
-
-/**
- * Deallocate memory of the struct GNUNET_TESTING_NetjailTopology.
- *
- * @param topology The GNUNET_TESTING_NetjailTopology to be deallocated.
- */
-void
-GNUNET_TESTING_free_topology (struct GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Calculate the unique id identifying a node from a given connction.
- *
- * @param node_connection The connection we calculate the id from.
- * @param topology The topology we get all needed information from.
- * @return The unique id of the node from the connection.
- */
-unsigned int
-GNUNET_TESTING_calculate_num (struct
-                              GNUNET_TESTING_NodeConnection *node_connection,
-                              struct GNUNET_TESTING_NetjailTopology *topology);
-
-
-/**
- * Retrieve the public key from the test system with the unique node id.
- *
- * @param num The unique node id.
- * @param tl_system The test system.
- * @return The peer identity wrapping the public key.
- */
-struct GNUNET_PeerIdentity *
-GNUNET_TESTING_get_pub_key (unsigned int num,
-                            const struct GNUNET_TESTING_System *tl_system);
-
-
-/**
- * Obtain performance data from the interpreter.
- *
- * @param timers what commands (by label) to obtain runtimes for
- * @return the command
- */
-struct GNUNET_TESTING_Command
-GNUNET_TESTING_cmd_stat (struct GNUNET_TESTING_Timer *timers);
-
-
-/* *** Generic trait logic for implementing traits ********* */
-
-/**
- * A trait.
- */
-struct GNUNET_TESTING_Trait
-{
-  /**
-   * Index number associated with the trait.  This gives the
-   * possibility to have _multiple_ traits on offer under the
-   * same name.
-   */
-  unsigned int index;
-
-  /**
-   * Trait type, for example "reserve-pub" or "coin-priv".
-   */
-  const char *trait_name;
-
-  /**
-   * Pointer to the piece of data to offer.
-   */
-  const void *ptr;
-};
-
-
-/**
- * "end" trait.  Because traits are offered into arrays,
- * this type of trait is used to mark the end of such arrays;
- * useful when iterating over those.
- */
-struct GNUNET_TESTING_Trait
-GNUNET_TESTING_trait_end (void);
-
-
-/**
- * Extract a trait.
- *
- * @param traits the array of all the traits.
- * @param[out] ret where to store the result.
- * @param trait type of the trait to extract.
- * @param index index number of the trait to extract.
- * @return #GNUNET_OK when the trait is found.
- */
-enum GNUNET_GenericReturnValue
-GNUNET_TESTING_get_trait (const struct GNUNET_TESTING_Trait *traits,
-                          const void **ret,
-                          const char *trait,
-                          unsigned int index);
-
-
-/* ****** Specific traits supported by this component ******* */
-
-
-/**
- * Create headers for a trait with name @a name for
- * statically allocated data of type @a type.
- */
-#define GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT(name,type)   \
-  enum GNUNET_GenericReturnValue                          \
-    GNUNET_TESTING_get_trait_ ## name (                    \
-    const struct GNUNET_TESTING_Command *cmd,              \
-    type **ret);                                          \
-  struct GNUNET_TESTING_Trait                              \
-    GNUNET_TESTING_make_trait_ ## name (                   \
-    type * value);
-
-
-/**
- * Create C implementation for a trait with name @a name for statically
- * allocated data of type @a type.
- */
-#define GNUNET_TESTING_MAKE_IMPL_SIMPLE_TRAIT(name,type)  \
-  enum GNUNET_GenericReturnValue                         \
-    GNUNET_TESTING_get_trait_ ## name (                   \
-    const struct GNUNET_TESTING_Command *cmd,             \
-    type **ret)                                          \
-  {                                                      \
-    if (NULL == cmd->traits) return GNUNET_SYSERR;       \
-    return cmd->traits (cmd->cls,                        \
-                        (const void **) ret,             \
-                        GNUNET_S (name),                  \
-                        0);                              \
-  }                                                      \
-  struct GNUNET_TESTING_Trait                             \
-    GNUNET_TESTING_make_trait_ ## name (                  \
-    type * value)                                        \
-  {                                                      \
-    struct GNUNET_TESTING_Trait ret = {                   \
-      .trait_name = GNUNET_S (name),                      \
-      .ptr = (const void *) value                        \
-    };                                                   \
-    return ret;                                          \
-  }
-
-
-/**
- * Create headers for a trait with name @a name for
- * statically allocated data of type @a type.
- */
-#define GNUNET_TESTING_MAKE_DECL_INDEXED_TRAIT(name,type)  \
-  enum GNUNET_GenericReturnValue                          \
-    GNUNET_TESTING_get_trait_ ## name (                    \
-    const struct GNUNET_TESTING_Command *cmd,              \
-    unsigned int index,                                   \
-    type **ret);                                          \
-  struct GNUNET_TESTING_Trait                              \
-    GNUNET_TESTING_make_trait_ ## name (                   \
-    unsigned int index,                                   \
-    type * value);
-
-
-/**
- * Create C implementation for a trait with name @a name for statically
- * allocated data of type @a type.
- */
-#define GNUNET_TESTING_MAKE_IMPL_INDEXED_TRAIT(name,type) \
-  enum GNUNET_GenericReturnValue                         \
-    GNUNET_TESTING_get_trait_ ## name (                   \
-    const struct GNUNET_TESTING_Command *cmd,             \
-    unsigned int index,                                  \
-    type **ret)                                          \
-  {                                                      \
-    if (NULL == cmd->traits) return GNUNET_SYSERR;       \
-    return cmd->traits (cmd->cls,                        \
-                        (const void **) ret,             \
-                        GNUNET_S (name),                  \
-                        index);                          \
-  }                                                      \
-  struct GNUNET_TESTING_Trait                             \
-    GNUNET_TESTING_make_trait_ ## name (                  \
-    unsigned int index,                                  \
-    type * value)                                        \
-  {                                                      \
-    struct GNUNET_TESTING_Trait ret = {                   \
-      .index = index,                                    \
-      .trait_name = GNUNET_S (name),                      \
-      .ptr = (const void *) value                        \
-    };                                                   \
-    return ret;                                          \
-  }
-
-
-/**
- * Call #op on all simple traits.
- */
-#define GNUNET_TESTING_SIMPLE_TRAITS(op) \
-  op (process, struct GNUNET_OS_Process *)
-
-
-/**
- * Call #op on all indexed traits.
- */
-#define GNUNET_TESTING_INDEXED_TRAITS(op)                         \
-  op (uint32, const uint32_t) \
-  op (uint64, const uint64_t) \
-  op (int64, const int64_t) \
-  op (uint, const unsigned int) \
-  op (string, const char) \
-  op (cmd, const struct GNUNET_TESTING_Command) \
-  op (uuid, const struct GNUNET_Uuid) \
-  op (time, const struct GNUNET_TIME_Absolute) \
-  op (absolute_time, const struct GNUNET_TIME_Absolute) \
-  op (relative_time, const struct GNUNET_TIME_Relative)
-
-GNUNET_TESTING_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT)
-
-GNUNET_TESTING_INDEXED_TRAITS (GNUNET_TESTING_MAKE_DECL_INDEXED_TRAIT)
-
-#endif
diff --git a/src/include/gnunet_testing_plugin.h b/src/include/gnunet_testing_plugin.h
deleted file mode 100644
index b59d2cea1..000000000
--- a/src/include/gnunet_testing_plugin.h
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
-      This file is part of GNUnet
-      Copyright (C) 2021 GNUnet e.V.
-
-      GNUnet is free software: you can redistribute it and/or modify it
-      under the terms of the GNU Affero General Public License as published
-      by the Free Software Foundation, either version 3 of the License,
-      or (at your option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      Affero General Public License for more details.
-
-      You should have received a copy of the GNU Affero General Public License
-      along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- *
- * @author t3sserakt
- *
- * Plugin API to start test cases.
- *
- */
-#ifndef GNUNET_TESTING_PLUGIN_H
-#define GNUNET_TESTING_PLUGIN_H
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-typedef void
-(*TESTING_CMD_HELPER_write_cb) (struct GNUNET_MessageHeader *message, size_t
-                                msg_length);
-
-typedef void
-(*GNUNET_TESTING_PLUGIN_StartTestCase) (TESTING_CMD_HELPER_write_cb
-                                        write_message, char *router_ip,
-                                        char *node_ip,
-                                        char *n,
-                                        char *m,
-                                        char *local_m,
-                                        char *topology_data,
-                                        unsigned int *read_file);
-
-
-typedef void
-(*GNUNET_TESTING_PLUGIN_ALL_PEERS_STARTED) ();
-
-
-typedef void
-(*GNUNET_TESTING_PLUGIN_ALL_LOCAL_TESTS_PREPARED) ();
-
-
-struct GNUNET_TESTING_PluginFunctions
-{
-  /**
-   * Closure for all of the callbacks.
-   */
-  void *cls;
-
-  GNUNET_TESTING_PLUGIN_StartTestCase start_testcase;
-
-  GNUNET_TESTING_PLUGIN_ALL_PEERS_STARTED all_peers_started;
-
-  GNUNET_TESTING_PLUGIN_ALL_LOCAL_TESTS_PREPARED all_local_tests_prepared;
-};
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/src/include/gnunet_testing_testbed_lib.h b/src/include/gnunet_testing_testbed_lib.h
new file mode 100644
index 000000000..872382706
--- /dev/null
+++ b/src/include/gnunet_testing_testbed_lib.h
@@ -0,0 +1,42 @@
+#ifndef GNUNET_TESTING_TESTBED_LIB_H
+#define GNUNET_TESTING_TESTBED_LIB_H
+
+#include "gnunet_testing_lib.h"
+#include "gnunet_testbed_lib.h"
+
+/**
+ * This command destroys the ressources allocated for the test system setup.
+ *
+ * @param label Name for command.
+ * @param create_label Label of the cmd which started the test system.
+ * @param write_message Callback to write messages to the master loop.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_system_destroy (const char *label,
+                                   const char *create_label);
+
+/**
+ * This command is setting up a test environment for a peer to start.
+ *
+ * @param label Name for command.
+ * @param testdir Only the directory name without any path. Temporary
+ *                directory used for all service homes.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_system_create (const char *label,
+                                  const char *testdir);
+
+
+/**
+ * Call #op on all simple traits.
+ */
+#define GNUNET_TESTING_TESTBED_SIMPLE_TRAITS(op, prefix)                            \
+        op (prefix, test_system, struct GNUNET_TESTBED_System)
+
+
+GNUNET_TESTING_TESTBED_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                                      GNUNET_TESTING_TESTBED)
+
+
+#endif
diff --git a/src/include/gnunet_testing_transport_lib.h b/src/include/gnunet_testing_transport_lib.h
new file mode 100644
index 000000000..db2749661
--- /dev/null
+++ b/src/include/gnunet_testing_transport_lib.h
@@ -0,0 +1,205 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021-2023 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @brief API for cmds working with transport sub system.
+ * @author t3sserakt
+ */
+#ifndef GNUNET_TRANSPORT_TESTING_NG_LIB_H
+#define GNUNET_TRANSPORT_TESTING_NG_LIB_H
+
+
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+/**
+ * Application handle; FIXME: what exactly is this?
+ */
+struct GNUNET_TRANSPORT_ApplicationHandle;
+
+
+// FIXME: breaks naming conventions
+typedef void *
+(*GNUNET_TESTING_notify_connect_cb) (struct GNUNET_TESTING_Interpreter *is,
+                                     const struct GNUNET_PeerIdentity *peer);
+
+
+// FIXME: breaks naming conventions! Needed public?
+struct GNUNET_TESTING_StartPeerState
+{
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * The ip of a node.
+   */
+  char *node_ip;
+
+  /**
+   * Receive callback
+   */
+  struct GNUNET_MQ_MessageHandler *handlers;
+
+  /**
+   * GNUnet configuration file used to start a peer.
+   */
+  char *cfgname;
+
+  /**
+   * Peer's configuration
+   */
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * struct GNUNET_TESTING_Peer returned by GNUNET_TESTING_peer_configure.
+   */
+  struct GNUNET_TESTING_Peer *peer;
+
+  /**
+   * Peer identity
+   */
+  struct GNUNET_PeerIdentity id;
+
+  /**
+   * Peer's transport service handle
+   */
+  struct GNUNET_TRANSPORT_CoreHandle *th;
+
+  /**
+   * Application handle
+   */
+  struct GNUNET_TRANSPORT_ApplicationHandle *ah;
+
+  /**
+   * Peer's PEERSTORE Handle
+   */
+  struct GNUNET_PEERSTORE_Handle *ph;
+
+  /**
+   * Hello get task
+   */
+  struct GNUNET_SCHEDULER_Task *rh_task;
+
+  /**
+   * Peer's transport get hello handle to retrieve peer's HELLO message
+   */
+  struct GNUNET_PEERSTORE_IterateContext *pic;
+
+  /**
+   * Hello
+   */
+  char *hello;
+
+  /**
+   * Hello size
+   */
+  size_t hello_size;
+
+  /**
+   * The label of the command which was started by calling GNUNET_TESTING_cmd_system_create.
+   */
+  char *system_label;
+
+  /**
+   * An unique number to identify the peer
+   */
+  unsigned int no;
+
+  /**
+   * A map with struct GNUNET_MQ_Handle values for each peer this peer
+   * is connected to.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *connected_peers_map;
+
+  /**
+   * Test setup for this peer.
+   */
+  const struct GNUNET_TESTING_System *tl_system;
+
+  /**
+   * Callback which is called on neighbour connect events.
+   */
+  GNUNET_TESTING_notify_connect_cb notify_connect;
+
+  /**
+   * Flag indicating, if udp broadcast should be switched on.
+   */
+  enum GNUNET_GenericReturnValue broadcast;
+};
+
+
+/**
+ * Create command.
+ *
+ * @param label name for command.
+ * @param system_label Label of the cmd to setup a test environment.
+ * @param no Decimal number representing the last byte of the IP address of this peer.
+ * @param node_ip The IP address of this node.
+ * @param cfgname Configuration file name for this peer.
+ * @param broadcast Flag indicating, if broadcast should be switched on.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_start_peer (const char *label,
+                               const char *system_label,
+                               uint32_t no,
+                               const char *node_ip,
+                               const char *cfgname,
+                               unsigned int broadcast);
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_stop_peer (const char *label,
+                              const char *start_label);
+
+
+/**
+ * Retrieve peer identity from the test system with the unique node id.
+ *
+ * @param num The unique node id.
+ * @param tl_system The test system.
+ * @return The peer identity wrapping the public key.
+ */
+struct GNUNET_PeerIdentity *
+GNUNET_TESTING_get_peer (unsigned int num,
+                         const struct GNUNET_TESTING_System *tl_system);
+
+
+/**
+ * Call #op on all simple traits.
+ */
+#define GNUNET_TRANSPORT_TESTING_SIMPLE_TRAITS(op, prefix)                         \
+        op (prefix, connected_peers_map, const struct \
+            GNUNET_CONTAINER_MultiShortmap)    \
+        op (prefix, peer_id, const struct GNUNET_PeerIdentity)                           \
+        op (prefix, hello_size, const size_t)                                            \
+        op (prefix, hello, const char)                                                   \
+        op (prefix, application_handle, const struct \
+            GNUNET_TRANSPORT_ApplicationHandle) \
+        op (prefix, state, const struct GNUNET_TESTING_StartPeerState)                   \
+        op (prefix, broadcast, const enum GNUNET_GenericReturnValue)
+
+
+GNUNET_TRANSPORT_TESTING_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                                        GNUNET_TRANSPORT_TESTING)
+
+#endif
diff --git a/src/include/gnunet_time_lib.h b/src/include/gnunet_time_lib.h
index 26b442066..88dafc62c 100644
--- a/src/include/gnunet_time_lib.h
+++ b/src/include/gnunet_time_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2001-2013 GNUnet e.V.
+     Copyright (C) 2001-2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -19,6 +19,10 @@
  */
 
 /**
+ * @addtogroup libgnunetutil
+ * Multi-function utilities library for GNUnet programs
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -40,6 +44,7 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_common.h"
 
 /**
@@ -54,6 +59,17 @@ struct GNUNET_TIME_Absolute
 };
 
 /**
+ * Rounded time for timestamps used by GNUnet, in seconds.
+ */
+struct GNUNET_TIME_Timestamp
+{
+  /**
+   * The actual value. Must be round number in seconds.
+   */
+  struct GNUNET_TIME_Absolute abs_time;
+};
+
+/**
  * Time for relative time used by GNUnet, in microseconds.
  * Always positive, so we can only refer to future time.
  */
@@ -89,17 +105,34 @@ struct GNUNET_TIME_AbsoluteNBO
    */
   uint64_t abs_value_us__ GNUNET_PACKED;
 };
+
+/**
+ * Time for timestamps used by GNUnet, in seconds and in network byte order.
+ */
+struct GNUNET_TIME_TimestampNBO
+{
+  /**
+   * The actual value. Must be round number in seconds.
+   */
+  struct GNUNET_TIME_AbsoluteNBO abs_time_nbo;
+};
+
 GNUNET_NETWORK_STRUCT_END
 
 /**
  * Relative time zero.
  */
-#define GNUNET_TIME_UNIT_ZERO     GNUNET_TIME_relative_get_zero_ ()
+#define GNUNET_TIME_UNIT_ZERO ((struct GNUNET_TIME_Relative){0})
 
 /**
  * Absolute time zero.
  */
-#define GNUNET_TIME_UNIT_ZERO_ABS GNUNET_TIME_absolute_get_zero_ ()
+#define GNUNET_TIME_UNIT_ZERO_ABS ((struct GNUNET_TIME_Absolute){0})
+
+/**
+ * Timestamp of zero.
+ */
+#define GNUNET_TIME_UNIT_ZERO_TS ((struct GNUNET_TIME_Timestamp){{0}})
 
 /**
  * One microsecond, our basic time unit.
@@ -154,13 +187,22 @@ GNUNET_NETWORK_STRUCT_END
  * Constant used to specify "forever".  This constant
  * will be treated specially in all time operations.
  */
-#define GNUNET_TIME_UNIT_FOREVER_REL GNUNET_TIME_relative_get_forever_ ()
+#define GNUNET_TIME_UNIT_FOREVER_REL \
+  ((struct GNUNET_TIME_Relative){UINT64_MAX})
+
+/**
+ * Constant used to specify "forever".  This constant
+ * will be treated specially in all time operations.
+ */
+#define GNUNET_TIME_UNIT_FOREVER_ABS \
+  ((struct GNUNET_TIME_Absolute){UINT64_MAX})
 
 /**
  * Constant used to specify "forever".  This constant
  * will be treated specially in all time operations.
  */
-#define GNUNET_TIME_UNIT_FOREVER_ABS GNUNET_TIME_absolute_get_forever_ ()
+#define GNUNET_TIME_UNIT_FOREVER_TS \
+  ((struct GNUNET_TIME_Timestamp){{UINT64_MAX}})
 
 
 /**
@@ -183,6 +225,47 @@ GNUNET_NETWORK_STRUCT_END
 
 
 /**
+ * Convert @a ts to human-readable timestamp.
+ * Note that the returned value will be overwritten if this function
+ * is called again.
+ *
+ * @param ts the timestamp to convert
+ * @return statically allocated string, will change on the next call
+ */
+const char *
+GNUNET_TIME_timestamp2s (struct GNUNET_TIME_Timestamp ts);
+
+
+/**
+ * @ingroup time
+ * Like `asctime`, except for GNUnet time.  Converts a GNUnet internal
+ * absolute time (which is in UTC) to a string in local time.
+ * Note that the returned value will be overwritten if this function
+ * is called again.
+ *
+ * @param ts the absolute time to convert
+ * @return timestamp in human-readable form in local time
+ */
+const char *
+GNUNET_TIME_absolute2s (struct GNUNET_TIME_Absolute ts);
+
+
+/**
+ * @ingroup time
+ * Give relative time in human-readable fancy format.
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param delta time in milli seconds
+ * @param do_round are we allowed to round a bit?
+ * @return string in human-readable form
+ */
+const char *
+GNUNET_TIME_relative2s (struct GNUNET_TIME_Relative delta,
+                        bool do_round);
+
+
+/**
  * Randomized exponential back-off, starting at 1 ms
  * and going up by a factor of 2+r, where 0 <= r <= 0.5, up
  * to a maximum of the given threshold.
@@ -192,8 +275,8 @@ GNUNET_NETWORK_STRUCT_END
  * @return the next backoff time
  */
 struct GNUNET_TIME_Relative
-GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt, struct
-                                GNUNET_TIME_Relative threshold);
+GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt,
+                                struct GNUNET_TIME_Relative threshold);
 
 
 /**
@@ -290,27 +373,69 @@ GNUNET_TIME_relative_to_absolute (struct GNUNET_TIME_Relative rel);
 
 
 /**
- * Round a time value so that it is suitable for transmission
- * via JSON encodings.
+ * Convert relative time to a timestamp in the
+ * future.
+ *
+ * @param rel relative time to convert
+ * @return timestamp that is "rel" in the future, or FOREVER if rel==FOREVER (or if we would overflow)
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_relative_to_timestamp (struct GNUNET_TIME_Relative rel);
+
+
+/**
+ * Round an absolute time to a timestamp.
  *
  * @param at time to round
- * @return #GNUNET_OK if time was already rounded, #GNUNET_NO if
- *         it was just now rounded
+ * @return the result
  */
-int
-GNUNET_TIME_round_abs (struct GNUNET_TIME_Absolute *at);
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_absolute_to_timestamp (struct GNUNET_TIME_Absolute at);
 
 
 /**
- * Round a time value so that it is suitable for transmission
- * via JSON encodings.
+ * Get timestamp representing the current time.
  *
- * @param rt time to round
- * @return #GNUNET_OK if time was already rounded, #GNUNET_NO if
- *         it was just now rounded
+ * @return current time, rounded down to seconds
  */
-int
-GNUNET_TIME_round_rel (struct GNUNET_TIME_Relative *rt);
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_get (void);
+
+
+/**
+ * Compare two absolute times.
+ *
+ * @param t1 first time
+ * @param op compare operator
+ * @param t2 second time
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_absolute_cmp(t1,op,t2) \
+  ((void) (1 op 2), (t1).abs_value_us op (t2).abs_value_us)
+
+
+/**
+ * Compare two timestamps
+ *
+ * @param t1 first timestamp
+ * @param op compare operator
+ * @param t2 second timestamp
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_timestamp_cmp(t1,op,t2) \
+  GNUNET_TIME_absolute_cmp ((t1).abs_time,op,(t2).abs_time)
+
+
+/**
+ * Compare two relative times.
+ *
+ * @param t1 first time
+ * @param op compare operator
+ * @param t2 second time
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_relative_cmp(t1,op,t2) \
+  ((void) (1 op 2), (t1).rel_value_us op (t2).rel_value_us)
 
 
 /**
@@ -362,6 +487,42 @@ GNUNET_TIME_absolute_max (struct GNUNET_TIME_Absolute t1,
 
 
 /**
+ * Round down absolute time @a at to multiple of @a rt.
+ *
+ * @param at absolute time to round
+ * @param rt multiple to round to (non-zero)
+ * @return rounded time
+ */
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_round_down (struct GNUNET_TIME_Absolute at,
+                                 struct GNUNET_TIME_Relative rt);
+
+
+/**
+ * Return the maximum of two timestamps.
+ *
+ * @param t1 first timestamp
+ * @param t2 other timestamp
+ * @return timestamp that is smaller
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_max (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2);
+
+
+/**
+ * Return the minimum of two timestamps.
+ *
+ * @param t1 first timestamp
+ * @param t2 other timestamp
+ * @return timestamp that is smaller
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_min (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2);
+
+
+/**
  * Given a timestamp in the future, how much time
  * remains until then?
  *
@@ -373,6 +534,21 @@ GNUNET_TIME_absolute_get_remaining (struct GNUNET_TIME_Absolute future);
 
 
 /**
+ * Test if @a a1 and @a a2 are equal within a margin of
+ * error of @a t.
+ *
+ * @param a1 time to compare
+ * @param a2 time to compare
+ * @param t tolerance to apply
+ * @return true if "|a1-a2|<=t" holds.
+ */
+bool
+GNUNET_TIME_absolute_approx_eq (struct GNUNET_TIME_Absolute a1,
+                                struct GNUNET_TIME_Absolute a2,
+                                struct GNUNET_TIME_Relative t);
+
+
+/**
  * Calculate the estimate time of arrival/completion
  * for an operation.
  *
@@ -443,6 +619,17 @@ GNUNET_TIME_absolute_subtract (struct GNUNET_TIME_Absolute start,
  * Multiply relative time by a given factor.
  *
  * @param rel some duration
+ * @param factor double to multiply with
+ * @return FOREVER if rel=FOREVER or on overflow; otherwise rel*factor
+ */
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_multiply_double (struct GNUNET_TIME_Relative rel,
+                                      double factor);
+
+/**
+ * Multiply relative time by a given factor.
+ *
+ * @param rel some duration
  * @param factor integer to multiply with
  * @return FOREVER if rel=FOREVER or on overflow; otherwise rel*factor
  */
@@ -530,6 +717,16 @@ GNUNET_TIME_absolute_hton (struct GNUNET_TIME_Absolute a);
 
 
 /**
+ * Convert timestamp to network byte order.
+ *
+ * @param t time to convert
+ * @return converted time value
+ */
+struct GNUNET_TIME_TimestampNBO
+GNUNET_TIME_timestamp_hton (struct GNUNET_TIME_Timestamp t);
+
+
+/**
  * Convert milliseconds after the UNIX epoch to absolute time.
  *
  * @param ms_after_epoch millisecond timestamp to convert
@@ -558,6 +755,15 @@ GNUNET_TIME_absolute_is_past (struct GNUNET_TIME_Absolute abs);
 
 
 /**
+ * Test if @a abs is truly zero.
+ *
+ * @return true if it is.
+ */
+bool
+GNUNET_TIME_absolute_is_zero (struct GNUNET_TIME_Absolute abs);
+
+
+/**
  * Test if @a abs is truly in the future (excluding now).
  *
  * @return true if it is.
@@ -595,6 +801,26 @@ GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch);
 
 
 /**
+ * Convert seconds after the UNIX epoch to timestamp.
+ *
+ * @param s_after_epoch seconds after epoch to convert
+ * @return converted time value
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch);
+
+
+/**
+ * Convert timestamp to number of seconds after the UNIX epoch.
+ *
+ * @param ts timestamp to convert
+ * @return converted time value
+ */
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts);
+
+
+/**
  * Convert absolute time from network byte order.
  *
  * @param a time to convert
@@ -605,6 +831,16 @@ GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a);
 
 
 /**
+ * Convert timestamp from network byte order.
+ *
+ * @param tn time to convert
+ * @return converted time value
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_ntoh (struct GNUNET_TIME_TimestampNBO tn);
+
+
+/**
  * Set the timestamp offset for this instance.
  *
  * @param offset the offset to skew the locale time by
@@ -690,4 +926,6 @@ GNUNET_TIME_absolute_get_monotonic (
 
 /** @} */ /* end of group time */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_time_lib.h */
diff --git a/src/include/gnunet_transport_application_service.h b/src/include/gnunet_transport_application_service.h
index f5d4c4ee0..c093ad96a 100644
--- a/src/include/gnunet_transport_application_service.h
+++ b/src/include/gnunet_transport_application_service.h
@@ -18,25 +18,24 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @file
  * Bandwidth allocation API for applications to interact with
  *
  * @author Christian Grothoff
  * @author Matthias Wachs
  *
- * @defgroup TRANSPORT service
- * Bandwidth allocation
- *
+ * @defgroup TNG Transport Next Generation service
  * @{
  */
 #ifndef GNUNET_TRANSPORT_APPLICATION_SERVICE_H
 #define GNUNET_TRANSPORT_APPLICATION_SERVICE_H
 
+
 #include "gnunet_constants.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_nt_lib.h"
-#include "gnunet_testing_lib.h"
-#include "gnunet_testing_ng_lib.h"
 
 /**
  * Handle to the TRANSPORT subsystem for making suggestions about
@@ -118,5 +117,7 @@ GNUNET_TRANSPORT_application_validate (
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 #endif
 /* end of file gnunet_ats_application_service.h */
diff --git a/src/include/gnunet_transport_communication_service.h b/src/include/gnunet_transport_communication_service.h
index 81a382fb2..ea947911f 100644
--- a/src/include/gnunet_transport_communication_service.h
+++ b/src/include/gnunet_transport_communication_service.h
@@ -19,12 +19,15 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
  * API of the transport service towards the communicator processes.
  *
- * @defgroup transport TRANSPORT service
+ * @defgroup TNG Transport Next Generation service
  * Low-level communication with other peers
  *
  * @see [Documentation](https://gnunet.org/transport-service)
@@ -42,8 +45,8 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
-#include "gnunet_nt_lib.h"
 
 /**
  * Version number of the transport communication API.
@@ -71,7 +74,7 @@ extern "C" {
  * @param address where to send the message, human-readable
  *        communicator-specific format, 0-terminated, UTF-8
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if the provided address is
- * invalid
+ * invalid, #GNUNET_NO if this address is already (beging) connected to.
  */
 typedef int (*GNUNET_TRANSPORT_CommunicatorMqInit) (
   void *cls,
@@ -135,7 +138,8 @@ typedef void (*GNUNET_TRANSPORT_CommunicatorNotify) (
  * Connect to the transport service.
  *
  * @param cfg configuration to use
- * @param config_section section of the configuration to use for options
+ * @param config_section_name section of the configuration to use for
+ *                            options
  * @param addr_prefix address prefix for addresses supported by this
  *        communicator, could be NULL for incoming-only communicators
  * @param cc what characteristics does the communicator have?
@@ -280,7 +284,7 @@ GNUNET_TRANSPORT_communicator_mq_add (
  * Notify transport service that an MQ was updated
  *
  * @param ch connection to transport service
- * @param qh the queue to update
+ * @param u_qh the queue to update
  * @param q_len number of messages that can be send through this queue
  * @param priority queue priority. Queues with highest priority should be
  *                 used
@@ -383,4 +387,6 @@ GNUNET_TRANSPORT_communicator_notify (
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_transport_communicator_service.h */
diff --git a/src/include/gnunet_transport_core_service.h b/src/include/gnunet_transport_core_service.h
index 314eb342f..f7907a12d 100644
--- a/src/include/gnunet_transport_core_service.h
+++ b/src/include/gnunet_transport_core_service.h
@@ -18,12 +18,15 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
  * API of the transport service towards the CORE service (TNG version)
  *
- * @defgroup transport TRANSPORT service
+ * @defgroup TNG Transport Next Generation service
  * Communication with other peers
  *
  * @see [Documentation](https://gnunet.org/transport-service)
@@ -40,6 +43,7 @@ extern "C" {
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
 
 /**
@@ -174,4 +178,6 @@ GNUNET_TRANSPORT_core_get_mq (struct GNUNET_TRANSPORT_CoreHandle *handle,
 
 /** @} */ /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_transport_core_service.h */
diff --git a/src/include/gnunet_transport_hello_service.h b/src/include/gnunet_transport_hello_service.h
deleted file mode 100644
index fecffd527..000000000
--- a/src/include/gnunet_transport_hello_service.h
+++ /dev/null
@@ -1,201 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009-2016 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * obtain information about our current address
- *
- * @deprecated, in TNG applications should query PEERSTORE directly!
- *
- * @defgroup transport  Transport service
- * address information
- *
- * @see [Documentation](https://gnunet.org/transport-service)
- *
- * @{
- */
-#ifndef GNUNET_TRANSPORT_HELLO_SERVICE_H
-#define GNUNET_TRANSPORT_HELLO_SERVICE_H
-
-#ifdef __cplusplus
-extern "C" {
-#if 0 /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-#include "gnunet_ats_service.h"
-
-/**
- * Version number of the transport API.
- */
-#define GNUNET_TRANSPORT_HELLO_VERSION 0x00000000
-
-
-/**
- * Some addresses contain sensitive information or are
- * not suitable for global distribution.  We use address
- * classes to filter addresses by which domain they make
- * sense to be used in.  These are used in a bitmask.
- */
-enum GNUNET_TRANSPORT_AddressClass
-{
-  /**
-   * No address.
-   */
-  GNUNET_TRANSPORT_AC_NONE = 0,
-
-  /**
-   * Addresses that fall into no other category
-   * (i.e. incoming which we cannot use elsewhere).
-   */
-  GNUNET_TRANSPORT_AC_OTHER = 1,
-
-  /**
-   * Addresses that are global and are insensitive
-   * (i.e. IPv4).
-   */
-  GNUNET_TRANSPORT_AC_GLOBAL = 2,
-
-  /**
-   * Addresses that are global and are sensitive
-   * (i.e. IPv6 with our MAC).
-   */
-  GNUNET_TRANSPORT_AC_GLOBAL_PRIVATE = 4,
-
-  /**
-   * Addresses useful in the local wired network,
-   * i.e. a MAC.  Sensitive, but obvious to people nearby.
-   * Useful for broadcasts.
-   */
-  GNUNET_TRANSPORT_AC_LAN = 8,
-
-  /**
-   * Addresses useful in the local wireless network,
-   * i.e. a MAC.  Sensitive, but obvious to people nearby.
-   * Useful for broadcasts.
-   */
-  GNUNET_TRANSPORT_AC_WLAN = 16,
-
-  /**
-   * Addresses useful in the local bluetooth network.  Sensitive, but
-   * obvious to people nearby.  Useful for broadcasts.
-   */
-  GNUNET_TRANSPORT_AC_BT = 32,
-
-  /**
-   * Bitmask for "any" address.
-   */
-  GNUNET_TRANSPORT_AC_ANY = 65535
-};
-
-
-/**
- * Function called whenever there is an update to the
- * HELLO of this peer.
- *
- * @param cls closure
- * @param hello our updated HELLO
- */
-typedef void (*GNUNET_TRANSPORT_HelloUpdateCallback) (
-  void *cls,
-  const struct GNUNET_MessageHeader *hello);
-
-
-/**
- * Handle to cancel a #GNUNET_TRANSPORT_hello_get() operation.
- */
-struct GNUNET_TRANSPORT_HelloGetHandle;
-
-
-/**
- * Obtain updates on changes to the HELLO message for this peer. The callback
- * given in this function is never called synchronously.
- *
- * @param cfg configuration to use
- * @param ac which network type should the addresses from the HELLO belong to?
- * @param rec function to call with the HELLO
- * @param rec_cls closure for @a rec
- * @return handle to cancel the operation
- */
-struct GNUNET_TRANSPORT_HelloGetHandle *
-GNUNET_TRANSPORT_hello_get (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            enum GNUNET_TRANSPORT_AddressClass ac,
-                            GNUNET_TRANSPORT_HelloUpdateCallback rec,
-                            void *rec_cls);
-
-
-/**
- * Stop receiving updates about changes to our HELLO message.
- *
- * @param ghh handle to cancel
- */
-void
-GNUNET_TRANSPORT_hello_get_cancel (struct GNUNET_TRANSPORT_HelloGetHandle *ghh);
-
-
-/**
- * Function with addresses found in a HELLO.
- *
- * @param cls closure
- * @param peer identity of the peer
- * @param address the address (UTF-8, 0-terminated)
- * @param nt network type of the address
- * @param expiration when does this address expire?
- */
-typedef void (*GNUNET_TRANSPORT_AddressCallback) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *peer,
-  const char *address,
-  enum GNUNET_NetworkType nt,
-  struct GNUNET_TIME_Absolute expiration);
-
-
-/**
- * Parse a HELLO message that we have received into its
- * constituent addresses.
- *
- * @param hello message to parse
- * @param cb function to call on each address found
- * @param cb_cls closure for @a cb
- * @return #GNUNET_OK if hello was well-formed, #GNUNET_SYSERR if not
- */
-int
-GNUNET_TRANSPORT_hello_parse (const struct GNUNET_MessageHeader *hello,
-                              GNUNET_TRANSPORT_AddressCallback cb,
-                              void *cb_cls);
-
-
-#if 0 /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef GNUNET_TRANSPORT_HELLO_SERVICE_H */
-#endif
-
-/** @} */ /* end of group */
-
-/* end of gnunet_transport_hello_service.h */
diff --git a/src/include/gnunet_transport_manipulation_service.h b/src/include/gnunet_transport_manipulation_service.h
deleted file mode 100644
index 09fb138f8..000000000
--- a/src/include/gnunet_transport_manipulation_service.h
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009-2014, 2016 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * Low-level P2P IO
- *
- * @defgroup transport  Transport service
- * Low-level P2P IO
- *
- * @see [Documentation](https://gnunet.org/transport-service)
- *
- * @{
- */
-
-#ifndef GNUNET_TRANSPORT_MANIPULATION_SERVICE_H
-#define GNUNET_TRANSPORT_MANIPULATION_SERVICE_H
-
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-#include "gnunet_ats_service.h"
-
-/**
- * Version number of the transport API.
- */
-#define GNUNET_TRANSPORT_MANIPULATION_VERSION 0x00000003
-
-/**
- * Handle for transport manipulation.
- */
-struct GNUNET_TRANSPORT_ManipulationHandle;
-
-
-/**
- * Connect to the transport service.  Note that the connection may
- * complete (or fail) asynchronously.
- *
- * @param cfg configuration to use
- * @return NULL on error
- */
-struct GNUNET_TRANSPORT_ManipulationHandle *
-GNUNET_TRANSPORT_manipulation_connect (const struct
-                                       GNUNET_CONFIGURATION_Handle *cfg);
-
-
-/**
- * Disconnect from the transport service.
- *
- * @param handle handle returned from connect
- */
-void
-GNUNET_TRANSPORT_manipulation_disconnect (struct
-                                          GNUNET_TRANSPORT_ManipulationHandle *
-                                          handle);
-
-
-/**
- * Set transport metrics for a peer and a direction
- *
- * @param handle transport handle
- * @param peer the peer to set the metric for
- * @param prop the performance metrics to set
- * @param delay_in inbound delay to introduce
- * @param delay_out outbound delay to introduce
- *
- * Note: Delay restrictions in receiving direction will be enforced
- * with one message delay.
- */
-void
-GNUNET_TRANSPORT_manipulation_set (struct
-                                   GNUNET_TRANSPORT_ManipulationHandle *handle,
-                                   const struct GNUNET_PeerIdentity *peer,
-                                   const struct GNUNET_ATS_Properties *prop,
-                                   struct GNUNET_TIME_Relative delay_in,
-                                   struct GNUNET_TIME_Relative delay_out);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef GNUNET_TRANSPORT_MANIPULATION_SERVICE_H */
-#endif
-
-/** @} */  /* end of group */
-
-/* end of gnunet_transport_manipulation_service.h */
diff --git a/src/include/gnunet_transport_monitor_service.h b/src/include/gnunet_transport_monitor_service.h
index f39be16d7..7c586b51e 100644
--- a/src/include/gnunet_transport_monitor_service.h
+++ b/src/include/gnunet_transport_monitor_service.h
@@ -19,12 +19,15 @@
  */
 
 /**
+ * @addtogroup Backbone
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
  * Monitoring / diagnostics API for the transport service
  *
- * @defgroup transport TRANSPORT service
+ * @defgroup TNG Transport Next Generation service
  * Communication with other peers
  *
  * @see [Documentation](https://gnunet.org/transport-service)
@@ -42,8 +45,8 @@ extern "C"
 #endif
 #endif
 
+
 #include "gnunet_util_lib.h"
-#include "gnunet_ats_transport_service.h"
 #include "gnunet_transport_communication_service.h"
 
 
@@ -189,4 +192,6 @@ GNUNET_TRANSPORT_monitor_cancel (struct GNUNET_TRANSPORT_MonitorContext *mc);
 
 /** @} */  /* end of group */
 
+/** @} */ /* end of group addition */
+
 /* end of gnunet_transport_monitor_service.h */
diff --git a/src/include/gnunet_transport_plugin.h b/src/include/gnunet_transport_plugin.h
deleted file mode 100644
index 74b27923a..000000000
--- a/src/include/gnunet_transport_plugin.h
+++ /dev/null
@@ -1,727 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2009-2014 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * Transport service plugin API
- *
- * @defgroup transport-plugin  Transport Service plugin API
- *
- * Specifies the struct that is given to the plugin's entry method and the other
- * struct that must be returned.  Note that the destructors of transport plugins
- * will be given the value returned by the constructor and is expected to return
- * a NULL pointer.
- *
- * @{
- */
-#ifndef PLUGIN_TRANSPORT_H
-#define PLUGIN_TRANSPORT_H
-
-#include "gnunet_configuration_lib.h"
-#include "gnunet_scheduler_lib.h"
-#include "gnunet_statistics_service.h"
-#include "gnunet_transport_service.h"
-#include "gnunet_ats_service.h"
-
-#define TRANSPORT_SESSION_INBOUND_STRING "<inbound>"
-
-/**
- * Opaque pointer that plugins can use to distinguish specific
- * connections to a given peer.  Typically used by stateful plugins to
- * allow the service to refer to specific streams instead of a more
- * general notion of "some connection" to the given peer.  This is
- * useful since sometimes (e.g. for inbound TCP connections) a
- * connection may not have an address that can be used for meaningful
- * distinction between sessions to the same peer.
- *
- * Each 'struct GNUNET_ATS_Session' MUST start with the 'struct GNUNET_PeerIdentity'
- * of the peer the session is for (which will be used for some error
- * checking by the ATS code).
- */
-struct GNUNET_ATS_Session;
-
-
-/**
- * Function that will be called whenever the plugin internally
- * cleans up a session pointer and hence the service needs to
- * discard all of those sessions as well.  Plugins that do not
- * use sessions can simply omit calling this function and always
- * use NULL wherever a session pointer is needed.  This function
- * should be called BEFORE a potential "TransmitContinuation"
- * from the "TransmitFunction".
- *
- * @param cls closure
- * @param peer which peer was the session for
- * @param session which session is being destroyed
- */
-typedef void
-(*GNUNET_TRANSPORT_SessionEnd) (void *cls,
-                                const struct GNUNET_HELLO_Address *address,
-                                struct GNUNET_ATS_Session *session);
-
-
-/**
- * Plugin tells transport service about a new inbound session
- *
- * @param cls unused
- * @param address the address
- * @param session the new session
- * @param net network information
- */
-typedef void
-(*GNUNET_TRANSPORT_SessionStart) (void *cls,
-                                  const struct GNUNET_HELLO_Address *address,
-                                  struct GNUNET_ATS_Session *session,
-                                  enum GNUNET_NetworkType net);
-
-
-/**
- * Function called by the transport for each received message.
- * This function should also be called with "NULL" for the
- * message to signal that the other peer disconnected.
- *
- * @param cls closure
- * @param peer (claimed) identity of the other peer
- * @param message the message, NULL if we only care about
- *                learning about the delay until we should receive again
- * @param session identifier used for this session (NULL for plugins
- *                that do not offer bi-directional communication to the sender
- *                using the same "connection")
- * @param sender_address binary address of the sender (if we established the
- *                connection or are otherwise sure of it; should be NULL
- *                for inbound TCP/UDP connections since it it not clear
- *                that we could establish ourselves a connection to that
- *                IP address and get the same system)
- * @param sender_address_len number of bytes in @a sender_address
- * @return how long the plugin should wait until receiving more data;
- *         returning #GNUNET_TIME_UNIT_FOREVER_REL means that the
- *         connection should be closed
- */
-typedef struct GNUNET_TIME_Relative
-(*GNUNET_TRANSPORT_PluginReceiveCallback) (void *cls,
-                                           const struct
-                                           GNUNET_HELLO_Address *address,
-                                           struct GNUNET_ATS_Session *session,
-                                           const struct
-                                           GNUNET_MessageHeader *message);
-
-
-/**
- * Function that can be called by plugins to figure if an address is
- * an loopback, LAN or WAN address.   Ultimately invokes
- * #GNUNET_ATS_address_get_type().
- *
- * @param cls closure
- * @param addr binary address
- * @param addrlen length of the @a addr
- * @return type of the network the address belongs to
- */
-typedef enum GNUNET_NetworkType
-(*GNUNET_TRANSPORT_AddressToType)(void *cls,
-                                  const struct sockaddr *addr,
-                                  size_t addrlen);
-
-
-/**
- * Function called when distance of an address changes.
- *
- * @param cls closure
- * @param peer peer
- * @param distance new distance
- */
-typedef void
-(*GNUNET_TRANSPORT_UpdateAddressDistance) (void *cls,
-                                           const struct
-                                           GNUNET_HELLO_Address *address,
-                                           uint32_t distance);
-
-
-/**
- * Function that will be called for each address the transport
- * is aware that it might be reachable under.
- *
- * @param cls closure
- * @param add_remove should the address added (#GNUNET_YES) or removed (#GNUNET_NO) from the
- *                   set of valid addresses?
- * @param address the address to add or remove
- */
-typedef void
-(*GNUNET_TRANSPORT_AddressNotification) (void *cls,
-                                         int add_remove,
-                                         const struct
-                                         GNUNET_HELLO_Address *address);
-
-
-/**
- * Function that will be called whenever the plugin receives data over
- * the network and wants to determine how long it should wait until
- * the next time it reads from the given peer.  Note that some plugins
- * (such as UDP) may not be able to wait (for a particular peer), so
- * the waiting part is optional.  Plugins that can wait should call
- * this function, sleep the given amount of time, and call it again
- * (with zero bytes read) UNTIL it returns zero and only then read.
- *
- * @param cls closure
- * @param peer which peer did we read data from
- * @param amount_recved number of bytes read (can be zero)
- * @return how long to wait until reading more from this peer
- *         (to enforce inbound quotas); returning #GNUNET_TIME_UNIT_FOREVER_REL
- *         means that the connection should be closed
- */
-typedef struct GNUNET_TIME_Relative
-(*GNUNET_TRANSPORT_TrafficReport) (void *cls,
-                                   const struct GNUNET_PeerIdentity *peer,
-                                   size_t amount_recved);
-
-
-/**
- * Function that returns a HELLO message.
- *
- * @return HELLO message (FIXME with what?)
- */
-typedef const struct GNUNET_MessageHeader *
-(*GNUNET_TRANSPORT_GetHelloCallback) (void);
-
-
-/**
- * The transport service will pass a pointer to a struct
- * of this type as the first and only argument to the
- * entry point of each transport plugin.
- */
-struct GNUNET_TRANSPORT_PluginEnvironment
-{
-  /**
-   * Configuration to use.
-   */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-  /**
-   * Identity of this peer.
-   */
-  const struct GNUNET_PeerIdentity *my_identity;
-
-  /**
-   * Closure for the various callbacks.
-   */
-  void *cls;
-
-  /**
-   * Handle for reporting statistics.
-   */
-  struct GNUNET_STATISTICS_Handle *stats;
-
-  /**
-   * Function that should be called by the transport plugin
-   * whenever a message is received.  If this field is "NULL",
-   * the plugin should load in 'stub' mode and NOT fully
-   * initialize and instead only return an API with the
-   * @e address_pretty_printer, @e address_to_string and
-   * @e string_to_address functions.
-   */
-  GNUNET_TRANSPORT_PluginReceiveCallback receive;
-
-  /**
-   * Function that returns our HELLO.
-   */
-  GNUNET_TRANSPORT_GetHelloCallback get_our_hello;
-
-  /**
-   * Function that must be called by each plugin to notify the
-   * transport service about the addresses under which the transport
-   * provided by the plugin can be reached.
-   */
-  GNUNET_TRANSPORT_AddressNotification notify_address;
-
-  /**
-   * Function that must be called by the plugin when a non-NULL
-   * session handle stops being valid (is destroyed).
-   */
-  GNUNET_TRANSPORT_SessionEnd session_end;
-
-  /**
-   * Function called by the plugin when a new (incoming) session was created
-   * not explicitly created using the the get_session function
-   */
-  GNUNET_TRANSPORT_SessionStart session_start;
-
-  /**
-   * Function that will be called to figure if an address is an loopback,
-   * LAN, WAN etc. address
-   */
-  GNUNET_TRANSPORT_AddressToType get_address_type;
-
-  /**
-   * Function that will be called by DV to update distance for
-   * an address.
-   */
-  GNUNET_TRANSPORT_UpdateAddressDistance update_address_distance;
-
-  /**
-   * What is the maximum number of connections that this transport
-   * should allow?  Transports that do not have sessions (such as
-   * UDP) can ignore this value.
-   */
-  uint32_t max_connections;
-};
-
-
-/**
- * Function called by the #GNUNET_TRANSPORT_TransmitFunction
- * upon "completion".  In the case that a peer disconnects,
- * this function must be called for each pending request
- * (with a 'failure' indication) AFTER notifying the service
- * about the disconnect event (so that the service won't try
- * to transmit more messages, believing the connection still
- * exists...).
- *
- * @param cls closure
- * @param target who was the recipient of the message?
- * @param result #GNUNET_OK on success
- *               #GNUNET_SYSERR if the target disconnected;
- *               disconnect will ALSO be signalled using
- *               the ReceiveCallback.
- * @param size_payload bytes of payload from transport service in message
- * @param size_on_wire bytes required on wire for transmission,
- *               0 if result == #GNUNET_SYSERR
- */
-typedef void
-(*GNUNET_TRANSPORT_TransmitContinuation) (void *cls,
-                                          const struct
-                                          GNUNET_PeerIdentity *target,
-                                          int result,
-                                          size_t size_payload,
-                                          size_t size_on_wire);
-
-
-/**
- * The new send function with just the session and no address
- *
- * Function that can be used by the transport service to transmit
- * a message using the plugin.   Note that in the case of a
- * peer disconnecting, the continuation MUST be called
- * prior to the disconnect notification itself.  This function
- * will be called with this peer's HELLO message to initiate
- * a fresh connection to another peer.
- *
- * @param cls closure
- * @param session which session must be used
- * @param msgbuf the message to transmit
- * @param msgbuf_size number of bytes in @a msgbuf
- * @param priority how important is the message (most plugins will
- *                 ignore message priority and just FIFO)
- * @param to how long to wait at most for the transmission (does not
- *                require plugins to discard the message after the timeout,
- *                just advisory for the desired delay; most plugins will ignore
- *                this as well)
- * @param cont continuation to call once the message has
- *        been transmitted (or if the transport is ready
- *        for the next transmission call; or if the
- *        peer disconnected...); can be NULL
- * @param cont_cls closure for @a cont
- * @return number of bytes used (on the physical network, with overheads);
- *         -1 on hard errors (i.e. address invalid); 0 is a legal value
- *         and does NOT mean that the message was not transmitted (DV)
- */
-typedef ssize_t
-(*GNUNET_TRANSPORT_TransmitFunction) (void *cls,
-                                      struct GNUNET_ATS_Session *session,
-                                      const char *msgbuf,
-                                      size_t msgbuf_size,
-                                      unsigned int priority,
-                                      struct GNUNET_TIME_Relative to,
-                                      GNUNET_TRANSPORT_TransmitContinuation cont,
-                                      void *cont_cls);
-
-
-/**
- * Function that can be called to force a disconnect from the
- * specified neighbour for the given session only.  .  This should
- * also cancel all previously scheduled transmissions for this
- * session.  Obviously the transmission may have been partially
- * completed already, which is OK.  The plugin is supposed to close
- * the connection (if applicable).
- *
- * @param cls closure with the `struct Plugin`
- * @param session session to destroy
- * @return #GNUNET_OK on success
- */
-typedef int
-(*GNUNET_TRANSPORT_DisconnectSessionFunction) (void *cls,
-                                               struct GNUNET_ATS_Session *
-                                               session);
-
-
-/**
- * Function that is called to get the keepalive factor.
- * #GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT is divided by this number to
- * calculate the interval between keepalive packets.
- *
- * @param cls closure with the `struct Plugin`
- * @return keepalive factor
- */
-typedef unsigned int
-(*GNUNET_TRANSPORT_QueryKeepaliveFactorFunction) (void *cls);
-
-
-/**
- * Function that can be called to force a disconnect from the
- * specified neighbour.  This should also cancel all previously
- * scheduled transmissions.  Obviously the transmission may have been
- * partially completed already, which is OK.  The plugin is supposed
- * to close the connection (if applicable) and no longer call the
- * transmit continuation(s).
- *
- * @param cls closure
- * @param target peer for which the last transmission is
- *        to be cancelled
- */
-typedef void
-(*GNUNET_TRANSPORT_DisconnectPeerFunction) (void *cls,
-                                            const struct
-                                            GNUNET_PeerIdentity *target);
-
-
-/**
- * Function called by the pretty printer for the resolved address for
- * each human-readable address obtained.  The callback can be called
- * several times. The last invocation must be with a @a address of
- * NULL and a @a res of #GNUNET_OK.  Thus, to indicate conversion
- * errors, the callback might be called first with @a address NULL and
- * @a res being #GNUNET_SYSERR.  In that case, there must still be a
- * subsequent call later with @a address NULL and @a res #GNUNET_OK.
- *
- * @param cls closure
- * @param address one of the names for the host, NULL on last callback
- * @param res #GNUNET_OK if conversion was successful, #GNUNET_SYSERR on failure,
- *      #GNUNET_OK on last callback
- */
-typedef void
-(*GNUNET_TRANSPORT_AddressStringCallback) (void *cls,
-                                           const char *address,
-                                           int res);
-
-
-/**
- * Convert the transports address to a nice, human-readable
- * format.
- *
- * @param cls closure
- * @param type name of the transport that generated the address
- * @param addr one of the addresses of the host, NULL for the last address
- *        the specific address format depends on the transport
- * @param addrlen length of the @a addr
- * @param numeric should (IP) addresses be displayed in numeric form?
- * @param timeout after how long should we give up?
- * @param asc function to call on each string
- * @param asc_cls closure for @a asc
- */
-typedef void
-(*GNUNET_TRANSPORT_AddressPrettyPrinter) (void *cls,
-                                          const char *type,
-                                          const void *addr,
-                                          size_t addrlen,
-                                          int numeric,
-                                          struct GNUNET_TIME_Relative timeout,
-                                          GNUNET_TRANSPORT_AddressStringCallback
-                                          asc,
-                                          void *asc_cls);
-
-
-/**
- * Another peer has suggested an address for this peer and transport
- * plugin.  Check that this could be a valid address.  This function
- * is not expected to 'validate' the address in the sense of trying to
- * connect to it but simply to see if the binary format is technically
- * legal for establishing a connection to this peer (and make sure that
- * the address really corresponds to our network connection/settings
- * and not some potential man-in-the-middle).
- *
- * @param addr pointer to the address
- * @param addrlen length of @a addr
- * @return #GNUNET_OK if this is a plausible address for this peer
- *         and transport, #GNUNET_SYSERR if not
- */
-typedef int
-(*GNUNET_TRANSPORT_CheckAddress) (void *cls,
-                                  const void *addr,
-                                  size_t addrlen);
-
-
-/**
- * Create a new session to transmit data to the target
- * This session will used to send data to this peer and the plugin will
- * notify us by calling the env->session_end function
- *
- * @param cls the plugin
- * @param address the hello address
- * @return the session if the address is valid, NULL otherwise
- */
-typedef struct GNUNET_ATS_Session *
-(*GNUNET_TRANSPORT_CreateSession) (void *cls,
-                                   const struct GNUNET_HELLO_Address *address);
-
-
-/**
- * Function that will be called whenever the transport service wants to
- * notify the plugin that a session is still active and in use and
- * therefore the session timeout for this session has to be updated
- *
- * @param cls closure
- * @param peer which peer was the session for
- * @param session which session is being updated
- */
-typedef void
-(*GNUNET_TRANSPORT_UpdateSessionTimeout) (void *cls,
-                                          const struct
-                                          GNUNET_PeerIdentity *peer,
-                                          struct GNUNET_ATS_Session *session);
-
-
-/**
- * Function that will be called whenever the transport service wants to
- * notify the plugin that the inbound quota changed and that the plugin
- * should update it's delay for the next receive value
- *
- * @param cls closure
- * @param peer which peer was the session for
- * @param session which session is being updated
- * @param delay new delay to use for receiving
- */
-typedef void
-(*GNUNET_TRANSPORT_UpdateInboundDelay) (void *cls,
-                                        const struct GNUNET_PeerIdentity *peer,
-                                        struct GNUNET_ATS_Session *session,
-                                        struct GNUNET_TIME_Relative delay);
-
-
-/**
- * Function called for a quick conversion of the binary address to
- * a numeric address.  Note that the caller must not free the
- * address and that the next call to this function is allowed
- * to override the address again.
- *
- * @param cls closure
- * @param addr binary address
- * @param addr_len length of the @a addr
- * @return string representing the same address
- */
-typedef const char *
-(*GNUNET_TRANSPORT_AddressToString) (void *cls,
-                                     const void *addr,
-                                     size_t addrlen);
-
-
-/**
- * Function called to convert a string address to
- * a binary address.
- *
- * @param cls closure (`struct Plugin*`)
- * @param addr string address
- * @param addrlen length of the @a addr including \0 termination
- * @param buf location to store the buffer
- *        If the function returns #GNUNET_SYSERR, its contents are undefined.
- * @param added length of created address
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
- */
-typedef int
-(*GNUNET_TRANSPORT_StringToAddress) (void *cls,
-                                     const char *addr,
-                                     uint16_t addrlen,
-                                     void **buf,
-                                     size_t *added);
-
-
-/**
- * Function to obtain the network type for a session
- *
- * @param cls closure (`struct Plugin *`)
- * @param session the session
- * @return the network type
- */
-typedef enum GNUNET_NetworkType
-(*GNUNET_TRANSPORT_GetNetworkType)(void *cls,
-                                   struct GNUNET_ATS_Session *session);
-
-
-/**
- * Function to obtain the network type for an address.
- *
- * @param cls closure (`struct Plugin *`)
- * @param address the address
- * @return the network type
- */
-typedef enum GNUNET_NetworkType
-(*GNUNET_TRANSPORT_GetNetworkTypeForAddress)(void *cls,
-                                             const struct
-                                             GNUNET_HELLO_Address *address);
-
-
-/**
- * Function called by the plugin with information about the
- * current sessions managed by the plugin (for monitoring).
- *
- * @param cls closure
- * @param session session handle this information is about,
- *        NULL to indicate that we are "in sync" (initial
- *        iteration complete)
- * @param info information about the state of the session,
- *        NULL if @a session is also NULL and we are
- *        merely signalling that the initial iteration is over
- */
-typedef void
-(*GNUNET_TRANSPORT_SessionInfoCallback) (void *cls,
-                                         struct GNUNET_ATS_Session *session,
-                                         const struct
-                                         GNUNET_TRANSPORT_SessionInfo *info);
-
-
-/**
- * Begin monitoring sessions of a plugin.  There can only
- * be one active monitor per plugin (i.e. if there are
- * multiple monitors, the transport service needs to
- * multiplex the generated events over all of them).
- *
- * @param cls closure of the plugin
- * @param sic callback to invoke, NULL to disable monitor;
- *            plugin will being by iterating over all active
- *            sessions immediately and then enter monitor mode
- * @param sic_cls closure for @a sic
- */
-typedef void
-(*GNUNET_TRANSPORT_SessionMonitorSetup) (void *cls,
-                                         GNUNET_TRANSPORT_SessionInfoCallback
-                                         sic,
-                                         void *sic_cls);
-
-
-/**
- * Each plugin is required to return a pointer to a struct of this
- * type as the return value from its entry point.
- */
-struct GNUNET_TRANSPORT_PluginFunctions
-{
-  /**
-   * Closure for all of the callbacks.
-   */
-  void *cls;
-
-  /**
-   * Function that the transport service will use to transmit data to
-   * another peer.  May be NULL for plugins that only support
-   * receiving data.  After this call, the plugin call the specified
-   * continuation with success or error before notifying us about the
-   * target having disconnected.
-   */
-  GNUNET_TRANSPORT_TransmitFunction send;
-
-  /**
-   * Function that can be used to force the plugin to disconnect from
-   * the given peer and cancel all previous transmissions (and their
-   * continuations).
-   */
-  GNUNET_TRANSPORT_DisconnectPeerFunction disconnect_peer;
-
-  /**
-   * Function that can be used to force the plugin to disconnect from
-   * the given peer and cancel all previous transmissions (and their
-   * continuations).
-   */
-  GNUNET_TRANSPORT_DisconnectSessionFunction disconnect_session;
-
-  /**
-   * Function that will be called whenever the transport service wants to
-   * notify the plugin that a session is still active and in use and
-   * therefore the session timeout for this session has to be updated
-   */
-  GNUNET_TRANSPORT_UpdateSessionTimeout update_session_timeout;
-
-  /**
-   * Function that will be called whenever the transport service wants to
-   * notify the plugin that the inbound quota changed and that the plugin
-   * should update it's delay for the next receive value
-   */
-  GNUNET_TRANSPORT_UpdateInboundDelay update_inbound_delay;
-
-  /**
-   * Function that is used to query keepalive factor.
-   * #GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT is divided by this number to
-   * calculate the interval between keepalive packets.
-   */
-  GNUNET_TRANSPORT_QueryKeepaliveFactorFunction query_keepalive_factor;
-
-  /**
-   * Function to pretty-print addresses.
-   */
-  GNUNET_TRANSPORT_AddressPrettyPrinter address_pretty_printer;
-
-  /**
-   * Function that will be called to check if a binary address
-   * for this plugin is well-formed and corresponds to an
-   * address for THIS peer (as per our configuration).  Naturally,
-   * if absolutely necessary, plugins can be a bit conservative in
-   * their answer, but in general plugins should make sure that the
-   * address does not redirect traffic to a 3rd party that might
-   * try to man-in-the-middle our traffic.
-   */
-  GNUNET_TRANSPORT_CheckAddress check_address;
-
-  /**
-   * Function that will be called to convert a binary address
-   * to a string (numeric conversion only).
-   */
-  GNUNET_TRANSPORT_AddressToString address_to_string;
-
-  /**
-   * Function that will be called to convert a string address
-   * to binary (numeric conversion only).
-   */
-  GNUNET_TRANSPORT_StringToAddress string_to_address;
-
-  /**
-   * Function that will be called tell the plugin to create a session
-   * object.
-   */
-  GNUNET_TRANSPORT_CreateSession get_session;
-
-  /**
-   * Function to obtain the network type for a session
-   */
-  GNUNET_TRANSPORT_GetNetworkType get_network;
-
-  /**
-   * Function to obtain the network type for an address
-   */
-  GNUNET_TRANSPORT_GetNetworkTypeForAddress get_network_for_address;
-
-  /**
-   * Function to monitor the sessions managed by the plugin.
-   */
-  GNUNET_TRANSPORT_SessionMonitorSetup setup_monitor;
-};
-
-
-/*#ifndef PLUGIN_TRANSPORT_H*/
-#endif
-
-/** @} */  /* end of group */
-
-/* end of gnunet_transport_plugin.h */
diff --git a/src/include/gnunet_transport_service.h b/src/include/gnunet_transport_service.h
deleted file mode 100644
index 459efc506..000000000
--- a/src/include/gnunet_transport_service.h
+++ /dev/null
@@ -1,708 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009-2016 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * Low-level P2P IO
- *
- * @defgroup transport  Transport service
- * Low-level P2P IO
- *
- * @see [Documentation](https://gnunet.org/transport-service)
- *
- * @{
- */
-
-#ifndef GNUNET_TRANSPORT_SERVICE_H
-#define GNUNET_TRANSPORT_SERVICE_H
-
-#ifdef __cplusplus
-extern "C" {
-#if 0 /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "gnunet_util_lib.h"
-#include "gnunet_ats_service.h"
-
-/**
- * Version number of the transport API.
- */
-#define GNUNET_TRANSPORT_VERSION 0x00000003
-
-
-/* *************************** HELLO *************************** */
-
-/**
- * Handle for a #GNUNET_TRANSPORT_offer_hello operation
- */
-struct GNUNET_TRANSPORT_OfferHelloHandle;
-
-
-/**
- * Offer the transport service the HELLO of another peer.  Note that
- * the transport service may just ignore this message if the HELLO is
- * malformed or useless due to our local configuration.
- *
- * @param cfg configuration
- * @param hello the hello message
- * @param cont continuation to call when HELLO has been sent,
- *      tc reason #GNUNET_SCHEDULER_REASON_TIMEOUT for fail
- *      tc reasong #GNUNET_SCHEDULER_REASON_READ_READY for success
- * @param cont_cls closure for @a cont
- * @return a `struct GNUNET_TRANSPORT_OfferHelloHandle` handle or NULL on
- * failure, in case of failure @a cont will not be called
- *
- */
-struct GNUNET_TRANSPORT_OfferHelloHandle *
-GNUNET_TRANSPORT_offer_hello (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                              const struct GNUNET_MessageHeader *hello,
-                              GNUNET_SCHEDULER_TaskCallback cont,
-                              void *cont_cls);
-
-
-/**
- * Cancel the request to transport to offer the HELLO message
- *
- * @param ohh the `struct GNUNET_TRANSPORT_OfferHelloHandle` to cancel
- */
-void
-GNUNET_TRANSPORT_offer_hello_cancel (
-  struct GNUNET_TRANSPORT_OfferHelloHandle *ohh);
-
-
-/* *********************** Address to String ******************* */
-
-/**
- * Handle to cancel a pending address lookup.
- */
-struct GNUNET_TRANSPORT_AddressToStringContext;
-
-
-/**
- * Function to call with a textual representation of an address.  This
- * function will be called several times with different possible
- * textual representations, and a last time with @a address being NULL
- * to signal the end of the iteration.  Note that @a address NULL
- * always is the last call, regardless of the value in @a res.
- *
- * @param cls closure
- * @param address NULL on end of iteration,
- *        otherwise 0-terminated printable UTF-8 string,
- *        in particular an empty string if @a res is #GNUNET_NO
- * @param res result of the address to string conversion:
- *        if #GNUNET_OK: conversion successful
- *        if #GNUNET_NO: address was invalid (or not supported)
- *        if #GNUNET_SYSERR: communication error (IPC error)
- */
-typedef void
-(*GNUNET_TRANSPORT_AddressToStringCallback) (void *cls,
-                                             const char *address,
-                                             int res);
-
-
-/**
- * Convert a binary address into a human readable address.
- *
- * @param cfg configuration to use
- * @param address address to convert (binary format)
- * @param numeric should (IP) addresses be displayed in numeric form
- *                (otherwise do reverse DNS lookup)
- * @param timeout how long is the lookup allowed to take at most
- * @param aluc function to call with the results
- * @param aluc_cls closure for @a aluc
- * @return handle to cancel the operation, NULL on error
- */
-struct GNUNET_TRANSPORT_AddressToStringContext *
-GNUNET_TRANSPORT_address_to_string (
-  const struct GNUNET_CONFIGURATION_Handle *cfg,
-  const struct GNUNET_HELLO_Address *address,
-  int numeric,
-  struct GNUNET_TIME_Relative timeout,
-  GNUNET_TRANSPORT_AddressToStringCallback aluc,
-  void *aluc_cls);
-
-
-/**
- * Cancel request for address conversion.
- *
- * @param alc the context handle
- */
-void
-GNUNET_TRANSPORT_address_to_string_cancel (
-  struct GNUNET_TRANSPORT_AddressToStringContext *alc);
-
-
-/* *********************** Monitoring ************************** */
-
-
-/**
- * Possible state of a neighbour.  Initially, we are
- * #GNUNET_TRANSPORT_PS_NOT_CONNECTED.
- *
- * Then, there are two main paths. If we receive a SYN message, we give
- * the inbound address to ATS. After the check we ask ATS for a suggestion
- * (#GNUNET_TRANSPORT_PS_CONNECT_RECV_ATS). If ATS makes a suggestion, we
- * send our SYN_ACK and go to #GNUNET_TRANSPORT_PS_CONNECT_RECV_ACK.
- * If we receive a ACK, we go to #GNUNET_TRANSPORT_PS_CONNECTED
- * (and notify everyone about the new connection). If the operation times out,
- * we go to #GNUNET_TRANSPORT_PS_DISCONNECT.
- *
- * The other case is where we transmit a SYN message first.  We
- * start with #GNUNET_TRANSPORT_PS_INIT_ATS.  If we get an address, we send
- * the SYN message and go to state #GNUNET_TRANSPORT_PS_CONNECT_SENT.
- * Once we receive a SYN_ACK, we go to #GNUNET_TRANSPORT_PS_CONNECTED
- * (and notify everyone about the new connection and send
- * back a ACK).  If the operation times out, we go to
- * #GNUNET_TRANSPORT_PS_DISCONNECT.
- *
- * If the session is in trouble (i.e. transport-level disconnect or
- * timeout), we go to #GNUNET_TRANSPORT_PS_RECONNECT_ATS where we ask ATS for a
- * new address (we don't notify anyone about the disconnect yet).  Once we have
- * a new address, we enter #GNUNET_TRANSPORT_PS_RECONNECT_SENT and send a SYN
- * message.  If we receive a SYN_ACK, we go to #GNUNET_TRANSPORT_PS_CONNECTED
- * and nobody noticed that we had trouble; we also send a ACK at this time just
- * in case.  If the operation times out, we go to
- * #GNUNET_TRANSPORT_PS_DISCONNECT (and notify everyone about the lost
- * connection).
- *
- * If ATS decides to switch addresses while we have a normal
- * connection, we go to #GNUNET_TRANSPORT_PS_CONNECTED_SWITCHING_SYN_SENT
- * and send a SESSION_CONNECT.  If we get a ACK back, we switch the
- * primary connection to the suggested alternative from ATS, go back
- * to #GNUNET_TRANSPORT_PS_CONNECTED and send a ACK to the other peer just to be
- * sure.  If the operation times out
- * we go to #GNUNET_TRANSPORT_PS_CONNECTED (and notify ATS that the given
- * alternative address is "invalid").
- *
- * Once a session is in #GNUNET_TRANSPORT_PS_DISCONNECT, it is cleaned up and
- * then goes to (#GNUNET_TRANSPORT_PS_DISCONNECT_FINISHED).  If we receive an
- * explicit disconnect request, we can go from any state to
- * #GNUNET_TRANSPORT_PS_DISCONNECT, possibly after generating disconnect
- * notifications.
- *
- * Note that it is quite possible that while we are in any of these
- * states, we could receive a 'SYN' request from the other peer.
- * We then enter a 'weird' state where we pursue our own primary state
- * machine (as described above), but with the 'send_connect_ack' flag
- * set to 1.  If our state machine allows us to send a 'SYN_ACK'
- * (because we have an acceptable address), we send the 'SYN_ACK'
- * and set the 'send_connect_ack' to 2.  If we then receive a
- * 'ACK', we go to #GNUNET_TRANSPORT_PS_CONNECTED (and reset 'send_connect_ack'
- * to 0).
- *
- */
-enum GNUNET_TRANSPORT_PeerState
-{
-  /**
-   * Fresh peer or completely disconnected
-   */
-  GNUNET_TRANSPORT_PS_NOT_CONNECTED = 0,
-
-  /**
-   * Asked to initiate connection, trying to get address from ATS
-   */
-  GNUNET_TRANSPORT_PS_INIT_ATS,
-
-  /**
-   * Sent SYN message to other peer, waiting for SYN_ACK
-   */
-  GNUNET_TRANSPORT_PS_SYN_SENT,
-
-  /**
-   * Received a SYN, asking ATS about address suggestions.
-   */
-  GNUNET_TRANSPORT_PS_SYN_RECV_ATS,
-
-  /**
-   * SYN request from other peer was SYN_ACK'ed, waiting for ACK.
-   */
-  GNUNET_TRANSPORT_PS_SYN_RECV_ACK,
-
-  /**
-   * Got our SYN_ACK/ACK, connection is up.
-   */
-  GNUNET_TRANSPORT_PS_CONNECTED,
-
-  /**
-   * Connection got into trouble, rest of the system still believes
-   * it to be up, but we're getting a new address from ATS.
-   */
-  GNUNET_TRANSPORT_PS_RECONNECT_ATS,
-
-  /**
-   * Sent SYN over new address (either by ATS telling us to switch
-   * addresses or from RECONNECT_ATS); if this fails, we need to tell
-   * the rest of the system about a disconnect.
-   */
-  GNUNET_TRANSPORT_PS_RECONNECT_SENT,
-
-  /**
-   * We have some primary connection, but ATS suggested we switch
-   * to some alternative; we now sent a SYN message for the
-   * alternative session to the other peer and waiting for a
-   * SYN_ACK to make this our primary connection.
-   */
-  GNUNET_TRANSPORT_PS_SWITCH_SYN_SENT,
-
-  /**
-   * Disconnect in progress (we're sending the DISCONNECT message to the
-   * other peer; after that is finished, the state will be cleaned up).
-   */
-  GNUNET_TRANSPORT_PS_DISCONNECT,
-
-  /**
-   * We're finished with the disconnect; and are cleaning up the state
-   * now!  We put the struct into this state when we are really in the
-   * task that calls 'free' on it and are about to remove the record
-   * from the map.  We should never find a 'struct NeighbourMapEntry'
-   * in this state in the map.  Accessing a 'struct NeighbourMapEntry'
-   * in this state virtually always means using memory that has been
-   * freed (the exception being the cleanup code in #free_neighbour()).
-   */
-  GNUNET_TRANSPORT_PS_DISCONNECT_FINISHED
-};
-
-
-/**
- * Convert a transport state to a human readable string.
- *
- * @param state the state
- */
-const char *
-GNUNET_TRANSPORT_ps2s (enum GNUNET_TRANSPORT_PeerState state);
-
-
-/**
- * Check if a state is defined as connected
- *
- * @param state the state value
- * @return #GNUNET_YES or #GNUNET_NO
- */
-int
-GNUNET_TRANSPORT_is_connected (enum GNUNET_TRANSPORT_PeerState state);
-
-
-/**
- * Handle for a #GNUNET_TRANSPORT_monitor_peers operation.
- */
-struct GNUNET_TRANSPORT_PeerMonitoringContext;
-
-
-/**
- * Function to call with information about a peer
- *
- * If one_shot was set to #GNUNET_YES to iterate over all peers once,
- * a final call with NULL for peer and address will follow when done.
- * In this case state and timeout do not contain valid values.
- *
- * The #GNUNET_TRANSPORT_monitor_peers_cancel() call MUST not be called from
- * within this function!
- *
- *
- * @param cls closure
- * @param peer peer this update is about,
- *      NULL if this is the final last callback for a iteration operation
- * @param address address, NULL if this is the final callback for iteration op
- * @param state current state this peer is in
- * @param state_timeout timeout for the current state of the peer
- */
-typedef void
-(*GNUNET_TRANSPORT_PeerIterateCallback) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *peer,
-  const struct GNUNET_HELLO_Address *address,
-  enum GNUNET_TRANSPORT_PeerState state,
-  struct GNUNET_TIME_Absolute state_timeout);
-
-
-/**
- * Return information about a specific peer or all peers currently known to
- * transport service once or in monitoring mode. To obtain information about
- * a specific peer, a peer identity can be passed. To obtain information about
- * all peers currently known to transport service, NULL can be passed as peer
- * identity.
- *
- * For each peer, the callback is called with information about the address used
- * to communicate with this peer, the state this peer is currently in and the
- * the current timeout for this state.
- *
- * Upon completion, the #GNUNET_TRANSPORT_PeerIterateCallback is called one
- * more time with `NULL`. After this, the operation must no longer be
- * explicitly canceled.
- *
- * The #GNUNET_TRANSPORT_monitor_peers_cancel call MUST not be called in the
- * the peer_callback!
- *
- * @param cfg configuration to use
- * @param peer a specific peer identity to obtain information for,
- *      NULL for all peers
- * @param one_shot #GNUNET_YES to return the current state and then end (with
- * NULL+NULL), #GNUNET_NO to monitor peers continuously
- * @param peer_callback function to call with the results
- * @param peer_callback_cls closure for @a peer_callback
- */
-struct GNUNET_TRANSPORT_PeerMonitoringContext *
-GNUNET_TRANSPORT_monitor_peers (
-  const struct GNUNET_CONFIGURATION_Handle *cfg,
-  const struct GNUNET_PeerIdentity *peer,
-  int one_shot,
-  GNUNET_TRANSPORT_PeerIterateCallback peer_callback,
-  void *peer_callback_cls);
-
-
-/**
- * Cancel request to monitor peers
- *
- * @param pic handle for the request to cancel
- */
-void
-GNUNET_TRANSPORT_monitor_peers_cancel (
-  struct GNUNET_TRANSPORT_PeerMonitoringContext *pic);
-
-
-/* *********************** Blacklisting ************************ */
-
-/**
- * Handle for blacklisting peers.
- */
-struct GNUNET_TRANSPORT_Blacklist;
-
-
-/**
- * Function that decides if a connection is acceptable or not.
- *
- * @param cls closure
- * @param pid peer to approve or disapproave
- * @return #GNUNET_OK if the connection is allowed, #GNUNET_SYSERR if not
- */
-typedef int
-(*GNUNET_TRANSPORT_BlacklistCallback) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *pid);
-
-
-/**
- * Install a blacklist callback.  The service will be queried for all
- * existing connections as well as any fresh connections to check if
- * they are permitted.  If the blacklisting callback is unregistered,
- * all hosts that were denied in the past will automatically be
- * whitelisted again.  Cancelling the blacklist handle is also the
- * only way to re-enable connections from peers that were previously
- * blacklisted.
- *
- * @param cfg configuration to use
- * @param cb callback to invoke to check if connections are allowed
- * @param cb_cls closure for @a cb
- * @return NULL on error, otherwise handle for cancellation
- */
-struct GNUNET_TRANSPORT_Blacklist *
-GNUNET_TRANSPORT_blacklist (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                            GNUNET_TRANSPORT_BlacklistCallback cb,
-                            void *cb_cls);
-
-
-/**
- * Abort the blacklist.  Note that this function is the only way for
- * removing a peer from the blacklist.
- *
- * @param br handle of the request that is to be cancelled
- */
-void
-GNUNET_TRANSPORT_blacklist_cancel (struct GNUNET_TRANSPORT_Blacklist *br);
-
-
-/**
- * Handle for a plugin session state monitor.
- */
-struct GNUNET_TRANSPORT_PluginMonitor;
-
-/**
- * Abstract representation of a plugin's session.
- * Corresponds to the `struct GNUNET_ATS_Session` within the TRANSPORT service.
- */
-struct GNUNET_TRANSPORT_PluginSession;
-
-
-/**
- * Possible states of a session in a plugin.
- */
-enum GNUNET_TRANSPORT_SessionState
-{
-  /**
-   * The session was created (first call for each session object).
-   */
-  GNUNET_TRANSPORT_SS_INIT,
-
-  /**
-   * Initial session handshake is in progress.
-   */
-  GNUNET_TRANSPORT_SS_HANDSHAKE,
-
-  /**
-   * Session is fully UP.
-   */
-  GNUNET_TRANSPORT_SS_UP,
-
-  /**
-   * This is just an update about the session,
-   * the state did not change.
-   */
-  GNUNET_TRANSPORT_SS_UPDATE,
-
-  /**
-   * Session is being torn down and about to disappear.
-   * Last call for each session object.
-   */
-  GNUNET_TRANSPORT_SS_DONE
-};
-
-
-/**
- * Information about a plugin's session.
- */
-struct GNUNET_TRANSPORT_SessionInfo
-{
-  /**
-   * New state of the session.
-   */
-  enum GNUNET_TRANSPORT_SessionState state;
-
-  /**
-   * #GNUNET_YES if this is an inbound connection,
-   * #GNUNET_NO if this is an outbound connection,
-   * #GNUNET_SYSERR if connections of this plugin
-   *             are so fundamentally bidirectional
-   *             that they have no 'initiator'
-   */
-  int is_inbound;
-
-  /**
-   * Number of messages pending transmission for this session.
-   */
-  uint32_t num_msg_pending;
-
-  /**
-   * Number of bytes pending transmission for this session.
-   */
-  uint32_t num_bytes_pending;
-
-  /**
-   * Until when does this plugin refuse to receive to manage
-   * staying within the inbound quota?  ZERO if receive is
-   * active.
-   */
-  struct GNUNET_TIME_Absolute receive_delay;
-
-  /**
-   * At what time will this session timeout (unless activity
-   * happens)?
-   */
-  struct GNUNET_TIME_Absolute session_timeout;
-
-  /**
-   * Address used by the session.  Can be NULL if none is available.
-   */
-  const struct GNUNET_HELLO_Address *address;
-};
-
-
-/**
- * Function called by the plugin with information about the
- * current sessions managed by the plugin (for monitoring).
- *
- * @param cls closure
- * @param session session handle this information is about,
- *        NULL to indicate that we are "in sync" (initial
- *        iteration complete)
- * @param session_ctx storage location where the application
- *        can store data; will point to NULL on #GNUNET_TRANSPORT_SS_INIT,
- *        and must be reset to NULL on #GNUNET_TRANSPORT_SS_DONE
- * @param info information about the state of the session,
- *        NULL if @a session is also NULL and we are
- *        merely signalling that the initial iteration is over;
- *        NULL with @a session being non-NULL if the monitor
- *        was being cancelled while sessions were active
- */
-typedef void
-(*GNUNET_TRANSPORT_SessionMonitorCallback) (
-  void *cls,
-  struct GNUNET_TRANSPORT_PluginSession *session,
-  void **session_ctx,
-  const struct GNUNET_TRANSPORT_SessionInfo *info);
-
-
-/**
- * Install a plugin session state monitor callback.  The callback
- * will be notified whenever the session changes.
- *
- * @param cfg configuration to use
- * @param cb callback to invoke on events
- * @param cb_cls closure for @a cb
- * @return NULL on error, otherwise handle for cancellation
- */
-struct GNUNET_TRANSPORT_PluginMonitor *
-GNUNET_TRANSPORT_monitor_plugins (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                                  GNUNET_TRANSPORT_SessionMonitorCallback cb,
-                                  void *cb_cls);
-
-
-/**
- * Cancel monitoring the plugin session state.  The callback will be
- * called once for each session that is up with the "info" argument
- * being NULL (this is just to enable client-side cleanup).
- *
- * @param pm handle of the request that is to be cancelled
- */
-void
-GNUNET_TRANSPORT_monitor_plugins_cancel (
-  struct GNUNET_TRANSPORT_PluginMonitor *pm);
-
-
-/**
- * Opaque handle to the service.
- */
-struct GNUNET_TRANSPORT_CoreHandle;
-
-
-/**
- * Function called to notify transport users that another
- * peer connected to us.
- *
- * @param cls closure
- * @param peer the identity of the peer that connected; this
- *        pointer will remain valid until the disconnect, hence
- *        applications do not necessarily have to make a copy
- *        of the value if they only need it until disconnect
- * @param mq message queue to use to transmit to @a peer
- * @return closure to use in MQ handlers
- */
-typedef void *
-(*GNUNET_TRANSPORT_NotifyConnect) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *peer,
-  struct GNUNET_MQ_Handle *mq);
-
-
-/**
- * Function called to notify transport users that another peer
- * disconnected from us.  The message queue that was given to the
- * connect notification will be destroyed and must not be used
- * henceforth.
- *
- * @param cls closure from #GNUNET_TRANSPORT_core_connect
- * @param peer the peer that disconnected
- * @param handlers_cls closure of the handlers, was returned from the
- *                    connect notification callback
- */
-typedef void
-(*GNUNET_TRANSPORT_NotifyDisconnect) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *peer,
-  void *handler_cls);
-
-
-/**
- * Function called if we have "excess" bandwidth to a peer.
- * The notification will happen the first time we have excess
- * bandwidth, and then only again after the client has performed
- * some transmission to the peer.
- *
- * Excess bandwidth is defined as being allowed (by ATS) to send
- * more data, and us reaching the limit of the capacity build-up
- * (which, if we go past it, means we don't use available bandwidth).
- * See also the "max carry" in `struct GNUNET_BANDWIDTH_Tracker`.
- *
- * @param cls the closure
- * @param neighbour peer that we have excess bandwidth to
- * @param handlers_cls closure of the handlers, was returned from the
- *                    connect notification callback
- */
-typedef void
-(*GNUNET_TRANSPORT_NotifyExcessBandwidth) (
-  void *cls,
-  const struct GNUNET_PeerIdentity *neighbour,
-  void *handlers_cls);
-
-
-/**
- * Connect to the transport service.  Note that the connection may
- * complete (or fail) asynchronously.
- *
- * @param cfg configuration to use
- * @param self our own identity (API should check that it matches
- *             the identity found by transport), or NULL (no check)
- * @param handlers array of message handlers; note that the
- *                 closures provided will be ignored and replaced
- *                 with the respective return value from @a nc
- * @param handlers array with handlers to call when we receive messages, or NULL
- * @param cls closure for the @a nc, @a nd and @a neb callbacks
- * @param nc function to call on connect events, or NULL
- * @param nd function to call on disconnect events, or NULL
- * @param neb function to call if we have excess bandwidth to a peer, or NULL
- * @return NULL on error
- */
-struct GNUNET_TRANSPORT_CoreHandle *
-GNUNET_TRANSPORT_core_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                               const struct GNUNET_PeerIdentity *self,
-                               const struct GNUNET_MQ_MessageHandler *handlers,
-                               void *cls,
-                               GNUNET_TRANSPORT_NotifyConnect nc,
-                               GNUNET_TRANSPORT_NotifyDisconnect nd,
-                               GNUNET_TRANSPORT_NotifyExcessBandwidth neb);
-
-
-/**
- * Disconnect from the transport service.
- *
- * @param handle handle returned from connect
- */
-void
-GNUNET_TRANSPORT_core_disconnect (struct GNUNET_TRANSPORT_CoreHandle *handle);
-
-
-/**
- * Checks if a given peer is connected to us and get the message queue.
- *
- * @param handle connection to transport service
- * @param peer the peer to check
- * @return NULL if disconnected, otherwise message queue for @a peer
- */
-struct GNUNET_MQ_Handle *
-GNUNET_TRANSPORT_core_get_mq (struct GNUNET_TRANSPORT_CoreHandle *handle,
-                              const struct GNUNET_PeerIdentity *peer);
-
-
-#if 0 /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef GNUNET_TRANSPORT_SERVICE_H */
-#endif
-
-/** @} */ /* end of group */
-
-/* end of gnunet_transport_service.h */
diff --git a/src/include/gnunet_tun_lib.h b/src/include/gnunet_tun_lib.h
index 61880cea1..6c7d2cd42 100644
--- a/src/include/gnunet_tun_lib.h
+++ b/src/include/gnunet_tun_lib.h
@@ -18,7 +18,14 @@
      SPDX-License-Identifier: AGPL3.0-or-later
  */
 
+#if !defined (__GNUNET_UTIL_LIB_H_INSIDE__)
+#error "Only <gnunet_util_lib.h> can be included directly."
+#endif
+
 /**
+ * @addtogroup vpn_suite  VPN services and libraries
+ * @{
+ *
  * @author Philipp Toelke
  * @author Christian Grothoff
  *
@@ -34,9 +41,6 @@
 #ifndef GNUNET_TUN_LIB_H
 #define GNUNET_TUN_LIB_H
 
-#include "gnunet_common.h"
-#include "gnunet_crypto_lib.h"
-
 
 /* see http://www.iana.org/assignments/ethernet-numbers */
 #ifndef ETH_P_IPV4
@@ -546,6 +550,29 @@ struct GNUNET_TUN_DnsSrvRecord
 
 
 /**
+ * Payload of DNS URI record (header).
+ */
+struct GNUNET_TUN_DnsUriRecord
+{
+  /**
+   * Preference for this entry (lower value is higher preference).  Clients
+   * will contact hosts from the lowest-priority group first and fall back
+   * to higher priorities if the low-priority entries are unavailable. (NBO)
+   */
+  uint16_t prio GNUNET_PACKED;
+
+  /**
+   * Relative weight for records with the same priority.  Clients will use
+   * the hosts of the same (lowest) priority with a probability proportional
+   * to the weight given. (NBO)
+   */
+  uint16_t weight GNUNET_PACKED;
+
+  /* followed by 'target' name */
+};
+
+
+/**
  * Payload of DNS CERT record.
  */
 struct GNUNET_TUN_DnsCertRecord
@@ -946,3 +973,5 @@ GNUNET_TUN_compute_service_cadet_port (const struct GNUNET_HashCode *desc,
 #endif
 
 /** @} */ /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/gnunet_util_lib.h b/src/include/gnunet_util_lib.h
index cc4f3a01e..86a1204bb 100644
--- a/src/include/gnunet_util_lib.h
+++ b/src/include/gnunet_util_lib.h
@@ -30,6 +30,10 @@
 #ifndef GNUNET_UTIL_LIB_H
 #define GNUNET_UTIL_LIB_H
 
+#define __GNUNET_UTIL_LIB_H_INSIDE__
+
+#include <sys/socket.h>
+
 #ifdef __cplusplus
 extern "C"
 {
@@ -59,9 +63,10 @@ extern "C"
  * this service available to anyone but yourself.
  */
 #define GNUNET_AGPL_URL "https://git.gnunet.org/gnunet.git/tag/?h=v" \
-  PACKAGE_VERSION
-
+        GNUNET_VERSION
 
+#include "gnunet_config.h"
+#include "gnunet_common.h"
 #include "gnunet_crypto_lib.h"
 #include "gnunet_bandwidth_lib.h"
 #include "gnunet_bio_lib.h"
@@ -72,8 +77,8 @@ extern "C"
 #include "gnunet_helper_lib.h"
 #include "gnunet_mst_lib.h"
 #include "gnunet_mq_lib.h"
+#include "gnunet_nt_lib.h"
 #include "gnunet_nc_lib.h"
-#include "gnunet_op_lib.h"
 #include "gnunet_os_lib.h"
 #include "gnunet_peer_lib.h"
 #include "gnunet_plugin_lib.h"
@@ -86,6 +91,17 @@ extern "C"
 #include "gnunet_dnsstub_lib.h"
 #include "gnunet_dnsparser_lib.h"
 #include "gnunet_child_management_lib.h"
+#include "gnunet_error_codes.h"
+
+
+/**
+ * Stringify operator.
+ *
+ * @param a some expression to stringify. Must NOT be a macro.
+ * @return same expression as a constant string.
+ */
+#define GNUNET_S(a) #a
+
 
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
@@ -94,4 +110,6 @@ extern "C"
 }
 #endif
 
+#undef __GNUNET_UTIL_LIB_H_INSIDE__
+
 #endif
diff --git a/src/include/gnunet_vpn_service.h b/src/include/gnunet_vpn_service.h
index 31476e140..f0a04ae1b 100644
--- a/src/include/gnunet_vpn_service.h
+++ b/src/include/gnunet_vpn_service.h
@@ -19,6 +19,9 @@
  */
 
 /**
+ * @addtogroup vpn_suite  VPN services and libraries
+ * @{
+ *
  * @author Christian Grothoff
  *
  * @file
@@ -31,6 +34,7 @@
 #ifndef GNUNET_VPN_SERVICE_H
 #define GNUNET_VPN_SERVICE_H
 
+
 #include "gnunet_util_lib.h"
 
 
@@ -159,3 +163,5 @@ GNUNET_VPN_disconnect (struct GNUNET_VPN_Handle *vh);
 #endif
 
 /** @} */  /* end of group */
+
+/** @} */ /* end of group addition */
diff --git a/src/include/meson.build b/src/include/meson.build
new file mode 100644
index 000000000..51a8009af
--- /dev/null
+++ b/src/include/meson.build
@@ -0,0 +1,122 @@
+configure_file(
+  input : 'gnunet_config.h.in',
+  output : 'gnunet_config.h',
+  configuration : cdata,
+  install: true,
+  install_dir: get_option('includedir')/'gnunet'
+)
+
+install_headers(
+  'gettext.h',
+  'compat.h',
+  'gnunet_abd_service.h',
+  'gnunet_applications.h',
+  'gnunet_arm_service.h',
+  'gnunet_bandwidth_lib.h',
+  'gnunet_bio_lib.h',
+  'gnunet_dht_block_types.h',
+  'gnunet_block_lib.h',
+  'gnunet_block_group_lib.h',
+  'gnunet_block_plugin.h',
+  'gnunet_buffer_lib.h',
+  'gnunet_child_management_lib.h',
+  'gnunet_client_lib.h',
+  'gnunet_common.h',
+  'gnunet_constants.h',
+  'gnunet_configuration_lib.h',
+  'gnunet_consensus_service.h',
+  'gnunet_container_lib.h',
+  'gnunet_conversation_service.h',
+  'gnunet_core_service.h',
+  'gnunet_crypto_lib.h',
+  'gnunet_curl_lib.h',
+  'gnunet_datacache_lib.h',
+  'gnunet_datacache_plugin.h',
+  'gnunet_datastore_service.h',
+  'gnunet_datastore_plugin.h',
+  'gnunet_db_lib.h',
+  'gnunet_dht_service.h',
+  'gnunet_dhtu_plugin.h',
+  'gnunet_disk_lib.h',
+  'gnunet_dnsparser_lib.h',
+  'gnunet_dnsstub_lib.h',
+  'gnunet_dns_service.h',
+  'gnunet_error_codes.h',
+  'gnunet_fs_service.h',
+  'gnunet_getopt_lib.h',
+  'gnunet_gns_service.h',
+  'gnunet_gnsrecord_lib.h',
+  'gnunet_gnsrecord_json_lib.h',
+  'gnunet_gnsrecord_plugin.h',
+  'gnu_name_system_protocols.h',
+  'gnu_name_system_service_ports.h',
+  'gnu_name_system_record_types.h',
+  'gnunet_hello_uri_lib.h',
+  'gnunet_helper_lib.h',
+  'gnunet_identity_service.h',
+  'gnunet_reclaim_lib.h',
+  'gnunet_reclaim_plugin.h',
+  'gnunet_reclaim_service.h',
+  'gnunet_json_lib.h',
+  'gnunet_load_lib.h',
+  'gnunet_cadet_service.h',
+  'gnunet_messenger_service.h',
+  'gnunet_mhd_compat.h',
+  'gnunet_microphone_lib.h',
+  'gnunet_mst_lib.h',
+  'gnunet_mq_lib.h',
+  'gnunet_namecache_plugin.h',
+  'gnunet_namecache_service.h',
+  'gnunet_namestore_plugin.h',
+  'gnunet_namestore_service.h',
+  'gnunet_nat_auto_service.h',
+  'gnunet_nat_service.h',
+  'gnunet_nc_lib.h',
+  'gnunet_network_lib.h',
+  'gnunet_nse_service.h',
+  'gnunet_nt_lib.h',
+  'gnunet_op_lib.h',
+  'gnunet_os_lib.h',
+  'gnunet_peer_lib.h',
+  'gnunet_peerstore_plugin.h',
+  'gnunet_peerstore_service.h',
+  'gnunet_plugin_lib.h',
+  'gnunet_pq_lib.h',
+  'gnunet_program_lib.h',
+  'gnunet_protocols.h',
+  'gnunet_resolver_service.h',
+  'gnunet_regex_service.h',
+  'gnunet_rest_lib.h',
+  'gnunet_rest_plugin.h',
+  'gnunet_rps_service.h',
+  'gnunet_revocation_service.h',
+  'gnunet_scalarproduct_service.h',
+  'gnunet_scheduler_lib.h',
+  'gnunet_secretsharing_service.h',
+  'gnunet_service_lib.h',
+  'gnunet_set_service.h',
+  'gnunet_seti_service.h',
+  'gnunet_setu_service.h',
+  'gnunet_signal_lib.h',
+  'gnunet_signatures.h',
+  'gnunet_socks.h',
+  'gnunet_speaker_lib.h',
+  'gnunet_sq_lib.h',
+  'gnunet_statistics_service.h',
+  'gnunet_strings_lib.h',
+  'gnunet_testing_lib.h',
+  'gnunet_testing_arm_lib.h',
+  'gnunet_testing_core_lib.h',
+  'gnunet_testing_testbed_lib.h',
+  'gnunet_testing_transport_lib.h',
+  'gnunet_time_lib.h',
+  'gnunet_transport_application_service.h',
+  'gnunet_transport_communication_service.h',
+  'gnunet_transport_core_service.h',
+  'gnunet_transport_monitor_service.h',
+  'gnunet_tun_lib.h',
+  'gnunet_uri_lib.h',
+  'gnunet_util_lib.h',
+  'gnunet_vpn_service.h',
+  install_dir: get_option('includedir')/'gnunet'
+  )
diff --git a/src/include/platform.h b/src/include/platform.h
index e44f9f51a..c04d8d487 100644
--- a/src/include/platform.h
+++ b/src/include/platform.h
@@ -34,7 +34,7 @@
 #ifndef HAVE_USED_CONFIG_H
 #define HAVE_USED_CONFIG_H
 #if HAVE_CONFIG_H
-#include "gnunet_config.h"
+#include "gnunet_private_config.h"
 #endif
 #endif
 
@@ -44,6 +44,7 @@
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
+#include <inttypes.h>
 
 #ifdef __clang__
 #undef HAVE_STATIC_ASSERT
@@ -272,6 +273,10 @@ atoll (const char *nptr);
 #define EXIT_NOTRUNNING 7
 #endif
 
+#ifndef EXIT_NO_RESTART
+#define EXIT_NO_RESTART 9
+#endif
+
 /**
  * clang et al do not have such an attribute
  */