245 files changed, 91708 insertions, 0 deletions

diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
new file mode 100644
index 000000000..89a34b299
--- /dev/null
+++ b/src/lib/Makefile.am
@@ -0,0 +1,14 @@
+if HAVE_POSTGRESQL
+ POSTGRES_DIR = pq
+endif
+
+SUBDIRS = \
+        util \
+        curl \
+        json \
+        sq \
+        $(POSTGRES_DIR) \
+        hello \
+        block \
+        gnsrecord \
+        testing
diff --git a/src/lib/block/Makefile.am b/src/lib/block/Makefile.am
new file mode 100644
index 000000000..f9a5a0347
--- /dev/null
+++ b/src/lib/block/Makefile.am
@@ -0,0 +1,31 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage
+endif
+
+lib_LTLIBRARIES = \
+  libgnunetblock.la \
+  libgnunetblockgroup.la
+
+libgnunetblock_la_SOURCES = \
+  block.c
+libgnunetblock_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunetblock_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  $(GN_LIBINTL) \
+  -version-info 0:0:0
+
+libgnunetblockgroup_la_SOURCES = \
+  bg_bf.c
+libgnunetblockgroup_la_LIBADD = \
+  libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunetblockgroup_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  $(GN_LIBINTL) \
+  -version-info 0:0:0
diff --git a/src/lib/block/bg_bf.c b/src/lib/block/bg_bf.c
new file mode 100644
index 000000000..c8269498e
--- /dev/null
+++ b/src/lib/block/bg_bf.c
@@ -0,0 +1,286 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file block/bg_bf.c
+ * @brief implementation of a block group using a Bloom filter
+ *        to drop duplicate blocks
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_block_group_lib.h"
+#include "gnunet_block_plugin.h"
+
+
+/**
+ * Internal data structure for a block group.
+ */
+struct BfGroupInternals
+{
+  /**
+   * A Bloom filter to weed out duplicate replies probabilistically.
+   */
+  struct GNUNET_CONTAINER_BloomFilter *bf;
+
+  /**
+   * Set from the nonce to mingle the hashes before going into the @e bf.
+   */
+  uint32_t bf_mutator;
+
+  /**
+   * Size of @a bf.
+   */
+  uint32_t bf_size;
+};
+
+
+/**
+ * Serialize state of a block group.
+ *
+ * @param bg group to serialize
+ * @param[out] raw_data set to the serialized state
+ * @param[out] raw_data_size set to the number of bytes in @a raw_data
+ * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
+ *         supported, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+bf_group_serialize_cb (struct GNUNET_BLOCK_Group *bg,
+                       void **raw_data,
+                       size_t *raw_data_size)
+{
+  struct BfGroupInternals *gi = bg->internal_cls;
+  void *raw;
+
+  raw = GNUNET_malloc (gi->bf_size + sizeof (uint32_t));
+  if (GNUNET_OK !=
+      GNUNET_CONTAINER_bloomfilter_get_raw_data (gi->bf,
+                                                 raw + sizeof (uint32_t),
+                                                 gi->bf_size))
+  {
+    GNUNET_free (raw);
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  memcpy (raw,
+          &gi->bf_mutator,
+          sizeof (uint32_t));
+  *raw_data = raw;
+  *raw_data_size = gi->bf_size + sizeof (uint32_t);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Mark elements as "seen" using a hash of the element. Not supported
+ * by all block plugins.
+ *
+ * @param bg group to update
+ * @param seen_results results already seen
+ * @param seen_results_count number of entries in @a seen_results
+ */
+static void
+bf_group_mark_seen_cb (struct GNUNET_BLOCK_Group *bg,
+                       const struct GNUNET_HashCode *seen_results,
+                       unsigned int seen_results_count)
+{
+  struct BfGroupInternals *gi = bg->internal_cls;
+
+  for (unsigned int i = 0; i < seen_results_count; i++)
+  {
+    struct GNUNET_HashCode mhash;
+
+    GNUNET_BLOCK_mingle_hash (&seen_results[i],
+                              gi->bf_mutator,
+                              &mhash);
+    GNUNET_CONTAINER_bloomfilter_add (gi->bf,
+                                      &mhash);
+  }
+}
+
+
+/**
+ * Merge two groups, if possible. Not supported by all block plugins,
+ * can also fail if the nonces were different.
+ *
+ * @param bg1 group to update
+ * @param bg2 group to merge into @a bg1
+ * @return #GNUNET_OK on success, #GNUNET_NO if the nonces were different and thus
+ *         we failed.
+ */
+static enum GNUNET_GenericReturnValue
+bf_group_merge_cb (struct GNUNET_BLOCK_Group *bg1,
+                   const struct GNUNET_BLOCK_Group *bg2)
+{
+  struct BfGroupInternals *gi1 = bg1->internal_cls;
+  struct BfGroupInternals *gi2 = bg2->internal_cls;
+
+  if (gi1->bf_mutator != gi2->bf_mutator)
+    return GNUNET_NO;
+  if (gi1->bf_size != gi2->bf_size)
+    return GNUNET_NO;
+  GNUNET_CONTAINER_bloomfilter_or2 (gi1->bf,
+                                    gi2->bf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Destroy resources used by a block group.
+ *
+ * @param bg group to destroy, NULL is allowed
+ */
+static void
+bf_group_destroy_cb (struct GNUNET_BLOCK_Group *bg)
+{
+  struct BfGroupInternals *gi = bg->internal_cls;
+
+  GNUNET_CONTAINER_bloomfilter_free (gi->bf);
+  GNUNET_free (gi);
+  GNUNET_free (bg);
+}
+
+
+/**
+ * Create a new block group that filters duplicates using a Bloom filter.
+ *
+ * @param ctx block context in which the block group is created
+ * @param bf_size size of the Bloom filter
+ * @param bf_k K-value for the Bloom filter
+ * @param type block type
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+struct GNUNET_BLOCK_Group *
+GNUNET_BLOCK_GROUP_bf_create (void *cls,
+                              size_t bf_size,
+                              unsigned int bf_k,
+                              enum GNUNET_BLOCK_Type type,
+                              const void *raw_data,
+                              size_t raw_data_size)
+{
+  struct BfGroupInternals *gi;
+  struct GNUNET_BLOCK_Group *bg;
+  uint32_t nonce;
+
+  if ( (NULL != raw_data) &&
+       (raw_data_size < sizeof (nonce)) )
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (NULL != raw_data)
+  {
+    memcpy (&nonce,
+            raw_data,
+            sizeof (nonce));
+    raw_data += sizeof (nonce);
+    raw_data_size -= sizeof (nonce);
+  }
+  else
+  {
+    nonce = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                      UINT32_MAX);
+  }
+  gi = GNUNET_new (struct BfGroupInternals);
+  gi->bf = GNUNET_CONTAINER_bloomfilter_init ((bf_size != raw_data_size) ?
+                                              NULL : raw_data,
+                                              bf_size,
+                                              bf_k);
+  gi->bf_mutator = nonce;
+  gi->bf_size = bf_size;
+  bg = GNUNET_new (struct GNUNET_BLOCK_Group);
+  bg->type = type;
+  bg->serialize_cb = &bf_group_serialize_cb;
+  bg->mark_seen_cb = &bf_group_mark_seen_cb;
+  bg->merge_cb = &bf_group_merge_cb;
+  bg->destroy_cb = &bf_group_destroy_cb;
+  bg->internal_cls = gi;
+  return bg;
+}
+
+
+/**
+ * Test if @a hc is contained in the Bloom filter of @a bg.  If so,
+ * return #GNUNET_YES.  If not, add @a hc to the Bloom filter and
+ * return #GNUNET_NO.
+ *
+ * @param bg block group to use for testing
+ * @param hc hash of element to evaluate
+ * @return #GNUNET_YES if @a hc is (likely) a duplicate
+ *         #GNUNET_NO if @a hc was definitively not in @a bg (but now is)
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_GROUP_bf_test_and_set (struct GNUNET_BLOCK_Group *bg,
+                                    const struct GNUNET_HashCode *hc)
+{
+  struct BfGroupInternals *gi;
+  struct GNUNET_HashCode mhash;
+
+  if (NULL == bg)
+    return GNUNET_NO;
+  gi = bg->internal_cls;
+  GNUNET_BLOCK_mingle_hash (hc,
+                            gi->bf_mutator,
+                            &mhash);
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_bloomfilter_test (gi->bf,
+                                         &mhash))
+    return GNUNET_YES;
+  GNUNET_CONTAINER_bloomfilter_add (gi->bf,
+                                    &mhash);
+  return GNUNET_NO;
+}
+
+
+/**
+ * How many bytes should a bloomfilter be if we have already seen
+ * entry_count responses?  Sized so that do not have to
+ * re-size the filter too often (to keep it cheap).
+ *
+ * Since other peers will also add entries but not resize the filter,
+ * we should generally pick a slightly larger size than what the
+ * strict math would suggest.
+ *
+ * @param entry_count expected number of entries in the Bloom filter
+ * @param k number of bits set per entry
+ * @return must be a power of two and smaller or equal to 2^15.
+ */
+size_t
+GNUNET_BLOCK_GROUP_compute_bloomfilter_size (unsigned int entry_count,
+                                             unsigned int k)
+{
+  size_t size;
+  unsigned int ideal = (entry_count * k) / 4;
+  uint16_t max = 1 << 15;
+
+  if (entry_count > max)
+    return max;
+  size = 8;
+  while ((size < max) && (size < ideal))
+    size *= 2;
+  if (size > max)
+    return max;
+  return size;
+}
+
+
+/* end of bg_bf.c */
diff --git a/src/lib/block/block.c b/src/lib/block/block.c
new file mode 100644
index 000000000..9edc7ce5e
--- /dev/null
+++ b/src/lib/block/block.c
@@ -0,0 +1,378 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2017, 2021, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file block/block.c
+ * @brief library for data block manipulation
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_signatures.h"
+#include "gnunet_block_lib.h"
+#include "gnunet_block_plugin.h"
+
+
+/**
+ * Handle for a plugin.
+ */
+struct Plugin
+{
+  /**
+   * Name of the shared library.
+   */
+  char *library_name;
+
+  /**
+   * Plugin API.
+   */
+  struct GNUNET_BLOCK_PluginFunctions *api;
+};
+
+
+/**
+ * Handle to an initialized block library.
+ */
+struct GNUNET_BLOCK_Context
+{
+  /**
+   * Array of our plugins.
+   */
+  struct Plugin **plugins;
+
+  /**
+   * Size of the 'plugins' array.
+   */
+  unsigned int num_plugins;
+
+  /**
+   * Our configuration.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+
+/**
+ * Serialization to use in #GNUNET_BLOCK_mingle_hash.
+ */
+struct MinglePacker
+{
+  /**
+   * Original hash.
+   */
+  struct GNUNET_HashCode in;
+
+  /**
+   * Mingle value.
+   */
+  uint32_t mingle GNUNET_PACKED;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+void
+GNUNET_BLOCK_mingle_hash (const struct GNUNET_HashCode *in,
+                          uint32_t mingle_number,
+                          struct GNUNET_HashCode *hc)
+{
+  struct MinglePacker mp = {
+    .in = *in,
+    .mingle = mingle_number
+  };
+
+  GNUNET_CRYPTO_hash (&mp,
+                      sizeof(mp),
+                      hc);
+}
+
+
+/**
+ * Add a plugin to the list managed by the block library.
+ *
+ * @param cls the block context
+ * @param library_name name of the plugin
+ * @param lib_ret the plugin API
+ */
+static void
+add_plugin (void *cls,
+            const char *library_name,
+            void *lib_ret)
+{
+  struct GNUNET_BLOCK_Context *ctx = cls;
+  struct GNUNET_BLOCK_PluginFunctions *api = lib_ret;
+  struct Plugin *plugin;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Loading block plugin `%s'\n",
+              library_name);
+  plugin = GNUNET_new (struct Plugin);
+  plugin->api = api;
+  plugin->library_name = GNUNET_strdup (library_name);
+  GNUNET_array_append (ctx->plugins,
+                       ctx->num_plugins,
+                       plugin);
+}
+
+
+struct GNUNET_BLOCK_Context *
+GNUNET_BLOCK_context_create (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_BLOCK_Context *ctx;
+
+  ctx = GNUNET_new (struct GNUNET_BLOCK_Context);
+  ctx->cfg = cfg;
+  GNUNET_PLUGIN_load_all_in_context (GNUNET_OS_project_data_default (),
+                                     "libgnunet_plugin_block_",
+                                     (void *) cfg,
+                                     &add_plugin,
+                                     ctx);
+  return ctx;
+}
+
+
+void
+GNUNET_BLOCK_context_destroy (struct GNUNET_BLOCK_Context *ctx)
+{
+  struct Plugin *plugin;
+
+  for (unsigned int i = 0; i < ctx->num_plugins; i++)
+  {
+    plugin = ctx->plugins[i];
+    GNUNET_break (NULL ==
+                  GNUNET_PLUGIN_unload (plugin->library_name,
+                                        plugin->api));
+    GNUNET_free (plugin->library_name);
+    GNUNET_free (plugin);
+  }
+  GNUNET_free (ctx->plugins);
+  GNUNET_free (ctx);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_group_serialize (struct GNUNET_BLOCK_Group *bg,
+                              void **raw_data,
+                              size_t *raw_data_size)
+{
+  *raw_data = NULL;
+  *raw_data_size = 0;
+  if (NULL == bg)
+    return GNUNET_NO;
+  if (NULL == bg->serialize_cb)
+    return GNUNET_NO;
+  return bg->serialize_cb (bg,
+                           raw_data,
+                           raw_data_size);
+}
+
+
+void
+GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg)
+{
+  if (NULL == bg)
+    return;
+  bg->destroy_cb (bg);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_group_merge (struct GNUNET_BLOCK_Group *bg1,
+                          struct GNUNET_BLOCK_Group *bg2)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  if (NULL == bg2)
+    return GNUNET_OK;
+  if (NULL == bg1)
+  {
+    bg2->destroy_cb (bg2);
+    return GNUNET_OK;
+  }
+  if (NULL == bg1->merge_cb)
+    return GNUNET_SYSERR;
+  GNUNET_assert (bg1->merge_cb == bg1->merge_cb);
+  ret = bg1->merge_cb (bg1,
+                       bg2);
+  bg2->destroy_cb (bg2);
+  return ret;
+}
+
+
+/**
+ * Find a plugin for the given type.
+ *
+ * @param ctx context to search
+ * @param type type to look for
+ * @return NULL if no matching plugin exists
+ */
+static struct GNUNET_BLOCK_PluginFunctions *
+find_plugin (struct GNUNET_BLOCK_Context *ctx,
+             enum GNUNET_BLOCK_Type type)
+{
+  for (unsigned i = 0; i < ctx->num_plugins; i++)
+  {
+    struct Plugin *plugin = ctx->plugins[i];
+
+    for (unsigned int j = 0; 0 != plugin->api->types[j]; j++)
+      if (type == plugin->api->types[j])
+        return plugin->api;
+  }
+  return NULL;
+}
+
+
+struct GNUNET_BLOCK_Group *
+GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *raw_data,
+                           size_t raw_data_size,
+                           ...)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin;
+  struct GNUNET_BLOCK_Group *bg;
+  va_list ap;
+
+  plugin = find_plugin (ctx,
+                        type);
+  if (NULL == plugin)
+    return NULL;
+  if (NULL == plugin->create_group)
+    return NULL;
+  va_start (ap,
+            raw_data_size);
+  bg = plugin->create_group (plugin->cls,
+                             type,
+                             raw_data,
+                             raw_data_size,
+                             ap);
+  va_end (ap);
+  return bg;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
+                      enum GNUNET_BLOCK_Type type,
+                      const void *block,
+                      size_t block_size,
+                      struct GNUNET_HashCode *key)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
+  return plugin->get_key (plugin->cls,
+                          type,
+                          block,
+                          block_size,
+                          key);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin;
+
+  if (GNUNET_BLOCK_TYPE_ANY == type)
+    return GNUNET_SYSERR; /* no checks */
+  plugin = find_plugin (ctx,
+                        type);
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
+  return plugin->check_query (plugin->cls,
+                              type,
+                              query,
+                              xquery,
+                              xquery_size);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const void *block,
+                          size_t block_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
+  return plugin->check_block (plugin->cls,
+                              type,
+                              block,
+                              block_size);
+}
+
+
+enum GNUNET_BLOCK_ReplyEvaluationResult
+GNUNET_BLOCK_check_reply (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          struct GNUNET_BLOCK_Group *group,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size,
+                          const void *reply_block,
+                          size_t reply_block_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  return plugin->check_reply (plugin->cls,
+                              type,
+                              group,
+                              query,
+                              xquery,
+                              xquery_size,
+                              reply_block,
+                              reply_block_size);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
+                             const struct GNUNET_HashCode *seen_results,
+                             unsigned int seen_results_count)
+{
+  if (NULL == bg)
+    return GNUNET_OK;
+  if (NULL == bg->mark_seen_cb)
+    return GNUNET_SYSERR;
+  bg->mark_seen_cb (bg,
+                    seen_results,
+                    seen_results_count);
+  return GNUNET_OK;
+}
+
+
+/* end of block.c */
diff --git a/src/lib/block/meson.build b/src/lib/block/meson.build
new file mode 100644
index 000000000..999391c27
--- /dev/null
+++ b/src/lib/block/meson.build
@@ -0,0 +1,24 @@
+libgnunetblock_src = ['block.c']
+libgnunetblockgroup_src = ['bg_bf.c']
+
+libgnunetblock = library('gnunetblock',
+        libgnunetblock_src,
+        dependencies: libgnunetutil_dep,
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        version: '0.0.0',
+        soversion: '0',
+        install_dir: get_option('libdir'))
+libgnunetblock_dep = declare_dependency(link_with : libgnunetblock)
+pkg.generate(libgnunetblock, url: 'https://www.gnunet.org',
+             description : 'Library for data block manipulation')
+
+libgnunetblockgroup = library('gnunetblockgroup',
+        libgnunetblockgroup_src,
+        dependencies: [libgnunetutil_dep, libgnunetblock_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        version: '0.0.0',
+        soversion: '0',
+        install_dir: get_option('libdir'))
+libgnunetblockgroup_dep = declare_dependency(link_with : libgnunetblockgroup)
diff --git a/src/lib/curl/Makefile.am b/src/lib/curl/Makefile.am
new file mode 100644
index 000000000..78eae4b97
--- /dev/null
+++ b/src/lib/curl/Makefile.am
@@ -0,0 +1,38 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+lib_LTLIBRARIES = \
+  libgnunetcurl.la
+
+libgnunetcurl_la_LDFLAGS = \
+  $(GN_LIBINTL) \
+  -version-info 0:0:0 \
+  -no-undefined
+libgnunetcurl_la_SOURCES = \
+  curl.c \
+  curl_reschedule.c
+libgnunetcurl_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  -ljansson \
+  @LIBCURL@ \
+  $(XLIB)
+libgnunetcurl_la_CPPFLAGS = \
+ @LIBCURL_CPPFLAGS@ $(AM_CPPFLAGS) $(MHD_CFLAGS)
+
+#check_PROGRAMS = \
+#  test_curl
+
+#TESTS = \
+#  $(check_PROGRAMS)
+
+#test_curl_SOURCES = \
+#  test_curl.c
+#test_curl_LDADD = \
+#  libgnunetcurl.la \
+#  $(top_builddir)/src/lib/util/libgnunetutil.la \
+#  -ljansson -lcurl
diff --git a/src/lib/curl/curl.c b/src/lib/curl/curl.c
new file mode 100644
index 000000000..648c9a14e
--- /dev/null
+++ b/src/lib/curl/curl.c
@@ -0,0 +1,907 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2016, 2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file curl/curl.c
+ * @brief API for downloading JSON via CURL
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include <jansson.h>
+#include <microhttpd.h>
+#include "gnunet_curl_lib.h"
+
+#if ENABLE_BENCHMARK
+#include "../util/benchmark.h"
+#endif
+
+/**
+ * Set to 1 for extra debug logging.
+ */
+#define DEBUG 0
+
+/**
+ * Log error related to CURL operations.
+ *
+ * @param type log level
+ * @param function which function failed to run
+ * @param code what was the curl error code
+ */
+#define CURL_STRERROR(type, function, code)                                \
+  GNUNET_log (type,                                                        \
+              "Curl function `%s' has failed at `%s:%d' with error: %s\n", \
+              function,                                                    \
+              __FILE__,                                                    \
+              __LINE__,                                                    \
+              curl_easy_strerror (code));
+
+/**
+ * Print JSON parsing related error information
+ */
+#define JSON_WARN(error)                                 \
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,                 \
+              "JSON parsing failed at %s:%u: %s (%s)\n", \
+              __FILE__,                                  \
+              __LINE__,                                  \
+              error.text,                                \
+              error.source)
+
+
+/**
+ * Failsafe flag. Raised if our constructor fails to initialize
+ * the Curl library.
+ */
+static int curl_fail;
+
+/**
+ * Jobs are CURL requests running within a `struct GNUNET_CURL_Context`.
+ */
+struct GNUNET_CURL_Job
+{
+  /**
+   * We keep jobs in a DLL.
+   */
+  struct GNUNET_CURL_Job *next;
+
+  /**
+   * We keep jobs in a DLL.
+   */
+  struct GNUNET_CURL_Job *prev;
+
+  /**
+   * Easy handle of the job.
+   */
+  CURL *easy_handle;
+
+  /**
+   * Context this job runs in.
+   */
+  struct GNUNET_CURL_Context *ctx;
+
+  /**
+   * Function to call upon completion.
+   */
+  GNUNET_CURL_JobCompletionCallback jcc;
+
+  /**
+   * Closure for @e jcc.
+   */
+  void *jcc_cls;
+
+  /**
+   * Function to call upon completion.
+   */
+  GNUNET_CURL_RawJobCompletionCallback jcc_raw;
+
+  /**
+   * Closure for @e jcc_raw.
+   */
+  void *jcc_raw_cls;
+
+  /**
+   * Buffer for response received from CURL.
+   */
+  struct GNUNET_CURL_DownloadBuffer db;
+
+  /**
+   * Headers used for this job, the list needs to be freed
+   * after the job has finished.
+   */
+  struct curl_slist *job_headers;
+
+  /**
+   * When did we start the job?
+   */
+  struct GNUNET_TIME_Absolute start_time;
+};
+
+
+/**
+ * Context
+ */
+struct GNUNET_CURL_Context
+{
+  /**
+   * Curl multi handle
+   */
+  CURLM *multi;
+
+  /**
+   * Curl share handle
+   */
+  CURLSH *share;
+
+  /**
+   * We keep jobs in a DLL.
+   */
+  struct GNUNET_CURL_Job *jobs_head;
+
+  /**
+   * We keep jobs in a DLL.
+   */
+  struct GNUNET_CURL_Job *jobs_tail;
+
+  /**
+   * Headers common for all requests in the context.
+   */
+  struct curl_slist *common_headers;
+
+  /**
+   * If non-NULL, the async scope ID is sent in a request
+   * header of this name.
+   */
+  const char *async_scope_id_header;
+
+  /**
+   * Function we need to call whenever the event loop's
+   * socket set changed.
+   */
+  GNUNET_CURL_RescheduleCallback cb;
+
+  /**
+   * Closure for @e cb.
+   */
+  void *cb_cls;
+
+  /**
+   * USERNAME:PASSWORD to use for client-authentication
+   * with all requests of this context, or NULL.
+   */
+  char *userpass;
+
+  /**
+   * Type of the TLS client certificate used, or NULL.
+   */
+  char *certtype;
+
+  /**
+   * File with the TLS client certificate, or NULL.
+   */
+  char *certfile;
+
+  /**
+   * File with the private key to authenticate the
+   * TLS client, or NULL.
+   */
+  char *keyfile;
+
+  /**
+   * Passphrase to decrypt @e keyfile, or NULL.
+   */
+  char *keypass;
+
+};
+
+
+void
+GNUNET_CURL_set_userpass (struct GNUNET_CURL_Context *ctx,
+                          const char *userpass)
+{
+  GNUNET_free (ctx->userpass);
+  if (NULL != userpass)
+    ctx->userpass = GNUNET_strdup (userpass);
+}
+
+
+void
+GNUNET_CURL_set_tlscert (struct GNUNET_CURL_Context *ctx,
+                         const char *certtype,
+                         const char *certfile,
+                         const char *keyfile,
+                         const char *keypass)
+{
+  GNUNET_free (ctx->certtype);
+  GNUNET_free (ctx->certfile);
+  GNUNET_free (ctx->keyfile);
+  GNUNET_free (ctx->keypass);
+  if (NULL != certtype)
+    ctx->certtype = GNUNET_strdup (certtype);
+  if (NULL != certfile)
+    ctx->certfile = GNUNET_strdup (certfile);
+  if (NULL != keyfile)
+    ctx->certtype = GNUNET_strdup (keyfile);
+  if (NULL != keypass)
+    ctx->certtype = GNUNET_strdup (keypass);
+}
+
+
+struct GNUNET_CURL_Context *
+GNUNET_CURL_init (GNUNET_CURL_RescheduleCallback cb,
+                  void *cb_cls)
+{
+  struct GNUNET_CURL_Context *ctx;
+  CURLM *multi;
+  CURLSH *share;
+
+  if (curl_fail)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Curl was not initialised properly\n");
+    return NULL;
+  }
+  if (NULL == (multi = curl_multi_init ()))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to create a Curl multi handle\n");
+    return NULL;
+  }
+  if (NULL == (share = curl_share_init ()))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to create a Curl share handle\n");
+    return NULL;
+  }
+  ctx = GNUNET_new (struct GNUNET_CURL_Context);
+  ctx->cb = cb;
+  ctx->cb_cls = cb_cls;
+  ctx->multi = multi;
+  ctx->share = share;
+  return ctx;
+}
+
+
+void
+GNUNET_CURL_enable_async_scope_header (struct GNUNET_CURL_Context *ctx,
+                                       const char *header_name)
+{
+  ctx->async_scope_id_header = header_name;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CURL_is_valid_scope_id (const char *scope_id)
+{
+  if (strlen (scope_id) >= 64)
+    return GNUNET_NO;
+  for (size_t i = 0; i < strlen (scope_id); i++)
+    if (! (isalnum (scope_id[i]) || (scope_id[i] == '-')))
+      return GNUNET_NO;
+  return GNUNET_YES;
+}
+
+
+/**
+ * Callback used when downloading the reply to an HTTP request.
+ * Just appends all of the data to the `buf` in the
+ * `struct DownloadBuffer` for further processing. The size of
+ * the download is limited to #GNUNET_MAX_MALLOC_CHECKED, if
+ * the download exceeds this size, we abort with an error.
+ *
+ * @param bufptr data downloaded via HTTP
+ * @param size size of an item in @a bufptr
+ * @param nitems number of items in @a bufptr
+ * @param cls the `struct DownloadBuffer`
+ * @return number of bytes processed from @a bufptr
+ */
+static size_t
+download_cb (char *bufptr,
+             size_t size,
+             size_t nitems,
+             void *cls)
+{
+  struct GNUNET_CURL_DownloadBuffer *db = cls;
+  size_t msize;
+  void *buf;
+
+  if (0 == size * nitems)
+  {
+    /* Nothing (left) to do */
+    return 0;
+  }
+  msize = size * nitems;
+  if ((msize + db->buf_size) >= GNUNET_MAX_MALLOC_CHECKED)
+  {
+    db->eno = ENOMEM;
+    return 0;   /* signals an error to curl */
+  }
+  db->buf = GNUNET_realloc (db->buf,
+                            db->buf_size + msize);
+  buf = db->buf + db->buf_size;
+  GNUNET_memcpy (buf, bufptr, msize);
+  db->buf_size += msize;
+  return msize;
+}
+
+
+/**
+ * Create the HTTP headers for the request
+ *
+ * @param ctx context we run in
+ * @param job_headers job-specific headers
+ * @return all headers to use
+ */
+static struct curl_slist *
+setup_job_headers (struct GNUNET_CURL_Context *ctx,
+                   const struct curl_slist *job_headers)
+{
+  struct curl_slist *all_headers = NULL;
+
+  for (const struct curl_slist *curr = job_headers;
+       NULL != curr;
+       curr = curr->next)
+  {
+    GNUNET_assert (NULL !=
+                   (all_headers = curl_slist_append (all_headers,
+                                                     curr->data)));
+  }
+
+  for (const struct curl_slist *curr = ctx->common_headers;
+       NULL != curr;
+       curr = curr->next)
+  {
+    GNUNET_assert (NULL !=
+                   (all_headers = curl_slist_append (all_headers,
+                                                     curr->data)));
+  }
+
+  if (NULL != ctx->async_scope_id_header)
+  {
+    struct GNUNET_AsyncScopeSave scope;
+
+    GNUNET_async_scope_get (&scope);
+    if (GNUNET_YES == scope.have_scope)
+    {
+      char *aid_header;
+
+      aid_header =
+        GNUNET_STRINGS_data_to_string_alloc (
+          &scope.scope_id,
+          sizeof(struct GNUNET_AsyncScopeId));
+      GNUNET_assert (NULL != aid_header);
+      GNUNET_assert (NULL != curl_slist_append (all_headers,
+                                                aid_header));
+      GNUNET_free (aid_header);
+    }
+  }
+  return all_headers;
+}
+
+
+/**
+ * Create a job.
+ *
+ * @param eh easy handle to use
+ * @param ctx context to run the job in
+ * @param all_headers HTTP client headers to use (free'd)
+ * @return NULL on error
+ */
+static struct GNUNET_CURL_Job *
+setup_job (CURL *eh,
+           struct GNUNET_CURL_Context *ctx,
+           struct curl_slist *all_headers)
+{
+  struct GNUNET_CURL_Job *job;
+
+  if (CURLE_OK !=
+      curl_easy_setopt (eh,
+                        CURLOPT_HTTPHEADER,
+                        all_headers))
+  {
+    GNUNET_break (0);
+    curl_slist_free_all (all_headers);
+    curl_easy_cleanup (eh);
+    return NULL;
+  }
+  job = GNUNET_new (struct GNUNET_CURL_Job);
+  job->start_time = GNUNET_TIME_absolute_get ();
+  job->job_headers = all_headers;
+
+  if ( (CURLE_OK !=
+        curl_easy_setopt (eh,
+                          CURLOPT_PRIVATE,
+                          job)) ||
+       (CURLE_OK !=
+        curl_easy_setopt (eh,
+                          CURLOPT_WRITEFUNCTION,
+                          &download_cb)) ||
+       (CURLE_OK !=
+        curl_easy_setopt (eh,
+                          CURLOPT_WRITEDATA,
+                          &job->db)) ||
+       (CURLE_OK !=
+        curl_easy_setopt (eh,
+                          CURLOPT_SHARE,
+                          ctx->share)) )
+  {
+    GNUNET_break (0);
+    GNUNET_free (job);
+    curl_easy_cleanup (eh);
+    return NULL;
+  }
+  if ( (CURLM_OK !=
+        curl_multi_add_handle (ctx->multi,
+                               eh)) )
+  {
+    GNUNET_break (0);
+    GNUNET_free (job);
+    curl_easy_cleanup (eh);
+    return NULL;
+  }
+  job->easy_handle = eh;
+  job->ctx = ctx;
+  GNUNET_CONTAINER_DLL_insert (ctx->jobs_head,
+                               ctx->jobs_tail,
+                               job);
+  return job;
+}
+
+
+void
+GNUNET_CURL_extend_headers (struct GNUNET_CURL_Job *job,
+                            const struct curl_slist *extra_headers)
+{
+  struct curl_slist *all_headers = job->job_headers;
+
+  for (const struct curl_slist *curr = extra_headers;
+       NULL != curr;
+       curr = curr->next)
+  {
+    GNUNET_assert (NULL !=
+                   (all_headers = curl_slist_append (all_headers,
+                                                     curr->data)));
+  }
+  job->job_headers = all_headers;
+}
+
+
+struct GNUNET_CURL_Job *
+GNUNET_CURL_job_add_raw (struct GNUNET_CURL_Context *ctx,
+                         CURL *eh,
+                         const struct curl_slist *job_headers,
+                         GNUNET_CURL_RawJobCompletionCallback jcc,
+                         void *jcc_cls)
+{
+  struct GNUNET_CURL_Job *job;
+  struct curl_slist *all_headers;
+
+  GNUNET_assert (NULL != jcc);
+  all_headers = setup_job_headers (ctx,
+                                   job_headers);
+  if (NULL == (job = setup_job (eh,
+                                ctx,
+                                all_headers)))
+    return NULL;
+  job->jcc_raw = jcc;
+  job->jcc_raw_cls = jcc_cls;
+  ctx->cb (ctx->cb_cls);
+  return job;
+}
+
+
+struct GNUNET_CURL_Job *
+GNUNET_CURL_job_add2 (struct GNUNET_CURL_Context *ctx,
+                      CURL *eh,
+                      const struct curl_slist *job_headers,
+                      GNUNET_CURL_JobCompletionCallback jcc,
+                      void *jcc_cls)
+{
+  struct GNUNET_CURL_Job *job;
+  struct curl_slist *all_headers;
+
+  GNUNET_assert (NULL != jcc);
+  if ( (NULL != ctx->userpass) &&
+       (0 != curl_easy_setopt (eh,
+                               CURLOPT_USERPWD,
+                               ctx->userpass)) )
+    return NULL;
+  if ( (NULL != ctx->certfile) &&
+       (0 != curl_easy_setopt (eh,
+                               CURLOPT_SSLCERT,
+                               ctx->certfile)) )
+    return NULL;
+  if ( (NULL != ctx->certtype) &&
+       (0 != curl_easy_setopt (eh,
+                               CURLOPT_SSLCERTTYPE,
+                               ctx->certtype)) )
+    return NULL;
+  if ( (NULL != ctx->keyfile) &&
+       (0 != curl_easy_setopt (eh,
+                               CURLOPT_SSLKEY,
+                               ctx->keyfile)) )
+    return NULL;
+  if ( (NULL != ctx->keypass) &&
+       (0 != curl_easy_setopt (eh,
+                               CURLOPT_KEYPASSWD,
+                               ctx->keypass)) )
+    return NULL;
+
+  all_headers = setup_job_headers (ctx,
+                                   job_headers);
+  if (NULL == (job = setup_job (eh,
+                                ctx,
+                                all_headers)))
+    return NULL;
+
+  job->jcc = jcc;
+  job->jcc_cls = jcc_cls;
+  ctx->cb (ctx->cb_cls);
+  return job;
+}
+
+
+struct GNUNET_CURL_Job *
+GNUNET_CURL_job_add_with_ct_json (struct GNUNET_CURL_Context *ctx,
+                                  CURL *eh,
+                                  GNUNET_CURL_JobCompletionCallback jcc,
+                                  void *jcc_cls)
+{
+  struct GNUNET_CURL_Job *job;
+  struct curl_slist *job_headers = NULL;
+
+  GNUNET_assert (NULL != (job_headers =
+                            curl_slist_append (NULL,
+                                               "Content-Type: application/json")));
+  job = GNUNET_CURL_job_add2 (ctx,
+                              eh,
+                              job_headers,
+                              jcc,
+                              jcc_cls);
+  curl_slist_free_all (job_headers);
+  return job;
+}
+
+
+struct GNUNET_CURL_Job *
+GNUNET_CURL_job_add (struct GNUNET_CURL_Context *ctx,
+                     CURL *eh,
+                     GNUNET_CURL_JobCompletionCallback jcc,
+                     void *jcc_cls)
+{
+  return GNUNET_CURL_job_add2 (ctx,
+                               eh,
+                               NULL,
+                               jcc,
+                               jcc_cls);
+}
+
+
+void
+GNUNET_CURL_job_cancel (struct GNUNET_CURL_Job *job)
+{
+  struct GNUNET_CURL_Context *ctx = job->ctx;
+
+  GNUNET_CONTAINER_DLL_remove (ctx->jobs_head,
+                               ctx->jobs_tail,
+                               job);
+  GNUNET_break (CURLM_OK ==
+                curl_multi_remove_handle (ctx->multi,
+                                          job->easy_handle));
+  curl_easy_cleanup (job->easy_handle);
+  GNUNET_free (job->db.buf);
+  curl_slist_free_all (job->job_headers);
+  ctx->cb (ctx->cb_cls);
+  GNUNET_free (job);
+}
+
+
+/**
+ * Test if the given content type @a ct is JSON
+ *
+ * @param ct a content type, e.g. "application/json; charset=UTF-8"
+ * @return true if @a ct denotes JSON
+ */
+static bool
+is_json (const char *ct)
+{
+  const char *semi;
+
+  /* check for "application/json" exact match */
+  if (0 == strcasecmp (ct,
+                       "application/json"))
+    return true;
+  /* check for "application/json;[ANYTHING]" */
+  semi = strchr (ct,
+                 ';');
+  /* also allow "application/json [ANYTHING]" (note the space!) */
+  if (NULL == semi)
+    semi = strchr (ct,
+                   ' ');
+  if (NULL == semi)
+    return false; /* no delimiter we accept, forget it */
+  if (semi - ct != strlen ("application/json"))
+    return false; /* delimiter past desired length, forget it */
+  if (0 == strncasecmp (ct,
+                        "application/json",
+                        strlen ("application/json")))
+    return true; /* OK */
+  return false;
+}
+
+
+void *
+GNUNET_CURL_download_get_result_ (struct GNUNET_CURL_DownloadBuffer *db,
+                                  CURL *eh,
+                                  long *response_code)
+{
+  json_t *json;
+  json_error_t error;
+  char *ct;
+
+#if DEBUG
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Downloaded body: %.*s\n",
+              (int) db->buf_size,
+              (char *) db->buf);
+#endif
+  if (CURLE_OK !=
+      curl_easy_getinfo (eh,
+                         CURLINFO_RESPONSE_CODE,
+                         response_code))
+  {
+    /* unexpected error... */
+    GNUNET_break (0);
+    *response_code = 0;
+  }
+  if (MHD_HTTP_NO_CONTENT == *response_code)
+    return NULL;
+  if ((CURLE_OK !=
+       curl_easy_getinfo (eh,
+                          CURLINFO_CONTENT_TYPE,
+                          &ct)) ||
+      (NULL == ct) ||
+      (! is_json (ct)))
+  {
+    /* No content type or explicitly not JSON, refuse to parse
+       (but keep response code) */
+    if (0 != db->buf_size)
+    {
+      char *url;
+
+      if (CURLE_OK !=
+          curl_easy_getinfo (eh,
+                             CURLINFO_EFFECTIVE_URL,
+                             &url))
+        url = "<unknown URL>";
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Request to `%s' was expected to return a body of type `application/json', got `%s'\n",
+                  url,
+                  ct);
+    }
+    return NULL;
+  }
+  if (0 == *response_code)
+  {
+    char *url;
+
+    if (CURLE_OK !=
+        curl_easy_getinfo (eh,
+                           CURLINFO_EFFECTIVE_URL,
+                           &url))
+      url = "<unknown URL>";
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Failed to download response from `%s': \n",
+                url);
+    return NULL;
+  }
+  json = NULL;
+  if (0 == db->eno)
+  {
+    json = json_loadb (db->buf,
+                       db->buf_size,
+                       JSON_REJECT_DUPLICATES | JSON_DISABLE_EOF_CHECK,
+                       &error);
+    if (NULL == json)
+    {
+      JSON_WARN (error);
+      *response_code = 0;
+    }
+  }
+  GNUNET_free (db->buf);
+  db->buf = NULL;
+  db->buf_size = 0;
+  return json;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CURL_append_header (struct GNUNET_CURL_Context *ctx,
+                           const char *header)
+{
+  ctx->common_headers = curl_slist_append (ctx->common_headers,
+                                           header);
+  if (NULL == ctx->common_headers)
+    return GNUNET_SYSERR;
+
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CURL_perform2 (struct GNUNET_CURL_Context *ctx,
+                      GNUNET_CURL_RawParser rp,
+                      GNUNET_CURL_ResponseCleaner rc)
+{
+  CURLMsg *cmsg;
+  int n_running;
+  int n_completed;
+
+  (void) curl_multi_perform (ctx->multi,
+                             &n_running);
+  while (NULL != (cmsg = curl_multi_info_read (ctx->multi,
+                                               &n_completed)))
+  {
+    struct GNUNET_CURL_Job *job;
+    struct GNUNET_TIME_Relative duration;
+    long response_code;
+    void *response;
+
+    /* Only documented return value is CURLMSG_DONE */
+    GNUNET_break (CURLMSG_DONE == cmsg->msg);
+    GNUNET_assert (CURLE_OK ==
+                   curl_easy_getinfo (cmsg->easy_handle,
+                                      CURLINFO_PRIVATE,
+                                      (char **) &job));
+    GNUNET_assert (job->ctx == ctx);
+    response_code = 0;
+    duration = GNUNET_TIME_absolute_get_duration (job->start_time);
+    if (NULL != job->jcc_raw)
+    {
+      /* RAW mode, no parsing */
+      GNUNET_break (CURLE_OK ==
+                    curl_easy_getinfo (job->easy_handle,
+                                       CURLINFO_RESPONSE_CODE,
+                                       &response_code));
+      job->jcc_raw (job->jcc_raw_cls,
+                    response_code,
+                    job->db.buf,
+                    job->db.buf_size);
+    }
+    else
+    {
+      /* to be parsed via 'rp' */
+      response = rp (&job->db,
+                     job->easy_handle,
+                     &response_code);
+      job->jcc (job->jcc_cls,
+                response_code,
+                response);
+      rc (response);
+    }
+    {
+      char *url = NULL;
+
+      if (CURLE_UNKNOWN_OPTION ==
+          curl_easy_getinfo (job->easy_handle,
+                             CURLINFO_EFFECTIVE_URL,
+                             &url))
+        url = "<unknown>";
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "HTTP request for `%s' finished with %u after %s\n",
+                  url,
+                  (unsigned int) response_code,
+                  GNUNET_TIME_relative2s (duration,
+                                          true));
+      /* Note: we MUST NOT free 'url' here */
+    }
+    GNUNET_CURL_job_cancel (job);
+  }
+}
+
+
+void
+GNUNET_CURL_perform (struct GNUNET_CURL_Context *ctx)
+{
+  GNUNET_CURL_perform2 (ctx,
+                        &GNUNET_CURL_download_get_result_,
+                        (GNUNET_CURL_ResponseCleaner) & json_decref);
+}
+
+
+void
+GNUNET_CURL_get_select_info (struct GNUNET_CURL_Context *ctx,
+                             fd_set *read_fd_set,
+                             fd_set *write_fd_set,
+                             fd_set *except_fd_set,
+                             int *max_fd,
+                             long *timeout)
+{
+  long to;
+  int m;
+
+  m = -1;
+  GNUNET_assert (CURLM_OK ==
+                 curl_multi_fdset (ctx->multi,
+                                   read_fd_set,
+                                   write_fd_set,
+                                   except_fd_set,
+                                   &m));
+  to = *timeout;
+  *max_fd = GNUNET_MAX (m, *max_fd);
+  GNUNET_assert (CURLM_OK ==
+                 curl_multi_timeout (ctx->multi,
+                                     &to));
+
+  /* Only if what we got back from curl is smaller than what we
+     already had (-1 == infinity!), then update timeout */
+  if ((to < *timeout) && (-1 != to))
+    *timeout = to;
+  if ((-1 == (*timeout)) && (NULL != ctx->jobs_head))
+    *timeout = to;
+}
+
+
+void
+GNUNET_CURL_fini (struct GNUNET_CURL_Context *ctx)
+{
+  /* all jobs must have been cancelled at this time, assert this */
+  GNUNET_assert (NULL == ctx->jobs_head);
+  curl_share_cleanup (ctx->share);
+  curl_multi_cleanup (ctx->multi);
+  curl_slist_free_all (ctx->common_headers);
+  GNUNET_free (ctx->userpass);
+  GNUNET_free (ctx->certtype);
+  GNUNET_free (ctx->certfile);
+  GNUNET_free (ctx->keyfile);
+  GNUNET_free (ctx->keypass);
+  GNUNET_free (ctx);
+}
+
+
+/**
+ * Initial global setup logic, specifically runs the Curl setup.
+ */
+__attribute__ ((constructor)) void
+GNUNET_CURL_constructor__ (void)
+{
+  CURLcode ret;
+
+  if (CURLE_OK != (ret = curl_global_init (CURL_GLOBAL_DEFAULT)))
+  {
+    CURL_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                   "curl_global_init",
+                   ret);
+    curl_fail = 1;
+  }
+}
+
+
+/**
+ * Cleans up after us, specifically runs the Curl cleanup.
+ */
+__attribute__ ((destructor)) void
+GNUNET_CURL_destructor__ (void)
+{
+  if (curl_fail)
+    return;
+  curl_global_cleanup ();
+}
+
+
+/* end of curl.c */
diff --git a/src/lib/curl/curl_reschedule.c b/src/lib/curl/curl_reschedule.c
new file mode 100644
index 000000000..0c19bd171
--- /dev/null
+++ b/src/lib/curl/curl_reschedule.c
@@ -0,0 +1,181 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2015, 2016 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file curl/curl_reschedule.c
+ * @brief API for event loop integration with GNUnet SCHEDULER.
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include <jansson.h>
+#include "gnunet_curl_lib.h"
+#include "gnunet_util_lib.h"
+
+extern void *
+GNUNET_CURL_download_get_result_ (struct GNUNET_CURL_DownloadBuffer *db,
+                                  CURL *eh,
+                                  long *response_code);
+
+/**
+ * Closure for #GNUNET_CURL_gnunet_scheduler_reschedule().
+ */
+struct GNUNET_CURL_RescheduleContext
+{
+  /**
+   * Just the task.
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+
+  /**
+   * Context we manage.
+   */
+  struct GNUNET_CURL_Context *ctx;
+
+  /**
+   * Parser of the raw response.
+   */
+  GNUNET_CURL_RawParser parser;
+
+  /**
+   * Deallocate the response object.
+   */
+  GNUNET_CURL_ResponseCleaner cleaner;
+};
+
+
+struct GNUNET_CURL_RescheduleContext *
+GNUNET_CURL_gnunet_rc_create_with_parser (struct GNUNET_CURL_Context *ctx,
+                                          GNUNET_CURL_RawParser rp,
+                                          GNUNET_CURL_ResponseCleaner rc)
+{
+  struct GNUNET_CURL_RescheduleContext *rctx;
+
+  rctx = GNUNET_new (struct GNUNET_CURL_RescheduleContext);
+  rctx->ctx = ctx;
+  rctx->parser = rp;
+  rctx->cleaner = rc;
+
+  return rctx;
+}
+
+
+/**
+ * Just a wrapper to avoid casting of function pointers.
+ *
+ * @param response the (JSON) response to clean.
+ */
+static void
+clean_result (void *response)
+{
+  json_decref (response);
+}
+
+
+struct GNUNET_CURL_RescheduleContext *
+GNUNET_CURL_gnunet_rc_create (struct GNUNET_CURL_Context *ctx)
+{
+  struct GNUNET_CURL_RescheduleContext *rc;
+
+  rc = GNUNET_new (struct GNUNET_CURL_RescheduleContext);
+  rc->ctx = ctx;
+  rc->parser = &GNUNET_CURL_download_get_result_;
+  rc->cleaner = &clean_result;
+  return rc;
+}
+
+
+void
+GNUNET_CURL_gnunet_rc_destroy (struct GNUNET_CURL_RescheduleContext *rc)
+{
+  if (NULL != rc->task)
+    GNUNET_SCHEDULER_cancel (rc->task);
+  GNUNET_free (rc);
+}
+
+
+/**
+ * Task that runs the context's event loop with the GNUnet scheduler.
+ *
+ * @param cls a `struct GNUNET_CURL_RescheduleContext *`
+ */
+static void
+context_task (void *cls)
+{
+  struct GNUNET_CURL_RescheduleContext *rc = cls;
+  long timeout;
+  int max_fd;
+  fd_set read_fd_set;
+  fd_set write_fd_set;
+  fd_set except_fd_set;
+  struct GNUNET_NETWORK_FDSet *rs;
+  struct GNUNET_NETWORK_FDSet *ws;
+  struct GNUNET_TIME_Relative delay;
+
+  rc->task = NULL;
+  GNUNET_CURL_perform2 (rc->ctx, rc->parser, rc->cleaner);
+  max_fd = -1;
+  timeout = -1;
+  FD_ZERO (&read_fd_set);
+  FD_ZERO (&write_fd_set);
+  FD_ZERO (&except_fd_set);
+  GNUNET_CURL_get_select_info (rc->ctx,
+                               &read_fd_set,
+                               &write_fd_set,
+                               &except_fd_set,
+                               &max_fd,
+                               &timeout);
+  if (timeout >= 0)
+    delay =
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS,
+                                     timeout);
+  else
+    delay = GNUNET_TIME_UNIT_FOREVER_REL;
+  rs = GNUNET_NETWORK_fdset_create ();
+  GNUNET_NETWORK_fdset_copy_native (rs,
+                                    &read_fd_set,
+                                    max_fd + 1);
+  ws = GNUNET_NETWORK_fdset_create ();
+  GNUNET_NETWORK_fdset_copy_native (ws,
+                                    &write_fd_set,
+                                    max_fd + 1);
+  if (NULL == rc->task)
+    rc->task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                            delay,
+                                            rs,
+                                            ws,
+                                            &context_task,
+                                            rc);
+  GNUNET_NETWORK_fdset_destroy (rs);
+  GNUNET_NETWORK_fdset_destroy (ws);
+}
+
+
+void
+GNUNET_CURL_gnunet_scheduler_reschedule (void *cls)
+{
+  struct GNUNET_CURL_RescheduleContext *rc = *(void **) cls;
+
+  if (NULL != rc->task)
+    GNUNET_SCHEDULER_cancel (rc->task);
+  rc->task = GNUNET_SCHEDULER_add_now (&context_task,
+                                       rc);
+}
+
+
+/* end of curl_reschedule.c */
diff --git a/src/lib/curl/meson.build b/src/lib/curl/meson.build
new file mode 100644
index 000000000..77594d6c1
--- /dev/null
+++ b/src/lib/curl/meson.build
@@ -0,0 +1,13 @@
+libgnunetcurl_src = ['curl.c',
+                    'curl_reschedule.c']
+
+libgnunetcurl = library('gnunetcurl',
+        libgnunetcurl_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep, curl_dep, json_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetcurl_dep = declare_dependency(link_with : libgnunetcurl)
+
diff --git a/src/lib/gnsrecord/.gitignore b/src/lib/gnsrecord/.gitignore
new file mode 100644
index 000000000..dca3bd309
--- /dev/null
+++ b/src/lib/gnsrecord/.gitignore
@@ -0,0 +1,6 @@
+test_gnsrecord_block_expiration
+test_gnsrecord_crypto
+test_gnsrecord_serialization
+zonefiles
+perf_gnsrecord_crypto
+gnunet-gnsrecord-tvg
diff --git a/src/lib/gnsrecord/Makefile.am b/src/lib/gnsrecord/Makefile.am
new file mode 100644
index 000000000..ab79de900
--- /dev/null
+++ b/src/lib/gnsrecord/Makefile.am
@@ -0,0 +1,111 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include ${MHD_CFLAGS}
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+noinst_PROGRAMS = \
+  gnunet-gnsrecord-tvg
+
+
+check_PROGRAMS = \
+ test_gnsrecord_crypto \
+ test_gnsrecord_serialization \
+ test_gnsrecord_lsd0001testvectors \
+ test_gnsrecord_block_expiration \
+ perf_gnsrecord_crypto
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = \
+  $(check_PROGRAMS) \
+  $(check_SCRIPTS)
+endif
+
+lib_LTLIBRARIES = \
+  libgnunetgnsrecord.la \
+  libgnunetgnsrecordjson.la
+
+gnunet_gnsrecord_tvg_SOURCES = \
+ gnunet-gnsrecord-tvg.c \
+ gnsrecord_crypto.h
+gnunet_gnsrecord_tvg_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  libgnunetgnsrecord.la \
+  $(GN_LIBINTL)
+
+
+libgnunetgnsrecord_la_SOURCES = \
+  gnsrecord.c \
+  gnsrecord_serialization.c \
+  gnsrecord_crypto.c \
+  gnsrecord_pow.c \
+  gnsrecord_misc.c
+libgnunetgnsrecord_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LIBGCRYPT_LIBS) \
+  -lsodium \
+  $(GN_LIBINTL)
+libgnunetgnsrecord_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)  \
+  -version-info 0:0:0
+
+libgnunetgnsrecordjson_la_SOURCES = \
+  json_gnsrecord.c
+libgnunetgnsrecordjson_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  libgnunetgnsrecord.la \
+  -ljansson \
+  $(GN_LIBINTL)
+libgnunetgnsrecordjson_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)  \
+  -version-info 0:0:0
+
+EXTRA_DIST = \
+  $(check_SCRIPTS)
+
+test_gnsrecord_lsd0001testvectors_SOURCES = \
+ test_gnsrecord_testvectors.c
+test_gnsrecord_lsd0001testvectors_LDADD = \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+test_gnsrecord_serialization_SOURCES = \
+ test_gnsrecord_serialization.c
+test_gnsrecord_serialization_LDADD = \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_gnsrecord_block_expiration_SOURCES = \
+ test_gnsrecord_block_expiration.c
+test_gnsrecord_block_expiration_LDADD = \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+test_gnsrecord_crypto_SOURCES = \
+ test_gnsrecord_crypto.c
+test_gnsrecord_crypto_LDADD = \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+perf_gnsrecord_crypto_SOURCES = \
+ perf_gnsrecord_crypto.c
+perf_gnsrecord_crypto_LDADD = \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
diff --git a/src/lib/gnsrecord/gnsrecord.c b/src/lib/gnsrecord/gnsrecord.c
new file mode 100644
index 000000000..c71dc1708
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord.c
@@ -0,0 +1,267 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/gnsrecord.c
+ * @brief API to access GNS record data
+ * @author Martin Schanzenbach
+ * @author Matthias Wachs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_gnsrecord_plugin.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
+
+
+/**
+ * Handle for a plugin.
+ */
+struct Plugin
+{
+  /**
+   * Name of the shared library.
+   */
+  char *library_name;
+
+  /**
+   * Plugin API.
+   */
+  struct GNUNET_GNSRECORD_PluginFunctions *api;
+};
+
+
+/**
+ * Array of our plugins.
+ */
+static struct Plugin **gns_plugins;
+
+/**
+ * Size of the 'plugins' array.
+ */
+static unsigned int num_plugins;
+
+/**
+ * Global to mark if we've run the initialization.
+ */
+static int once;
+
+
+/**
+ * Add a plugin to the list managed by the block library.
+ *
+ * @param cls NULL
+ * @param library_name name of the plugin
+ * @param lib_ret the plugin API
+ */
+static void
+add_plugin (void *cls,
+            const char *library_name,
+            void *lib_ret)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api = lib_ret;
+  struct Plugin *plugin;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Loading block plugin `%s'\n",
+              library_name);
+  plugin = GNUNET_new (struct Plugin);
+  plugin->api = api;
+  plugin->library_name = GNUNET_strdup (library_name);
+  GNUNET_array_append (gns_plugins, num_plugins, plugin);
+}
+
+
+/**
+ * Loads all plugins (lazy initialization).
+ */
+static void
+init ()
+{
+  if (1 == once)
+    return;
+  once = 1;
+
+  GNUNET_PLUGIN_load_all_in_context (GNUNET_OS_project_data_default (),
+                                     "libgnunet_plugin_gnsrecord_",
+                                     NULL,
+                                     &add_plugin,
+                                     NULL);
+}
+
+
+/**
+ * Dual function to #init().
+ */
+void __attribute__ ((destructor))
+GNSRECORD_fini ()
+{
+  struct Plugin *plugin;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  const struct GNUNET_OS_ProjectData *dpd = GNUNET_OS_project_data_default ();
+
+  if (pd != dpd)
+    GNUNET_OS_init (dpd);
+
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    GNUNET_break (NULL ==
+                  GNUNET_PLUGIN_unload (plugin->library_name,
+                                        plugin->api));
+    GNUNET_free (plugin->library_name);
+    GNUNET_free (plugin);
+  }
+  GNUNET_free (gns_plugins);
+
+  if (pd != dpd)
+    GNUNET_OS_init (pd);
+
+  gns_plugins = NULL;
+  once = 0;
+  num_plugins = 0;
+}
+
+
+/**
+ * Convert the 'value' of a record to a string.
+ *
+ * @param type type of the record
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+char *
+GNUNET_GNSRECORD_value_to_string (uint32_t type,
+                                  const void *data,
+                                  size_t data_size)
+{
+  struct Plugin *plugin;
+  char *ret;
+
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (NULL != (ret = plugin->api->value_to_string (plugin->api->cls,
+                                                     type,
+                                                     data,
+                                                     data_size)))
+      return ret;
+  }
+  return NULL;
+}
+
+
+int
+GNUNET_GNSRECORD_string_to_value (uint32_t type,
+                                  const char *s,
+                                  void **data,
+                                  size_t *data_size)
+{
+  struct Plugin *plugin;
+
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (GNUNET_OK == plugin->api->string_to_value (plugin->api->cls,
+                                                   type,
+                                                   s,
+                                                   data,
+                                                   data_size))
+      return GNUNET_OK;
+  }
+  return GNUNET_SYSERR;
+}
+
+
+uint32_t
+GNUNET_GNSRECORD_typename_to_number (const char *dns_typename)
+{
+  struct Plugin *plugin;
+  uint32_t ret;
+
+  if (0 == strcasecmp (dns_typename,
+                       "ANY"))
+    return GNUNET_GNSRECORD_TYPE_ANY;
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (UINT32_MAX != (ret = plugin->api->typename_to_number (plugin->api->cls,
+                                                              dns_typename)))
+      return ret;
+  }
+  return UINT32_MAX;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+const char *
+GNUNET_GNSRECORD_number_to_typename (uint32_t type)
+{
+  struct Plugin *plugin;
+  const char *ret;
+
+  if (GNUNET_GNSRECORD_TYPE_ANY == type)
+    return "ANY";
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (NULL != (ret = plugin->api->number_to_typename (plugin->api->cls,
+                                                        type)))
+      return ret;
+  }
+  return NULL;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type)
+{
+  struct Plugin *plugin;
+
+  if (GNUNET_GNSRECORD_TYPE_ANY == type)
+    return GNUNET_NO;
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (NULL == plugin->api->is_critical)
+      continue;
+    if (GNUNET_NO == plugin->api->is_critical (plugin->api->cls, type))
+      continue;
+    return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/* end of gnsrecord.c */
diff --git a/src/lib/gnsrecord/gnsrecord_crypto.c b/src/lib/gnsrecord/gnsrecord_crypto.c
new file mode 100644
index 000000000..de0fa3ffd
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord_crypto.c
@@ -0,0 +1,1091 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/gnsrecord_crypto.c
+ * @brief API for GNS record-related crypto
+ * @author Martin Schanzenbach
+ * @author Matthias Wachs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnsrecord_crypto.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
+
+ssize_t
+ecdsa_symmetric_decrypt (
+  const void *block,
+  size_t size,
+  const unsigned char *key,
+  const unsigned char *ctr,
+  void *result)
+{
+  gcry_cipher_hd_t handle;
+  int rc;
+
+  GNUNET_assert (0 == gcry_cipher_open (&handle, GCRY_CIPHER_AES256,
+                                        GCRY_CIPHER_MODE_CTR, 0));
+  rc = gcry_cipher_setkey (handle,
+                           key,
+                           GNUNET_CRYPTO_AES_KEY_LENGTH);
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  rc = gcry_cipher_setctr (handle,
+                           ctr,
+                           GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  GNUNET_assert (0 == gcry_cipher_decrypt (handle, result, size, block, size));
+  gcry_cipher_close (handle);
+  return size;
+}
+
+
+ssize_t
+ecdsa_symmetric_encrypt (
+  const void *block,
+  size_t size,
+  const unsigned char *key,
+  const unsigned char *ctr,
+  void *result)
+{
+  gcry_cipher_hd_t handle;
+  int rc;
+
+  GNUNET_assert (0 == gcry_cipher_open (&handle, GCRY_CIPHER_AES256,
+                                        GCRY_CIPHER_MODE_CTR, 0));
+  rc = gcry_cipher_setkey (handle,
+                           key,
+                           GNUNET_CRYPTO_AES_KEY_LENGTH);
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  rc = gcry_cipher_setctr (handle,
+                           ctr,
+                           GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  GNUNET_assert (0 == gcry_cipher_encrypt (handle, result, size, block, size));
+  gcry_cipher_close (handle);
+  return size;
+}
+
+
+enum GNUNET_GenericReturnValue
+eddsa_symmetric_decrypt (
+  const void *block,
+  size_t size,
+  const unsigned char *key,
+  const unsigned char *nonce,
+  void *result)
+{
+  ssize_t ctlen = size - crypto_secretbox_MACBYTES;
+  if (ctlen < 0)
+    return GNUNET_SYSERR;
+  if (0 != crypto_secretbox_open_detached (result,
+                                           ((unsigned char*) block)
+                                           + crypto_secretbox_MACBYTES,                          // Ciphertext
+                                           block, // Tag
+                                           ctlen,
+                                           nonce, key))
+  {
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+eddsa_symmetric_encrypt (
+  const void *block,
+  size_t size,
+  const unsigned char *key,
+  const unsigned char *nonce,
+  void *result)
+{
+  if (size > crypto_secretbox_MESSAGEBYTES_MAX)
+    return GNUNET_SYSERR;
+  crypto_secretbox_detached (result + crypto_secretbox_MACBYTES, // Ciphertext
+                             result, // TAG
+                             block, size, nonce, key);
+  return GNUNET_OK;
+}
+
+
+void
+GNR_derive_block_aes_key (unsigned char *ctr,
+                          unsigned char *key,
+                          const char *label,
+                          uint64_t exp,
+                          const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
+{
+  static const char ctx_key[] = "gns-aes-ctx-key";
+  static const char ctx_iv[] = "gns-aes-ctx-iv";
+
+  GNUNET_CRYPTO_kdf (key, GNUNET_CRYPTO_AES_KEY_LENGTH,
+                     ctx_key, strlen (ctx_key),
+                     pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                     label, strlen (label),
+                     NULL, 0);
+  memset (ctr, 0, GNUNET_CRYPTO_AES_KEY_LENGTH / 2);
+  /** 4 byte nonce **/
+  GNUNET_CRYPTO_kdf (ctr, 4,
+                     ctx_iv, strlen (ctx_iv),
+                     pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                     label, strlen (label),
+                     NULL, 0);
+  /** Expiration time 64 bit. **/
+  memcpy (ctr + 4, &exp, sizeof (exp));
+  /** Set counter part to 1 **/
+  ctr[15] |= 0x01;
+}
+
+
+void
+GNR_derive_block_xsalsa_key (unsigned char *nonce,
+                             unsigned char *key,
+                             const char *label,
+                             uint64_t exp,
+                             const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
+{
+  static const char ctx_key[] = "gns-xsalsa-ctx-key";
+  static const char ctx_iv[] = "gns-xsalsa-ctx-iv";
+
+  GNUNET_CRYPTO_kdf (key, crypto_secretbox_KEYBYTES,
+                     ctx_key, strlen (ctx_key),
+                     pub, sizeof(struct GNUNET_CRYPTO_EddsaPublicKey),
+                     label, strlen (label),
+                     NULL, 0);
+  memset (nonce, 0, crypto_secretbox_NONCEBYTES);
+  /** 16 byte nonce **/
+  GNUNET_CRYPTO_kdf (nonce, (crypto_secretbox_NONCEBYTES - sizeof (exp)),
+                     ctx_iv, strlen (ctx_iv),
+                     pub, sizeof(struct GNUNET_CRYPTO_EddsaPublicKey),
+                     label, strlen (label),
+                     NULL, 0);
+  /** Expiration time 64 bit. **/
+  memcpy (nonce + (crypto_secretbox_NONCEBYTES - sizeof (exp)),
+          &exp, sizeof (exp));
+}
+
+
+static ssize_t
+block_get_size_ecdsa (const struct GNUNET_GNSRECORD_Data *rd,
+                      unsigned int rd_count)
+{
+  ssize_t len;
+
+  len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  if (len < 0)
+    return -1;
+  len += sizeof(struct GNUNET_GNSRECORD_Block);
+  return len;
+}
+
+
+enum GNUNET_GenericReturnValue
+block_sign_ecdsa (const struct
+                  GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                  const struct
+                  GNUNET_CRYPTO_EcdsaPublicKey *pkey,
+                  const char *label,
+                  struct GNUNET_GNSRECORD_Block *block)
+{
+  struct GNRBlockPS *gnr_block;
+  struct GNUNET_GNSRECORD_EcdsaBlock *ecblock;
+  size_t size = ntohl (block->size) - sizeof (*block) + sizeof (*gnr_block);
+
+  gnr_block = GNUNET_malloc (size);
+  ecblock = &(block)->ecdsa_block;
+  gnr_block->purpose.size = htonl (size);
+  gnr_block->purpose.purpose =
+    htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
+  gnr_block->expiration_time = ecblock->expiration_time;
+  /* encrypt and sign */
+  GNUNET_memcpy (&gnr_block[1], &ecblock[1],
+                 size - sizeof (*gnr_block));
+  GNUNET_CRYPTO_ecdsa_public_key_derive (pkey,
+                                         label,
+                                         "gns",
+                                         &ecblock->derived_key);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecdsa_sign_derived (key,
+                                        label,
+                                        "gns",
+                                        &gnr_block->purpose,
+                                        &ecblock->signature))
+  {
+    GNUNET_break (0);
+    GNUNET_free (gnr_block);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (gnr_block);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+block_sign_eddsa (const struct
+                  GNUNET_CRYPTO_EddsaPrivateKey *key,
+                  const struct
+                  GNUNET_CRYPTO_EddsaPublicKey *pkey,
+                  const char *label,
+                  struct GNUNET_GNSRECORD_Block *block)
+{
+  struct GNRBlockPS *gnr_block;
+  struct GNUNET_GNSRECORD_EddsaBlock *edblock;
+  size_t size = ntohl (block->size) - sizeof (*block) + sizeof (*gnr_block);
+  gnr_block = GNUNET_malloc (size);
+  edblock = &(block)->eddsa_block;
+  gnr_block->purpose.size = htonl (size);
+  gnr_block->purpose.purpose =
+    htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
+  gnr_block->expiration_time = edblock->expiration_time;
+  GNUNET_memcpy (&gnr_block[1], &edblock[1],
+                 size - sizeof (*gnr_block));
+  /* encrypt and sign */
+  GNUNET_CRYPTO_eddsa_public_key_derive (pkey,
+                                         label,
+                                         "gns",
+                                         &edblock->derived_key);
+  GNUNET_CRYPTO_eddsa_sign_derived (key,
+                                    label,
+                                    "gns",
+                                    &gnr_block->purpose,
+                                    &edblock->signature);
+  GNUNET_free (gnr_block);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_sign (const struct
+                             GNUNET_CRYPTO_PrivateKey *key,
+                             const char *label,
+                             struct GNUNET_GNSRECORD_Block *block)
+{
+  struct GNUNET_CRYPTO_PublicKey pkey;
+  enum GNUNET_GenericReturnValue res = GNUNET_SYSERR;
+  char *norm_label;
+
+  GNUNET_CRYPTO_key_get_public (key,
+                                  &pkey);
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+
+  switch (ntohl (key->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    res = block_sign_ecdsa (&key->ecdsa_key,
+                            &pkey.ecdsa_key,
+                            norm_label,
+                            block);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    res = block_sign_eddsa (&key->eddsa_key,
+                            &pkey.eddsa_key,
+                            norm_label,
+                            block);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  GNUNET_free (norm_label);
+  return res;
+}
+
+
+/**
+ * Sign name and records
+ *
+ * @param key the private key
+ * @param pkey associated public key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @param block the block result. Must be allocated sufficiently.
+ * @param sign sign the block GNUNET_NO if block will be signed later.
+ * @return GNUNET_SYSERR on error (otherwise GNUNET_OK)
+ */
+static enum GNUNET_GenericReturnValue
+block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                    const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey,
+                    struct GNUNET_TIME_Absolute expire,
+                    const char *label,
+                    const struct GNUNET_GNSRECORD_Data *rd,
+                    unsigned int rd_count,
+                    struct GNUNET_GNSRECORD_Block **block,
+                    int sign)
+{
+  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                           rd);
+  struct GNUNET_GNSRECORD_EcdsaBlock *ecblock;
+  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
+  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
+  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
+  struct GNUNET_TIME_Absolute now;
+
+  if (payload_len < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* convert relative to absolute times */
+  now = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    rdc[i] = rd[i];
+    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    {
+      struct GNUNET_TIME_Relative t;
+
+      /* encrypted blocks must never have relative expiration times, convert! */
+      rdc[i].flags &= ~GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+      t.rel_value_us = rdc[i].expiration_time;
+      rdc[i].expiration_time = GNUNET_TIME_absolute_add (now, t).abs_value_us;
+    }
+  }
+  /* serialize */
+  *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
+  (*block)->size = htonl (sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
+  {
+    char payload[payload_len];
+
+    GNUNET_assert (payload_len ==
+                   GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                       rdc,
+                                                       payload_len,
+                                                       payload));
+    ecblock = &(*block)->ecdsa_block;
+    (*block)->type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+    ecblock->expiration_time = GNUNET_TIME_absolute_hton (expire);
+    GNR_derive_block_aes_key (ctr,
+                              skey,
+                              label,
+                              ecblock->expiration_time.abs_value_us__,
+                              pkey);
+    GNUNET_assert (payload_len ==
+                   ecdsa_symmetric_encrypt (payload,
+                                            payload_len,
+                                            skey,
+                                            ctr,
+                                            &ecblock[1]));
+  }
+  if (GNUNET_YES != sign)
+    return GNUNET_OK;
+  if (GNUNET_OK !=
+      block_sign_ecdsa (key, pkey, label, *block))
+  {
+    GNUNET_break (0);
+    GNUNET_free (*block);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static ssize_t
+block_get_size_eddsa (const struct GNUNET_GNSRECORD_Data *rd,
+                      unsigned int rd_count)
+{
+  ssize_t len;
+
+  len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  if (len < 0)
+    return -1;
+  len += sizeof(struct GNUNET_GNSRECORD_Block);
+  len += crypto_secretbox_MACBYTES;
+  return len;
+}
+
+
+/**
+ * Sign name and records (EDDSA version)
+ *
+ * @param key the private key
+ * @param pkey associated public key
+ * @param expire block expiration
+ * @param label the name for the records
+ * @param rd record data
+ * @param rd_count number of records
+ * @param block where to store the block. Must be allocated sufficiently.
+ * @param sign GNUNET_YES if block shall be signed as well
+ * @return GNUNET_SYSERR on error (otherwise GNUNET_OK)
+ */
+enum GNUNET_GenericReturnValue
+block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
+                    const struct GNUNET_CRYPTO_EddsaPublicKey *pkey,
+                    struct GNUNET_TIME_Absolute expire,
+                    const char *label,
+                    const struct GNUNET_GNSRECORD_Data *rd,
+                    unsigned int rd_count,
+                    struct GNUNET_GNSRECORD_Block **block,
+                    int sign)
+{
+  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                           rd);
+  struct GNUNET_GNSRECORD_EddsaBlock *edblock;
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char skey[crypto_secretbox_KEYBYTES];
+  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
+  struct GNUNET_TIME_Absolute now;
+
+  if (payload_len < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* convert relative to absolute times */
+  now = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    rdc[i] = rd[i];
+    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    {
+      struct GNUNET_TIME_Relative t;
+
+      /* encrypted blocks must never have relative expiration times, convert! */
+      rdc[i].flags &= ~GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+      t.rel_value_us = rdc[i].expiration_time;
+      rdc[i].expiration_time = GNUNET_TIME_absolute_add (now, t).abs_value_us;
+    }
+  }
+  /* serialize */
+  *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block)
+                          + payload_len + crypto_secretbox_MACBYTES);
+  (*block)->size = htonl (sizeof (struct GNUNET_GNSRECORD_Block)
+                          + payload_len + crypto_secretbox_MACBYTES);
+  {
+    char payload[payload_len];
+
+    GNUNET_assert (payload_len ==
+                   GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                       rdc,
+                                                       payload_len,
+                                                       payload));
+    edblock = &(*block)->eddsa_block;
+    (*block)->type = htonl (GNUNET_GNSRECORD_TYPE_EDKEY);
+    edblock->expiration_time = GNUNET_TIME_absolute_hton (expire);
+    GNR_derive_block_xsalsa_key (nonce,
+                                 skey,
+                                 label,
+                                 edblock->expiration_time.abs_value_us__,
+                                 pkey);
+    GNUNET_assert (GNUNET_OK ==
+                   eddsa_symmetric_encrypt (payload,
+                                            payload_len,
+                                            skey,
+                                            nonce,
+                                            &edblock[1]));
+    if (GNUNET_YES != sign)
+      return GNUNET_OK;
+    block_sign_eddsa (key, pkey, label, *block);
+  }
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_GNSRECORD_block_calculate_size (const struct
+                                       GNUNET_CRYPTO_PrivateKey *key,
+                                       const struct GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count)
+{
+  struct GNUNET_CRYPTO_PublicKey pkey;
+  ssize_t res = -1;
+
+  GNUNET_CRYPTO_key_get_public (key,
+                                  &pkey);
+  switch (ntohl (key->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    res = block_get_size_ecdsa (rd, rd_count);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    res = block_get_size_eddsa (rd, rd_count);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  return res;
+
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_PrivateKey *key,
+                               struct GNUNET_TIME_Absolute expire,
+                               const char *label,
+                               const struct GNUNET_GNSRECORD_Data *rd,
+                               unsigned int rd_count,
+                               struct GNUNET_GNSRECORD_Block **result)
+{
+  struct GNUNET_CRYPTO_PublicKey pkey;
+  enum GNUNET_GenericReturnValue res = GNUNET_SYSERR;
+  char *norm_label;
+
+  GNUNET_CRYPTO_key_get_public (key,
+                                  &pkey);
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+
+  switch (ntohl (key->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    res = block_create_ecdsa (&key->ecdsa_key,
+                              &pkey.ecdsa_key,
+                              expire,
+                              norm_label,
+                              rd,
+                              rd_count,
+                              result,
+                              GNUNET_YES);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    res = block_create_eddsa (&key->eddsa_key,
+                              &pkey.eddsa_key,
+                              expire,
+                              norm_label,
+                              rd,
+                              rd_count,
+                              result,
+                              GNUNET_YES);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  GNUNET_free (norm_label);
+  return res;
+}
+
+
+/**
+ * Line in cache mapping private keys to public keys.
+ */
+struct KeyCacheLine
+{
+  /**
+   * A private key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPrivateKey key;
+
+  /**
+   * Associated public key.
+   */
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+};
+
+
+static enum GNUNET_GenericReturnValue
+block_create2 (const struct GNUNET_CRYPTO_PrivateKey *pkey,
+               struct GNUNET_TIME_Absolute expire,
+               const char *label,
+               const struct GNUNET_GNSRECORD_Data *rd,
+               unsigned int rd_count,
+               struct GNUNET_GNSRECORD_Block **result,
+               int sign)
+{
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *key;
+  struct GNUNET_CRYPTO_EddsaPublicKey edpubkey;
+  enum GNUNET_GenericReturnValue res = GNUNET_SYSERR;
+  char *norm_label;
+
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+
+  if (GNUNET_PUBLIC_KEY_TYPE_ECDSA == ntohl (pkey->type))
+  {
+    key = &pkey->ecdsa_key;
+#define CSIZE 64
+    static struct KeyCacheLine cache[CSIZE];
+    struct KeyCacheLine *line;
+
+    line = &cache[(*(unsigned int *) key) % CSIZE];
+    if (0 != memcmp (&line->key,
+                     key,
+                     sizeof(*key)))
+    {
+      /* cache miss, recompute */
+      line->key = *key;
+      GNUNET_CRYPTO_ecdsa_key_get_public (key,
+                                          &line->pkey);
+    }
+#undef CSIZE
+    res = block_create_ecdsa (key,
+                              &line->pkey,
+                              expire,
+                              norm_label,
+                              rd,
+                              rd_count,
+                              result,
+                              sign);
+  }
+  else if (GNUNET_PUBLIC_KEY_TYPE_EDDSA == ntohl (pkey->type))
+  {
+    GNUNET_CRYPTO_eddsa_key_get_public (&pkey->eddsa_key,
+                                        &edpubkey);
+    res = block_create_eddsa (&pkey->eddsa_key,
+                              &edpubkey,
+                              expire,
+                              norm_label,
+                              rd,
+                              rd_count,
+                              result,
+                              sign);
+  }
+  GNUNET_free (norm_label);
+  return res;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create_unsigned (const struct
+                                        GNUNET_CRYPTO_PrivateKey *pkey,
+                                        struct GNUNET_TIME_Absolute expire,
+                                        const char *label,
+                                        const struct GNUNET_GNSRECORD_Data *rd,
+                                        unsigned int rd_count,
+                                        struct GNUNET_GNSRECORD_Block **result)
+{
+  return block_create2 (pkey, expire, label, rd, rd_count, result, GNUNET_NO);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_PrivateKey *pkey,
+                                struct GNUNET_TIME_Absolute expire,
+                                const char *label,
+                                const struct GNUNET_GNSRECORD_Data *rd,
+                                unsigned int rd_count,
+                                struct GNUNET_GNSRECORD_Block **result)
+{
+  return block_create2 (pkey, expire, label, rd, rd_count, result, GNUNET_YES);
+}
+
+
+/**
+ * Check if a signature is valid.  This API is used by the GNS Block
+ * to validate signatures received from the network.
+ *
+ * @param block block to verify
+ * @return #GNUNET_OK if the signature is valid
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
+{
+  struct GNRBlockPS *purp;
+  size_t payload_len = ntohl (block->size)
+                       - sizeof (struct GNUNET_GNSRECORD_Block);
+  enum GNUNET_GenericReturnValue res = GNUNET_NO;
+  purp = GNUNET_malloc (sizeof (struct GNRBlockPS) + payload_len);
+  purp->purpose.size = htonl (sizeof (struct GNRBlockPS) + payload_len);
+  purp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
+  GNUNET_memcpy (&purp[1],
+                 &block[1],
+                 payload_len);
+  switch (ntohl (block->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    purp->expiration_time = block->ecdsa_block.expiration_time;
+    res = GNUNET_CRYPTO_ecdsa_verify_ (
+      GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN,
+      &purp->purpose,
+      &block->ecdsa_block.signature,
+      &block->ecdsa_block.derived_key);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    purp->expiration_time = block->eddsa_block.expiration_time;
+    res = GNUNET_CRYPTO_eddsa_verify_ (
+      GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN,
+      &purp->purpose,
+      &block->eddsa_block.signature,
+      &block->eddsa_block.derived_key);
+    break;
+  default:
+    res = GNUNET_NO;
+  }
+  GNUNET_free (purp);
+  return res;
+}
+
+
+enum GNUNET_GenericReturnValue
+block_decrypt_ecdsa (const struct GNUNET_GNSRECORD_Block *block,
+                     const struct
+                     GNUNET_CRYPTO_EcdsaPublicKey *zone_key,
+                     const char *label,
+                     GNUNET_GNSRECORD_RecordCallback proc,
+                     void *proc_cls)
+{
+  size_t payload_len = ntohl (block->size) - sizeof (struct
+                                                     GNUNET_GNSRECORD_Block);
+  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
+  unsigned char key[GNUNET_CRYPTO_AES_KEY_LENGTH];
+
+  if (ntohl (block->size) <
+      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+      + sizeof(struct GNUNET_TIME_AbsoluteNBO))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNR_derive_block_aes_key (ctr,
+                            key,
+                            label,
+                            block->ecdsa_block.expiration_time.abs_value_us__,
+                            zone_key);
+  {
+    char payload[payload_len];
+    unsigned int rd_count;
+
+    GNUNET_assert (payload_len ==
+                   ecdsa_symmetric_decrypt (&block[1], payload_len,
+                                            key, ctr,
+                                            payload));
+    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
+                                                              payload);
+    if (rd_count > 2048)
+    {
+      /* limit to sane value */
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    {
+      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
+      unsigned int j;
+      struct GNUNET_TIME_Absolute now;
+
+      if (GNUNET_OK !=
+          GNUNET_GNSRECORD_records_deserialize (payload_len,
+                                                payload,
+                                                rd_count,
+                                                rd))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_SYSERR;
+      }
+      /* hide expired records */
+      now = GNUNET_TIME_absolute_get ();
+      j = 0;
+      for (unsigned int i = 0; i < rd_count; i++)
+      {
+        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+        {
+          /* encrypted blocks must never have relative expiration times, skip! */
+          GNUNET_break_op (0);
+          continue;
+        }
+
+        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_SHADOW))
+        {
+          int include_record = GNUNET_YES;
+          /* Shadow record, figure out if we have a not expired active record */
+          for (unsigned int k = 0; k < rd_count; k++)
+          {
+            if (k == i)
+              continue;
+            if (rd[i].expiration_time < now.abs_value_us)
+              include_record = GNUNET_NO;       /* Shadow record is expired */
+            if ((rd[k].record_type == rd[i].record_type) &&
+                (rd[k].expiration_time >= now.abs_value_us) &&
+                (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW)))
+            {
+              include_record = GNUNET_NO;         /* We have a non-expired, non-shadow record of the same type */
+              GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                          "Ignoring shadow record\n");
+              break;
+            }
+          }
+          if (GNUNET_YES == include_record)
+          {
+            rd[i].flags ^= GNUNET_GNSRECORD_RF_SHADOW;       /* Remove Flag */
+            if (j != i)
+              rd[j] = rd[i];
+            j++;
+          }
+        }
+        else if (rd[i].expiration_time >= now.abs_value_us)
+        {
+          /* Include this record */
+          if (j != i)
+            rd[j] = rd[i];
+          j++;
+        }
+        else
+        {
+          struct GNUNET_TIME_Absolute at;
+
+          at.abs_value_us = rd[i].expiration_time;
+          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                      "Excluding record that expired %s (%llu ago)\n",
+                      GNUNET_STRINGS_absolute_time_to_string (at),
+                      (unsigned long long) rd[i].expiration_time
+                      - now.abs_value_us);
+        }
+      }
+      rd_count = j;
+      if (NULL != proc)
+        proc (proc_cls,
+              rd_count,
+              (0 != rd_count) ? rd : NULL);
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block,
+                     const struct
+                     GNUNET_CRYPTO_EddsaPublicKey *zone_key,
+                     const char *label,
+                     GNUNET_GNSRECORD_RecordCallback proc,
+                     void *proc_cls)
+{
+  size_t payload_len = ntohl (block->size) - sizeof (struct
+                                                     GNUNET_GNSRECORD_Block);
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char key[crypto_secretbox_KEYBYTES];
+
+  if (ntohl (block->size) <
+      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+      + sizeof(struct GNUNET_TIME_AbsoluteNBO))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNR_derive_block_xsalsa_key (nonce,
+                               key,
+                               label,
+                               block->eddsa_block.expiration_time.abs_value_us__,
+                               zone_key);
+  {
+    char payload[payload_len];
+    unsigned int rd_count;
+
+    GNUNET_assert (GNUNET_OK ==
+                   eddsa_symmetric_decrypt (&block[1], payload_len,
+                                            key, nonce,
+                                            payload));
+    payload_len -= crypto_secretbox_MACBYTES;
+    rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
+                                                              payload);
+    if (rd_count > 2048)
+    {
+      /* limit to sane value */
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    {
+      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
+      unsigned int j;
+      struct GNUNET_TIME_Absolute now;
+
+      if (GNUNET_OK !=
+          GNUNET_GNSRECORD_records_deserialize (payload_len,
+                                                payload,
+                                                rd_count,
+                                                rd))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_SYSERR;
+      }
+      /* hide expired records */
+      now = GNUNET_TIME_absolute_get ();
+      j = 0;
+      for (unsigned int i = 0; i < rd_count; i++)
+      {
+        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+        {
+          /* encrypted blocks must never have relative expiration times, skip! */
+          GNUNET_break_op (0);
+          continue;
+        }
+
+        if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_SHADOW))
+        {
+          int include_record = GNUNET_YES;
+          /* Shadow record, figure out if we have a not expired active record */
+          for (unsigned int k = 0; k < rd_count; k++)
+          {
+            if (k == i)
+              continue;
+            if (rd[i].expiration_time < now.abs_value_us)
+              include_record = GNUNET_NO;       /* Shadow record is expired */
+            if ((rd[k].record_type == rd[i].record_type) &&
+                (rd[k].expiration_time >= now.abs_value_us) &&
+                (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW)))
+            {
+              include_record = GNUNET_NO;         /* We have a non-expired, non-shadow record of the same type */
+              GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                          "Ignoring shadow record\n");
+              break;
+            }
+          }
+          if (GNUNET_YES == include_record)
+          {
+            rd[i].flags ^= GNUNET_GNSRECORD_RF_SHADOW;       /* Remove Flag */
+            if (j != i)
+              rd[j] = rd[i];
+            j++;
+          }
+        }
+        else if (rd[i].expiration_time >= now.abs_value_us)
+        {
+          /* Include this record */
+          if (j != i)
+            rd[j] = rd[i];
+          j++;
+        }
+        else
+        {
+          struct GNUNET_TIME_Absolute at;
+
+          at.abs_value_us = rd[i].expiration_time;
+          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                      "Excluding record that expired %s (%llu ago)\n",
+                      GNUNET_STRINGS_absolute_time_to_string (at),
+                      (unsigned long long) rd[i].expiration_time
+                      - now.abs_value_us);
+        }
+      }
+      rd_count = j;
+      if (NULL != proc)
+        proc (proc_cls,
+              rd_count,
+              (0 != rd_count) ? rd : NULL);
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
+                                const struct
+                                GNUNET_CRYPTO_PublicKey *zone_key,
+                                const char *label,
+                                GNUNET_GNSRECORD_RecordCallback proc,
+                                void *proc_cls)
+{
+  enum GNUNET_GenericReturnValue res = GNUNET_SYSERR;
+  char *norm_label;
+
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+  switch (ntohl (zone_key->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    res = block_decrypt_ecdsa (block,
+                               &zone_key->ecdsa_key, norm_label, proc,
+                               proc_cls);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    res = block_decrypt_eddsa (block,
+                               &zone_key->eddsa_key, norm_label, proc,
+                               proc_cls);
+    break;
+  default:
+    res = GNUNET_SYSERR;
+  }
+  GNUNET_free (norm_label);
+  return res;
+}
+
+
+/**
+ * Calculate the DHT query for a given @a label in a given @a zone.
+ *
+ * @param zone private key of the zone
+ * @param label label of the record
+ * @param query hash to use for the query
+ */
+void
+GNUNET_GNSRECORD_query_from_private_key (const struct
+                                         GNUNET_CRYPTO_PrivateKey *zone,
+                                         const char *label,
+                                         struct GNUNET_HashCode *query)
+{
+  char *norm_label;
+  struct GNUNET_CRYPTO_PublicKey pub;
+
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+  switch (ntohl (zone->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+
+    GNUNET_CRYPTO_key_get_public (zone,
+                                    &pub);
+    GNUNET_GNSRECORD_query_from_public_key (&pub,
+                                            norm_label,
+                                            query);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  GNUNET_free (norm_label);
+}
+
+
+void
+GNUNET_GNSRECORD_query_from_public_key (const struct
+                                        GNUNET_CRYPTO_PublicKey *pub,
+                                        const char *label,
+                                        struct GNUNET_HashCode *query)
+{
+  char *norm_label;
+  struct GNUNET_CRYPTO_PublicKey pd;
+
+  norm_label = GNUNET_GNSRECORD_string_normalize (label);
+
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    pd.type = pub->type;
+    GNUNET_CRYPTO_ecdsa_public_key_derive (&pub->ecdsa_key,
+                                           norm_label,
+                                           "gns",
+                                           &pd.ecdsa_key);
+    GNUNET_CRYPTO_hash (&pd.ecdsa_key,
+                        sizeof (pd.ecdsa_key),
+                        query);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    pd.type = pub->type;
+    GNUNET_CRYPTO_eddsa_public_key_derive (&pub->eddsa_key,
+                                           norm_label,
+                                           "gns",
+                                           &(pd.eddsa_key));
+    GNUNET_CRYPTO_hash (&pd.eddsa_key,
+                        sizeof (pd.eddsa_key),
+                        query);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  GNUNET_free (norm_label);
+}
+
+
+/* end of gnsrecord_crypto.c */
diff --git a/src/lib/gnsrecord/gnsrecord_crypto.h b/src/lib/gnsrecord/gnsrecord_crypto.h
new file mode 100644
index 000000000..85f2258ab
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord_crypto.h
@@ -0,0 +1,94 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/gnsrecord_crypto.h
+ * @brief API for GNS record-related crypto
+ * @author Martin Schanzenbach
+ * @author Matthias Wachs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_signatures.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_gnsrecord_lib.h"
+
+/**
+ * Information we have in an encrypted block with record data (i.e. in the DHT).
+ */
+struct GNRBlockPS
+{
+  /**
+   * Number of bytes signed; also specifies the number of bytes
+   * of encrypted data that follow.
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * Expiration time of the block.
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /* followed by encrypted data */
+};
+
+
+/**
+ * Derive session key and iv from label and public key.
+ *
+ * @param iv initialization vector to initialize
+ * @param skey session key to initialize
+ * @param label label to use for KDF
+ * @param pub public key to use for KDF
+ */
+void
+GNR_derive_block_aes_key (unsigned char *ctr,
+                      unsigned char *key,
+                      const char *label,
+                      uint64_t exp,
+                      const struct GNUNET_CRYPTO_EcdsaPublicKey *pub);
+
+
+/**
+ * Derive session key and iv from label and public key.
+ *
+ * @param nonce initialization vector to initialize
+ * @param skey session key to initialize
+ * @param label label to use for KDF
+ * @param pub public key to use for KDF
+ */
+void
+GNR_derive_block_xsalsa_key (unsigned char *nonce,
+                         unsigned char *key,
+                         const char *label,
+                         uint64_t exp,
+                         const struct GNUNET_CRYPTO_EddsaPublicKey *pub);
+
+/**
+ * Create the revocation metadata to sign for a revocation message
+ *
+ * @param pow the PoW to sign
+ * @return the signature purpose
+ */
+struct GNUNET_GNSRECORD_SignaturePurposePS *
+GNR_create_signature_message (const struct GNUNET_GNSRECORD_PowP *pow);
+
diff --git a/src/lib/gnsrecord/gnsrecord_misc.c b/src/lib/gnsrecord/gnsrecord_misc.c
new file mode 100644
index 000000000..ede3e23e4
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord_misc.c
@@ -0,0 +1,566 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/gnsrecord_misc.c
+ * @brief MISC functions related to GNS records
+ * @author Martin Schanzenbach
+ * @author Matthias Wachs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_signatures.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_gnsrecord_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
+
+char *
+GNUNET_GNSRECORD_string_normalize (const char *src)
+{
+  /*FIXME: We may want to follow RFC5890/RFC5891 */
+  return GNUNET_STRINGS_utf8_normalize (src);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg)
+{
+  if (NULL == label)
+  {
+    *emsg = GNUNET_strdup (_ ("Label is NULL which is not allowed\n"));
+    return GNUNET_NO;
+  }
+  if (0 != strchr (label, '.'))
+  {
+    *emsg = GNUNET_strdup (_ ("Label  contains `.' which is not allowed\n"));
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+const char *
+GNUNET_GNSRECORD_z2s (const struct GNUNET_CRYPTO_PublicKey *z)
+{
+  static char buf[sizeof(struct GNUNET_CRYPTO_PublicKey) * 8];
+  char *end;
+
+  end = GNUNET_STRINGS_data_to_string ((const unsigned char *) z,
+                                       sizeof(struct
+                                              GNUNET_CRYPTO_PublicKey),
+                                       buf, sizeof(buf));
+  if (NULL == end)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  *end = '\0';
+  return buf;
+}
+
+
+/**
+ * Compares if two records are equal (ignoring flags such
+ * as authority, private and pending, but not relative vs.
+ * absolute expiration time).
+ *
+ * @param a record
+ * @param b record
+ * @return #GNUNET_YES if the records are equal or #GNUNET_NO if they are not
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
+                              const struct GNUNET_GNSRECORD_Data *b)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Comparing records\n");
+  if (a->record_type != b->record_type)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Record type %u != %u\n", a->record_type, b->record_type);
+    return GNUNET_NO;
+  }
+  if ((a->expiration_time != b->expiration_time) &&
+      ((a->expiration_time != 0) && (b->expiration_time != 0)))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Expiration time %llu != %llu\n",
+         (unsigned long long) a->expiration_time,
+         (unsigned long long) b->expiration_time);
+    return GNUNET_NO;
+  }
+  if ((a->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS)
+      != (b->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Flags %u (%u) != %u (%u)\n", a->flags,
+         a->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS, b->flags,
+         b->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS);
+    return GNUNET_NO;
+  }
+  if (a->data_size != b->data_size)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Data size %llu != %llu\n",
+         (unsigned long long) a->data_size,
+         (unsigned long long) b->data_size);
+    return GNUNET_NO;
+  }
+  if (0 != memcmp (a->data, b->data, a->data_size))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Data contents do not match\n");
+    return GNUNET_NO;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Records are equal\n");
+  return GNUNET_YES;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min)
+{
+  struct GNUNET_TIME_Absolute expire;
+  struct GNUNET_TIME_Absolute at;
+  struct GNUNET_TIME_Relative rt;
+  struct GNUNET_TIME_Absolute at_shadow;
+  struct GNUNET_TIME_Relative rt_shadow;
+
+  if (0 == rd_count)
+    return GNUNET_TIME_absolute_max (GNUNET_TIME_UNIT_ZERO_ABS, min);
+  expire = GNUNET_TIME_UNIT_FOREVER_ABS;
+  for (unsigned int c = 0; c < rd_count; c++)
+  {
+    if (0 != (rd[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    {
+      rt.rel_value_us = rd[c].expiration_time;
+      at = GNUNET_TIME_relative_to_absolute (rt);
+    }
+    else
+    {
+      at.abs_value_us = rd[c].expiration_time;
+    }
+
+    for (unsigned int c2 = 0; c2 < rd_count; c2++)
+    {
+      /* Check for shadow record */
+      if ((c == c2) ||
+          (rd[c].record_type != rd[c2].record_type) ||
+          (0 == (rd[c2].flags & GNUNET_GNSRECORD_RF_SHADOW)))
+        continue;
+      /* We have a shadow record */
+      if (0 != (rd[c2].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+      {
+        rt_shadow.rel_value_us = rd[c2].expiration_time;
+        at_shadow = GNUNET_TIME_relative_to_absolute (rt_shadow);
+      }
+      else
+      {
+        at_shadow.abs_value_us = rd[c2].expiration_time;
+      }
+      at = GNUNET_TIME_absolute_max (at,
+                                     at_shadow);
+    }
+    expire = GNUNET_TIME_absolute_min (at,
+                                       expire);
+  }
+  expire = GNUNET_TIME_absolute_max (expire, min);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Determined expiration time for block with %u records to be %s\n",
+       rd_count,
+       GNUNET_STRINGS_absolute_time_to_string (expire));
+  return expire;
+}
+
+
+/**
+ * Test if a given record is expired.
+ *
+ * @return #GNUNET_YES if the record is expired,
+ *         #GNUNET_NO if not
+ */
+int
+GNUNET_GNSRECORD_is_expired (const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_TIME_Absolute at;
+
+  if (0 != (rd->flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    return GNUNET_NO;
+  at.abs_value_us = rd->expiration_time;
+  return (0 == GNUNET_TIME_absolute_get_remaining (at).rel_value_us) ?
+         GNUNET_YES : GNUNET_NO;
+}
+
+
+/**
+ * Convert public key to the respective absolute domain name in the
+ * ".zkey" pTLD.
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param pkey a public key with a point on the eliptic curve
+ * @return string "X.zkey" where X is the public
+ *         key in an encoding suitable for DNS labels.
+ */
+const char *
+GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_CRYPTO_PublicKey *pkey)
+{
+  static char ret[128];
+  char *pkeys;
+
+  pkeys = GNUNET_CRYPTO_public_key_to_string (pkey);
+  GNUNET_snprintf (ret,
+                   sizeof(ret),
+                   "%s",
+                   pkeys);
+  GNUNET_free (pkeys);
+  return ret;
+}
+
+
+/**
+ * Convert an absolute domain name to the
+ * respective public key.
+ *
+ * @param zkey string encoding the coordinates of the public
+ *         key in an encoding suitable for DNS labels.
+ * @param pkey set to a public key on the eliptic curve
+ * @return #GNUNET_SYSERR if @a zkey has the wrong syntax
+ */
+int
+GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
+                               struct GNUNET_CRYPTO_PublicKey *pkey)
+{
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_public_key_from_string (zkey,
+                                            pkey))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_identity_from_data (const char *data,
+                                     size_t data_size,
+                                     uint32_t type,
+                                     struct GNUNET_CRYPTO_PublicKey *key)
+{
+  if (GNUNET_NO == GNUNET_GNSRECORD_is_zonekey_type (type))
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey))
+      return GNUNET_SYSERR;
+    memcpy (&key->ecdsa_key, data, data_size);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EddsaPublicKey))
+      return GNUNET_SYSERR;
+    memcpy (&key->eddsa_key, data, data_size);
+    break;
+  default:
+    return GNUNET_NO;
+  }
+  key->type = htonl (type);
+
+  return GNUNET_YES;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_data_from_identity (const struct
+                                     GNUNET_CRYPTO_PublicKey *key,
+                                     char **data,
+                                     size_t *data_size,
+                                     uint32_t *type)
+{
+  char *tmp;
+  *type = ntohl (key->type);
+  *data_size = GNUNET_CRYPTO_public_key_get_length (key) - sizeof (key->type);
+  if (0 == *data_size)
+    return GNUNET_SYSERR;
+  tmp = GNUNET_malloc (*data_size);
+  memcpy (tmp, ((char*) key) + sizeof (key->type), *data_size);
+  *data = tmp;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_zonekey_type (uint32_t type)
+{
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    return GNUNET_YES;
+  default:
+    return GNUNET_NO;
+  }
+}
+
+
+size_t
+GNUNET_GNSRECORD_block_get_size (const struct GNUNET_GNSRECORD_Block *block)
+{
+  return ntohl (block->size);
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_GNSRECORD_block_get_expiration (const struct
+                                       GNUNET_GNSRECORD_Block *block)
+{
+
+  switch (ntohl (block->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    return GNUNET_TIME_absolute_ntoh (block->ecdsa_block.expiration_time);
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    return GNUNET_TIME_absolute_ntoh (block->eddsa_block.expiration_time);
+  default:
+    GNUNET_break (0); /* Hopefully we never get here, but we might */
+  }
+  return GNUNET_TIME_absolute_get_zero_ ();
+
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_query_from_block (const struct GNUNET_GNSRECORD_Block *block,
+                                   struct GNUNET_HashCode *query)
+{
+  switch (ntohl (block->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    GNUNET_CRYPTO_hash (&(block->ecdsa_block.derived_key),
+                        sizeof (block->ecdsa_block.derived_key),
+                        query);
+    return GNUNET_OK;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    GNUNET_CRYPTO_hash (&block->eddsa_block.derived_key,
+                        sizeof (block->eddsa_block.derived_key),
+                        query);
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_SYSERR;
+
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_record_to_identity_key (const struct GNUNET_GNSRECORD_Data *rd,
+                                         struct GNUNET_CRYPTO_PublicKey *key)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got record of type %u\n",
+              rd->record_type);
+  switch (rd->record_type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    key->type = htonl (rd->record_type);
+    memcpy (&key->ecdsa_key, rd->data, sizeof (key->ecdsa_key));
+    return GNUNET_OK;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    key->type = htonl (rd->record_type);
+    memcpy (&key->eddsa_key, rd->data, sizeof (key->eddsa_key));
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_SYSERR;
+
+
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct
+                                       GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *
+                                       rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *expiry,
+                                       enum GNUNET_GNSRECORD_Filter filter,
+                                       char **emsg)
+{
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute minimum_expiration;
+  int have_zone_delegation = GNUNET_NO;
+  int have_gns2dns = GNUNET_NO;
+  int have_other = GNUNET_NO;
+  int have_redirect = GNUNET_NO;
+  int have_empty_label = (0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, label));
+  unsigned int rd_count_tmp;
+
+  minimum_expiration = GNUNET_TIME_UNIT_ZERO_ABS;
+  now = GNUNET_TIME_absolute_get ();
+  rd_count_tmp = 0;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    /* Ignore private records for public record set */
+    if ((0 != (filter & GNUNET_GNSRECORD_FILTER_OMIT_PRIVATE)) &&
+        (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Filtering private record filter=%u...\n", filter);
+      continue;
+    }
+    /* Skip expired records */
+    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
+        (rd[i].expiration_time < now.abs_value_us))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Filtering expired record...\n");
+      continue;    /* record already expired, skip it */
+    }
+    /* Ignore the maintenance record (e.g. tombstone) unless filter permits explicitly.
+    * Remember expiration time. */
+    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_MAINTENANCE))
+    {
+      if (0 != (filter & GNUNET_GNSRECORD_FILTER_INCLUDE_MAINTENANCE))
+      {
+        rd_public[rd_count_tmp] = rd[i];
+        rd_count_tmp++;
+      }
+      continue;
+    }
+    /* No NICK records unless empty label */
+    if (have_empty_label &&
+        (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type))
+      continue;
+
+    /**
+     * Check for delegation and redirect consistency.
+     * Note that we check for consistency BEFORE we filter for
+     * private records ON PURPOSE.
+     * We also want consistent record sets in our local zone(s).
+     * The only exception is the tombstone (above) which we ignore
+     * for the consistency check(s).
+     * FIXME: What about shadow records? Should we ignore them?
+     */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
+    {
+      /* No delegation records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record set contains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_zone_delegation = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[i].record_type)
+    {
+      if (GNUNET_YES == have_redirect)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Multiple REDIRECT records."));
+        return GNUNET_SYSERR;
+
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set contains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      /* No redirection records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      have_redirect = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_GNS2DNS == rd[i].record_type)
+    {
+      /* No gns2dns records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex.."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_zone_delegation))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set contains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_gns2dns = GNUNET_YES;
+    }
+    else
+    {
+      /* Some other record.
+       * Not allowed for zone delegations or redirections */
+      if ((GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_other = GNUNET_YES;
+    }
+
+    rd_public[rd_count_tmp] = rd[i];
+    /* Make sure critical record types are marked as such */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_critical (rd[i].record_type))
+      rd_public[rd_count_tmp].flags |= GNUNET_GNSRECORD_RF_CRITICAL;
+    rd_count_tmp++;
+  }
+
+  *expiry = GNUNET_GNSRECORD_record_get_expiration_time (rd_count_tmp,
+                                                         rd_public,
+                                                         minimum_expiration);
+  *rd_count_public = rd_count_tmp;
+  return GNUNET_OK;
+}
+
+
+/* end of gnsrecord_misc.c */
diff --git a/src/lib/gnsrecord/gnsrecord_pow.c b/src/lib/gnsrecord/gnsrecord_pow.c
new file mode 100644
index 000000000..a40dd7802
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord_pow.c
@@ -0,0 +1,462 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013, 2016 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+
+/**
+ * @brief API for proof of work
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_signatures.h"
+#include "gnunet_protocols.h"
+#include <inttypes.h>
+
+/**
+ * Helper struct that holds a found pow nonce
+ * and the corresponding number of leading zeros.
+ */
+struct BestPow
+{
+  /**
+   * PoW nonce
+   */
+  uint64_t pow;
+
+  /**
+   * Corresponding zero bits in hash
+   */
+  unsigned int bits;
+};
+
+
+/**
+ * The handle to a PoW calculation.
+ * Used in iterative PoW rounds.
+ */
+struct GNUNET_GNSRECORD_PowCalculationHandle
+{
+  /**
+   * Current set of found PoWs
+   */
+  struct BestPow best[POW_COUNT];
+
+  /**
+   * The final PoW result data structure.
+   */
+  struct GNUNET_GNSRECORD_PowP *pow;
+
+  /**
+   * The current nonce to try
+   */
+  uint64_t current_pow;
+
+  /**
+   * Epochs how long the PoW should be valid.
+   * This is added on top of the difficulty in the PoW.
+   */
+  unsigned int epochs;
+
+  /**
+   * The difficulty (leading zeros) to achieve.
+   */
+  unsigned int difficulty;
+
+};
+
+static struct GNUNET_CRYPTO_PowSalt salt = { "GnsRevocationPow" };
+
+/**
+ * Calculate the average zeros in the pows.
+ *
+ * @param ph the PowHandle
+ * @return the average number of zeros.
+ */
+static unsigned int
+calculate_score (const struct GNUNET_GNSRECORD_PowCalculationHandle *ph)
+{
+  double sum = 0.0;
+  for (unsigned int j = 0; j<POW_COUNT; j++)
+    sum += ph->best[j].bits;
+  double avg = sum / POW_COUNT;
+  return avg;
+}
+
+
+struct GNUNET_GNSRECORD_SignaturePurposePS *
+GNR_create_signature_message (const struct GNUNET_GNSRECORD_PowP *pow)
+{
+  struct GNUNET_GNSRECORD_SignaturePurposePS *spurp;
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+  size_t ksize;
+
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
+  spurp = GNUNET_malloc (sizeof (*spurp) + ksize);
+  spurp->timestamp = pow->timestamp;
+  spurp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_REVOCATION);
+  spurp->purpose.size = htonl (sizeof(*spurp) + ksize);
+  GNUNET_CRYPTO_write_public_key_to_buffer (pk,
+                                            (char*) &spurp[1],
+                                            ksize);
+  return spurp;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_signature_identity (const struct GNUNET_GNSRECORD_PowP *pow,
+                          const struct GNUNET_CRYPTO_PublicKey *key)
+{
+  struct GNUNET_GNSRECORD_SignaturePurposePS *spurp;
+  unsigned char *sig;
+  size_t ksize;
+  int ret;
+
+  ksize = GNUNET_CRYPTO_public_key_get_length (key);
+  spurp = GNR_create_signature_message (pow);
+  sig = ((unsigned char*) &pow[1] + ksize);
+  ret =
+    GNUNET_CRYPTO_signature_verify_raw_ (
+      GNUNET_SIGNATURE_PURPOSE_GNS_REVOCATION,
+      &spurp->purpose,
+      sig,
+      key);
+  GNUNET_free (spurp);
+  return ret == GNUNET_OK ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_signature (const struct GNUNET_GNSRECORD_PowP *pow)
+{
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+  return check_signature_identity (pow, pk);
+}
+
+
+/**
+ * Check if the given proof-of-work is valid.
+ *
+ * @param pow proof of work
+ * @param difficulty how many bits must match (configuration) LSD0001: D
+ * @param epoch_duration length of single epoch in configuration
+ * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_check_pow (const struct GNUNET_GNSRECORD_PowP *pow,
+                            unsigned int difficulty,
+                            struct GNUNET_TIME_Relative epoch_duration)
+{
+  char buf[sizeof(struct GNUNET_CRYPTO_PublicKey)
+           + sizeof (struct GNUNET_TIME_AbsoluteNBO)
+           + sizeof (uint64_t)] GNUNET_ALIGN;
+  struct GNUNET_HashCode result;
+  struct GNUNET_TIME_Absolute ts;
+  struct GNUNET_TIME_Absolute exp;
+  struct GNUNET_TIME_Relative ttl;
+  struct GNUNET_TIME_Relative buffer;
+  /* LSD0001: D' */
+  unsigned int score = 0;
+  unsigned int tmp_score = 0;
+  unsigned int epochs;
+  uint64_t pow_val;
+  ssize_t pklen;
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+
+  /**
+   * Check if signature valid
+   */
+  if (GNUNET_OK != check_signature (pow))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Proof of work signature invalid!\n");
+    return GNUNET_SYSERR;
+  }
+
+  /**
+   * First, check if PoW set is strictly monotically increasing
+   */
+  for (unsigned int i = 0; i < POW_COUNT - 1; i++)
+  {
+    if (GNUNET_ntohll (pow->pow[i]) >= GNUNET_ntohll (pow->pow[i + 1]))
+      return GNUNET_NO;
+  }
+  GNUNET_memcpy (&buf[sizeof(uint64_t)],
+                 &pow->timestamp,
+                 sizeof (uint64_t));
+  pklen = GNUNET_CRYPTO_public_key_get_length (pk);
+  if (0 > pklen)
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+  GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
+                 pk,
+                 pklen);
+  for (unsigned int i = 0; i < POW_COUNT; i++)
+  {
+    pow_val = GNUNET_ntohll (pow->pow[i]);
+    GNUNET_memcpy (buf, &pow->pow[i], sizeof(uint64_t));
+    GNUNET_CRYPTO_pow_hash (&salt,
+                            buf,
+                            sizeof(buf),
+                            &result);
+    tmp_score = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Score %u with %" PRIu64 " (#%u)\n",
+                tmp_score, pow_val, i);
+
+    score += tmp_score;
+
+  }
+  score = score / POW_COUNT;
+  if (score < difficulty)
+    return GNUNET_NO;
+  /* LSD0001: (D'-D+1) */
+  epochs = score - difficulty + 1;
+
+  /**
+   * Check expiration
+   */
+  ts = GNUNET_TIME_absolute_ntoh (pow->timestamp);
+  ttl = GNUNET_TIME_relative_multiply (epoch_duration,
+                                       epochs);
+  /**
+   * Extend by 10% for unsynchronized clocks
+   */
+  buffer = GNUNET_TIME_relative_divide (epoch_duration,
+                                        10);
+  exp = GNUNET_TIME_absolute_add (ts, ttl);
+  exp = GNUNET_TIME_absolute_add (exp,
+                                  buffer);
+
+  if (0 != GNUNET_TIME_absolute_get_remaining (ts).rel_value_us)
+    return GNUNET_NO; /* Not yet valid. */
+  /* Revert to actual start time */
+  ts = GNUNET_TIME_absolute_add (ts,
+                                 buffer);
+
+  if (0 == GNUNET_TIME_absolute_get_remaining (exp).rel_value_us)
+    return GNUNET_NO; /* expired */
+  return GNUNET_YES;
+}
+
+
+enum GNUNET_GenericReturnValue
+sign_pow_identity (const struct GNUNET_CRYPTO_PrivateKey *key,
+                   struct GNUNET_GNSRECORD_PowP *pow)
+{
+  struct GNUNET_TIME_Absolute ts = GNUNET_TIME_absolute_get ();
+  struct GNUNET_GNSRECORD_SignaturePurposePS *rp;
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+  size_t ksize;
+  char *sig;
+
+  /**
+   * Predate the validity period to prevent rejections due to
+   * unsynchronized clocks
+   */
+  ts = GNUNET_TIME_absolute_subtract (ts,
+                                      GNUNET_TIME_UNIT_WEEKS);
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
+  pow->timestamp = GNUNET_TIME_absolute_hton (ts);
+  rp = GNR_create_signature_message (pow);
+  sig = ((char*) &pow[1]) + ksize;
+  int result = GNUNET_CRYPTO_sign_raw_ (key,
+                                        &rp->purpose,
+                                        (void*) sig);
+  GNUNET_free (rp);
+  if (result == GNUNET_SYSERR)
+    return GNUNET_NO;
+  else
+    return result;
+}
+
+
+enum GNUNET_GenericReturnValue
+sign_pow (const struct GNUNET_CRYPTO_PrivateKey *key,
+          struct GNUNET_GNSRECORD_PowP *pow)
+{
+  struct GNUNET_CRYPTO_PublicKey *pk;
+
+  pk = (struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+  GNUNET_CRYPTO_key_get_public (key, pk);
+  return sign_pow_identity (key, pow);
+}
+
+
+/**
+ * Initializes a fresh PoW computation.
+ *
+ * @param key the key to calculate the PoW for.
+ * @param[out] pow starting point for PoW calculation (not yet valid)
+ */
+void
+GNUNET_GNSRECORD_pow_init (const struct GNUNET_CRYPTO_PrivateKey *key,
+                           struct GNUNET_GNSRECORD_PowP *pow)
+{
+  GNUNET_assert (GNUNET_OK == sign_pow (key, pow));
+}
+
+
+struct GNUNET_GNSRECORD_PowCalculationHandle*
+GNUNET_GNSRECORD_pow_start (struct GNUNET_GNSRECORD_PowP *pow,
+                            int epochs,
+                            unsigned int difficulty)
+{
+  struct GNUNET_GNSRECORD_PowCalculationHandle *pc;
+  struct GNUNET_TIME_Relative ttl;
+
+
+  pc = GNUNET_new (struct GNUNET_GNSRECORD_PowCalculationHandle);
+  pc->pow = pow;
+  ttl = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS,
+                                       epochs);
+  pc->pow->ttl = GNUNET_TIME_relative_hton (ttl);
+  pc->current_pow = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                              UINT64_MAX);
+  pc->difficulty = difficulty;
+  pc->epochs = epochs;
+  return pc;
+}
+
+
+/**
+ * Comparison function for quicksort
+ *
+ * @param a left element
+ * @param b right element
+ * @return a-b
+ */
+static int
+cmp_pow_value (const void *a, const void *b)
+{
+  return (GNUNET_ntohll (*(uint64_t*) a) - GNUNET_ntohll (*(uint64_t*) b));
+}
+
+
+/**
+ * Calculate a key revocation valid for broadcasting for a number
+ * of epochs.
+ *
+ * @param pc handle to the PoW, initially called with NULL.
+ * @param epochs number of epochs for which the revocation must be valid.
+ * @param pow current pow value to try
+ * @param difficulty current base difficulty to achieve
+ * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_pow_round (struct GNUNET_GNSRECORD_PowCalculationHandle *pc)
+{
+  char buf[sizeof(struct GNUNET_CRYPTO_PublicKey)
+           + sizeof (uint64_t)
+           + sizeof (uint64_t)] GNUNET_ALIGN;
+  struct GNUNET_HashCode result;
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+  unsigned int zeros;
+  int ret;
+  uint64_t pow_nbo;
+  ssize_t ksize;
+
+  pc->current_pow++;
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &(pc->pow[1]);
+
+  /**
+   * Do not try duplicates
+   */
+  for (unsigned int i = 0; i < POW_COUNT; i++)
+    if (pc->current_pow == pc->best[i].pow)
+      return GNUNET_NO;
+  pow_nbo = GNUNET_htonll (pc->current_pow);
+  GNUNET_memcpy (buf, &pow_nbo, sizeof(uint64_t));
+  GNUNET_memcpy (&buf[sizeof(uint64_t)],
+                 &pc->pow->timestamp,
+                 sizeof (uint64_t));
+  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
+  GNUNET_assert (0 < ksize);
+  GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
+                 pk,
+                 ksize);
+  GNUNET_CRYPTO_pow_hash (&salt,
+                          buf,
+                          sizeof(buf),
+                          &result);
+  zeros = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
+  for (unsigned int i = 0; i < POW_COUNT; i++)
+  {
+    if (pc->best[i].bits < zeros)
+    {
+      pc->best[i].bits = zeros;
+      pc->best[i].pow = pc->current_pow;
+      pc->pow->pow[i] = pow_nbo;
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "New best score %u with %" PRIu64 " (#%u)\n",
+                  zeros, pc->current_pow, i);
+
+      break;
+    }
+  }
+  ret = calculate_score (pc) >= pc->difficulty + pc->epochs ? GNUNET_YES :
+        GNUNET_NO;
+  if (GNUNET_YES == ret)
+  {
+    /* Sort POWs) */
+    qsort (pc->pow->pow, POW_COUNT, sizeof (uint64_t), &cmp_pow_value);
+  }
+  return ret;
+}
+
+
+size_t
+GNUNET_GNSRECORD_proof_get_size (const struct GNUNET_GNSRECORD_PowP *pow)
+{
+  size_t size;
+  size_t ksize;
+  const struct GNUNET_CRYPTO_PublicKey *pk;
+
+  size = sizeof (struct GNUNET_GNSRECORD_PowP);
+  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
+  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
+  size += ksize;
+  size += GNUNET_CRYPTO_signature_get_raw_length_by_type (pk->type);
+  return size;
+}
+
+
+/**
+ * Stop a PoW calculation
+ *
+ * @param pc the calculation to clean up
+ * @return #GNUNET_YES if pow valid, #GNUNET_NO if pow was set but is not
+ * valid
+ */
+void
+GNUNET_GNSRECORD_pow_stop (struct GNUNET_GNSRECORD_PowCalculationHandle *pc)
+{
+  GNUNET_free (pc);
+}
+
+
diff --git a/src/lib/gnsrecord/gnsrecord_serialization.c b/src/lib/gnsrecord/gnsrecord_serialization.c
new file mode 100644
index 000000000..053edfd33
--- /dev/null
+++ b/src/lib/gnsrecord/gnsrecord_serialization.c
@@ -0,0 +1,302 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/gnsrecord_serialization.c
+ * @brief API to serialize and deserialize GNS records
+ * @author Martin Schanzenbach
+ * @author Matthias Wachs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_signatures.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
+
+/**
+ * Set to 1 to check that all records are well-formed (can be converted
+ * to string) during serialization/deserialization.
+ */
+#define DEBUG_GNSRECORDS 0
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+
+/**
+ * Internal format of a record in the serialized form.
+ */
+struct NetworkRecord
+{
+  /**
+   * Expiration time for the DNS record; relative or absolute depends
+   * on @e flags, network byte order.
+   */
+  uint64_t expiration_time GNUNET_PACKED;
+
+  /**
+   * Number of bytes in 'data', network byte order.
+   */
+  uint16_t data_size GNUNET_PACKED;
+
+  /**
+   * Flags for the record, network byte order.
+   */
+  uint16_t flags GNUNET_PACKED;
+
+  /**
+   * Type of the GNS/DNS record, network byte order.
+   */
+  uint32_t record_type GNUNET_PACKED;
+
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+ssize_t
+GNUNET_GNSRECORD_records_get_size (unsigned int rd_count,
+                                   const struct GNUNET_GNSRECORD_Data *rd)
+{
+  size_t ret;
+
+  if (0 == rd_count)
+    return 0;
+
+  ret = sizeof(struct NetworkRecord) * rd_count;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    if ((ret + rd[i].data_size) < ret)
+    {
+      GNUNET_break (0);
+      return -1;
+    }
+    ret += rd[i].data_size;
+#if DEBUG_GNSRECORDS
+    {
+      char *str;
+
+      str = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
+                                              rd[i].data,
+                                              rd[i].data_size);
+      if (NULL == str)
+      {
+        GNUNET_break_op (0);
+        return -1;
+      }
+      GNUNET_free (str);
+    }
+#endif
+  }
+  if (ret > SSIZE_MAX)
+  {
+    GNUNET_break (0);
+    return -1;
+  }
+  // Do not pad PKEY
+  if ((GNUNET_GNSRECORD_TYPE_PKEY == rd->record_type) ||
+      (GNUNET_GNSRECORD_TYPE_EDKEY == rd->record_type))
+    return ret;
+  /**
+   * Efficiently round up to the next
+   * power of 2 for padding
+   * https://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
+   */ret--;
+  ret |= ret >> 1;
+  ret |= ret >> 2;
+  ret |= ret >> 4;
+  ret |= ret >> 8;
+  ret |= ret >> 16;
+  ret++;
+  return (ssize_t) ret;
+}
+
+
+ssize_t
+GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
+                                    const struct GNUNET_GNSRECORD_Data *rd,
+                                    size_t dest_size,
+                                    char *dest)
+{
+  struct NetworkRecord rec;
+  size_t off;
+
+  off = 0;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Serializing record %u with flags %d and expiration time %llu\n",
+         i,
+         rd[i].flags,
+         (unsigned long long) rd[i].expiration_time);
+    rec.expiration_time = GNUNET_htonll (rd[i].expiration_time);
+    rec.data_size = htons ((uint16_t) rd[i].data_size);
+    rec.record_type = htonl (rd[i].record_type);
+    rec.flags = htons (rd[i].flags);
+    if ((off + sizeof(rec) > dest_size) ||
+        (off + sizeof(rec) < off))
+    {
+      GNUNET_break (0);
+      return -1;
+    }
+    GNUNET_memcpy (&dest[off],
+                   &rec,
+                   sizeof(rec));
+    off += sizeof(rec);
+    if ((off + rd[i].data_size > dest_size) ||
+        (off + rd[i].data_size < off))
+    {
+      GNUNET_break (0);
+      return -1;
+    }
+    GNUNET_memcpy (&dest[off],
+                   rd[i].data,
+                   rd[i].data_size);
+    off += rd[i].data_size;
+#if DEBUG_GNSRECORDS
+    {
+      char *str;
+
+      str = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
+                                              rd[i].data,
+                                              rd[i].data_size);
+      if (NULL == str)
+      {
+        GNUNET_break_op (0);
+        return -1;
+      }
+      GNUNET_free (str);
+    }
+#endif
+  }
+  memset (&dest[off],
+          0,
+          dest_size - off);
+  return dest_size;
+}
+
+unsigned int
+GNUNET_GNSRECORD_records_deserialize_get_size (size_t len,
+                                               const char *src)
+{
+  struct NetworkRecord rec;
+  struct NetworkRecord rec_zero;
+  size_t off;
+  unsigned int rd_count = 0;
+
+  memset (&rec_zero, 0, sizeof (rec_zero));
+
+  off = 0;
+  for (off = 0; (off + sizeof(rec) <= len) && (off + sizeof(rec) >= off);)
+  {
+    GNUNET_memcpy (&rec,
+                   &src[off],
+                   sizeof(rec));
+    /*
+     * If we have found a byte string of zeroes, we have reached
+     * the padding
+     */
+    if (0 == GNUNET_memcmp (&rec, &rec_zero))
+      break;
+    off += sizeof(rec);
+    if ((off + ntohs ((uint16_t) rec.data_size) > len) ||
+        (off + ntohs ((uint16_t) rec.data_size) < off))
+    {
+      GNUNET_break_op (0);
+      return 0;
+    }
+    off += ntohs ((uint16_t) rec.data_size);
+    rd_count++;
+  }
+  return rd_count;
+}
+
+/**
+ * Deserialize the given records to the given destination.
+ *
+ * @param len size of the serialized record data
+ * @param src the serialized record data
+ * @param rd_count number of records parsed
+ * @param dest where to put the data
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+int
+GNUNET_GNSRECORD_records_deserialize (size_t len,
+                                      const char *src,
+                                      unsigned int rd_count,
+                                      struct GNUNET_GNSRECORD_Data *dest)
+{
+  struct NetworkRecord rec;
+  size_t off;
+
+  off = 0;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    if ((off + sizeof(rec) > len) ||
+        (off + sizeof(rec) < off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_memcpy (&rec,
+                   &src[off],
+                   sizeof(rec));
+    dest[i].expiration_time = GNUNET_ntohll (rec.expiration_time);
+    dest[i].data_size = ntohs ((uint16_t) rec.data_size);
+    dest[i].record_type = ntohl (rec.record_type);
+    dest[i].flags = ntohs (rec.flags);
+    off += sizeof(rec);
+    if ((off + dest[i].data_size > len) ||
+        (off + dest[i].data_size < off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    dest[i].data = &src[off];
+    off += dest[i].data_size;
+#if GNUNET_EXTRA_LOGGING
+    {
+      char *str;
+
+      str = GNUNET_GNSRECORD_value_to_string (dest[i].record_type,
+                                              dest[i].data,
+                                              dest[i].data_size);
+      if (NULL == str)
+      {
+        GNUNET_break_op (0);
+        return GNUNET_SYSERR;
+      }
+      GNUNET_free (str);
+    }
+#endif
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Deserialized record %u with flags %d and expiration time %llu\n",
+         i,
+         dest[i].flags,
+         (unsigned long long) dest[i].expiration_time);
+  }
+  return GNUNET_OK;
+}
+
+
+/* end of gnsrecord_serialization.c */
diff --git a/src/lib/gnsrecord/gnunet-gnsrecord-tvg.c b/src/lib/gnsrecord/gnunet-gnsrecord-tvg.c
new file mode 100644
index 000000000..746e95c32
--- /dev/null
+++ b/src/lib/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -0,0 +1,539 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2020 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/gnunet-gns-tvg.c
+ * @brief Generate test vectors for GNS.
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_signatures.h"
+#include "gnunet_gns_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnsrecord_crypto.h"
+#include <inttypes.h>
+
+
+static char *d_pkey =
+  "50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
+
+static char *d_edkey =
+  "5af7020ee19160328832352bbc6a68a8d71a7cbe1b929969a7c66d415a0d8f65";
+
+
+static int
+parsehex (char *src, char *dst, size_t dstlen, int invert)
+{
+  char *line = src;
+  char *data = line;
+  int off;
+  int read_byte;
+  int data_len = 0;
+
+  while (sscanf (data, " %02x%n", &read_byte, &off) == 1)
+  {
+    if (invert)
+      dst[dstlen - 1 - data_len++] = read_byte;
+    else
+      dst[data_len++] = read_byte;
+    data += off;
+  }
+  return data_len;
+}
+
+
+static void
+print_bytes_ (void *buf,
+              size_t buf_len,
+              int fold,
+              int in_be)
+{
+  int i;
+
+  for (i = 0; i < buf_len; i++)
+  {
+    if (0 != i)
+    {
+      if ((0 != fold) && (i % fold == 0))
+        printf ("\n  ");
+      else
+        printf (" ");
+    }
+    else
+    {
+      printf ("  ");
+    }
+    if (in_be)
+      printf ("%02x", ((unsigned char*) buf)[buf_len - 1 - i]);
+    else
+      printf ("%02x", ((unsigned char*) buf)[i]);
+  }
+  printf ("\n");
+}
+
+
+static void
+print_bytes (void *buf,
+             size_t buf_len,
+             int fold)
+{
+  print_bytes_ (buf, buf_len, fold, 0);
+}
+
+
+static void
+print_record (const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_TIME_Relative rt;
+  struct GNUNET_TIME_Absolute at;
+  uint16_t flags = htons (rd->flags);
+  uint64_t abs_nbo = GNUNET_htonll (rd->expiration_time);
+  uint16_t size_nbo = htons (rd->data_size);
+  uint32_t type_nbo = htonl (rd->record_type);
+  at.abs_value_us = GNUNET_ntohll (abs_nbo);
+  if (0 != (rd->flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+  {
+    rt.rel_value_us = rd->expiration_time;
+    at = GNUNET_TIME_relative_to_absolute (rt);
+    abs_nbo = GNUNET_htonll (at.abs_value_us);
+  }
+  printf ("  EXPIRATION: %" PRIu64 " us\n", rd->expiration_time);
+  print_bytes (&abs_nbo, sizeof (abs_nbo), 8);
+  printf ("\n  DATA_SIZE:\n");
+  print_bytes (&size_nbo, sizeof (size_nbo), 8);
+  printf ("\n  TYPE:\n");
+  print_bytes (&type_nbo, sizeof (type_nbo), 8);
+  printf ("\n  FLAGS: ");
+  print_bytes ((void*) &flags, sizeof (flags), 8);
+  printf ("\n");
+  fprintf (stdout,
+           "  DATA:\n");
+  print_bytes ((char*) rd->data, rd->data_size, 8);
+  printf ("\n");
+}
+
+
+/**
+ * Main function that will be run.
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run_pkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char *label)
+{
+  struct GNUNET_TIME_Absolute expire;
+  struct GNUNET_GNSRECORD_Block *rrblock;
+  char *bdata;
+  struct GNUNET_CRYPTO_PrivateKey id_priv;
+  struct GNUNET_CRYPTO_PublicKey id_pub;
+  struct GNUNET_CRYPTO_PrivateKey pkey_data_p;
+  struct GNUNET_CRYPTO_PublicKey pkey_data;
+  struct GNUNET_HashCode query;
+  char *rdata;
+  char *conv_lbl;
+  size_t rdata_size;
+  char ztld[128];
+  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
+  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
+
+  id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
+  parsehex (d_pkey,
+            (char*) &id_priv.ecdsa_key,
+            sizeof (id_priv.ecdsa_key), 1);
+
+  GNUNET_CRYPTO_key_get_public (&id_priv,
+                                  &id_pub);
+  printf ("Zone private key (d, big-endian):\n");
+  print_bytes_ (&id_priv.ecdsa_key,
+                sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey), 8, 1);
+  printf ("\n");
+  printf ("Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_CRYPTO_public_key_get_length (&id_pub));
+  print_bytes (&id_pub, GNUNET_CRYPTO_public_key_get_length (&id_pub), 8);
+  GNUNET_STRINGS_data_to_string (&id_pub,
+                                 GNUNET_CRYPTO_public_key_get_length (
+                                   &id_pub),
+                                 ztld,
+                                 sizeof (ztld));
+  printf ("\n");
+  printf ("zTLD:\n");
+  printf ("%s\n", ztld);
+  printf ("\n");
+
+  pkey_data_p.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&pkey_data_p.ecdsa_key);
+  GNUNET_CRYPTO_key_get_public (&pkey_data_p,
+                                  &pkey_data);
+  conv_lbl = GNUNET_GNSRECORD_string_normalize (label);
+  printf ("Label:\n");
+  print_bytes (conv_lbl, strlen (conv_lbl), 8);
+  GNUNET_free (conv_lbl);
+  printf ("\nNumber of records (integer): %d\n\n", rd_count);
+
+  for (int i = 0; i < rd_count; i++)
+  {
+    printf ("Record #%d := (\n", i);
+    print_record (&rd[i]);
+    printf (")\n\n");
+  }
+
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                  rd);
+  rdata = GNUNET_malloc (rdata_size);
+  GNUNET_GNSRECORD_records_serialize (rd_count,
+                                      rd,
+                                      (size_t) rdata_size,
+                                      rdata);
+  printf ("RDATA:\n");
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
+  printf ("\n");
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count, rd,
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
+  GNR_derive_block_aes_key (ctr,
+                            skey,
+                            label,
+                            GNUNET_TIME_absolute_hton (
+                              expire).abs_value_us__,
+                            &id_pub.ecdsa_key);
+
+  printf ("Encryption NONCE|EXPIRATION|BLOCK COUNTER:\n");
+  print_bytes (ctr, sizeof (ctr), 8);
+  printf ("\n");
+  printf ("Encryption key (K):\n");
+  print_bytes (skey, sizeof (skey), 8);
+  printf ("\n");
+  GNUNET_GNSRECORD_query_from_public_key (&id_pub,
+                                          label,
+                                          &query);
+  printf ("Storage key (q):\n");
+  print_bytes (&query, sizeof (query), 8);
+  printf ("\n");
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (&id_priv,
+                                                             expire,
+                                                             label,
+                                                             rd,
+                                                             rd_count,
+                                                             &rrblock));
+  struct GNUNET_CRYPTO_EcdsaPublicKey derived_key;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey *derived_privkey;
+
+  GNUNET_CRYPTO_ecdsa_public_key_derive (&id_pub.ecdsa_key,
+                                         label,
+                                         "gns",
+                                         &derived_key);
+  derived_privkey = GNUNET_CRYPTO_ecdsa_private_key_derive (&id_priv.ecdsa_key,
+                                                            label,
+                                                            "gns");
+  printf ("ZKDF(zkey):\n");
+  print_bytes (&derived_key, sizeof (derived_key), 8);
+  printf ("\n");
+  printf ("Derived private key (d', big-endian):\n");
+  print_bytes_ (derived_privkey, sizeof (*derived_privkey), 8, 1);
+  printf ("\n");
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
+
+  GNUNET_free (derived_privkey);
+
+  bdata = (char*) &(&rrblock->ecdsa_block)[1];
+  printf ("BDATA:\n");
+  print_bytes (bdata, bdata_size, 8);
+  printf ("\n");
+  printf ("RRBLOCK:\n");
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
+  printf ("\n");
+  GNUNET_free (rdata);
+}
+
+
+/**
+ * Main function that will be run.
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run_edkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char*label)
+{
+  struct GNUNET_TIME_Absolute expire;
+  struct GNUNET_GNSRECORD_Block *rrblock;
+  char *bdata;
+  struct GNUNET_CRYPTO_PrivateKey id_priv;
+  struct GNUNET_CRYPTO_PublicKey id_pub;
+  struct GNUNET_CRYPTO_PrivateKey pkey_data_p;
+  struct GNUNET_CRYPTO_PublicKey pkey_data;
+  struct GNUNET_HashCode query;
+  char *rdata;
+  char *conv_lbl;
+  size_t rdata_size;
+
+  char ztld[128];
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char skey[crypto_secretbox_KEYBYTES];
+
+  id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
+  GNUNET_CRYPTO_key_get_public (&id_priv,
+                                  &id_pub);
+
+  id_priv.type = htonl (GNUNET_PUBLIC_KEY_TYPE_EDDSA);
+  GNUNET_CRYPTO_eddsa_key_create (&id_priv.eddsa_key);
+  parsehex (d_edkey,
+            (char*) &id_priv.eddsa_key,
+            sizeof (id_priv.eddsa_key), 0);
+  GNUNET_CRYPTO_key_get_public (&id_priv,
+                                  &id_pub);
+  fprintf (stdout,
+           "Zone private key (d):\n");
+  print_bytes (&id_priv.eddsa_key, sizeof (struct
+                                           GNUNET_CRYPTO_EddsaPrivateKey), 8);
+  printf ("\n");
+  printf ("Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_CRYPTO_public_key_get_length (&id_pub));
+  print_bytes (&id_pub, GNUNET_CRYPTO_public_key_get_length (&id_pub), 8);
+  GNUNET_STRINGS_data_to_string (&id_pub,
+                                 GNUNET_CRYPTO_public_key_get_length (
+                                   &id_pub),
+                                 ztld,
+                                 sizeof (ztld));
+  printf ("\n");
+  printf ("zTLD:\n");
+  printf ("%s\n", ztld);
+  printf ("\n");
+
+  pkey_data_p.type = htonl (GNUNET_GNSRECORD_TYPE_EDKEY);
+  GNUNET_CRYPTO_eddsa_key_create (&pkey_data_p.eddsa_key);
+  GNUNET_CRYPTO_key_get_public (&pkey_data_p,
+                                  &pkey_data);
+  conv_lbl = GNUNET_GNSRECORD_string_normalize (label);
+  printf ("Label:\n");
+  print_bytes (conv_lbl, strlen (conv_lbl), 8);
+  GNUNET_free (conv_lbl);
+  fprintf (stdout,
+           "\nNumber of records (integer): %d\n\n", rd_count);
+
+  for (int i = 0; i < rd_count; i++)
+  {
+    printf ("Record #%d := (\n", i);
+    print_record (&rd[i]);
+    printf (")\n\n");
+  }
+
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                  rd);
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count,
+                                                        rd,
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
+  GNUNET_assert (0 < rdata_size);
+  rdata = GNUNET_malloc ((size_t) rdata_size);
+  GNUNET_GNSRECORD_records_serialize (rd_count,
+                                      rd,
+                                      (size_t) rdata_size,
+                                      rdata);
+  printf ("RDATA:\n");
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
+  printf ("\n");
+  GNR_derive_block_xsalsa_key (nonce,
+                               skey,
+                               label,
+                               GNUNET_TIME_absolute_hton (
+                                 expire).abs_value_us__,
+                               &id_pub.eddsa_key);
+  printf ("Encryption NONCE|EXPIRATION:\n");
+  print_bytes (nonce, sizeof (nonce), 8);
+  printf ("\n");
+  printf ("Encryption key (K):\n");
+  print_bytes (skey, sizeof (skey), 8);
+  printf ("\n");
+  GNUNET_GNSRECORD_query_from_public_key (&id_pub,
+                                          label,
+                                          &query);
+  printf ("Storage key (q):\n");
+  print_bytes (&query, sizeof (query), 8);
+  printf ("\n");
+
+  GNUNET_assert (GNUNET_OK ==  GNUNET_GNSRECORD_block_create (&id_priv,
+                                                              expire,
+                                                              label,
+                                                              rd,
+                                                              rd_count,
+                                                              &rrblock));
+
+  struct GNUNET_CRYPTO_EddsaPublicKey derived_key;
+  struct GNUNET_CRYPTO_EddsaPrivateScalar derived_privkey;
+  GNUNET_CRYPTO_eddsa_public_key_derive (&id_pub.eddsa_key,
+                                         label,
+                                         "gns",
+                                         &derived_key);
+  GNUNET_CRYPTO_eddsa_private_key_derive (&id_priv.eddsa_key,
+                                          label,
+                                          "gns", &derived_privkey);
+  printf ("ZKDF(zkey):\n");
+  print_bytes (&derived_key, sizeof (derived_key), 8);
+  printf ("\n");
+  printf ("nonce := SHA-256 (dh[32..63] || h):\n");
+  print_bytes (derived_privkey.s + 32, 32, 8);
+  printf ("\n");
+  char derived_privkeyNBO[32];
+  /* Convert from little endian */
+  for (size_t i = 0; i < 32; i++)
+    derived_privkeyNBO[i] = derived_privkey.s[31 - i];
+  printf ("Derived private key (d', big-endian):\n");
+  print_bytes (derived_privkeyNBO, sizeof (derived_privkeyNBO), 8);
+  printf ("\n");
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
+
+
+  bdata = (char*) &(&rrblock->eddsa_block)[1];
+  printf ("BDATA:\n");
+  print_bytes (bdata, bdata_size, 8);
+  printf ("\n");
+  printf ("RRBLOCK:\n");
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
+  printf ("\n");
+  GNUNET_free (rdata);
+}
+
+
+/**
+ * Main function that will be run.
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_GNSRECORD_Data rd_pkey;
+  struct GNUNET_GNSRECORD_Data rd[3];
+  struct GNUNET_TIME_Absolute exp1;
+  struct GNUNET_TIME_Absolute exp2;
+  struct GNUNET_TIME_Absolute exp3;
+  struct GNUNET_TIME_AbsoluteNBO exp1nbo;
+  struct GNUNET_TIME_AbsoluteNBO exp2nbo;
+  struct GNUNET_TIME_AbsoluteNBO exp3nbo;
+  size_t pkey_data_size;
+  size_t ip_data_size;
+  char *pkey_data;
+  char *ip_data;
+
+  /*
+   * Make different expiration times
+   */
+  parsehex ("001cee8c10e25980", (char*) &exp1nbo, sizeof (exp1nbo), 0);
+  parsehex ("003ff2aa5408db40", (char*) &exp2nbo, sizeof (exp2nbo), 0);
+  parsehex ("0028bb13ff371940", (char*) &exp3nbo, sizeof (exp3nbo), 0);
+  exp1 = GNUNET_TIME_absolute_ntoh (exp1nbo);
+  exp2 = GNUNET_TIME_absolute_ntoh (exp2nbo);
+  exp3 = GNUNET_TIME_absolute_ntoh (exp3nbo);
+
+  memset (&rd_pkey, 0, sizeof (struct GNUNET_GNSRECORD_Data));
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_GNSRECORD_TYPE_PKEY,
+                   "000G0011WESGZY9VRV9NNJ66W3GKNZFZF56BFD2BQF3MHMJST2G2GKDYGG",
+                   (void**) &pkey_data,
+                   &pkey_data_size));
+  rd_pkey.data = pkey_data;
+  rd_pkey.data_size = pkey_data_size;
+  rd_pkey.expiration_time = exp1.abs_value_us;
+  rd_pkey.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
+  rd_pkey.flags = GNUNET_GNSRECORD_RF_CRITICAL;
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_DNSPARSER_TYPE_AAAA,
+                   "::dead:beef",
+                   (void**) &ip_data,
+                   &ip_data_size));
+
+  rd[0].data = ip_data;
+  rd[0].data_size = ip_data_size;
+  rd[0].expiration_time = exp1.abs_value_us;
+  rd[0].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+  rd[0].flags = GNUNET_GNSRECORD_RF_NONE;
+
+  rd[1].data = "\u611b\u79f0";
+  rd[1].data_size = strlen (rd[1].data);
+  rd[1].expiration_time = exp2.abs_value_us;
+  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
+  rd[1].flags = GNUNET_GNSRECORD_RF_NONE;
+
+  rd[2].data = "Hello World";
+  rd[2].data_size = strlen (rd[2].data);
+  rd[2].expiration_time = exp3.abs_value_us;
+  rd[2].record_type = GNUNET_DNSPARSER_TYPE_TXT;
+  rd[2].flags = GNUNET_GNSRECORD_RF_SUPPLEMENTAL;
+
+  run_pkey (&rd_pkey, 1, "testdelegation");
+  run_pkey (rd, 3, "\u5929\u4e0b\u7121\u6575");
+  run_edkey (&rd_pkey, 1, "testdelegation");
+  run_edkey (rd, 3, "\u5929\u4e0b\u7121\u6575");
+}
+
+
+/**
+ * The main function of the test vector generation tool.
+ *
+ * @param argc number of arguments from the command line
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ */
+int
+main (int argc,
+      char *const *argv)
+{
+  const struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_log_setup ("gnunet-gns-tvg",
+                                   "INFO",
+                                   NULL));
+  // gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  // gcry_control (GCRYCTL_SET_VERBOSITY, 99);
+  if (GNUNET_OK !=
+      GNUNET_PROGRAM_run (argc, argv,
+                          "gnunet-gns-tvg",
+                          "Generate test vectors for GNS",
+                          options,
+                          &run, NULL))
+    return 1;
+  return 0;
+}
+
+
+/* end of gnunet-gns-tvg.c */
diff --git a/src/lib/gnsrecord/json_gnsrecord.c b/src/lib/gnsrecord/json_gnsrecord.c
new file mode 100644
index 000000000..9a08e0157
--- /dev/null
+++ b/src/lib/gnsrecord/json_gnsrecord.c
@@ -0,0 +1,397 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file json/json_gnsrecord.c
+ * @brief JSON handling of GNS record data
+ * @author Philippe Buschmann
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define GNUNET_JSON_GNSRECORD_VALUE "value"
+#define GNUNET_JSON_GNSRECORD_RECORD_DATA "data"
+#define GNUNET_JSON_GNSRECORD_TYPE "record_type"
+#define GNUNET_JSON_GNSRECORD_RELATIVE_EXPIRATION_TIME "relative_expiration"
+#define GNUNET_JSON_GNSRECORD_ABSOLUTE_EXPIRATION_TIME "absolute_expiration"
+#define GNUNET_JSON_GNSRECORD_FLAG_MAINTENANCE "is_maintenance"
+#define GNUNET_JSON_GNSRECORD_FLAG_PRIVATE "is_private"
+#define GNUNET_JSON_GNSRECORD_FLAG_SUPPLEMENTAL "is_supplemental"
+#define GNUNET_JSON_GNSRECORD_FLAG_RELATIVE "is_relative_expiration"
+#define GNUNET_JSON_GNSRECORD_FLAG_SHADOW "is_shadow"
+#define GNUNET_JSON_GNSRECORD_RECORD_NAME "record_name"
+
+struct GnsRecordInfo
+{
+  char **name;
+
+  unsigned int *rd_count;
+
+  struct GNUNET_GNSRECORD_Data **rd;
+};
+
+
+static void
+cleanup_recordinfo (struct GnsRecordInfo *gnsrecord_info)
+{
+  char *tmp;
+
+  if (NULL != *(gnsrecord_info->rd))
+  {
+    for (int i = 0; i < *(gnsrecord_info->rd_count); i++)
+    {
+      tmp = (char*) (*(gnsrecord_info->rd))[i].data;
+      if (NULL != tmp)
+        GNUNET_free (tmp);
+    }
+    GNUNET_free (*(gnsrecord_info->rd));
+    *(gnsrecord_info->rd) = NULL;
+  }
+  if (NULL != *(gnsrecord_info->name))
+    GNUNET_free (*(gnsrecord_info->name));
+  *(gnsrecord_info->name) = NULL;
+}
+
+
+/**
+ * Parse given JSON object to gns record
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_record (json_t *data, struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_TIME_Absolute abs_exp;
+  struct GNUNET_TIME_Relative rel_exp;
+  const char *value;
+  const char *record_type;
+  int maintenance;
+  int private;
+  int supplemental;
+  int is_rel_exp;
+  int shadow;
+  int unpack_state = 0;
+  json_error_t err;
+
+  // interpret single gns record
+  unpack_state = json_unpack_ex (data,
+                                 &err,
+                                 0,
+                                 "{s:s, s:s, s:I, s:b, s:b, s:b, s:b}",
+                                 GNUNET_JSON_GNSRECORD_VALUE,
+                                 &value,
+                                 GNUNET_JSON_GNSRECORD_TYPE,
+                                 &record_type,
+                                 GNUNET_JSON_GNSRECORD_RELATIVE_EXPIRATION_TIME,
+                                 &rel_exp.rel_value_us,
+                                 GNUNET_JSON_GNSRECORD_FLAG_MAINTENANCE,
+                                 &maintenance,
+                                 GNUNET_JSON_GNSRECORD_FLAG_PRIVATE,
+                                 &private,
+                                 GNUNET_JSON_GNSRECORD_FLAG_SUPPLEMENTAL,
+                                 &supplemental,
+                                 GNUNET_JSON_GNSRECORD_FLAG_RELATIVE,
+                                 &is_rel_exp,
+                                 GNUNET_JSON_GNSRECORD_FLAG_SHADOW,
+                                 &shadow);
+  if (0 != unpack_state)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error gnsdata object has a wrong format: `%s'!\n",
+                err.text);
+    unpack_state = json_unpack_ex (data,
+                                   &err,
+                                   0,
+                                   "{s:s, s:s, s:I, s:b, s:b, s:b, s:b}",
+                                   GNUNET_JSON_GNSRECORD_VALUE,
+                                   &value,
+                                   GNUNET_JSON_GNSRECORD_TYPE,
+                                   &record_type,
+                                   GNUNET_JSON_GNSRECORD_ABSOLUTE_EXPIRATION_TIME,
+                                   &abs_exp.abs_value_us,
+                                   GNUNET_JSON_GNSRECORD_FLAG_MAINTENANCE,
+                                   &maintenance,
+                                   GNUNET_JSON_GNSRECORD_FLAG_PRIVATE,
+                                   &private,
+                                   GNUNET_JSON_GNSRECORD_FLAG_SUPPLEMENTAL,
+                                   &supplemental,
+                                   GNUNET_JSON_GNSRECORD_FLAG_RELATIVE,
+                                   &is_rel_exp,
+                                   GNUNET_JSON_GNSRECORD_FLAG_SHADOW,
+                                   &shadow);
+    if ((0 != unpack_state) || (is_rel_exp))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Error gnsdata object has a wrong format: `%s'!\n",
+                  (is_rel_exp) ? "No relative expiration given" : err.text);
+      return GNUNET_SYSERR;
+    }
+    rd->expiration_time = abs_exp.abs_value_us;
+  }
+  else
+  {
+    rd->expiration_time = rel_exp.rel_value_us;
+  }
+  rd->record_type = GNUNET_GNSRECORD_typename_to_number (record_type);
+  if (UINT32_MAX == rd->record_type)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Unsupported type\n");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK != GNUNET_GNSRECORD_string_to_value (rd->record_type,
+                                                     value,
+                                                     (void **) &rd->data,
+                                                     &rd->data_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Value invalid for record type\n");
+    return GNUNET_SYSERR;
+  }
+
+  if (is_rel_exp)
+    rd->flags |= GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+  if (1 == maintenance)
+    rd->flags |= GNUNET_GNSRECORD_RF_MAINTENANCE;
+  if (1 == private)
+    rd->flags |= GNUNET_GNSRECORD_RF_PRIVATE;
+  if (1 == supplemental)
+    rd->flags |= GNUNET_GNSRECORD_RF_SUPPLEMENTAL;
+  if (1 == shadow)
+    rd->flags |= GNUNET_GNSRECORD_RF_SHADOW;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse given JSON object to gns record
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_record_data (struct GnsRecordInfo *gnsrecord_info, json_t *data)
+{
+  GNUNET_assert (NULL != data);
+  if (! json_is_array (data))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error gns record data JSON is not an array!\n");
+    return GNUNET_SYSERR;
+  }
+  *(gnsrecord_info->rd_count) = json_array_size (data);
+  *(gnsrecord_info->rd) = GNUNET_malloc (sizeof(struct GNUNET_GNSRECORD_Data)
+                                         * json_array_size (data));
+  size_t index;
+  json_t *value;
+  json_array_foreach (data, index, value)
+  {
+    if (GNUNET_OK != parse_record (value, &(*(gnsrecord_info->rd))[index]))
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static int
+parse_gnsrecordobject (void *cls,
+                       json_t *root,
+                       struct GNUNET_JSON_Specification *spec)
+{
+  struct GnsRecordInfo *gnsrecord_info;
+  int unpack_state = 0;
+  const char *name;
+  json_t *data;
+
+  GNUNET_assert (NULL != root);
+  if (! json_is_object (root))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error record JSON is not an object!\n");
+    return GNUNET_SYSERR;
+  }
+  // interpret single gns record
+  unpack_state = json_unpack (root,
+                              "{s:s, s:o!}",
+                              GNUNET_JSON_GNSRECORD_RECORD_NAME,
+                              &name,
+                              GNUNET_JSON_GNSRECORD_RECORD_DATA,
+                              &data);
+  if (0 != unpack_state)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error namestore records object has a wrong format!\n");
+    return GNUNET_SYSERR;
+  }
+  gnsrecord_info = (struct GnsRecordInfo *) spec->ptr;
+  *(gnsrecord_info->name) = GNUNET_strdup (name);
+  if (GNUNET_OK != parse_record_data (gnsrecord_info, data))
+  {
+    cleanup_recordinfo (gnsrecord_info);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing the record.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_gnsrecordobject (void *cls, struct GNUNET_JSON_Specification *spec)
+{
+  struct GnsRecordInfo *gnsrecord_info = (struct GnsRecordInfo *) spec->ptr;
+
+  GNUNET_free (gnsrecord_info);
+}
+
+
+/**
+ * JSON Specification for GNS Records.
+ *
+ * @param gnsrecord_object struct of GNUNET_GNSRECORD_Data to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_GNSRECORD_JSON_spec_gnsrecord (struct GNUNET_GNSRECORD_Data **rd,
+                                      unsigned int *rd_count,
+                                      char **name)
+{
+  struct GnsRecordInfo *gnsrecord_info = GNUNET_new (struct GnsRecordInfo);
+
+  gnsrecord_info->rd = rd;
+  gnsrecord_info->name = name;
+  gnsrecord_info->rd_count = rd_count;
+  struct GNUNET_JSON_Specification ret = { .parser = &parse_gnsrecordobject,
+                                           .cleaner = &clean_gnsrecordobject,
+                                           .cls = NULL,
+                                           .field = NULL,
+                                           .ptr = (struct GnsRecordInfo *)
+                                                  gnsrecord_info,
+                                           .ptr_size = 0,
+                                           .size_ptr = NULL };
+  return ret;
+}
+
+
+/**
+ * Convert GNS record to JSON.
+ *
+ * @param rname name of record
+ * @param rd record data
+ * @return corresponding JSON encoding
+ */
+json_t *
+GNUNET_GNSRECORD_JSON_from_gnsrecord (const char*rname,
+                                      const struct GNUNET_GNSRECORD_Data *rd,
+                                      unsigned int rd_count)
+{
+  const char *record_type_str;
+  char *value_str;
+  json_t *data;
+  json_t *record;
+  json_t *records;
+
+  data = json_object ();
+  if (NULL == data)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (0 !=
+      json_object_set_new (data,
+                           "record_name",
+                           json_string (rname)))
+  {
+    GNUNET_break (0);
+    json_decref (data);
+    return NULL;
+  }
+  records = json_array ();
+  if (NULL == records)
+  {
+    GNUNET_break (0);
+    json_decref (data);
+    return NULL;
+  }
+  for (int i = 0; i < rd_count; i++)
+  {
+    value_str = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
+                                                  rd[i].data,
+                                                  rd[i].data_size);
+    record_type_str = GNUNET_GNSRECORD_number_to_typename (rd[i].record_type);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Packing %s %s %" PRIu64 " %d\n",
+                value_str, record_type_str, rd[i].expiration_time, rd[i].flags);
+    record = json_pack (
+      "{s:s,s:s,s:I,s:b,s:b,s:b,s:b, s:b}",
+      GNUNET_JSON_GNSRECORD_VALUE, value_str,
+      GNUNET_JSON_GNSRECORD_TYPE, record_type_str,
+      (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)
+            ? GNUNET_JSON_GNSRECORD_RELATIVE_EXPIRATION_TIME
+            : GNUNET_JSON_GNSRECORD_ABSOLUTE_EXPIRATION_TIME,
+      rd[i].expiration_time,
+      GNUNET_JSON_GNSRECORD_FLAG_MAINTENANCE,
+      rd[i].flags & GNUNET_GNSRECORD_RF_MAINTENANCE,
+      GNUNET_JSON_GNSRECORD_FLAG_PRIVATE,
+      rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE,
+      GNUNET_JSON_GNSRECORD_FLAG_RELATIVE,
+      rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION,
+      GNUNET_JSON_GNSRECORD_FLAG_SUPPLEMENTAL,
+      rd[i].flags & GNUNET_GNSRECORD_RF_SUPPLEMENTAL,
+      GNUNET_JSON_GNSRECORD_FLAG_SUPPLEMENTAL,
+      rd[i].flags & GNUNET_GNSRECORD_RF_SHADOW);
+    GNUNET_free (value_str);
+    if (NULL == record)
+    {
+      GNUNET_break (0);
+      json_decref (records);
+      json_decref (data);
+      return NULL;
+    }
+    if (0 !=
+        json_array_append_new (records,
+                               record))
+    {
+      GNUNET_break (0);
+      json_decref (records);
+      json_decref (data);
+      return NULL;
+    }
+  }
+  if (0 !=
+      json_object_set_new (data,
+                           "data",
+                           records))
+  {
+    GNUNET_break (0);
+    json_decref (data);
+    return NULL;
+  }
+  return data;
+}
diff --git a/src/lib/gnsrecord/meson.build b/src/lib/gnsrecord/meson.build
new file mode 100644
index 000000000..dd71695ca
--- /dev/null
+++ b/src/lib/gnsrecord/meson.build
@@ -0,0 +1,86 @@
+libgnunetgnsrecord_src = ['gnsrecord.c',
+                          'gnsrecord_serialization.c',
+                          'gnsrecord_crypto.c',
+                          'gnsrecord_pow.c',
+                          'gnsrecord_misc.c']
+libgnunetgnsrecordjson_src = ['json_gnsrecord.c']
+
+libgnunetgnsrecord = library('gnunetgnsrecord',
+        libgnunetgnsrecord_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep,
+                       sodium_dep,
+                       gcrypt_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetgnsrecord_dep = declare_dependency(link_with : libgnunetgnsrecord)
+pkg.generate(libgnunetgnsrecord, url: 'https://www.gnunet.org',
+             description : 'Provides API for manipulating GNS records')
+
+
+libgnunetgnsrecordjson = library('gnunetgnsrecordjson',
+        libgnunetgnsrecordjson_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep, libgnunetgnsrecord_dep, json_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetgnsrecordjson_dep = declare_dependency(link_with : libgnunetgnsrecordjson)
+
+testgnsrecrd_perf_crypto = executable ('perf_gnsrecord_crypto',
+          ['perf_gnsrecord_crypto.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+testgnsrecrd_test_crypto = executable ('test_gnsrecord_crypto',
+          ['test_gnsrecord_crypto.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+testgnsrecrd_test_serialization = executable ('test_gnsrecord_serialization',
+          ['test_gnsrecord_serialization.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+testgnsrecrd_test_tvs = executable ('test_gnsrecord_testvectors',
+          ['test_gnsrecord_testvectors.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+testgnsrecrd_test_exp = executable ('test_gnsrecord_block_expiration',
+          ['test_gnsrecord_block_expiration.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+
+test('perf_gnsrecord_crypto', testgnsrecrd_perf_crypto,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord', 'perf'])
+test('test_gnsrecord_crypto', testgnsrecrd_test_crypto,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord'])
+test('test_gnsrecord_serialization', testgnsrecrd_test_serialization,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord'])
+test('test_gnsrecord_block_expiration', testgnsrecrd_test_exp,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord'])
+test('test_gnsrecord_serialization', testgnsrecrd_test_serialization,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord'])
+test('test_gnsrecord_testvectors', testgnsrecrd_test_tvs,
+   workdir: meson.current_build_dir(),
+   suite: ['gnsrecord'])
diff --git a/src/lib/gnsrecord/perf_gnsrecord_crypto.c b/src/lib/gnsrecord/perf_gnsrecord_crypto.c
new file mode 100644
index 000000000..1f9a3d4d4
--- /dev/null
+++ b/src/lib/gnsrecord/perf_gnsrecord_crypto.c
@@ -0,0 +1,139 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file gnsrecord/test_gnsrecord_crypto.c
+ * @brief testcase for block creation, verification and decryption
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define ROUNDS 1000
+
+#define RECORDS 5
+
+#define TEST_RECORD_TYPE 1234
+
+#define TEST_RECORD_DATALEN 123
+
+#define TEST_RECORD_DATA 'a'
+
+#define TEST_REMOVE_RECORD_TYPE 4321
+
+#define TEST_REMOVE_RECORD_DATALEN 255
+
+#define TEST_REMOVE_RECORD_DATA 'b'
+
+
+static struct GNUNET_GNSRECORD_Data *
+create_record (int count)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+
+  rd = GNUNET_new_array (count,
+                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int c = 0; c < count; c++)
+  {
+    rd[c].expiration_time = GNUNET_TIME_absolute_get ().abs_value_us
+                            + 1000000000;
+    rd[c].record_type = TEST_RECORD_TYPE;
+    rd[c].data_size = TEST_RECORD_DATALEN;
+    rd[c].data = GNUNET_malloc (TEST_RECORD_DATALEN);
+    memset ((char *) rd[c].data, TEST_RECORD_DATA, TEST_RECORD_DATALEN);
+  }
+  return rd;
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_HashCode query;
+  struct GNUNET_GNSRECORD_Data *s_rd;
+  const char *s_name;
+  struct GNUNET_TIME_Absolute start_time;
+  struct GNUNET_CRYPTO_PrivateKey privkey;
+  struct GNUNET_TIME_Absolute expire;
+
+  (void) cls;
+  (void) args;
+  (void) cfgfile;
+  (void) cfg;
+  expire = GNUNET_TIME_absolute_get ();
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+
+  /* test block creation */
+  s_name = "DUMMY.dummy.gnunet";
+  s_rd = create_record (RECORDS);
+  start_time = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < ROUNDS; i++)
+  {
+    GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (&privkey,
+                                                              expire,
+                                                              s_name,
+                                                              s_rd,
+                                                              RECORDS,
+                                                              &block));
+    GNUNET_GNSRECORD_query_from_private_key (&privkey,
+                                             s_name,
+                                             &query);
+    GNUNET_free (block);
+  }
+  fprintf (stderr,
+           "Took %s to produce %u GNS blocks for the DHT\n",
+           GNUNET_STRINGS_relative_time_to_string (
+             GNUNET_TIME_absolute_get_duration (start_time),
+             GNUNET_YES),
+           ROUNDS);
+  for (unsigned int i = 0; i < RECORDS; i++)
+    GNUNET_free_nz ((void *) s_rd[i].data);
+  GNUNET_free (s_rd);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  static char *const argvx[] = {
+    "perf-gnsrecord-crypto",
+    NULL
+  };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_PROGRAM_run ((sizeof(argvx) / sizeof(char *)) - 1,
+                          argvx,
+                          "perf-gnsrecord-crypto",
+                          "nohelp", options,
+                          &run,
+                          NULL))
+    return 1;
+  return 0;
+}
+
+
+/* end of test_gnsrecord_crypto.c */
diff --git a/src/lib/gnsrecord/test_gnsrecord_block_expiration.c b/src/lib/gnsrecord/test_gnsrecord_block_expiration.c
new file mode 100644
index 000000000..14b2acd97
--- /dev/null
+++ b/src/lib/gnsrecord/test_gnsrecord_block_expiration.c
@@ -0,0 +1,118 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file gnsrecord/test_gnsrecord_crypto.c
+ * @brief testcase for block creation, verification and decryption
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define RECORDS 5
+
+#define TEST_RECORD_TYPE 1234
+
+#define TEST_RECORD_DATALEN 123
+
+#define TEST_RECORD_DATA 'a'
+
+#define TEST_REMOVE_RECORD_TYPE 4321
+
+#define TEST_REMOVE_RECORD_DATALEN 255
+
+#define TEST_REMOVE_RECORD_DATA 'b'
+
+static int res;
+
+
+static void
+run (void *cls, char *const *args, const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_GNSRECORD_Data rd[2];
+  struct GNUNET_TIME_Absolute expiration_abs;
+  struct GNUNET_TIME_Absolute expiration_abs_shadow;
+  char *tmp_data0;
+  char *tmp_data1;
+
+  expiration_abs.abs_value_us = GNUNET_TIME_absolute_get ().abs_value_us
+                                + GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+  expiration_abs_shadow.abs_value_us = GNUNET_TIME_absolute_get ().abs_value_us
+                                       + GNUNET_TIME_UNIT_MINUTES.rel_value_us;
+
+  /* create record */
+  rd[0].expiration_time = expiration_abs.abs_value_us;
+  rd[0].record_type = TEST_RECORD_TYPE;
+  rd[0].data_size = TEST_RECORD_DATALEN;
+  tmp_data0 = GNUNET_malloc (TEST_RECORD_DATALEN);
+  rd[0].data = tmp_data0;
+  rd[0].flags = GNUNET_GNSRECORD_RF_NONE;
+  memset ((char *) rd[0].data, TEST_RECORD_DATA, TEST_RECORD_DATALEN);
+
+  rd[1].expiration_time = expiration_abs.abs_value_us;
+  rd[1].record_type = TEST_RECORD_TYPE;
+  rd[1].data_size = TEST_RECORD_DATALEN;
+  tmp_data1 = GNUNET_malloc (TEST_RECORD_DATALEN);
+  rd[1].data = tmp_data1;
+  rd[1].flags = GNUNET_GNSRECORD_RF_NONE;
+  memset ((char *) rd[1].data, TEST_RECORD_DATA, TEST_RECORD_DATALEN);
+
+  GNUNET_assert (expiration_abs.abs_value_us ==
+                 GNUNET_GNSRECORD_record_get_expiration_time (2,
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
+
+  rd[1].expiration_time = expiration_abs_shadow.abs_value_us;
+  rd[1].record_type = TEST_RECORD_TYPE;
+  rd[1].data_size = TEST_RECORD_DATALEN;
+  GNUNET_free (tmp_data1);
+  tmp_data1 = GNUNET_malloc (TEST_RECORD_DATALEN);
+  rd[1].data = tmp_data1;
+  rd[1].flags = GNUNET_GNSRECORD_RF_SHADOW;
+  memset ((char *) rd[1].data, TEST_RECORD_DATA, TEST_RECORD_DATALEN);
+
+  GNUNET_assert (expiration_abs_shadow.abs_value_us ==
+                 GNUNET_GNSRECORD_record_get_expiration_time (2,
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
+  GNUNET_free (tmp_data0);
+  GNUNET_free (tmp_data1);
+  res = 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  static char *const argvx[] = { "test-gnsrecord-crypto",
+                                 NULL };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  res = 1;
+  GNUNET_PROGRAM_run ((sizeof(argvx) / sizeof(char *)) - 1, argvx,
+                      "test-namestore-api",
+                      "nohelp", options, &run, &res);
+  return res;
+}
+
+
+/* end of test_gnsrecord_crypto.c */
diff --git a/src/lib/gnsrecord/test_gnsrecord_crypto.c b/src/lib/gnsrecord/test_gnsrecord_crypto.c
new file mode 100644
index 000000000..34f5f35e5
--- /dev/null
+++ b/src/lib/gnsrecord/test_gnsrecord_crypto.c
@@ -0,0 +1,211 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file gnsrecord/test_gnsrecord_crypto.c
+ * @brief testcase for block creation, verification and decryption
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define RECORDS 5
+
+#define TEST_RECORD_TYPE GNUNET_DNSPARSER_TYPE_TXT
+
+#define TEST_RECORD_DATALEN 123
+
+#define TEST_RECORD_DATA 'a'
+
+#define TEST_REMOVE_RECORD_TYPE 4321
+
+#define TEST_REMOVE_RECORD_DATALEN 255
+
+#define TEST_REMOVE_RECORD_DATA 'b'
+
+
+static struct GNUNET_GNSRECORD_Data *s_rd;
+
+static char *s_name;
+
+static int res;
+
+
+static struct GNUNET_GNSRECORD_Data *
+create_record (int count)
+{
+  struct GNUNET_GNSRECORD_Data *rd;
+
+  rd = GNUNET_new_array (count, struct GNUNET_GNSRECORD_Data);
+  for (unsigned int c = 0; c < count; c++)
+  {
+    rd[c].expiration_time = GNUNET_TIME_absolute_get ().abs_value_us
+                            + 1000000000;
+    rd[c].record_type = TEST_RECORD_TYPE;
+    rd[c].data_size = TEST_RECORD_DATALEN;
+    rd[c].data = GNUNET_malloc (TEST_RECORD_DATALEN);
+    memset ((char *) rd[c].data, TEST_RECORD_DATA, TEST_RECORD_DATALEN);
+  }
+  return rd;
+}
+
+
+static void
+rd_decrypt_cb (void *cls,
+               unsigned int rd_count,
+               const struct GNUNET_GNSRECORD_Data *rd)
+{
+  char rd_cmp_data[TEST_RECORD_DATALEN];
+
+  GNUNET_assert (RECORDS == rd_count);
+  GNUNET_assert (NULL != rd);
+  memset (rd_cmp_data,
+          'a',
+          TEST_RECORD_DATALEN);
+  for (unsigned int c = 0; c < rd_count; c++)
+  {
+    GNUNET_assert (TEST_RECORD_TYPE == rd[c].record_type);
+    GNUNET_assert (TEST_RECORD_DATALEN == rd[c].data_size);
+    GNUNET_assert (0 == memcmp (&rd_cmp_data,
+                                rd[c].data,
+                                TEST_RECORD_DATALEN));
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Block was decrypted successfully \n");
+  res = 0;
+}
+
+
+static void
+test_with_type (struct GNUNET_CRYPTO_PrivateKey *privkey)
+{
+  struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_CRYPTO_PublicKey pubkey;
+  struct GNUNET_HashCode query_pub;
+  struct GNUNET_HashCode query_priv;
+  struct GNUNET_HashCode query_block;
+  struct GNUNET_TIME_Absolute expire = GNUNET_TIME_UNIT_FOREVER_ABS;
+  char* tmp_data;
+
+  /* get public key */
+  GNUNET_CRYPTO_key_get_public (privkey,
+                                  &pubkey);
+
+  /* test query derivation */
+  GNUNET_GNSRECORD_query_from_private_key (privkey,
+                                           "testlabel",
+                                           &query_priv);
+  GNUNET_GNSRECORD_query_from_public_key (&pubkey,
+                                          "testlabel",
+                                          &query_pub);
+  GNUNET_assert (0 == memcmp (&query_priv,
+                              &query_pub,
+                              sizeof(struct GNUNET_HashCode)));
+  /* create record */
+  s_name = "testlabel";
+  s_rd = create_record (RECORDS);
+
+  /* Create block */
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (privkey,
+                                                             expire,
+                                                             s_name,
+                                                             s_rd,
+                                                             RECORDS,
+                                                             &block));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_query_from_block (block,
+                                                    &query_block));
+  GNUNET_assert (0 == memcmp (&query_pub,
+                              &query_block,
+                              sizeof(struct GNUNET_HashCode)));
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_verify (block));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_block_decrypt (block,
+                                                 &pubkey,
+                                                 s_name,
+                                                 &rd_decrypt_cb,
+                                                 NULL));
+  for (int i = 0; i < RECORDS; i++)
+  {
+    tmp_data = (char*) s_rd[i].data;
+    GNUNET_free(tmp_data);
+  }
+  GNUNET_free (s_rd);
+  GNUNET_free (block);
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_CRYPTO_PrivateKey privkey;
+  struct GNUNET_CRYPTO_PrivateKey privkey_ed;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Absolute end;
+
+
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  start = GNUNET_TIME_absolute_get ();
+  test_with_type (&privkey);
+  end = GNUNET_TIME_absolute_get ();
+  printf ("Time: %llu ms\n", (unsigned long long)
+          GNUNET_TIME_absolute_get_difference (start,
+                                               end).rel_value_us);
+
+  privkey_ed.type = htonl (GNUNET_GNSRECORD_TYPE_EDKEY);
+  GNUNET_CRYPTO_eddsa_key_create (&privkey_ed.eddsa_key);
+  start = GNUNET_TIME_absolute_get ();
+  test_with_type (&privkey_ed);
+  end = GNUNET_TIME_absolute_get ();
+  printf ("Time: %llu ms\n", (unsigned long long)
+          GNUNET_TIME_absolute_get_difference (start,
+                                               end).rel_value_us);
+
+
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  static char *const argvx[] = {
+    "test-gnsrecord-crypto",
+    NULL
+  };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  res = 1;
+  GNUNET_PROGRAM_run ((sizeof(argvx) / sizeof(char *)) - 1,
+                      argvx,
+                      "test-gnsrecord-crypto",
+                      "nohelp", options,
+                      &run, &res);
+  return res;
+}
+
+
+/* end of test_gnsrecord_crypto.c */
diff --git a/src/lib/gnsrecord/test_gnsrecord_serialization.c b/src/lib/gnsrecord/test_gnsrecord_serialization.c
new file mode 100644
index 000000000..b06b3a0fe
--- /dev/null
+++ b/src/lib/gnsrecord/test_gnsrecord_serialization.c
@@ -0,0 +1,156 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file gnsrecord/test_gnsrecord_serialization.c
+ * @brief testcase for gnsrecord_serialization.c
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 100)
+
+static int res;
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  size_t len;
+  int c;
+
+  int rd_count = 3;
+  size_t data_len;
+  struct GNUNET_GNSRECORD_Data src[rd_count];
+
+  memset (src, '\0', rd_count * sizeof(struct GNUNET_GNSRECORD_Data));
+
+  data_len = 0;
+  for (c = 0; c < rd_count; c++)
+  {
+    src[c].record_type = GNUNET_DNSPARSER_TYPE_TXT;
+    src[c].data_size = data_len;
+    src[c].data = GNUNET_malloc (data_len);
+
+    /* Setting data to data_len * record_type */
+    memset ((char *) src[c].data, 'a', data_len);
+    data_len += 10;
+  }
+  res = 0;
+
+  len = GNUNET_GNSRECORD_records_get_size (rd_count, src);
+  char rd_ser[len];
+  GNUNET_assert (len ==
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     src,
+                                                     len,
+                                                     rd_ser));
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Serialized data len: %u\n",
+              (unsigned int) len);
+
+  GNUNET_assert (rd_ser != NULL);
+  {
+    struct GNUNET_GNSRECORD_Data dst[rd_count];
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_GNSRECORD_records_deserialize (len,
+                                                         rd_ser,
+                                                         rd_count,
+                                                         dst));
+
+    GNUNET_assert (dst != NULL);
+
+    for (c = 0; c < rd_count; c++)
+    {
+      if (src[c].data_size != dst[c].data_size)
+      {
+        GNUNET_break (0);
+        res = 1;
+      }
+      if (src[c].expiration_time != dst[c].expiration_time)
+      {
+        GNUNET_break (0);
+        res = 1;
+      }
+      if (src[c].flags != dst[c].flags)
+      {
+        GNUNET_break (0);
+        res = 1;
+      }
+      if (src[c].record_type != dst[c].record_type)
+      {
+        GNUNET_break (0);
+        res = 1;
+      }
+
+      {
+        size_t data_size = src[c].data_size;
+        char data[data_size];
+
+        memset (data, 'a', data_size);
+        if (0 != memcmp (data, dst[c].data, data_size))
+        {
+          GNUNET_break (0);
+          res = 1;
+        }
+        if (0 != memcmp (data, src[c].data, data_size))
+        {
+          GNUNET_break (0);
+          res = 1;
+        }
+        if (0 != memcmp (src[c].data, dst[c].data, src[c].data_size))
+        {
+          GNUNET_break (0);
+          res = 1;
+        }
+      }
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Element [%i]: EQUAL\n", c);
+  }
+
+  for (c = 0; c < rd_count; c++)
+  {
+    GNUNET_free_nz ((void *) src[c].data);
+  }
+}
+
+
+int
+main (int argcx, char *argvx[])
+{
+  static char *const argv[] = { "test_gnsrecord_serialization",
+                                NULL };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  res = 1;
+  GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1, argv,
+                      "test_namestore_record_serialization",
+                      "nohelp", options, &run, &res);
+  return res;
+}
+
+
+/* end of test_gnsrecord_serialization.c */
diff --git a/src/lib/gnsrecord/test_gnsrecord_testvectors.c b/src/lib/gnsrecord/test_gnsrecord_testvectors.c
new file mode 100644
index 000000000..12b9efe56
--- /dev/null
+++ b/src/lib/gnsrecord/test_gnsrecord_testvectors.c
@@ -0,0 +1,716 @@
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gns_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include <inttypes.h>
+#include "gnsrecord_crypto.h"
+
+int res;
+
+struct GnsTv
+{
+  uint32_t expected_rd_count;
+  struct GNUNET_GNSRECORD_Data expected_rd[2048];
+  char *d;
+  char *zid;
+  char *ztld;
+  char *label;
+  char *q;
+  char *rdata;
+  char *rrblock;
+  char *k;
+  char *nonce;
+};
+
+struct RevocationTv
+{
+  char *d;
+  char *zid;
+  char *ztld;
+  char *m;
+  char *proof;
+  int diff;
+  int epochs;
+};
+
+struct RevocationTv rtvs[] = {
+  {
+    .d =
+      "70 ed 98 b9 07 8c 47 f7"
+      "d5 78 3b 26 cc f9 8b 7d"
+      "d5 5f 60 88 d1 53 95 97"
+      "fa 8b f5 5a c0 32 ea 6f",
+    .zid =
+      "00 01 00 00 2c a2 23 e8"
+      "79 ec c4 bb de b5 da 17"
+      "31 92 81 d6 3b 2e 3b 69"
+      "55 f1 c3 77 5c 80 4a 98"
+      "d5 f8 dd aa",
+    .ztld =
+      "000G001CM8HYGYFCRJXXXDET2WRS50EP7CQ3PTANY71QEQ409ACDBY6XN8",
+    .m =
+      "00 00 00 34 00 00 00 03"
+      "00 05 fe b4 6d 86 5c 1c"
+      "00 01 00 00 2c a2 23 e8"
+      "79 ec c4 bb de b5 da 17"
+      "31 92 81 d6 3b 2e 3b 69"
+      "55 f1 c3 77 5c 80 4a 98"
+      "d5 f8 dd aa",
+    .proof =
+      "00 05 fe b4 6d 86 5c 1c"
+      "00 00 39 5d 18 27 c0 00"
+      "e6 6a 57 0b cc d4 b3 93"
+      "e6 6a 57 0b cc d4 b3 ea"
+      "e6 6a 57 0b cc d4 b5 36"
+      "e6 6a 57 0b cc d4 b5 42"
+      "e6 6a 57 0b cc d4 b6 13"
+      "e6 6a 57 0b cc d4 b6 5f"
+      "e6 6a 57 0b cc d4 b6 72"
+      "e6 6a 57 0b cc d4 b7 0a"
+      "e6 6a 57 0b cc d4 b7 1a"
+      "e6 6a 57 0b cc d4 b7 23"
+      "e6 6a 57 0b cc d4 b7 47"
+      "e6 6a 57 0b cc d4 b7 77"
+      "e6 6a 57 0b cc d4 b7 85"
+      "e6 6a 57 0b cc d4 b7 89"
+      "e6 6a 57 0b cc d4 b7 cf"
+      "e6 6a 57 0b cc d4 b7 dc"
+      "e6 6a 57 0b cc d4 b9 3a"
+      "e6 6a 57 0b cc d4 b9 56"
+      "e6 6a 57 0b cc d4 ba 4a"
+      "e6 6a 57 0b cc d4 ba 9d"
+      "e6 6a 57 0b cc d4 bb 28"
+      "e6 6a 57 0b cc d4 bb 5a"
+      "e6 6a 57 0b cc d4 bb 92"
+      "e6 6a 57 0b cc d4 bb a2"
+      "e6 6a 57 0b cc d4 bb d8"
+      "e6 6a 57 0b cc d4 bb e2"
+      "e6 6a 57 0b cc d4 bc 93"
+      "e6 6a 57 0b cc d4 bc 94"
+      "e6 6a 57 0b cc d4 bd 0f"
+      "e6 6a 57 0b cc d4 bd ce"
+      "e6 6a 57 0b cc d4 be 6a"
+      "e6 6a 57 0b cc d4 be 73"
+      "00 01 00 00 2c a2 23 e8"
+      "79 ec c4 bb de b5 da 17"
+      "31 92 81 d6 3b 2e 3b 69"
+      "55 f1 c3 77 5c 80 4a 98"
+      "d5 f8 dd aa 04 4a 87 8a"
+      "15 8b 40 f0 c8 41 d9 f9"
+      "78 cb 13 72 ea ee 51 99"
+      "a3 d8 7e 5e 2b db c7 2a"
+      "6c 8c 73 d0 00 18 1d fc"
+      "39 c3 aa a4 81 66 7b 16"
+      "5b 58 44 e4 50 71 3d 8a"
+      "b6 a3 b2 ba 8f ef 44 7b"
+      "65 07 6a 0f",
+    .diff = 5,
+    .epochs = 2
+  }
+};
+
+struct GnsTv tvs[] = {
+  { .d =
+      "50 d7 b6 52 a4 ef ea df"
+      "f3 73 96 90 97 85 e5 95"
+      "21 71 a0 21 78 c8 e7 d4"
+      "50 fa 90 79 25 fa fd 98",
+    .zid =
+      "00 01 00 00 67 7c 47 7d"
+      "2d 93 09 7c 85 b1 95 c6"
+      "f9 6d 84 ff 61 f5 98 2c"
+      "2c 4f e0 2d 5a 11 fe df"
+      "b0 c2 90 1f",
+    .ztld = "000G0037FH3QTBCK15Y8BCCNRVWPV17ZC7TSGB1C9ZG2TPGHZVFV1GMG3W",
+    .label = "74 65 73 74 64 65 6c 65"
+             "67 61 74 69 6f 6e",
+    .q =
+      "4a dc 67 c5 ec ee 9f 76"
+      "98 6a bd 71 c2 22 4a 3d"
+      "ce 2e 91 70 26 c9 a0 9d"
+      "fd 44 ce f3 d2 0f 55 a2"
+      "73 32 72 5a 6c 8a fb bb"
+      "b0 f7 ec 9a f1 cc 42 64"
+      "12 99 40 6b 04 fd 9b 5b"
+      "57 91 f8 6c 4b 08 d5 f4",
+    .nonce =
+      "e9 0a 00 61 00 1c ee 8c"
+      "10 e2 59 80 00 00 00 01",
+    .k =
+      "86 4e 71 38 ea e7 fd 91"
+      "a3 01 36 89 9c 13 2b 23"
+      "ac eb db 2c ef 43 cb 19"
+      "f6 bf 55 b6 7d b9 b3 b3",
+    .rdata =
+      "00 1c ee 8c 10 e2 59 80"
+      "00 20 00 01 00 01 00 00"
+      "21 e3 b3 0f f9 3b c6 d3"
+      "5a c8 c6 e0 e1 3a fd ff"
+      "79 4c b7 b4 4b bb c7 48"
+      "d2 59 d0 a0 28 4d be 84",
+    .rrblock =
+      "00 00 00 a0 00 01 00 00"
+      "18 2b b6 36 ed a7 9f 79"
+      "57 11 bc 27 08 ad bb 24"
+      "2a 60 44 6a d3 c3 08 03"
+      "12 1d 03 d3 48 b7 ce b6"
+      "0a d1 0b c1 3b 40 3b 5b"
+      "25 61 26 b2 14 5a 6f 60"
+      "c5 14 f9 51 ff a7 66 f7"
+      "a3 fd 4b ac 4a 4e 19 90"
+      "05 5c b8 7e 8d 1b fd 19"
+      "aa 09 a4 29 f7 29 e9 f5"
+      "c6 ee c2 47 0a ce e2 22"
+      "07 59 e9 e3 6c 88 6f 35"
+      "00 1c ee 8c 10 e2 59 80"
+      "0c 1e da 5c c0 94 a1 c7"
+      "a8 88 64 9d 25 fa ee bd"
+      "60 da e6 07 3d 57 d8 ae"
+      "8d 45 5f 4f 13 92 c0 74"
+      "e2 6a c6 69 bd ee c2 34"
+      "62 b9 62 95 2c c6 e9 eb"},
+  { .d =
+      "50 d7 b6 52 a4 ef ea df"
+      "f3 73 96 90 97 85 e5 95"
+      "21 71 a0 21 78 c8 e7 d4"
+      "50 fa 90 79 25 fa fd 98",
+    .zid =
+      "00 01 00 00 67 7c 47 7d"
+      "2d 93 09 7c 85 b1 95 c6"
+      "f9 6d 84 ff 61 f5 98 2c"
+      "2c 4f e0 2d 5a 11 fe df"
+      "b0 c2 90 1f",
+    .ztld = "000G0037FH3QTBCK15Y8BCCNRVWPV17ZC7TSGB1C9ZG2TPGHZVFV1GMG3W",
+    .label =
+      "e5 a4 a9 e4 b8 8b e7 84"
+      "a1 e6 95 b5",
+    .nonce =
+      "ee 96 33 c1 00 1c ee 8c"
+      "10 e2 59 80 00 00 00 01",
+    .k =
+      "fb 3a b5 de 23 bd da e1"
+      "99 7a af 7b 92 c2 d2 71"
+      "51 40 8b 77 af 7a 41 ac"
+      "79 05 7c 4d f5 38 3d 01",
+    .q =
+      "af f0 ad 6a 44 09 73 68"
+      "42 9a c4 76 df a1 f3 4b"
+      "ee 4c 36 e7 47 6d 07 aa"
+      "64 63 ff 20 91 5b 10 05"
+      "c0 99 1d ef 91 fc 3e 10"
+      "90 9f 87 02 c0 be 40 43"
+      "67 78 c7 11 f2 ca 47 d5"
+      "5c f0 b5 4d 23 5d a9 77",
+    .rdata =
+      "00 1c ee 8c 10 e2 59 80"
+      "00 10 00 00 00 00 00 1c"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 de ad be ef"
+      "00 3f f2 aa 54 08 db 40"
+      "00 06 00 00 00 01 00 01"
+      "e6 84 9b e7 a7 b0 00 28"
+      "bb 13 ff 37 19 40 00 0b"
+      "00 04 00 00 00 10 48 65"
+      "6c 6c 6f 20 57 6f 72 6c"
+      "64 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00",
+    .rrblock =
+      "00 00 00 f0 00 01 00 00"
+      "a5 12 96 df 75 7e e2 75"
+      "ca 11 8d 4f 07 fa 7a ae"
+      "55 08 bc f5 12 aa 41 12"
+      "14 29 d4 a0 de 9d 05 7e"
+      "08 5b d6 5f d4 85 10 51"
+      "ba ce 2a 45 2a fc 8a 7e"
+      "4f 6b 2c 1f 74 f0 20 35"
+      "d9 64 1a cd ba a4 66 e0"
+      "00 ce d6 f2 d2 3b 63 1c"
+      "8e 8a 0b 38 e2 ba e7 9a"
+      "22 ca d8 1d 4c 50 d2 25"
+      "35 8e bc 17 ac 0f 89 9e"
+      "00 1c ee 8c 10 e2 59 80"
+      "d8 c2 8d 2f d6 96 7d 1a"
+      "b7 22 53 f2 10 98 b8 14"
+      "a4 10 be 1f 59 98 de 03"
+      "f5 8f 7e 7c db 7f 08 a6"
+      "16 51 be 4d 0b 6f 8a 61"
+      "df 15 30 44 0b d7 47 dc"
+      "f0 d7 10 4f 6b 8d 24 c2"
+      "ac 9b c1 3d 9c 6f e8 29"
+      "05 25 d2 a6 d0 f8 84 42"
+      "67 a1 57 0e 8e 29 4d c9"
+      "3a 31 9f cf c0 3e a2 70"
+      "17 d6 fd a3 47 b4 a7 94"
+      "97 d7 f6 b1 42 2d 4e dd"
+      "82 1c 19 93 4e 96 c1 aa"
+      "87 76 57 25 d4 94 c7 64"
+      "b1 55 dc 6d 13 26 91 74"},
+  { .d =
+      "5a f7 02 0e e1 91 60 32"
+      "88 32 35 2b bc 6a 68 a8"
+      "d7 1a 7c be 1b 92 99 69"
+      "a7 c6 6d 41 5a 0d 8f 65",
+    .zid =
+      "00 01 00 14 3c f4 b9 24"
+      "03 20 22 f0 dc 50 58 14"
+      "53 b8 5d 93 b0 47 b6 3d"
+      "44 6c 58 45 cb 48 44 5d"
+      "db 96 68 8f",
+    .ztld = "000G051WYJWJ80S04BRDRM2R2H9VGQCKP13VCFA4DHC4BJT88HEXQ5K8HW",
+    .label =
+      "74 65 73 74 64 65 6c 65"
+      "67 61 74 69 6f 6e",
+    .nonce =
+      "98 13 2e a8 68 59 d3 5c"
+      "88 bf d3 17 fa 99 1b cb"
+      "00 1c ee 8c 10 e2 59 80",
+    .k =
+      "85 c4 29 a9 56 7a a6 33"
+      "41 1a 96 91 e9 09 4c 45"
+      "28 16 72 be 58 60 34 aa"
+      "e4 a2 a2 cc 71 61 59 e2",
+    .q =
+      "ab aa ba c0 e1 24 94 59"
+      "75 98 83 95 aa c0 24 1e"
+      "55 59 c4 1c 40 74 e2 55"
+      "7b 9f e6 d1 54 b6 14 fb"
+      "cd d4 7f c7 f5 1d 78 6d"
+      "c2 e0 b1 ec e7 60 37 c0"
+      "a1 57 8c 38 4e c6 1d 44"
+      "56 36 a9 4e 88 03 29 e9",
+    .rdata =
+      "00 1c ee 8c 10 e2 59 80"
+      "00 20 00 01 00 01 00 00"
+      "21 e3 b3 0f f9 3b c6 d3"
+      "5a c8 c6 e0 e1 3a fd ff"
+      "79 4c b7 b4 4b bb c7 48"
+      "d2 59 d0 a0 28 4d be 84",
+    .rrblock =
+      "00 00 00 b0 00 01 00 14"
+      "9b f2 33 19 8c 6d 53 bb"
+      "db ac 49 5c ab d9 10 49"
+      "a6 84 af 3f 40 51 ba ca"
+      "b0 dc f2 1c 8c f2 7a 1a"
+      "9f 56 a8 86 ea 73 9d 59"
+      "17 50 8f 9b 75 56 39 f3"
+      "a9 ac fa ed ed ca 7f bf"
+      "a7 94 b1 92 e0 8b f9 ed"
+      "4c 7e c8 59 4c 9f 7b 4e"
+      "19 77 4f f8 38 ec 38 7a"
+      "8f 34 23 da ac 44 9f 59"
+      "db 4e 83 94 3f 90 72 00"
+      "00 1c ee 8c 10 e2 59 80"
+      "57 7c c6 c9 5a 14 e7 04"
+      "09 f2 0b 01 67 e6 36 d0"
+      "10 80 7c 4f 00 37 2d 69"
+      "8c 82 6b d9 2b c2 2b d6"
+      "bb 45 e5 27 7c 01 88 1d"
+      "6a 43 60 68 e4 dd f1 c6"
+      "b7 d1 41 6f af a6 69 7c"
+      "25 ed d9 ea e9 91 67 c3"},
+  { .d =
+      "5a f7 02 0e e1 91 60 32"
+      "88 32 35 2b bc 6a 68 a8"
+      "d7 1a 7c be 1b 92 99 69"
+      "a7 c6 6d 41 5a 0d 8f 65",
+    .zid =
+      "00 01 00 14 3c f4 b9 24"
+      "03 20 22 f0 dc 50 58 14"
+      "53 b8 5d 93 b0 47 b6 3d"
+      "44 6c 58 45 cb 48 44 5d"
+      "db 96 68 8f",
+    .ztld = "000G051WYJWJ80S04BRDRM2R2H9VGQCKP13VCFA4DHC4BJT88HEXQ5K8HW",
+    .label =
+      "e5 a4 a9 e4 b8 8b e7 84"
+      "a1 e6 95 b5",
+    .nonce =
+      "bb 0d 3f 0f bd 22 42 77"
+      "50 da 5d 69 12 16 e6 c9"
+      "00 1c ee 8c 10 e2 59 80",
+    .k =
+      "3d f8 05 bd 66 87 aa 14"
+      "20 96 28 c2 44 b1 11 91"
+      "88 c3 92 56 37 a4 1e 5d"
+      "76 49 6c 29 45 dc 37 7b",
+    .q =
+      "ba f8 21 77 ee c0 81 e0"
+      "74 a7 da 47 ff c6 48 77"
+      "58 fb 0d f0 1a 6c 7f bb"
+      "52 fc 8a 31 be f0 29 af"
+      "74 aa 0d c1 5a b8 e2 fa"
+      "7a 54 b4 f5 f6 37 f6 15"
+      "8f a7 f0 3c 3f ce be 78"
+      "d3 f9 d6 40 aa c0 d1 ed",
+    .rdata =
+      "00 1c ee 8c 10 e2 59 80"
+      "00 10 00 00 00 00 00 1c"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 de ad be ef"
+      "00 3f f2 aa 54 08 db 40"
+      "00 06 00 00 00 01 00 01"
+      "e6 84 9b e7 a7 b0 00 28"
+      "bb 13 ff 37 19 40 00 0b"
+      "00 04 00 00 00 10 48 65"
+      "6c 6c 6f 20 57 6f 72 6c"
+      "64 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00"
+      "00 00 00 00 00 00 00 00",
+    .rrblock =
+      "00 00 01 00 00 01 00 14"
+      "74 f9 00 68 f1 67 69 53"
+      "52 a8 a6 c2 eb 98 48 98"
+      "c5 3a cc a0 98 04 70 c6"
+      "c8 12 64 cb dd 78 ad 11"
+      "75 6d 2c 15 7a d2 ea 4f"
+      "c0 b1 b9 1c 08 03 79 44"
+      "61 d3 de f2 0d d1 63 6c"
+      "fe dc 03 89 c5 49 d1 43"
+      "6c c3 5b 4e 1b f8 89 5a"
+      "64 6b d9 a6 f4 6b 83 48"
+      "1d 9c 0e 91 d4 e1 be bb"
+      "6a 83 52 6f b7 25 2a 06"
+      "00 1c ee 8c 10 e2 59 80"
+      "4e b3 5a 50 d4 0f e1 a4"
+      "29 c7 f4 b2 67 a0 59 de"
+      "4e 2c 8a 89 a5 ed 53 d3"
+      "d4 92 58 59 d2 94 9f 7f"
+      "30 d8 a2 0c aa 96 f8 81"
+      "45 05 2d 1c da 04 12 49"
+      "8f f2 5f f2 81 6e f0 ce"
+      "61 fe 69 9b fa c7 2c 15"
+      "dc 83 0e a9 b0 36 17 1c"
+      "cf ca bb dd a8 de 3c 86"
+      "ed e2 95 70 d0 17 4b 82"
+      "82 09 48 a9 28 b7 f0 0e"
+      "fb 40 1c 10 fe 80 bb bb"
+      "02 76 33 1b f7 f5 1b 8d"
+      "74 57 9c 14 14 f2 2d 50"
+      "1a d2 5a e2 49 f5 bb f2"
+      "a6 c3 72 59 d1 75 e4 40"
+      "b2 94 39 c6 05 19 cb b1"},
+  {.d = NULL}
+};
+
+static void
+print_bytes_ (void *buf,
+              size_t buf_len,
+              int fold,
+              int in_be)
+{
+  int i;
+
+  for (i = 0; i < buf_len; i++)
+  {
+    if (0 != i)
+    {
+      if ((0 != fold) && (i % fold == 0))
+        printf ("\n  ");
+      else
+        printf (" ");
+    }
+    else
+    {
+      printf ("  ");
+    }
+    if (in_be)
+      printf ("%02x", ((unsigned char*) buf)[buf_len - 1 - i]);
+    else
+      printf ("%02x", ((unsigned char*) buf)[i]);
+  }
+  printf ("\n");
+}
+
+
+static void
+print_bytes (void *buf,
+             size_t buf_len,
+             int fold)
+{
+  print_bytes_ (buf, buf_len, fold, 0);
+}
+
+
+int
+parsehex (char *src, char *dst, size_t dstlen, int invert)
+{
+  int off;
+  int read_byte;
+  int data_len = 0;
+  char data[strlen (src) + 1];
+  char *pos = data;
+  int i = 0;
+  int j = 0;
+  memset (data, 0, strlen (src) + 1);
+
+  for (i = 0; i < strlen (src); i++)
+  {
+    if ((src[i] == ' ') || (src[i] == '\n'))
+      continue;
+    data[j++] = src[i];
+  }
+
+  while (sscanf (pos, " %02x%n", &read_byte, &off) == 1)
+  {
+    if (invert)
+      dst[dstlen - 1 - data_len++] = read_byte;
+    else
+      dst[data_len++] = read_byte;
+    pos += off;
+  }
+  return data_len;
+}
+
+
+void
+res_checker (void *cls,
+             unsigned int rd_count, const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GnsTv *tv = cls;
+  if (rd_count != tv->expected_rd_count)
+  {
+    printf ("FAIL: Record count expected: %u, was: %u\n", tv->expected_rd_count,
+            rd_count);
+    res = 1;
+    return;
+  }
+  for (int i = 0; i < rd_count; i++)
+  {
+    if (rd[i].record_type != tv->expected_rd[i].record_type)
+    {
+      printf ("FAIL: Record type expected: %u, was: %u\n",
+              tv->expected_rd[i].record_type,
+              rd[i].record_type);
+      res = 1;
+      return;
+    }
+    if (rd[i].expiration_time != tv->expected_rd[i].expiration_time)
+    {
+      printf ("FAIL: Expiration expected: %" PRIu64 ", was: %" PRIu64 "\n",
+              tv->expected_rd[i].expiration_time,
+              rd[i].expiration_time);
+      res = 1;
+      return;
+    }
+    if (rd[i].flags != tv->expected_rd[i].flags)
+    {
+      printf ("FAIL: Record flags expected: %u, was: %u\n",
+              tv->expected_rd[i].flags,
+              rd[i].flags);
+      res = 1;
+      return;
+    }
+    if (rd[i].data_size != tv->expected_rd[i].data_size)
+    {
+      printf ("FAIL: Record data size expected: %lu, was: %lu\n",
+              tv->expected_rd[i].data_size,
+              rd[i].data_size);
+      res = 1;
+      return;
+    }
+    if (0 != memcmp (rd[i].data, tv->expected_rd[i].data,
+                     rd[i].data_size))
+    {
+      printf ("FAIL: Record data does not match\n");
+      res = 1;
+      return;
+    }
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+check_derivations_edkey (const char*label,
+                         struct GNUNET_TIME_Absolute expire,
+                         struct GNUNET_CRYPTO_PublicKey *pub,
+                         struct GnsTv *tv)
+{
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char skey[crypto_secretbox_KEYBYTES];
+  unsigned char nonce_expected[crypto_secretbox_NONCEBYTES];
+  unsigned char skey_expected[crypto_secretbox_KEYBYTES];
+
+
+  parsehex (tv->nonce,(char*) nonce_expected, crypto_secretbox_NONCEBYTES, 0);
+  parsehex (tv->k,(char*) skey_expected, crypto_secretbox_KEYBYTES, 0);
+  GNR_derive_block_xsalsa_key (nonce,
+                               skey,
+                               label,
+                               GNUNET_TIME_absolute_hton (
+                                 expire).abs_value_us__,
+                               &pub->eddsa_key);
+  /* Ignore random 128-bit nonce, can't check this here. Will be checked on
+   * decryption. */
+  if (0 != memcmp (nonce + 16, nonce_expected + 16, sizeof (nonce) - 16))
+  {
+    printf ("FAIL: Failed to derive nonce:\n");
+    print_bytes (nonce, sizeof (nonce), 8);
+    print_bytes (nonce_expected, sizeof (nonce), 8);
+    return GNUNET_NO;
+  }
+  if (0 != memcmp (skey, skey_expected, sizeof (skey)))
+  {
+    printf ("FAIL: Failed to derive secret key\n");
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_derivations_pkey (const char*label,
+                        struct GNUNET_TIME_Absolute expire,
+                        struct GNUNET_CRYPTO_PublicKey *pub,
+                        struct GnsTv *tv)
+{
+  unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
+  unsigned char ctr_expected[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
+  unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
+  unsigned char skey_expected[GNUNET_CRYPTO_AES_KEY_LENGTH];
+
+  parsehex (tv->nonce,(char*) ctr_expected, sizeof (ctr), 0);
+  parsehex (tv->k,(char*) skey_expected, sizeof (skey), 0);
+  GNR_derive_block_aes_key (ctr,
+                            skey,
+                            label,
+                            GNUNET_TIME_absolute_hton (
+                              expire).abs_value_us__,
+                            &pub->ecdsa_key);
+
+  /* Ignore random 32-bit nonce, can't check this here. Will be checked on
+   * decryption. */
+  if (0 != memcmp (ctr + 4, ctr_expected + 4, sizeof (ctr) - 4))
+  {
+    printf ("FAIL: Failed to derive nonce\n");
+    return GNUNET_NO;
+  }
+  if (0 != memcmp (skey, skey_expected, sizeof (skey)))
+  {
+    printf ("FAIL: Failed to derive secret key\n");
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+int
+main ()
+{
+  struct GNUNET_CRYPTO_PrivateKey priv;
+  struct GNUNET_CRYPTO_PublicKey pub;
+  struct GNUNET_CRYPTO_PublicKey pub_parsed;
+  struct GNUNET_GNSRECORD_Block *rrblock;
+  struct GNUNET_HashCode query;
+  struct GNUNET_HashCode expected_query;
+  struct GNUNET_TIME_Absolute expire;
+  char label[128];
+  char rdata[8096];
+  char ztld[128];
+  res = 0;
+
+  for (int i = 0; NULL != tvs[i].d; i++)
+  {
+    printf ("Test vector #%d\n", i);
+    memset (label, 0, sizeof (label));
+    parsehex (tvs[i].zid,(char*) &pub_parsed, 36, 0);
+    parsehex (tvs[i].d,(char*) &priv.ecdsa_key, sizeof (priv.ecdsa_key),
+              (GNUNET_GNSRECORD_TYPE_PKEY == ntohl (pub_parsed.type)) ? 1 : 0);
+    priv.type = pub_parsed.type;
+    GNUNET_CRYPTO_key_get_public (&priv, &pub);
+    if (0 != memcmp (&pub, &pub_parsed, GNUNET_CRYPTO_public_key_get_length (
+                       &pub)))
+    {
+      printf ("Wrong pubkey.\n");
+      print_bytes (&pub, 36, 8);
+      print_bytes (&pub_parsed, 36, 8);
+      res = 1;
+      break;
+    }
+    GNUNET_STRINGS_data_to_string (&pub,
+                                   GNUNET_CRYPTO_public_key_get_length (
+                                     &pub),
+                                   ztld,
+                                   sizeof (ztld));
+    if (0 != strcmp (ztld, tvs[i].ztld))
+    {
+      printf ("Wrong zTLD: expected %s, got %s\n", tvs[i].ztld, ztld);
+      res = 1;
+      break;
+    }
+    rrblock = GNUNET_malloc (strlen (tvs[i].rrblock));
+    parsehex (tvs[i].rrblock, (char*) rrblock, 0, 0);
+    parsehex (tvs[i].label, (char*) label, 0, 0);
+    parsehex (tvs[i].q, (char*) &query, 0, 0);
+    GNUNET_GNSRECORD_query_from_public_key (&pub_parsed,
+                                            label,
+                                            &expected_query);
+    if (0 != GNUNET_memcmp (&query, &expected_query))
+    {
+      printf ("FAIL: query does not match:");
+      printf ("  expected: %s", GNUNET_h2s (&expected_query));
+      printf (", was: %s\n", GNUNET_h2s (&query));
+      GNUNET_free (rrblock);
+      res = 1;
+      break;
+    }
+    int len = parsehex (tvs[i].rdata, (char*) rdata, 0, 0);
+    tvs[i].expected_rd_count =
+      GNUNET_GNSRECORD_records_deserialize_get_size (len,
+                                                     rdata);
+    GNUNET_assert (tvs[i].expected_rd_count < 2048);
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_records_deserialize (len,
+                                              rdata,
+                                              tvs[i].expected_rd_count,
+                                              tvs[i].expected_rd))
+    {
+      printf ("FAIL: Deserialization of RDATA failed\n");
+      res = 1;
+      GNUNET_free (rrblock);
+      break;
+    }
+    expire = GNUNET_GNSRECORD_record_get_expiration_time (
+      tvs[i].expected_rd_count,
+      tvs[i].expected_rd,
+      GNUNET_TIME_UNIT_ZERO_ABS);
+    if ((GNUNET_GNSRECORD_TYPE_PKEY == ntohl (pub.type)) &&
+        (GNUNET_OK != check_derivations_pkey (label, expire, &pub, &tvs[i])))
+    {
+      res = 1;
+      GNUNET_free (rrblock);
+      break;
+    }
+    else if ((GNUNET_GNSRECORD_TYPE_EDKEY == ntohl (pub.type)) &&
+             (GNUNET_OK != check_derivations_edkey (label, expire, &pub,
+                                                    &tvs[i])))
+    {
+      res = 1;
+      GNUNET_free (rrblock);
+      break;
+    }
+    if (GNUNET_OK != GNUNET_GNSRECORD_block_decrypt (rrblock,
+                                                     &pub_parsed,
+                                                     label,
+                                                     &res_checker,
+                                                     &tvs[i]))
+    {
+      printf ("FAIL: Decryption of RRBLOCK failed\n");
+      res = 1;
+      GNUNET_free (rrblock);
+      break;
+    }
+    if (0 != res)
+    {
+      GNUNET_free (rrblock);
+      break;
+    }
+    printf ("Good.\n");
+  }
+  return res;
+}
diff --git a/src/lib/hello/.gitignore b/src/lib/hello/.gitignore
new file mode 100644
index 000000000..d175d148e
--- /dev/null
+++ b/src/lib/hello/.gitignore
@@ -0,0 +1,5 @@
+gnunet-hello
+test_friend_hello
+test_hello
+test_hello-uri
+test_hello-ng
diff --git a/src/lib/hello/Makefile.am b/src/lib/hello/Makefile.am
new file mode 100644
index 000000000..c7b3e4a05
--- /dev/null
+++ b/src/lib/hello/Makefile.am
@@ -0,0 +1,33 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+lib_LTLIBRARIES = libgnunethello.la
+
+libgnunethello_la_SOURCES = \
+  hello-uri.c
+libgnunethello_la_LIBADD = \
+ $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIB) \
+ $(LTLIBINTL)
+libgnunethello_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  -version-info 1:0:1
+
+check_PROGRAMS = \
+ test_hello-uri
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
+
+test_hello_uri_SOURCES = \
+ test_hello-uri.c
+test_hello_uri_LDADD = \
+ libgnunethello.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la \
+ -lgcrypt
diff --git a/src/lib/hello/gnunet-hello.c b/src/lib/hello/gnunet-hello.c
new file mode 100644
index 000000000..aaa4b5005
--- /dev/null
+++ b/src/lib/hello/gnunet-hello.c
@@ -0,0 +1,426 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file hello/gnunet-hello.c
+ * @brief change HELLO files to never expire
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_protocols.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_transport_plugin.h"
+
+/**
+ * Closure for #add_to_buf().
+ */
+struct AddContext
+{
+  /**
+   * Where to add.
+   */
+  char *buf;
+
+  /**
+   * Maximum number of bytes left
+   */
+  size_t max;
+
+  /**
+   * Number of bytes added so far.
+   */
+  size_t ret;
+
+  struct GNUNET_HELLO_Builder *builder;
+};
+
+/**
+ * Entry in doubly-linked list of all of our plugins.
+ */
+struct TransportPlugin
+{
+  /**
+   * This is a doubly-linked list.
+   */
+  struct TransportPlugin *next;
+
+  /**
+   * This is a doubly-linked list.
+   */
+  struct TransportPlugin *prev;
+
+  /**
+   * API of the transport as returned by the plugin's
+   * initialization function.
+   */
+  struct GNUNET_TRANSPORT_PluginFunctions *api;
+
+  /**
+   * Short name for the plugin (e.g. "tcp").
+   */
+  char *short_name;
+
+  /**
+   * Name of the library (e.g. "gnunet_plugin_transport_tcp").
+   */
+  char *lib_name;
+
+  /**
+   * Environment this transport service is using
+   * for this plugin.
+   */
+  struct GNUNET_TRANSPORT_PluginEnvironment env;
+};
+
+static int address_count;
+
+/**
+ * Our private key.
+ */
+static struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
+
+/**
+ * Local peer own ID.
+ */
+struct GNUNET_PeerIdentity my_full_id;
+
+/**
+ * The file with hello in old style which we like to replace with the new one.
+ */
+static char *hello_file;
+
+/**
+ * Head of DLL of all loaded plugins.
+ */
+static struct TransportPlugin *plugins_head;
+
+/**
+ * Head of DLL of all loaded plugins.
+ */
+static struct TransportPlugin *plugins_tail;
+
+static void
+plugins_load (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct TransportPlugin *plug;
+  struct TransportPlugin *next;
+  char *libname;
+  char *plugs;
+  char *pos;
+
+  if (NULL != plugins_head)
+    return; /* already loaded */
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "TRANSPORT", "PLUGINS",
+                                             &plugs))
+    return;
+  fprintf (stdout,"Starting transport plugins `%s'\n",
+              plugs);
+  for (pos = strtok (plugs, " "); pos != NULL; pos = strtok (NULL, " "))
+  {
+    fprintf (stdout,"Loading `%s' transport plugin\n",
+                pos);
+    GNUNET_asprintf (&libname, "libgnunet_plugin_transport_%s", pos);
+    plug = GNUNET_new (struct TransportPlugin);
+    plug->short_name = GNUNET_strdup (pos);
+    plug->lib_name = libname;
+    plug->env.cfg = cfg;
+    plug->env.cls = plug->short_name;
+    GNUNET_CONTAINER_DLL_insert (plugins_head, plugins_tail, plug);
+  }
+  GNUNET_free (plugs);
+  next = plugins_head;
+  while (next != NULL)
+  {
+    plug = next;
+    next = plug->next;
+    plug->api = GNUNET_PLUGIN_load (plug->lib_name, &plug->env);
+    if (plug->api == NULL)
+    {
+      fprintf (stdout,"Failed to load transport plugin for `%s'\n",
+                  plug->lib_name);
+      GNUNET_CONTAINER_DLL_remove (plugins_head, plugins_tail, plug);
+      GNUNET_free (plug->short_name);
+      GNUNET_free (plug->lib_name);
+      GNUNET_free (plug);
+    }
+  }
+}
+
+
+static int
+add_to_builder (void *cls,
+            const struct GNUNET_HELLO_Address *address,
+            struct GNUNET_TIME_Absolute expiration)
+{
+  struct GNUNET_HELLO_Builder *builder= cls;
+  struct TransportPlugin *pos = plugins_head;
+  const char *addr;
+  char *uri;
+
+  while (NULL != pos)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "short_name: %s transport_name: %s\n",
+                pos->short_name,
+              address->transport_name);
+    if (0 == strcmp (address->transport_name, pos->short_name))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "short_name: %s transport_name: %s are the same\n",
+                  pos->short_name,
+              address->transport_name);
+      addr = strchr (strchr (pos->api->address_to_string (pos, address, address->address_length), '.')+1, '.') + 1;
+    }
+    pos = pos->next;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Hello address string: %s\n",
+              addr);
+  GNUNET_asprintf (&uri, "%s://%s", address->transport_name, addr);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Hello address uri string: %s\n",
+              uri);
+  GNUNET_HELLO_builder_add_address (builder,
+                                    uri);
+}
+
+
+/**
+ * Add the given address with infinite expiration to the buffer.
+ *
+ * @param cls closure
+ * @param address address to add
+ * @param expiration old expiration
+ * @return #GNUNET_OK keep iterating
+ */
+static int
+add_to_buf (void *cls,
+            const struct GNUNET_HELLO_Address *address,
+            struct GNUNET_TIME_Absolute expiration)
+{
+  struct AddContext *ac = cls;
+  size_t ret;
+
+  ret = GNUNET_HELLO_add_address (address,
+                                  GNUNET_TIME_UNIT_FOREVER_ABS,
+                                  ac->buf,
+                                  ac->max);
+
+  ac->buf += ret;
+  ac->max -= ret;
+  ac->ret += ret;
+  address_count++;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add addresses from the address list to the HELLO.
+ *
+ * @param cls the HELLO with the addresses to add
+ * @param max maximum space available
+ * @param buf where to add the addresses
+ * @return number of bytes added, 0 to terminate
+ */
+static ssize_t
+add_from_hello (void *cls, size_t max, void *buf)
+{
+  struct GNUNET_HELLO_Message **orig = cls;
+  struct AddContext ac;
+
+  if (NULL == *orig)
+    return GNUNET_SYSERR; /* already done */
+  ac.buf = buf;
+  ac.max = max;
+  ac.ret = 0;
+  GNUNET_assert (
+    NULL ==
+    GNUNET_HELLO_iterate_addresses (*orig, GNUNET_NO, &add_to_buf, &ac));
+  *orig = NULL;
+  return ac.ret;
+}
+
+
+/**
+ * Main function that will be run without the scheduler.
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param c configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  struct GNUNET_HELLO_Message *orig;
+  struct GNUNET_HELLO_Message *result;
+  struct GNUNET_PeerIdentity pid;
+  uint64_t fsize;
+  ssize_t size_written;
+  struct GNUNET_HELLO_Builder *builder;
+  char *url;
+  const struct GNUNET_MessageHeader *msg;
+  struct GNUNET_MQ_Envelope *env;
+
+  plugins_load (c);
+  address_count = 0;
+
+  my_private_key =
+    GNUNET_CRYPTO_eddsa_key_create_from_configuration (c);
+  GNUNET_CRYPTO_eddsa_key_get_public (my_private_key,
+                                      &my_full_id.public_key);
+  fprintf (stdout,"We are peer %s\n", GNUNET_i2s (&my_full_id));
+
+  GNUNET_log_setup ("gnunet-hello", "DEBUG", NULL);
+
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_size (hello_file, &fsize, GNUNET_YES, GNUNET_YES))
+  {
+    fprintf (stderr,
+             _ ("Error accessing file `%s': %s\n"),
+             hello_file,
+             strerror (errno));
+    return;
+  }
+  if (fsize > 65536)
+  {
+    fprintf (stderr, _ ("File `%s' is too big to be a HELLO\n"), hello_file);
+    return;
+  }
+  if (fsize < sizeof(struct GNUNET_MessageHeader))
+  {
+    fprintf (stderr, _ ("File `%s' is too small to be a HELLO\n"), hello_file);
+    return;
+  }
+  fh = GNUNET_DISK_file_open (hello_file,
+                              GNUNET_DISK_OPEN_READ,
+                              GNUNET_DISK_PERM_USER_READ);
+  if (NULL == fh)
+  {
+    fprintf (stderr,
+             _ ("Error opening file `%s': %s\n"),
+             hello_file,
+             strerror (errno));
+    return;
+  }
+  {
+    char buf[fsize] GNUNET_ALIGN;
+
+    GNUNET_assert (fsize == GNUNET_DISK_file_read (fh, buf, fsize));
+    GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fh));
+    orig = (struct GNUNET_HELLO_Message *) buf;
+    if ((fsize < GNUNET_HELLO_size (orig)) ||
+        (GNUNET_OK != GNUNET_HELLO_get_id (orig, &pid)))
+    {
+      fprintf (stderr,
+               _ ("Did not find well-formed HELLO in file `%s'\n"),
+               hello_file);
+      return;
+    }
+    {
+      char *pids;
+
+      pids = GNUNET_CRYPTO_eddsa_public_key_to_string (&my_full_id.public_key);
+      fprintf (stdout, "Processing HELLO for peer `%s'\n", pids);
+      GNUNET_free (pids);
+    }
+    /* result = GNUNET_HELLO_create (&pid.public_key, */
+    /*                               &add_from_hello, */
+    /*                               &orig, */
+    /*                               GNUNET_HELLO_is_friend_only (orig)); */
+
+    builder = GNUNET_HELLO_builder_new (&my_full_id);
+    GNUNET_assert (
+    NULL ==
+    GNUNET_HELLO_iterate_addresses ((const struct GNUNET_HELLO_Message *) orig, GNUNET_NO, &add_to_builder, builder));
+    url = GNUNET_HELLO_builder_to_url (builder, my_private_key);
+    fprintf (stdout,"url: %s\n", url);
+    env = GNUNET_HELLO_builder_to_env (builder,
+                                 my_private_key,
+                                 GNUNET_TIME_UNIT_FOREVER_REL);
+    msg = GNUNET_MQ_env_get_msg (env);
+    //GNUNET_assert (NULL != result);
+    GNUNET_assert (NULL != msg);
+    fh =
+      GNUNET_DISK_file_open (hello_file,
+                             GNUNET_DISK_OPEN_WRITE | GNUNET_DISK_OPEN_TRUNCATE,
+                             GNUNET_DISK_PERM_USER_READ
+                             | GNUNET_DISK_PERM_USER_WRITE);
+    if (NULL == fh)
+    {
+      fprintf (stderr,
+               _ ("Error opening file `%s': %s\n"),
+               hello_file,
+               strerror (errno));
+      GNUNET_free (result);
+      return;
+    }
+    //fsize = GNUNET_HELLO_size (result);
+    size_written = GNUNET_DISK_file_write (fh, msg, ntohs (msg->size));
+    if (ntohs (msg->size) != size_written)
+    {
+      fprintf (stderr,
+               _ ("Error writing HELLO to file `%s': %s expected size %u size written %u\n"),
+               hello_file,
+               strerror (errno));
+      (void) GNUNET_DISK_file_close (fh);
+      return;
+    }
+    GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fh));
+  }
+  fprintf (stderr,
+           _ ("Modified %u addresses, wrote %u bytes\n"),
+           address_count,
+           (unsigned int) ntohs (msg->size));
+  GNUNET_HELLO_builder_free (builder);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] =
+  { GNUNET_GETOPT_option_string ('h',
+                               "hello-file",
+                               "HELLO_FILE",
+                               gettext_noop ("Hello file to read"),
+                               &hello_file),
+    GNUNET_GETOPT_OPTION_END };
+  int ret;
+
+  ret = (GNUNET_OK ==
+         GNUNET_PROGRAM_run2 (argc,
+                             argv,
+                             "gnunet-peerinfo",
+                             gettext_noop ("Print information about peers."),
+                             options,
+                             &run,
+                             NULL,
+                             GNUNET_YES));
+  return ret;
+}
+
+
+/* end of gnunet-hello.c */
diff --git a/src/lib/hello/hello-ng.c b/src/lib/hello/hello-ng.c
new file mode 100644
index 000000000..9c255b361
--- /dev/null
+++ b/src/lib/hello/hello-ng.c
@@ -0,0 +1,198 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file hello/hello-ng.c
+ * @brief helper library for handling HELLOs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_util_lib.h"
+
+GNUNET_NETWORK_STRUCT_BEGIN
+/**
+ * Binary block we sign when we sign an address.
+ */
+struct SignedAddress
+{
+  /**
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * When was the address generated.
+   */
+  struct GNUNET_TIME_AbsoluteNBO mono_time;
+
+  /**
+   * Hash of the address.
+   */
+  struct GNUNET_HashCode addr_hash GNUNET_PACKED;
+};
+GNUNET_NETWORK_STRUCT_END
+
+/**
+ * Build address record by signing raw information with private key.
+ *
+ * @param address text address at @a communicator to sign
+ * @param nt network type of @a address
+ * @param mono_time monotonic time at which @a address was valid
+ * @param private_key signing key to use
+ * @param[out] result where to write address record (allocated)
+ * @param[out] result_size set to size of @a result
+ */
+void
+GNUNET_HELLO_sign_address (
+  const char *address,
+  enum GNUNET_NetworkType nt,
+  struct GNUNET_TIME_Absolute mono_time,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *private_key,
+  void **result,
+  size_t *result_size)
+{
+  struct SignedAddress sa;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  char *sig_str;
+
+  sa.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS);
+  sa.purpose.size = htonl (sizeof(sa));
+  sa.mono_time = GNUNET_TIME_absolute_hton (mono_time);
+  GNUNET_CRYPTO_hash (address, strlen (address), &sa.addr_hash);
+  GNUNET_CRYPTO_eddsa_sign (private_key, &sa, &sig);
+  sig_str = NULL;
+  (void) GNUNET_STRINGS_base64_encode (&sig, sizeof(sig), &sig_str);
+  *result_size =
+    1 + GNUNET_asprintf ((char **) result,
+                         "%s;%llu;%u;%s",
+                         sig_str,
+                         (unsigned long long) mono_time.abs_value_us,
+                         (unsigned int) nt,
+                         address);
+  GNUNET_free (sig_str);
+}
+
+
+/**
+ * Check signature and extract address record.
+ *
+ * @param raw raw signed address
+ * @param raw_size size of @a raw
+ * @param pid public key to use for signature verification
+ * @param nt[out] set to network type
+ * @param mono_time[out] when was the address generated
+ * @return NULL on error, otherwise the address
+ */
+char *
+GNUNET_HELLO_extract_address (const void *raw,
+                              size_t raw_size,
+                              const struct GNUNET_PeerIdentity *pid,
+                              enum GNUNET_NetworkType *nt,
+                              struct GNUNET_TIME_Absolute *mono_time)
+{
+  const struct GNUNET_CRYPTO_EddsaPublicKey *public_key = &pid->public_key;
+  const char *raws = raw;
+  unsigned long long raw_us = 0;
+  unsigned int raw_nt = 0;
+  const char *sc;
+  const char *sc2;
+  const char *sc3;
+  const char *raw_addr;
+  char *data = NULL;
+  struct GNUNET_TIME_Absolute raw_mono_time;
+  struct SignedAddress sa;
+  struct GNUNET_CRYPTO_EddsaSignature *sig;
+
+  if ('\0' != raws[raw_size-1])
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (NULL == (sc = strchr (raws, ';')))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (NULL == (sc2 = strchr (sc + 1, ';')))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (NULL == (sc3 = strchr (sc2 + 1, ';')))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (2 != sscanf (sc + 1, "%llu;%u;%*s", &raw_us, &raw_nt))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  raw_addr = sc3 + 1;
+  raw_mono_time.abs_value_us = raw_us;
+    if (sizeof(struct GNUNET_CRYPTO_EddsaSignature) !=
+      GNUNET_STRINGS_base64_decode (raws, sc - raws, (void **) &data))
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (data);
+    return NULL;
+  }
+  sig = (struct GNUNET_CRYPTO_EddsaSignature*) data;
+  sa.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS);
+  sa.purpose.size = htonl (sizeof(sa));
+  sa.mono_time = GNUNET_TIME_absolute_hton (raw_mono_time);
+  GNUNET_CRYPTO_hash (raw_addr, strlen (raw_addr), &sa.addr_hash);
+  if (GNUNET_YES !=
+      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS,
+                                  &sa,
+                                  sig,
+                                  public_key))
+  {
+    GNUNET_free (data);
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  GNUNET_free (data);
+  *mono_time = raw_mono_time;
+  *nt = raw_nt;
+  return GNUNET_strdup (raw_addr);
+}
+
+
+/**
+ * Given an address as a string, extract the prefix that identifies
+ * the communicator offering transmissions to that address.
+ *
+ * @param address a peer's address
+ * @return NULL if the address is mal-formed, otherwise the prefix
+ */
+char *
+GNUNET_HELLO_address_to_prefix (const char *address)
+{
+  const char *dash;
+
+  dash = strchr (address, '-');
+  if (NULL == dash)
+    return NULL;
+  return GNUNET_strndup (address, dash - address);
+}
diff --git a/src/lib/hello/hello-uri.c b/src/lib/hello/hello-uri.c
new file mode 100644
index 000000000..49acaf7a9
--- /dev/null
+++ b/src/lib/hello/hello-uri.c
@@ -0,0 +1,1045 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file hello/hello-uri.c
+ * @brief helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ *
+ * Note:
+ * - Current API does not support deserializing HELLO of
+ *   another peer and then serializing it into another
+ *   format (we always require the private key).
+ *   Not sure if we need this, but if we do, we need
+ *   to extend the builder and the API.
+ * - Current API does not allow overriding the default
+ *   HELLO expiration time. We may want to add a function
+ *   that does this to create bootstrap HELLOs shipped with
+ *   the TGZ.
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_util_lib.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Binary block we sign when we sign an address.
+ */
+struct SignedAddress
+{
+  /**
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * When was the address generated.
+   */
+  struct GNUNET_TIME_AbsoluteNBO mono_time;
+
+  /**
+   * Hash of the address.
+   */
+  struct GNUNET_HashCode addr_hash GNUNET_PACKED;
+};
+
+/**
+ * Message signed as part of a HELLO block/URL.
+ */
+struct HelloSignaturePurpose
+{
+  /**
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_HELLO
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * When does the signature expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /**
+   * Hash over all addresses.
+   */
+  struct GNUNET_HashCode h_addrs;
+
+};
+
+/**
+ * Message used when gossiping HELLOs between peers.
+ */
+struct HelloUriMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_HELLO_URI
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+
+  /* followed by a 'block' */
+};
+
+
+/**
+ * Start of a 'block'.
+ */
+struct BlockHeader
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+};
+
+
+/**
+ * Message used when a DHT provides its HELLO to direct
+ * neighbours.
+ */
+struct DhtHelloMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /* followed by the serialized addresses of the 'block' */
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Address of a peer.
+ */
+struct Address
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *prev;
+
+  /**
+   * Actual URI, allocated at the end of this struct.
+   */
+  const char *uri;
+
+  /**
+   * Length of @a uri including 0-terminator.
+   */
+  size_t uri_len;
+};
+
+
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Head of the addresses DLL.
+   */
+  struct Address *a_head;
+
+  /**
+   * Tail of the addresses DLL.
+   */
+  struct Address *a_tail;
+
+  /**
+   * Length of the @a a_head DLL.
+   */
+  unsigned int a_length;
+
+};
+
+/**
+ * Struct to wrap data to do the merge of to hello uris.
+ */
+struct AddressUriMergeResult
+{
+  /**
+   * The builder of the hello uri we merge with.
+   */
+  struct GNUNET_HELLO_Builder *builder;
+
+  /**
+   * The actual address to check, if it is allready in the hello uri we merge with.
+   */
+  const char *address_uri;
+
+  /**
+   * Did we found the actual address to check.
+   */
+  unsigned int found;
+
+  /**
+   * Did we found at least one address to merge.
+   */
+  unsigned int merged;
+};
+
+
+/**
+ * Compute @a hash over addresses in @a builder.
+ *
+ * @param builder the builder to hash addresses of
+ * @param[out] hash where to write the hash
+ */
+static void
+hash_addresses (const struct GNUNET_HELLO_Builder *builder,
+                struct GNUNET_HashCode *hash)
+{
+  struct GNUNET_HashContext *hc;
+
+  hc = GNUNET_CRYPTO_hash_context_start ();
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Hashing over %.*s\n",
+                (int) a->uri_len,
+                a->uri);
+    GNUNET_CRYPTO_hash_context_read (hc,
+                                     a->uri,
+                                     a->uri_len);
+  }
+  GNUNET_CRYPTO_hash_context_finish (hc,
+                                     hash);
+
+}
+
+
+/**
+ * Create HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to sign
+ * @param priv key to sign with
+ * @param[out] sig where to write the signature
+ */
+static void
+sign_hello (const struct GNUNET_HELLO_Builder *builder,
+            struct GNUNET_TIME_Timestamp et,
+            const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+            struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et.abs_time)
+  };
+
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Address hash is %s\n",
+              GNUNET_h2s_full (&hsp.h_addrs));
+  GNUNET_CRYPTO_eddsa_sign (priv,
+                            &hsp,
+                            sig);
+}
+
+
+/**
+ * Verify HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to verify
+ * @param sig signature to verify
+ * @return #GNUNET_OK if everything is ok, #GNUNET_NO if the
+ *    HELLO expired, #GNUNET_SYSERR if the signature is wrong
+ */
+static enum GNUNET_GenericReturnValue
+verify_hello (const struct GNUNET_HELLO_Builder *builder,
+              struct GNUNET_TIME_Absolute et,
+              const struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et)
+  };
+
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_HELLO,
+                                  &hsp,
+                                  sig,
+                                  &builder->pid.public_key))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_TIME_absolute_is_past (et))
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid)
+{
+  struct GNUNET_HELLO_Builder *builder;
+
+  builder = GNUNET_new (struct GNUNET_HELLO_Builder);
+  builder->pid = *pid;
+  return builder;
+}
+
+
+const struct GNUNET_PeerIdentity *
+GNUNET_HELLO_builder_get_id (const struct GNUNET_HELLO_Builder *builder)
+{
+  return &builder->pid;
+}
+
+
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder)
+{
+  struct Address *a;
+
+  while (NULL != (a = builder->a_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                                 builder->a_tail,
+                                 a);
+    builder->a_length--;
+    GNUNET_free (a);
+  }
+  GNUNET_assert (0 == builder->a_length);
+  GNUNET_free (builder);
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg)
+{
+  const struct HelloUriMessage *h;
+  uint16_t size = ntohs (msg->size);
+
+  if (GNUNET_MESSAGE_TYPE_HELLO_URI != ntohs (msg->type))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (sizeof (struct HelloUriMessage) > size)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  h = (const struct HelloUriMessage *) msg;
+  size -= sizeof (*h);
+  return GNUNET_HELLO_builder_from_block (&h[1],
+                                          size);
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size)
+{
+  const struct BlockHeader *bh = block;
+  struct GNUNET_HELLO_Builder *b;
+
+  if (block_size < sizeof (*bh))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  b = GNUNET_HELLO_builder_new (&bh->pid);
+  block += sizeof (*bh);
+  block_size -= sizeof (*bh);
+  while (block_size > 0)
+  {
+    const void *end = memchr (block,
+                              '\0',
+                              block_size);
+
+    if (NULL == end)
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          block))
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    end++;
+    block_size -= (end - block);
+    block = end;
+  }
+  {
+    enum GNUNET_GenericReturnValue ret;
+
+    ret = verify_hello (b,
+                        GNUNET_TIME_absolute_ntoh (bh->expiration_time),
+                        &bh->sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_HELLO_builder_get_expiration_time (const struct
+                                          GNUNET_MessageHeader *msg)
+{
+  if (GNUNET_MESSAGE_TYPE_HELLO_URI == ntohs (msg->type))
+  {
+    const struct HelloUriMessage *h = (struct HelloUriMessage *) msg;
+    const struct BlockHeader *bh = (const struct BlockHeader *) &h[1];
+
+    return GNUNET_TIME_absolute_ntoh (bh->expiration_time);
+  }
+  else if (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO == ntohs (msg->type))
+  {
+    const struct DhtHelloMessage *dht_hello = (struct DhtHelloMessage *) msg;
+
+    return GNUNET_TIME_absolute_ntoh (dht_hello->expiration_time);
+  }
+  else
+    GNUNET_break (0);
+  return GNUNET_TIME_UNIT_ZERO_ABS;
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url)
+{
+  const char *q;
+  const char *s1;
+  const char *s2;
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Absolute et;
+  size_t len;
+  struct GNUNET_HELLO_Builder *b;
+
+  if (0 != strncasecmp (url,
+                        "gnunet://hello/",
+                        strlen ("gnunet://hello/")))
+    return NULL;
+  url += strlen ("gnunet://hello/");
+  s1 = strchr (url, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  s2 = strchr (s1 + 1, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  q = strchr (url, '?');
+  if (NULL == q)
+    q = url + strlen (url);
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (url,
+                                     s1 - url,
+                                     &pid,
+                                     sizeof(pid)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (s1 + 1,
+                                     s2 - (s1 + 1),
+                                     &sig,
+                                     sizeof(sig)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  {
+    unsigned long long sec;
+    char dummy = '?';
+
+    if ( (0 == sscanf (s2 + 1,
+                       "%llu%c",
+                       &sec,
+                       &dummy)) ||
+         ('?' != dummy) )
+    {
+      GNUNET_break_op (0);
+      return NULL;
+    }
+    et = GNUNET_TIME_absolute_from_s (sec);
+  }
+
+  b = GNUNET_HELLO_builder_new (&pid);
+  len = strlen (q);
+  while (len > 0)
+  {
+    const char *eq;
+    const char *amp;
+    char *addr = NULL;
+    char *uri;
+
+    /* skip ?/& separator */
+    len--;
+    q++;
+    eq = strchr (q, '=');
+    if ( (eq == q) ||
+         (NULL == eq) )
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    amp = strchr (eq, '&');
+    if (NULL == amp)
+      amp = &q[len];
+    GNUNET_STRINGS_urldecode (eq + 1,
+                              amp - (eq + 1),
+                              &addr);
+    if ( (NULL == addr) ||
+         (0 == strlen (addr)) )
+    {
+      GNUNET_free (addr);
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_asprintf (&uri,
+                     "%.*s://%s",
+                     (int) (eq - q),
+                     q,
+                     addr);
+    GNUNET_free (addr);
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          uri))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (uri);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_free (uri);
+    /* move to next URL */
+    len -= (amp - q);
+    q = amp;
+  }
+
+  {
+    enum GNUNET_GenericReturnValue ret;
+
+    ret = verify_hello (b,
+                        et,
+                        &sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                             struct GNUNET_TIME_Relative expiration_time)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct HelloUriMessage *msg;
+  size_t blen;
+
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen,
+                                                expiration_time));
+  env = GNUNET_MQ_msg_extra (msg,
+                             blen,
+                             GNUNET_MESSAGE_TYPE_HELLO_URI);
+  msg->url_counter = htons ((uint16_t) builder->a_length);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                &msg[1],
+                                                &blen,
+                                                expiration_time));
+  return env;
+}
+
+
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  struct GNUNET_TIME_Relative expiration_time)
+{
+  struct DhtHelloMessage *msg;
+  size_t blen;
+
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen,
+                                                expiration_time));
+  GNUNET_assert (blen < UINT16_MAX);
+  GNUNET_assert (blen >= sizeof (struct BlockHeader));
+  {
+    char buf[blen] GNUNET_ALIGN;
+    const struct BlockHeader *block = (const struct BlockHeader *) buf;
+
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (builder,
+                                                  priv,
+                                                  buf,
+                                                  &blen,
+                                                  expiration_time));
+    msg = GNUNET_malloc (sizeof (*msg)
+                         + blen
+                         - sizeof (*block));
+    msg->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO);
+    msg->header.size = htons (sizeof (*msg)
+                              + blen
+                              - sizeof (*block));
+    memcpy (&msg[1],
+            &block[1],
+            blen - sizeof (*block));
+    msg->sig = block->sig;
+    msg->expiration_time = block->expiration_time;
+  }
+  msg->url_counter = htons ((uint16_t) builder->a_length);
+  return &msg->header;
+}
+
+
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Timestamp et;
+  char *result;
+  char *pids;
+  char *sigs;
+  const char *sep = "?";
+
+  et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  sign_hello (builder,
+              et,
+              priv,
+              &sig);
+  pids = GNUNET_STRINGS_data_to_string_alloc (&builder->pid,
+                                              sizeof (builder->pid));
+  sigs = GNUNET_STRINGS_data_to_string_alloc (&sig,
+                                              sizeof (sig));
+  GNUNET_asprintf (&result,
+                   "gnunet://hello/%s/%s/%llu",
+                   pids,
+                   sigs,
+                   (unsigned long long) GNUNET_TIME_timestamp_to_s (et));
+  GNUNET_free (sigs);
+  GNUNET_free (pids);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    char *ue;
+    char *tmp;
+    int pfx_len;
+    const char *eou;
+
+    eou = strstr (a->uri,
+                  "://");
+    if (NULL == eou)
+    {
+      GNUNET_break (0);
+      GNUNET_free (result);
+      return NULL;
+    }
+    pfx_len = eou - a->uri;
+    eou += 3;
+    GNUNET_STRINGS_urlencode (a->uri_len - 4 - pfx_len,
+                              eou,
+                              &ue);
+    GNUNET_asprintf (&tmp,
+                     "%s%s%.*s=%s",
+                     result,
+                     sep,
+                     pfx_len,
+                     a->uri,
+                     ue);
+    GNUNET_free (ue);
+    GNUNET_free (result);
+    result = tmp;
+    sep = "&";
+  }
+  return result;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Relative expiration_time)
+{
+  struct BlockHeader bh;
+  size_t needed = sizeof (bh);
+  char *pos;
+  struct GNUNET_TIME_Timestamp et;
+
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_assert (needed + a->uri_len > needed);
+    needed += a->uri_len;
+  }
+  if ( (NULL == block) ||
+       (needed < *block_size) )
+  {
+    *block_size = needed;
+    return GNUNET_NO;
+  }
+  bh.pid = builder->pid;
+  if (GNUNET_TIME_UNIT_ZERO.rel_value_us == expiration_time.rel_value_us)
+    et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  else
+    et = GNUNET_TIME_relative_to_timestamp (expiration_time);
+  bh.expiration_time = GNUNET_TIME_absolute_hton (et.abs_time);
+  sign_hello (builder,
+              et,
+              priv,
+              &bh.sig);
+  memcpy (block,
+          &bh,
+          sizeof (bh));
+  pos = block + sizeof (bh);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    memcpy (pos,
+            a->uri,
+            a->uri_len);
+    pos += a->uri_len;
+  }
+  *block_size = needed;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  size_t alen = strlen (address) + 1;
+  struct Address *a;
+  const char *e;
+
+  if (NULL == (e = strstr (address,
+                           "://")))
+  {
+    GNUNET_break_op (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Invalid address `%s'\n",
+                address);
+    return GNUNET_SYSERR;
+  }
+  if (e == address)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  for (const char *p = address; p != e; p++)
+    if ( (! isalpha ((unsigned char) *p)) &&
+         ('+' != *p) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      return GNUNET_NO;
+  a = GNUNET_malloc (sizeof (struct Address) + alen);
+  a->uri_len = alen;
+  memcpy (&a[1],
+          address,
+          alen);
+  a->uri = (const char *) &a[1];
+  GNUNET_CONTAINER_DLL_insert_tail (builder->a_head,
+                                    builder->a_tail,
+                                    a);
+  builder->a_length++;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  struct Address *a;
+
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      break;
+  if (NULL == a)
+    return GNUNET_NO;
+  GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                               builder->a_tail,
+                               a);
+  builder->a_length--;
+  GNUNET_free (a);
+  return GNUNET_OK;
+}
+
+
+const struct GNUNET_PeerIdentity*
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls)
+{
+  struct Address *nxt;
+
+  if (NULL == uc)
+    return &builder->pid;
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = nxt)
+  {
+    nxt = a->next;
+    uc (uc_cls,
+        &builder->pid,
+        a->uri);
+  }
+  return &builder->pid;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration)
+{
+  const struct DhtHelloMessage *msg
+    = (const struct DhtHelloMessage *) hello;
+  uint16_t len = ntohs (hello->size);
+  struct BlockHeader *bh;
+  struct GNUNET_HELLO_Builder *b;
+  enum GNUNET_GenericReturnValue ret;
+
+  if (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO != ntohs (hello->type))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (len < sizeof (*msg))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len -= sizeof (*msg);
+  *block_size = len + sizeof (*bh);
+  *block = GNUNET_malloc (*block_size);
+  bh = *block;
+  bh->pid = *pid;
+  bh->sig = msg->sig;
+  bh->expiration_time = msg->expiration_time;
+  *block_expiration = GNUNET_TIME_absolute_ntoh (msg->expiration_time);
+  memcpy (&bh[1],
+          &msg[1],
+          len);
+  b = GNUNET_HELLO_builder_from_block (*block,
+                                       *block_size);
+  if (NULL == b)
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  ret = verify_hello (b,
+                      *block_expiration,
+                      &msg->sig);
+  GNUNET_HELLO_builder_free (b);
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  return ret;
+}
+
+
+/**
+ * Given an address as a string, extract the prefix that identifies
+ * the communicator offering transmissions to that address.
+ *
+ * @param address a peer's address
+ * @return NULL if the address is mal-formed, otherwise the prefix
+ */
+char *
+GNUNET_HELLO_address_to_prefix (const char *address)
+{
+  const char *dash;
+
+  dash = strchr (address, '-');
+  if (NULL == dash)
+    return NULL;
+  return GNUNET_strndup (address, dash - address);
+}
+
+
+/**
+ * Build address record by signing raw information with private key.
+ *
+ * @param address text address at @a communicator to sign
+ * @param nt network type of @a address
+ * @param mono_time monotonic time at which @a address was valid
+ * @param private_key signing key to use
+ * @param[out] result where to write address record (allocated)
+ * @param[out] result_size set to size of @a result
+ */
+void
+GNUNET_HELLO_sign_address (
+  const char *address,
+  enum GNUNET_NetworkType nt,
+  struct GNUNET_TIME_Absolute mono_time,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *private_key,
+  void **result,
+  size_t *result_size)
+{
+  struct SignedAddress sa;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  char *sig_str;
+
+  sa.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS);
+  sa.purpose.size = htonl (sizeof(sa));
+  sa.mono_time = GNUNET_TIME_absolute_hton (mono_time);
+  GNUNET_CRYPTO_hash (address, strlen (address), &sa.addr_hash);
+  GNUNET_CRYPTO_eddsa_sign (private_key, &sa, &sig);
+  sig_str = NULL;
+  (void) GNUNET_STRINGS_base64_encode (&sig, sizeof(sig), &sig_str);
+  *result_size =
+    1 + GNUNET_asprintf ((char **) result,
+                         "%s;%llu;%u;%s",
+                         sig_str,
+                         (unsigned long long) mono_time.abs_value_us,
+                         (unsigned int) nt,
+                         address);
+  GNUNET_free (sig_str);
+}
diff --git a/src/lib/hello/meson.build b/src/lib/hello/meson.build
new file mode 100644
index 000000000..caf70e4a7
--- /dev/null
+++ b/src/lib/hello/meson.build
@@ -0,0 +1,27 @@
+libgnunethello_src = ['hello-uri.c']
+
+libgnunethello = library('gnunethello',
+        libgnunethello_src,
+        soversion: '0',
+        version: '0.1.0',
+        dependencies: libgnunetutil_dep,
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunethello_dep = declare_dependency(link_with : libgnunethello)
+pkg.generate(libgnunethello, url: 'https://www.gnunet.org',
+             description : 'Helper library for handling GNUnet HELLO messages')
+
+
+test_hello_uri = executable ('test_hello_uri',
+            ['test_hello-uri.c'],
+            dependencies: [libgnunethello_dep,
+                           libgnunetutil_dep,
+                           gcrypt_dep],
+            include_directories: [incdir, configuration_inc],
+            build_by_default: false,
+            install: false)
+
+test('test_hello_uri', test_hello_uri,
+  workdir: meson.current_build_dir(),
+  suite: ['hello'])
diff --git a/src/lib/hello/test_hello-uri.c b/src/lib/hello/test_hello-uri.c
new file mode 100644
index 000000000..9f3179270
--- /dev/null
+++ b/src/lib/hello/test_hello-uri.c
@@ -0,0 +1,215 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file hello/test_hello-uri.c
+ * @brief test for helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_hello_uri_lib.h"
+
+
+/**
+ * Check for expected URIs.
+ *
+ * @param cls a `unsigned int*`, bitmask set to found URIs
+ * @param uri URI to check for
+ */
+static void
+check_uris (void *cls,
+            const struct GNUNET_PeerIdentity *pid,
+            const char *uri)
+{
+  unsigned int *found = cls;
+
+  if (0 == strcmp (uri,
+                   "test://address"))
+    *found |= 1;
+  else if (0 == strcmp (uri,
+                        "test://more"))
+    *found |= 2;
+  else
+    *found = (unsigned int) -1;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_HELLO_Builder *b;
+  struct GNUNET_CRYPTO_EddsaPrivateKey priv;
+
+  GNUNET_log_setup ("test-hell-uri",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_eddsa_key_create (&priv);
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "invalid"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "i%v://bla"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "://empty"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://more"));
+  {
+    void *block;
+    size_t block_size = 0;
+    struct GNUNET_HELLO_Builder *b2;
+    const struct GNUNET_PeerIdentity *p2;
+    unsigned int found;
+
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size,
+                                                  GNUNET_TIME_UNIT_FOREVER_REL));
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size,
+                                                  GNUNET_TIME_UNIT_FOREVER_REL));
+    GNUNET_assert (0 != block_size);
+    block = GNUNET_malloc (block_size);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  block,
+                                                  &block_size,
+                                                  GNUNET_TIME_UNIT_FOREVER_REL));
+    b2 = GNUNET_HELLO_builder_from_block (block,
+                                          block_size);
+    GNUNET_free (block);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    p2 = GNUNET_HELLO_builder_iterate (b2,
+                                       &check_uris,
+                                       &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  {
+    char *url;
+    struct GNUNET_HELLO_Builder *b2;
+    const struct GNUNET_PeerIdentity *p2;
+    unsigned int found;
+
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    b2 = GNUNET_HELLO_builder_from_url (url);
+    GNUNET_free (url);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    p2 = GNUNET_HELLO_builder_iterate (b2,
+                                       &check_uris,
+                                       &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct GNUNET_HELLO_Builder *b2;
+    const struct GNUNET_PeerIdentity *p2;
+    unsigned int found;
+
+    env = GNUNET_HELLO_builder_to_env (b,
+                                       &priv,
+                                       GNUNET_TIME_UNIT_FOREVER_REL);
+    b2 = GNUNET_HELLO_builder_from_msg (GNUNET_MQ_env_get_msg (env));
+    GNUNET_free (env);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    p2 = GNUNET_HELLO_builder_iterate (b2,
+                                       &check_uris,
+                                       &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  GNUNET_HELLO_builder_free (b);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (priv.d,
+                                    sizeof (priv.d),
+                                    GCRYMPI_CONST_ONE);
+  priv.d[0] &= 248;
+  priv.d[31] &= 127;
+  priv.d[31] |= 64;
+  {
+    char *buf;
+
+    buf = GNUNET_STRINGS_data_to_string_alloc (&priv,
+                                               sizeof (priv));
+    fprintf (stderr,
+             "PK: %s\n",
+             buf);
+    GNUNET_free (buf);
+  }
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "a://first"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "b://second"));
+  {
+    char *url;
+
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    fprintf (stderr,
+             "TV: %s\n",
+             url);
+    GNUNET_free (url);
+  }
+  GNUNET_HELLO_builder_free (b);
+
+  return 0;
+}
diff --git a/src/lib/json/.gitignore b/src/lib/json/.gitignore
new file mode 100644
index 000000000..347bffd7b
--- /dev/null
+++ b/src/lib/json/.gitignore
@@ -0,0 +1,2 @@
+test_json
+test_json_mhd
diff --git a/src/lib/json/Makefile.am b/src/lib/json/Makefile.am
new file mode 100644
index 000000000..c67824ee4
--- /dev/null
+++ b/src/lib/json/Makefile.am
@@ -0,0 +1,57 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+lib_LTLIBRARIES = \
+  libgnunetjson.la
+
+libgnunetjson_la_LDFLAGS = \
+  $(GN_LIBINTL) \
+  -version-info 0:0:0 \
+  -no-undefined
+libgnunetjson_la_CFLAGS = \
+  $(MHD_CFLAGS) \
+  $(AM_CFLAGS)
+libgnunetjson_la_SOURCES = \
+  json.c \
+  json_generator.c \
+  json_helper.c \
+  json_mhd.c \
+  json_pack.c
+libgnunetjson_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  -ljansson \
+  $(MHD_LIBS) \
+  $(XLIB) \
+  $(Z_LIBS)
+
+check_PROGRAMS = \
+  test_json \
+  test_json_mhd
+
+TESTS = \
+  $(check_PROGRAMS)
+
+test_json_SOURCES = \
+  test_json.c
+test_json_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
+test_json_LDADD = \
+  libgnunetjson.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  -ljansson
+
+
+test_json_mhd_SOURCES = \
+  test_json_mhd.c
+test_json_mhd_LDADD = \
+  libgnunetjson.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  -ljansson \
+  $(MHD_LIBS) \
+  $(Z_LIBS) \
+  @LIBCURL@
+test_json_mhd_CFLAGS = $(MHD_CFLAGS) @LIBCURL_CPPFLAGS@ $(AM_CFLAGS)
diff --git a/src/lib/json/json.c b/src/lib/json/json.c
new file mode 100644
index 000000000..07ec158be
--- /dev/null
+++ b/src/lib/json/json.c
@@ -0,0 +1,161 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014-2017, 2021, 2022 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file json/json.c
+ * @brief functions to parse JSON snippets
+ * @author Florian Dold
+ * @author Benedikt Mueller
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_json_lib.h"
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_JSON_parse (const json_t *root,
+                   struct GNUNET_JSON_Specification *spec,
+                   const char **error_json_name,
+                   unsigned int *error_line)
+{
+  if (NULL == root)
+    return GNUNET_SYSERR;
+  for (unsigned int i = 0; NULL != spec[i].parser; i++)
+  {
+    json_t *pos;
+
+    if (NULL == spec[i].field)
+      pos = (json_t *) root;
+    else
+      pos = json_object_get (root,
+                             spec[i].field);
+    if ( ( (NULL == pos) ||
+           (json_is_null (pos) ) ) &&
+         (spec[i].is_optional) )
+    {
+      if (NULL != spec[i].missing)
+        *spec[i].missing = true;
+      continue;
+    }
+    if ( (NULL == pos) ||
+         (GNUNET_OK !=
+          spec[i].parser (spec[i].cls,
+                          pos,
+                          &spec[i])) )
+    {
+      if (NULL != error_json_name)
+        *error_json_name = spec[i].field;
+      else
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Parsing failed for field `%s:%u`\n",
+                    spec[i].field,
+                    i);
+      if (NULL != error_line)
+        *error_line = i;
+      GNUNET_JSON_parse_free (spec);
+      return GNUNET_SYSERR;
+    }
+    if (NULL != spec[i].missing)
+      *spec[i].missing = false;
+  }
+  return GNUNET_OK; /* all OK! */
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_mark_optional (struct GNUNET_JSON_Specification spec,
+                                bool *missing)
+{
+  struct GNUNET_JSON_Specification ret = spec;
+
+  ret.is_optional = true;
+  ret.missing = missing;
+  return ret;
+}
+
+
+void
+GNUNET_JSON_parse_free (struct GNUNET_JSON_Specification *spec)
+{
+  for (unsigned int i = 0; NULL != spec[i].parser; i++)
+    if (NULL != spec[i].cleaner)
+      spec[i].cleaner (spec[i].cls,
+                       &spec[i]);
+}
+
+
+/**
+ * Set an option with a JSON value from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'json_t *')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_json (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+          void *scls,
+          const char *option,
+          const char *value)
+{
+  json_t **json = scls;
+  json_error_t error;
+
+  *json = json_loads (value,
+                      JSON_REJECT_DUPLICATES,
+                      &error);
+  if (NULL == *json)
+  {
+    fprintf (stderr,
+             _ ("Failed to parse JSON in option `%s': %s (%s)\n"),
+             option,
+             error.text,
+             error.source);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_JSON_getopt (char shortName,
+                    const char *name,
+                    const char *argumentHelp,
+                    const char *description,
+                    json_t **json)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_json,
+    .scls = (void *) json
+  };
+
+  return clo;
+}
+
+
+/* end of json.c */
diff --git a/src/lib/json/json_generator.c b/src/lib/json/json_generator.c
new file mode 100644
index 000000000..43b72ba57
--- /dev/null
+++ b/src/lib/json/json_generator.c
@@ -0,0 +1,207 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2016 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file json/json_generator.c
+ * @brief helper functions for generating JSON from GNUnet data structures
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+
+
+json_t *
+GNUNET_JSON_from_data (const void *data,
+                       size_t size)
+{
+  char *buf;
+  json_t *json;
+
+  if (size >= ( (GNUNET_MAX_MALLOC_CHECKED - 1) * 5) - 4 / 8)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  buf = GNUNET_STRINGS_data_to_string_alloc (data,
+                                             size);
+  json = json_string (buf);
+  GNUNET_free (buf);
+  GNUNET_break (NULL != json);
+  return json;
+}
+
+
+json_t *
+GNUNET_JSON_from_data64 (const void *data,
+                         size_t size)
+{
+  char *buf = NULL;
+  json_t *json;
+  size_t len;
+
+  if (size >= ( ( (GNUNET_MAX_MALLOC_CHECKED - 1) * 6) - 5) / 8)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  len = GNUNET_STRINGS_base64_encode (data,
+                                      size,
+                                      &buf);
+  if (NULL == buf)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  json = json_stringn (buf,
+                       len);
+  GNUNET_free (buf);
+  GNUNET_break (NULL != json);
+  return json;
+}
+
+
+json_t *
+GNUNET_JSON_from_timestamp (struct GNUNET_TIME_Timestamp stamp)
+{
+  json_t *j;
+
+  j = json_object ();
+  if (NULL == j)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (GNUNET_TIME_absolute_is_never (stamp.abs_time))
+  {
+    if (0 !=
+        json_object_set_new (j,
+                             "t_s",
+                             json_string ("never")))
+    {
+      GNUNET_break (0);
+      json_decref (j);
+      return NULL;
+    }
+    return j;
+  }
+  GNUNET_assert (
+    0 ==
+    (stamp.abs_time.abs_value_us
+     % GNUNET_TIME_UNIT_SECONDS.rel_value_us));
+  if (0 !=
+      json_object_set_new (
+        j,
+        "t_s",
+        json_integer (
+          (json_int_t) (stamp.abs_time.abs_value_us
+                        / GNUNET_TIME_UNIT_SECONDS.rel_value_us))))
+  {
+    GNUNET_break (0);
+    json_decref (j);
+    return NULL;
+  }
+  return j;
+}
+
+
+json_t *
+GNUNET_JSON_from_timestamp_nbo (struct GNUNET_TIME_TimestampNBO stamp)
+{
+  return GNUNET_JSON_from_timestamp (GNUNET_TIME_timestamp_ntoh (stamp));
+}
+
+
+json_t *
+GNUNET_JSON_from_time_rel (struct GNUNET_TIME_Relative stamp)
+{
+  json_t *j;
+
+  j = json_object ();
+  if (NULL == j)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (GNUNET_TIME_relative_is_forever (stamp))
+  {
+    if (0 !=
+        json_object_set_new (j,
+                             "d_us",
+                             json_string ("forever")))
+    {
+      GNUNET_break (0);
+      json_decref (j);
+      return NULL;
+    }
+    return j;
+  }
+  if (stamp.rel_value_us >= (1LLU << 53))
+  {
+    /* value is larger than allowed */
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (0 !=
+      json_object_set_new (
+        j,
+        "d_us",
+        json_integer ((json_int_t) stamp.rel_value_us)))
+  {
+    GNUNET_break (0);
+    json_decref (j);
+    return NULL;
+  }
+  return j;
+}
+
+
+json_t *
+GNUNET_JSON_from_rsa_public_key (const struct GNUNET_CRYPTO_RsaPublicKey *pk)
+{
+  void *buf;
+  size_t buf_len;
+  json_t *ret;
+
+  buf_len = GNUNET_CRYPTO_rsa_public_key_encode (pk,
+                                                 &buf);
+  ret = GNUNET_JSON_from_data (buf,
+                               buf_len);
+  GNUNET_free (buf);
+  return ret;
+}
+
+
+json_t *
+GNUNET_JSON_from_rsa_signature (const struct GNUNET_CRYPTO_RsaSignature *sig)
+{
+  void *buf;
+  size_t buf_len;
+  json_t *ret;
+
+  buf_len = GNUNET_CRYPTO_rsa_signature_encode (sig,
+                                                &buf);
+  ret = GNUNET_JSON_from_data (buf,
+                               buf_len);
+  GNUNET_free (buf);
+  return ret;
+}
+
+
+/* End of json/json_generator.c */
diff --git a/src/lib/json/json_helper.c b/src/lib/json/json_helper.c
new file mode 100644
index 000000000..5c2f8ae05
--- /dev/null
+++ b/src/lib/json/json_helper.c
@@ -0,0 +1,1611 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014-2022 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file json/json_helper.c
+ * @brief functions to generate specifciations for JSON parsing
+ * @author Florian Dold
+ * @author Benedikt Mueller
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_common.h"
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_end ()
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = NULL,
+    .cleaner = NULL,
+    .cls = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Convert string value to numeric cipher value.
+ *
+ * @param cipher_s input string
+ * @return numeric cipher value
+ */
+static enum GNUNET_CRYPTO_BlindSignatureAlgorithm
+string_to_cipher (const char *cipher_s)
+{
+  if ((0 == strcasecmp (cipher_s,
+                        "RSA")) ||
+      (0 == strcasecmp (cipher_s,
+                        "RSA+age_restricted")))
+    return GNUNET_CRYPTO_BSA_RSA;
+  if ((0 == strcasecmp (cipher_s,
+                        "CS")) ||
+      (0 == strcasecmp (cipher_s,
+                        "CS+age_restricted")))
+    return GNUNET_CRYPTO_BSA_CS;
+  return GNUNET_CRYPTO_BSA_INVALID;
+}
+
+
+/**
+ * Parse given JSON object to fixed size data
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_fixed_data (void *cls,
+                  json_t *root,
+                  struct GNUNET_JSON_Specification *spec)
+{
+  const char *enc;
+  size_t len;
+
+  if (NULL == (enc = json_string_value (root)))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len = strlen (enc);
+  if (len >= SIZE_MAX / 5)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (((len * 5) / 8) != spec->ptr_size)
+  {
+    GNUNET_break_op (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Field `%s' has wrong length\n",
+                spec->field);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc,
+                                     len,
+                                     spec->ptr,
+                                     spec->ptr_size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_fixed (const char *name,
+                        void *obj,
+                        size_t size)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_fixed_data,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = obj,
+    .ptr_size = size,
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to fixed size data
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_fixed64_data (void *cls,
+                    json_t *root,
+                    struct GNUNET_JSON_Specification *spec)
+{
+  const char *enc;
+  unsigned int len;
+  void *output;
+  size_t olen;
+
+  if (NULL == (enc = json_string_value (root)))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len = strlen (enc);
+  output = NULL;
+  olen = GNUNET_STRINGS_base64_decode (enc,
+                                       len,
+                                       &output);
+  if (olen != spec->ptr_size)
+  {
+    GNUNET_break_op (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Field `%s' has wrong length\n",
+                spec->field);
+    GNUNET_free (output);
+    return GNUNET_SYSERR;
+  }
+  memcpy (spec->ptr,
+          output,
+          olen);
+  GNUNET_free (output);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_fixed64 (const char *name,
+                          void *obj,
+                          size_t size)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_fixed64_data,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = obj,
+    .ptr_size = size,
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to variable size data
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_variable_data (void *cls,
+                     json_t *root,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  const char *str;
+  size_t size;
+  void *data;
+
+  str = json_string_value (root);
+  if (NULL == str)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data_alloc (str,
+                                           strlen (str),
+                                           &data,
+                                           &size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *(void **) spec->ptr = data;
+  *spec->size_ptr = size;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing variable size data
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_variable_data (void *cls,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  (void) cls;
+  if (0 != *spec->size_ptr)
+  {
+    GNUNET_free (*(void **) spec->ptr);
+    *(void **) spec->ptr = NULL;
+    *spec->size_ptr = 0;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_varsize (const char *name,
+                          void **obj,
+                          size_t *size)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_variable_data,
+    .cleaner = &clean_variable_data,
+    .cls = NULL,
+    .field = name,
+    .ptr = obj,
+    .ptr_size = 0,
+    .size_ptr = size
+  };
+
+  *obj = NULL;
+  *size = 0;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to string.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_string (void *cls,
+              json_t *root,
+              struct GNUNET_JSON_Specification *spec)
+{
+  const char *str;
+
+  (void) cls;
+  str = json_string_value (root);
+  if (NULL == str)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *(const char **) spec->ptr = str;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_string (const char *name,
+                         const char **strptr)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_string,
+    .field = name,
+    .ptr = strptr
+  };
+
+  *strptr = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a JSON object. (Yes, trivial.)
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_json (void *cls,
+            json_t *root,
+            struct GNUNET_JSON_Specification *spec)
+{
+  if (! (json_is_object (root) || json_is_array (root)))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  json_incref (root);
+  *(json_t **) spec->ptr = root;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing JSON object.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_json (void *cls,
+            struct GNUNET_JSON_Specification *spec)
+{
+  json_t **ptr = (json_t **) spec->ptr;
+
+  if (NULL != *ptr)
+  {
+    json_decref (*ptr);
+    *ptr = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_json (const char *name,
+                       json_t **jsonp)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_json,
+    .cleaner = &clean_json,
+    .cls = NULL,
+    .field = name,
+    .ptr = jsonp,
+    .ptr_size = 0,
+    .size_ptr = NULL
+  };
+
+  *jsonp = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a JSON object.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_object_const (void *cls,
+                    json_t *root,
+                    struct GNUNET_JSON_Specification *spec)
+{
+  if (NULL == root)
+    return GNUNET_OK;
+  if (! json_is_object (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *(const json_t **) spec->ptr = (const json_t *) root;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_object_const (const char *name,
+                               const json_t **jsonp)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_object_const,
+    .cls = NULL,
+    .field = name,
+    .ptr = jsonp,
+    .ptr_size = 0,
+    .size_ptr = NULL
+  };
+
+  *jsonp = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON to a JSON array.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_array_const (void *cls,
+                   json_t *root,
+                   struct GNUNET_JSON_Specification *spec)
+{
+  if (NULL == root)
+    return GNUNET_OK;
+  if (! json_is_array (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *(const json_t **) spec->ptr = (const json_t *) root;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_array_const (const char *name,
+                              const json_t **jsonp)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_array_const,
+    .cls = NULL,
+    .field = name,
+    .ptr = jsonp,
+    .ptr_size = 0,
+    .size_ptr = NULL
+  };
+
+  *jsonp = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a bool.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_bool (void *cls,
+            json_t *root,
+            struct GNUNET_JSON_Specification *spec)
+{
+  bool *b = spec->ptr;
+
+  if (json_true () == root)
+  {
+    *b = true;
+    return GNUNET_OK;
+  }
+  if (json_false () == root)
+  {
+    *b = false;
+    return GNUNET_OK;
+  }
+  GNUNET_break_op (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_bool (const char *name,
+                       bool *b)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_bool,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = b,
+    .ptr_size = sizeof(bool),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a double.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_double (void *cls,
+              json_t *root,
+              struct GNUNET_JSON_Specification *spec)
+{
+  double *f = spec->ptr;
+
+  if (! json_is_real (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *f = json_real_value (root);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_double (const char *name,
+                         double *f)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_double,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = f,
+    .ptr_size = sizeof(double),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a uint8_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_u8 (void *cls,
+          json_t *root,
+          struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  uint8_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  if ((0 > val) || (val > UINT8_MAX))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *up = (uint8_t) val;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_uint8 (const char *name,
+                        uint8_t *u8)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_u8,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = u8,
+    .ptr_size = sizeof(uint8_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a uint16_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_u16 (void *cls,
+           json_t *root,
+           struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  uint16_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  if ((0 > val) || (val > UINT16_MAX))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *up = (uint16_t) val;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_uint16 (const char *name,
+                         uint16_t *u16)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_u16,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = u16,
+    .ptr_size = sizeof(uint16_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a uint32_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_u32 (void *cls,
+           json_t *root,
+           struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  uint32_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  if ((0 > val) || (val > UINT32_MAX))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *up = (uint32_t) val;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_uint32 (const char *name,
+                         uint32_t *u32)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_u32,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = u32,
+    .ptr_size = sizeof(uint32_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a uint64_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_u64 (void *cls,
+           json_t *root,
+           struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  uint64_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  *up = (uint64_t) val;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_uint64 (const char *name,
+                         uint64_t *u64)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_u64,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = u64,
+    .ptr_size = sizeof(uint64_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a int64_t.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_i64 (void *cls,
+           json_t *root,
+           struct GNUNET_JSON_Specification *spec)
+{
+  json_int_t val;
+  int64_t *up = spec->ptr;
+
+  if (! json_is_integer (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  val = json_integer_value (root);
+  *up = (int64_t) val;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_int64 (const char *name,
+                        int64_t *i64)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_i64,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = i64,
+    .ptr_size = sizeof(int64_t),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/* ************ GNUnet-specific parser specifications ******************* */
+
+/**
+ * Parse given JSON object to a timestamp.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_timestamp (void *cls,
+                 json_t *root,
+                 struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_TIME_Timestamp *ts = spec->ptr;
+  json_t *json_t_s;
+  unsigned long long int tval;
+
+  if (! json_is_object (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  json_t_s = json_object_get (root,
+                              "t_s");
+  if (json_is_integer (json_t_s))
+  {
+    tval = json_integer_value (json_t_s);
+    /* Time is in seconds in JSON, but in microseconds in GNUNET_TIME_Absolute */
+    ts->abs_time.abs_value_us
+      = tval * GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+    if (ts->abs_time.abs_value_us
+        / GNUNET_TIME_UNIT_SECONDS.rel_value_us
+        != tval)
+    {
+      /* Integer overflow */
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+  }
+  if (json_is_string (json_t_s))
+  {
+    const char *val;
+
+    val = json_string_value (json_t_s);
+    if ((0 == strcasecmp (val,
+                          "never")))
+    {
+      ts->abs_time = GNUNET_TIME_UNIT_FOREVER_ABS;
+      return GNUNET_OK;
+    }
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_break_op (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp *t)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_timestamp,
+    .field = name,
+    .ptr = t,
+    .ptr_size = sizeof(struct GNUNET_TIME_Timestamp)
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to absolute time.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_timestamp_nbo (void *cls,
+                     json_t *root,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_TIME_TimestampNBO *ts = spec->ptr;
+  struct GNUNET_TIME_Timestamp a;
+  struct GNUNET_JSON_Specification ispec;
+
+  ispec = *spec;
+  ispec.parser = &parse_timestamp;
+  ispec.ptr = &a;
+  if (GNUNET_OK !=
+      parse_timestamp (NULL,
+                       root,
+                       &ispec))
+    return GNUNET_SYSERR;
+  *ts = GNUNET_TIME_timestamp_hton (a);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO *at)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_timestamp_nbo,
+    .field = name,
+    .ptr = at,
+    .ptr_size = sizeof(struct GNUNET_TIME_TimestampNBO)
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to relative time.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_rel_time (void *cls,
+                json_t *root,
+                struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_TIME_Relative *rel = spec->ptr;
+  json_t *json_d_us;
+  unsigned long long int tval;
+
+  if (! json_is_object (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  json_d_us = json_object_get (root,
+                               "d_us");
+  if (json_is_integer (json_d_us))
+  {
+    tval = json_integer_value (json_d_us);
+    if (tval >= (1LLU << 53))
+    {
+      /* value is larger than allowed */
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    rel->rel_value_us = tval;
+    return GNUNET_OK;
+  }
+  if (json_is_string (json_d_us))
+  {
+    const char *val;
+
+    val = json_string_value (json_d_us);
+    if ((0 == strcasecmp (val,
+                          "forever")))
+    {
+      *rel = GNUNET_TIME_UNIT_FOREVER_REL;
+      return GNUNET_OK;
+    }
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_break_op (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_relative_time (const char *name,
+                                struct GNUNET_TIME_Relative *rt)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_rel_time,
+    .field = name,
+    .ptr = rt,
+    .ptr_size = sizeof(struct GNUNET_TIME_Relative)
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to RSA public key.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_rsa_public_key (void *cls,
+                      json_t *root,
+                      struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = spec->ptr;
+  const char *enc;
+  char *buf;
+  size_t len;
+  size_t buf_len;
+
+  if (NULL == (enc = json_string_value (root)))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len = strlen (enc);
+  buf_len = (len * 5) / 8;
+  buf = GNUNET_malloc (buf_len);
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc,
+                                     len,
+                                     buf,
+                                     buf_len))
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (buf);
+    return GNUNET_SYSERR;
+  }
+  if (NULL == (*pk = GNUNET_CRYPTO_rsa_public_key_decode (buf,
+                                                          buf_len)))
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (buf);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (buf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing RSA public key.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_rsa_public_key (void *cls,
+                      struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = spec->ptr;
+
+  if (NULL != *pk)
+  {
+    GNUNET_CRYPTO_rsa_public_key_free (*pk);
+    *pk = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_rsa_public_key (const char *name,
+                                 struct GNUNET_CRYPTO_RsaPublicKey **pk)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_rsa_public_key,
+    .cleaner = &clean_rsa_public_key,
+    .field = name,
+    .ptr = pk
+  };
+
+  *pk = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to RSA signature.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_rsa_signature (void *cls,
+                     json_t *root,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_RsaSignature **sig = spec->ptr;
+  size_t size;
+  const char *str;
+  int res;
+  void *buf;
+
+  str = json_string_value (root);
+  if (NULL == str)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  size = (strlen (str) * 5) / 8;
+  buf = GNUNET_malloc (size);
+  res = GNUNET_STRINGS_string_to_data (str,
+                                       strlen (str),
+                                       buf,
+                                       size);
+  if (GNUNET_OK != res)
+  {
+    GNUNET_free (buf);
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (NULL == (*sig = GNUNET_CRYPTO_rsa_signature_decode (buf,
+                                                          size)))
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (buf);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (buf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing RSA signature.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_rsa_signature (void *cls,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_RsaSignature  **sig = spec->ptr;
+
+  if (NULL != *sig)
+  {
+    GNUNET_CRYPTO_rsa_signature_free (*sig);
+    *sig = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_rsa_signature (const char *name,
+                                struct GNUNET_CRYPTO_RsaSignature **sig)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_rsa_signature,
+    .cleaner = &clean_rsa_signature,
+    .cls = NULL,
+    .field = name,
+    .ptr = sig,
+    .ptr_size = 0,
+    .size_ptr = NULL
+  };
+
+  *sig = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to an int as a boolean.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_boolean (void *cls,
+               json_t *root,
+               struct GNUNET_JSON_Specification *spec)
+{
+  int *bp = spec->ptr;
+
+  if (! json_is_boolean (root))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  *bp = json_boolean_value (root) ? GNUNET_YES : GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_boolean (const char *name,
+                          int *boolean)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_boolean,
+    .cleaner = NULL,
+    .cls = NULL,
+    .field = name,
+    .ptr = boolean,
+    .ptr_size = sizeof(int),
+    .size_ptr = NULL
+  };
+
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a blinded message.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_blinded_message (void *cls,
+                       json_t *root,
+                       struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_BlindedMessage **target = spec->ptr;
+  struct GNUNET_CRYPTO_BlindedMessage *blinded_message;
+  const char *cipher;
+  struct GNUNET_JSON_Specification dspec[] = {
+    GNUNET_JSON_spec_string ("cipher",
+                             &cipher),
+    GNUNET_JSON_spec_end ()
+  };
+  const char *emsg;
+  unsigned int eline;
+
+  (void) cls;
+  if (GNUNET_OK !=
+      GNUNET_JSON_parse (root,
+                         dspec,
+                         &emsg,
+                         &eline))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  blinded_message = GNUNET_new (struct GNUNET_CRYPTO_BlindedMessage);
+  blinded_message->rc = 1;
+  blinded_message->cipher = string_to_cipher (cipher);
+  switch (blinded_message->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_varsize (
+          /* TODO: Change this field name to something
+                   more generic / pass in as argument. */
+          "rsa_blinded_planchet",
+          &blinded_message->details.rsa_blinded_message.blinded_msg,
+          &blinded_message->details.rsa_blinded_message.blinded_msg_size),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (blinded_message);
+        return GNUNET_SYSERR;
+      }
+      *target = blinded_message;
+      return GNUNET_OK;
+    }
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_fixed_auto (
+          "cs_nonce",
+          &blinded_message->details.cs_blinded_message.nonce),
+        GNUNET_JSON_spec_fixed_auto (
+          "cs_blinded_c0",
+          &blinded_message->details.cs_blinded_message.c[0]),
+        GNUNET_JSON_spec_fixed_auto (
+          "cs_blinded_c1",
+          &blinded_message->details.cs_blinded_message.c[1]),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (blinded_message);
+        return GNUNET_SYSERR;
+      }
+      *target = blinded_message;
+      return GNUNET_OK;
+    }
+  }
+  GNUNET_break_op (0);
+  GNUNET_free (blinded_message);
+  return GNUNET_SYSERR;
+}
+
+/**
+ * Cleanup data left from parsing blinded message.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_blinded_message (void *cls,
+                       struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_BlindedMessage **blinded_message = spec->ptr;
+
+  (void) cls;
+  if (NULL != blinded_message)
+  {
+    GNUNET_CRYPTO_blinded_message_decref (*blinded_message);
+    *blinded_message = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_blinded_message (const char *name,
+                                  struct GNUNET_CRYPTO_BlindedMessage **msg)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_blinded_message,
+    .cleaner = &clean_blinded_message,
+    .cls = NULL,
+    .field = name,
+    .ptr = msg,
+    .ptr_size = 0,
+    .size_ptr = NULL
+  };
+
+  *msg = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a blinded signature.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_blinded_sig (void *cls,
+                   json_t *root,
+                   struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_BlindedSignature **target = spec->ptr;
+  struct GNUNET_CRYPTO_BlindedSignature *blinded_sig;
+  const char *cipher;
+  struct GNUNET_JSON_Specification dspec[] = {
+    GNUNET_JSON_spec_string ("cipher",
+                             &cipher),
+    GNUNET_JSON_spec_end ()
+  };
+  const char *emsg;
+  unsigned int eline;
+
+  (void) cls;
+  if (GNUNET_OK !=
+      GNUNET_JSON_parse (root,
+                         dspec,
+                         &emsg,
+                         &eline))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  blinded_sig = GNUNET_new (struct GNUNET_CRYPTO_BlindedSignature);
+  blinded_sig->cipher = string_to_cipher (cipher);
+  blinded_sig->rc = 1;
+  switch (blinded_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_rsa_signature (
+          "blinded_rsa_signature",
+          &blinded_sig->details.blinded_rsa_signature),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (blinded_sig);
+        return GNUNET_SYSERR;
+      }
+      *target = blinded_sig;
+      return GNUNET_OK;
+    }
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_uint32 ("b",
+                                 &blinded_sig->details.blinded_cs_answer.b),
+        GNUNET_JSON_spec_fixed_auto ("s",
+                                     &blinded_sig->details.blinded_cs_answer.
+                                     s_scalar),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (blinded_sig);
+        return GNUNET_SYSERR;
+      }
+      *target = blinded_sig;
+      return GNUNET_OK;
+    }
+  }
+  GNUNET_break_op (0);
+  GNUNET_free (blinded_sig);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Cleanup data left from parsing blinded sig.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_blinded_sig (void *cls,
+                   struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_BlindedSignature **b_sig = spec->ptr;
+
+  (void) cls;
+
+  if (NULL != *b_sig)
+  {
+    GNUNET_CRYPTO_blinded_sig_decref (*b_sig);
+    *b_sig = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_blinded_signature (const char *field,
+                                    struct GNUNET_CRYPTO_BlindedSignature **b_sig)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_blinded_sig,
+    .cleaner = &clean_blinded_sig,
+    .field = field,
+    .ptr = b_sig
+  };
+
+  *b_sig = NULL;
+  return ret;
+}
+
+/**
+ * Parse given JSON object to unblinded signature.
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param[out] spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static enum GNUNET_GenericReturnValue
+parse_unblinded_sig (void *cls,
+                     json_t *root,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_UnblindedSignature **target = spec->ptr;
+  struct GNUNET_CRYPTO_UnblindedSignature *unblinded_sig;
+  const char *cipher;
+  struct GNUNET_JSON_Specification dspec[] = {
+    GNUNET_JSON_spec_string ("cipher",
+                             &cipher),
+    GNUNET_JSON_spec_end ()
+  };
+  const char *emsg;
+  unsigned int eline;
+
+  (void) cls;
+  if (GNUNET_OK !=
+      GNUNET_JSON_parse (root,
+                         dspec,
+                         &emsg,
+                         &eline))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  unblinded_sig = GNUNET_new (struct GNUNET_CRYPTO_UnblindedSignature);
+  unblinded_sig->cipher = string_to_cipher (cipher);
+  unblinded_sig->rc = 1;
+  switch (unblinded_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_rsa_signature (
+          "rsa_signature",
+          &unblinded_sig->details.rsa_signature),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (unblinded_sig);
+        return GNUNET_SYSERR;
+      }
+      *target = unblinded_sig;
+      return GNUNET_OK;
+    }
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_JSON_Specification ispec[] = {
+        GNUNET_JSON_spec_fixed_auto ("cs_signature_r",
+                                     &unblinded_sig->details.cs_signature.
+                                     r_point),
+        GNUNET_JSON_spec_fixed_auto ("cs_signature_s",
+                                     &unblinded_sig->details.cs_signature.
+                                     s_scalar),
+        GNUNET_JSON_spec_end ()
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_JSON_parse (root,
+                             ispec,
+                             &emsg,
+                             &eline))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (unblinded_sig);
+        return GNUNET_SYSERR;
+      }
+      *target = unblinded_sig;
+      return GNUNET_OK;
+    }
+  }
+  GNUNET_break_op (0);
+  GNUNET_free (unblinded_sig);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Cleanup data left from parsing unblinded signature.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_unblinded_sig (void *cls,
+                     struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_CRYPTO_UnblindedSignature **ub_sig = spec->ptr;
+
+  (void) cls;
+  if (NULL != *ub_sig)
+  {
+    GNUNET_CRYPTO_unblinded_sig_decref (*ub_sig);
+    *ub_sig = NULL;
+  }
+}
+
+
+struct GNUNET_JSON_Specification
+GNUNET_JSON_spec_unblinded_signature (const char *field,
+                                      struct GNUNET_CRYPTO_UnblindedSignature **ub_sig)
+{
+  struct GNUNET_JSON_Specification ret = {
+    .parser = &parse_unblinded_sig,
+    .cleaner = &clean_unblinded_sig,
+    .field = field,
+    .ptr = ub_sig
+  };
+
+  *ub_sig = NULL;
+  return ret;
+}
+
+
+
+/* end of json_helper.c */
diff --git a/src/lib/json/json_mhd.c b/src/lib/json/json_mhd.c
new file mode 100644
index 000000000..0b0fa0538
--- /dev/null
+++ b/src/lib/json/json_mhd.c
@@ -0,0 +1,379 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2016 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file json/json_mhd.c
+ * @brief functions to parse JSON snippets we receive via MHD
+ * @author Florian Dold
+ * @author Benedikt Mueller
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_json_lib.h"
+#include <zlib.h>
+
+
+/**
+ * Initial size for POST request buffers.  Should be big enough to
+ * usually not require a reallocation, but not so big that it hurts in
+ * terms of memory use.
+ */
+#define REQUEST_BUFFER_INITIAL (2 * 1024)
+
+
+/**
+ * Buffer for POST requests.
+ */
+struct Buffer
+{
+  /**
+   * Allocated memory
+   */
+  char *data;
+
+  /**
+   * Number of valid bytes in buffer.
+   */
+  size_t fill;
+
+  /**
+   * Number of allocated bytes in buffer.
+   */
+  size_t alloc;
+
+  /**
+   * Maximum buffer size allowed.
+   */
+  size_t max;
+};
+
+
+/**
+ * Initialize a buffer.
+ *
+ * @param buf the buffer to initialize
+ * @param data the initial data
+ * @param data_size size of the initial data
+ * @param alloc_size size of the buffer
+ * @param max_size maximum size that the buffer can grow to
+ * @return a GNUnet result code
+ */
+static int
+buffer_init (struct Buffer *buf,
+             const void *data,
+             size_t data_size,
+             size_t alloc_size,
+             size_t max_size)
+{
+  if ((data_size > max_size) || (alloc_size > max_size))
+    return GNUNET_SYSERR;
+  if (data_size > alloc_size)
+    alloc_size = data_size;
+  buf->data = GNUNET_malloc (alloc_size);
+  buf->alloc = alloc_size;
+  GNUNET_memcpy (buf->data, data, data_size);
+  buf->fill = data_size;
+  buf->max = max_size;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Free the data in a buffer.  Does *not* free
+ * the buffer object itself.
+ *
+ * @param buf buffer to de-initialize
+ */
+static void
+buffer_deinit (struct Buffer *buf)
+{
+  GNUNET_free (buf->data);
+  buf->data = NULL;
+}
+
+
+/**
+ * Append data to a buffer, growing the buffer if necessary.
+ *
+ * @param buf the buffer to append to
+ * @param data the data to append
+ * @param data_size the size of @a data
+ * @param max_size maximum size that the buffer can grow to
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if the buffer can't accommodate for the new data
+ */
+static int
+buffer_append (struct Buffer *buf,
+               const void *data,
+               size_t data_size,
+               size_t max_size)
+{
+  if (buf->fill + data_size > max_size)
+    return GNUNET_NO;
+  if (buf->fill + data_size > buf->alloc)
+  {
+    char *new_buf;
+    size_t new_size = buf->alloc;
+    while (new_size < buf->fill + data_size)
+      new_size += 2;
+    if (new_size > max_size)
+      return GNUNET_NO;
+    new_buf = GNUNET_malloc (new_size);
+    GNUNET_memcpy (new_buf, buf->data, buf->fill);
+    GNUNET_free (buf->data);
+    buf->data = new_buf;
+    buf->alloc = new_size;
+  }
+  GNUNET_memcpy (buf->data + buf->fill, data, data_size);
+  buf->fill += data_size;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Decompress data in @a buf.
+ *
+ * @param buf input data to inflate
+ * @return result code indicating the status of the operation
+ */
+static enum GNUNET_JSON_PostResult
+inflate_data (struct Buffer *buf)
+{
+  z_stream z;
+  char *tmp;
+  size_t tmp_size;
+  int ret;
+
+  memset (&z, 0, sizeof(z));
+  z.next_in = (Bytef *) buf->data;
+  z.avail_in = buf->fill;
+  tmp_size = GNUNET_MIN (buf->max, buf->fill * 4);
+  tmp = GNUNET_malloc (tmp_size);
+  z.next_out = (Bytef *) tmp;
+  z.avail_out = tmp_size;
+  ret = inflateInit (&z);
+  switch (ret)
+  {
+  case Z_MEM_ERROR:
+    GNUNET_break (0);
+    return GNUNET_JSON_PR_OUT_OF_MEMORY;
+
+  case Z_STREAM_ERROR:
+    GNUNET_break_op (0);
+    return GNUNET_JSON_PR_JSON_INVALID;
+
+  case Z_OK:
+    break;
+  }
+  while (1)
+  {
+    ret = inflate (&z, 0);
+    switch (ret)
+    {
+    case Z_BUF_ERROR:
+      GNUNET_break_op (0);
+      GNUNET_break (Z_OK == inflateEnd (&z));
+      GNUNET_free (tmp);
+      return GNUNET_JSON_PR_JSON_INVALID;
+    case Z_MEM_ERROR:
+      GNUNET_break (0);
+      GNUNET_break (Z_OK == inflateEnd (&z));
+      GNUNET_free (tmp);
+      return GNUNET_JSON_PR_OUT_OF_MEMORY;
+    case Z_DATA_ERROR:
+      GNUNET_break_op (0);
+      GNUNET_break (Z_OK == inflateEnd (&z));
+      GNUNET_free (tmp);
+      return GNUNET_JSON_PR_JSON_INVALID;
+    case Z_NEED_DICT:
+      GNUNET_break_op (0);
+      GNUNET_break (Z_OK == inflateEnd (&z));
+      GNUNET_free (tmp);
+      return GNUNET_JSON_PR_JSON_INVALID;
+    case Z_OK:
+      if ((0 < z.avail_out) && (0 == z.avail_in))
+      {
+        /* truncated input stream */
+        GNUNET_break (0);
+        GNUNET_break (Z_OK == inflateEnd (&z));
+        GNUNET_free (tmp);
+        return GNUNET_JSON_PR_JSON_INVALID;
+      }
+      if (0 < z.avail_out)
+        continue;     /* just call it again */
+      /* output buffer full, can we grow it? */
+      if (tmp_size == buf->max)
+      {
+        /* already at max */
+        GNUNET_break (0);
+        GNUNET_break (Z_OK == inflateEnd (&z));
+        GNUNET_free (tmp);
+        return GNUNET_JSON_PR_OUT_OF_MEMORY;
+      }
+      if (tmp_size * 2 < tmp_size)
+        tmp_size = buf->max;
+      else
+        tmp_size = GNUNET_MIN (buf->max, tmp_size * 2);
+      tmp = GNUNET_realloc (tmp, tmp_size);
+      z.next_out = (Bytef *) &tmp[z.total_out];
+      continue;
+    case Z_STREAM_END:
+      /* decompression successful, make 'tmp' the new 'data' */
+      GNUNET_free (buf->data);
+      buf->data = tmp;
+      buf->alloc = tmp_size;
+      buf->fill = z.total_out;
+      GNUNET_break (Z_OK == inflateEnd (&z));
+      return GNUNET_JSON_PR_SUCCESS;     /* at least for now */
+    }
+  }   /* while (1) */
+}
+
+
+/**
+ * Process a POST request containing a JSON object.  This function
+ * realizes an MHD POST processor that will (incrementally) process
+ * JSON data uploaded to the HTTP server.  It will store the required
+ * state in the @a con_cls, which must be cleaned up using
+ * #GNUNET_JSON_post_parser_callback().
+ *
+ * @param buffer_max maximum allowed size for the buffer
+ * @param connection MHD connection handle (for meta data about the upload)
+ * @param con_cls the closure (will point to a `struct Buffer *`)
+ * @param upload_data the POST data
+ * @param upload_data_size number of bytes in @a upload_data
+ * @param json the JSON object for a completed request
+ * @return result code indicating the status of the operation
+ */
+enum GNUNET_JSON_PostResult
+GNUNET_JSON_post_parser (size_t buffer_max,
+                         struct MHD_Connection *connection,
+                         void **con_cls,
+                         const char *upload_data,
+                         size_t *upload_data_size,
+                         json_t **json)
+{
+  struct Buffer *r = *con_cls;
+  const char *ce;
+  int ret;
+
+  *json = NULL;
+  if (NULL == *con_cls)
+  {
+    /* We are seeing a fresh POST request. */
+    r = GNUNET_new (struct Buffer);
+    if (GNUNET_OK != buffer_init (r,
+                                  upload_data,
+                                  *upload_data_size,
+                                  REQUEST_BUFFER_INITIAL,
+                                  buffer_max))
+    {
+      *con_cls = NULL;
+      buffer_deinit (r);
+      GNUNET_free (r);
+      return GNUNET_JSON_PR_OUT_OF_MEMORY;
+    }
+    /* everything OK, wait for more POST data */
+    *upload_data_size = 0;
+    *con_cls = r;
+    return GNUNET_JSON_PR_CONTINUE;
+  }
+  if (0 != *upload_data_size)
+  {
+    /* We are seeing an old request with more data available. */
+
+    if (GNUNET_OK !=
+        buffer_append (r, upload_data, *upload_data_size, buffer_max))
+    {
+      /* Request too long */
+      *con_cls = NULL;
+      buffer_deinit (r);
+      GNUNET_free (r);
+      return GNUNET_JSON_PR_REQUEST_TOO_LARGE;
+    }
+    /* everything OK, wait for more POST data */
+    *upload_data_size = 0;
+    return GNUNET_JSON_PR_CONTINUE;
+  }
+
+  /* We have seen the whole request. */
+  ce = MHD_lookup_connection_value (connection,
+                                    MHD_HEADER_KIND,
+                                    MHD_HTTP_HEADER_CONTENT_ENCODING);
+  if ((NULL != ce) && (0 == strcasecmp ("deflate", ce)))
+  {
+    ret = inflate_data (r);
+    if (GNUNET_JSON_PR_SUCCESS != ret)
+    {
+      buffer_deinit (r);
+      GNUNET_free (r);
+      *con_cls = NULL;
+      return ret;
+    }
+  }
+
+  {
+    json_error_t err;
+
+    *json = json_loadb (r->data,
+                        r->fill,
+                        0,
+                        &err);
+    if (NULL == *json)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Failed to parse JSON request body of %u byte at offset %d: %s\n",
+                  (unsigned int) r->fill,
+                  err.position,
+                  err.text);
+      buffer_deinit (r);
+      GNUNET_free (r);
+      *con_cls = NULL;
+      return GNUNET_JSON_PR_JSON_INVALID;
+    }
+  }
+  buffer_deinit (r);
+  GNUNET_free (r);
+  *con_cls = NULL;
+
+  return GNUNET_JSON_PR_SUCCESS;
+}
+
+
+/**
+ * Function called whenever we are done with a request
+ * to clean up our state.
+ *
+ * @param con_cls value as it was left by
+ *        #GNUNET_JSON_post_parser(), to be cleaned up
+ */
+void
+GNUNET_JSON_post_parser_cleanup (void *con_cls)
+{
+  struct Buffer *r = con_cls;
+
+  if (NULL != r)
+  {
+    buffer_deinit (r);
+    GNUNET_free (r);
+  }
+}
+
+
+/* end of mhd_json.c */
diff --git a/src/lib/json/json_pack.c b/src/lib/json/json_pack.c
new file mode 100644
index 000000000..d298e6efe
--- /dev/null
+++ b/src/lib/json/json_pack.c
@@ -0,0 +1,480 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2021 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file json/json_pack.c
+ * @brief functions to pack JSON objects
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_json_lib.h"
+
+json_t *
+GNUNET_JSON_pack_ (struct GNUNET_JSON_PackSpec spec[])
+{
+  json_t *ret;
+
+  if (NULL == spec[0].field_name)
+  {
+    ret = spec[0].object;
+    spec[0].object = NULL;
+    return ret;
+  }
+  ret = json_object ();
+  GNUNET_assert (NULL != ret);
+  for (unsigned int i = 0;
+       NULL != spec[i].field_name;
+       i++)
+  {
+    if (NULL == spec[i].object)
+    {
+      if (! spec[i].allow_null)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "NULL not allowed for `%s'\n",
+                    spec[i].field_name);
+        GNUNET_assert (0);
+      }
+    }
+    else
+    {
+      GNUNET_assert (0 ==
+                     json_object_set_new (ret,
+                                          spec[i].field_name,
+                                          spec[i].object));
+      spec[i].object = NULL;
+    }
+  }
+  return ret;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_end_ (void)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = NULL
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_allow_null (struct GNUNET_JSON_PackSpec in)
+{
+  in.allow_null = true;
+  return in;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_bool (const char *name,
+                       bool b)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = json_boolean (b)
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_double (const char *name,
+                         double f)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = json_real (f)
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_string (const char *name,
+                         const char *s)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = json_string (s)
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_uint64 (const char *name,
+                         uint64_t num)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = json_integer ((json_int_t) num)
+  };
+
+#if JSON_INTEGER_IS_LONG_LONG
+  GNUNET_assert (num <= LLONG_MAX);
+#else
+  GNUNET_assert (num <= LONG_MAX);
+#endif
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_int64 (const char *name,
+                        int64_t num)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = json_integer ((json_int_t) num)
+  };
+
+#if JSON_INTEGER_IS_LONG_LONG
+  GNUNET_assert (num <= LLONG_MAX);
+  GNUNET_assert (num >= LLONG_MIN);
+#else
+  GNUNET_assert (num <= LONG_MAX);
+  GNUNET_assert (num >= LONG_MIN);
+#endif
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_object_steal (const char *name,
+                               json_t *o)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = o
+  };
+
+  if (NULL == o)
+    return ps;
+  if (! json_is_object (o))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected JSON object for field `%s'\n",
+                name);
+    GNUNET_assert (0);
+  }
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_object_incref (const char *name,
+                                json_t *o)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = o
+  };
+
+  if (NULL == o)
+    return ps;
+  (void) json_incref (o);
+  if (! json_is_object (o))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected JSON object for field `%s'\n",
+                name);
+    GNUNET_assert (0);
+  }
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_array_steal (const char *name,
+                              json_t *a)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = a
+  };
+
+  if (NULL == a)
+    return ps;
+  if (! json_is_array (a))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected JSON array for field `%s'\n",
+                name);
+    GNUNET_assert (0);
+  }
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_array_incref (const char *name,
+                               json_t *a)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = a
+  };
+
+  if (NULL == a)
+    return ps;
+  (void) json_incref (a);
+  if (! json_is_array (a))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected JSON array for field `%s'\n",
+                name);
+    GNUNET_assert (0);
+  }
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_data_varsize (const char *name,
+                               const void *blob,
+                               size_t blob_size)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = (NULL != blob)
+    ? GNUNET_JSON_from_data (blob,
+                             blob_size)
+    : NULL
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_data64_varsize (const char *name,
+                                 const void *blob,
+                                 size_t blob_size)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = (NULL != blob)
+    ? GNUNET_JSON_from_data64 (blob,
+                               blob_size)
+    : NULL
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp t)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name
+  };
+
+  if (! GNUNET_TIME_absolute_is_zero (t.abs_time))
+  {
+    ps.object = GNUNET_JSON_from_timestamp (t);
+    GNUNET_assert (NULL != ps.object);
+  }
+  else
+  {
+    ps.object = NULL;
+  }
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO at)
+{
+  return GNUNET_JSON_pack_timestamp (name,
+                                     GNUNET_TIME_timestamp_ntoh (at));
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_time_rel (const char *name,
+                           struct GNUNET_TIME_Relative rt)
+{
+  json_t *json;
+
+  json = GNUNET_JSON_from_time_rel (rt);
+  GNUNET_assert (NULL != json);
+  return GNUNET_JSON_pack_object_steal (name,
+                                        json);
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_time_rel_nbo (const char *name,
+                               struct GNUNET_TIME_RelativeNBO rt)
+{
+  return GNUNET_JSON_pack_time_rel (name,
+                                    GNUNET_TIME_relative_ntoh (rt));
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_rsa_public_key (const char *name,
+                                 const struct GNUNET_CRYPTO_RsaPublicKey *pk)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = GNUNET_JSON_from_rsa_public_key (pk)
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_rsa_signature (const char *name,
+                                const struct GNUNET_CRYPTO_RsaSignature *sig)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+    .object = GNUNET_JSON_from_rsa_signature (sig)
+  };
+
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_unblinded_signature (const char *name,
+                                      const struct GNUNET_CRYPTO_UnblindedSignature *sig)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name
+  };
+
+  if (NULL == sig)
+    return ps;
+
+  switch (sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "RSA"),
+      GNUNET_JSON_pack_rsa_signature ("rsa_signature",
+                                      sig->details.rsa_signature));
+    return ps;
+  case GNUNET_CRYPTO_BSA_CS:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "CS"),
+      GNUNET_JSON_pack_data_auto ("cs_signature_r",
+                                  &sig->details.cs_signature.r_point),
+      GNUNET_JSON_pack_data_auto ("cs_signature_s",
+                                  &sig->details.cs_signature.s_scalar));
+    return ps;
+  }
+  GNUNET_assert (0);
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_blinded_message (const char *name,
+                                  const struct GNUNET_CRYPTO_BlindedMessage *msg)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+  };
+
+  switch (msg->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "RSA"),
+      GNUNET_JSON_pack_data_varsize (
+        "rsa_blinded_planchet",
+        msg->details.rsa_blinded_message.blinded_msg,
+        msg->details.rsa_blinded_message.blinded_msg_size));
+    return ps;
+  case GNUNET_CRYPTO_BSA_CS:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "CS"),
+      GNUNET_JSON_pack_data_auto (
+        "cs_nonce",
+        &msg->details.cs_blinded_message.nonce),
+      GNUNET_JSON_pack_data_auto (
+        "cs_blinded_c0",
+        &msg->details.cs_blinded_message.c[0]),
+      GNUNET_JSON_pack_data_auto (
+        "cs_blinded_c1",
+        &msg->details.cs_blinded_message.c[1]));
+    return ps;
+  }
+  GNUNET_assert (0);
+  return ps;
+}
+
+
+struct GNUNET_JSON_PackSpec
+GNUNET_JSON_pack_blinded_sig (
+  const char *name,
+  const struct GNUNET_CRYPTO_BlindedSignature *sig)
+{
+  struct GNUNET_JSON_PackSpec ps = {
+    .field_name = name,
+  };
+
+  if (NULL == sig)
+    return ps;
+  switch (sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "RSA"),
+      GNUNET_JSON_pack_rsa_signature ("blinded_rsa_signature",
+                                      sig->details.blinded_rsa_signature));
+    return ps;
+  case GNUNET_CRYPTO_BSA_CS:
+    ps.object = GNUNET_JSON_PACK (
+      GNUNET_JSON_pack_string ("cipher",
+                               "CS"),
+      GNUNET_JSON_pack_uint64 ("b",
+                               sig->details.blinded_cs_answer.b),
+      GNUNET_JSON_pack_data_auto ("s",
+                                  &sig->details.blinded_cs_answer.s_scalar));
+    return ps;
+  }
+  GNUNET_assert (0);
+  return ps;
+}
+
+/* end of json_pack.c */
diff --git a/src/lib/json/meson.build b/src/lib/json/meson.build
new file mode 100644
index 000000000..d4c3b4528
--- /dev/null
+++ b/src/lib/json/meson.build
@@ -0,0 +1,44 @@
+libgnunetjson_src = ['json.c',
+                    'json_generator.c',
+                    'json_helper.c',
+                    'json_mhd.c',
+                    'json_pack.c']
+
+libgnunetjson = library('gnunetjson',
+        libgnunetjson_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep, json_dep, mhd_dep, zlib_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetjson_dep = declare_dependency(link_with : libgnunetjson)
+pkg.generate(libgnunetjson, url: 'https://www.gnunet.org',
+             description : 'Library for JSON de/serialization')
+
+testjson = executable ('test_json',
+          ['test_json.c'],
+          dependencies: [libgnunetutil_dep,
+                         json_dep,
+                         libgnunetjson_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+testjson_mhd = executable ('test_json_mhd',
+          ['test_json_mhd.c'],
+          dependencies: [libgnunetutil_dep,
+                         json_dep,
+                         mhd_dep,
+                         curl_dep,
+                         zlib_dep,
+                         libgnunetjson_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+test('test_json', testjson,
+   workdir: meson.current_build_dir(),
+   suite: ['json'])
+test('test_json_mhd', testjson_mhd,
+   workdir: meson.current_build_dir(),
+   suite: ['json'])
+
diff --git a/src/lib/json/test_json.c b/src/lib/json/test_json.c
new file mode 100644
index 000000000..1d27518b2
--- /dev/null
+++ b/src/lib/json/test_json.c
@@ -0,0 +1,247 @@
+/*
+   This file is part of GNUnet
+   (C) 2015, 2016, 2021 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file json/test_json.c
+ * @brief Tests for JSON conversion functions
+ * @author Christian Grothoff <christian@grothoff.org>
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+
+
+/**
+ * Test absolute time conversion from/to JSON.
+ *
+ * @return 0 on success
+ */
+static int
+test_timestamp (void)
+{
+  json_t *j;
+  struct GNUNET_TIME_Absolute a1;
+  struct GNUNET_TIME_Timestamp t1;
+  struct GNUNET_TIME_Timestamp t2;
+  struct GNUNET_JSON_Specification s1[] = {
+    GNUNET_JSON_spec_timestamp (NULL,
+                                &t2),
+    GNUNET_JSON_spec_end ()
+  };
+  struct GNUNET_JSON_Specification s2[] = {
+    GNUNET_JSON_spec_timestamp (NULL,
+                                &t2),
+    GNUNET_JSON_spec_end ()
+  };
+
+  a1 = GNUNET_TIME_absolute_get ();
+  t1 = GNUNET_TIME_absolute_to_timestamp (a1);
+  j = GNUNET_JSON_from_timestamp (t1);
+  GNUNET_assert (NULL != j);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_JSON_parse (j,
+                                    s1,
+                                    NULL,
+                                    NULL));
+  GNUNET_assert (GNUNET_TIME_timestamp_cmp (t1, ==, t2));
+  json_decref (j);
+
+  a1 = GNUNET_TIME_UNIT_FOREVER_ABS;
+  j = GNUNET_JSON_from_timestamp (t1);
+  GNUNET_assert (NULL != j);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_JSON_parse (j,
+                                    s2,
+                                    NULL,
+                                    NULL));
+  GNUNET_assert (GNUNET_TIME_timestamp_cmp (t1, ==, t2));
+  json_decref (j);
+  return 0;
+}
+
+
+/**
+ * Test relative time conversion from/to JSON.
+ *
+ * @return 0 on success
+ */
+static int
+test_rel_time (void)
+{
+  json_t *j;
+  struct GNUNET_TIME_Relative r1;
+  struct GNUNET_TIME_Relative r2;
+  struct GNUNET_JSON_Specification s1[] = {
+    GNUNET_JSON_spec_relative_time (NULL,
+                                    &r2),
+    GNUNET_JSON_spec_end ()
+  };
+  struct GNUNET_JSON_Specification s2[] = {
+    GNUNET_JSON_spec_relative_time (NULL,
+                                    &r2),
+    GNUNET_JSON_spec_end ()
+  };
+
+  r1 = GNUNET_TIME_UNIT_SECONDS;
+  j = GNUNET_JSON_from_time_rel (r1);
+  GNUNET_assert (NULL != j);
+  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (j, s1, NULL, NULL));
+  GNUNET_assert (r1.rel_value_us == r2.rel_value_us);
+  json_decref (j);
+
+  r1 = GNUNET_TIME_UNIT_FOREVER_REL;
+  j = GNUNET_JSON_from_time_rel (r1);
+  GNUNET_assert (NULL != j);
+  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (j, s2, NULL, NULL));
+  GNUNET_assert (r1.rel_value_us == r2.rel_value_us);
+  json_decref (j);
+  return 0;
+}
+
+
+/**
+ * Test raw (binary) conversion from/to JSON.
+ *
+ * @return 0 on success
+ */
+static int
+test_raw ()
+{
+  char blob[256];
+  unsigned int i;
+  json_t *j;
+
+  for (i = 0; i <= 256; i++)
+  {
+    char blob2[256];
+    struct GNUNET_JSON_Specification spec[] = { GNUNET_JSON_spec_fixed (NULL,
+                                                                        blob2,
+                                                                        i),
+                                                GNUNET_JSON_spec_end () };
+
+    memset (blob, i, i);
+    j = GNUNET_JSON_from_data (blob, i);
+    GNUNET_assert (NULL != j);
+    GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (j, spec, NULL, NULL));
+    GNUNET_assert (0 == memcmp (blob, blob2, i));
+    json_decref (j);
+  }
+  return 0;
+}
+
+
+/**
+ * Test rsa conversions from/to JSON.
+ *
+ * @return 0 on success
+ */
+static int
+test_rsa ()
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *pub;
+  struct GNUNET_CRYPTO_RsaPublicKey *pub2;
+  struct GNUNET_JSON_Specification pspec[] =
+  { GNUNET_JSON_spec_rsa_public_key (NULL, &pub2), GNUNET_JSON_spec_end () };
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  struct GNUNET_CRYPTO_RsaSignature *sig2;
+  struct GNUNET_JSON_Specification sspec[] =
+  { GNUNET_JSON_spec_rsa_signature (NULL, &sig2), GNUNET_JSON_spec_end () };
+  struct GNUNET_CRYPTO_RsaPrivateKey *priv;
+  struct GNUNET_HashCode msg;
+  json_t *jp;
+  json_t *js;
+
+  priv = GNUNET_CRYPTO_rsa_private_key_create (1024);
+  pub = GNUNET_CRYPTO_rsa_private_key_get_public (priv);
+  memset (&msg, 42, sizeof(msg));
+  sig = GNUNET_CRYPTO_rsa_sign_fdh (priv, &msg, sizeof (msg));
+  GNUNET_assert (NULL != (jp = GNUNET_JSON_from_rsa_public_key (pub)));
+  GNUNET_assert (NULL != (js = GNUNET_JSON_from_rsa_signature (sig)));
+  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (jp, pspec, NULL, NULL));
+  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (js, sspec, NULL, NULL));
+  GNUNET_break (0 == GNUNET_CRYPTO_rsa_signature_cmp (sig, sig2));
+  GNUNET_break (0 == GNUNET_CRYPTO_rsa_public_key_cmp (pub, pub2));
+  json_decref (jp);
+  json_decref (js);
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+  GNUNET_CRYPTO_rsa_signature_free (sig2);
+  GNUNET_CRYPTO_rsa_private_key_free (priv);
+  GNUNET_CRYPTO_rsa_public_key_free (pub);
+  GNUNET_CRYPTO_rsa_public_key_free (pub2);
+  return 0;
+}
+
+
+/**
+ * Test rsa conversions from/to JSON.
+ *
+ * @return 0 on success
+ */
+static int
+test_boolean ()
+{
+  int b1;
+  int b2;
+  json_t *json;
+  struct GNUNET_JSON_Specification pspec[] = { GNUNET_JSON_spec_boolean ("b1",
+                                                                         &b1),
+                                               GNUNET_JSON_spec_boolean ("b2",
+                                                                         &b2),
+                                               GNUNET_JSON_spec_end () };
+
+  json = json_object ();
+  json_object_set_new (json, "b1", json_true ());
+  json_object_set_new (json, "b2", json_false ());
+
+  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (json, pspec, NULL, NULL));
+
+  GNUNET_assert (GNUNET_YES == b1);
+  GNUNET_assert (GNUNET_NO == b2);
+
+  json_object_set_new (json, "b1", json_integer (42));
+
+  GNUNET_assert (GNUNET_OK != GNUNET_JSON_parse (json, pspec, NULL, NULL));
+
+  json_decref (json);
+
+  return 0;
+}
+
+
+int
+main (int argc, const char *const argv[])
+{
+  GNUNET_log_setup ("test-json", "WARNING", NULL);
+  if (0 != test_timestamp ())
+    return 1;
+  if (0 != test_rel_time ())
+    return 1;
+  if (0 != test_raw ())
+    return 1;
+  if (0 != test_rsa ())
+    return 1;
+  if (0 != test_boolean ())
+    return 1;
+  /* FIXME: test EdDSA signature conversion... */
+  return 0;
+}
+
+
+/* end of test_json.c */
diff --git a/src/lib/json/test_json_mhd.c b/src/lib/json/test_json_mhd.c
new file mode 100644
index 000000000..642715f25
--- /dev/null
+++ b/src/lib/json/test_json_mhd.c
@@ -0,0 +1,193 @@
+/*
+   This file is part of GNUnet
+   (C) 2019 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file json/test_json_mhd.c
+ * @brief Tests for JSON MHD integration functions
+ * @author Christian Grothoff <christian@grothoff.org>
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_curl_lib.h"
+#include "gnunet_mhd_compat.h"
+#include <zlib.h>
+
+#define MAX_SIZE 1024 * 1024
+
+static json_t *bigj;
+
+static int global_ret;
+
+
+static MHD_RESULT
+access_handler_cb (void *cls,
+                   struct MHD_Connection *connection,
+                   const char *url,
+                   const char *method,
+                   const char *version,
+                   const char *upload_data,
+                   size_t *upload_data_size,
+                   void **con_cls)
+{
+  int ret;
+  json_t *json;
+  struct MHD_Response *resp;
+
+  json = NULL;
+  ret = GNUNET_JSON_post_parser (MAX_SIZE,
+                                 connection,
+                                 con_cls,
+                                 upload_data,
+                                 upload_data_size,
+                                 &json);
+  switch (ret)
+  {
+  case GNUNET_JSON_PR_SUCCESS:
+    if (json_equal (bigj, json))
+    {
+      global_ret = 0;
+    }
+    else
+    {
+      GNUNET_break (0);
+      global_ret = 6;
+    }
+    json_decref (json);
+    resp = MHD_create_response_from_buffer (3, "OK\n", MHD_RESPMEM_PERSISTENT);
+    ret = MHD_queue_response (connection, MHD_HTTP_OK, resp);
+    MHD_destroy_response (resp);
+    return ret;
+
+  case GNUNET_JSON_PR_CONTINUE:
+    return MHD_YES;
+
+  case GNUNET_JSON_PR_OUT_OF_MEMORY:
+    GNUNET_break (0);
+    global_ret = 3;
+    break;
+
+  case GNUNET_JSON_PR_REQUEST_TOO_LARGE:
+    GNUNET_break (0);
+    global_ret = 4;
+    break;
+
+  case GNUNET_JSON_PR_JSON_INVALID:
+    GNUNET_break (0);
+    global_ret = 5;
+    break;
+  }
+  GNUNET_break (0);
+  return MHD_NO;
+}
+
+
+int
+main (int argc, const char *const argv[])
+{
+  struct MHD_Daemon *daemon;
+  uint16_t port;
+  CURL *easy;
+  char *url;
+  char *str;
+  size_t slen;
+  long post_data_size;
+  void *post_data;
+  uLongf dlen;
+  struct curl_slist *json_header;
+
+  GNUNET_log_setup ("test-json-mhd", "WARNING", NULL);
+  global_ret = 2;
+  daemon = MHD_start_daemon (MHD_USE_DUAL_STACK | MHD_USE_AUTO_INTERNAL_THREAD,
+                             0,
+                             NULL,
+                             NULL,
+                             &access_handler_cb,
+                             NULL,
+                             MHD_OPTION_END);
+  if (NULL == daemon)
+    return 77;
+  bigj = json_object ();
+  json_object_set_new (bigj, "test", json_string ("value"));
+  for (unsigned int i = 0; i < 1000; i++)
+  {
+    char tmp[5];
+
+    GNUNET_snprintf (tmp, sizeof(tmp), "%u", i);
+    json_object_set_new (bigj, tmp, json_string (tmp));
+  }
+  str = json_dumps (bigj, JSON_INDENT (2));
+  slen = strlen (str);
+
+#ifdef compressBound
+  dlen = compressBound (slen);
+#else
+  dlen = slen + slen / 100 + 20;
+  /* documentation says 100.1% oldSize + 12 bytes, but we
+   * should be able to overshoot by more to be safe */
+#endif
+  post_data = GNUNET_malloc (dlen);
+  if (Z_OK !=
+      compress2 ((Bytef *) post_data, &dlen, (const Bytef *) str, slen, 9))
+  {
+    GNUNET_break (0);
+    MHD_stop_daemon (daemon);
+    json_decref (bigj);
+    GNUNET_free (post_data);
+    GNUNET_free (str);
+    return 1;
+  }
+  post_data_size = (long) dlen;
+  port = MHD_get_daemon_info (daemon, MHD_DAEMON_INFO_BIND_PORT)->port;
+  easy = curl_easy_init ();
+  GNUNET_asprintf (&url, "http://localhost:%u/", (unsigned int) port);
+  curl_easy_setopt (easy, CURLOPT_VERBOSE, 0);
+  curl_easy_setopt (easy, CURLOPT_URL, url);
+  curl_easy_setopt (easy, CURLOPT_POST, 1);
+  curl_easy_setopt (easy, CURLOPT_POSTFIELDS, post_data);
+  curl_easy_setopt (easy, CURLOPT_POSTFIELDSIZE, post_data_size);
+
+  json_header = curl_slist_append (NULL, "Content-Type: application/json");
+  json_header = curl_slist_append (json_header, "Content-Encoding: deflate");
+  curl_easy_setopt (easy, CURLOPT_HTTPHEADER, json_header);
+  if (0 != curl_easy_perform (easy))
+  {
+    GNUNET_break (0);
+    MHD_stop_daemon (daemon);
+    GNUNET_free (url);
+    json_decref (bigj);
+    GNUNET_free (post_data);
+    GNUNET_free (str);
+    curl_slist_free_all (json_header);
+    curl_easy_cleanup (easy);
+    return 1;
+  }
+  MHD_stop_daemon (daemon);
+  GNUNET_free (url);
+  json_decref (bigj);
+  GNUNET_free (post_data);
+  GNUNET_free (str);
+  curl_slist_free_all (json_header);
+  curl_easy_cleanup (easy);
+  return global_ret;
+}
+
+
+/* end of test_json_mhd.c */
diff --git a/src/lib/meson.build b/src/lib/meson.build
new file mode 100644
index 000000000..93dbf5c4d
--- /dev/null
+++ b/src/lib/meson.build
@@ -0,0 +1,9 @@
+subdir('util')
+subdir('hello')
+subdir('block')
+subdir('json', if_found : json_dep)
+subdir('curl', if_found : [curl_dep])
+subdir('sq', if_found : [sqlite_dep])
+subdir('pq', if_found : [pq_dep])
+subdir('gnsrecord')
+subdir('testing')
diff --git a/src/lib/pq/.gitignore b/src/lib/pq/.gitignore
new file mode 100644
index 000000000..8de68ddc9
--- /dev/null
+++ b/src/lib/pq/.gitignore
@@ -0,0 +1 @@
+test_pq
diff --git a/src/lib/pq/Makefile.am b/src/lib/pq/Makefile.am
new file mode 100644
index 000000000..91014dbfe
--- /dev/null
+++ b/src/lib/pq/Makefile.am
@@ -0,0 +1,51 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include $(POSTGRESQL_CPPFLAGS)
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage
+endif
+
+sqldir = $(prefix)/share/gnunet/sql/
+
+sql_DATA = \
+  versioning.sql
+
+EXTRA_DIST = \
+  $(sql_DATA)
+
+if HAVE_POSTGRESQL
+lib_LTLIBRARIES = libgnunetpq.la
+endif
+
+libgnunetpq_la_SOURCES = \
+  pq.c \
+  pq.h \
+  pq_connect.c \
+  pq_eval.c \
+  pq_event.c \
+  pq_exec.c \
+  pq_prepare.c \
+  pq_query_helper.c \
+  pq_result_helper.c
+libgnunetpq_la_LIBADD = -lpq \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunetpq_la_LDFLAGS = \
+ $(POSTGRESQL_LDFLAGS) \
+ $(GN_LIB_LDFLAGS) \
+  -version-info 7:0:2
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = \
+ test_pq
+endif
+
+check_PROGRAMS= \
+ test_pq
+
+test_pq_SOURCES = \
+  test_pq.c
+test_pq_LDADD = \
+  libgnunetpq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la  \
+  -lpq $(XLIB)
diff --git a/src/lib/pq/meson.build b/src/lib/pq/meson.build
new file mode 100644
index 000000000..ea73f45a1
--- /dev/null
+++ b/src/lib/pq/meson.build
@@ -0,0 +1,32 @@
+libgnunetpq_src = ['pq.c',
+                   'pq_connect.c',
+                   'pq_eval.c',
+                   'pq_event.c',
+                   'pq_exec.c',
+                   'pq_prepare.c',
+                   'pq_query_helper.c',
+                   'pq_result_helper.c']
+
+libgnunetpq = library('gnunetpq',
+        libgnunetpq_src,
+        soversion: '5',
+        version: '5.0.0',
+        dependencies: [libgnunetutil_dep, pq_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetpq_dep = declare_dependency(link_with : libgnunetpq)
+
+testpq = executable ('test_pq',
+          ['test_pq.c'],
+          dependencies: [libgnunetutil_dep,
+                         pq_dep,
+                         libgnunetpq_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+test('test_pq', testpq,
+   workdir: meson.current_build_dir(),
+   suite: ['pq'])
+
+
diff --git a/src/lib/pq/pq.c b/src/lib/pq/pq.c
new file mode 100644
index 000000000..65e051bfc
--- /dev/null
+++ b/src/lib/pq/pq.c
@@ -0,0 +1,207 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2016, 2017, 2019, 2020 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq.c
+ * @brief helper functions for libpq (PostGres) interactions
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_pq_lib.h"
+#include "pq.h"
+
+
+PGresult *
+GNUNET_PQ_exec_prepared (struct GNUNET_PQ_Context *db,
+                         const char *name,
+                         const struct GNUNET_PQ_QueryParam *params)
+{
+  unsigned int len;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Running prepared statement `%s' on %p\n",
+              name,
+              db);
+  /* count the number of parameters */
+  len = 0;
+  for (unsigned int i = 0; 0 != params[i].num_params; i++)
+    len += params[i].num_params;
+
+  /* new scope to allow stack allocation without alloca */
+  {
+    /* Scratch buffer for temporary storage */
+    void *scratch[GNUNET_NZL (len)];
+    /* Parameter array we are building for the query */
+    void *param_values[GNUNET_NZL (len)];
+    int param_lengths[GNUNET_NZL (len)];
+    int param_formats[GNUNET_NZL (len)];
+    unsigned int off;
+    /* How many entries in the scratch buffer are in use? */
+    unsigned int soff;
+    PGresult *res;
+    int ret;
+    ConnStatusType status;
+
+    off = 0;
+    soff = 0;
+    for (unsigned int i = 0; 0 != params[i].num_params; i++)
+    {
+      const struct GNUNET_PQ_QueryParam *x = &params[i];
+
+      ret = x->conv (x->conv_cls,
+                     x->data,
+                     x->size,
+                     &param_values[off],
+                     &param_lengths[off],
+                     &param_formats[off],
+                     x->num_params,
+                     &scratch[soff],
+                     len - soff);
+      if (ret < 0)
+      {
+        for (off = 0; off < soff; off++)
+          GNUNET_free (scratch[off]);
+        return NULL;
+      }
+      soff += ret;
+      off += x->num_params;
+    }
+    GNUNET_assert (off == len);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "pq",
+                     "Executing prepared SQL statement `%s'\n",
+                     name);
+    res = PQexecPrepared (db->conn,
+                          name,
+                          len,
+                          (const char **) param_values,
+                          param_lengths,
+                          param_formats,
+                          1);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "pq",
+                     "Execution of prepared SQL statement `%s' finished (%s)\n",
+                     name,
+                     PQresStatus (PQresultStatus (res)));
+    if ( (PGRES_COMMAND_OK != PQresultStatus (res)) &&
+         (CONNECTION_OK != (status = PQstatus (db->conn))) )
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "pq",
+                       "Database disconnected on SQL statement `%s' (reconnecting)\n",
+                       name);
+      GNUNET_PQ_reconnect (db);
+      res = NULL;
+    }
+
+    for (off = 0; off < soff; off++)
+      GNUNET_free (scratch[off]);
+    return res;
+  }
+}
+
+
+void
+GNUNET_PQ_cleanup_query_params_closures (
+  const struct GNUNET_PQ_QueryParam *params)
+{
+  for (unsigned int i = 0; 0 != params[i].num_params; i++)
+  {
+    const struct GNUNET_PQ_QueryParam *x = &params[i];
+
+    if ((NULL != x->conv_cls) &&
+        (NULL != x->conv_cls_cleanup))
+      x->conv_cls_cleanup (x->conv_cls);
+  }
+
+}
+
+
+void
+GNUNET_PQ_cleanup_result (struct GNUNET_PQ_ResultSpec *rs)
+{
+  for (unsigned int i = 0; NULL != rs[i].conv; i++)
+    if (NULL != rs[i].cleaner)
+      rs[i].cleaner (rs[i].cls,
+                     rs[i].dst);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_extract_result (PGresult *result,
+                          struct GNUNET_PQ_ResultSpec *rs,
+                          int row)
+{
+  unsigned int i;
+
+  if (NULL == result)
+    return GNUNET_SYSERR;
+  for (i = 0; NULL != rs[i].conv; i++)
+  {
+    struct GNUNET_PQ_ResultSpec *spec;
+    enum GNUNET_GenericReturnValue ret;
+
+    spec = &rs[i];
+    ret = spec->conv (spec->cls,
+                      result,
+                      row,
+                      spec->fname,
+                      &spec->dst_size,
+                      spec->dst);
+    switch (ret)
+    {
+    case GNUNET_OK:
+      /* canonical case, continue below */
+      if (NULL != spec->is_null)
+        *spec->is_null = false;
+      break;
+    case GNUNET_NO:
+      if (spec->is_nullable)
+      {
+        if (NULL != spec->is_null)
+          *spec->is_null = true;
+        continue;
+      }
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "NULL field encountered for `%s' where non-NULL was required\n",
+                  spec->fname);
+      goto cleanup;
+    case GNUNET_SYSERR:
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to extract field `%s'\n",
+                  spec->fname);
+      GNUNET_break (0);
+      goto cleanup;
+    }
+    if (NULL != spec->result_size)
+      *spec->result_size = spec->dst_size;
+  }
+  return GNUNET_OK;
+cleanup:
+  for (unsigned int j = 0; j < i; j++)
+    if (NULL != rs[j].cleaner)
+      rs[j].cleaner (rs[j].cls,
+                     rs[j].dst);
+  return GNUNET_SYSERR;
+}
+
+
+/* end of pq/pq.c */
diff --git a/src/lib/pq/pq.h b/src/lib/pq/pq.h
new file mode 100644
index 000000000..65b72cedd
--- /dev/null
+++ b/src/lib/pq/pq.h
@@ -0,0 +1,172 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017, 2019 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq.h
+ * @brief shared internal data structures of libgnunetpq
+ * @author Christian Grothoff
+ */
+#ifndef PQ_H
+#define PQ_H
+
+#include "gnunet_util_lib.h"
+#include "gnunet_pq_lib.h"
+
+
+/**
+ * Handle to Postgres database.
+ */
+struct GNUNET_PQ_Context
+{
+  /**
+   * Actual connection.
+   */
+  PGconn *conn;
+
+  /**
+   * Statements to execute upon connection.
+   */
+  struct GNUNET_PQ_ExecuteStatement *es;
+
+  /**
+   * Prepared statements.
+   */
+  struct GNUNET_PQ_PreparedStatement *ps;
+
+  /**
+   * Length of the @e ps array.
+   */
+  unsigned int ps_len;
+
+  /**
+   * Last used offset in the @e ps array.
+   */
+  unsigned int ps_off;
+
+  /**
+   * Configuration to use to connect to the DB.
+   */
+  char *config_str;
+
+  /**
+   * Path to load SQL files from.
+   */
+  char *load_path;
+
+  /**
+   * Suffix to append to path to load on startup.
+   */
+  char *auto_suffix;
+
+  /**
+   * Map managing event subscriptions.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *channel_map;
+
+  /**
+   * Task responsible for processing events.
+   */
+  struct GNUNET_SCHEDULER_Task *event_task;
+
+  /**
+   * File descriptor wrapper for @e event_task.
+   */
+  struct GNUNET_NETWORK_Handle *rfd;
+
+  /**
+   * How fast should we resubscribe again?
+   */
+  struct GNUNET_TIME_Relative resubscribe_backoff;
+
+  /**
+   * Flags controlling the connection.
+   */
+  enum GNUNET_PQ_Options flags;
+
+  /**
+   * Mapping between array types and Oid's, pre-filled at reconnect.
+   * More entries are captured in via GNUNET_PQ_get_oid_by_name.
+   */
+  struct
+  {
+    /* Allocated number of elements array the table */
+    unsigned int cap;
+
+    /* Number of entries in the table */
+    unsigned int num;
+
+    /* The table of (name, oid) pairs.
+     * Note that the names are 'const char *' and the pointers should be point
+     * to the same string throughout the lifetime of the program.*/
+    struct name2oid
+    {
+      const char *name;
+      Oid oid;
+    } *table;
+
+  } oids;
+};
+
+
+/**
+ * Internal types that are supported as array types.
+ */
+
+enum array_types
+{
+  array_of_bool,
+  array_of_uint16,
+  array_of_uint32,
+  array_of_uint64,
+  array_of_byte,      /* buffers of (char *), (void *), ... */
+  array_of_string,    /* NULL-terminated (char *) */
+  array_of_abs_time,
+  array_of_rel_time,
+  array_of_timestamp,
+  array_of_MAX,       /* must be last */
+};
+
+/**
+ * the header for a postgresql array in binary format. note that this a
+ * simplified special case of the general structure (which contains pointers),
+ * as we only support one-dimensional arrays.
+ */
+struct pq_array_header
+{
+  uint32_t ndim;     /* number of dimensions. we only support ndim = 1 */
+  uint32_t has_null;
+  uint32_t oid;
+  uint32_t dim;      /* size of the array */
+  uint32_t lbound;   /* index value of first element in the db (default: 1). */
+} __attribute__((packed));
+
+
+/**
+ * Internal API. Reconnect should re-register notifications
+ * after a disconnect.
+ *
+ * @param db the DB handle
+ * @param fd socket to listen on
+ */
+void
+GNUNET_PQ_event_reconnect_ (struct GNUNET_PQ_Context *db,
+                            int fd);
+
+
+#endif
diff --git a/src/lib/pq/pq_connect.c b/src/lib/pq/pq_connect.c
new file mode 100644
index 000000000..4ad88ef53
--- /dev/null
+++ b/src/lib/pq/pq_connect.c
@@ -0,0 +1,705 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017, 2019, 2020, 2021, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_connect.c
+ * @brief functions to connect to libpq (PostGres)
+ * @author Christian Grothoff
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include "pq.h"
+#include <pthread.h>
+
+
+/**
+ * Function called by libpq whenever it wants to log something.
+ * We already log whenever we care, so this function does nothing
+ * and merely exists to silence the libpq logging.
+ *
+ * @param arg the SQL connection that was used
+ * @param res information about some libpq event
+ */
+static void
+pq_notice_receiver_cb (void *arg,
+                       const PGresult *res)
+{
+  /* do nothing, intentionally */
+  (void) arg;
+  (void) res;
+}
+
+
+/**
+ * Function called by libpq whenever it wants to log something.
+ * We log those using the GNUnet logger.
+ *
+ * @param arg the SQL connection that was used
+ * @param message information about some libpq event
+ */
+static void
+pq_notice_processor_cb (void *arg,
+                        const char *message)
+{
+  (void) arg;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
+                   "pq",
+                   "%s",
+                   message);
+}
+
+
+struct GNUNET_PQ_Context *
+GNUNET_PQ_connect (const char *config_str,
+                   const char *load_path,
+                   const struct GNUNET_PQ_ExecuteStatement *es,
+                   const struct GNUNET_PQ_PreparedStatement *ps)
+{
+  return GNUNET_PQ_connect2 (config_str,
+                             load_path,
+                             NULL == load_path
+                             ? NULL
+                             : "",
+                             es,
+                             ps,
+                             GNUNET_PQ_FLAG_NONE);
+}
+
+
+struct GNUNET_PQ_Context *
+GNUNET_PQ_connect2 (const char *config_str,
+                    const char *load_path,
+                    const char *auto_suffix,
+                    const struct GNUNET_PQ_ExecuteStatement *es,
+                    const struct GNUNET_PQ_PreparedStatement *ps,
+                    enum GNUNET_PQ_Options flags)
+{
+  struct GNUNET_PQ_Context *db;
+  unsigned int elen = 0;
+  unsigned int plen = 0;
+
+  if (NULL != es)
+    while (NULL != es[elen].sql)
+      elen++;
+  if (NULL != ps)
+    while (NULL != ps[plen].name)
+      plen++;
+
+  db = GNUNET_new (struct GNUNET_PQ_Context);
+  db->flags = flags;
+  db->config_str = GNUNET_strdup (config_str);
+  if (NULL != load_path)
+    db->load_path = GNUNET_strdup (load_path);
+  if (NULL != auto_suffix)
+    db->auto_suffix = GNUNET_strdup (auto_suffix);
+  if (0 != elen)
+  {
+    db->es = GNUNET_new_array (elen + 1,
+                               struct GNUNET_PQ_ExecuteStatement);
+    memcpy (db->es,
+            es,
+            elen * sizeof (struct GNUNET_PQ_ExecuteStatement));
+  }
+  if (0 != plen)
+  {
+    db->ps = GNUNET_new_array (plen + 1,
+                               struct GNUNET_PQ_PreparedStatement);
+    memcpy (db->ps,
+            ps,
+            plen * sizeof (struct GNUNET_PQ_PreparedStatement));
+  }
+  db->channel_map = GNUNET_CONTAINER_multishortmap_create (16,
+                                                           GNUNET_YES);
+  GNUNET_PQ_reconnect (db);
+  if (NULL == db->conn)
+  {
+    GNUNET_CONTAINER_multishortmap_destroy (db->channel_map);
+    GNUNET_free (db->load_path);
+    GNUNET_free (db->auto_suffix);
+    GNUNET_free (db->config_str);
+    GNUNET_free (db);
+    return NULL;
+  }
+  return db;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_exec_sql (struct GNUNET_PQ_Context *db,
+                    const char *buf)
+{
+  struct GNUNET_OS_Process *psql;
+  enum GNUNET_OS_ProcessStatusType type;
+  unsigned long code;
+  enum GNUNET_GenericReturnValue ret;
+  char *fn;
+
+  GNUNET_asprintf (&fn,
+                   "%s%s.sql",
+                   db->load_path,
+                   buf);
+  if (GNUNET_YES !=
+      GNUNET_DISK_file_test (fn))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "SQL resource `%s' does not exist\n",
+                fn);
+    GNUNET_free (fn);
+    return GNUNET_NO;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Applying SQL file `%s' on database %s\n",
+              fn,
+              db->config_str);
+  psql = GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_NONE,
+                                  NULL,
+                                  NULL,
+                                  NULL,
+                                  "psql",
+                                  "psql",
+                                  db->config_str,
+                                  "-f",
+                                  fn,
+                                  "-q",
+                                  "--set",
+                                  "ON_ERROR_STOP=1",
+                                  NULL);
+  if (NULL == psql)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                              "exec",
+                              "psql");
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  ret = GNUNET_OS_process_wait_status (psql,
+                                       &type,
+                                       &code);
+  if (GNUNET_OK != ret)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "psql on file %s did not finish, killed it!\n",
+                fn);
+    /* can happen if we got a signal, like CTRL-C, before
+       psql was complete */
+    (void) GNUNET_OS_process_kill (psql,
+                                   SIGKILL);
+    GNUNET_OS_process_destroy (psql);
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_OS_process_destroy (psql);
+  if ( (GNUNET_OS_PROCESS_EXITED != type) ||
+       (0 != code) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Could not run PSQL on file %s: psql exit code was %d\n",
+                fn,
+                (int) code);
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (fn);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_run_sql (struct GNUNET_PQ_Context *db,
+                   const char *load_path)
+{
+  const char *load_path_suffix;
+  size_t slen = strlen (load_path) + 10;
+
+  load_path_suffix = strrchr (load_path, '/');
+  if (NULL == load_path_suffix)
+    load_path_suffix = load_path;
+  else
+    load_path_suffix++; /* skip '/' */
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Loading SQL resources from `%s'\n",
+              load_path);
+  for (unsigned int i = 1; i<10000; i++)
+  {
+    char patch_name[slen];
+    enum GNUNET_DB_QueryStatus qs;
+
+    /* Check with DB versioning schema if this patch was already applied,
+       if so, skip it. */
+    GNUNET_snprintf (patch_name,
+                     sizeof (patch_name),
+                     "%s%04u",
+                     load_path_suffix,
+                     i);
+    {
+      char *applied_by;
+      struct GNUNET_PQ_QueryParam params[] = {
+        GNUNET_PQ_query_param_string (patch_name),
+        GNUNET_PQ_query_param_end
+      };
+      struct GNUNET_PQ_ResultSpec rs[] = {
+        GNUNET_PQ_result_spec_string ("applied_by",
+                                      &applied_by),
+        GNUNET_PQ_result_spec_end
+      };
+
+      qs = GNUNET_PQ_eval_prepared_singleton_select (db,
+                                                     "gnunet_pq_check_patch",
+                                                     params,
+                                                     rs);
+      if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT == qs)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "Database version %s already applied by %s, skipping\n",
+                    patch_name,
+                    applied_by);
+        GNUNET_PQ_cleanup_result (rs);
+      }
+      if (GNUNET_DB_STATUS_HARD_ERROR == qs)
+      {
+        GNUNET_break (0);
+        return GNUNET_SYSERR;
+      }
+    }
+    if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT == qs)
+      continue; /* patch already applied, skip it */
+
+    if (0 != (GNUNET_PQ_FLAG_CHECK_CURRENT & db->flags))
+    {
+      /* We are only checking, found unapplied patch, bad! */
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Database outdated, patch %s missing. Aborting!\n",
+                  patch_name);
+      return GNUNET_SYSERR;
+    }
+    else
+    {
+      /* patch not yet applied, run it! */
+      enum GNUNET_GenericReturnValue ret;
+
+      GNUNET_snprintf (patch_name,
+                       sizeof (patch_name),
+                       "%s%04u",
+                       load_path,
+                       i);
+      ret = GNUNET_PQ_exec_sql (db,
+                                patch_name);
+      if (GNUNET_NO == ret)
+        break;
+      if (GNUNET_SYSERR == ret)
+        return GNUNET_SYSERR;
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_PQ_reconnect_if_down (struct GNUNET_PQ_Context *db)
+{
+  if (1 ==
+      PQconsumeInput (db->conn))
+    return;
+  if (CONNECTION_BAD != PQstatus (db->conn))
+    return;
+  GNUNET_PQ_reconnect (db);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_get_oid_by_name (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  Oid *oid)
+{
+  /* Check if the entry is in the cache already */
+  for (unsigned int i = 0; i < db->oids.num; i++)
+  {
+    /* Pointer comparison */
+    if (name == db->oids.table[i].name)
+    {
+      *oid = db->oids.table[i].oid;
+      return GNUNET_OK;
+    }
+  }
+
+  /* No entry found in cache, ask database */
+  {
+    enum GNUNET_DB_QueryStatus qs;
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_string (name),
+      GNUNET_PQ_query_param_end
+    };
+    struct GNUNET_PQ_ResultSpec spec[] = {
+      GNUNET_PQ_result_spec_uint32 ("oid",
+                                    oid),
+      GNUNET_PQ_result_spec_end
+    };
+
+    GNUNET_assert (NULL != db);
+
+    qs = GNUNET_PQ_eval_prepared_singleton_select (db,
+                                                   "gnunet_pq_get_oid_by_name",
+                                                   params,
+                                                   spec);
+    if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != qs)
+      return GNUNET_SYSERR;
+  }
+
+  /* Add the entry to the cache */
+  if (NULL == db->oids.table)
+  {
+    db->oids.table = GNUNET_new_array (8,
+                                       typeof(*db->oids.table));
+    db->oids.cap = 8;
+    db->oids.num = 0;
+  }
+
+  if (db->oids.cap <= db->oids.num)
+    GNUNET_array_grow (db->oids.table,
+                       db->oids.cap,
+                       db->oids.cap + 8);
+
+  db->oids.table[db->oids.num].name = name;
+  db->oids.table[db->oids.num].oid = *oid;
+  db->oids.num++;
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Load the initial set of OIDs for the supported
+ * array-datatypes
+ *
+ * @param db The database context
+ * @return GNUNET_OK on success, GNUNET_SYSERR if any of the types couldn't be found
+ */
+static
+enum GNUNET_GenericReturnValue
+load_initial_oids (struct GNUNET_PQ_Context *db)
+{
+  static const char *typnames[] = {
+    "bool",
+    "int2",
+    "int4",
+    "int8",
+    "bytea",
+    "varchar"
+  };
+  Oid oid;
+
+  for (size_t i = 0; i< sizeof(typnames) / sizeof(*typnames); i++)
+  {
+    if (GNUNET_OK !=
+        GNUNET_PQ_get_oid_by_name (db,
+                                   typnames[i],
+                                   &oid))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                       "pq",
+                       "Couldn't retrieve OID for type %s\n",
+                       typnames[i]);
+      return GNUNET_SYSERR;
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_PQ_reconnect (struct GNUNET_PQ_Context *db)
+{
+  GNUNET_PQ_event_reconnect_ (db,
+                              -1);
+  if (NULL != db->conn)
+    PQfinish (db->conn);
+  db->conn = PQconnectdb (db->config_str);
+  if ( (NULL == db->conn) ||
+       (CONNECTION_OK != PQstatus (db->conn)) )
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "pq",
+                     "Database connection to '%s' failed: %s\n",
+                     db->config_str,
+                     (NULL != db->conn)
+                     ? PQerrorMessage (db->conn)
+                     : "PQconnectdb returned NULL");
+    if (NULL != db->conn)
+    {
+      PQfinish (db->conn);
+      db->conn = NULL;
+    }
+    return;
+  }
+  PQsetNoticeReceiver (db->conn,
+                       &pq_notice_receiver_cb,
+                       db);
+  PQsetNoticeProcessor (db->conn,
+                        &pq_notice_processor_cb,
+                        db);
+  if ( (NULL != db->load_path) &&
+       (NULL != db->auto_suffix) )
+  {
+    PGresult *res;
+    ExecStatusType est;
+
+    res = PQexec (db->conn,
+                  "SELECT"
+                  " schema_name"
+                  " FROM information_schema.schemata"
+                  " WHERE schema_name='_v';");
+    est = PQresultStatus (res);
+    if ( (PGRES_COMMAND_OK != est) &&
+         (PGRES_TUPLES_OK != est) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to run statement to check versioning schema. Bad!\n");
+      PQclear (res);
+      PQfinish (db->conn);
+      db->conn = NULL;
+      return;
+    }
+    if (0 == PQntuples (res))
+    {
+      enum GNUNET_GenericReturnValue ret;
+
+      PQclear (res);
+      if (0 != (db->flags & GNUNET_PQ_FLAG_DROP))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    "Versioning schema does not exist yet. Not attempting drop!\n");
+        PQfinish (db->conn);
+        db->conn = NULL;
+        return;
+      }
+      ret = GNUNET_PQ_exec_sql (db,
+                                "versioning");
+      if (GNUNET_NO == ret)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Failed to find SQL file to load database versioning logic\n");
+        PQfinish (db->conn);
+        db->conn = NULL;
+        return;
+      }
+      if (GNUNET_SYSERR == ret)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Failed to run SQL logic to setup database versioning logic\n");
+        PQfinish (db->conn);
+        db->conn = NULL;
+        return;
+      }
+    }
+    else
+    {
+      PQclear (res);
+    }
+  }
+
+  /* Prepare statement for OID lookup by name */
+  {
+    PGresult *res;
+
+    res = PQprepare (db->conn,
+                     "gnunet_pq_get_oid_by_name",
+                     "SELECT"
+                     " typname, oid"
+                     " FROM pg_type"
+                     " WHERE typname = $1"
+                     " LIMIT 1",
+                     1,
+                     NULL);
+    if (PGRES_COMMAND_OK != PQresultStatus (res))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to run SQL statement prepare OID lookups: %s/%s\n",
+                  PQresultErrorMessage (res),
+                  PQerrorMessage (db->conn));
+      PQclear (res);
+      PQfinish (db->conn);
+      db->conn = NULL;
+      return;
+    }
+    PQclear (res);
+  }
+
+  /* Reset the OID-cache and retrieve the OIDs for the supported Array types */
+  db->oids.num = 0;
+  if (GNUNET_SYSERR == load_initial_oids (db))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to retrieve OID information for array types!\n");
+    PQfinish (db->conn);
+    db->conn = NULL;
+    return;
+  }
+
+  if (NULL != db->auto_suffix)
+  {
+    PGresult *res;
+
+    GNUNET_assert (NULL != db->load_path);
+    res = PQprepare (db->conn,
+                     "gnunet_pq_check_patch",
+                     "SELECT"
+                     " applied_by"
+                     " FROM _v.patches"
+                     " WHERE patch_name = $1"
+                     " LIMIT 1",
+                     1,
+                     NULL);
+    if (PGRES_COMMAND_OK != PQresultStatus (res))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to run SQL logic to setup database versioning logic: %s/%s\n",
+                  PQresultErrorMessage (res),
+                  PQerrorMessage (db->conn));
+      PQclear (res);
+      PQfinish (db->conn);
+      db->conn = NULL;
+      return;
+    }
+    PQclear (res);
+
+    if (GNUNET_SYSERR ==
+        GNUNET_PQ_run_sql (db,
+                           db->auto_suffix))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Failed to load SQL statements from `%s*'\n",
+                  db->auto_suffix);
+      PQfinish (db->conn);
+      db->conn = NULL;
+      return;
+    }
+  }
+
+  if ( (NULL != db->es) &&
+       (GNUNET_OK !=
+        GNUNET_PQ_exec_statements (db,
+                                   db->es)) )
+  {
+    PQfinish (db->conn);
+    db->conn = NULL;
+    return;
+  }
+  if ( (NULL != db->ps) &&
+       (GNUNET_OK !=
+        GNUNET_PQ_prepare_statements (db,
+                                      db->ps)) )
+  {
+    PQfinish (db->conn);
+    db->conn = NULL;
+    return;
+  }
+  GNUNET_PQ_event_reconnect_ (db,
+                              PQsocket (db->conn));
+}
+
+
+struct GNUNET_PQ_Context *
+GNUNET_PQ_connect_with_cfg (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                            const char *section,
+                            const char *load_path_suffix,
+                            const struct GNUNET_PQ_ExecuteStatement *es,
+                            const struct GNUNET_PQ_PreparedStatement *ps)
+{
+  return GNUNET_PQ_connect_with_cfg2 (cfg,
+                                      section,
+                                      load_path_suffix,
+                                      es,
+                                      ps,
+                                      GNUNET_PQ_FLAG_NONE);
+}
+
+
+struct GNUNET_PQ_Context *
+GNUNET_PQ_connect_with_cfg2 (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                             const char *section,
+                             const char *load_path_suffix,
+                             const struct GNUNET_PQ_ExecuteStatement *es,
+                             const struct GNUNET_PQ_PreparedStatement *ps,
+                             enum GNUNET_PQ_Options flags)
+{
+  struct GNUNET_PQ_Context *db;
+  char *conninfo;
+  char *load_path;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             section,
+                                             "CONFIG",
+                                             &conninfo))
+    conninfo = NULL;
+  load_path = NULL;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                               section,
+                                               "SQL_DIR",
+                                               &load_path))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_INFO,
+                               section,
+                               "SQL_DIR");
+  }
+  if ( (NULL != load_path_suffix) &&
+       (NULL == load_path) )
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               "SQL_DIR");
+    return NULL;
+  }
+  db = GNUNET_PQ_connect2 (conninfo == NULL ? "" : conninfo,
+                           load_path,
+                           load_path_suffix,
+                           es,
+                           ps,
+                           flags);
+  GNUNET_free (load_path);
+  GNUNET_free (conninfo);
+  return db;
+}
+
+
+void
+GNUNET_PQ_disconnect (struct GNUNET_PQ_Context *db)
+{
+  if (NULL == db)
+    return;
+  GNUNET_assert (0 ==
+                 GNUNET_CONTAINER_multishortmap_size (db->channel_map));
+  GNUNET_CONTAINER_multishortmap_destroy (db->channel_map);
+  GNUNET_free (db->es);
+  GNUNET_free (db->ps);
+  GNUNET_free (db->load_path);
+  GNUNET_free (db->auto_suffix);
+  GNUNET_free (db->config_str);
+  GNUNET_free (db->oids.table);
+  db->oids.table = NULL;
+  db->oids.num = 0;
+  db->oids.cap = 0;
+  PQfinish (db->conn);
+  GNUNET_free (db);
+}
+
+
+/* end of pq/pq_connect.c */
diff --git a/src/lib/pq/pq_eval.c b/src/lib/pq/pq_eval.c
new file mode 100644
index 000000000..e31475e13
--- /dev/null
+++ b/src/lib/pq/pq_eval.c
@@ -0,0 +1,248 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017, 2019 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_eval.c
+ * @brief functions to execute SQL statements with arguments and/or results (PostGres)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "pq.h"
+
+
+/**
+ * Error code returned by Postgres for deadlock.
+ */
+#define PQ_DIAG_SQLSTATE_DEADLOCK "40P01"
+
+/**
+ * Error code returned by Postgres for uniqueness violation.
+ */
+#define PQ_DIAG_SQLSTATE_UNIQUE_VIOLATION "23505"
+
+/**
+ * Error code returned by Postgres on serialization failure.
+ */
+#define PQ_DIAG_SQLSTATE_SERIALIZATION_FAILURE "40001"
+
+
+enum GNUNET_DB_QueryStatus
+GNUNET_PQ_eval_result (struct GNUNET_PQ_Context *db,
+                       const char *statement_name,
+                       PGresult *result)
+{
+  ExecStatusType est;
+
+  if (NULL == result)
+    return GNUNET_DB_STATUS_SOFT_ERROR;
+  est = PQresultStatus (result);
+  if ((PGRES_COMMAND_OK != est) &&
+      (PGRES_TUPLES_OK != est))
+  {
+    const char *sqlstate;
+    ConnStatusType status;
+
+    if (CONNECTION_OK != (status = PQstatus (db->conn)))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
+                       "pq",
+                       "Database connection failed during query `%s': %d (reconnecting)\n",
+                       statement_name,
+                       status);
+      GNUNET_PQ_reconnect (db);
+      return GNUNET_DB_STATUS_SOFT_ERROR;
+    }
+
+    sqlstate = PQresultErrorField (result,
+                                   PG_DIAG_SQLSTATE);
+    if (NULL == sqlstate)
+    {
+      /* very unexpected... */
+      GNUNET_break (0);
+      return GNUNET_DB_STATUS_HARD_ERROR;
+    }
+    if ((0 == strcmp (sqlstate,
+                      PQ_DIAG_SQLSTATE_DEADLOCK)) ||
+        (0 == strcmp (sqlstate,
+                      PQ_DIAG_SQLSTATE_SERIALIZATION_FAILURE)))
+    {
+      /* These two can be retried and have a fair chance of working
+         the next time */
+      GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
+                       "pq",
+                       "Query `%s' failed with result: %s/%s/%s/%s/%s\n",
+                       statement_name,
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_PRIMARY),
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_DETAIL),
+                       PQresultErrorMessage (result),
+                       PQresStatus (PQresultStatus (result)),
+                       PQerrorMessage (db->conn));
+      return GNUNET_DB_STATUS_SOFT_ERROR;
+    }
+    if (0 == strcmp (sqlstate,
+                     PQ_DIAG_SQLSTATE_UNIQUE_VIOLATION))
+    {
+      /* Likely no need to retry, INSERT of "same" data. */
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "pq",
+                       "Query `%s' failed with unique violation: %s/%s/%s/%s/%s\n",
+                       statement_name,
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_PRIMARY),
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_DETAIL),
+                       PQresultErrorMessage (result),
+                       PQresStatus (PQresultStatus (result)),
+                       PQerrorMessage (db->conn));
+      return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
+    }
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "pq",
+                     "Query `%s' failed with result: %s/%s/%s/%s/%s\n",
+                     statement_name,
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_PRIMARY),
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_DETAIL),
+                     PQresultErrorMessage (result),
+                     PQresStatus (PQresultStatus (result)),
+                     PQerrorMessage (db->conn));
+    return GNUNET_DB_STATUS_HARD_ERROR;
+  }
+  return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
+}
+
+
+enum GNUNET_DB_QueryStatus
+GNUNET_PQ_eval_prepared_non_select (struct GNUNET_PQ_Context *db,
+                                    const char *statement_name,
+                                    const struct GNUNET_PQ_QueryParam *params)
+{
+  PGresult *result;
+  enum GNUNET_DB_QueryStatus qs;
+
+  result = GNUNET_PQ_exec_prepared (db,
+                                    statement_name,
+                                    params);
+  if (NULL == result)
+    return GNUNET_DB_STATUS_SOFT_ERROR;
+  qs = GNUNET_PQ_eval_result (db,
+                              statement_name,
+                              result);
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == qs)
+  {
+    const char *tuples;
+
+    /* What an awful API, this function really does return a string */
+    tuples = PQcmdTuples (result);
+    if (NULL != tuples)
+      qs = strtol (tuples, NULL, 10);
+  }
+  PQclear (result);
+  return qs;
+}
+
+
+enum GNUNET_DB_QueryStatus
+GNUNET_PQ_eval_prepared_multi_select (struct GNUNET_PQ_Context *db,
+                                      const char *statement_name,
+                                      const struct GNUNET_PQ_QueryParam *params,
+                                      GNUNET_PQ_PostgresResultHandler rh,
+                                      void *rh_cls)
+{
+  PGresult *result;
+  enum GNUNET_DB_QueryStatus qs;
+  unsigned int ret;
+
+  result = GNUNET_PQ_exec_prepared (db,
+                                    statement_name,
+                                    params);
+  if (NULL == result)
+    return GNUNET_DB_STATUS_SOFT_ERROR;
+  qs = GNUNET_PQ_eval_result (db,
+                              statement_name,
+                              result);
+  if (qs < 0)
+  {
+    PQclear (result);
+    return qs;
+  }
+  ret = PQntuples (result);
+  if (NULL != rh)
+    rh (rh_cls,
+        result,
+        ret);
+  PQclear (result);
+  return ret;
+}
+
+
+enum GNUNET_DB_QueryStatus
+GNUNET_PQ_eval_prepared_singleton_select (
+  struct GNUNET_PQ_Context *db,
+  const char *statement_name,
+  const struct GNUNET_PQ_QueryParam *params,
+  struct GNUNET_PQ_ResultSpec *rs)
+{
+  PGresult *result;
+  enum GNUNET_DB_QueryStatus qs;
+  int ntuples;
+
+  result = GNUNET_PQ_exec_prepared (db,
+                                    statement_name,
+                                    params);
+  if (NULL == result)
+    return GNUNET_DB_STATUS_SOFT_ERROR;
+  qs = GNUNET_PQ_eval_result (db,
+                              statement_name,
+                              result);
+  if (qs < 0)
+  {
+    PQclear (result);
+    return qs;
+  }
+  ntuples = PQntuples (result);
+  if (0 == ntuples)
+  {
+    PQclear (result);
+    return GNUNET_DB_STATUS_SUCCESS_NO_RESULTS;
+  }
+  if (1 != ntuples)
+  {
+    /* more than one result, but there must be at most one */
+    GNUNET_break (0);
+    PQclear (result);
+    return GNUNET_DB_STATUS_HARD_ERROR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_PQ_extract_result (result,
+                                rs,
+                                0))
+  {
+    PQclear (result);
+    return GNUNET_DB_STATUS_HARD_ERROR;
+  }
+  PQclear (result);
+  return GNUNET_DB_STATUS_SUCCESS_ONE_RESULT;
+}
+
+
+/* end of pq/pq_eval.c */
diff --git a/src/lib/pq/pq_event.c b/src/lib/pq/pq_event.c
new file mode 100644
index 000000000..7506ff2f0
--- /dev/null
+++ b/src/lib/pq/pq_event.c
@@ -0,0 +1,584 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2021, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_event.c
+ * @brief event notifications via Postgres
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "pq.h"
+#include <pthread.h>
+
+
+/**
+ * Handle for an active LISTENer to the database.
+ */
+struct GNUNET_DB_EventHandler
+{
+  /**
+   * Channel name.
+   */
+  struct GNUNET_ShortHashCode sh;
+
+  /**
+   * Function to call on events.
+   */
+  GNUNET_DB_EventCallback cb;
+
+  /**
+   * Closure for @e cb.
+   */
+  void *cb_cls;
+
+  /**
+   * Database context this event handler is with.
+   */
+  struct GNUNET_PQ_Context *db;
+
+  /**
+   * Task to run on timeout.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+};
+
+
+/**
+ * Convert @a es to a short hash.
+ *
+ * @param es spec to hash to an identifier
+ * @param[out] sh short hash to set
+ */
+static void
+es_to_sh (const struct GNUNET_DB_EventHeaderP *es,
+          struct GNUNET_ShortHashCode *sh)
+{
+  struct GNUNET_HashCode h_channel;
+
+  GNUNET_CRYPTO_hash (es,
+                      ntohs (es->size),
+                      &h_channel);
+  GNUNET_static_assert (sizeof (*sh) <= sizeof (h_channel));
+  memcpy (sh,
+          &h_channel,
+          sizeof (*sh));
+}
+
+
+/**
+ * Convert @a sh to a Postgres identifier.
+ *
+ * @param sh short hash to convert to an identifier
+ * @param[out] identifier by default, Postgres supports
+ *     NAMEDATALEN=64 character identifiers
+ * @return end position of the identifier
+ */
+static char *
+sh_to_channel (struct GNUNET_ShortHashCode *sh,
+               char identifier[64])
+{
+  char *end;
+
+  end = GNUNET_STRINGS_data_to_string (sh,
+                                       sizeof (*sh),
+                                       identifier,
+                                       63);
+  GNUNET_assert (NULL != end);
+  *end = '\0';
+  return end;
+}
+
+
+/**
+ * Convert @a sh to a Postgres identifier.
+ *
+ * @param identifier to convert
+ * @param[out] sh set to short hash
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+channel_to_sh (const char *identifier,
+               struct GNUNET_ShortHashCode *sh)
+{
+  return GNUNET_STRINGS_string_to_data (identifier,
+                                        strlen (identifier),
+                                        sh,
+                                        sizeof (*sh));
+}
+
+
+/**
+ * Convert @a es to a Postgres identifier.
+ *
+ * @param es spec to hash to an identifier
+ * @param[out] identifier by default, Postgres supports
+ *     NAMEDATALEN=64 character identifiers
+ * @return end position of the identifier
+ */
+static char *
+es_to_channel (const struct GNUNET_DB_EventHeaderP *es,
+               char identifier[64])
+{
+  struct GNUNET_ShortHashCode sh;
+
+  es_to_sh (es,
+            &sh);
+  return sh_to_channel (&sh,
+                        identifier);
+}
+
+
+/**
+ * Closure for #do_notify().
+ */
+struct NotifyContext
+{
+  /**
+   * Extra argument of the notification, or NULL.
+   */
+  void *extra;
+
+  /**
+   * Number of bytes in @e extra.
+   */
+  size_t extra_size;
+};
+
+
+/**
+ * Function called on every event handler that
+ * needs to be triggered.
+ *
+ * @param cls a `struct NotifyContext`
+ * @param sh channel name
+ * @param value a `struct GNUNET_DB_EventHandler`
+ * @return #GNUNET_OK continue to iterate
+ */
+static enum GNUNET_GenericReturnValue
+do_notify (void *cls,
+           const struct GNUNET_ShortHashCode *sh,
+           void *value)
+{
+  struct NotifyContext *ctx = cls;
+  struct GNUNET_DB_EventHandler *eh = value;
+
+  eh->cb (eh->cb_cls,
+          ctx->extra,
+          ctx->extra_size);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_PQ_event_do_poll (struct GNUNET_PQ_Context *db)
+{
+  PGnotify *n;
+  unsigned int cnt = 0;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "PG poll job active\n");
+  if (1 !=
+      PQconsumeInput (db->conn))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read from Postgres: %s\n",
+                PQerrorMessage (db->conn));
+    if (CONNECTION_BAD != PQstatus (db->conn))
+      return;
+    GNUNET_PQ_reconnect (db);
+    return;
+  }
+  while (NULL != (n = PQnotifies (db->conn)))
+  {
+    struct GNUNET_ShortHashCode sh;
+    struct NotifyContext ctx = {
+      .extra = NULL
+    };
+
+    cnt++;
+    if ('X' != toupper ((int) n->relname[0]))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Ignoring notification for unsupported channel identifier `%s'\n",
+                  n->relname);
+      PQfreemem (n);
+      continue;
+    }
+    if (GNUNET_OK !=
+        channel_to_sh (&n->relname[1],
+                       &sh))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Ignoring notification for unsupported channel identifier `%s'\n",
+                  n->relname);
+      PQfreemem (n);
+      continue;
+    }
+    if ( (NULL != n->extra) &&
+         (GNUNET_OK !=
+          GNUNET_STRINGS_string_to_data_alloc (n->extra,
+                                               strlen (n->extra),
+                                               &ctx.extra,
+                                               &ctx.extra_size)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Ignoring notification for unsupported extra data `%s' on channel `%s'\n",
+                  n->extra,
+                  n->relname);
+      PQfreemem (n);
+      continue;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Received notification %s with extra data `%.*s'\n",
+                n->relname,
+                (int) ctx.extra_size,
+                (const char *) ctx.extra);
+    GNUNET_CONTAINER_multishortmap_get_multiple (db->channel_map,
+                                                 &sh,
+                                                 &do_notify,
+                                                 &ctx);
+    GNUNET_free (ctx.extra);
+    PQfreemem (n);
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "PG poll job finishes after %u events\n",
+              cnt);
+}
+
+
+/**
+ * The GNUnet scheduler notifies us that we need to
+ * trigger the DB event poller.
+ *
+ * @param cls a `struct GNUNET_PQ_Context *`
+ */
+static void
+do_scheduler_notify (void *cls)
+{
+  struct GNUNET_PQ_Context *db = cls;
+
+  db->event_task = NULL;
+  if (NULL == db->rfd)
+    GNUNET_PQ_reconnect (db);
+  GNUNET_PQ_event_do_poll (db);
+  if (NULL != db->event_task)
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Resubscribing\n");
+  if (NULL == db->rfd)
+  {
+    db->resubscribe_backoff
+      = GNUNET_TIME_relative_max (db->resubscribe_backoff,
+                                  GNUNET_TIME_UNIT_SECONDS);
+    db->resubscribe_backoff
+      = GNUNET_TIME_STD_BACKOFF (db->resubscribe_backoff);
+    db->event_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                                   &do_scheduler_notify,
+                                                   db);
+    return;
+  }
+  db->resubscribe_backoff = GNUNET_TIME_UNIT_SECONDS;
+  db->event_task
+    = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                     db->rfd,
+                                     &do_scheduler_notify,
+                                     db);
+}
+
+
+/**
+ * Function called when the Postgres FD changes and we need
+ * to update the scheduler event loop task.
+ *
+ * @param cls a `struct GNUNET_PQ_Context *`
+ * @param fd the file descriptor, possibly -1
+ */
+static void
+scheduler_fd_cb (void *cls,
+                 int fd)
+{
+  struct GNUNET_PQ_Context *db = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "New poll FD is %d\n",
+              fd);
+  if (NULL != db->event_task)
+  {
+    GNUNET_SCHEDULER_cancel (db->event_task);
+    db->event_task = NULL;
+  }
+  GNUNET_free (db->rfd);
+  if (-1 == fd)
+    return;
+  if (0 == GNUNET_CONTAINER_multishortmap_size (db->channel_map))
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Activating poll job on %d\n",
+              fd);
+  db->rfd = GNUNET_NETWORK_socket_box_native (fd);
+  db->event_task
+    = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_ZERO,
+                                     db->rfd,
+                                     &do_scheduler_notify,
+                                     db);
+}
+
+
+/**
+ * Helper function to trigger an SQL @a cmd on @a db
+ *
+ * @param db database to send command to
+ * @param cmd prefix of the command to send
+ * @param eh details about the event
+ */
+static void
+manage_subscribe (struct GNUNET_PQ_Context *db,
+                  const char *cmd,
+                  struct GNUNET_DB_EventHandler *eh)
+{
+  char sql[16 + 64];
+  char *end;
+  PGresult *result;
+
+  if (NULL == db->conn)
+    return;
+  end = stpcpy (sql,
+                cmd);
+  end = sh_to_channel (&eh->sh,
+                       end);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Executing PQ command `%s'\n",
+              sql);
+  result = PQexec (db->conn,
+                   sql);
+  if (PGRES_COMMAND_OK != PQresultStatus (result))
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "pq",
+                     "Failed to execute `%s': %s/%s/%s/%s/%s",
+                     sql,
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_PRIMARY),
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_DETAIL),
+                     PQresultErrorMessage (result),
+                     PQresStatus (PQresultStatus (result)),
+                     PQerrorMessage (db->conn));
+  }
+  PQclear (result);
+}
+
+
+/**
+ * Re-subscribe to notifications after disconnect.
+ *
+ * @param cls the DB context
+ * @param sh the short hash of the channel
+ * @param value the event handler
+ * @return #GNUNET_OK to continue to iterate
+ */
+static enum GNUNET_GenericReturnValue
+register_notify (void *cls,
+                 const struct GNUNET_ShortHashCode *sh,
+                 void *value)
+{
+  struct GNUNET_PQ_Context *db = cls;
+  struct GNUNET_DB_EventHandler *eh = value;
+
+  manage_subscribe (db,
+                    "LISTEN X",
+                    eh);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_PQ_event_reconnect_ (struct GNUNET_PQ_Context *db,
+                            int fd)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Change in PQ event FD to %d\n",
+              fd);
+  scheduler_fd_cb (db,
+                   fd);
+  GNUNET_CONTAINER_multishortmap_iterate (db->channel_map,
+                                          &register_notify,
+                                          db);
+}
+
+
+/**
+ * Function run on timeout for an event. Triggers
+ * the notification, but does NOT clear the handler.
+ *
+ * @param cls a `struct GNUNET_DB_EventHandler *`
+ */
+static void
+event_timeout (void *cls)
+{
+  struct GNUNET_DB_EventHandler *eh = cls;
+
+  eh->timeout_task = NULL;
+  eh->cb (eh->cb_cls,
+          NULL,
+          0);
+}
+
+
+struct GNUNET_DB_EventHandler *
+GNUNET_PQ_event_listen (struct GNUNET_PQ_Context *db,
+                        const struct GNUNET_DB_EventHeaderP *es,
+                        struct GNUNET_TIME_Relative timeout,
+                        GNUNET_DB_EventCallback cb,
+                        void *cb_cls)
+{
+  struct GNUNET_DB_EventHandler *eh;
+  bool sub;
+
+  eh = GNUNET_new (struct GNUNET_DB_EventHandler);
+  eh->db = db;
+  es_to_sh (es,
+            &eh->sh);
+  eh->cb = cb;
+  eh->cb_cls = cb_cls;
+  sub = (NULL ==
+         GNUNET_CONTAINER_multishortmap_get (db->channel_map,
+                                             &eh->sh));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multishortmap_put (db->channel_map,
+                                                     &eh->sh,
+                                                     eh,
+                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  if (NULL == db->event_task)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Starting event scheduler\n");
+    scheduler_fd_cb (db,
+                     PQsocket (db->conn));
+  }
+  if (sub)
+    manage_subscribe (db,
+                      "LISTEN X",
+                      eh);
+  eh->timeout_task = GNUNET_SCHEDULER_add_delayed (timeout,
+                                                   &event_timeout,
+                                                   eh);
+  return eh;
+}
+
+
+void
+GNUNET_PQ_event_listen_cancel (struct GNUNET_DB_EventHandler *eh)
+{
+  struct GNUNET_PQ_Context *db = eh->db;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multishortmap_remove (db->channel_map,
+                                                        &eh->sh,
+                                                        eh));
+  if (NULL ==
+      GNUNET_CONTAINER_multishortmap_get (db->channel_map,
+                                          &eh->sh))
+    manage_subscribe (db,
+                      "UNLISTEN X",
+                      eh);
+  if (0 == GNUNET_CONTAINER_multishortmap_size (db->channel_map))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Stopping PQ event scheduler job\n");
+    GNUNET_free (db->rfd);
+    if (NULL != db->event_task)
+    {
+      GNUNET_SCHEDULER_cancel (db->event_task);
+      db->event_task = NULL;
+    }
+  }
+  if (NULL != eh->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (eh->timeout_task);
+    eh->timeout_task = NULL;
+  }
+  GNUNET_free (eh);
+}
+
+
+char *
+GNUNET_PQ_get_event_notify_channel (const struct GNUNET_DB_EventHeaderP *es)
+{
+  char sql[16 + 64 + 8];
+  char *end;
+
+  end = stpcpy (sql,
+                "X");
+  end = es_to_channel (es,
+                       end);
+  GNUNET_assert (NULL != end);
+  return GNUNET_strdup (sql);
+}
+
+
+void
+GNUNET_PQ_event_notify (struct GNUNET_PQ_Context *db,
+                        const struct GNUNET_DB_EventHeaderP *es,
+                        const void *extra,
+                        size_t extra_size)
+{
+  char sql[16 + 64 + extra_size * 8 / 5 + 8];
+  char *end;
+  PGresult *result;
+
+  end = stpcpy (sql,
+                "NOTIFY X");
+  end = es_to_channel (es,
+                       end);
+  end = stpcpy (end,
+                ", '");
+  end = GNUNET_STRINGS_data_to_string (extra,
+                                       extra_size,
+                                       end,
+                                       sizeof (sql) - (end - sql) - 1);
+  GNUNET_assert (NULL != end);
+  *end = '\0';
+  end = stpcpy (end,
+                "'");
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Executing command `%s'\n",
+              sql);
+  result = PQexec (db->conn,
+                   sql);
+  if (PGRES_COMMAND_OK != PQresultStatus (result))
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "pq",
+                     "Failed to execute `%s': %s/%s/%s/%s/%s",
+                     sql,
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_PRIMARY),
+                     PQresultErrorField (result,
+                                         PG_DIAG_MESSAGE_DETAIL),
+                     PQresultErrorMessage (result),
+                     PQresStatus (PQresultStatus (result)),
+                     PQerrorMessage (db->conn));
+  }
+  PQclear (result);
+  GNUNET_PQ_event_do_poll (db);
+}
+
+
+/* end of pq_event.c */
diff --git a/src/lib/pq/pq_exec.c b/src/lib/pq/pq_exec.c
new file mode 100644
index 000000000..1fd8c5068
--- /dev/null
+++ b/src/lib/pq/pq_exec.c
@@ -0,0 +1,95 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017, 2019 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_exec.c
+ * @brief functions to execute plain SQL statements (PostGres)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "pq.h"
+
+
+struct GNUNET_PQ_ExecuteStatement
+GNUNET_PQ_make_execute (const char *sql)
+{
+  struct GNUNET_PQ_ExecuteStatement es = {
+    .sql = sql,
+    .ignore_errors = GNUNET_NO
+  };
+
+  return es;
+}
+
+
+struct GNUNET_PQ_ExecuteStatement
+GNUNET_PQ_make_try_execute (const char *sql)
+{
+  struct GNUNET_PQ_ExecuteStatement es = {
+    .sql = sql,
+    .ignore_errors = GNUNET_YES
+  };
+
+  return es;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_exec_statements (struct GNUNET_PQ_Context *db,
+                           const struct GNUNET_PQ_ExecuteStatement *es)
+{
+  for (unsigned int i = 0; NULL != es[i].sql; i++)
+  {
+    PGresult *result;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Running statement `%s' on %p\n",
+                es[i].sql,
+                db);
+    result = PQexec (db->conn,
+                     es[i].sql);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Running statement `%s' on %p finished (%s)\n",
+                es[i].sql,
+                db,
+                PQresStatus (PQresultStatus (result)));
+    if ((GNUNET_NO == es[i].ignore_errors) &&
+        (PGRES_COMMAND_OK != PQresultStatus (result)))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                       "pq",
+                       "Failed to execute `%s': %s/%s/%s/%s/%s",
+                       es[i].sql,
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_PRIMARY),
+                       PQresultErrorField (result,
+                                           PG_DIAG_MESSAGE_DETAIL),
+                       PQresultErrorMessage (result),
+                       PQresStatus (PQresultStatus (result)),
+                       PQerrorMessage (db->conn));
+      PQclear (result);
+      return GNUNET_SYSERR;
+    }
+    PQclear (result);
+  }
+  return GNUNET_OK;
+}
+
+
+/* end of pq/pq_exec.c */
diff --git a/src/lib/pq/pq_prepare.c b/src/lib/pq/pq_prepare.c
new file mode 100644
index 000000000..b4292dea3
--- /dev/null
+++ b/src/lib/pq/pq_prepare.c
@@ -0,0 +1,125 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017, 2019 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_prepare.c
+ * @brief functions to connect to libpq (PostGres)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "pq.h"
+
+
+struct GNUNET_PQ_PreparedStatement
+GNUNET_PQ_make_prepare (const char *name,
+                        const char *sql)
+{
+  struct GNUNET_PQ_PreparedStatement ps = {
+    .name = name,
+    .sql = sql
+  };
+
+  return ps;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_prepare_once (struct GNUNET_PQ_Context *db,
+                        const struct GNUNET_PQ_PreparedStatement *ps)
+{
+  for (unsigned int i = 0; NULL != ps[i].name; i++)
+  {
+    PGresult *ret;
+
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "pq",
+                     "Preparing SQL statement `%s' as `%s'\n",
+                     ps[i].sql,
+                     ps[i].name);
+    ret = PQprepare (db->conn,
+                     ps[i].name,
+                     ps[i].sql,
+                     0,
+                     NULL);
+    if (PGRES_COMMAND_OK != PQresultStatus (ret))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                       "pq",
+                       "PQprepare (`%s' as `%s') failed with error: %s\n",
+                       ps[i].sql,
+                       ps[i].name,
+                       PQerrorMessage (db->conn));
+      PQclear (ret);
+      ret = PQdescribePrepared (db->conn,
+                                ps[i].name);
+      if (PGRES_COMMAND_OK != PQresultStatus (ret))
+      {
+        PQclear (ret);
+        return GNUNET_SYSERR;
+      }
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                       "pq",
+                       "Statement `%s' already known. Ignoring the issue in the hope that you are using connection pooling...\n",
+                       ps[i].name);
+    }
+    PQclear (ret);
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PQ_prepare_statements (struct GNUNET_PQ_Context *db,
+                              const struct GNUNET_PQ_PreparedStatement *ps)
+{
+  if (db->ps != ps)
+  {
+    /* add 'ps' to list db->ps of prepared statements to run on reconnect! */
+    unsigned int nlen = 0; /* length of 'ps' array */
+    unsigned int xlen;
+    struct GNUNET_PQ_PreparedStatement *rps; /* combined array */
+
+    while (NULL != ps[nlen].name)
+      nlen++;
+    xlen = nlen + db->ps_off;
+    if (xlen > db->ps_len)
+    {
+      xlen = 2 * xlen + 1;
+      rps = GNUNET_new_array (xlen,
+                              struct GNUNET_PQ_PreparedStatement);
+      if (NULL != db->ps)
+        memcpy (rps,
+                db->ps,
+                db->ps_off * sizeof (struct GNUNET_PQ_PreparedStatement));
+      GNUNET_free (db->ps);
+      db->ps_len = xlen;
+      db->ps = rps;
+    }
+    memcpy (&db->ps[db->ps_off],
+            ps,
+            nlen * sizeof (struct GNUNET_PQ_PreparedStatement));
+    db->ps_off += nlen;
+  }
+
+  return GNUNET_PQ_prepare_once (db,
+                                 ps);
+}
+
+
+/* end of pq/pq_prepare.c */
diff --git a/src/lib/pq/pq_query_helper.c b/src/lib/pq/pq_query_helper.c
new file mode 100644
index 000000000..913ce9235
--- /dev/null
+++ b/src/lib/pq/pq_query_helper.c
@@ -0,0 +1,1585 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2016, 2020 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_query_helper.c
+ * @brief functions to initialize parameter arrays
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_common.h"
+#include "gnunet_pq_lib.h"
+#include "gnunet_time_lib.h"
+#include "pq.h"
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_null (void *cls,
+            const void *data,
+            size_t data_len,
+            void *param_values[],
+            int param_lengths[],
+            int param_formats[],
+            unsigned int param_length,
+            void *scratch[],
+            unsigned int scratch_length)
+{
+  (void) scratch;
+  (void) scratch_length;
+  (void) data;
+  (void) data_len;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  param_values[0] = NULL;
+  param_lengths[0] = 0;
+  param_formats[0] = 1;
+  return 0;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_null (void)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_null,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_fixed (void *cls,
+             const void *data,
+             size_t data_len,
+             void *param_values[],
+             int param_lengths[],
+             int param_formats[],
+             unsigned int param_length,
+             void *scratch[],
+             unsigned int scratch_length)
+{
+  (void) scratch;
+  (void) scratch_length;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  param_values[0] = (void *) data;
+  param_lengths[0] = data_len;
+  param_formats[0] = 1;
+  return 0;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_fixed_size (const void *ptr,
+                                  size_t ptr_size)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_fixed,
+    .conv_cls = NULL,
+    .data = ptr,
+    .size = ptr_size,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_string (const char *ptr)
+{
+  return GNUNET_PQ_query_param_fixed_size (ptr,
+                                           strlen (ptr));
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_bool (bool b)
+{
+  static uint8_t bt = 1;
+  static uint8_t bf = 0;
+
+  return GNUNET_PQ_query_param_fixed_size (b ? &bt : &bf,
+                                           sizeof (uint8_t));
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_uint16 (void *cls,
+              const void *data,
+              size_t data_len,
+              void *param_values[],
+              int param_lengths[],
+              int param_formats[],
+              unsigned int param_length,
+              void *scratch[],
+              unsigned int scratch_length)
+{
+  const uint16_t *u_hbo = data;
+  uint16_t *u_nbo;
+
+  (void) scratch;
+  (void) scratch_length;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  u_nbo = GNUNET_new (uint16_t);
+  scratch[0] = u_nbo;
+  *u_nbo = htons (*u_hbo);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(uint16_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_uint16 (const uint16_t *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_uint16,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_uint32 (void *cls,
+              const void *data,
+              size_t data_len,
+              void *param_values[],
+              int param_lengths[],
+              int param_formats[],
+              unsigned int param_length,
+              void *scratch[],
+              unsigned int scratch_length)
+{
+  const uint32_t *u_hbo = data;
+  uint32_t *u_nbo;
+
+  (void) scratch;
+  (void) scratch_length;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  u_nbo = GNUNET_new (uint32_t);
+  scratch[0] = u_nbo;
+  *u_nbo = htonl (*u_hbo);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(uint32_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_uint32 (const uint32_t *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_uint32,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_uint64 (void *cls,
+              const void *data,
+              size_t data_len,
+              void *param_values[],
+              int param_lengths[],
+              int param_formats[],
+              unsigned int param_length,
+              void *scratch[],
+              unsigned int scratch_length)
+{
+  const uint64_t *u_hbo = data;
+  uint64_t *u_nbo;
+
+  (void) scratch;
+  (void) scratch_length;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  u_nbo = GNUNET_new (uint64_t);
+  scratch[0] = u_nbo;
+  *u_nbo = GNUNET_htonll (*u_hbo);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(uint64_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_uint64 (const uint64_t *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_uint64,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_int64 (void *cls,
+             const void *data,
+             size_t data_len,
+             void *param_values[],
+             int param_lengths[],
+             int param_formats[],
+             unsigned int param_length,
+             void *scratch[],
+             unsigned int scratch_length)
+{
+  const int64_t *u_hbo = data;
+  int64_t *u_nbo;
+
+  (void) scratch;
+  (void) scratch_length;
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  u_nbo = GNUNET_new (int64_t);
+  scratch[0] = u_nbo;
+  *u_nbo = GNUNET_htonll (*u_hbo);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(int64_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_int64 (const int64_t *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_int64,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_rsa_public_key (void *cls,
+                      const void *data,
+                      size_t data_len,
+                      void *param_values[],
+                      int param_lengths[],
+                      int param_formats[],
+                      unsigned int param_length,
+                      void *scratch[],
+                      unsigned int scratch_length)
+{
+  const struct GNUNET_CRYPTO_RsaPublicKey *rsa = data;
+  void *buf;
+  size_t buf_size;
+
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  buf_size = GNUNET_CRYPTO_rsa_public_key_encode (rsa,
+                                                  &buf);
+  scratch[0] = buf;
+  param_values[0] = (void *) buf;
+  param_lengths[0] = buf_size;
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_rsa_public_key (
+  const struct GNUNET_CRYPTO_RsaPublicKey *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_rsa_public_key,
+    .data = x,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_rsa_signature (void *cls,
+                     const void *data,
+                     size_t data_len,
+                     void *param_values[],
+                     int param_lengths[],
+                     int param_formats[],
+                     unsigned int param_length,
+                     void *scratch[],
+                     unsigned int scratch_length)
+{
+  const struct GNUNET_CRYPTO_RsaSignature *sig = data;
+  void *buf;
+  size_t buf_size;
+
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  buf_size = GNUNET_CRYPTO_rsa_signature_encode (sig,
+                                                 &buf);
+  scratch[0] = buf;
+  param_values[0] = (void *) buf;
+  param_lengths[0] = buf_size;
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_rsa_signature (const struct GNUNET_CRYPTO_RsaSignature *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_rsa_signature,
+    .data = x,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_rel_time (void *cls,
+                const void *data,
+                size_t data_len,
+                void *param_values[],
+                int param_lengths[],
+                int param_formats[],
+                unsigned int param_length,
+                void *scratch[],
+                unsigned int scratch_length)
+{
+  const struct GNUNET_TIME_Relative *u = data;
+  struct GNUNET_TIME_Relative rel;
+  uint64_t *u_nbo;
+
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  rel = *u;
+  if (rel.rel_value_us > INT64_MAX)
+    rel.rel_value_us = INT64_MAX;
+  u_nbo = GNUNET_new (uint64_t);
+  scratch[0] = u_nbo;
+  *u_nbo = GNUNET_htonll (rel.rel_value_us);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(uint64_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_relative_time (const struct GNUNET_TIME_Relative *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_rel_time,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_abs_time (void *cls,
+                const void *data,
+                size_t data_len,
+                void *param_values[],
+                int param_lengths[],
+                int param_formats[],
+                unsigned int param_length,
+                void *scratch[],
+                unsigned int scratch_length)
+{
+  const struct GNUNET_TIME_Absolute *u = data;
+  struct GNUNET_TIME_Absolute abs;
+  uint64_t *u_nbo;
+
+  GNUNET_break (NULL == cls);
+  if (1 != param_length)
+    return -1;
+  abs = *u;
+  if (abs.abs_value_us > INT64_MAX)
+    abs.abs_value_us = INT64_MAX;
+  u_nbo = GNUNET_new (uint64_t);
+  scratch[0] = u_nbo;
+  *u_nbo = GNUNET_htonll (abs.abs_value_us);
+  param_values[0] = (void *) u_nbo;
+  param_lengths[0] = sizeof(uint64_t);
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_abs_time,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_absolute_time_nbo (
+  const struct GNUNET_TIME_AbsoluteNBO *x)
+{
+  return GNUNET_PQ_query_param_auto_from_type (&x->abs_value_us__);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp (const struct GNUNET_TIME_Timestamp *x)
+{
+  return GNUNET_PQ_query_param_absolute_time (&x->abs_time);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp_nbo (
+  const struct GNUNET_TIME_TimestampNBO *x)
+{
+  return GNUNET_PQ_query_param_absolute_time_nbo (&x->abs_time_nbo);
+}
+
+
+/**
+ * Closure for the array type handlers.
+ *
+ * May contain sizes information for the data, given (and handled) by the
+ * caller.
+ */
+struct qconv_array_cls
+{
+  /**
+   * If not null, contains the array of sizes (the size of the array is the
+   * .size field in the ambient GNUNET_PQ_QueryParam struct). We do not free
+   * this memory.
+   *
+   * If not null, this value has precedence over @a sizes, which MUST be NULL */
+  const size_t *sizes;
+
+  /**
+   * If @a size and @a c_sizes are NULL, this field defines the same size
+   * for each element in the array.
+   */
+  size_t same_size;
+
+  /**
+   * If true, the array parameter to the data pointer to the qconv_array is a
+   * continuous byte array of data, either with @a same_size each or sizes
+   * provided bytes by @a sizes;
+   */
+  bool continuous;
+
+  /**
+   * Type of the array elements
+   */
+  enum array_types typ;
+
+  /**
+   * Oid of the array elements
+   */
+  Oid oid;
+};
+
+/**
+ * Callback to cleanup a qconv_array_cls to be used during
+ * GNUNET_PQ_cleanup_query_params_closures
+ */
+static void
+qconv_array_cls_cleanup (void *cls)
+{
+  GNUNET_free (cls);
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters for arrays
+ *
+ * Note: the format for the encoding of arrays for libpq is not very well
+ * documented.  We peeked into various sources (postgresql and libpqtypes) for
+ * guidance.
+ *
+ * @param cls Closure of type struct qconv_array_cls*
+ * @param data Pointer to first element in the array
+ * @param data_len Number of _elements_ in array @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_array (
+  void *cls,
+  const void *data,
+  size_t data_len,
+  void *param_values[],
+  int param_lengths[],
+  int param_formats[],
+  unsigned int param_length,
+  void *scratch[],
+  unsigned int scratch_length)
+{
+  struct qconv_array_cls *meta = cls;
+  size_t num = data_len;
+  size_t total_size;
+  const size_t *sizes;
+  bool same_sized;
+  size_t *string_lengths = NULL;
+  void *elements = NULL;
+  bool noerror = true;
+
+  (void) (param_length);
+  (void) (scratch_length);
+
+  GNUNET_assert (NULL != meta);
+  GNUNET_assert (num < INT_MAX);
+
+  sizes = meta->sizes;
+  same_sized = (0 != meta->same_size);
+
+#define RETURN_UNLESS(cond) \
+  do { \
+    if (! (cond)) \
+    { \
+      GNUNET_break ((cond)); \
+      noerror = false; \
+      goto DONE; \
+    } \
+  } while (0)
+
+  /* Calculate sizes and check bounds */
+  {
+    /* num * length-field */
+    size_t x = sizeof(uint32_t);
+    size_t y = x * num;
+    RETURN_UNLESS ((0 == num) || (y / num == x));
+
+    /* size of header */
+    total_size  = x = sizeof(struct pq_array_header);
+    total_size += y;
+    RETURN_UNLESS (total_size >= x);
+
+    /* sizes of elements */
+    if (same_sized)
+    {
+      x = num * meta->same_size;
+      RETURN_UNLESS ((0 == num) || (x / num == meta->same_size));
+
+      y = total_size;
+      total_size += x;
+      RETURN_UNLESS (total_size >= y);
+    }
+    else  /* sizes are different per element */
+    {
+      /* for an array of strings we need to get their length's first */
+      if (array_of_string == meta->typ)
+      {
+        string_lengths = GNUNET_new_array (num, size_t);
+
+        if (meta->continuous)
+        {
+          const char *ptr = data;
+          for (unsigned int i = 0; i < num; i++)
+          {
+            size_t len = strlen (ptr);
+            string_lengths[i] = len;
+            ptr += len + 1;
+          }
+        }
+        else
+        {
+          const char **str = (const char **) data;
+          for (unsigned int i = 0; i < num; i++)
+            string_lengths[i] = strlen (str[i]);
+        }
+
+        sizes = string_lengths;
+      }
+
+      for (unsigned int i = 0; i < num; i++)
+      {
+        x = total_size;
+        total_size += sizes[i];
+        RETURN_UNLESS (total_size >= x);
+      }
+    }
+
+    RETURN_UNLESS (total_size < INT_MAX);
+
+    elements = GNUNET_malloc (total_size);
+  }
+
+  /* Write data */
+  {
+    char *in = (char *) data;
+    char *out = elements;
+    size_t nullbyte = (array_of_string == meta->typ) ? 1 : 0;
+    struct pq_array_header h = {
+      .ndim = htonl (1),        /* We only support one-dimensional arrays */
+      .has_null = htonl (0),    /* We do not support NULL entries in arrays */
+      .lbound = htonl (1),      /* Default start index value */
+      .dim = htonl (num),
+      .oid = htonl (meta->oid),
+    };
+
+    /* Write header */
+    GNUNET_memcpy (out, &h, sizeof(h));
+    out += sizeof(h);
+
+
+    /* Write elements */
+    for (unsigned int i = 0; i < num; i++)
+    {
+      size_t sz = same_sized ? meta->same_size : sizes[i];
+      size_t hsz = htonl (sz);
+
+      GNUNET_memcpy (out,
+                     &hsz,
+                     sizeof(hsz));
+      out += sizeof(uint32_t);
+
+      switch (meta->typ)
+      {
+      case array_of_bool:
+        {
+          GNUNET_assert (sizeof(bool) == sz);
+          *(bool *) out = (*(bool *) in);
+          in  += sz;
+          break;
+        }
+      case array_of_uint16:
+        {
+          GNUNET_assert (sizeof(uint16_t) == sz);
+          *(uint16_t *) out = htons (*(uint16_t *) in);
+          in  += sz;
+          break;
+        }
+      case array_of_uint32:
+        {
+          uint32_t v;
+          GNUNET_assert (sizeof(uint32_t) == sz);
+
+          v = htonl (*(uint32_t *) in);
+          GNUNET_memcpy (out,
+                         &v,
+                         sizeof(v));
+          in  += sz;
+          break;
+        }
+      case array_of_uint64:
+        {
+          uint64_t tmp;
+          GNUNET_assert (sizeof(uint64_t) == sz);
+
+          tmp = GNUNET_htonll (*(uint64_t *) in);
+          GNUNET_memcpy (out,
+                         &tmp,
+                         sizeof(tmp));
+          in  += sz;
+          break;
+        }
+      case array_of_byte:
+      case array_of_string:
+        {
+          const void *ptr;
+
+          if (meta->continuous)
+          {
+            ptr = in;
+            in += sz + nullbyte;
+          }
+          else
+            ptr = ((const void **) data)[i];
+
+          GNUNET_memcpy (out,
+                         ptr,
+                         sz);
+          break;
+        }
+      case array_of_abs_time:
+      case array_of_rel_time:
+      case array_of_timestamp:
+        {
+          uint64_t val;
+
+          switch (meta->typ)
+          {
+          case array_of_abs_time:
+            {
+              const struct GNUNET_TIME_Absolute *abs =
+                (const struct GNUNET_TIME_Absolute *) in;
+
+              GNUNET_assert (sizeof(struct GNUNET_TIME_Absolute) == sz);
+
+              if (! meta->continuous)
+                abs = ((const struct GNUNET_TIME_Absolute **) data)[i];
+
+              val = abs->abs_value_us;
+              break;
+            }
+          case array_of_rel_time:
+            {
+              const struct GNUNET_TIME_Relative *rel =
+                (const struct GNUNET_TIME_Relative *) in;
+
+              GNUNET_assert (sizeof(struct GNUNET_TIME_Relative) == sz);
+
+              if (! meta->continuous)
+                rel = ((const struct GNUNET_TIME_Relative **) data)[i];
+
+              val = rel->rel_value_us;
+              break;
+            }
+          case array_of_timestamp:
+            {
+              const struct GNUNET_TIME_Timestamp *ts =
+                (const struct GNUNET_TIME_Timestamp *) in;
+
+              GNUNET_assert (sizeof(struct GNUNET_TIME_Timestamp) == sz);
+
+              if (! meta->continuous)
+                ts = ((const struct GNUNET_TIME_Timestamp **) data)[i];
+
+              val = ts->abs_time.abs_value_us;
+              break;
+            }
+          default:
+            {
+              GNUNET_assert (0);
+            }
+          }
+
+          if (val > INT64_MAX)
+            val = INT64_MAX;
+
+          val = GNUNET_htonll (val);
+          GNUNET_memcpy (out,
+                         &val,
+                         sizeof(val));
+
+          if (meta->continuous)
+            in += sz;
+
+          break;
+        }
+      default:
+        {
+          GNUNET_assert (0);
+          break;
+        }
+      }
+      out += sz;
+    }
+  }
+
+  param_values[0] = elements;
+  param_lengths[0] = total_size;
+  param_formats[0] = 1;
+  scratch[0] = elements;
+
+DONE:
+  GNUNET_free (string_lengths);
+
+  if (noerror)
+    return 1;
+
+  return -1;
+}
+
+
+/**
+ * Function to genreate a typ specific query parameter and corresponding closure
+ *
+ * @param num Number of elements in @a elements
+ * @param continuous If true, @a elements is an continuous array of data
+ * @param elements Array of @a num elements, either continuous or pointers
+ * @param sizes Array of @a num sizes, one per element, may be NULL
+ * @param same_size If not 0, all elements in @a elements have this size
+ * @param typ Supported internal type of each element in @a elements
+ * @param oid Oid of the type to be used in Postgres
+ * @return Query parameter
+ */
+static struct GNUNET_PQ_QueryParam
+query_param_array_generic (
+  unsigned int num,
+  bool continuous,
+  const void *elements,
+  const size_t *sizes,
+  size_t same_size,
+  enum array_types typ,
+  Oid oid)
+{
+  struct qconv_array_cls *meta = GNUNET_new (struct qconv_array_cls);
+
+  meta->typ = typ;
+  meta->oid = oid;
+  meta->sizes = sizes;
+  meta->same_size = same_size;
+  meta->continuous = continuous;
+
+  {
+    struct GNUNET_PQ_QueryParam res = {
+      .conv = qconv_array,
+      .conv_cls = meta,
+      .conv_cls_cleanup = &qconv_array_cls_cleanup,
+      .data = elements,
+      .size = num,
+      .num_params = 1,
+    };
+
+    return res;
+  }
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bool (
+  unsigned int num,
+  const bool *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bool",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(bool),
+                                    array_of_bool,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint16 (
+  unsigned int num,
+  const uint16_t *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int2",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(uint16_t),
+                                    array_of_uint16,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint32 (
+  unsigned int num,
+  const uint32_t *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int4",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(uint32_t),
+                                    array_of_uint32,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_uint64 (
+  unsigned int num,
+  const uint64_t *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(uint64_t),
+                                    array_of_uint64,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bytes (
+  unsigned int num,
+  const void *elements,
+  const size_t *sizes,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    sizes,
+                                    0,
+                                    array_of_byte,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_bytes (
+  unsigned int num,
+  const void *elements[static num],
+  const size_t *sizes,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    sizes,
+                                    0,
+                                    array_of_byte,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_bytes_same_size (
+  unsigned int num,
+  const void *elements,
+  size_t same_size,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    same_size,
+                                    array_of_byte,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_bytes_same_size (
+  unsigned int num,
+  const void *elements[static num],
+  size_t same_size,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    NULL,
+                                    same_size,
+                                    array_of_byte,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_string (
+  unsigned int num,
+  const char *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "text",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    0,
+                                    array_of_string,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_string (
+  unsigned int num,
+  const char *elements[static num],
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "text",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    NULL,
+                                    0,
+                                    array_of_string,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_abs_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Absolute *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Absolute),
+                                    array_of_abs_time,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_abs_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Absolute *elements[],
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Absolute),
+                                    array_of_abs_time,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_rel_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Relative *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Relative),
+                                    array_of_abs_time,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_rel_time (
+  unsigned int num,
+  const struct GNUNET_TIME_Relative *elements[],
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Relative),
+                                    array_of_abs_time,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_timestamp (
+  unsigned int num,
+  const struct GNUNET_TIME_Timestamp *elements,
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    true,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Timestamp),
+                                    array_of_timestamp,
+                                    oid);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_array_ptrs_timestamp (
+  unsigned int num,
+  const struct GNUNET_TIME_Timestamp *elements[],
+  struct GNUNET_PQ_Context *db)
+{
+  Oid oid;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &oid));
+  return query_param_array_generic (num,
+                                    false,
+                                    elements,
+                                    NULL,
+                                    sizeof(struct GNUNET_TIME_Timestamp),
+                                    array_of_timestamp,
+                                    oid);
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_blind_sign_pub (void *cls,
+                      const void *data,
+                      size_t data_len,
+                      void *param_values[],
+                      int param_lengths[],
+                      int param_formats[],
+                      unsigned int param_length,
+                      void *scratch[],
+                      unsigned int scratch_length)
+{
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *public_key = data;
+  size_t tlen;
+  size_t len;
+  uint32_t be;
+  char *buf;
+  void *tbuf;
+
+  (void) cls;
+  (void) data_len;
+  GNUNET_assert (1 == param_length);
+  GNUNET_assert (scratch_length > 0);
+  GNUNET_break (NULL == cls);
+  be = htonl ((uint32_t) public_key->cipher);
+  switch (public_key->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_RSA:
+    tlen = GNUNET_CRYPTO_rsa_public_key_encode (
+      public_key->details.rsa_public_key,
+      &tbuf);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    tlen = sizeof (public_key->details.cs_public_key);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  len = tlen + sizeof (be);
+  buf = GNUNET_malloc (len);
+  GNUNET_memcpy (buf,
+                 &be,
+                 sizeof (be));
+  switch (public_key->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_RSA:
+    GNUNET_memcpy (&buf[sizeof (be)],
+                   tbuf,
+                   tlen);
+    GNUNET_free (tbuf);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    GNUNET_memcpy (&buf[sizeof (be)],
+                   &public_key->details.cs_public_key,
+                   tlen);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+
+  scratch[0] = buf;
+  param_values[0] = (void *) buf;
+  param_lengths[0] = len;
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+/**
+ * Generate query parameter for a blind sign public key of variable size.
+ *
+ * @param pub pointer to the query parameter to pass
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_blind_sign_pub (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *pub)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_blind_sign_pub,
+    .data = pub,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param[out] param_values SQL data to set
+ * @param[out] param_lengths SQL length data to set
+ * @param[out] param_formats SQL format data to set
+ * @param param_length number of entries available in the @a param_values, @a param_lengths and @a param_formats arrays
+ * @param[out] scratch buffer for dynamic allocations (to be done via #GNUNET_malloc()
+ * @param scratch_length number of entries left in @a scratch
+ * @return -1 on error, number of offsets used in @a scratch otherwise
+ */
+static int
+qconv_blind_sign_priv (void *cls,
+                       const void *data,
+                       size_t data_len,
+                       void *param_values[],
+                       int param_lengths[],
+                       int param_formats[],
+                       unsigned int param_length,
+                       void *scratch[],
+                       unsigned int scratch_length)
+{
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *private_key = data;
+  size_t tlen;
+  size_t len;
+  uint32_t be;
+  char *buf;
+  void *tbuf;
+
+  (void) cls;
+  (void) data_len;
+  GNUNET_assert (1 == param_length);
+  GNUNET_assert (scratch_length > 0);
+  GNUNET_break (NULL == cls);
+  be = htonl ((uint32_t) private_key->cipher);
+  switch (private_key->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_RSA:
+    tlen = GNUNET_CRYPTO_rsa_private_key_encode (
+      private_key->details.rsa_private_key,
+      &tbuf);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    tlen = sizeof (private_key->details.cs_private_key);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+  len = tlen + sizeof (be);
+  buf = GNUNET_malloc (len);
+  GNUNET_memcpy (buf,
+                 &be,
+                 sizeof (be));
+  switch (private_key->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_RSA:
+    GNUNET_memcpy (&buf[sizeof (be)],
+                   tbuf,
+                   tlen);
+    GNUNET_free (tbuf);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    GNUNET_memcpy (&buf[sizeof (be)],
+                   &private_key->details.cs_private_key,
+                   tlen);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
+
+  scratch[0] = buf;
+  param_values[0] = (void *) buf;
+  param_lengths[0] = len;
+  param_formats[0] = 1;
+  return 1;
+}
+
+
+/**
+ * Generate query parameter for a blind sign private key of variable size.
+ *
+ * @param priv pointer to the query parameter to pass
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_blind_sign_priv (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *priv)
+{
+  struct GNUNET_PQ_QueryParam res = {
+    .conv = &qconv_blind_sign_priv,
+    .data = priv,
+    .num_params = 1
+  };
+
+  return res;
+}
+
+
+/* end of pq_query_helper.c */
diff --git a/src/lib/pq/pq_result_helper.c b/src/lib/pq/pq_result_helper.c
new file mode 100644
index 000000000..cbb1e8e8e
--- /dev/null
+++ b/src/lib/pq/pq_result_helper.c
@@ -0,0 +1,2067 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014-2024 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/pq_result_helper.c
+ * @brief functions to extract result values
+ * @author Christian Grothoff
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include "gnunet_time_lib.h"
+#include "gnunet_common.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_pq_lib.h"
+#include "pq.h"
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_allow_null (struct GNUNET_PQ_ResultSpec rs,
+                                  bool *is_null)
+{
+  struct GNUNET_PQ_ResultSpec rsr;
+
+  rsr = rs;
+  rsr.is_nullable = true;
+  rsr.is_null = is_null;
+  return rsr;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_varsize_blob (void *cls,
+                    void *rd)
+{
+  void **dst = rd;
+
+  (void) cls;
+  if (NULL != *dst)
+  {
+    GNUNET_free (*dst);
+    *dst = NULL;
+  }
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field)
+ */
+static enum GNUNET_GenericReturnValue
+extract_varsize_blob (void *cls,
+                      PGresult *result,
+                      int row,
+                      const char *fname,
+                      size_t *dst_size,
+                      void *dst)
+{
+  size_t len;
+  const char *res;
+  void *idst;
+  int fnum;
+
+  (void) cls;
+  *dst_size = 0;
+  *((void **) dst) = NULL;
+
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  GNUNET_assert (NULL != res);
+  *dst_size = len;
+  idst = GNUNET_malloc (len);
+  *((void **) dst) = idst;
+  GNUNET_memcpy (idst,
+                 res,
+                 len);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_variable_size (const char *name,
+                                     void **dst,
+                                     size_t *sptr)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_varsize_blob,
+    .cleaner = &clean_varsize_blob,
+    .dst = (void *) (dst),
+    .fname = name,
+    .result_size = sptr
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in] dst_size desired size, never NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_fixed_blob (void *cls,
+                    PGresult *result,
+                    int row,
+                    const char *fname,
+                    size_t *dst_size,
+                    void *dst)
+{
+  size_t len;
+  const char *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Result does not have field %s\n",
+                fname);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  if (*dst_size != len)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected %u bytes for field `%s', got %u\n",
+                (unsigned int) *dst_size,
+                fname,
+                (unsigned int) len);
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  GNUNET_assert (NULL != res);
+  GNUNET_memcpy (dst,
+                 res,
+                 len);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_fixed_size (const char *name,
+                                  void *dst,
+                                  size_t dst_size)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_fixed_blob,
+    .dst = (dst),
+    .dst_size = dst_size,
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_rsa_public_key (void *cls,
+                        PGresult *result,
+                        int row,
+                        const char *fname,
+                        size_t *dst_size,
+                        void *dst)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = dst;
+  size_t len;
+  const char *res;
+  int fnum;
+
+  (void) cls;
+  *pk = NULL;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  *pk = GNUNET_CRYPTO_rsa_public_key_decode (res,
+                                             len);
+  if (NULL == *pk)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_rsa_public_key (void *cls,
+                      void *rd)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = rd;
+
+  (void) cls;
+  if (NULL != *pk)
+  {
+    GNUNET_CRYPTO_rsa_public_key_free (*pk);
+    *pk = NULL;
+  }
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_rsa_public_key (const char *name,
+                                      struct GNUNET_CRYPTO_RsaPublicKey **rsa)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_rsa_public_key,
+    .cleaner = &clean_rsa_public_key,
+    .dst = (void *) rsa,
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_rsa_signature (void *cls,
+                       PGresult *result,
+                       int row,
+                       const char *fname,
+                       size_t *dst_size,
+                       void *dst)
+{
+  struct GNUNET_CRYPTO_RsaSignature **sig = dst;
+  size_t len;
+  const void *res;
+  int fnum;
+
+  (void) cls;
+  *sig = NULL;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  *sig = GNUNET_CRYPTO_rsa_signature_decode (res,
+                                             len);
+  if (NULL == *sig)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_rsa_signature (void *cls,
+                     void *rd)
+{
+  struct GNUNET_CRYPTO_RsaSignature **sig = rd;
+
+  (void) cls;
+  if (NULL != *sig)
+  {
+    GNUNET_CRYPTO_rsa_signature_free (*sig);
+    *sig = NULL;
+  }
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_rsa_signature (const char *name,
+                                     struct GNUNET_CRYPTO_RsaSignature **sig)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_rsa_signature,
+    .cleaner = &clean_rsa_signature,
+    .dst = (void *) sig,
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_string (void *cls,
+                PGresult *result,
+                int row,
+                const char *fname,
+                size_t *dst_size,
+                void *dst)
+{
+  char **str = dst;
+  size_t len;
+  const char *res;
+  int fnum;
+
+  (void) cls;
+  *str = NULL;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  *str = GNUNET_strndup (res,
+                         len);
+  if (NULL == *str)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_string (void *cls,
+              void *rd)
+{
+  char **str = rd;
+
+  (void) cls;
+  if (NULL != *str)
+  {
+    GNUNET_free (*str);
+    *str = NULL;
+  }
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_string (const char *name,
+                              char **dst)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_string,
+    .cleaner = &clean_string,
+    .dst = (void *) dst,
+    .fname = (name)
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_bool (void *cls,
+              PGresult *result,
+              int row,
+              const char *fname,
+              size_t *dst_size,
+              void *dst)
+{
+  bool *b = dst;
+  const uint8_t *res;
+  int fnum;
+  size_t len;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  if (sizeof (uint8_t) != len)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (const uint8_t *) PQgetvalue (result,
+                                      row,
+                                      fnum);
+  *b = (0 != *res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_bool (const char *name,
+                            bool *dst)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_bool,
+    .dst = (void *) dst,
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_rel_time (void *cls,
+                  PGresult *result,
+                  int row,
+                  const char *fname,
+                  size_t *dst_size,
+                  void *dst)
+{
+  struct GNUNET_TIME_Relative *udst = dst;
+  const int64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(struct GNUNET_TIME_Relative) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(int64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (int64_t *) PQgetvalue (result,
+                                row,
+                                fnum);
+  if (INT64_MAX == GNUNET_ntohll ((uint64_t) *res))
+    *udst = GNUNET_TIME_UNIT_FOREVER_REL;
+  else
+    udst->rel_value_us = GNUNET_ntohll ((uint64_t) *res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_relative_time (const char *name,
+                                     struct GNUNET_TIME_Relative *rt)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_rel_time,
+    .dst = (void *) rt,
+    .dst_size = sizeof(*rt),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_abs_time (void *cls,
+                  PGresult *result,
+                  int row,
+                  const char *fname,
+                  size_t *dst_size,
+                  void *dst)
+{
+  struct GNUNET_TIME_Absolute *udst = dst;
+  const int64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(struct GNUNET_TIME_Absolute) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(int64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (int64_t *) PQgetvalue (result,
+                                row,
+                                fnum);
+  if (INT64_MAX == GNUNET_ntohll ((uint64_t) *res))
+    *udst = GNUNET_TIME_UNIT_FOREVER_ABS;
+  else
+    udst->abs_value_us = GNUNET_ntohll ((uint64_t) *res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_absolute_time (const char *name,
+                                     struct GNUNET_TIME_Absolute *at)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_abs_time,
+    .dst = (void *) at,
+    .dst_size = sizeof(*at),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_absolute_time_nbo (const char *name,
+                                         struct GNUNET_TIME_AbsoluteNBO *at)
+{
+  struct GNUNET_PQ_ResultSpec res =
+    GNUNET_PQ_result_spec_auto_from_type (name,
+                                          &at->abs_value_us__);
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_timestamp (void *cls,
+                   PGresult *result,
+                   int row,
+                   const char *fname,
+                   size_t *dst_size,
+                   void *dst)
+{
+  struct GNUNET_TIME_Timestamp *udst = dst;
+  struct GNUNET_TIME_Absolute abs;
+  const int64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(struct GNUNET_TIME_Absolute) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(int64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (int64_t *) PQgetvalue (result,
+                                row,
+                                fnum);
+  if (INT64_MAX == GNUNET_ntohll ((uint64_t) *res))
+  {
+    abs = GNUNET_TIME_UNIT_FOREVER_ABS;
+  }
+  else
+  {
+    abs.abs_value_us = GNUNET_ntohll ((uint64_t) *res);
+    if (0 != abs.abs_value_us % GNUNET_TIME_UNIT_SECONDS.rel_value_us)
+    {
+      /* timestamps must be multiple of seconds! */
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+  }
+  udst->abs_time = abs;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp (const char *name,
+                                 struct GNUNET_TIME_Timestamp *at)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_timestamp,
+    .dst = (void *) at,
+    .dst_size = sizeof(*at),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_timestamp_nbo (void *cls,
+                       PGresult *result,
+                       int row,
+                       const char *fname,
+                       size_t *dst_size,
+                       void *dst)
+{
+  struct GNUNET_TIME_TimestampNBO *udst = dst;
+  struct GNUNET_TIME_Timestamp t;
+  enum GNUNET_GenericReturnValue r;
+
+  r = extract_timestamp (NULL,
+                         result,
+                         row,
+                         fname,
+                         dst_size,
+                         &t);
+  if (GNUNET_OK != r)
+    return r;
+  *udst = GNUNET_TIME_timestamp_hton (t);
+  return r;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp_nbo (const char *name,
+                                     struct GNUNET_TIME_TimestampNBO *at)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_timestamp_nbo,
+    .dst = (void *) at,
+    .dst_size = sizeof(*at),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_uint16 (void *cls,
+                PGresult *result,
+                int row,
+                const char *fname,
+                size_t *dst_size,
+                void *dst)
+{
+  uint16_t *udst = dst;
+  const uint16_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(uint16_t) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(uint16_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (uint16_t *) PQgetvalue (result,
+                                 row,
+                                 fnum);
+  *udst = ntohs (*res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_uint16 (const char *name,
+                              uint16_t *u16)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_uint16,
+    .dst = (void *) u16,
+    .dst_size = sizeof(*u16),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_uint32 (void *cls,
+                PGresult *result,
+                int row,
+                const char *fname,
+                size_t *dst_size,
+                void *dst)
+{
+  uint32_t *udst = dst;
+  const uint32_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(uint32_t) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(uint32_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (uint32_t *) PQgetvalue (result,
+                                 row,
+                                 fnum);
+  *udst = ntohl (*res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_uint32 (const char *name,
+                              uint32_t *u32)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_uint32,
+    .dst = (void *) u32,
+    .dst_size = sizeof(*u32),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_uint64 (void *cls,
+                PGresult *result,
+                int row,
+                const char *fname,
+                size_t *dst_size,
+                void *dst)
+{
+  uint64_t *udst = dst;
+  const uint64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Field %s missing in result\n",
+                fname);
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+
+  GNUNET_assert (NULL != dst);
+  if (sizeof(uint64_t) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(uint64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Got length %u for field `%s'\n",
+                PQgetlength (result,
+                             row,
+                             fnum),
+                fname);
+    return GNUNET_SYSERR;
+  }
+  res = (uint64_t *) PQgetvalue (result,
+                                 row,
+                                 fnum);
+  *udst = GNUNET_ntohll (*res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_uint64 (const char *name,
+                              uint64_t *u64)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_uint64,
+    .dst = (void *) u64,
+    .dst_size = sizeof(*u64),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_int64 (void *cls,
+               PGresult *result,
+               int row,
+               const char *fname,
+               size_t *dst_size,
+               void *dst)
+{
+  int64_t *udst = dst;
+  const int64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Field %s missing in result\n",
+                fname);
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+
+  GNUNET_assert (NULL != dst);
+  if (sizeof(int64_t) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(int64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Got length %u for field `%s'\n",
+                PQgetlength (result,
+                             row,
+                             fnum),
+                fname);
+    return GNUNET_SYSERR;
+  }
+  res = (int64_t *) PQgetvalue (result,
+                                row,
+                                fnum);
+  *udst = GNUNET_ntohll (*res);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_int64 (const char *name,
+                             int64_t *i64)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_int64,
+    .dst = (void *) i64,
+    .dst_size = sizeof(*i64),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Closure for the array result specifications.  Contains type information
+ * for the generic parser extract_array_generic and out-pointers for the results.
+ */
+struct array_result_cls
+{
+  /* Oid of the expected type, must match the oid in the header of the PQResult struct */
+  Oid oid;
+
+  /* Target type */
+  enum array_types typ;
+
+  /* If not 0, defines the expected size of each entry */
+  size_t same_size;
+
+  /* Out-pointer to write the number of elements in the array */
+  size_t *num;
+
+  /* Out-pointer. If @a typ is array_of_byte and @a same_size is 0,
+   * allocate and put the array of @a num sizes here. NULL otherwise */
+  size_t **sizes;
+};
+
+
+/**
+ * Extract data from a Postgres database @a result as array of a specific type
+ * from row @a row.  The type information and optionally additional
+ * out-parameters are given in @a cls which is of type array_result_cls.
+ *
+ * @param cls closure of type array_result_cls
+ * @param result where to extract data from
+ * @param row row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_array_generic (
+  void *cls,
+  PGresult *result,
+  int row,
+  const char *fname,
+  size_t *dst_size,
+  void *dst)
+{
+  const struct array_result_cls *info = cls;
+  int data_sz;
+  char *data;
+  void *out = NULL;
+  struct pq_array_header header;
+  int col_num;
+
+  GNUNET_assert (NULL != dst);
+  *((void **) dst) = NULL;
+
+  #define FAIL_IF(cond) \
+  do { \
+    if ((cond)) \
+    { \
+      GNUNET_break (! (cond)); \
+      goto FAIL; \
+    } \
+  } while (0)
+
+  col_num = PQfnumber (result, fname);
+  FAIL_IF (0 > col_num);
+
+  data_sz = PQgetlength (result, row, col_num);
+  FAIL_IF (0 > data_sz);
+  FAIL_IF (sizeof(header) > (size_t) data_sz);
+
+  data = PQgetvalue (result, row, col_num);
+  FAIL_IF (NULL == data);
+
+  {
+    struct pq_array_header *h =
+      (struct pq_array_header *) data;
+
+    header.ndim = ntohl (h->ndim);
+    header.has_null = ntohl (h->has_null);
+    header.oid = ntohl (h->oid);
+    header.dim = ntohl (h->dim);
+    header.lbound = ntohl (h->lbound);
+
+    FAIL_IF (1 != header.ndim);
+    FAIL_IF (INT_MAX <= header.dim);
+    FAIL_IF (0 != header.has_null);
+    FAIL_IF (1 != header.lbound);
+    FAIL_IF (info->oid != header.oid);
+  }
+
+  if (NULL != info->num)
+    *info->num = header.dim;
+
+  {
+    char *in = data + sizeof(header);
+
+    switch (info->typ)
+    {
+    case array_of_bool:
+      if (NULL != dst_size)
+        *dst_size = sizeof(bool) * (header.dim);
+      out = GNUNET_new_array (header.dim, bool);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(bool));
+        in += sizeof(uint32_t);
+        *(bool *) out = *(bool *) in;
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_uint16:
+      if (NULL != dst_size)
+        *dst_size = sizeof(uint16_t) * (header.dim);
+      out = GNUNET_new_array (header.dim, uint16_t);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint16_t));
+        in += sizeof(uint32_t);
+        *(uint16_t *) out = ntohs (*(uint16_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_uint32:
+      if (NULL != dst_size)
+        *dst_size = sizeof(uint32_t) * (header.dim);
+      out = GNUNET_new_array (header.dim, uint32_t);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint32_t));
+        in += sizeof(uint32_t);
+        *(uint32_t *) out = ntohl (*(uint32_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_uint64:
+      if (NULL != dst_size)
+        *dst_size = sizeof(uint64_t) * (header.dim);
+      out = GNUNET_new_array (header.dim, uint64_t);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint64_t));
+        in += sizeof(uint32_t);
+        *(uint64_t *) out = GNUNET_ntohll (*(uint64_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_abs_time:
+      if (NULL != dst_size)
+        *dst_size = sizeof(struct GNUNET_TIME_Absolute) * (header.dim);
+      out = GNUNET_new_array (header.dim, struct GNUNET_TIME_Absolute);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint64_t));
+        in += sizeof(uint32_t);
+        ((struct GNUNET_TIME_Absolute *) out)->abs_value_us =
+          GNUNET_ntohll (*(uint64_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_rel_time:
+      if (NULL != dst_size)
+        *dst_size = sizeof(struct GNUNET_TIME_Relative) * (header.dim);
+      out = GNUNET_new_array (header.dim, struct GNUNET_TIME_Relative);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint64_t));
+        in += sizeof(uint32_t);
+        ((struct GNUNET_TIME_Relative *) out)->rel_value_us =
+          GNUNET_ntohll (*(uint64_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_timestamp:
+      if (NULL != dst_size)
+        *dst_size = sizeof(struct GNUNET_TIME_Timestamp) * (header.dim);
+      out = GNUNET_new_array (header.dim, struct GNUNET_TIME_Timestamp);
+      *((void **) dst) = out;
+      for (uint32_t i = 0; i < header.dim; i++)
+      {
+        size_t sz =  ntohl (*(uint32_t *) in);
+        FAIL_IF (sz != sizeof(uint64_t));
+        in += sizeof(uint32_t);
+        ((struct GNUNET_TIME_Timestamp *) out)->abs_time.abs_value_us =
+          GNUNET_ntohll (*(uint64_t *) in);
+        in += sz;
+        out += sz;
+      }
+      break;
+
+    case array_of_byte:
+      if (0 == info->same_size)
+        *info->sizes = GNUNET_new_array (header.dim, size_t);
+    /* fallthrough */
+    case array_of_string:
+      {
+        size_t total = 0;
+        bool is_string = (array_of_string == info->typ);
+
+        /* first, calculate total size required for allocation */
+        {
+          char *ptr = data + sizeof(header);
+          for (uint32_t i = 0; i < header.dim; i++)
+          {
+            uint32_t sz;
+
+            sz = ntohl (*(uint32_t *) ptr);
+            sz += is_string ? 1 : 0;
+            total += sz;
+            ptr += sizeof(uint32_t);
+            ptr += sz;
+
+            if ((! is_string) &&
+                (0 == info->same_size))
+              (*info->sizes)[i] = sz;
+
+            FAIL_IF ((0 != info->same_size) &&
+                     (sz != info->same_size));
+            FAIL_IF (total < sz);
+          }
+        }
+
+        if (NULL != dst_size)
+          *dst_size = total;
+
+        FAIL_IF (0 == total);
+        out = GNUNET_malloc (total);
+
+        *((void **) dst) = out;
+
+        /* copy data */
+        for (uint32_t i = 0; i < header.dim; i++)
+        {
+          size_t sz =  ntohl (*(uint32_t *) in);
+          in += sizeof(uint32_t);
+          GNUNET_memcpy (out, in, sz);
+
+          in += sz;
+          out += sz;
+          out += (array_of_string == info->typ) ? 1 : 0;
+        }
+        break;
+      }
+    default:
+      FAIL_IF (1 != 0);
+    }
+  }
+
+  return GNUNET_OK;
+
+FAIL:
+  GNUNET_free (*(void **) dst);
+  return GNUNET_SYSERR;
+  #undef FAIL_IF
+}
+
+
+/**
+ * Cleanup of the data and closure of an array spec.
+ */
+static void
+array_cleanup (void *cls,
+               void *rd)
+{
+
+  struct array_result_cls *info = cls;
+  void **dst = rd;
+
+  if ((array_of_byte == info->typ) &&
+      (0 == info->same_size) &&
+      (NULL != info->sizes))
+    GNUNET_free (*(info->sizes));
+
+  GNUNET_free (cls);
+  GNUNET_free (*dst);
+  *dst = NULL;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_bool (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  bool **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_bool;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bool",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint16 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint16_t **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_uint16;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int2",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint32 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint32_t **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_uint32;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int4",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_uint64 (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  uint64_t **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_uint64;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_abs_time (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Absolute **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_abs_time;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_rel_time (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Relative **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_rel_time;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_timestamp (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  struct GNUNET_TIME_Timestamp **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_timestamp;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "int8",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_variable_size (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  size_t **sizes,
+  void **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->sizes = sizes;
+  info->typ = array_of_byte;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_fixed_size (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t size,
+  size_t *num,
+  void **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->same_size = size;
+  info->typ = array_of_byte;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "bytea",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_array_string (
+  struct GNUNET_PQ_Context *db,
+  const char *name,
+  size_t *num,
+  char **dst)
+{
+  struct array_result_cls *info =
+    GNUNET_new (struct array_result_cls);
+
+  info->num = num;
+  info->typ = array_of_string;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PQ_get_oid_by_name (db,
+                                            "text",
+                                            &info->oid));
+
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = extract_array_generic,
+    .cleaner = array_cleanup,
+    .dst = (void *) dst,
+    .fname = name,
+    .cls = info
+  };
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row the row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_blind_sign_pub (void *cls,
+                        PGresult *result,
+                        int row,
+                        const char *fname,
+                        size_t *dst_size,
+                        void *dst)
+{
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bpk = dst;
+  struct GNUNET_CRYPTO_BlindSignPublicKey *tmp;
+  size_t len;
+  const char *res;
+  int fnum;
+  uint32_t be;
+
+  (void) cls;
+  (void) dst_size;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  if (len < sizeof (be))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&be,
+                 res,
+                 sizeof (be));
+  res += sizeof (be);
+  len -= sizeof (be);
+  tmp = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPublicKey);
+  tmp->cipher = ntohl (be);
+  tmp->rc = 1;
+  switch (tmp->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    tmp->details.rsa_public_key
+      = GNUNET_CRYPTO_rsa_public_key_decode (res,
+                                             len);
+    if (NULL == tmp->details.rsa_public_key)
+    {
+      GNUNET_break (0);
+      GNUNET_free (tmp);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_CRYPTO_hash (res,
+                        len,
+                        &tmp->pub_key_hash);
+    *bpk = tmp;
+    return GNUNET_OK;
+  case GNUNET_CRYPTO_BSA_CS:
+    if (sizeof (tmp->details.cs_public_key) != len)
+    {
+      GNUNET_break (0);
+      GNUNET_free (tmp);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_memcpy (&tmp->details.cs_public_key,
+                   res,
+                   len);
+    GNUNET_CRYPTO_hash (res,
+                        len,
+                        &tmp->pub_key_hash);
+    *bpk = tmp;
+    return GNUNET_OK;
+  }
+  GNUNET_break (0);
+  GNUNET_free (tmp);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_blind_sign_pub (void *cls,
+                      void *rd)
+{
+  struct GNUNET_CRYPTO_BlindSignPublicKey **pub = rd;
+
+  (void) cls;
+  GNUNET_CRYPTO_blind_sign_pub_decref (*pub);
+  *pub = NULL;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_blind_sign_pub (const char *name,
+                                      struct GNUNET_CRYPTO_BlindSignPublicKey **pub)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_blind_sign_pub,
+    .cleaner = &clean_blind_sign_pub,
+    .dst = (void *) pub,
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param row the row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_blind_sign_priv (void *cls,
+                         PGresult *result,
+                         int row,
+                         const char *fname,
+                         size_t *dst_size,
+                         void *dst)
+{
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bpk = dst;
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *tmp;
+  size_t len;
+  const char *res;
+  int fnum;
+  uint32_t be;
+
+  (void) cls;
+  (void) dst_size;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+
+  /* if a field is null, continue but
+   * remember that we now return a different result */
+  len = PQgetlength (result,
+                     row,
+                     fnum);
+  res = PQgetvalue (result,
+                    row,
+                    fnum);
+  if (len < sizeof (be))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&be,
+                 res,
+                 sizeof (be));
+  res += sizeof (be);
+  len -= sizeof (be);
+  tmp = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPrivateKey);
+  tmp->cipher = ntohl (be);
+  tmp->rc = 1;
+  switch (tmp->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    tmp->details.rsa_private_key
+      = GNUNET_CRYPTO_rsa_private_key_decode (res,
+                                              len);
+    if (NULL == tmp->details.rsa_private_key)
+    {
+      GNUNET_break (0);
+      GNUNET_free (bpk);
+      return GNUNET_SYSERR;
+    }
+    *bpk = tmp;
+    return GNUNET_OK;
+  case GNUNET_CRYPTO_BSA_CS:
+    if (sizeof (tmp->details.cs_private_key) != len)
+    {
+      GNUNET_break (0);
+      GNUNET_free (tmp);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_memcpy (&tmp->details.cs_private_key,
+                   res,
+                   len);
+    *bpk = tmp;
+    return GNUNET_OK;
+  }
+  GNUNET_break (0);
+  GNUNET_free (tmp);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ * @param rd result data to clean up
+ */
+static void
+clean_blind_sign_priv (void *cls,
+                      void *rd)
+{
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **priv = rd;
+
+  (void) cls;
+  GNUNET_CRYPTO_blind_sign_priv_decref (*priv);
+  *priv = NULL;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_blind_sign_priv (const char *name,
+                                       struct GNUNET_CRYPTO_BlindSignPrivateKey **priv)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_blind_sign_priv,
+    .cleaner = &clean_blind_sign_priv,
+    .dst = (void *) priv,
+    .fname = name
+  };
+
+  return res;
+}
+
+/* end of pq_result_helper.c */
diff --git a/src/lib/pq/test_pq.c b/src/lib/pq/test_pq.c
new file mode 100644
index 000000000..813c4a019
--- /dev/null
+++ b/src/lib/pq/test_pq.c
@@ -0,0 +1,630 @@
+/*
+   This file is part of GNUnet
+   (C) 2015, 2016, 2019, 2020 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file pq/test_pq.c
+ * @brief Tests for Postgres convenience API
+ * @author Christian Grothoff <christian@grothoff.org>
+ */
+#include "platform.h"
+#include "gnunet_common.h"
+#include "gnunet_pq_lib.h"
+#include "gnunet_time_lib.h"
+#include "pq.h"
+
+/**
+ * Database handle.
+ */
+static struct GNUNET_PQ_Context *db;
+
+/**
+ * Global return value, 0 on success.
+ */
+static int ret;
+
+/**
+ * An event handler.
+ */
+static struct GNUNET_DB_EventHandler *eh;
+
+/**
+ * Timeout task.
+ */
+static struct GNUNET_SCHEDULER_Task *tt;
+
+
+/**
+ * Setup prepared statements.
+ *
+ * @param db database handle to initialize
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+postgres_prepare (struct GNUNET_PQ_Context *db)
+{
+  struct GNUNET_PQ_PreparedStatement ps[] = {
+    GNUNET_PQ_make_prepare ("test_insert",
+                            "INSERT INTO test_pq ("
+                            " pub"
+                            ",sig"
+                            ",abs_time"
+                            ",forever"
+                            ",hash"
+                            ",vsize"
+                            ",u16"
+                            ",u32"
+                            ",u64"
+                            ",unn"
+                            ",arr_bool"
+                            ",arr_int2"
+                            ",arr_int4"
+                            ",arr_int8"
+                            ",arr_bytea"
+                            ",arr_text"
+                            ",arr_abs_time"
+                            ",arr_rel_time"
+                            ",arr_timestamp"
+                            ") VALUES "
+                            "($1, $2, $3, $4, $5, $6,"
+                            "$7, $8, $9, $10,"
+                            "$11, $12, $13, $14, $15, $16,"
+                            "$17, $18, $19);"),
+    GNUNET_PQ_make_prepare ("test_select",
+                            "SELECT"
+                            " pub"
+                            ",sig"
+                            ",abs_time"
+                            ",forever"
+                            ",hash"
+                            ",vsize"
+                            ",u16"
+                            ",u32"
+                            ",u64"
+                            ",unn"
+                            ",arr_bool"
+                            ",arr_int2"
+                            ",arr_int4"
+                            ",arr_int8"
+                            ",arr_bytea"
+                            ",arr_text"
+                            ",arr_abs_time"
+                            ",arr_rel_time"
+                            ",arr_timestamp"
+                            " FROM test_pq"
+                            " ORDER BY abs_time DESC "
+                            " LIMIT 1;"),
+    GNUNET_PQ_PREPARED_STATEMENT_END
+  };
+
+  return GNUNET_PQ_prepare_statements (db,
+                                       ps);
+}
+
+
+/**
+ * Run actual test queries.
+ *
+ * @param db database handle
+ * @return 0 on success
+ */
+static int
+run_queries (struct GNUNET_PQ_Context *db)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *pub;
+  struct GNUNET_CRYPTO_RsaPublicKey *pub2 = NULL;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  struct GNUNET_CRYPTO_RsaSignature *sig2 = NULL;
+  struct GNUNET_TIME_Absolute abs_time = GNUNET_TIME_absolute_get ();
+  struct GNUNET_TIME_Absolute abs_time2;
+  struct GNUNET_TIME_Absolute forever = GNUNET_TIME_UNIT_FOREVER_ABS;
+  struct GNUNET_TIME_Absolute forever2;
+  struct GNUNET_HashCode hc;
+  struct GNUNET_HashCode hc2;
+  PGresult *result;
+  int ret;
+  struct GNUNET_CRYPTO_RsaPrivateKey *priv;
+  const char msg[] = "hello";
+  void *msg2;
+  struct GNUNET_HashCode hmsg;
+  size_t msg2_len;
+  uint16_t u16;
+  uint16_t u162;
+  uint32_t u32;
+  uint32_t u322;
+  uint64_t u64;
+  uint64_t u642;
+  uint64_t uzzz = 42;
+  struct GNUNET_HashCode ahc[3] = {};
+  bool ab[5] = {true, false, false, true, false};
+  uint16_t ai2[3] = {42, 0x0001, 0xFFFF};
+  uint32_t ai4[3] = {42, 0x00010000, 0xFFFFFFFF};
+  uint64_t ai8[3] = {42, 0x0001000000000000, 0xFFFFFFFFFFFFFFFF};
+  const char *as[] = {"foo", "bar", "buzz"};
+  const struct GNUNET_TIME_Absolute ata[2] = {GNUNET_TIME_absolute_get (),
+                                              GNUNET_TIME_absolute_get ()};
+  const struct GNUNET_TIME_Relative atr[2] = {GNUNET_TIME_relative_get_hour_ (),
+                                              GNUNET_TIME_relative_get_minute_ ()};
+  const struct GNUNET_TIME_Timestamp ats[2] = {GNUNET_TIME_timestamp_get (),
+                                               GNUNET_TIME_timestamp_get ()};
+
+
+  priv = GNUNET_CRYPTO_rsa_private_key_create (1024);
+  pub = GNUNET_CRYPTO_rsa_private_key_get_public (priv);
+  memset (&hmsg, 42, sizeof(hmsg));
+  sig = GNUNET_CRYPTO_rsa_sign_fdh (priv,
+                                    &hmsg,
+                                    sizeof (hmsg));
+  u16 = 16;
+  u32 = 32;
+  u64 = 64;
+  for (int i = 0; i < 3; i++)
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                                &ahc[i],
+                                sizeof(ahc[i]));
+
+  /* FIXME: test GNUNET_PQ_result_spec_variable_size */
+  {
+    struct GNUNET_PQ_QueryParam params_insert[] = {
+      GNUNET_PQ_query_param_rsa_public_key (pub),
+      GNUNET_PQ_query_param_rsa_signature (sig),
+      GNUNET_PQ_query_param_absolute_time (&abs_time),
+      GNUNET_PQ_query_param_absolute_time (&forever),
+      GNUNET_PQ_query_param_auto_from_type (&hc),
+      GNUNET_PQ_query_param_string (msg),
+      GNUNET_PQ_query_param_uint16 (&u16),
+      GNUNET_PQ_query_param_uint32 (&u32),
+      GNUNET_PQ_query_param_uint64 (&u64),
+      GNUNET_PQ_query_param_null (),
+      GNUNET_PQ_query_param_array_bool (5, ab, db),
+      GNUNET_PQ_query_param_array_uint16 (3, ai2, db),
+      GNUNET_PQ_query_param_array_uint32 (3, ai4, db),
+      GNUNET_PQ_query_param_array_uint64 (3, ai8, db),
+      GNUNET_PQ_query_param_array_bytes_same_size (3,
+                                                   ahc,
+                                                   sizeof(ahc[0]),
+                                                   db),
+      GNUNET_PQ_query_param_array_ptrs_string (3, as, db),
+      GNUNET_PQ_query_param_array_abs_time (2, ata, db),
+      GNUNET_PQ_query_param_array_rel_time (2, atr, db),
+      GNUNET_PQ_query_param_array_timestamp (2, ats, db),
+      GNUNET_PQ_query_param_end
+    };
+    struct GNUNET_PQ_QueryParam params_select[] = {
+      GNUNET_PQ_query_param_end
+    };
+    bool got_null = false;
+    size_t num_bool;
+    bool *arr_bools;
+    size_t num_u16;
+    uint16_t *arr_u16;
+    size_t num_u32;
+    uint32_t *arr_u32;
+    size_t num_u64;
+    uint64_t *arr_u64;
+    size_t num_abs;
+    struct GNUNET_TIME_Absolute *arr_abs;
+    size_t num_rel;
+    struct GNUNET_TIME_Relative *arr_rel;
+    size_t num_tstmp;
+    struct GNUNET_TIME_Timestamp *arr_tstmp;
+    size_t num_str;
+    char *arr_str;
+    size_t num_hash;
+    struct GNUNET_HashCode *arr_hash;
+    size_t num_buf;
+    void *arr_buf;
+    size_t *sz_buf;
+    struct GNUNET_PQ_ResultSpec results_select[] = {
+      GNUNET_PQ_result_spec_rsa_public_key ("pub", &pub2),
+      GNUNET_PQ_result_spec_rsa_signature ("sig", &sig2),
+      GNUNET_PQ_result_spec_absolute_time ("abs_time", &abs_time2),
+      GNUNET_PQ_result_spec_absolute_time ("forever", &forever2),
+      GNUNET_PQ_result_spec_auto_from_type ("hash", &hc2),
+      GNUNET_PQ_result_spec_variable_size ("vsize", &msg2, &msg2_len),
+      GNUNET_PQ_result_spec_uint16 ("u16", &u162),
+      GNUNET_PQ_result_spec_uint32 ("u32", &u322),
+      GNUNET_PQ_result_spec_uint64 ("u64", &u642),
+      GNUNET_PQ_result_spec_allow_null (
+        GNUNET_PQ_result_spec_uint64 ("unn", &uzzz),
+        &got_null),
+      GNUNET_PQ_result_spec_array_bool (db,
+                                        "arr_bool",
+                                        &num_bool,
+                                        &arr_bools),
+      GNUNET_PQ_result_spec_array_uint16 (db,
+                                          "arr_int2",
+                                          &num_u16,
+                                          &arr_u16),
+      GNUNET_PQ_result_spec_array_uint32 (db,
+                                          "arr_int4",
+                                          &num_u32,
+                                          &arr_u32),
+      GNUNET_PQ_result_spec_array_uint64 (db,
+                                          "arr_int8",
+                                          &num_u64,
+                                          &arr_u64),
+      GNUNET_PQ_result_spec_array_abs_time (db,
+                                            "arr_abs_time",
+                                            &num_abs,
+                                            &arr_abs),
+      GNUNET_PQ_result_spec_array_rel_time (db,
+                                            "arr_rel_time",
+                                            &num_rel,
+                                            &arr_rel),
+      GNUNET_PQ_result_spec_array_timestamp (db,
+                                             "arr_timestamp",
+                                             &num_tstmp,
+                                             &arr_tstmp),
+      GNUNET_PQ_result_spec_auto_array_from_type (db,
+                                                  "arr_bytea",
+                                                  &num_hash,
+                                                  arr_hash),
+      GNUNET_PQ_result_spec_array_variable_size (db,
+                                                 "arr_bytea",
+                                                 &num_buf,
+                                                 &sz_buf,
+                                                 &arr_buf),
+      GNUNET_PQ_result_spec_array_string (db,
+                                          "arr_text",
+                                          &num_str,
+                                          &arr_str),
+      GNUNET_PQ_result_spec_end
+    };
+
+    result = GNUNET_PQ_exec_prepared (db,
+                                      "test_insert",
+                                      params_insert);
+    if (PGRES_COMMAND_OK != PQresultStatus (result))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Database failure: %s\n",
+                  PQresultErrorMessage (result));
+      PQclear (result);
+      GNUNET_CRYPTO_rsa_signature_free (sig);
+      GNUNET_CRYPTO_rsa_private_key_free (priv);
+      GNUNET_CRYPTO_rsa_public_key_free (pub);
+      return 1;
+    }
+
+    PQclear (result);
+    result = GNUNET_PQ_exec_prepared (db,
+                                      "test_select",
+                                      params_select);
+    if (1 !=
+        PQntuples (result))
+    {
+      GNUNET_break (0);
+      PQclear (result);
+      GNUNET_CRYPTO_rsa_signature_free (sig);
+      GNUNET_CRYPTO_rsa_private_key_free (priv);
+      GNUNET_CRYPTO_rsa_public_key_free (pub);
+      return 1;
+    }
+    ret = GNUNET_PQ_extract_result (result,
+                                    results_select,
+                                    0);
+    GNUNET_break (GNUNET_YES == ret);
+    GNUNET_break (abs_time.abs_value_us == abs_time2.abs_value_us);
+    GNUNET_break (forever.abs_value_us == forever2.abs_value_us);
+    GNUNET_break (0 ==
+                  GNUNET_memcmp (&hc,
+                                 &hc2));
+    GNUNET_break (0 ==
+                  GNUNET_CRYPTO_rsa_signature_cmp (sig,
+                                                   sig2));
+    GNUNET_break (0 ==
+                  GNUNET_CRYPTO_rsa_public_key_cmp (pub,
+                                                    pub2));
+    GNUNET_break (strlen (msg) == msg2_len);
+    GNUNET_break (0 ==
+                  strncmp (msg,
+                           msg2,
+                           msg2_len));
+    GNUNET_break (16 == u162);
+    GNUNET_break (32 == u322);
+    GNUNET_break (64 == u642);
+    GNUNET_break (42 == uzzz);
+    GNUNET_break (got_null);
+
+    /* Check arrays */
+    GNUNET_break (num_bool == 5);
+    for (size_t i = 0; i < num_bool; i++)
+      GNUNET_break (arr_bools[i] == ab[i]);
+
+    GNUNET_break (num_u16 == 3);
+    for (size_t i = 0; i < num_u16; i++)
+      GNUNET_break (arr_u16[i] == ai2[i]);
+
+    GNUNET_break (num_u32 == 3);
+    for (size_t i = 0; i < num_u32; i++)
+      GNUNET_break (arr_u32[i] == ai4[i]);
+
+    GNUNET_break (num_u64 == 3);
+    for (size_t i = 0; i < num_u64; i++)
+      GNUNET_break (arr_u64[i] == ai8[i]);
+
+    GNUNET_break (num_abs == 2);
+    for (size_t i = 0; i < num_abs; i++)
+      GNUNET_break (arr_abs[i].abs_value_us == ata[i].abs_value_us);
+
+    GNUNET_break (num_rel == 2);
+    for (size_t i = 0; i < num_rel; i++)
+      GNUNET_break (arr_rel[i].rel_value_us == atr[i].rel_value_us);
+
+    GNUNET_break (num_tstmp == 2);
+    for (size_t i = 0; i < num_tstmp; i++)
+      GNUNET_break (arr_tstmp[i].abs_time.abs_value_us ==
+                    ats[i].abs_time.abs_value_us);
+
+    GNUNET_break (num_str == 3);
+    GNUNET_break (0 == strcmp (arr_str, as[0]));
+    GNUNET_break (0 == strcmp (arr_str + 4, as[1]));
+    GNUNET_break (0 == strcmp (arr_str + 8, as[2]));
+
+    GNUNET_break (num_hash == 3);
+    for (size_t i = 0; i < num_hash; i++)
+      GNUNET_break (0 == GNUNET_memcmp (&arr_hash[i], &ahc[i]));
+
+    GNUNET_break (num_buf == 3);
+    for (size_t i = 0; i < num_buf; i++)
+    {
+      GNUNET_break (0 == memcmp (((char *) arr_buf) + i * sizeof(ahc[i]),
+                                 &ahc[i],
+                                 sizeof(ahc[i])));
+    }
+
+    GNUNET_PQ_cleanup_result (results_select);
+    PQclear (result);
+
+    GNUNET_PQ_cleanup_query_params_closures (params_insert);
+  }
+
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+  GNUNET_CRYPTO_rsa_private_key_free (priv);
+  GNUNET_CRYPTO_rsa_public_key_free (pub);
+  if (GNUNET_OK != ret)
+    return 1;
+
+  return 0;
+}
+
+
+/**
+ * Task called on shutdown.
+ *
+ * @param cls NULL
+ */
+static void
+event_end (void *cls)
+{
+  GNUNET_PQ_event_listen_cancel (eh);
+  eh = NULL;
+  if (NULL != tt)
+  {
+    GNUNET_SCHEDULER_cancel (tt);
+    tt = NULL;
+  }
+}
+
+
+/**
+ * Task called on timeout. Should not happen, means
+ * we did not get the expected event.
+ *
+ * @param cls NULL
+ */
+static void
+timeout_cb (void *cls)
+{
+  ret = 2;
+  GNUNET_break (0);
+  tt = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Task called on expected event
+ *
+ * @param cls NULL
+ */
+static void
+event_sched_cb (void *cls,
+                const void *extra,
+                size_t extra_size)
+{
+  GNUNET_assert (5 == extra_size);
+  GNUNET_assert (0 ==
+                 memcmp ("hello",
+                         extra,
+                         5));
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Run tests that need a scheduler.
+ *
+ * @param cls NULL
+ */
+static void
+sched_tests (void *cls)
+{
+  struct GNUNET_DB_EventHeaderP es = {
+    .size = htons (sizeof (es)),
+    .type = htons (42)
+  };
+
+
+  tt = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                     &timeout_cb,
+                                     NULL);
+  eh = GNUNET_PQ_event_listen (db,
+                               &es,
+                               GNUNET_TIME_UNIT_FOREVER_REL,
+                               &event_sched_cb,
+                               NULL);
+  GNUNET_PQ_reconnect (db);
+  GNUNET_SCHEDULER_add_shutdown (&event_end,
+                                 NULL);
+  GNUNET_PQ_event_notify (db,
+                          &es,
+                          "hello",
+                          5);
+}
+
+
+int
+main (int argc,
+      const char *const argv[])
+{
+  struct GNUNET_PQ_ExecuteStatement es[] = {
+    GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS test_pq ("
+                            " pub BYTEA NOT NULL"
+                            ",sig BYTEA NOT NULL"
+                            ",abs_time INT8 NOT NULL"
+                            ",forever INT8 NOT NULL"
+                            ",hash BYTEA NOT NULL CHECK(LENGTH(hash)=64)"
+                            ",vsize VARCHAR NOT NULL"
+                            ",u16 INT2 NOT NULL"
+                            ",u32 INT4 NOT NULL"
+                            ",u64 INT8 NOT NULL"
+                            ",unn INT8"
+                            ",arr_bool BOOL[]"
+                            ",arr_int2 INT2[]"
+                            ",arr_int4 INT4[]"
+                            ",arr_int8 INT8[]"
+                            ",arr_bytea BYTEA[]"
+                            ",arr_text TEXT[]"
+                            ",arr_abs_time INT8[]"
+                            ",arr_rel_time INT8[]"
+                            ",arr_timestamp  INT8[]"
+                            ")"),
+    GNUNET_PQ_EXECUTE_STATEMENT_END
+  };
+
+  GNUNET_log_setup ("test-pq",
+                    "INFO",
+                    NULL);
+  db = GNUNET_PQ_connect ("postgres:///gnunetcheck",
+                          NULL,
+                          es,
+                          NULL);
+  if (NULL == db)
+  {
+    fprintf (stderr,
+             "Cannot run test, database connection failed\n");
+    return 77;
+  }
+  if (CONNECTION_OK != PQstatus (db->conn))
+  {
+    fprintf (stderr,
+             "Cannot run test, database connection failed: %s\n",
+             PQerrorMessage (db->conn));
+    GNUNET_break (0);
+    GNUNET_PQ_disconnect (db);
+    return 77;   /* signal test was skipped */
+  }
+  if (GNUNET_OK !=
+      postgres_prepare (db))
+  {
+    GNUNET_break (0);
+    GNUNET_PQ_disconnect (db);
+    return 1;
+  }
+  ret = run_queries (db);
+  if (0 != ret)
+  {
+    GNUNET_break (0);
+    GNUNET_PQ_disconnect (db);
+    return ret;
+  }
+
+  /* ensure oid lookup works */
+  {
+    enum GNUNET_GenericReturnValue ret;
+    Oid oid;
+
+    ret = GNUNET_PQ_get_oid_by_name (db, "int8", &oid);
+
+    if (GNUNET_OK != ret)
+    {
+      fprintf (stderr,
+               "Cannot lookup oid for int8: %s\n",
+               PQerrorMessage (db->conn));
+      GNUNET_break (0);
+      GNUNET_PQ_disconnect (db);
+      return 77; /* signal test was skipped */
+    }
+
+    PQexec (db->conn, "CREATE TYPE foo AS (foo int, bar int);");
+
+    ret = GNUNET_PQ_get_oid_by_name (db, "foo", &oid);
+    if (GNUNET_OK != ret)
+    {
+      fprintf (stderr,
+               "Cannot lookup oid for foo: %s\n",
+               PQerrorMessage (db->conn));
+      GNUNET_break (0);
+      GNUNET_PQ_disconnect (db);
+      return 77; /* signal test was skipped */
+    }
+
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "got oid %d for type foo\n", oid);
+  }
+
+  GNUNET_SCHEDULER_run (&sched_tests,
+                        NULL);
+  if (0 != ret)
+  {
+    GNUNET_break (0);
+    GNUNET_PQ_disconnect (db);
+    return ret;
+  }
+#if TEST_RESTART
+  fprintf (stderr, "Please restart Postgres database now!\n");
+  sleep (60);
+  ret |= run_queries (db);
+  fprintf (stderr, "Result: %d (expect: 1 -- if you restarted the DB)\n", ret);
+  ret |= run_queries (db);
+  fprintf (stderr, "Result: %d (expect: 0)\n", ret);
+#endif
+  {
+    struct GNUNET_PQ_ExecuteStatement es[] = {
+      GNUNET_PQ_make_execute ("DROP TABLE test_pq"),
+      GNUNET_PQ_EXECUTE_STATEMENT_END
+    };
+
+    if (GNUNET_OK !=
+        GNUNET_PQ_exec_statements (db,
+                                   es))
+    {
+      fprintf (stderr,
+               "Failed to drop table\n");
+      GNUNET_PQ_disconnect (db);
+      return 1;
+    }
+  }
+  GNUNET_PQ_disconnect (db);
+  return ret;
+}
+
+
+/* end of test_pq.c */
diff --git a/src/lib/pq/versioning.sql b/src/lib/pq/versioning.sql
new file mode 100644
index 000000000..c7fa81213
--- /dev/null
+++ b/src/lib/pq/versioning.sql
@@ -0,0 +1,298 @@
+-- LICENSE AND COPYRIGHT
+--
+-- Copyright (C) 2010 Hubert depesz Lubaczewski
+--
+-- This program is distributed under the (Revised) BSD License:
+-- L<http://www.opensource.org/licenses/bsd-license.php>
+--
+-- Redistribution and use in source and binary forms, with or without
+-- modification, are permitted provided that the following conditions
+-- are met:
+--
+-- * Redistributions of source code must retain the above copyright
+-- notice, this list of conditions and the following disclaimer.
+--
+-- * Redistributions in binary form must reproduce the above copyright
+--   notice, this list of conditions and the following disclaimer in the
+--   documentation and/or other materials provided with the distribution.
+--
+-- * Neither the name of Hubert depesz Lubaczewski's Organization
+--   nor the names of its contributors may be used to endorse or
+--   promote products derived from this software without specific
+--   prior written permission.
+--
+-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+-- AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+-- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+-- DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
+-- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+-- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+-- SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+-- CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+-- OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+-- OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+--
+-- Code origin: https://gitlab.com/depesz/Versioning/blob/master/install.versioning.sql
+--
+--
+-- # NAME
+--
+-- **Versioning** - simplistic take on tracking and applying changes to databases.
+--
+-- # DESCRIPTION
+--
+-- This project strives to provide simple way to manage changes to
+-- database.
+--
+-- Instead of making changes on development server, then finding
+-- differences between production and development, deciding which ones
+-- should be installed on production, and finding a way to install them -
+-- you start with writing diffs themselves!
+--
+-- # INSTALLATION
+--
+-- To install versioning simply run install.versioning.sql in your database
+-- (all of them: production, stage, test, devel, ...).
+--
+-- # USAGE
+--
+-- In your files with patches to database, put whole logic in single
+-- transaction, and use \_v.\* functions - usually \_v.register_patch() at
+-- least to make sure everything is OK.
+--
+-- For example. Let's assume you have patch files:
+--
+-- ## 0001.sql:
+--
+-- ```
+-- create table users (id serial primary key, username text);
+-- ```
+--
+-- ## 0002.sql:
+--
+-- ```
+-- insert into users (username) values ('depesz');
+-- ```
+-- To change it to use versioning you would change the files, to this
+-- state:
+--
+-- 0000.sql:
+--
+-- ```
+-- BEGIN;
+-- select _v.register_patch('000-base', NULL, NULL);
+-- create table users (id serial primary key, username text);
+-- COMMIT;
+-- ```
+--
+-- ## 0002.sql:
+--
+-- ```
+-- BEGIN;
+-- select _v.register_patch('001-users', ARRAY['000-base'], NULL);
+-- insert into users (username) values ('depesz');
+-- COMMIT;
+-- ```
+--
+-- This will make sure that patch 001-users can only be applied after
+-- 000-base.
+--
+-- # AVAILABLE FUNCTIONS
+--
+-- ## \_v.register_patch( TEXT )
+--
+-- Registers named patch, or dies if it is already registered.
+--
+-- Returns integer which is id of patch in \_v.patches table - only if it
+-- succeeded.
+--
+-- ## \_v.register_patch( TEXT, TEXT[] )
+--
+-- Same as \_v.register_patch( TEXT ), but checks is all given patches (given as
+-- array in second argument) are already registered.
+--
+-- ## \_v.register_patch( TEXT, TEXT[], TEXT[] )
+--
+-- Same as \_v.register_patch( TEXT, TEXT[] ), but also checks if there are no conflicts with preexisting patches.
+--
+-- Third argument is array of names of patches that conflict with current one. So
+-- if any of them is installed - register_patch will error out.
+--
+-- ## \_v.unregister_patch( TEXT )
+--
+-- Removes information about given patch from the versioning data.
+--
+-- It doesn't remove objects that were created by this patch - just removes
+-- metainformation.
+--
+-- ## \_v.assert_user_is_superuser()
+--
+-- Make sure that current patch is being loaded by superuser.
+--
+-- If it's not - it will raise exception, and break transaction.
+--
+-- ## \_v.assert_user_is_not_superuser()
+--
+-- Make sure that current patch is not being loaded by superuser.
+--
+-- If it is - it will raise exception, and break transaction.
+--
+-- ## \_v.assert_user_is_one_of(TEXT, TEXT, ... )
+--
+-- Make sure that current patch is being loaded by one of listed users.
+--
+-- If ```current_user``` is not listed as one of arguments - function will raise
+-- exception and break the transaction.
+
+BEGIN;
+
+-- Added by Christian Grothoff to support concurrency, see
+-- https://stackoverflow.com/questions/29900845/create-schema-if-not-exists-raises-duplicate-key-error?rq=4
+LOCK TABLE pg_catalog.pg_namespace;
+
+
+-- This file adds versioning support to database it will be loaded to.
+-- It requires that PL/pgSQL is already loaded - will raise exception otherwise.
+-- All versioning "stuff" (tables, functions) is in "_v" schema.
+
+-- All functions are defined as 'RETURNS SETOF INT4' to be able to make them to RETURN literally nothing (0 rows).
+-- >> RETURNS VOID<< IS similar, but it still outputs "empty line" in psql when calling
+CREATE SCHEMA IF NOT EXISTS _v;
+COMMENT ON SCHEMA _v IS 'Schema for versioning data and functionality.';
+
+CREATE TABLE IF NOT EXISTS _v.patches (
+    patch_name  TEXT        PRIMARY KEY,
+    applied_tsz TIMESTAMPTZ NOT NULL DEFAULT now(),
+    applied_by  TEXT        NOT NULL,
+    requires    TEXT[],
+    conflicts   TEXT[]
+);
+COMMENT ON TABLE _v.patches              IS 'Contains information about what patches are currently applied on database.';
+COMMENT ON COLUMN _v.patches.patch_name  IS 'Name of patch, has to be unique for every patch.';
+COMMENT ON COLUMN _v.patches.applied_tsz IS 'When the patch was applied.';
+COMMENT ON COLUMN _v.patches.applied_by  IS 'Who applied this patch (PostgreSQL username)';
+COMMENT ON COLUMN _v.patches.requires    IS 'List of patches that are required for given patch.';
+COMMENT ON COLUMN _v.patches.conflicts   IS 'List of patches that conflict with given patch.';
+
+CREATE OR REPLACE FUNCTION _v.register_patch( IN in_patch_name TEXT, IN in_requirements TEXT[], in_conflicts TEXT[], OUT versioning INT4 ) RETURNS setof INT4 AS $$
+DECLARE
+    t_text   TEXT;
+    t_text_a TEXT[];
+    i INT4;
+BEGIN
+    -- Thanks to this we know only one patch will be applied at a time
+    LOCK TABLE _v.patches IN EXCLUSIVE MODE;
+
+    SELECT patch_name INTO t_text FROM _v.patches WHERE patch_name = in_patch_name;
+    IF FOUND THEN
+        RAISE EXCEPTION 'Patch % is already applied!', in_patch_name;
+    END IF;
+
+    t_text_a := ARRAY( SELECT patch_name FROM _v.patches WHERE patch_name = any( in_conflicts ) );
+    IF array_upper( t_text_a, 1 ) IS NOT NULL THEN
+        RAISE EXCEPTION 'Versioning patches conflict. Conflicting patche(s) installed: %.', array_to_string( t_text_a, ', ' );
+    END IF;
+
+    IF array_upper( in_requirements, 1 ) IS NOT NULL THEN
+        t_text_a := '{}';
+        FOR i IN array_lower( in_requirements, 1 ) .. array_upper( in_requirements, 1 ) LOOP
+            SELECT patch_name INTO t_text FROM _v.patches WHERE patch_name = in_requirements[i];
+            IF NOT FOUND THEN
+                t_text_a := t_text_a || in_requirements[i];
+            END IF;
+        END LOOP;
+        IF array_upper( t_text_a, 1 ) IS NOT NULL THEN
+            RAISE EXCEPTION 'Missing prerequisite(s): %.', array_to_string( t_text_a, ', ' );
+        END IF;
+    END IF;
+
+    INSERT INTO _v.patches (patch_name, applied_tsz, applied_by, requires, conflicts ) VALUES ( in_patch_name, now(), current_user, coalesce( in_requirements, '{}' ), coalesce( in_conflicts, '{}' ) );
+    RETURN;
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.register_patch( TEXT, TEXT[], TEXT[] ) IS 'Function to register patches in database. Raises exception if there are conflicts, prerequisites are not installed or the migration has already been installed.';
+
+CREATE OR REPLACE FUNCTION _v.register_patch( TEXT, TEXT[] ) RETURNS setof INT4 AS $$
+    SELECT _v.register_patch( $1, $2, NULL );
+$$ language sql;
+COMMENT ON FUNCTION _v.register_patch( TEXT, TEXT[] ) IS 'Wrapper to allow registration of patches without conflicts.';
+CREATE OR REPLACE FUNCTION _v.register_patch( TEXT ) RETURNS setof INT4 AS $$
+    SELECT _v.register_patch( $1, NULL, NULL );
+$$ language sql;
+COMMENT ON FUNCTION _v.register_patch( TEXT ) IS 'Wrapper to allow registration of patches without requirements and conflicts.';
+
+CREATE OR REPLACE FUNCTION _v.unregister_patch( IN in_patch_name TEXT, OUT versioning INT4 ) RETURNS setof INT4 AS $$
+DECLARE
+    i        INT4;
+    t_text_a TEXT[];
+BEGIN
+    -- Thanks to this we know only one patch will be applied at a time
+    LOCK TABLE _v.patches IN EXCLUSIVE MODE;
+
+    t_text_a := ARRAY( SELECT patch_name FROM _v.patches WHERE in_patch_name = ANY( requires ) );
+    IF array_upper( t_text_a, 1 ) IS NOT NULL THEN
+        RAISE EXCEPTION 'Cannot uninstall %, as it is required by: %.', in_patch_name, array_to_string( t_text_a, ', ' );
+    END IF;
+
+    DELETE FROM _v.patches WHERE patch_name = in_patch_name;
+    GET DIAGNOSTICS i = ROW_COUNT;
+    IF i < 1 THEN
+        RAISE EXCEPTION 'Patch % is not installed, so it can''t be uninstalled!', in_patch_name;
+    END IF;
+
+    RETURN;
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.unregister_patch( TEXT ) IS 'Function to unregister patches in database. Dies if the patch is not registered, or if unregistering it would break dependencies.';
+
+CREATE OR REPLACE FUNCTION _v.assert_patch_is_applied( IN in_patch_name TEXT ) RETURNS TEXT as $$
+DECLARE
+    t_text TEXT;
+BEGIN
+    SELECT patch_name INTO t_text FROM _v.patches WHERE patch_name = in_patch_name;
+    IF NOT FOUND THEN
+        RAISE EXCEPTION 'Patch % is not applied!', in_patch_name;
+    END IF;
+    RETURN format('Patch %s is applied.', in_patch_name);
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.assert_patch_is_applied( TEXT ) IS 'Function that can be used to make sure that patch has been applied.';
+
+CREATE OR REPLACE FUNCTION _v.assert_user_is_superuser() RETURNS TEXT as $$
+DECLARE
+    v_super bool;
+BEGIN
+    SELECT usesuper INTO v_super FROM pg_user WHERE usename = current_user;
+    IF v_super THEN
+        RETURN 'assert_user_is_superuser: OK';
+    END IF;
+    RAISE EXCEPTION 'Current user is not superuser - cannot continue.';
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.assert_user_is_superuser() IS 'Function that can be used to make sure that patch is being applied using superuser account.';
+
+CREATE OR REPLACE FUNCTION _v.assert_user_is_not_superuser() RETURNS TEXT as $$
+DECLARE
+    v_super bool;
+BEGIN
+    SELECT usesuper INTO v_super FROM pg_user WHERE usename = current_user;
+    IF v_super THEN
+        RAISE EXCEPTION 'Current user is superuser - cannot continue.';
+    END IF;
+    RETURN 'assert_user_is_not_superuser: OK';
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.assert_user_is_not_superuser() IS 'Function that can be used to make sure that patch is being applied using normal (not superuser) account.';
+
+CREATE OR REPLACE FUNCTION _v.assert_user_is_one_of(VARIADIC p_acceptable_users TEXT[] ) RETURNS TEXT as $$
+DECLARE
+BEGIN
+    IF current_user = any( p_acceptable_users ) THEN
+        RETURN 'assert_user_is_one_of: OK';
+    END IF;
+    RAISE EXCEPTION 'User is not one of: % - cannot continue.', p_acceptable_users;
+END;
+$$ language plpgsql;
+COMMENT ON FUNCTION _v.assert_user_is_one_of(TEXT[]) IS 'Function that can be used to make sure that patch is being applied by one of defined users.';
+
+COMMIT;
diff --git a/src/lib/sq/.gitignore b/src/lib/sq/.gitignore
new file mode 100644
index 000000000..951587047
--- /dev/null
+++ b/src/lib/sq/.gitignore
@@ -0,0 +1 @@
+test_sq
diff --git a/src/lib/sq/Makefile.am b/src/lib/sq/Makefile.am
new file mode 100644
index 000000000..a77a380af
--- /dev/null
+++ b/src/lib/sq/Makefile.am
@@ -0,0 +1,38 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage
+endif
+
+if HAVE_SQLITE
+lib_LTLIBRARIES = libgnunetsq.la
+endif
+
+libgnunetsq_la_SOURCES = \
+  sq.c \
+  sq_exec.c \
+  sq_prepare.c \
+  sq_query_helper.c \
+  sq_result_helper.c
+libgnunetsq_la_LIBADD = -lsqlite3 \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunetsq_la_LDFLAGS = \
+ $(GN_LIBINTL) \
+ $(GN_LIB_LDFLAGS) \
+  -version-info 0:0:0
+
+if ENABLE_TEST_RUN
+TESTS = \
+ test_sq
+endif
+
+check_PROGRAMS= \
+ test_sq
+
+test_sq_SOURCES = \
+  test_sq.c
+test_sq_LDADD = \
+  libgnunetsq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la  \
+  -lsqlite3 $(XLIB)
diff --git a/src/lib/sq/meson.build b/src/lib/sq/meson.build
new file mode 100644
index 000000000..69d372cac
--- /dev/null
+++ b/src/lib/sq/meson.build
@@ -0,0 +1,30 @@
+libgnunetsq_src = ['sq.c',
+                   'sq_exec.c',
+                   'sq_prepare.c',
+                   'sq_query_helper.c',
+                   'sq_result_helper.c']
+
+libgnunetsq = library('gnunetsq',
+        libgnunetsq_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep, sqlite_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+pkg.generate(libgnunetsq, url: 'https://www.gnunet.org',
+             description : 'Provides API for accessing the SQ service')
+libgnunetsq_dep = declare_dependency(link_with : libgnunetsq)
+testsq = executable ('test_sq',
+          ['test_sq.c'],
+          dependencies: [libgnunetutil_dep,
+                         sqlite_dep,
+                         libgnunetsq_dep],
+          include_directories: [incdir, configuration_inc],
+          build_by_default: false,
+          install: false)
+test('test_sq', testsq,
+   workdir: meson.current_build_dir(),
+   suite: ['sq'])
+
+
diff --git a/src/lib/sq/sq.c b/src/lib/sq/sq.c
new file mode 100644
index 000000000..96d1d333d
--- /dev/null
+++ b/src/lib/sq/sq.c
@@ -0,0 +1,131 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/sq.c
+ * @brief helper functions for Sqlite3 DB interactions
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_SQ_bind (sqlite3_stmt *stmt,
+                const struct GNUNET_SQ_QueryParam *params)
+{
+  unsigned int j;
+
+  j = 1;
+  for (unsigned int i = 0; NULL != params[i].conv; i++)
+  {
+    if (GNUNET_OK !=
+        params[i].conv (params[i].conv_cls,
+                        params[i].data,
+                        params[i].size,
+                        stmt,
+                        j))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                       "sq",
+                       _ ("Failure to bind %u-th SQL parameter\n"),
+                       i);
+      if (SQLITE_OK !=
+          sqlite3_reset (stmt))
+      {
+        GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                         "sq",
+                         _ ("Failure in sqlite3_reset (!)\n"));
+        return GNUNET_SYSERR;
+      }
+    }
+    GNUNET_assert (0 != params[i].num_params);
+    j += params[i].num_params;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Extract results from a query result according to the given specification.
+ *
+ * @param result result to process
+ * @param[in,out] rs result specification to extract for
+ * @return
+ *   #GNUNET_OK if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field)
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_SQ_extract_result (sqlite3_stmt *result,
+                          struct GNUNET_SQ_ResultSpec *rs)
+{
+  unsigned int j = 0;
+
+  for (unsigned int i = 0; NULL != rs[i].conv; i++)
+  {
+    if (NULL == rs[i].result_size)
+      rs[i].result_size = &rs[i].dst_size;
+    if (GNUNET_OK !=
+        rs[i].conv (rs[i].cls,
+                    result,
+                    j,
+                    rs[i].result_size,
+                    rs[i].dst))
+    {
+      for (unsigned int k = 0; k < i; k++)
+        if (NULL != rs[k].cleaner)
+          rs[k].cleaner (rs[k].cls);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_assert (0 != rs[i].num_params);
+    j += rs[i].num_params;
+  }
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_SQ_cleanup_result (struct GNUNET_SQ_ResultSpec *rs)
+{
+  for (unsigned int i = 0; NULL != rs[i].conv; i++)
+    if (NULL != rs[i].cleaner)
+      rs[i].cleaner (rs[i].cls);
+}
+
+
+/**
+ * Reset @a stmt and log error.
+ *
+ * @param dbh database handle
+ * @param stmt statement to reset
+ */
+void
+GNUNET_SQ_reset (sqlite3 *dbh,
+                 sqlite3_stmt *stmt)
+{
+  if (SQLITE_OK !=
+      sqlite3_reset (stmt))
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                     "sqlite",
+                     _ ("Failed to reset sqlite statement with error: %s\n"),
+                     sqlite3_errmsg (dbh));
+}
+
+
+/* end of sq.c */
diff --git a/src/lib/sq/sq_exec.c b/src/lib/sq/sq_exec.c
new file mode 100644
index 000000000..d4690ee99
--- /dev/null
+++ b/src/lib/sq/sq_exec.c
@@ -0,0 +1,113 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/sq_exec.c
+ * @brief helper functions for executing SQL statements
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+
+
+/**
+ * Create a `struct GNUNET_SQ_ExecuteStatement` where errors are fatal.
+ *
+ * @param sql actual SQL statement
+ * @return initialized struct
+ */
+struct GNUNET_SQ_ExecuteStatement
+GNUNET_SQ_make_execute (const char *sql)
+{
+  struct GNUNET_SQ_ExecuteStatement es = {
+    .sql = sql,
+    .ignore_errors = GNUNET_NO
+  };
+
+  return es;
+}
+
+
+/**
+ * Create a `struct GNUNET_SQ_ExecuteStatement` where errors should
+ * be tolerated.
+ *
+ * @param sql actual SQL statement
+ * @return initialized struct
+ */
+struct GNUNET_SQ_ExecuteStatement
+GNUNET_SQ_make_try_execute (const char *sql)
+{
+  struct GNUNET_SQ_ExecuteStatement es = {
+    .sql = sql,
+    .ignore_errors = GNUNET_YES
+  };
+
+  return es;
+}
+
+
+/**
+ * Request execution of an array of statements @a es from Postgres.
+ *
+ * @param dbh database to execute the statements over
+ * @param es #GNUNET_PQ_PREPARED_STATEMENT_END-terminated array of prepared
+ *            statements.
+ * @return #GNUNET_OK on success (modulo statements where errors can be ignored)
+ *         #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_SQ_exec_statements (sqlite3 *dbh,
+                           const struct GNUNET_SQ_ExecuteStatement *es)
+{
+  for (unsigned int i = 0; NULL != es[i].sql; i++)
+  {
+    char *emsg = NULL;
+
+    if (SQLITE_OK !=
+        sqlite3_exec (dbh,
+                      es[i].sql,
+                      NULL,
+                      NULL,
+                      &emsg))
+    {
+      if (es[i].ignore_errors)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "Failed to run SQL `%s': %s\n",
+                    es[i].sql,
+                    emsg);
+      }
+      else
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Failed to run SQL `%s': %s\n",
+                    es[i].sql,
+                    emsg);
+        sqlite3_free (emsg);
+        return GNUNET_SYSERR;
+      }
+      sqlite3_free (emsg);
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+/* end of sq_exec */
diff --git a/src/lib/sq/sq_prepare.c b/src/lib/sq/sq_prepare.c
new file mode 100644
index 000000000..d1ca0e8bd
--- /dev/null
+++ b/src/lib/sq/sq_prepare.c
@@ -0,0 +1,77 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/sq_prepare.c
+ * @brief helper functions for executing SQL statements
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+
+
+/**
+ * Create a `struct GNUNET_SQ_PrepareStatement`
+ *
+ * @param sql actual SQL statement
+ * @param pstmt where to store the handle
+ * @return initialized struct
+ */
+struct GNUNET_SQ_PrepareStatement
+GNUNET_SQ_make_prepare (const char *sql,
+                        sqlite3_stmt **pstmt)
+{
+  struct GNUNET_SQ_PrepareStatement ps = {
+    .sql = sql,
+    .pstmt = pstmt
+  };
+
+  return ps;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_SQ_prepare (sqlite3 *dbh,
+                   const struct GNUNET_SQ_PrepareStatement *ps)
+{
+  for (unsigned int i = 0; NULL != ps[i].sql; i++)
+  {
+    const char *epos = NULL;
+    int ret;
+
+    if (SQLITE_OK !=
+        (ret = sqlite3_prepare_v2 (dbh,
+                                   ps[i].sql,
+                                   strlen (ps[i].sql),
+                                   ps[i].pstmt,
+                                   &epos)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to prepare SQL `%s': error %d at %s\n",
+                  ps[i].sql,
+                  ret,
+                  epos);
+      return GNUNET_SYSERR;
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+/* end of sq_prepare.c */
diff --git a/src/lib/sq/sq_query_helper.c b/src/lib/sq/sq_query_helper.c
new file mode 100644
index 000000000..ead1b5bdd
--- /dev/null
+++ b/src/lib/sq/sq_query_helper.c
@@ -0,0 +1,510 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/sq_query_helper.c
+ * @brief helper functions for queries
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_fixed_blob (void *cls,
+                 const void *data,
+                 size_t data_len,
+                 sqlite3_stmt *stmt,
+                 unsigned int off)
+{
+  if (SQLITE_OK !=
+      sqlite3_bind_blob64 (stmt,
+                           (int) off,
+                           data,
+                           (sqlite3_uint64) data_len,
+                           SQLITE_TRANSIENT))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for a buffer @a ptr of
+ * @a ptr_size bytes.
+ *
+ * @param ptr pointer to the query parameter to pass
+ * @param ptr_size number of bytes in @a ptr
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_fixed_size (const void *ptr,
+                                  size_t ptr_size)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_fixed_blob,
+    .data = ptr,
+    .size = ptr_size,
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_string (void *cls,
+             const void *data,
+             size_t data_len,
+             sqlite3_stmt *stmt,
+             unsigned int off)
+{
+  if (NULL == data)
+  {
+    if (SQLITE_OK !=
+        sqlite3_bind_null (stmt,
+                           (int) off))
+      return GNUNET_SYSERR;
+    return GNUNET_OK;
+  }
+  if (SQLITE_OK !=
+      sqlite3_bind_text (stmt,
+                         (int) off,
+                         (const char *) data,
+                         -1,
+                         SQLITE_TRANSIENT))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for a string.
+ *
+ * @param ptr pointer to the string query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_string (const char *ptr)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_string,
+    .data = ptr,
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_rsa_pub (void *cls,
+              const void *data,
+              size_t data_len,
+              sqlite3_stmt *stmt,
+              unsigned int off)
+{
+  const struct GNUNET_CRYPTO_RsaPublicKey *rsa = data;
+  void *buf;
+  size_t buf_size;
+
+  GNUNET_break (NULL == cls);
+  buf_size = GNUNET_CRYPTO_rsa_public_key_encode (rsa,
+                                                  &buf);
+  if (SQLITE_OK !=
+      sqlite3_bind_blob64 (stmt,
+                           (int) off,
+                           buf,
+                           (sqlite3_uint64) buf_size,
+                           SQLITE_TRANSIENT))
+  {
+    GNUNET_free (buf);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (buf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an RSA public key.  The
+ * database must contain a BLOB type in the respective position.
+ *
+ * @param x the query parameter to pass.
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_rsa_public_key (const struct
+                                      GNUNET_CRYPTO_RsaPublicKey *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_rsa_pub,
+    .data = x,
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_rsa_sig (void *cls,
+              const void *data,
+              size_t data_len,
+              sqlite3_stmt *stmt,
+              unsigned int off)
+{
+  const struct GNUNET_CRYPTO_RsaSignature *sig = data;
+  void *buf;
+  size_t buf_size;
+
+  GNUNET_break (NULL == cls);
+  buf_size = GNUNET_CRYPTO_rsa_signature_encode (sig,
+                                                 &buf);
+  if (SQLITE_OK !=
+      sqlite3_bind_blob64 (stmt,
+                           (int) off,
+                           buf,
+                           (sqlite3_uint64) buf_size,
+                           SQLITE_TRANSIENT))
+  {
+    GNUNET_free (buf);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (buf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an RSA signature.  The
+ * database must contain a BLOB type in the respective position.
+ *
+ * @param x the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_rsa_signature (const struct GNUNET_CRYPTO_RsaSignature *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_rsa_sig,
+    .data = x,
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_abstime (void *cls,
+              const void *data,
+              size_t data_len,
+              sqlite3_stmt *stmt,
+              unsigned int off)
+{
+  const struct GNUNET_TIME_Absolute *u = data;
+  struct GNUNET_TIME_Absolute abs;
+
+  abs = *u;
+  if (abs.abs_value_us > INT64_MAX)
+    abs.abs_value_us = INT64_MAX;
+  GNUNET_assert (sizeof(uint64_t) == data_len);
+  if (SQLITE_OK !=
+      sqlite3_bind_int64 (stmt,
+                          (int) off,
+                          (sqlite3_int64) abs.abs_value_us))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an absolute time value.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_abstime,
+    .data = x,
+    .size = sizeof(struct GNUNET_TIME_Absolute),
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_nbotime (void *cls,
+              const void *data,
+              size_t data_len,
+              sqlite3_stmt *stmt,
+              unsigned int off)
+{
+  const struct GNUNET_TIME_AbsoluteNBO *u = data;
+  struct GNUNET_TIME_Absolute abs;
+
+  abs = GNUNET_TIME_absolute_ntoh (*u);
+  if (abs.abs_value_us > INT64_MAX)
+    abs.abs_value_us = INT64_MAX;
+  GNUNET_assert (sizeof(uint64_t) == data_len);
+  if (SQLITE_OK !=
+      sqlite3_bind_int64 (stmt,
+                          (int) off,
+                          (sqlite3_int64) abs.abs_value_us))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an absolute time value.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_absolute_time_nbo (const struct
+                                         GNUNET_TIME_AbsoluteNBO *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_nbotime,
+    .data = x,
+    .size = sizeof(struct GNUNET_TIME_AbsoluteNBO),
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_u16 (void *cls,
+          const void *data,
+          size_t data_len,
+          sqlite3_stmt *stmt,
+          unsigned int off)
+{
+  const uint16_t *u = data;
+
+  GNUNET_assert (sizeof(uint16_t) == data_len);
+  if (SQLITE_OK !=
+      sqlite3_bind_int (stmt,
+                        (int) off,
+                        (int) *u))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an uint16_t in host byte order.
+ *
+ * @param x pointer to the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_uint16 (const uint16_t *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_u16,
+    .data = x,
+    .size = sizeof(uint16_t),
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_u32 (void *cls,
+          const void *data,
+          size_t data_len,
+          sqlite3_stmt *stmt,
+          unsigned int off)
+{
+  const uint32_t *u = data;
+
+  GNUNET_assert (sizeof(uint32_t) == data_len);
+  if (SQLITE_OK !=
+      sqlite3_bind_int64 (stmt,
+                          (int) off,
+                          (sqlite3_int64) * u))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an uint32_t in host byte order.
+ *
+ * @param x pointer to the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_uint32 (const uint32_t *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_u32,
+    .data = x,
+    .size = sizeof(uint32_t),
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/**
+ * Function called to convert input argument into SQL parameters.
+ *
+ * @param cls closure
+ * @param data pointer to input argument
+ * @param data_len number of bytes in @a data (if applicable)
+ * @param stmt sqlite statement to bind parameters for
+ * @param off offset of the argument to bind in @a stmt, numbered from 1,
+ *            so immediately suitable for passing to `sqlite3_bind`-functions.
+ * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
+ */
+static int
+bind_u64 (void *cls,
+          const void *data,
+          size_t data_len,
+          sqlite3_stmt *stmt,
+          unsigned int off)
+{
+  const uint64_t *u = data;
+
+  GNUNET_assert (sizeof(uint64_t) == data_len);
+  if (SQLITE_OK !=
+      sqlite3_bind_int64 (stmt,
+                          (int) off,
+                          (sqlite3_int64) * u))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Generate query parameter for an uint16_t in host byte order.
+ *
+ * @param x pointer to the query parameter to pass
+ */
+struct GNUNET_SQ_QueryParam
+GNUNET_SQ_query_param_uint64 (const uint64_t *x)
+{
+  struct GNUNET_SQ_QueryParam qp = {
+    .conv = &bind_u64,
+    .data = x,
+    .size = sizeof(uint64_t),
+    .num_params = 1
+  };
+
+  return qp;
+}
+
+
+/* end of sq_query_helper.c */
diff --git a/src/lib/sq/sq_result_helper.c b/src/lib/sq/sq_result_helper.c
new file mode 100644
index 000000000..5ea3f1e56
--- /dev/null
+++ b/src/lib/sq/sq_result_helper.c
@@ -0,0 +1,785 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2017 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/sq_result_helper.c
+ * @brief helper functions for queries
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+
+
+/**
+ * Extract variable-sized binary data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result (actually a `void **`)
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_var_blob (void *cls,
+                  sqlite3_stmt *result,
+                  unsigned int column,
+                  size_t *dst_size,
+                  void *dst)
+{
+  int have;
+  const void *ret;
+  void **rdst = (void **) dst;
+
+  if (SQLITE_NULL ==
+      sqlite3_column_type (result,
+                           column))
+  {
+    *rdst = NULL;
+    *dst_size = 0;
+    return GNUNET_YES;
+  }
+
+  if (SQLITE_BLOB !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* sqlite manual says to invoke 'sqlite3_column_blob()'
+     before calling sqlite3_column_bytes() */
+  ret = sqlite3_column_blob (result,
+                             column);
+  have = sqlite3_column_bytes (result,
+                               column);
+  if (have < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  *dst_size = have;
+  if (0 == have)
+  {
+    *rdst = NULL;
+    return GNUNET_OK;
+  }
+  *rdst = GNUNET_malloc (have);
+  GNUNET_memcpy (*rdst,
+                 ret,
+                 have);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup memory allocated by #extract_var_blob().
+ *
+ * @param cls pointer to pointer of allocation
+ */
+static void
+clean_var_blob (void *cls)
+{
+  void **dptr = (void **) cls;
+
+  if (NULL != *dptr)
+  {
+    GNUNET_free (*dptr);
+    *dptr = NULL;
+  }
+}
+
+
+/**
+ * Variable-size result expected.
+ *
+ * @param[out] dst where to store the result, allocated
+ * @param[out] sptr where to store the size of @a dst
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_variable_size (void **dst,
+                                     size_t *sptr)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_var_blob,
+    .cleaner = &clean_var_blob,
+    .dst = dst,
+    .cls = dst,
+    .result_size = sptr,
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract fixed-sized binary data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_fixed_blob (void *cls,
+                    sqlite3_stmt *result,
+                    unsigned int column,
+                    size_t *dst_size,
+                    void *dst)
+{
+  int have;
+  const void *ret;
+
+  if ((0 == *dst_size) &&
+      (SQLITE_NULL ==
+       sqlite3_column_type (result,
+                            column)))
+  {
+    return GNUNET_YES;
+  }
+
+  if (SQLITE_BLOB !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* sqlite manual says to invoke 'sqlite3_column_blob()'
+     before calling sqlite3_column_bytes() */
+  ret = sqlite3_column_blob (result,
+                             column);
+  have = sqlite3_column_bytes (result,
+                               column);
+  if (*dst_size != have)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (dst,
+                 ret,
+                 have);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Fixed-size result expected.
+ *
+ * @param[out] dst where to store the result
+ * @param dst_size number of bytes in @a dst
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_fixed_size (void *dst,
+                                  size_t dst_size)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_fixed_blob,
+    .dst = dst,
+    .dst_size = dst_size,
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract fixed-sized binary data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_utf8_string (void *cls,
+                     sqlite3_stmt *result,
+                     unsigned int column,
+                     size_t *dst_size,
+                     void *dst)
+{
+  const char *text;
+  char **rdst = dst;
+
+  if (SQLITE_NULL ==
+      sqlite3_column_type (result,
+                           column))
+  {
+    *rdst = NULL;
+    return GNUNET_OK;
+  }
+  if (SQLITE_TEXT !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* sqlite manual guarantees that 'sqlite3_column_text()'
+     is 0-terminated */
+  text = (const char *) sqlite3_column_text (result,
+                                             column);
+  if (NULL == text)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  *dst_size = strlen (text) + 1;
+  *rdst = GNUNET_strdup (text);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup memory allocated by #extract_var_blob().
+ *
+ * @param cls pointer to pointer of allocation
+ */
+static void
+clean_utf8_string (void *cls)
+{
+  char **dptr = (char **) cls;
+
+  if (NULL != *dptr)
+  {
+    GNUNET_free (*dptr);
+    *dptr = NULL;
+  }
+}
+
+
+/**
+ * 0-terminated string expected.
+ *
+ * @param[out] dst where to store the result, allocated
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_string (char **dst)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_utf8_string,
+    .cleaner = &clean_utf8_string,
+    .cls = dst,
+    .dst = dst,
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_rsa_pub (void *cls,
+                 sqlite3_stmt *result,
+                 unsigned int column,
+                 size_t *dst_size,
+                 void *dst)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = dst;
+  int have;
+  const void *ret;
+
+  if (SQLITE_BLOB !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* sqlite manual says to invoke 'sqlite3_column_blob()'
+     before calling sqlite3_column_bytes() */
+  ret = sqlite3_column_blob (result,
+                             column);
+  have = sqlite3_column_bytes (result,
+                               column);
+  if (have < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  *pk = GNUNET_CRYPTO_rsa_public_key_decode (ret,
+                                             have);
+  if (NULL == *pk)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls closure
+ */
+static void
+clean_rsa_pub (void *cls)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey **pk = cls;
+
+  if (NULL != *pk)
+  {
+    GNUNET_CRYPTO_rsa_public_key_free (*pk);
+    *pk = NULL;
+  }
+}
+
+
+/**
+ * RSA public key expected.
+ *
+ * @param[out] rsa where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_rsa_public_key (struct GNUNET_CRYPTO_RsaPublicKey **rsa)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_rsa_pub,
+    .cleaner = &clean_rsa_pub,
+    .dst = rsa,
+    .cls = rsa,
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_rsa_sig (void *cls,
+                 sqlite3_stmt *result,
+                 unsigned int column,
+                 size_t *dst_size,
+                 void *dst)
+{
+  struct GNUNET_CRYPTO_RsaSignature **sig = dst;
+  int have;
+  const void *ret;
+
+  if (SQLITE_BLOB !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* sqlite manual says to invoke 'sqlite3_column_blob()'
+     before calling sqlite3_column_bytes() */
+  ret = sqlite3_column_blob (result,
+                             column);
+  have = sqlite3_column_bytes (result,
+                               column);
+  if (have < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  *sig = GNUNET_CRYPTO_rsa_signature_decode (ret,
+                                             have);
+  if (NULL == *sig)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to clean up memory allocated
+ * by a #GNUNET_PQ_ResultConverter.
+ *
+ * @param cls result data to clean up
+ */
+static void
+clean_rsa_sig (void *cls)
+{
+  struct GNUNET_CRYPTO_RsaSignature **sig = cls;
+
+  if (NULL != *sig)
+  {
+    GNUNET_CRYPTO_rsa_signature_free (*sig);
+    *sig = NULL;
+  }
+}
+
+
+/**
+ * RSA signature expected.
+ *
+ * @param[out] sig where to store the result;
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_rsa_signature (struct GNUNET_CRYPTO_RsaSignature **sig)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_rsa_sig,
+    .cleaner = &clean_rsa_sig,
+    .dst = sig,
+    .cls = sig,
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract absolute time value from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_abs_time (void *cls,
+                  sqlite3_stmt *result,
+                  unsigned int column,
+                  size_t *dst_size,
+                  void *dst)
+{
+  struct GNUNET_TIME_Absolute *u = dst;
+  struct GNUNET_TIME_Absolute t;
+
+  GNUNET_assert (sizeof(uint64_t) == *dst_size);
+  if (SQLITE_INTEGER !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  t.abs_value_us = (uint64_t) sqlite3_column_int64 (result,
+                                                    column);
+  if (INT64_MAX == t.abs_value_us)
+    t = GNUNET_TIME_UNIT_FOREVER_ABS;
+  *u = t;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Absolute time expected.
+ *
+ * @param[out] at where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_absolute_time (struct GNUNET_TIME_Absolute *at)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_abs_time,
+    .dst = at,
+    .dst_size = sizeof(struct GNUNET_TIME_Absolute),
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract absolute time value in NBO from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_abs_time_nbo (void *cls,
+                      sqlite3_stmt *result,
+                      unsigned int column,
+                      size_t *dst_size,
+                      void *dst)
+{
+  struct GNUNET_TIME_AbsoluteNBO *u = dst;
+  struct GNUNET_TIME_Absolute t;
+
+  GNUNET_assert (sizeof(uint64_t) == *dst_size);
+  if (SQLITE_INTEGER !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  t.abs_value_us = (uint64_t) sqlite3_column_int64 (result,
+                                                    column);
+  if (INT64_MAX == t.abs_value_us)
+    t = GNUNET_TIME_UNIT_FOREVER_ABS;
+  *u = GNUNET_TIME_absolute_hton (t);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Absolute time expected.
+ *
+ * @param[out] at where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_absolute_time_nbo (struct GNUNET_TIME_AbsoluteNBO *at)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_abs_time_nbo,
+    .dst = at,
+    .dst_size = sizeof(struct GNUNET_TIME_AbsoluteNBO),
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract 16-bit integer from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_uint16 (void *cls,
+                sqlite3_stmt *result,
+                unsigned int column,
+                size_t *dst_size,
+                void *dst)
+{
+  uint64_t v;
+  uint16_t *u = dst;
+
+  GNUNET_assert (sizeof(uint16_t) == *dst_size);
+  if (SQLITE_INTEGER !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  v = (uint64_t) sqlite3_column_int64 (result,
+                                       column);
+  if (v > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  *u = (uint16_t) v;
+  return GNUNET_OK;
+}
+
+
+/**
+ * uint16_t expected.
+ *
+ * @param[out] u16 where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_uint16 (uint16_t *u16)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_uint16,
+    .dst = u16,
+    .dst_size = sizeof(uint16_t),
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract 32-bit integer from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_uint32 (void *cls,
+                sqlite3_stmt *result,
+                unsigned int column,
+                size_t *dst_size,
+                void *dst)
+{
+  uint64_t v;
+  uint32_t *u = dst;
+
+  GNUNET_assert (sizeof(uint32_t) == *dst_size);
+  if (SQLITE_INTEGER !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  v = (uint64_t) sqlite3_column_int64 (result,
+                                       column);
+  if (v > UINT32_MAX)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  *u = (uint32_t) v;
+  return GNUNET_OK;
+}
+
+
+/**
+ * uint32_t expected.
+ *
+ * @param[out] u32 where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_uint32 (uint32_t *u32)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_uint32,
+    .dst = u32,
+    .dst_size = sizeof(uint32_t),
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/**
+ * Extract 64-bit integer from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param column column to extract data from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static int
+extract_uint64 (void *cls,
+                sqlite3_stmt *result,
+                unsigned int column,
+                size_t *dst_size,
+                void *dst)
+{
+  uint64_t *u = dst;
+
+  GNUNET_assert (sizeof(uint64_t) == *dst_size);
+  if (SQLITE_INTEGER !=
+      sqlite3_column_type (result,
+                           column))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  *u = (uint64_t) sqlite3_column_int64 (result,
+                                        column);
+  return GNUNET_OK;
+}
+
+
+/**
+ * uint64_t expected.
+ *
+ * @param[out] u64 where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_SQ_ResultSpec
+GNUNET_SQ_result_spec_uint64 (uint64_t *u64)
+{
+  struct GNUNET_SQ_ResultSpec rs = {
+    .conv = &extract_uint64,
+    .dst = u64,
+    .dst_size = sizeof(uint64_t),
+    .num_params = 1
+  };
+
+  return rs;
+}
+
+
+/* end of sq_result_helper.c */
diff --git a/src/lib/sq/test_sq.c b/src/lib/sq/test_sq.c
new file mode 100644
index 000000000..292de5f34
--- /dev/null
+++ b/src/lib/sq/test_sq.c
@@ -0,0 +1,291 @@
+/*
+   This file is part of GNUnet
+   (C) 2015, 2016, 2017 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file sq/test_sq.c
+ * @brief Tests for sqlite3 convenience API
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_sq_lib.h"
+
+
+/**
+ * @brief Prepare a SQL statement
+ *
+ * @param dbh handle to the database
+ * @param zSql SQL statement, UTF-8 encoded
+ * @param[out] ppStmt set to the prepared statement
+ * @return 0 on success
+ */
+static int
+sq_prepare (sqlite3 *dbh,
+            const char *zSql,
+            sqlite3_stmt **ppStmt)
+{
+  char *dummy;
+  int result;
+
+  result = sqlite3_prepare_v2 (dbh,
+                               zSql,
+                               strlen (zSql),
+                               ppStmt,
+                               (const char **) &dummy);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Prepared `%s' / %p: %d\n",
+              zSql,
+              *ppStmt,
+              result);
+  return result;
+}
+
+
+/**
+ * Run actual test queries.
+ *
+ * @return 0 on success
+ */
+static int
+run_queries (sqlite3 *dbh)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *pub;
+  struct GNUNET_CRYPTO_RsaPublicKey *pub2 = NULL;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  struct GNUNET_CRYPTO_RsaSignature *sig2 = NULL;
+  struct GNUNET_TIME_Absolute abs_time = GNUNET_TIME_absolute_get ();
+  struct GNUNET_TIME_Absolute abs_time2;
+  struct GNUNET_TIME_Absolute forever = GNUNET_TIME_UNIT_FOREVER_ABS;
+  struct GNUNET_TIME_Absolute forever2;
+  struct GNUNET_HashCode hc;
+  struct GNUNET_HashCode hc2;
+  sqlite3_stmt *stmt;
+  struct GNUNET_CRYPTO_RsaPrivateKey *priv;
+  const char msg[] = "hello";
+  void *msg2;
+  struct GNUNET_HashCode hmsg;
+  size_t msg2_len;
+  uint16_t u16;
+  uint16_t u162;
+  uint32_t u32;
+  uint32_t u322;
+  uint64_t u64;
+  uint64_t u642;
+
+  priv = GNUNET_CRYPTO_rsa_private_key_create (1024);
+  pub = GNUNET_CRYPTO_rsa_private_key_get_public (priv);
+  memset (&hmsg, 42, sizeof(hmsg));
+  sig = GNUNET_CRYPTO_rsa_sign_fdh (priv,
+                                    &hmsg,
+                                    sizeof (hmsg));
+  u16 = 16;
+  u32 = 32;
+  u64 = 64;
+  /* FIXME: test GNUNET_SQ_result_spec_variable_size */
+
+  sq_prepare (dbh,
+              "INSERT INTO test_sq ("
+              " pub"
+              ",sig"
+              ",abs_time"
+              ",forever"
+              ",hash"
+              ",vsize"
+              ",u16"
+              ",u32"
+              ",u64"
+              ") VALUES "
+              "($1, $2, $3, $4, $5, $6,"
+              "$7, $8, $9);",
+              &stmt);
+  {
+    struct GNUNET_SQ_QueryParam params_insert[] = {
+      GNUNET_SQ_query_param_rsa_public_key (pub),
+      GNUNET_SQ_query_param_rsa_signature (sig),
+      GNUNET_SQ_query_param_absolute_time (&abs_time),
+      GNUNET_SQ_query_param_absolute_time (&forever),
+      GNUNET_SQ_query_param_auto_from_type (&hc),
+      GNUNET_SQ_query_param_fixed_size (msg, strlen (msg)),
+      GNUNET_SQ_query_param_uint16 (&u16),
+      GNUNET_SQ_query_param_uint32 (&u32),
+      GNUNET_SQ_query_param_uint64 (&u64),
+      GNUNET_SQ_query_param_end
+    };
+
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_SQ_bind (stmt,
+                                   params_insert));
+    if (SQLITE_DONE !=
+        sqlite3_step (stmt))
+    {
+      GNUNET_CRYPTO_rsa_signature_free (sig);
+      GNUNET_CRYPTO_rsa_private_key_free (priv);
+      GNUNET_CRYPTO_rsa_public_key_free (pub);
+      return 1;
+    }
+    sqlite3_reset (stmt);
+  }
+  sqlite3_finalize (stmt);
+
+  sq_prepare (dbh,
+              "SELECT"
+              " pub"
+              ",sig"
+              ",abs_time"
+              ",forever"
+              ",hash"
+              ",vsize"
+              ",u16"
+              ",u32"
+              ",u64"
+              " FROM test_sq"
+              " ORDER BY abs_time DESC "
+              " LIMIT 1;",
+              &stmt);
+  {
+    struct GNUNET_SQ_QueryParam params_select[] = {
+      GNUNET_SQ_query_param_end
+    };
+    struct GNUNET_SQ_ResultSpec results_select[] = {
+      GNUNET_SQ_result_spec_rsa_public_key (&pub2),
+      GNUNET_SQ_result_spec_rsa_signature (&sig2),
+      GNUNET_SQ_result_spec_absolute_time (&abs_time2),
+      GNUNET_SQ_result_spec_absolute_time (&forever2),
+      GNUNET_SQ_result_spec_auto_from_type (&hc2),
+      GNUNET_SQ_result_spec_variable_size (&msg2, &msg2_len),
+      GNUNET_SQ_result_spec_uint16 (&u162),
+      GNUNET_SQ_result_spec_uint32 (&u322),
+      GNUNET_SQ_result_spec_uint64 (&u642),
+      GNUNET_SQ_result_spec_end
+    };
+
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_SQ_bind (stmt,
+                                   params_select));
+    if (SQLITE_ROW !=
+        sqlite3_step (stmt))
+    {
+      GNUNET_break (0);
+      sqlite3_finalize (stmt);
+      GNUNET_CRYPTO_rsa_signature_free (sig);
+      GNUNET_CRYPTO_rsa_private_key_free (priv);
+      GNUNET_CRYPTO_rsa_public_key_free (pub);
+      return 1;
+    }
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_SQ_extract_result (stmt,
+                                             results_select));
+    GNUNET_break (abs_time.abs_value_us == abs_time2.abs_value_us);
+    GNUNET_break (forever.abs_value_us == forever2.abs_value_us);
+    GNUNET_break (0 ==
+                  GNUNET_memcmp (&hc,
+                                 &hc2));
+    GNUNET_break (0 ==
+                  GNUNET_CRYPTO_rsa_signature_cmp (sig,
+                                                   sig2));
+    GNUNET_break (0 ==
+                  GNUNET_CRYPTO_rsa_public_key_cmp (pub,
+                                                    pub2));
+    GNUNET_break (strlen (msg) == msg2_len);
+    GNUNET_break (0 ==
+                  strncmp (msg,
+                           msg2,
+                           msg2_len));
+    GNUNET_break (16 == u162);
+    GNUNET_break (32 == u322);
+    GNUNET_break (64 == u642);
+    GNUNET_SQ_cleanup_result (results_select);
+    sqlite3_reset (stmt);
+  }
+  sqlite3_finalize (stmt);
+
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+  GNUNET_CRYPTO_rsa_private_key_free (priv);
+  GNUNET_CRYPTO_rsa_public_key_free (pub);
+  return 0;
+}
+
+
+int
+main (int argc,
+      const char *const argv[])
+{
+  sqlite3 *dbh;
+  int ret;
+
+  GNUNET_log_setup ("test-sq",
+                    "WARNING",
+                    NULL);
+  if (SQLITE_OK !=
+      sqlite3_open ("test.db",
+                    &dbh))
+  {
+    fprintf (stderr,
+             "Cannot run test, sqlite3 initialization failed\n");
+    GNUNET_break (0);
+    return 77;   /* Signal test was skipped... */
+  }
+
+  if (SQLITE_OK !=
+      sqlite3_exec (dbh,
+                    "CREATE TEMPORARY TABLE IF NOT EXISTS test_sq ("
+                    " pub BYTEA NOT NULL"
+                    ",sig BYTEA NOT NULL"
+                    ",abs_time INT8 NOT NULL"
+                    ",forever INT8 NOT NULL"
+                    ",hash BYTEA NOT NULL"
+                    ",vsize VARCHAR NOT NULL"
+                    ",u16 INT2 NOT NULL"
+                    ",u32 INT4 NOT NULL"
+                    ",u64 INT8 NOT NULL"
+                    ")",
+                    NULL, NULL, NULL))
+  {
+    fprintf (stderr,
+             "Failed to create table\n");
+    GNUNET_break (SQLITE_OK ==
+                  sqlite3_close (dbh));
+    if (0 != unlink ("test.db"))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                "test.db");
+    return 1;
+  }
+
+  ret = run_queries (dbh);
+  if (SQLITE_OK !=
+      sqlite3_exec (dbh,
+                    "DROP TABLE test_sq",
+                    NULL, NULL, NULL))
+  {
+    fprintf (stderr,
+             "Failed to drop table\n");
+    ret = 1;
+  }
+  GNUNET_break (SQLITE_OK ==
+                sqlite3_close (dbh));
+  if (0 != unlink ("test.db"))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                              "unlink",
+                              "test.db");
+  return ret;
+}
+
+
+/* end of test_sq.c */
diff --git a/src/lib/testing/.gitignore b/src/lib/testing/.gitignore
new file mode 100644
index 000000000..a1e77a8e4
--- /dev/null
+++ b/src/lib/testing/.gitignore
@@ -0,0 +1,9 @@
+test_testing_start_with_config
+list-keys
+gnunet-testing
+test_testing_peerstartup
+test_testing_peerstartup2
+test_testing_portreservation
+test_testing_servicestartup
+test_testing_sharedservices
+gnunet-cmds-helper
diff --git a/src/lib/testing/Makefile.am b/src/lib/testing/Makefile.am
new file mode 100644
index 000000000..cd53d7237
--- /dev/null
+++ b/src/lib/testing/Makefile.am
@@ -0,0 +1,43 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+libexecdir= $(pkglibdir)/libexec/
+
+libexec_PROGRAMS = \
+  gnunet-cmds-helper
+
+plugindir = $(libdir)/gnunet
+
+lib_LTLIBRARIES = \
+  libgnunettesting.la
+
+gnunet_cmds_helper_SOURCES = \
+  gnunet-cmds-helper.c
+gnunet_cmds_helper_LDADD = $(XLIB) \
+  libgnunettesting.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL) $(Z_LIBS)
+
+libgnunettesting_la_SOURCES = \
+  testing_api_cmd_barrier.c \
+  testing_api_cmd_barrier_reached.c \
+  testing_api_cmd_exec.c \
+  testing_api_cmd_finish.c \
+  testing_api_loop.c testing_api_loop.h \
+  testing_api_traits.c \
+  testing_api_cmd_netjail_start.c \
+  testing_api_cmd_netjail_start_cmds_helper.c \
+  netjail.c netjail.h \
+  barrier.c barrier.h \
+  testing_api_cmd_batch.c testing_api_cmd_batch.h
+libgnunettesting_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunettesting_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  -version-info 3:0:0
diff --git a/src/lib/testing/barrier.c b/src/lib/testing/barrier.c
new file mode 100644
index 000000000..fba350035
--- /dev/null
+++ b/src/lib/testing/barrier.c
@@ -0,0 +1,51 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2024 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/barrier.c
+ * @brief convenience API for writing testcases for GNUnet
+ *        Many testcases need to start and stop a peer/service
+ *        and this library is supposed to make that easier
+ *        for TESTCASES.  Normal programs should always
+ *        use functions from gnunet_{util,arm}_lib.h.  This API is
+ *        ONLY for writing testcases (or internal use of the testbed).
+ * @author Christian Grothoff
+ *
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "barrier.h"
+
+
+void
+GNUNET_TESTING_barrier_name_hash_ (
+  const char *barrier_name,
+  struct GNUNET_ShortHashCode *bkey)
+{
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (barrier_name,
+                      strlen (barrier_name),
+                      &hc);
+  memcpy (bkey,
+          &hc,
+          sizeof (*bkey));
+}
diff --git a/src/lib/testing/barrier.h b/src/lib/testing/barrier.h
new file mode 100644
index 000000000..bf777d9cf
--- /dev/null
+++ b/src/lib/testing/barrier.h
@@ -0,0 +1,77 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file barrier.h
+ * @brief API to manage barriers.
+ * @author t3sserakt
+ */
+
+#ifndef BARRIER_H
+#define BARRIER_H
+
+/**
+ * An entry for a barrier list
+ */
+struct GNUNET_TESTING_Barrier
+{
+
+  struct GNUNET_ShortHashCode barrier_id;
+
+  /**
+   * Context of a barrier reached command of our local interpreter that is
+   * currently blocked on this barrier, or NULL if
+   * no command is currently blocked on this barrier.
+   */
+  struct GNUNET_TESTING_AsyncContext *cmd_ac;
+
+  /**
+   * Number of total commands expected to be reached by the barrier.
+   */
+  unsigned int expected_reaches;
+
+  /**
+   * Number of times the barrier has been reached.
+   * Only used if @e inherited is false.
+   */
+  unsigned int reached;
+
+  /**
+   * Did we inherit the barrier from our parent loop?
+   */
+  bool inherited;
+
+  /**
+   * Did we reach @e expected_reaches? Used in particular if
+   * @e inherited is true and we cannot compute locally.
+   */
+  bool satisfied;
+
+};
+
+
+void
+GNUNET_TESTING_barrier_name_hash_ (
+  const char *barrier_name,
+  struct GNUNET_ShortHashCode *bkey);
+
+
+#endif
+/* end of barrier.h */
diff --git a/src/lib/testing/gnunet-cmds-helper.c b/src/lib/testing/gnunet-cmds-helper.c
new file mode 100644
index 000000000..4fccdc68b
--- /dev/null
+++ b/src/lib/testing/gnunet-cmds-helper.c
@@ -0,0 +1,527 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testbed/gnunet-cmds-helper.c
+ * @brief Helper binary that is started from a remote interpreter loop to start
+ *        a local interpreter loop.
+ *
+ *        This helper monitors for three termination events.  They are: (1)The
+ *        stdin of the helper is closed for reading; (2)the helper received
+ *        SIGTERM/SIGINT; (3)the local loop crashed.  In case of events 1 and 2
+ *        the helper kills the interpreter loop.  When the interpreter loop
+ *        crashed (event 3), the helper should send a SIGTERM to its own process
+ *        group; this behaviour will help terminate any child processes the loop
+ *        has started and prevents them from leaking and running forever.
+ *
+ * @author t3sserakt
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "testing_api_loop.h"
+#include "testing_cmds.h"
+#include "netjail.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+/**
+ * Debug logging shorthand
+ */
+#define LOG_DEBUG(...) LOG (GNUNET_ERROR_TYPE_DEBUG, __VA_ARGS__)
+
+/**
+ * Context for a single write on a chunk of memory
+ */
+struct WriteContext
+{
+
+  struct WriteContext *next;
+
+  struct WriteContext *prev;
+
+  /**
+   * The data to write
+   */
+  void *data;
+
+  /**
+   * The length of the data
+   */
+  size_t length;
+
+  /**
+   * The current position from where the write operation should begin
+   */
+  size_t pos;
+};
+
+
+static struct WriteContext *wc_head;
+
+static struct WriteContext *wc_tail;
+
+static struct GNUNET_TESTING_Interpreter *is;
+
+static const char *my_node_id;
+
+/**
+ * Plugin to dynamically load a test case.
+ */
+static struct GNUNET_TESTING_PluginFunctions *plugin;
+
+/**
+ * Name of our plugin.
+ */
+static char *plugin_name;
+
+/**
+ * Our message stream tokenizer
+ */
+static struct GNUNET_MessageStreamTokenizer *tokenizer;
+
+/**
+ * Disk handle from stdin
+ */
+static struct GNUNET_DISK_FileHandle *stdin_fd;
+
+/**
+ * Disk handle for stdout
+ */
+static struct GNUNET_DISK_FileHandle *stdout_fd;
+
+/**
+ * Task identifier for the read task
+ */
+static struct GNUNET_SCHEDULER_Task *read_task_id;
+
+/**
+ * Task identifier for the write task
+ */
+static struct GNUNET_SCHEDULER_Task *write_task_id;
+
+/**
+ * Result to return in case we fail
+ */
+static int global_ret;
+
+/**
+ * Set to true once we are finished and should exit
+ * after sending our final message to the parent.
+ */
+static bool finished;
+
+
+/**
+ * Task to shut down cleanly
+ *
+ * @param cls NULL
+ */
+static void
+do_shutdown (void *cls)
+{
+  struct WriteContext *wc;
+
+  if (NULL != read_task_id)
+  {
+    GNUNET_SCHEDULER_cancel (read_task_id);
+    read_task_id = NULL;
+  }
+  if (NULL != write_task_id)
+  {
+    GNUNET_SCHEDULER_cancel (write_task_id);
+    write_task_id = NULL;
+  }
+  while (NULL != (wc = wc_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (wc_head,
+                                 wc_tail,
+                                 wc);
+    GNUNET_free (wc->data);
+    GNUNET_free (wc);
+  }
+  if (NULL != tokenizer)
+  {
+    GNUNET_MST_destroy (tokenizer);
+    tokenizer = NULL;
+  }
+  if (NULL != plugin)
+  {
+    GNUNET_PLUGIN_unload (plugin_name,
+                          plugin);
+    GNUNET_free (plugin_name);
+  }
+}
+
+
+/**
+ * Task to write to the standard out
+ *
+ * @param cls the WriteContext
+ */
+static void
+write_task (void *cls)
+{
+  struct WriteContext *wc = wc_head;
+  ssize_t bytes_wrote;
+
+  write_task_id = NULL;
+  if (NULL == wc)
+  {
+    if (finished)
+      GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  bytes_wrote
+    = GNUNET_DISK_file_write (stdout_fd,
+                              wc->data + wc->pos,
+                              wc->length - wc->pos);
+  if (GNUNET_SYSERR == bytes_wrote)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "write");
+    GNUNET_free (wc->data);
+    GNUNET_free (wc);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  wc->pos += bytes_wrote;
+  if (wc->pos == wc->length)
+  {
+    GNUNET_CONTAINER_DLL_remove (wc_head,
+                                 wc_tail,
+                                 wc);
+    GNUNET_free (wc->data);
+    GNUNET_free (wc);
+  }
+  write_task_id
+    = GNUNET_SCHEDULER_add_write_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                       stdout_fd,
+                                       &write_task,
+                                       NULL);
+}
+
+
+/**
+ * Callback to write a message to the parent process.
+ *
+ */
+static void
+write_message (const struct GNUNET_MessageHeader *message)
+{
+  struct WriteContext *wc;
+  size_t msg_length = ntohl (message->size);
+
+  wc = GNUNET_new (struct WriteContext);
+  wc->length = msg_length;
+  wc->data = GNUNET_memdup (message,
+                            msg_length);
+  GNUNET_CONTAINER_DLL_insert_tail (wc_head,
+                                    wc_tail,
+                                    wc);
+  if (NULL == write_task_id)
+  {
+    GNUNET_assert (wc_head == wc);
+    write_task_id
+      = GNUNET_SCHEDULER_add_write_file (
+          GNUNET_TIME_UNIT_FOREVER_REL,
+          stdout_fd,
+          &write_task,
+          NULL);
+  }
+}
+
+
+static void
+finished_cb (enum GNUNET_GenericReturnValue rv)
+{
+  struct GNUNET_TESTING_CommandLocalFinished reply = {
+    .header.type = htons (GNUNET_MESSAGE_TYPE_CMDS_HELPER_LOCAL_FINISHED),
+    .header.size = htons (sizeof (reply)),
+    .rv = htonl ((uint32_t) rv)
+  };
+
+  finished = true;
+  write_message (&reply.header);
+}
+
+
+static enum GNUNET_GenericReturnValue
+check_helper_init (
+  void *cls,
+  const struct GNUNET_TESTING_CommandHelperInit *msg)
+{
+  uint16_t msize = htons (msg->header.size);
+  uint32_t barrier_count = htonl (msg->barrier_count);
+  size_t bs = barrier_count * sizeof (struct GNUNET_ShortHashCode);
+  size_t left = msize - bs - sizeof (*msg);
+  const struct GNUNET_ShortHashCode *bd
+    = (const struct GNUNET_ShortHashCode *) &msg[1];
+  const char *topo = (const char *) &bd[barrier_count];
+
+  if (msize < bs + sizeof (*msg))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if ('\0' != topo[left - 1])
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static void
+handle_helper_init (
+  void *cls,
+  const struct GNUNET_TESTING_CommandHelperInit *msg)
+{
+  uint16_t msize = htons (msg->header.size);
+  uint32_t barrier_count = htonl (msg->barrier_count);
+  size_t bs = barrier_count * sizeof (struct GNUNET_ShortHashCode);
+  size_t left = msize - bs - sizeof (*msg);
+  const struct GNUNET_ShortHashCode *bd
+    = (const struct GNUNET_ShortHashCode *) &msg[1];
+  const char *topo = (const char *) &bd[barrier_count];
+  struct GNUNET_TESTING_NetjailTopology *njt;
+
+  GNUNET_assert ('\0' == topo[left - 1]);
+  njt = GNUNET_TESTING_get_topo_from_string (topo);
+  if (NULL == njt)
+  {
+    GNUNET_break_op (0);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  plugin_name = GNUNET_TESTING_get_plugin_from_topo (njt,
+                                                     my_node_id);
+  GNUNET_TESTING_free_toplogy (njt);
+  plugin = GNUNET_PLUGIN_load (plugin_name,
+                               (void *) my_node_id);
+  if (NULL == plugin)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Plugin `%s' not found!\n",
+                plugin_name);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  is = plugin->start_testcase (plugin->cls,
+                               topo,
+                               barrier_count,
+                               bd,
+                               &write_message,
+                               &finished_cb);
+}
+
+
+static void
+handle_helper_barrier_crossable (
+  void *cls,
+  const struct GNUNET_TESTING_CommandBarrierSatisfied *cbs)
+{
+  struct GNUNET_TESTING_Barrier *barrier;
+
+  if (NULL == is)
+  {
+    /* Barrier satisfied *before* helper_init?! */
+    GNUNET_break_op (0);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  barrier = GNUNET_TESTING_get_barrier2_ (is,
+                                          &cbs->barrier_key);
+  if (barrier->satisfied)
+  {
+    /* Barrier satisfied *twice* is strange... */
+    GNUNET_break_op (0);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  barrier->satisfied = true;
+  GNUNET_TESTING_loop_notify_children_ (is,
+                                        &cbs->header);
+  if (NULL != barrier->cmd_ac)
+  {
+    GNUNET_TESTING_async_finish (barrier->cmd_ac);
+    barrier->cmd_ac = NULL;
+  }
+}
+
+
+/**
+ * Functions with this signature are called whenever a
+ * complete message is received by the tokenizer.
+ *
+ * Do not call #GNUNET_mst_destroy() in this callback
+ *
+ * @param cls identification of the client
+ * @param message the actual message
+ * @return #GNUNET_OK on success,
+ *    #GNUNET_NO to stop further processing (no error)
+ *    #GNUNET_SYSERR to stop further processing with error
+ */
+static enum GNUNET_GenericReturnValue
+tokenizer_cb (void *cls,
+              const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (
+      helper_init,
+      GNUNET_MESSAGE_TYPE_CMDS_HELPER_INIT,
+      struct GNUNET_TESTING_CommandHelperInit,
+      NULL),
+    GNUNET_MQ_hd_fixed_size (
+      helper_barrier_crossable,
+      GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_CROSSABLE,
+      struct GNUNET_TESTING_CommandBarrierSatisfied,
+      NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  return GNUNET_MQ_handle_message (handlers,
+                                   message);
+}
+
+
+/**
+ * Task to read from stdin
+ *
+ * @param cls NULL
+ */
+static void
+read_task (void *cls)
+{
+  char buf[GNUNET_MAX_MESSAGE_SIZE];
+  ssize_t sread;
+
+  read_task_id = NULL;
+  sread = GNUNET_DISK_file_read (stdin_fd,
+                                 buf,
+                                 sizeof(buf));
+  if (GNUNET_SYSERR == sread)
+  {
+    GNUNET_break (0);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (0 == sread)
+  {
+    LOG_DEBUG ("STDIN eof\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (GNUNET_OK !=
+      GNUNET_MST_from_buffer (tokenizer,
+                              buf,
+                              sread,
+                              GNUNET_NO,
+                              GNUNET_NO))
+  {
+    GNUNET_break (0);
+    global_ret = EXIT_FAILURE;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  read_task_id
+    = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                      stdin_fd,
+                                      &read_task,
+                                      NULL);
+}
+
+
+/**
+ * Main function that will be run.
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  if (NULL == args[0])
+  {
+    /* must be called with our node ID as 1st argument */
+    GNUNET_break_op (0);
+    global_ret = EXIT_INVALIDARGUMENT;
+    return;
+  }
+  my_node_id = args[0];
+  tokenizer = GNUNET_MST_create (&tokenizer_cb,
+                                 NULL);
+  stdin_fd = GNUNET_DISK_get_handle_from_native (stdin);
+  stdout_fd = GNUNET_DISK_get_handle_from_native (stdout);
+  read_task_id = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                                 stdin_fd,
+                                                 &read_task,
+                                                 NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+}
+
+
+/**
+ * Main function
+ *
+ * @param argc the number of command line arguments
+ * @param argv command line arg array
+ * @return return code
+ */
+int
+main (int argc,
+      char **argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+  enum GNUNET_GenericReturnValue ret;
+
+  ret = GNUNET_PROGRAM_run (argc,
+                            argv,
+                            "gnunet-cmds-helper",
+                            "Helper for starting a local interpreter loop",
+                            options,
+                            &run,
+                            NULL);
+  if (GNUNET_OK != ret)
+    return 1;
+  return global_ret;
+}
+
+
+/* end of gnunet-cmds-helper.c */
diff --git a/src/lib/testing/meson.build b/src/lib/testing/meson.build
new file mode 100644
index 000000000..ea8956c1b
--- /dev/null
+++ b/src/lib/testing/meson.build
@@ -0,0 +1,62 @@
+libgnunettesting_src = [
+                        'testing_api_cmd_exec_bash_script.c',
+                        'testing_api_cmd_barrier.c',
+                        'testing_api_cmd_barrier_reached.c',
+                        'testing_api_cmd_finish.c',
+                        'testing_api_cmd_local_test_prepared.c',
+                        'testing_api_cmd_send_peer_ready.c',
+                        'testing_api_cmd_block_until_external_trigger.c',
+                        'testing_api_cmd_netjail_start.c',
+                        'testing_api_cmd_netjail_start_cmds_helper.c',
+                        'testing_api_cmd_netjail_stop_cmds_helper.c',
+                        'testing_api_cmd_netjail_stop.c',
+                        'testing.c',
+                        'testing_api_cmd_system_create.c',
+                        'testing_api_cmd_system_destroy.c',
+                        'testing_api_cmd_batch.c',
+                        'testing_api_loop.c',
+                        'testing_api_traits.c'
+                        ]
+
+gnunettesting_src = ['gnunet-testing.c']
+gnunetservicetesting_src = ['gnunet-service-testing.c']
+
+configure_file(input : 'testing.conf',
+               output : 'testing.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+
+libgnunettesting = library('gnunettesting',
+        libgnunettesting_src,
+        soversion: '1',
+        version: '1.1.0',
+        dependencies: [libgnunetutil_dep,
+                       m_dep,
+                       libgnunetarm_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunettesting_dep = declare_dependency(link_with : libgnunettesting)
+pkg.generate(libgnunettesting, url: 'https://www.gnunet.org',
+             description : 'Provides API for gnunet testing')
+
+executable ('gnunet-testing',
+          gnunettesting_src,
+          dependencies: [libgnunettesting_dep,
+                         libgnunetutil_dep,
+                         ],
+          include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('bindir'))
+
+executable ('gnunet-cmds-helper',
+            ['gnunet-cmds-helper.c'],
+            dependencies: [libgnunettesting_dep,
+                           libgnunetutil_dep,
+                           ],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir')/'gnunet'/'libexec')
+
diff --git a/src/lib/testing/netjail.c b/src/lib/testing/netjail.c
new file mode 100644
index 000000000..f3b670311
--- /dev/null
+++ b/src/lib/testing/netjail.c
@@ -0,0 +1,1085 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2008, 2009, 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing.c
+ * @brief convenience API for writing testcases for GNUnet
+ *        Many testcases need to start and stop a peer/service
+ *        and this library is supposed to make that easier
+ *        for TESTCASES.  Normal programs should always
+ *        use functions from gnunet_{util,arm}_lib.h.  This API is
+ *        ONLY for writing testcases (or internal use of the testbed).
+ * @author Christian Grothoff
+ *
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "netjail.h"
+#include "testing_cmds.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "testing-api", __VA_ARGS__)
+
+#define CONNECT_ADDRESS_TEMPLATE "%s-192.168.15.%u"
+
+#define ROUTER_CONNECT_ADDRESS_TEMPLATE "%s-92.68.150.%u"
+
+#define KNOWN_CONNECT_ADDRESS_TEMPLATE "%s-92.68.151.%u"
+
+#define PREFIX_TCP "tcp"
+
+#define PREFIX_UDP "udp"
+
+#define PREFIX_TCP_NATTED "tcp_natted"
+
+#define PREFIX_UDP_NATTED "udp_natted"
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. An integer value seperated
+ * by ':' is returned by this function.
+ *
+ * @param line The line of configuration.
+ * @return An integer value.
+ */
+static unsigned int
+get_first_value (const char *line)
+{
+  char *copy;
+  size_t slen;
+  char *token;
+  unsigned int ret;
+  char *rest = NULL;
+
+  slen = strlen (line) + 1;
+  copy = GNUNET_malloc (slen);
+  memcpy (copy, line, slen);
+  token = strtok_r (copy, ":", &rest);
+  token = strtok_r (NULL, ":", &rest);
+  GNUNET_assert (1 == sscanf (token, "%u", &ret));
+  GNUNET_free (copy);
+  return ret;
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. This string is returned by this function.
+ *
+ * @param line The line of configuration.
+ * @return The leading string of this configuration line.
+ */
+static char *
+get_key (const char *line)
+{
+  char *copy;
+  size_t slen;
+  size_t tlen;
+  char *token;
+  char *ret;
+  char *rest = NULL;
+
+  slen = strlen (line) + 1;
+  copy = GNUNET_malloc (slen);
+  memcpy (copy, line, slen);
+  token = strtok_r (copy, ":", &rest);
+  tlen = strlen (token) + 1;
+  ret = GNUNET_malloc (tlen);
+  memcpy (ret, token, tlen);
+  GNUNET_free (copy);
+  return ret;
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. A string value seperated
+ * by ':' is returned by this function.
+ *
+ * @param line The line of configuration.
+ * @return A string value.
+ */
+static char *
+get_first_string_value (const char *line)
+{
+  char *copy;
+  size_t slen, slen_token;
+  char *token;
+  char *ret;
+  char *rest = NULL;
+
+  slen = strlen (line) + 1;
+  copy = GNUNET_malloc (slen);
+  memcpy (copy, line, slen);
+  token = strtok_r (copy, ":", &rest);
+  token = strtok_r (NULL, ":", &rest);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "first token %s\n",
+       token);
+  slen_token = strlen (token);
+  ret = GNUNET_malloc (slen_token + 1);
+  memcpy (ret, token, slen_token + 1);
+  GNUNET_free (copy);
+  return ret;
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. A second integer value
+ * seperated by ':' from a first value is returned by this function.
+ *
+ * @param line The line of configuration.
+ * @return An integer value.
+ */
+static unsigned int
+get_second_value (const char *line)
+{
+  char *copy;
+  char *token;
+  unsigned int ret;
+  char *rest = NULL;
+
+  copy = GNUNET_strdup (line);
+  token = strtok_r (copy, ":", &rest);
+  token = strtok_r (NULL, ":", &rest);
+  token = strtok_r (NULL, ":", &rest);
+  LOG (GNUNET_ERROR_TYPE_ERROR,
+       "Format error in configuration line: %s\n",
+       line);
+  GNUNET_assert (1 == sscanf (token, "%u", &ret));
+  GNUNET_free (copy);
+  return ret;
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. A value might be
+ * a key value pair.
+ * This function returns the value for a specific key in a configuration line.
+ *
+ * @param key The key of the key value pair.
+ * @return The value of the key value pair.
+ */
+static char *
+get_value (const char *key, const char *line)
+{
+  char copy[strlen (line) + 1];
+  size_t slen;
+  char *token;
+  char *token2;
+  char *temp;
+  char *rest = NULL;
+
+  slen = strlen (line) + 1;
+  memcpy (copy, line, slen);
+  temp = strstr (copy, key);
+  if (NULL == temp)
+    return NULL;
+  token = strtok_r (temp, ":", &rest);
+  if (NULL == token)
+    return NULL;
+  token = strtok_r (NULL, ":", &rest);
+  if (NULL == token)
+    return NULL;
+  token2 = strtok_r (token, "}", &rest);
+  if (NULL == token2)
+    return NULL;
+  return GNUNET_strdup (token2);
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. A value might be
+ * a key value pair. A special key is the 'connect' key which can appear more than once.
+ * The value is the information about a connection via some protocol to some other node.
+ * This function returns the struct GNUNET_TESTING_NodeConnection which holds the information
+ * of the connect value.
+ *
+ * @param value The value of the connect key value pair.
+ * @return The struct GNUNET_TESTING_NodeConnection.
+ */
+static struct GNUNET_TESTING_NodeConnection *
+get_connect_value (const char *line,
+                   struct GNUNET_TESTING_NetjailNode *node)
+{
+  struct GNUNET_TESTING_NodeConnection *node_connection;
+  char *copy;
+  char *token;
+  char *token2;
+  unsigned int node_n;
+  unsigned int namespace_n;
+  char *rest = NULL;
+  char *rest2 = NULL;
+  struct GNUNET_TESTING_AddressPrefix *prefix;
+  unsigned int sscanf_ret;
+
+  node_connection = GNUNET_new (struct GNUNET_TESTING_NodeConnection);
+  node_connection->node = node;
+
+  copy = GNUNET_strdup (line);
+  token = strtok_r (copy, ":", &rest);
+  if (0 == strcmp ("{K", token))
+  {
+    node_connection->node_type = GNUNET_TESTING_GLOBAL_NODE;
+    token = strtok_r (NULL, ":", &rest);
+    GNUNET_assert (1 == sscanf (token, "%u", &node_n));
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "node_n %u\n",
+         node_n);
+    node_connection->node_n = node_n;
+    node_connection->namespace_n = 0;
+  }
+  else if (0 == strcmp ("{P", token))
+  {
+    node_connection->node_type = GNUNET_TESTING_SUBNET_NODE;
+    token = strtok_r (NULL, ":", &rest);
+    errno = 0;
+    sscanf_ret = sscanf (token, "%u", &namespace_n);
+    if (errno != 0)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+    }
+    GNUNET_assert (0 < sscanf_ret);
+    node_connection->namespace_n = namespace_n;
+    token = strtok_r (NULL, ":", &rest);
+    errno = 0;
+    sscanf_ret = sscanf (token, "%u", &node_n);
+    if (errno != 0)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+    }
+    GNUNET_assert (0 < sscanf_ret);
+    node_connection->node_n = node_n;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "node_n %u namespace_n %u node->node_n %u node->namespace_n %u\n",
+         node_n,
+         namespace_n,
+         node->node_n,
+         node->namespace_n);
+  }
+  else
+  {
+    GNUNET_break (0);
+    GNUNET_free (node_connection);
+    GNUNET_free (copy);
+    return NULL;
+  }
+
+  while (NULL != (token = strtok_r (NULL, ":", &rest)))
+  {
+    prefix = GNUNET_new (struct GNUNET_TESTING_AddressPrefix);
+    token2 = strtok_r (token, "}", &rest2);
+    if (NULL != token2)
+      prefix->address_prefix = GNUNET_strdup (token2);
+    else
+      prefix->address_prefix = GNUNET_strdup (token);
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "address_prefix %s\n",
+         prefix->address_prefix);
+
+    GNUNET_CONTAINER_DLL_insert (node_connection->address_prefixes_head,
+                                 node_connection->address_prefixes_tail,
+                                 prefix);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "address_prefix %s\n",
+         prefix->address_prefix);
+  }
+
+  GNUNET_free (copy);
+  return node_connection;
+}
+
+
+/**
+ * Every line in the topology configuration starts with a string indicating which
+ * kind of information will be configured with this line. Configuration values following
+ * this string are seperated by special sequences of characters. A value might be
+ * a key value pair. A special key is the 'connect' key.
+ * The value is the information about a connections via some protocol to other nodes.
+ * Each connection itself is a key value pair separated by the character '|' and
+ * surrounded by the characters '{' and '}'.
+ * The struct GNUNET_TESTING_NodeConnection holds the information of each connection value.
+ * This function extracts the values of each connection into a DLL of
+ * struct GNUNET_TESTING_NodeConnection which will be added to a node.
+ *
+ * @param line The line of configuration.
+ * @param node The struct GNUNET_TESTING_NetjailNode to which the DLL of
+ *             struct GNUNET_TESTING_NodeConnection will be added.
+ */
+static void
+node_connections (const char *line, struct GNUNET_TESTING_NetjailNode *node)
+{
+  char *value, *value2;
+  char *temp;
+  char *copy;
+  char *rest = NULL;
+  char *rest2 = NULL;
+  struct GNUNET_TESTING_NodeConnection *node_connection;
+
+
+  temp = strstr (line, "connect");
+  if (NULL != temp)
+  {
+    copy = GNUNET_strdup (temp);
+    strtok_r (copy, ":", &rest);
+    value = strtok_r (rest, "|", &rest2);
+
+    while (NULL != value)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "node_connections value %s\n",
+           value);
+      node_connection = get_connect_value (value, node);
+      if (NULL == node_connection)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "connect key was not expected in this configuration line: %s\n",
+             line);
+        break;
+      }
+      GNUNET_CONTAINER_DLL_insert (node->node_connections_head,
+                                   node->node_connections_tail,
+                                   node_connection);
+      value2 = strstr (value, "}}");
+      if (NULL != value2)
+        break;
+      value = strtok_r (NULL, "|", &rest2);
+
+    }
+    GNUNET_free (copy);
+  }
+}
+
+
+/**
+ * A helper function to log information about individual nodes.
+ *
+ * @param cls This is not used actually.
+ * @param id The key of this value in the map.
+ * @param value A struct GNUNET_TESTING_NetjailNode which holds information about a node.
+ * return GNUNET_YES to continue with iterating, GNUNET_NO otherwise.
+ */
+static int
+log_nodes (void *cls, const struct GNUNET_ShortHashCode *id, void *value)
+{
+  struct GNUNET_TESTING_NetjailNode *node = value;
+  struct GNUNET_TESTING_NodeConnection *pos_connection;
+  struct GNUNET_TESTING_AddressPrefix *pos_prefix;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "plugin: %s space: %u node: %u global: %u\n",
+       node->plugin,
+       node->namespace_n,
+       node->node_n,
+       node->is_global);
+
+  for (pos_connection = node->node_connections_head; NULL != pos_connection;
+       pos_connection = pos_connection->next)
+  {
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "namespace_n: %u node_n: %u node_type: %u\n",
+         pos_connection->namespace_n,
+         pos_connection->node_n,
+         pos_connection->node_type);
+
+    for (pos_prefix = pos_connection->address_prefixes_head; NULL != pos_prefix;
+         pos_prefix =
+           pos_prefix->next)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "prefix: %s\n",
+           pos_prefix->address_prefix);
+    }
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Helper function to log information about namespaces.
+ *
+ * @param cls This is not used actually.
+ * @param id The key of this value in the map.
+ * @param value A struct GNUNET_TESTING_NetjailNamespace which holds information about a subnet.
+ * return GNUNET_YES to continue with iterating, GNUNET_NO otherwise.
+ */
+static int
+log_namespaces (void *cls, const struct GNUNET_ShortHashCode *id, void *value)
+{
+  struct GNUNET_TESTING_NetjailNamespace *namespace = value;
+
+  GNUNET_CONTAINER_multishortmap_iterate (namespace->nodes, &log_nodes, NULL);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Helper function to log the configuration in case of a problem with configuration.
+ *
+ * @param topology The struct GNUNET_TESTING_NetjailTopology holding the configuration information.
+ */
+static int
+log_topo (const struct GNUNET_TESTING_NetjailTopology *topology)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "plugin: %s spaces: %u nodes: %u known: %u\n",
+       topology->plugin,
+       topology->namespaces_n,
+       topology->nodes_m,
+       topology->nodes_x);
+
+  GNUNET_CONTAINER_multishortmap_iterate (topology->map_namespaces,
+                                          log_namespaces, NULL);
+  GNUNET_CONTAINER_multishortmap_iterate (topology->map_globals, &log_nodes,
+                                          NULL);
+  return GNUNET_YES;
+}
+
+
+/**
+ * This function extracts information about a specific node from the topology.
+ *
+ * @param num The global index number of the node.
+ * @param[out] node_ex A struct GNUNET_TESTING_NetjailNode with information about the node.
+ * @param[out] namespace_ex A struct GNUNET_TESTING_NetjailNamespace with information about the namespace
+               the node is in or NULL, if the node is a global node.
+ * @param[out] node_connections_ex A struct GNUNET_TESTING_NodeConnection with information about the connection
+               of this node to other nodes.
+*/
+static void
+get_node_info (unsigned int num,
+               const struct GNUNET_TESTING_NetjailTopology *topology,
+               struct GNUNET_TESTING_NetjailNode **node_ex,
+               struct GNUNET_TESTING_NetjailNamespace **namespace_ex,
+               struct GNUNET_TESTING_NodeConnection **node_connections_ex)
+{
+  struct GNUNET_ShortHashCode hkey;
+  struct GNUNET_HashCode hc;
+  unsigned int namespace_n;
+  unsigned int node_m;
+  struct GNUNET_TESTING_NetjailNode *node;
+  struct GNUNET_TESTING_NetjailNamespace *namespace;
+  struct GNUNET_TESTING_NodeConnection *node_connections = NULL;
+
+  log_topo (topology);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "num: %u \n",
+       num);
+  if (topology->nodes_x >= num)
+  {
+
+    GNUNET_CRYPTO_hash (&num, sizeof(num), &hc);
+    memcpy (&hkey,
+            &hc,
+            sizeof (hkey));
+    node = GNUNET_CONTAINER_multishortmap_get (topology->map_globals,
+                                               &hkey);
+    if (NULL != node)
+    {
+      *node_ex = node;
+      *node_connections_ex = node->node_connections_head;
+    }
+  }
+  else
+  {
+    namespace_n = (unsigned int) ceil ((double) (num - topology->nodes_x)
+                                       / topology->nodes_m);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "ceil num: %u nodes_x: %u nodes_m: %u namespace_n: %u\n",
+         num,
+         topology->nodes_x,
+         topology->nodes_m,
+         namespace_n);
+    GNUNET_CRYPTO_hash (&namespace_n, sizeof(namespace_n), &hc);
+    memcpy (&hkey,
+            &hc,
+            sizeof (hkey));
+    namespace = GNUNET_CONTAINER_multishortmap_get (topology->map_namespaces,
+                                                    &hkey);
+    if (NULL != namespace)
+    {
+      node_m = num - topology->nodes_x - topology->nodes_m * (namespace_n - 1);
+      GNUNET_CRYPTO_hash (&node_m, sizeof(node_m), &hc);
+      memcpy (&hkey,
+              &hc,
+              sizeof (hkey));
+      node = GNUNET_CONTAINER_multishortmap_get (namespace->nodes,
+                                                 &hkey);
+      if (NULL != node)
+      {
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "node additional_connects: %u %p\n",
+             node->additional_connects,
+             node);
+        node_connections = node->node_connections_head;
+      }
+      *node_ex = node;
+      *namespace_ex = namespace;
+      *node_connections_ex = node_connections;
+    }
+  }
+}
+
+
+/**
+ * Get a node from the topology.
+ *
+ * @param num The specific node we want the connections for.
+ * @param topology The topology we get the connections from.
+ * @return The connections of the node.
+ */
+struct GNUNET_TESTING_NetjailNode *
+GNUNET_TESTING_get_node (unsigned int num,
+                         struct GNUNET_TESTING_NetjailTopology *topology)
+{
+  struct GNUNET_TESTING_NetjailNode *node;
+  struct GNUNET_TESTING_NetjailNamespace *namespace;
+  struct GNUNET_TESTING_NodeConnection *node_connections;
+
+  get_node_info (num, topology, &node, &namespace, &node_connections);
+
+  return node;
+
+}
+
+
+/**
+ * Get the connections to other nodes for a specific node.
+ *
+ * @param num The specific node we want the connections for.
+ * @param topology The topology we get the connections from.
+ * @return The connections of the node.
+ */
+struct GNUNET_TESTING_NodeConnection *
+GNUNET_TESTING_get_connections (unsigned int num,
+                                const struct
+                                GNUNET_TESTING_NetjailTopology *topology)
+{
+  struct GNUNET_TESTING_NetjailNode *node;
+  struct GNUNET_TESTING_NetjailNamespace *namespace;
+  struct GNUNET_TESTING_NodeConnection *node_connections;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "get_connections\n");
+
+  get_node_info (num, topology, &node, &namespace, &node_connections);
+
+  return node_connections;
+}
+
+
+int
+free_nodes_cb (void *cls,
+               const struct GNUNET_ShortHashCode *key,
+               void *value)
+{
+  (void) cls;
+  struct GNUNET_TESTING_NetjailNode *node = value;
+  struct GNUNET_TESTING_NodeConnection *pos_connection;
+  struct GNUNET_TESTING_AddressPrefix *pos_prefix;
+
+  while (NULL != (pos_connection = node->node_connections_head))
+  {
+    while (NULL != (pos_prefix = pos_connection->address_prefixes_head))
+    {
+      GNUNET_CONTAINER_DLL_remove (pos_connection->address_prefixes_head,
+                                   pos_connection->address_prefixes_tail,
+                                   pos_prefix);
+      GNUNET_free (pos_prefix->address_prefix);
+      GNUNET_free (pos_prefix);
+    }
+    GNUNET_CONTAINER_DLL_remove (node->node_connections_head,
+                                 node->node_connections_tail,
+                                 pos_connection);
+    GNUNET_free (pos_connection);
+  }
+
+  GNUNET_free (node->plugin);
+  GNUNET_free (node);
+  return GNUNET_OK;
+}
+
+
+int
+free_namespaces_cb (void *cls,
+                    const struct GNUNET_ShortHashCode *key,
+                    void *value)
+{
+  (void) cls;
+  struct GNUNET_TESTING_NetjailNamespace *namespace = value;
+
+  GNUNET_free (namespace->router);
+  GNUNET_CONTAINER_multishortmap_iterate (namespace->nodes, free_nodes_cb,
+                                          namespace->nodes);
+  return GNUNET_OK;
+
+}
+
+
+/**
+ * Deallocate memory of the struct GNUNET_TESTING_NetjailTopology.
+ *
+ * @param topology The GNUNET_TESTING_NetjailTopology to be deallocated.
+ */
+void
+GNUNET_TESTING_free_topology (struct GNUNET_TESTING_NetjailTopology *topology)
+{
+  GNUNET_CONTAINER_multishortmap_iterate (topology->map_namespaces,
+                                          free_namespaces_cb, NULL);
+  GNUNET_CONTAINER_multishortmap_destroy (topology->map_namespaces);
+  GNUNET_CONTAINER_multishortmap_iterate (topology->map_globals, free_nodes_cb,
+                                          NULL);
+  GNUNET_CONTAINER_multishortmap_destroy (topology->map_globals);
+  GNUNET_free (topology->plugin);
+  GNUNET_free (topology);
+}
+
+
+unsigned int
+GNUNET_TESTING_calculate_num (
+  struct GNUNET_TESTING_NodeConnection *node_connection,
+  struct GNUNET_TESTING_NetjailTopology *topology)
+{
+  unsigned int n, m, num;
+
+  n = node_connection->namespace_n;
+  m = node_connection->node_n;
+
+  if (0 == n)
+    num = m;
+  else
+    num = (n - 1) * topology->nodes_m + m + topology->nodes_x;
+
+  return num;
+}
+
+
+/**
+ * Get the address for a specific communicator from a connection.
+ *
+ * @param connection The connection we like to have the address from.
+ * @param prefix The communicator protocol prefix.
+ * @return The address of the communicator.
+ */
+char *
+GNUNET_TESTING_get_address (struct GNUNET_TESTING_NodeConnection *connection,
+                            const char *prefix)
+{
+  struct GNUNET_TESTING_NetjailNode *node;
+  char *addr;
+  char *template;
+  unsigned int node_n;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "get address prefix: %s node_n: %u\n",
+       prefix,
+       connection->node_n);
+
+  node = connection->node;
+  if (connection->namespace_n == node->namespace_n)
+  {
+    template = CONNECT_ADDRESS_TEMPLATE;
+    node_n = connection->node_n;
+  }
+  else if (0 == connection->namespace_n)
+  {
+    template = KNOWN_CONNECT_ADDRESS_TEMPLATE;
+    node_n = connection->node_n;
+  }
+  else if (1 == connection->node_n)
+  {
+    template = ROUTER_CONNECT_ADDRESS_TEMPLATE;
+    node_n = connection->namespace_n;
+  }
+  else
+  {
+    return NULL;
+  }
+
+  if (0 == strcmp (PREFIX_TCP, prefix) ||
+      0 == strcmp (PREFIX_UDP, prefix) ||
+      0 == strcmp (PREFIX_UDP_NATTED, prefix) ||
+      0 == strcmp (PREFIX_TCP_NATTED, prefix))
+  {
+    GNUNET_asprintf (&addr,
+                     template,
+                     prefix,
+                     node_n);
+  }
+  else
+  {
+    GNUNET_assert (0);
+  }
+
+  return addr;
+}
+
+
+/**
+ * Get the number of unintentional additional connections the node waits for.
+ *
+ * @param num The specific node we want the additional connects for.
+ * @return The number of additional connects
+ */
+unsigned int
+GNUNET_TESTING_get_additional_connects (unsigned int num,
+                                        struct GNUNET_TESTING_NetjailTopology *
+                                        topology)
+{
+  struct GNUNET_TESTING_NetjailNode *node;
+  struct GNUNET_TESTING_NetjailNamespace *namespace;
+  struct GNUNET_TESTING_NodeConnection *node_connections;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "get_additional_connects\n");
+
+  get_node_info (num, topology, &node, &namespace, &node_connections);
+
+  if (NULL == node)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "No info found for node %d\n", num);
+    return 0;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "node additional_connects for node %p\n",
+       node);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "node additional_connects: %u\n",
+       node->additional_connects);
+
+  return node->additional_connects;
+}
+
+
+static void
+parse_ac (struct GNUNET_TESTING_NetjailNode *p_node, const char *token)
+{
+  char *ac_value;
+  int ret;
+
+  ac_value = get_value ("AC", token);
+  if (NULL != ac_value)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "ac value: %s\n",
+         ac_value);
+    errno = 0;
+    ret = sscanf (ac_value, "%u", &p_node->additional_connects);
+    if (errno != 0)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+    }
+    GNUNET_assert (0 < ret);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "AC %u\n",
+         p_node->additional_connects);
+  }
+  else
+  {
+    p_node->additional_connects = 0;
+  }
+  GNUNET_free (ac_value);
+}
+
+
+/**
+ * Parse the topology data.
+ *
+ * @param data The topology data.
+ * @return The GNUNET_TESTING_NetjailTopology
+ */
+struct GNUNET_TESTING_NetjailTopology *
+GNUNET_TESTING_get_topo_from_string_ (const char *input)
+{
+  char *token;
+  char *key = NULL;
+  unsigned int out;
+  char *rest = NULL;
+  char *value = NULL;
+  char *value2;
+  char *data;
+  int ret;
+  struct GNUNET_TESTING_NetjailTopology *topo;
+  struct GNUNET_TESTING_NetjailRouter *router;
+  struct GNUNET_TESTING_NetjailNamespace *namespace;
+  struct GNUNET_HashCode hc;
+
+  data = GNUNET_strdup (input);
+  token = strtok_r (data, "\n", &rest);
+  topo = GNUNET_new (struct GNUNET_TESTING_NetjailTopology);
+  topo->map_namespaces =
+    GNUNET_CONTAINER_multishortmap_create (1,GNUNET_NO);
+  topo->map_globals =
+    GNUNET_CONTAINER_multishortmap_create (1,GNUNET_NO);
+
+  while (NULL != token)
+  {
+    if (NULL != key)
+      GNUNET_free (key);
+    key = get_key (token);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "In the loop with token: %s beginning with %s\n",
+         token,
+         key);
+    if (0 == strcmp (key, "M"))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for M.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "M: %u\n",
+           out);
+      topo->nodes_m = out;
+    }
+    else if (0 == strcmp (key, "N"))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for N.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "N: %u\n",
+           out);
+      topo->namespaces_n = out;
+    }
+    else if (0 == strcmp (key, "X"))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for X.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "X: %u\n",
+           out);
+      topo->nodes_x = out;
+    }
+    else if (0 == strcmp (key, "AC"))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for AC.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "AC: %u\n",
+           out);
+      topo->additional_connects = out;
+    }
+    else if (0 == strcmp (key, "T"))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first string value for T.\n");
+      value = get_first_string_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "value: %s\n",
+           value);
+      topo->plugin = value;
+    }
+    else if (0 == strcmp (key, "K"))
+    {
+      struct GNUNET_ShortHashCode hkey_k;
+      struct GNUNET_TESTING_NetjailNode *k_node = GNUNET_new (struct
+                                                              GNUNET_TESTING_NetjailNode);
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for K.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "K: %u\n",
+           out);
+      k_node->node_n = out;
+      GNUNET_CRYPTO_hash (&out, sizeof(out), &hc);
+      memcpy (&hkey_k,
+              &hc,
+              sizeof (hkey_k));
+      k_node->is_global = GNUNET_YES;
+
+      if (GNUNET_YES == GNUNET_CONTAINER_multishortmap_contains (
+            topo->map_globals,
+            &hkey_k))
+        GNUNET_break (0);
+      else
+        GNUNET_CONTAINER_multishortmap_put (topo->map_globals,
+                                            &hkey_k,
+                                            k_node,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get value for key value on K.\n");
+      value = get_value ("plugin", token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "value: %s\n",
+           value);
+      k_node->plugin = value;
+      parse_ac (k_node, token);
+      node_connections (token, k_node);
+      GNUNET_free (value);
+    }
+    else if (0 == strcmp (key, "R"))
+    {
+      struct GNUNET_ShortHashCode hkey_r;
+      router = GNUNET_new (struct GNUNET_TESTING_NetjailRouter);
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for R.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "R: %u\n",
+           out);
+      GNUNET_CRYPTO_hash (&out, sizeof(out), &hc);
+      memcpy (&hkey_r,
+              &hc,
+              sizeof (hkey_r));
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get value for key tcp_port on R.\n");
+      value = get_value ("tcp_port", token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "tcp_port: %s\n",
+           value);
+      ret = sscanf (value, "%u", &(router->tcp_port));
+      GNUNET_free (value);
+      GNUNET_break (0 != ret && 1 >= router->tcp_port);
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get value for key udp_port on R.\n");
+      value2 = get_value ("udp_port", token);
+      ret = sscanf (value2, "%u", &(router->udp_port));
+      GNUNET_free (value2);
+      GNUNET_break (0 != ret && 1 >= router->udp_port);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "udp_port: %s\n",
+           value2);
+      GNUNET_free (value2);
+      if (GNUNET_YES == GNUNET_CONTAINER_multishortmap_contains (
+            topo->map_namespaces,
+            &hkey_r))
+      {
+        namespace = GNUNET_CONTAINER_multishortmap_get (topo->map_namespaces,
+                                                        &hkey_r);
+      }
+      else
+      {
+        namespace = GNUNET_new (struct GNUNET_TESTING_NetjailNamespace);
+        namespace->namespace_n = out;
+        namespace->nodes = GNUNET_CONTAINER_multishortmap_create (1,GNUNET_NO);
+        GNUNET_CONTAINER_multishortmap_put (topo->map_namespaces,
+                                            &hkey_r,
+                                            namespace,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+      }
+      namespace->router = router;
+
+    }
+    else if (0 == strcmp (key, "P"))
+    {
+      struct GNUNET_TESTING_NetjailNode *p_node = GNUNET_new (struct
+                                                              GNUNET_TESTING_NetjailNode);
+      struct GNUNET_ShortHashCode hkey_p;
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get first Value for P.\n");
+      out = get_first_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "P: %u\n",
+           out);
+      GNUNET_CRYPTO_hash (&out, sizeof(out), &hc);
+      memcpy (&hkey_p,
+              &hc,
+              sizeof (hkey_p));
+
+      if (GNUNET_YES == GNUNET_CONTAINER_multishortmap_contains (
+            topo->map_namespaces,
+            &hkey_p))
+      {
+        namespace = GNUNET_CONTAINER_multishortmap_get (topo->map_namespaces,
+                                                        &hkey_p);
+      }
+      else
+      {
+        namespace = GNUNET_new (struct GNUNET_TESTING_NetjailNamespace);
+        namespace->nodes = GNUNET_CONTAINER_multishortmap_create (1,GNUNET_NO);
+        namespace->namespace_n = out;
+        GNUNET_CONTAINER_multishortmap_put (topo->map_namespaces,
+                                            &hkey_p,
+                                            namespace,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+      }
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get second Value for P.\n");
+      out = get_second_value (token);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "P: %u\n",
+           out);
+      GNUNET_CRYPTO_hash (&out, sizeof(out), &hc);
+      memcpy (&hkey_p,
+              &hc,
+              sizeof (hkey_p));
+      if (GNUNET_YES == GNUNET_CONTAINER_multishortmap_contains (
+            namespace->nodes,
+            &hkey_p))
+      {
+        GNUNET_break (0);
+      }
+      else
+      {
+
+        GNUNET_CONTAINER_multishortmap_put (namespace->nodes,
+                                            &hkey_p,
+                                            p_node,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "Get value for key plugin on P.\n");
+        value = get_value ("plugin", token);
+        if (NULL != value)
+        {
+          LOG (GNUNET_ERROR_TYPE_DEBUG,
+               "plugin: %s\n",
+               value);
+          p_node->plugin = value;
+        }
+        p_node->node_n = out;
+        p_node->namespace_n = namespace->namespace_n;
+      }
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Get AC Value for P.\n");
+      parse_ac (p_node, token);
+      node_connections (token, p_node);
+    }
+    token = strtok_r (NULL, "\n", &rest);
+    if (NULL != token)
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Next token %s\n",
+           token);
+  }
+  if (NULL != key)
+    GNUNET_free (key);
+  GNUNET_free (data);
+  return topo;
+}
+
+
+/* end of testing.c */
diff --git a/src/lib/testing/netjail.h b/src/lib/testing/netjail.h
new file mode 100644
index 000000000..f8445a89f
--- /dev/null
+++ b/src/lib/testing/netjail.h
@@ -0,0 +1,358 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @brief API for writing an interpreter to test GNUnet components
+ * @author Christian Grothoff <christian@grothoff.org>
+ * @author Marcello Stanisci
+ * @author t3sserakt
+ */
+#ifndef NETJAIL_H
+#define NETJAIL_H
+
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+
+/**
+ * Router of a netjail subnet.
+ */
+struct GNUNET_TESTING_NetjailRouter
+{
+  /**
+   * Will tcp be forwarded?
+   */
+  unsigned int tcp_port;
+
+  /**
+   * Will udp be forwarded?
+   */
+  unsigned int udp_port;
+};
+
+
+/**
+ * Enum for the different types of nodes.
+ */
+enum GNUNET_TESTING_NodeType
+{
+  /**
+   * Node in a subnet.
+   */
+  GNUNET_TESTING_SUBNET_NODE,
+
+  /**
+   * Global known node.
+   */
+  GNUNET_TESTING_GLOBAL_NODE
+};
+
+/**
+ * Protocol address prefix für a connection between nodes.
+ */
+struct GNUNET_TESTING_AddressPrefix
+{
+  /**
+   * Pointer to the previous prefix in the DLL.
+   */
+  struct GNUNET_TESTING_AddressPrefix *prev;
+
+  /**
+   * Pointer to the next prefix in the DLL.
+   */
+  struct GNUNET_TESTING_AddressPrefix *next;
+
+  /**
+   * The address prefix.
+   */
+  char *address_prefix;
+};
+
+
+/**
+ * Node in a netjail topology.
+ */
+struct GNUNET_TESTING_NetjailNode;
+
+/**
+ * Connection to another node.
+ */
+struct GNUNET_TESTING_NodeConnection
+{
+  /**
+   * Pointer to the previous connection in the DLL.
+   */
+  struct GNUNET_TESTING_NodeConnection *prev;
+
+  /**
+   * Pointer to the next connection in the DLL.
+   */
+  struct GNUNET_TESTING_NodeConnection *next;
+
+  /**
+   * The number of the subnet of the node this connection points to. This is 0,
+   * if the node is a global known node.
+   */
+  unsigned int namespace_n;
+
+  /**
+   * The number of the node this connection points to.
+   */
+  unsigned int node_n;
+
+  /**
+   * The type of the node this connection points to.
+   */
+  enum GNUNET_TESTING_NodeType node_type;
+
+  /**
+   * The node which establish the connection
+   */
+  struct GNUNET_TESTING_NetjailNode *node;
+
+  /**
+   * Head of the DLL with the address prefixes for the protocolls this node is reachable.
+   */
+  struct GNUNET_TESTING_AddressPrefix *address_prefixes_head;
+
+  /**
+   * Tail of the DLL with the address prefixes for the protocolls this node is reachable.
+   */
+  struct GNUNET_TESTING_AddressPrefix *address_prefixes_tail;
+};
+
+/**
+ * Node in the netjail topology.
+ */
+struct GNUNET_TESTING_NetjailNode
+{
+  /**
+   * Head of the DLL with the connections which shall be established to other nodes.
+   */
+  struct GNUNET_TESTING_NodeConnection *node_connections_head;
+
+  /**
+   * Tail of the DLL with the connections which shall be established to other nodes.
+   */
+  struct GNUNET_TESTING_NodeConnection *node_connections_tail;
+
+  /**
+   * Plugin for the test case to be run on this node.
+   */
+  char *plugin;
+
+  /**
+   * Flag indicating if this node is a global known node.
+   */
+  unsigned int is_global;
+
+  /**
+   * The number of the subnet this node is running in.
+   */
+  unsigned int namespace_n;
+
+  /**
+   * The number of this node in the subnet.
+   */
+  unsigned int node_n;
+
+  /**
+   * The overall number of the node in the whole test system.
+   */
+  unsigned int node_number;
+
+  /**
+   * The number of unintentional additional connections this node waits for. This overwrites the global additional_connects value.
+   */
+  unsigned int additional_connects;
+
+  /**
+   * The number of cmds waiting for a specific barrier.
+   */
+  unsigned int expected_reaches;
+};
+
+
+/**
+ * Subnet in a topology.
+ */
+struct GNUNET_TESTING_NetjailNamespace
+{
+  /**
+   * The number of the subnet.
+   */
+  unsigned int namespace_n;
+
+  /**
+   * Router of the subnet.
+   */
+  struct GNUNET_TESTING_NetjailRouter *router;
+
+  /**
+   * Hash map containing the nodes in this subnet.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *nodes;
+};
+
+/**
+ * Toplogy of our netjail setup.
+ */
+struct GNUNET_TESTING_NetjailTopology
+{
+
+  /**
+   * Default plugin for the test case to be run on nodes.
+   */
+  char *plugin;
+
+  /**
+   * Total number of namespaces in the topology;
+   * numbered starting from 1 (!).
+   */
+  unsigned int total;
+
+  /**
+   * Number of subnets.
+   */
+  unsigned int namespaces_n;
+
+  /**
+   * Number of nodes per subnet.
+   */
+  unsigned int nodes_m;
+
+  /**
+   * Number of global known nodes.
+   */
+  unsigned int nodes_x;
+
+  /**
+   * Hash map containing the subnets (for natted nodes) of the topology.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *map_namespaces;
+
+  /**
+   * Hash map containing the global known nodes which are not natted.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *map_globals;
+
+  /**
+   * Additional connects we do expect, beside the connects which are configured in the topology.
+   */
+  unsigned int additional_connects;
+};
+
+
+/**
+ * Parse the topology data.
+ *
+ * @param data The topology data.
+ * @return The GNUNET_TESTING_NetjailTopology
+ */
+struct GNUNET_TESTING_NetjailTopology *
+GNUNET_TESTING_get_topo_from_string_ (const char *data);
+
+
+/**
+ * Get the number of unintentional additional connections the node waits for.
+ *
+ * @param num The specific node we want the additional connects for.
+ * @return The number of additional connects
+ */
+unsigned int
+GNUNET_TESTING_get_additional_connects (
+  unsigned int num,
+  struct GNUNET_TESTING_NetjailTopology *topology);
+
+
+/**
+ * Get a node from the topology.
+ *
+ * @param num The specific node we want the connections for.
+ * @param topology The topology we get the connections from.
+ * @return The connections of the node.
+ */
+struct GNUNET_TESTING_NetjailNode *
+GNUNET_TESTING_get_node (unsigned int num,
+                         struct GNUNET_TESTING_NetjailTopology *topology);
+
+
+/**
+ * Get the connections to other nodes for a specific node.
+ *
+ * @param num The specific node we want the connections for.
+ * @param topology The topology we get the connections from.
+ * @return The connections of the node.
+ */
+struct GNUNET_TESTING_NodeConnection *
+GNUNET_TESTING_get_connections (
+  unsigned int num,
+  const struct GNUNET_TESTING_NetjailTopology *topology);
+
+
+/**
+ * Get the address for a specific communicator from a connection.
+ *
+ * @param connection The connection we like to have the address from.
+ * @param prefix The communicator protocol prefix.
+ * @return The address of the communicator.
+ */
+char *
+GNUNET_TESTING_get_address (
+  struct GNUNET_TESTING_NodeConnection *connection,
+  const char *prefix);
+
+
+/**
+ * Deallocate memory of the struct GNUNET_TESTING_NetjailTopology.
+ *
+ * @param[in] topology The GNUNET_TESTING_NetjailTopology to be deallocated.
+ */
+void
+GNUNET_TESTING_free_topology (struct GNUNET_TESTING_NetjailTopology *topology);
+
+
+/**
+ * Calculate the unique id identifying a node from a given connection.
+ *
+ * @param node_connection The connection we calculate the id from.
+ * @param topology The topology we get all needed information from.
+ * @return The unique id of the node from the connection.
+ */
+unsigned int
+GNUNET_TESTING_calculate_num (
+  struct GNUNET_TESTING_NodeConnection *node_connection,
+  struct GNUNET_TESTING_NetjailTopology *topology);
+
+
+/**
+ * Call #op on all simple traits.
+ */
+#define GNUNET_TESTING_SIMPLE_NETJAIL_TRAITS(op, prefix)                            \
+  op (prefix, get_topology, const struct GNUNET_TESTING_NetjailTopology)            \
+  op (prefix, get_topology_string, char)                                    \
+  op (prefix, async_context, struct GNUNET_TESTING_AsyncContext)                    \
+  op (prefix, helper_handles, const struct GNUNET_HELPER_Handle *)                  
+
+GNUNET_TESTING_SIMPLE_NETJAIL_TRAITS (GNUNET_TESTING_MAKE_DECL_SIMPLE_TRAIT,
+                                      GNUNET_TESTING)
+
+
+#endif
diff --git a/src/lib/testing/testing.conf b/src/lib/testing/testing.conf
new file mode 100644
index 000000000..7e25f8c13
--- /dev/null
+++ b/src/lib/testing/testing.conf
@@ -0,0 +1,11 @@
+[TESTING]
+# How long before failing a connection?
+CONNECT_TIMEOUT = 30 s
+# How many connect attempts should we make?
+CONNECT_ATTEMPTS = 3
+# How many connections can happen simultaneously?
+MAX_OUTSTANDING_CONNECTIONS = 50
+
+# Should we clean up the files on peer group shutdown?
+DELETE_FILES = YES
+
diff --git a/src/lib/testing/testing_api_cmd_barrier.c b/src/lib/testing/testing_api_cmd_barrier.c
new file mode 100644
index 000000000..582df792d
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_barrier.c
@@ -0,0 +1,106 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_barrier.c
+ * @brief Barrier functionality.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_testing_lib.h"
+#include "barrier.h"
+#include "testing_api_loop.h"
+
+
+/**
+ * Offer internal data from a "barrier" CMD, to other commands.
+ *
+ * @param cls closure.
+ * @param[out] ret result.
+ * @param trait name of the trait.
+ * @param index index number of the object to offer.
+ * @return #GNUNET_OK on success.
+ */
+static enum GNUNET_GenericReturnValue
+barrier_traits (void *cls,
+                const void **ret,
+                const char *trait,
+                unsigned int index)
+{
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_trait_end ()
+  };
+
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+
+/**
+ * Cleanup the state from a "barrier" CMD, and possibly
+ * cancel a pending operation thereof.
+ *
+ * @param cls closure.
+ */
+static void
+barrier_cleanup (void *cls)
+{
+  struct GNUNET_TESTING_Barrier *barrier = cls;
+
+  GNUNET_free (barrier);
+}
+
+
+/**
+ * Run the command.
+ *
+ * @param cls closure.
+ * @param is the interpreter state.
+ */
+static void
+barrier_run (void *cls,
+             struct GNUNET_TESTING_Interpreter *is)
+{
+  struct GNUNET_TESTING_Barrier *barrier = cls;
+
+  GNUNET_TESTING_add_barrier_ (is,
+                               barrier);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_barrier_create (
+  const char *label,
+  unsigned int number_to_be_reached)
+{
+  struct GNUNET_TESTING_Barrier *barrier;
+
+  barrier = GNUNET_new (struct GNUNET_TESTING_Barrier);
+  GNUNET_TESTING_barrier_name_hash_ (label,
+                                     &barrier->barrier_id);
+  barrier->expected_reaches = number_to_be_reached;
+  return GNUNET_TESTING_command_new (barrier,
+                                     label,
+                                     &barrier_run,
+                                     &barrier_cleanup,
+                                     &barrier_traits);
+}
diff --git a/src/lib/testing/testing_api_cmd_barrier_reached.c b/src/lib/testing/testing_api_cmd_barrier_reached.c
new file mode 100644
index 000000000..dac0705cf
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_barrier_reached.c
@@ -0,0 +1,182 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_barrier_reached.c
+ * @brief Command to signal barrier was reached.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_testing_lib.h"
+#include "testing_api_loop.h"
+#include "testing_cmds.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+/**
+ * Struct with information for callbacks.
+ *
+ */
+struct BarrierReachedState
+{
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * The label of this command.
+   */
+  const char *label;
+
+  /**
+   * The name of the barrier this commands wait (if finishing asynchronous) for or/and reaches.
+   */
+  const char *barrier_name;
+
+};
+
+
+/**
+ * Run the command.
+ *
+ * @param cls closure.
+ * @param is the interpreter state.
+ */
+static void
+barrier_reached_run (void *cls,
+                     struct GNUNET_TESTING_Interpreter *is)
+{
+  struct BarrierReachedState *brs = cls;
+  struct GNUNET_TESTING_Barrier *barrier;
+
+  barrier = GNUNET_TESTING_get_barrier_ (is,
+                                         brs->barrier_name);
+  if (NULL == barrier)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No barrier `%s'\n",
+                brs->barrier_name);
+    GNUNET_TESTING_async_fail (&brs->ac);
+    return;
+  }
+  if (barrier->satisfied)
+  {
+    GNUNET_TESTING_async_finish (&brs->ac);
+    return;
+  }
+  if (barrier->inherited)
+  {
+    struct GNUNET_TESTING_CommandBarrierReached cbr = {
+      .header.size = htons (sizeof (cbr)),
+      .header.type = htons (GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_REACHED)
+    };
+
+    GNUNET_TESTING_barrier_name_hash_ (brs->barrier_name,
+                                       &cbr.barrier_key);
+    GNUNET_TESTING_loop_notify_parent_ (is,
+                                        &cbr.header);
+    return;
+  }
+  barrier->reached++;
+  if (barrier->reached == barrier->expected_reaches)
+  {
+    struct GNUNET_TESTING_CommandBarrierSatisfied cbs = {
+      .header.size = htons (sizeof (cbs)),
+      .header.type = htons (GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_CROSSABLE)
+    };
+
+    GNUNET_TESTING_barrier_name_hash_ (brs->barrier_name,
+                                       &cbs.barrier_key);
+    barrier->satisfied = true;
+    GNUNET_TESTING_loop_notify_children_ (is,
+                                          &cbs.header);
+  }
+  if (barrier->satisfied)
+  {
+    GNUNET_TESTING_async_finish (&brs->ac);
+    return;
+  }
+  barrier->cmd_ac = &brs->ac;
+}
+
+
+/**
+ * Cleanup the state from a "barrier reached" CMD, and possibly
+ * cancel a pending operation thereof.
+ *
+ * @param cls closure.
+ */
+static void
+barrier_reached_cleanup (void *cls)
+{
+  struct BarrierReachedState *brs = cls;
+
+  GNUNET_free (brs);
+}
+
+
+/**
+ * Offer internal data from a "batch" CMD, to other commands.
+ *
+ * @param cls closure.
+ * @param[out] ret result.
+ * @param trait name of the trait.
+ * @param index index number of the object to offer.
+ * @return #GNUNET_OK on success.
+ */
+static enum GNUNET_GenericReturnValue
+barrier_reached_traits (void *cls,
+                        const void **ret,
+                        const char *trait,
+                        unsigned int index)
+{
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_trait_end ()
+  };
+
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_barrier_reached (
+  const char *label,
+  const char *barrier_label)
+{
+  struct BarrierReachedState *brs;
+
+  brs = GNUNET_new (struct BarrierReachedState);
+  brs->label = label;
+  brs->barrier_name = barrier_label;
+  return GNUNET_TESTING_command_new_ac (
+    brs,
+    label,
+    &barrier_reached_run,
+    &barrier_reached_cleanup,
+    &barrier_reached_traits,
+    &brs->ac);
+}
diff --git a/src/lib/testing/testing_api_cmd_batch.c b/src/lib/testing/testing_api_cmd_batch.c
new file mode 100644
index 000000000..3aeaa5bfb
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_batch.c
@@ -0,0 +1,210 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_batch.c
+ * @brief Implement batch-execution of CMDs.
+ * @author Marcello Stanisci (GNU Taler testing)
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_testing_ng_lib.h"
+#include "testing.h"
+
+/**
+ * State for a "batch" CMD.
+ */
+struct BatchState
+{
+  /**
+   * CMDs batch.
+   */
+  struct GNUNET_TESTING_Command *batch;
+
+  /**
+   * Our label.
+   */
+  struct GNUNET_TESTING_CommandLabel label;
+
+  /**
+   * Internal command pointer.
+   */
+  unsigned int batch_ip;
+};
+
+
+/**
+ * Run the command.
+ *
+ * @param cls closure.
+ * @param is the interpreter state.
+ */
+static void
+batch_run (void *cls,
+           struct GNUNET_TESTING_Interpreter *is)
+{
+  struct BatchState *bs = cls;
+
+  if (NULL != bs->batch[bs->batch_ip].run)
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Running batched command: %s\n",
+                bs->batch[bs->batch_ip].label.value);
+
+  /* hit end command, leap to next top-level command.  */
+  if (NULL == bs->batch[bs->batch_ip].run)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Exiting from batch: %s\n",
+                bs->label.value);
+    return;
+  }
+  bs->batch[bs->batch_ip].start_time
+    = bs->batch[bs->batch_ip].last_req_time
+      = GNUNET_TIME_absolute_get ();
+  bs->batch[bs->batch_ip].num_tries = 1;
+  bs->batch[bs->batch_ip].run (bs->batch[bs->batch_ip].cls,
+                               is);
+}
+
+
+/**
+ * Cleanup the state from a "reserve status" CMD, and possibly
+ * cancel a pending operation thereof.
+ *
+ * @param cls closure.
+ */
+static void
+batch_cleanup (void *cls)
+{
+  struct BatchState *bs = cls;
+
+  for (unsigned int i = 0;
+       NULL != bs->batch[i].run;
+       i++)
+    bs->batch[i].cleanup (bs->batch[i].cls);
+  GNUNET_free (bs->batch);
+  GNUNET_free (bs);
+}
+
+
+/**
+ * Offer internal data from a "batch" CMD, to other commands.
+ *
+ * @param cls closure.
+ * @param[out] ret result.
+ * @param trait name of the trait.
+ * @param index index number of the object to offer.
+ * @return #GNUNET_OK on success.
+ */
+static enum GNUNET_GenericReturnValue
+batch_traits (void *cls,
+              const void **ret,
+              const char *trait,
+              unsigned int index)
+{
+  struct BatchState *bs = cls;
+  // FIXME: these constants should be more global!
+#define CURRENT_CMD_INDEX 0
+#define BATCH_INDEX 1
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_make_trait_cmd (CURRENT_CMD_INDEX,
+                                   &bs->batch[bs->batch_ip]),
+    GNUNET_TESTING_make_trait_cmd (BATCH_INDEX,
+                                   bs->batch),
+    GNUNET_TESTING_trait_end ()
+  };
+
+  /* Always return current command.  */
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+
+/**
+ * Create a "batch" command.  Such command takes a
+ * end_CMD-terminated array of CMDs and executed them.
+ * Once it hits the end CMD, it passes the control
+ * to the next top-level CMD, regardless of it being
+ * another batch or ordinary CMD.
+ *
+ * @param label the command label.
+ * @param batch array of CMDs to execute.
+ *
+ * @return the command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_batch (const char *label,
+                          struct GNUNET_TESTING_Command *batch)
+{
+  struct BatchState *bs;
+  unsigned int i;
+
+  bs = GNUNET_new (struct BatchState);
+  GNUNET_TESTING_set_label (&bs->label,
+                            label);
+  /* Get number of commands.  */
+  for (i = 0; NULL != batch[i].run; i++)
+    /* noop */
+    ;
+
+  bs->batch = GNUNET_new_array (i + 1,
+                                struct GNUNET_TESTING_Command);
+  memcpy (bs->batch,
+          batch,
+          sizeof (struct GNUNET_TESTING_Command) * i);
+  return GNUNET_TESTING_command_new (bs,
+                                     label,
+                                     &batch_run,
+                                     &batch_cleanup,
+                                     &batch_traits);
+}
+
+
+bool
+GNUNET_TESTING_cmd_batch_next_ (void *cls)
+{
+  struct BatchState *bs = cls;
+
+  if (NULL == bs->batch[bs->batch_ip].run)
+    return false;
+  bs->batch[bs->batch_ip].finish_time
+    = GNUNET_TIME_absolute_get ();
+  bs->batch_ip++;
+  return true;
+}
+
+
+bool
+GNUNET_TESTING_cmd_is_batch_ (const struct GNUNET_TESTING_Command *cmd)
+{
+  return cmd->run == &batch_run;
+}
+
+
+struct GNUNET_TESTING_Command *
+GNUNET_TESTING_cmd_batch_get_current_ (const struct GNUNET_TESTING_Command *cmd)
+{
+  struct BatchState *bs = cmd->cls;
+
+  GNUNET_assert (GNUNET_TESTING_cmd_is_batch_ (cmd));
+  return &bs->batch[bs->batch_ip];
+}
diff --git a/src/lib/testing/testing_api_cmd_batch.h b/src/lib/testing/testing_api_cmd_batch.h
new file mode 100644
index 000000000..4b4d041d7
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_batch.h
@@ -0,0 +1,61 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing_api_cmd_batch.h
+ * @brief
+ * @author t3sserakt
+ */
+#ifndef TESTING_API_CMD_BATCH_H
+#define TESTING_API_CMD_BATCH_H
+
+
+/**
+ * Test if this command is a batch command.
+ *
+ * @return false if not, true if it is a batch command
+ */
+bool
+GNUNET_TESTING_cmd_is_batch_ (
+  const struct GNUNET_TESTING_Command *cmd);
+
+
+/**
+ * Advance internal pointer to next command.
+ *
+ * @param cls batch internal state
+ * @return true if we could advance, false if the batch
+ *         has completed and cannot advance anymore
+ */
+bool
+GNUNET_TESTING_cmd_batch_next_ (void *cls);
+
+
+/**
+ * Obtain what command the batch is at.
+ *
+ * @return cmd current batch command
+ */
+struct GNUNET_TESTING_Command *
+GNUNET_TESTING_cmd_batch_get_current_ (
+  const struct GNUNET_TESTING_Command *cmd);
+
+
+#endif
diff --git a/src/lib/testing/testing_api_cmd_exec.c b/src/lib/testing/testing_api_cmd_exec.c
new file mode 100644
index 000000000..e452ce4b3
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_exec.c
@@ -0,0 +1,180 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2023 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing_api_cmd_exec.c
+ * @brief cmd to block the interpreter loop until all peers started.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+struct BashScriptState
+{
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * Callback handed over to the command, which should
+   * be called upon death or completion of the script.
+   */
+  GNUNET_ChildCompletedCallback cb;
+
+  /**
+   * Wait for death of @e start_proc.
+   */
+  struct GNUNET_ChildWaitHandle *cwh;
+
+  /**
+  * The process id of the script.
+  */
+  struct GNUNET_OS_Process *start_proc;
+
+  /**
+   * Arguments for the script
+   */
+  char *const*script_argv;
+
+  /**
+   *
+   */
+  enum GNUNET_OS_ProcessStatusType expected_type;
+
+  /**
+   *
+   */
+  unsigned long int expected_exit_code;
+
+};
+
+/**
+ * The cleanup function of this cmd frees resources the cmd allocated.
+ *
+ */
+static void
+exec_bash_script_cleanup (void *cls)
+{
+  struct BashScriptState *bss = cls;
+
+  if (NULL != bss->cwh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Cancel child\n");
+    GNUNET_wait_child_cancel (bss->cwh);
+    bss->cwh = NULL;
+  }
+  if (NULL != bss->start_proc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Kill process\n");
+    GNUNET_assert (0 ==
+                   GNUNET_OS_process_kill (bss->start_proc,
+                                           SIGKILL));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_OS_process_wait (bss->start_proc));
+    GNUNET_OS_process_destroy (bss->start_proc);
+    bss->start_proc = NULL;
+  }
+  GNUNET_free (bss);
+}
+
+
+/**
+ * Callback which will be called if the setup script finished.
+ *
+ */
+static void
+child_completed_callback (void *cls,
+                          enum GNUNET_OS_ProcessStatusType type,
+                          long unsigned int exit_code)
+{
+  struct BashScriptState *bss = cls;
+
+  GNUNET_OS_process_destroy (bss->start_proc);
+  bss->start_proc = NULL;
+  bss->cwh = NULL;
+  if ( (bss->expected_type != type) ||
+       (bss->expected_exit_code != exit_code) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Child failed with error %lu!\n",
+                exit_code);
+    GNUNET_TESTING_async_fail (&bss->ac);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Child succeeded!\n");
+  GNUNET_TESTING_async_finish (&bss->ac);
+}
+
+
+/**
+ * Run method of the command created by the interpreter to wait for another
+ * command to finish.
+ *
+ */
+static void
+exec_bash_script_run (void *cls,
+                      struct GNUNET_TESTING_Interpreter *is)
+{
+  struct BashScriptState *bss = cls;
+
+  bss->start_proc
+    = GNUNET_OS_start_process_vap (
+        GNUNET_OS_INHERIT_STD_ERR,
+        NULL,
+        NULL,
+        NULL,
+        bss->script_argv[0],
+        bss->script_argv);
+  bss->cwh = GNUNET_wait_child (bss->start_proc,
+                                &child_completed_callback,
+                                bss);
+  GNUNET_break (NULL != bss->cwh);
+}
+
+
+// FIXME: support variadic style...
+const struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_exec (
+  const char *label,
+  enum GNUNET_OS_ProcessStatusType expected_type,
+  unsigned long int expected_exit_code,
+  char *const script_argv[])
+{
+  struct BashScriptState *bss;
+
+  bss = GNUNET_new (struct BashScriptState);
+  bss->script_argv = script_argv; // FIXME: make copy?
+  bss->expected_type = expected_type;
+  bss->expected_exit_code = expected_exit_code;
+  return GNUNET_TESTING_command_new_ac (
+    bss,
+    label,
+    &exec_bash_script_run,
+    &exec_bash_script_cleanup,
+    NULL,
+    &bss->ac);
+}
diff --git a/src/lib/testing/testing_api_cmd_finish.c b/src/lib/testing/testing_api_cmd_finish.c
new file mode 100644
index 000000000..7abcb5bb9
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_finish.c
@@ -0,0 +1,215 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file testing/testing_api_cmd_finish.c
+ * @brief command to wait for completion of async command
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+
+/**
+ * Struct to use for command-specific context information closure of a command waiting
+ * for another command.
+ */
+struct FinishState
+{
+  /**
+   * Closure for all commands with command-specific context information.
+   */
+  void *cls;
+
+  /**
+   * Label of the asynchronous command the synchronous command of this closure
+   * waits for.
+   */
+  const char *async_label;
+
+  /**
+   * Function to call when async operation is done.
+   */
+  GNUNET_SCHEDULER_TaskCallback old_notify;
+
+  /**
+   * Closure for @e notify_finished.
+   */
+  void *old_notify_cls;
+
+  /**
+   * Task for running the finish method of the asynchronous task the command
+   * is waiting for.
+   */
+  struct GNUNET_SCHEDULER_Task *finish_task;
+
+  /**
+   * Function to call when done.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * How long to wait until finish fails hard?
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+};
+
+
+/**
+ * Function called when the command we are waiting on
+ * is finished. Hence we are finished, too.
+ *
+ * @param cls a `struct FinishState` being notified
+ */
+static void
+done_finish (void *cls)
+{
+  struct FinishState *finish_state = cls;
+
+  GNUNET_SCHEDULER_cancel (finish_state->finish_task);
+  finish_state->finish_task = NULL;
+  if (NULL != finish_state->old_notify)
+  {
+    finish_state->old_notify (finish_state->old_notify_cls);
+    finish_state->old_notify = NULL;
+  }
+  GNUNET_TESTING_async_finish (&finish_state->ac);
+}
+
+
+/**
+ * Function triggered if the command we are waiting
+ * for did not complete on time.
+ *
+ * @param cls our `struct FinishState`
+ */
+static void
+timeout_finish (void *cls)
+{
+  struct FinishState *finish_state = cls;
+
+  finish_state->finish_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Timeout waiting for command `%s' to finish\n",
+              finish_state->async_label);
+  GNUNET_TESTING_async_fail (&finish_state->ac);
+}
+
+
+/**
+ * Run method of the command created by the interpreter to wait for another
+ * command to finish.
+ *
+ */
+static void
+run_finish (void *cls,
+            struct GNUNET_TESTING_Interpreter *is)
+{
+  struct FinishState *finish_state = cls;
+  const struct GNUNET_TESTING_Command *async_cmd;
+  struct GNUNET_TESTING_AsyncContext *aac;
+
+  async_cmd
+    = GNUNET_TESTING_interpreter_lookup_command (is,
+                                                 finish_state->async_label);
+  if (NULL == async_cmd)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Did not find command `%s'\n",
+                finish_state->async_label);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+  if ( (NULL == (aac = async_cmd->ac)) ||
+       (! async_cmd->asynchronous_finish) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Cannot finish `%s': not asynchronous\n",
+                finish_state->async_label);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+  if (GNUNET_NO != aac->finished)
+  {
+    /* Command is already finished, so are we! */
+    GNUNET_TESTING_async_finish (&finish_state->ac);
+    return;
+  }
+  /* add timeout */
+  finish_state->finish_task
+    = GNUNET_SCHEDULER_add_delayed (finish_state->timeout,
+                                    &timeout_finish,
+                                    finish_state);
+  /* back up old notification that we will override */
+  finish_state->old_notify = aac->notify_finished;
+  finish_state->old_notify_cls = aac->notify_finished_cls;
+  aac->notify_finished = &done_finish;
+  aac->notify_finished_cls = finish_state;
+}
+
+
+/**
+ * Cleanup state of a finish command.
+ *
+ * @param cls a `struct FinishState` to clean up
+ */
+static void
+cleanup_finish (void *cls)
+{
+  struct FinishState *finish_state = cls;
+
+  if (NULL != finish_state->finish_task)
+  {
+    GNUNET_SCHEDULER_cancel (finish_state->finish_task);
+    finish_state->finish_task = NULL;
+  }
+  GNUNET_free (finish_state);
+}
+
+
+const struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_finish (const char *finish_label,
+                           const char *cmd_ref,
+                           struct GNUNET_TIME_Relative timeout)
+{
+  struct FinishState *finish_state;
+
+  finish_state = GNUNET_new (struct FinishState);
+  finish_state->async_label = cmd_ref;
+  finish_state->timeout = timeout;
+  return GNUNET_TESTING_command_new_ac (finish_state,
+                                        finish_label,
+                                        &run_finish,
+                                        &cleanup_finish,
+                                        NULL,
+                                        &finish_state->ac);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_make_unblocking (struct GNUNET_TESTING_Command cmd)
+{
+  /* do not permit this function to be used on
+     a finish command! */
+  GNUNET_assert (cmd.run != &run_finish);
+  cmd.asynchronous_finish = true;
+  return cmd;
+}
diff --git a/src/lib/testing/testing_api_cmd_get_topo_from_file.c b/src/lib/testing/testing_api_cmd_get_topo_from_file.c
new file mode 100644
index 000000000..e38b81f24
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_get_topo_from_file.c
@@ -0,0 +1,161 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_netjail_start.c
+ * @brief Command to start the netjail script.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+struct TopologyState
+{
+  /**
+   * The label of the command.
+   */
+  char *label;
+
+  /**
+   * The topology we parsed.
+   */
+  struct GNUNET_TESTING_NetjailTopology *topology;
+
+  /**
+   * A string with the name of the topology file, if @e read_file is true,
+   * otherwise a string containing the topology data.
+   */
+  char *topology_string;
+
+  /**
+   * A string with the name of the topology file.
+   */
+  char *file_name;
+}
+
+/**
+ * The cleanup function of this cmd frees resources the cmd allocated.
+ *
+ */
+static void
+cleanup (void *cls)
+{
+  struct NetJailState *ts = cls;
+
+  GNUNET_free (ts);
+}
+
+/**
+ * This function prepares an array with traits.
+ */
+static enum GNUNET_GenericReturnValue
+traits (void *cls,
+                     const void **ret,
+                     const char *trait,
+                     unsigned int index)
+{
+  struct NetJailState *ts = cls;
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_make_trait_get_topology ((const void *) ts->topology),
+    GNUNET_TESTING_make_trait_get_topology_string ((const void *) ts->topology_string),
+    GNUNET_TESTING_trait_end ()
+  };
+
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+static char *
+get_topo_string_from_file (char *topology_data_file)
+{
+  uint64_t fs;
+  char *data;
+
+  if (GNUNET_YES !=
+      GNUNET_DISK_file_test (topology_data_file))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Topology file %s not found\n",
+         topology_data_file);
+    GNUNET_assert (0);
+  }
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_size (topology_data_file,
+                             &fs,
+                             GNUNET_YES,
+                             GNUNET_YES))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Could not determine size of topology file %s\n",
+         topology_data_file);
+    GNUNET_assert (0);
+  }
+  data = GNUNET_malloc_large (fs + 1);
+  GNUNET_assert (NULL != data);
+  if (fs !=
+      GNUNET_DISK_fn_read (topology_data_file,
+                           data,
+                           fs))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Topology file %s cannot be read\n",
+         topology_data_file);
+    GNUNET_free (data);
+    return NULL;
+  }
+  return data;
+}
+
+/**
+* The run method starts the script which setup the network namespaces.
+*
+* @param cls closure.
+* @param is interpreter state.
+*/
+static void
+run (void *cls,
+                   struct GNUNET_TESTING_Interpreter *is)
+{
+  struct TopologyState *ts = cls;
+
+  ts->topology_string = get_topo_string_from_file (ts->file_name);
+  ts->topology = GNUNET_TESTING_get_topo_from_string (ts->topology_string);
+}
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_get_topo_from_file (
+                                     const char *label,
+                                     char *file_name)
+{
+  struct TopologyState *ts;
+
+  ts = GNUNET_new (struct TopologyState);
+  ts->label = label;
+  ts->file_name = file_name;
+  return GNUNET_TESTING_command_new_ac (
+    ts,
+    label,
+    &run,
+    &cleanup,
+    traits,
+    &ts->ac);
+}
diff --git a/src/lib/testing/testing_api_cmd_get_topo_from_string.c b/src/lib/testing/testing_api_cmd_get_topo_from_string.c
new file mode 100644
index 000000000..777e8ae2a
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_get_topo_from_string.c
@@ -0,0 +1,119 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_netjail_start.c
+ * @brief Command to start the netjail script.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+struct TopologyState
+{
+  /**
+   * The label of the command.
+   */
+  char *label;
+
+  /**
+   * The topology we parsed.
+   */
+  struct GNUNET_TESTING_NetjailTopology *topology;
+
+  /**
+   * A string with the name of the topology file, if @e read_file is true,
+   * otherwise a string containing the topology data.
+   */
+  char *topology_string;
+
+  /**
+   * Are we reading from file, or did we get a string with the topology data?
+   */
+  bool read_file;
+}
+
+/**
+ * The cleanup function of this cmd frees resources the cmd allocated.
+ *
+ */
+static void
+netjail_topology_cleanup (void *cls)
+{
+  struct NetJailState *ts = cls;
+
+  GNUNET_free (ts);
+}
+
+/**
+ * This function prepares an array with traits.
+ */
+static enum GNUNET_GenericReturnValue
+netjail_topology_traits (void *cls,
+                     const void **ret,
+                     const char *trait,
+                     unsigned int index)
+{
+  struct NetJailState *ts = cls;
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_make_trait_get_topology ((const void *) ts->topology),
+    GNUNET_TESTING_make_trait_get_topology_string ((const void *) ts->topology_string),
+    GNUNET_TESTING_trait_end ()
+  };
+
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+/**
+* The run method starts the script which setup the network namespaces.
+*
+* @param cls closure.
+* @param is interpreter state.
+*/
+static void
+netjail_topology_run (void *cls,
+                   struct GNUNET_TESTING_Interpreter *is)
+{
+  struct TopologyState *ts = cls;
+
+  ts->topology = GNUNET_TESTING_get_topo_from_string (topology_string);
+}
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_get_topo_from_string (
+                                     const char *label,
+                                     char *topology_string)
+{
+  struct TopologyState *ts;
+
+  ts = GNUNET_new (struct TopologyState);
+  ts->label = label;
+  ts->topology_string = topology_string;
+  return GNUNET_TESTING_command_new_ac (
+    ts,
+    label,
+    &run,
+    &cleanup,
+    traits,
+    &ts->ac);
+}
diff --git a/src/lib/testing/testing_api_cmd_netjail_start.c b/src/lib/testing/testing_api_cmd_netjail_start.c
new file mode 100644
index 000000000..e81622133
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_netjail_start.c
@@ -0,0 +1,223 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_cmd_netjail_start.c
+ * @brief Command to start the netjail script.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+/**
+ * Struct to hold information for callbacks.
+ *
+ */
+struct NetJailState
+{
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  struct GNUNET_ChildWaitHandle *cwh;
+
+  /**
+   * The process id of the start script.
+   */
+  struct GNUNET_OS_Process *start_proc;
+
+  /**
+   * Configuration file for the test topology.
+   */
+  const char *topology_cmd_label;
+
+  /**
+   * Start or stop?
+   */
+  const char *script;
+
+};
+
+
+/**
+ * The cleanup function of this cmd frees resources the cmd allocated.
+ *
+ */
+static void
+netjail_start_cleanup (void *cls)
+{
+  struct NetJailState *ns = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "netjail_start_cleanup!\n");
+  if (NULL != ns->cwh)
+  {
+    GNUNET_wait_child_cancel (ns->cwh);
+    ns->cwh = NULL;
+  }
+  if (NULL != ns->start_proc)
+  {
+    GNUNET_assert (0 ==
+                   GNUNET_OS_process_kill (ns->start_proc,
+                                           SIGKILL));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_OS_process_wait (ns->start_proc));
+    GNUNET_OS_process_destroy (ns->start_proc);
+    ns->start_proc = NULL;
+  }
+  GNUNET_free (ns);
+}
+
+
+/**
+ * Callback which will be called if the setup script finished.
+ */
+static void
+child_completed_callback (void *cls,
+                          enum GNUNET_OS_ProcessStatusType type,
+                          unsigned long int exit_code)
+{
+  struct NetJailState *ns = cls;
+
+  GNUNET_OS_process_destroy (ns->start_proc);
+  ns->start_proc = NULL;
+  ns->cwh = NULL;
+  if ( (GNUNET_OS_PROCESS_EXITED != type) ||
+       (0 != exit_code) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Child failed with error %lu!\n",
+                exit_code);
+    GNUNET_TESTING_async_fail (&ns->ac);
+    return;
+  }
+  GNUNET_TESTING_async_finish (&ns->ac);
+}
+
+
+/**
+* The run method starts the script which setup the network namespaces.
+*
+* @param cls closure.
+* @param is interpreter state.
+*/
+static void
+netjail_start_run (void *cls,
+                   struct GNUNET_TESTING_Interpreter *is)
+{
+  struct NetJailState *ns = cls;
+  const struct GNUNET_TESTING_Command *topo_cmd;
+  char pid[15];
+  enum GNUNET_GenericReturnValue helper_check;
+  char *data_dir;
+  char *script_name;
+  const char *topology_data;
+
+  topo_cmd = GNUNET_TESTING_interpreter_lookup_command (
+    is,
+    ns->topology_cmd_label);
+  if (NULL == topo_cmd)
+  {
+    GNUNET_break (0);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+  // FIXME: get topology_data from topo_cmd trait!
+  data_dir = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DATADIR);
+  GNUNET_asprintf (&script_name,
+                   "%s%s",
+                   data_dir,
+                   ns->script);
+  helper_check = GNUNET_OS_check_helper_binary (
+    script_name,
+    GNUNET_YES,
+    NULL);
+  if (GNUNET_NO == helper_check)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No SUID for %s!\n",
+                script_name);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+  if (GNUNET_SYSERR == helper_check)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "%s not found!\n",
+                script_name);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+
+  GNUNET_snprintf (pid,
+                   sizeof (pid),
+                   "%u",
+                   getpid ());
+  {
+    char *const script_argv[] = {
+      script_name,
+      (char *) topology_data,
+      pid, // FIXME: use $PPID!
+      "0",
+      NULL
+    };
+
+    ns->start_proc
+      = GNUNET_OS_start_process_vap (GNUNET_OS_INHERIT_STD_ERR,
+                                     NULL,
+                                     NULL,
+                                     NULL,
+                                     script_name,
+                                     script_argv);
+
+  }
+  ns->cwh = GNUNET_wait_child (ns->start_proc,
+                               &child_completed_callback,
+                               ns);
+  GNUNET_break (NULL != ns->cwh);
+  GNUNET_free (script_name);
+  GNUNET_free (data_dir);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_netjail_setup (
+  const char *label,
+  const char *script,
+  const char *topology_cmd_label)
+{
+  struct NetJailState *ns;
+
+  ns = GNUNET_new (struct NetJailState);
+  ns->script = script;
+  ns->topology_cmd_label = topology_cmd_label;
+  return GNUNET_TESTING_command_new_ac (
+    ns,
+    label,
+    &netjail_start_run,
+    &netjail_start_cleanup,
+    NULL,
+    &ns->ac);
+}
diff --git a/src/lib/testing/testing_api_cmd_netjail_start_cmds_helper.c b/src/lib/testing/testing_api_cmd_netjail_start_cmds_helper.c
new file mode 100644
index 000000000..4236f0da2
--- /dev/null
+++ b/src/lib/testing/testing_api_cmd_netjail_start_cmds_helper.c
@@ -0,0 +1,555 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file testing/testing_api_cmd_netjail_start_cmds_helper.c
+ * @brief Command to start the netjail peers.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "barrier.h"
+#include "netjail.h"
+#include "testing_api_loop.h"
+#include "testing_cmds.h"
+#include "netjail.h"
+
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+ * Struct containing the number of the netjail node and the NetJailState which
+ * will be handed to callbacks specific to a test environment.
+ */
+struct TestingSystemCount;
+
+
+/**
+ * Struct to store information handed over to callbacks.
+ */
+struct NetJailState
+{
+  /**
+   * Global state of the interpreter, used by a command
+   * to access information about other commands.
+   */
+  struct GNUNET_TESTING_Interpreter *is;
+
+  /**
+   * Context for our asynchronous completion.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+  /**
+   * Command with topology data.
+   */
+  const char *topology_cmd_label;
+
+  /**
+   * Array with handles of helper processes.
+   */
+  struct GNUNET_HELPER_Handle **helpers;
+
+  /**
+   * Time after this cmd has to finish.
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * Timeout task.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct TestingSystemCount *tbc_head;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct TestingSystemCount *tbc_tail;
+
+  char *topology_data;
+
+  /**
+   * Size of the array @e helpers.
+   */
+  unsigned int n_helpers;
+
+  /**
+   * Counts number of helpers that finished.
+   */
+  unsigned int n_finished;
+
+  /**
+   * Set to true if we already failed the command.
+   */
+  bool failed;
+};
+
+/**
+ * Struct containing the number of the netjail node and the NetJailState which
+ * will be handed to callbacks specific to a test environment.
+ */
+struct TestingSystemCount
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct TestingSystemCount *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct TestingSystemCount *prev;
+
+  /**
+   * The send handle for the helper
+   */
+  struct GNUNET_HELPER_SendHandle *shandle;
+
+  /**
+   * Struct to store information handed over to callbacks.
+   */
+  struct NetJailState *ns;
+
+
+};
+
+
+/**
+ * Continuation function from GNUNET_HELPER_send()
+ *
+ * @param cls closure
+ * @param result #GNUNET_OK on success,
+ *               #GNUNET_NO if helper process died
+ *               #GNUNET_SYSERR during GNUNET_HELPER_stop
+ */
+static void
+clear_msg (void *cls,
+           enum GNUNET_GenericReturnValue result)
+{
+  struct TestingSystemCount *tbc = cls;
+  struct NetJailState *ns = tbc->ns;
+
+  GNUNET_assert (NULL != tbc->shandle);
+  tbc->shandle = NULL;
+  GNUNET_CONTAINER_DLL_remove (ns->tbc_head,
+                               ns->tbc_tail,
+                               tbc);
+  GNUNET_free (tbc);
+  if ( (! ns->failed) &&
+       (GNUNET_OK != result) )
+  {
+    ns->failed = true;
+    GNUNET_TESTING_interpreter_fail (ns->is);
+  }
+}
+
+
+static void
+handle_helper_barrier_reached (
+  void *cls,
+  const struct GNUNET_TESTING_CommandBarrierReached *rm)
+{
+  struct NetJailState *ns = cls;
+  struct GNUNET_TESTING_Barrier *barrier;
+
+  barrier = GNUNET_TESTING_get_barrier2_ (ns->is,
+                                          &rm->barrier_key);
+  if (NULL == barrier)
+  {
+    if (! ns->failed)
+    {
+      ns->failed = true;
+      GNUNET_TESTING_async_fail (&ns->ac);
+    }
+    return;
+  }
+  if (barrier->inherited)
+  {
+    /* pass on to parent */
+    GNUNET_TESTING_loop_notify_parent_ (ns->is,
+                                        &rm->header);
+  }
+  else
+  {
+    barrier->reached++;
+    if (barrier->reached == barrier->expected_reaches)
+    {
+      struct GNUNET_TESTING_CommandBarrierSatisfied cbs = {
+        .header.size
+          = htons (sizeof (cbs)),
+        .header.type
+          = htons (GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_CROSSABLE),
+        .barrier_key
+          = rm->barrier_key
+      };
+
+      GNUNET_assert (! barrier->satisfied);
+      barrier->satisfied = true;
+      /* unblock children */
+      GNUNET_TESTING_loop_notify_children_ (ns->is,
+                                            &cbs.header);
+      /* unblock self */
+      if (NULL != barrier->cmd_ac)
+        GNUNET_TESTING_async_finish (barrier->cmd_ac);
+    }
+  }
+}
+
+
+static void
+handle_helper_local_finished (
+  void *cls,
+  const struct GNUNET_TESTING_CommandLocalFinished *lf)
+{
+  struct NetJailState *ns = cls;
+
+  ns->n_finished++;
+  if ( (! ns->failed) &&
+       (GNUNET_OK != ntohl (lf->rv)) )
+  {
+    ns->failed = true;
+    GNUNET_TESTING_async_fail (&ns->ac);
+    return;
+  }
+  if (ns->n_finished == ns->n_helpers)
+  {
+    GNUNET_SCHEDULER_cancel (ns->timeout_task);
+    ns->timeout_task = NULL;
+    GNUNET_TESTING_async_finish (&ns->ac);
+  }
+}
+
+
+/**
+ * Functions with this signature are called whenever a
+ * complete message is received by the tokenizer.
+ *
+ * Do not call GNUNET_SERVER_mst_destroy in callback
+ *
+ * @param cls closure
+ * @param message the actual message
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR to stop further processing
+ */
+static enum GNUNET_GenericReturnValue
+helper_mst (void *cls,
+            const struct GNUNET_MessageHeader *message)
+{
+  struct NetJailState *ns = cls;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (
+      helper_barrier_reached,
+      GNUNET_MESSAGE_TYPE_CMDS_HELPER_BARRIER_REACHED,
+      struct GNUNET_TESTING_CommandBarrierReached,
+      ns),
+    GNUNET_MQ_hd_fixed_size (
+      helper_local_finished,
+      GNUNET_MESSAGE_TYPE_CMDS_HELPER_LOCAL_FINISHED,
+      struct GNUNET_TESTING_CommandLocalFinished,
+      ns),
+    GNUNET_MQ_handler_end ()
+  };
+  enum GNUNET_GenericReturnValue ret;
+
+  ret = GNUNET_MQ_handle_message (handlers,
+                                  message);
+  if (GNUNET_OK != ret)
+  {
+    GNUNET_break (0);
+    if (! ns->failed)
+    {
+      ns->failed = true;
+      GNUNET_TESTING_async_fail (&ns->ac);
+    }
+  }
+  return ret;
+}
+
+
+/**
+ * Callback called if there was an exception during execution of the helper.
+ */
+static void
+exp_cb (void *cls)
+{
+  struct NetJailState *ns = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Called exp_cb.\n");
+  if (NULL != ns->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (ns->timeout_task);
+    ns->timeout_task = NULL;
+  }
+  if (! ns->failed)
+    GNUNET_TESTING_async_fail (&ns->ac);
+}
+
+
+/**
+ * @return true on success
+ */
+static bool
+send_start_messages (struct NetJailState *ns,
+                     struct GNUNET_HELPER_Handle *helper)
+{
+  struct GNUNET_TESTING_Interpreter *is = ns->is;
+  const struct GNUNET_TESTING_Command *topo_cmd;
+  struct GNUNET_TESTING_CommandHelperInit *msg;
+  struct TestingSystemCount *tbc;
+  struct GNUNET_ShortHashCode *bar;
+  unsigned int num_barriers = 0;
+  size_t topo_length;
+  size_t msg_len;
+
+  topo_cmd = GNUNET_TESTING_interpreter_lookup_command (is,
+                                                   ns->topology_cmd_label);
+  GNUNET_TESTING_get_trait_get_topology_string (topo_cmd,
+                                                &ns->topology_data);
+  topo_length = strlen (ns->topology_data) + 1;
+  msg_len = sizeof (*msg) + topo_length
+            + num_barriers * sizeof (struct GNUNET_ShortHashCode);
+  // FIXME: check for integer arithmetic overflow in the above code; theoretically.
+  if (msg_len > UINT16_MAX)
+  {
+    /* ask a wizzard to enhance the protocol;
+       start with gzip topology_data? multiple
+       init messages for barriers + topo data,
+       etc.*/
+    GNUNET_break (0);
+    return false;
+  }
+  msg = GNUNET_malloc (msg_len);
+  msg->header.size = htons ((uint16_t) msg_len);
+  msg->header.type = htons (GNUNET_MESSAGE_TYPE_CMDS_HELPER_INIT);
+  bar = (struct GNUNET_ShortHashCode *) &msg[1];
+  // FIXME: iterate over barriers...
+  memcpy (&bar[num_barriers],
+          ns->topology_data,
+          topo_length);
+  tbc = GNUNET_new (struct TestingSystemCount);
+  tbc->ns = ns;
+  tbc->shandle = GNUNET_HELPER_send (
+    helper,
+    &msg->header,
+    GNUNET_NO,
+    &clear_msg,
+    tbc);
+  GNUNET_free (msg);
+  if (NULL == tbc->shandle)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Send handle is NULL!\n");
+    GNUNET_free (tbc);
+    return false;
+  }
+  GNUNET_CONTAINER_DLL_insert (ns->tbc_head,
+                               ns->tbc_tail,
+                               tbc);
+  return true;
+}
+
+
+/**
+ * Function which start a single helper process.
+ * @return true on success
+ */
+static bool
+start_helper (struct NetJailState *ns,
+              unsigned int script_num)
+{
+  char *gnunet_cmds_helper
+    = GNUNET_OS_get_libexec_binary_path (HELPER_CMDS_BINARY);
+  char node_id[32];
+  char *const script_argv[] = {
+    "ip",
+    "netns",
+    "exec",
+    node_id,
+    gnunet_cmds_helper,
+    node_id,
+    NULL
+  };
+  struct GNUNET_HELPER_Handle *helper;
+
+  GNUNET_snprintf (node_id,
+                   sizeof (node_id),
+                   "if%06x-%06x\n",
+                   (unsigned int) getpid (),
+                   script_num);
+  helper = GNUNET_HELPER_start (
+    GNUNET_YES,                             /* with control pipe */
+    script_argv[0],
+    script_argv,
+    &helper_mst,
+    &exp_cb,
+    ns);
+  GNUNET_free (gnunet_cmds_helper);
+  if (NULL == helper)
+  {
+    GNUNET_break (0);
+    return false;
+  }
+  GNUNET_array_append (ns->helpers,
+                       ns->n_helpers,
+                       helper);
+  GNUNET_TESTING_add_netjail_helper_ (ns->is,
+                                      helper);
+  return send_start_messages (ns,
+                              helper);
+}
+
+
+/**
+ * Function run when the cmd terminates (good or bad) with timeout.
+ *
+ * @param cls the interpreter state
+ */
+static void
+do_timeout (void *cls)
+{
+  struct NetJailState *ns = cls;
+
+  ns->timeout_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Terminating cmd due to global timeout\n");
+  GNUNET_TESTING_async_finish (&ns->ac);
+}
+
+
+/**
+ * This function starts a helper process for each node.
+ *
+ * @param cls closure.
+ * @param cmd CMD being run.
+ * @param is interpreter state.
+ */
+static void
+netjail_exec_run (void *cls,
+                  struct GNUNET_TESTING_Interpreter *is)
+{
+  struct NetJailState *ns = cls;
+  struct GNUNET_TESTING_NetjailTopology *topology;
+  bool failed = false;
+
+  ns->is = is;
+  topology
+    = GNUNET_TESTING_get_topo_from_string_ (ns->topology_data);
+  for (unsigned int i = 1; i <= topology->total; i++)
+  {
+    if (! start_helper (ns,
+                        i))
+    {
+      failed = true;
+      break;
+    }
+  }
+  GNUNET_TESTING_free_topology (topology);
+  if (failed)
+  {
+    ns->failed = true;
+    GNUNET_TESTING_interpreter_fail (ns->is);
+    return;
+  }
+  ns->timeout_task
+    = GNUNET_SCHEDULER_add_delayed (ns->timeout,
+                                    &do_timeout,
+                                    ns);
+}
+
+
+/**
+ * Code to clean up resource this cmd used.
+ *
+ * @param cls closure
+ */
+static void
+netjail_exec_cleanup (void *cls)
+{
+  struct NetJailState *ns = cls;
+
+  if (NULL != ns->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (ns->timeout_task);
+    ns->timeout_task = NULL;
+  }
+  for (unsigned int i = 0; i<ns->n_helpers; i++)
+    GNUNET_HELPER_stop (ns->helpers[i],
+                        GNUNET_YES);
+  GNUNET_free (ns);
+}
+
+
+/**
+ * This function prepares an array with traits.
+ */
+static enum GNUNET_GenericReturnValue
+netjail_exec_traits (void *cls,
+                     const void **ret,
+                     const char *trait,
+                     unsigned int index)
+{
+  struct NetJailState *ns = cls;
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_trait_end ()
+  };
+
+  (void) ns;
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+
+/**
+ * Create command.
+ *
+ * @param label Name for the command.
+ * @param topology_data topology data
+ * @param timeout Before this timeout is reached this cmd MUST finish.
+ * @return command.
+ */
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_netjail_start_helpers (
+  const char *label,
+  const char *topology_cmd_label,
+  struct GNUNET_TIME_Relative timeout)
+{
+  struct NetJailState *ns;
+
+  ns = GNUNET_new (struct NetJailState);
+  ns->topology_cmd_label = topology_cmd_label;
+  ns->timeout = timeout;
+  return GNUNET_TESTING_command_new_ac (ns,
+                                        label,
+                                        &netjail_exec_run,
+                                        &netjail_exec_cleanup,
+                                        &netjail_exec_traits,
+                                        &ns->ac);
+}
diff --git a/src/lib/testing/testing_api_loop.c b/src/lib/testing/testing_api_loop.c
new file mode 100644
index 000000000..a22e0c3c9
--- /dev/null
+++ b/src/lib/testing/testing_api_loop.c
@@ -0,0 +1,901 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021-2023 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_loop.c
+ * @brief main interpreter loop for testcases
+ * @author Christian Grothoff (GNU Taler testing)
+ * @author Marcello Stanisci (GNU Taler testing)
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "testing_api_loop.h"
+#include "testing_api_cmd_batch.h"
+#include "netjail.h"
+#include "testing_cmds.h"
+
+
+struct SendContext
+{
+  struct SendContext *next;
+  struct SendContext *prev;
+
+  /**
+   * Handle to a send op
+   */
+  struct GNUNET_HELPER_SendHandle *send_handle;
+
+  struct GNUNET_TESTING_Interpreter *is;
+};
+
+/**
+ * Global state of the interpreter, used by a command
+ * to access information about other commands.
+ */
+struct GNUNET_TESTING_Interpreter
+{
+  /**
+   * Array with handles of helper processes for communication with netjails.
+   */
+  struct GNUNET_HELPER_Handle **helpers;
+
+  /**
+   * Function to call with the test result.
+   */
+  GNUNET_TESTING_ResultCallback rc;
+
+  /**
+   * Closure for @e rc.
+   */
+  void *rc_cls;
+
+  /**
+   * Commands the interpreter will run.
+   */
+  struct GNUNET_TESTING_Command *commands;
+
+  /**
+   * Map with barriers for this loop.
+   */
+  struct GNUNET_CONTAINER_MultiShortmap *barriers;
+
+  /**
+   * Interpreter task (if one is scheduled).
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+
+  /**
+   * Final task that returns the result.
+   */
+  struct GNUNET_SCHEDULER_Task *final_task;
+
+  /**
+   * Task run on timeout.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * Hash map mapping variable names to commands.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *vars;
+
+  struct SendContext *sender_head;
+  struct SendContext *sender_tail;
+
+  /**
+   * Function to call to send messages to our parent.
+   */
+  GNUNET_TESTING_cmd_helper_write_cb parent_writer;
+
+  /**
+   * Number of GNUNET_TESTING_Command in @e commands.
+   */
+  unsigned int cmds_n;
+
+  /**
+   * Size of the array @e helpers.
+   */
+  unsigned int n_helpers;
+
+  /**
+   * Instruction pointer.  Tells #interpreter_run() which instruction to run
+   * next.  Need (signed) int because it gets -1 when rewinding the
+   * interpreter to the first CMD.
+   */
+  int ip;
+
+  /**
+   * Result of the testcases, #GNUNET_OK on success
+   */
+  enum GNUNET_GenericReturnValue result;
+
+  /**
+   * Is the interpreter finishing?
+   */
+  bool finishing;
+
+};
+
+
+/**
+ * Lookup command by label.
+ *
+ * @param is interpreter to lookup command in
+ * @param label label of the command to lookup.
+ * @param future true to look into the future, false to look into the past
+ * @return the command, if it is found, or NULL.
+ */
+static const struct GNUNET_TESTING_Command *
+get_command (struct GNUNET_TESTING_Interpreter *is,
+             const char *label,
+             bool future)
+{
+  int start_i = future ? is->cmds_n - 1 : is->ip;
+  int end_i = future ? is->ip + 1 : 0;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "start_i: %u end_i: %u\n",
+              start_i,
+              end_i);
+  if (NULL == label)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Attempt to lookup command for empty label\n");
+    return NULL;
+  }
+  for (int i = start_i; i >= end_i; i--)
+  {
+    const struct GNUNET_TESTING_Command *cmd = &is->commands[i];
+
+    if (NULL != cmd->run)
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "label to compare %s\n",
+                  cmd->label.value);
+    /* Give precedence to top-level commands.  */
+    if ( (NULL != cmd->run) &&
+         (0 == strcmp (cmd->label.value,
+                       label)) )
+      return cmd;
+
+    if (GNUNET_TESTING_cmd_is_batch_ (cmd))
+    {
+      struct GNUNET_TESTING_Command **batch;
+      struct GNUNET_TESTING_Command *current;
+      const struct GNUNET_TESTING_Command *icmd;
+      const struct GNUNET_TESTING_Command *match;
+
+      current = GNUNET_TESTING_cmd_batch_get_current_ (cmd);
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_TESTING_get_trait_batch_cmds (cmd,
+                                                          &batch));
+      /* We must do the loop forward, but we can find the last match */
+      match = NULL;
+      for (unsigned int j = 0;
+           NULL != (icmd = &(*batch)[j])->run;
+           j++)
+      {
+        if (current == icmd)
+          break; /* do not go past current command */
+        if ( (NULL != icmd->run) &&
+             (0 == strcmp (icmd->label.value,
+                           label)) )
+          match = icmd;
+      }
+      if (NULL != match)
+        return match;
+    }
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Command `%s' not found\n",
+              label);
+  return NULL;
+}
+
+
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_lookup_future_command (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *label)
+{
+  return get_command (is,
+                      label,
+                      true);
+}
+
+
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_lookup_command (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *label)
+{
+  return get_command (is,
+                      label,
+                      false);
+}
+
+
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_lookup_command_all (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *label)
+{
+  const struct GNUNET_TESTING_Command *cmd;
+
+  cmd = get_command (is,
+                     label,
+                     false);
+  if (NULL == cmd)
+    cmd = get_command (is,
+                       label,
+                       true);
+  return cmd;
+}
+
+
+const struct GNUNET_TESTING_Command *
+GNUNET_TESTING_interpreter_get_command (
+  struct GNUNET_TESTING_Interpreter *is,
+  const char *name)
+{
+  const struct GNUNET_TESTING_Command *cmd;
+  struct GNUNET_HashCode h_name;
+
+  GNUNET_CRYPTO_hash (name,
+                      strlen (name),
+                      &h_name);
+  cmd = GNUNET_CONTAINER_multihashmap_get (is->vars,
+                                           &h_name);
+  if (NULL == cmd)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Command not found by name: %s\n",
+                name);
+  return cmd;
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_set_var (const char *name,
+                            struct GNUNET_TESTING_Command cmd)
+{
+  cmd.name = name;
+  return cmd;
+}
+
+
+static void
+send_finished (void *cls,
+               enum GNUNET_GenericReturnValue result)
+{
+  struct SendContext *sctx = cls;
+  struct GNUNET_TESTING_Interpreter *is = sctx->is;
+
+  GNUNET_break (GNUNET_OK == result);
+  GNUNET_CONTAINER_DLL_remove (is->sender_head,
+                               is->sender_tail,
+                               sctx);
+  GNUNET_free (sctx);
+}
+
+
+void
+GNUNET_TESTING_loop_notify_children_ (struct GNUNET_TESTING_Interpreter *is,
+                                      const struct GNUNET_MessageHeader *hdr)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Send notification to children of type %u\n",
+              (unsigned int) ntohs (hdr->type));
+  for (unsigned int i = 0; i<is->n_helpers; i++)
+  {
+    struct SendContext *sctx;
+
+    sctx = GNUNET_new (struct SendContext);
+    sctx->is = is;
+    GNUNET_CONTAINER_DLL_insert (is->sender_head,
+                                 is->sender_tail,
+                                 sctx);
+    sctx->send_handle
+      = GNUNET_HELPER_send (is->helpers[i],
+                            hdr,
+                            false, /* never drop */
+                            &send_finished,
+                            sctx);
+  }
+}
+
+
+void
+GNUNET_TESTING_loop_notify_parent_ (struct GNUNET_TESTING_Interpreter *is,
+                                    const struct GNUNET_MessageHeader *hdr)
+{
+  if (NULL == is->parent_writer)
+  {
+    /* We have no parent, this is impossible! */
+    GNUNET_break (0);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+  is->parent_writer (hdr);
+}
+
+
+/**
+ * Finish the test run, return the final result.
+ *
+ * @param cls the `struct GNUNET_TESTING_Interpreter`
+ */
+static void
+finish_test (void *cls)
+{
+  struct GNUNET_TESTING_Interpreter *is = cls;
+  struct GNUNET_TESTING_Command *cmd;
+  const char *label;
+
+  is->finishing = true;
+  is->final_task = NULL;
+  label = is->commands[is->ip].label.value;
+  if (NULL == is->commands[is->ip].run)
+    label = "END";
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Interpreter finishes at `%s' with status %d\n",
+              label,
+              is->result);
+  for (unsigned int j = 0;
+       NULL != (cmd = &is->commands[j])->run;
+       j++)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Cleaning up cmd %s\n",
+                cmd->label.value);
+    cmd->cleanup (cmd->cls);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Cleaned up cmd %s\n",
+                cmd->label.value);
+  }
+  if (NULL != is->task)
+  {
+    GNUNET_SCHEDULER_cancel (is->task);
+    is->task = NULL;
+  }
+  if (NULL != is->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (is->timeout_task);
+    is->timeout_task = NULL;
+  }
+  {
+    struct SendContext *sctx;
+
+    while (NULL != (sctx = is->sender_head))
+    {
+      GNUNET_CONTAINER_DLL_remove (is->sender_head,
+                                   is->sender_tail,
+                                   sctx);
+      GNUNET_HELPER_send_cancel (sctx->send_handle);
+      GNUNET_free (sctx);
+    }
+  }
+  GNUNET_free (is->commands);
+  is->rc (is->rc_cls,
+          is->result);
+  if (NULL != is->barriers)
+  {
+    GNUNET_CONTAINER_multishortmap_destroy (is->barriers);
+    is->barriers = NULL;
+  }
+  if (NULL != is->vars)
+  {
+    GNUNET_CONTAINER_multihashmap_destroy (is->vars);
+    is->vars = NULL;
+  }
+  GNUNET_free (is->helpers);
+  GNUNET_free (is);
+}
+
+
+/**
+ * Run the main interpreter loop that performs exchange operations.
+ *
+ * @param cls contains the `struct InterpreterState`
+ */
+static void
+interpreter_run (void *cls);
+
+
+/**
+ * Current command is done, run the next one.
+ */
+static void
+interpreter_next (void *cls)
+{
+  struct GNUNET_TESTING_Interpreter *is = cls;
+  static unsigned long long ipc;
+  static struct GNUNET_TIME_Absolute last_report;
+  struct GNUNET_TESTING_Command *cmd = &is->commands[is->ip];
+
+  if (GNUNET_SYSERR == is->result)
+    return; /* ignore, we already failed! */
+  cmd->finish_time = GNUNET_TIME_absolute_get ();
+  if ( (! GNUNET_TESTING_cmd_is_batch_ (cmd)) ||
+       (! GNUNET_TESTING_cmd_batch_next_ (cmd->cls)) )
+    is->ip++;
+  if (0 == (ipc % 1000))
+  {
+    if (0 != ipc)
+      GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
+                  "Interpreter executed 1000 instructions in %s\n",
+                  GNUNET_STRINGS_relative_time_to_string (
+                    GNUNET_TIME_absolute_get_duration (last_report),
+                    true));
+    last_report = GNUNET_TIME_absolute_get ();
+  }
+  ipc++;
+  is->task = GNUNET_SCHEDULER_add_now (&interpreter_run,
+                                       is);
+}
+
+
+void
+GNUNET_TESTING_interpreter_fail (struct GNUNET_TESTING_Interpreter *is)
+{
+  struct GNUNET_TESTING_Command *cmd
+    = &is->commands[is->ip];
+
+  if (GNUNET_SYSERR == is->result)
+  {
+    GNUNET_break (0);
+    return; /* ignore, we already failed! */
+  }
+  if (NULL != cmd)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed during command `%s'\n",
+                cmd->label.value);
+    while (GNUNET_TESTING_cmd_is_batch_ (cmd))
+    {
+      cmd = GNUNET_TESTING_cmd_batch_get_current_ (cmd);
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed in batch during command `%s'\n",
+                  cmd->label.value);
+    }
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed with CMD being NULL!\n");
+  }
+  is->result = GNUNET_SYSERR;
+  GNUNET_assert (NULL == is->final_task);
+  is->final_task = GNUNET_SCHEDULER_add_now (&finish_test,
+                                             is);
+}
+
+
+void
+GNUNET_TESTING_async_fail (struct GNUNET_TESTING_AsyncContext *ac)
+{
+  GNUNET_assert (GNUNET_NO == ac->finished);
+  ac->finished = GNUNET_SYSERR;
+  GNUNET_TESTING_interpreter_fail (ac->is);
+}
+
+
+void
+GNUNET_TESTING_async_finish (struct GNUNET_TESTING_AsyncContext *ac)
+{
+  GNUNET_assert (GNUNET_NO == ac->finished);
+  ac->finished = GNUNET_OK;
+  if (NULL != ac->notify_finished)
+  {
+    ac->notify_finished (ac->notify_finished_cls);
+    ac->notify_finished = NULL;
+  }
+  if (! ac->next_called)
+  {
+    ac->next_called = true;
+    interpreter_next (ac->is);
+  }
+}
+
+
+/**
+ * Run the main interpreter loop.
+ *
+ * @param cls contains the `struct GNUNET_TESTING_Interpreter`
+ */
+static void
+interpreter_run (void *cls)
+{
+  struct GNUNET_TESTING_Interpreter *is = cls;
+  struct GNUNET_TESTING_Command *cmd = &is->commands[is->ip];
+
+  is->task = NULL;
+  if (NULL == cmd->run)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Running command END\n");
+    is->result = GNUNET_OK;
+    finish_test (is);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Running command `%s'\n",
+              cmd->label.value);
+  cmd->last_req_time
+    = GNUNET_TIME_absolute_get ();
+  if (0 == cmd->num_tries)
+    cmd->start_time = cmd->last_req_time;
+  cmd->num_tries = 1;
+  if (NULL != cmd->name)
+  {
+    struct GNUNET_HashCode h_name;
+
+    GNUNET_CRYPTO_hash (cmd->name,
+                        strlen (cmd->name),
+                        &h_name);
+    (void) GNUNET_CONTAINER_multihashmap_put (
+      is->vars,
+      &h_name,
+      cmd,
+      GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  }
+  if (NULL != cmd->ac)
+  {
+    cmd->ac->is = is;
+    cmd->ac->finished = GNUNET_NO;
+  }
+  cmd->run (cmd->cls,
+            is);
+  if ( (NULL == cmd->ac) ||
+       (cmd->asynchronous_finish) )
+  {
+    if (NULL != cmd->ac)
+      cmd->ac->next_called = true;
+    interpreter_next (is);
+  }
+}
+
+
+/**
+ * Function run when the test terminates (good or bad) with timeout.
+ *
+ * @param cls the interpreter state
+ */
+static void
+do_timeout (void *cls)
+{
+  struct GNUNET_TESTING_Interpreter *is = cls;
+
+  is->timeout_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Terminating test due to global timeout\n");
+  is->result = GNUNET_SYSERR;
+  finish_test (is);
+}
+
+
+static void
+setup_is (struct GNUNET_TESTING_Interpreter *is,
+          const struct GNUNET_TESTING_Command *bcommand,
+          const struct GNUNET_TESTING_Command *commands)
+{
+  unsigned int i;
+
+  is->vars = GNUNET_CONTAINER_multihashmap_create (1024,
+                                                   false);
+  /* get the number of commands */
+  for (i = 0; NULL != commands[i].run; i++)
+    ;
+  if (NULL != bcommand)
+    i++;
+  is->cmds_n = i + 1;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got %u commands\n",
+              i);
+  is->commands = GNUNET_malloc_large (
+    (i + 1)
+    * sizeof (struct GNUNET_TESTING_Command));
+  GNUNET_assert (NULL != is->commands);
+  if (NULL == bcommand)
+  {
+    memcpy (is->commands,
+            commands,
+            sizeof (struct GNUNET_TESTING_Command) * i);
+  }
+  else
+  {
+    is->commands[0] = *bcommand;
+    memcpy (&is->commands[1],
+            commands,
+            sizeof (struct GNUNET_TESTING_Command) * i);
+  }
+  is->task = GNUNET_SCHEDULER_add_now (&interpreter_run,
+                                       is);
+}
+
+
+struct GNUNET_TESTING_Interpreter *
+GNUNET_TESTING_run (const struct GNUNET_TESTING_Command *commands,
+                    struct GNUNET_TIME_Relative timeout,
+                    GNUNET_TESTING_ResultCallback rc,
+                    void *rc_cls)
+{
+  struct GNUNET_TESTING_Interpreter *is;
+
+  is = GNUNET_new (struct GNUNET_TESTING_Interpreter);
+  is->timeout_task
+    = GNUNET_SCHEDULER_add_delayed (timeout,
+                                    &do_timeout,
+                                    is);
+  is->rc = rc;
+  is->rc_cls = rc_cls;
+  setup_is (is,
+            NULL,
+            commands);
+  return is;
+}
+
+
+static struct GNUNET_TESTING_Interpreter *
+start_testcase (
+  void *cls,
+  const char *topology_data,
+  uint32_t inherited_barrier_count,
+  const struct GNUNET_ShortHashCode *inherited_barriers,
+  GNUNET_TESTING_cmd_helper_write_cb parent_writer,
+  GNUNET_TESTING_cmd_helper_finish_cb finish_cb)
+{
+  const struct GNUNET_TESTING_Command *commands = cls;
+  struct GNUNET_TESTING_Interpreter *is;
+
+  is = GNUNET_new (struct GNUNET_TESTING_Interpreter);
+  if (0 != inherited_barrier_count)
+  {
+    is->barriers
+      = GNUNET_CONTAINER_multishortmap_create (inherited_barrier_count * 4 / 3,
+                                               true);
+    for (unsigned int j = 0; j<inherited_barrier_count; j++)
+    {
+      struct GNUNET_TESTING_Barrier *barrier;
+
+      barrier = GNUNET_new (struct GNUNET_TESTING_Barrier);
+      barrier->barrier_id = inherited_barriers[j];
+      barrier->inherited = true;
+      (void) GNUNET_CONTAINER_multishortmap_put (
+        is->barriers,
+        &barrier->barrier_id,
+        barrier,
+        GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+    }
+  }
+  is->parent_writer = parent_writer;
+  is->rc = finish_cb;
+  is->rc_cls = NULL;
+  {
+    struct GNUNET_TESTING_Command bcmd;
+
+    bcmd = GNUNET_TESTING_cmd_set_var (
+      "topology",
+      GNUNET_TESTING_cmd_netjail_topology_from_data (
+        "_boot_",
+        topology_data));
+    setup_is (is,
+              &bcmd,
+              commands);
+  }
+  return is;
+
+}
+
+
+struct GNUNET_TESTING_PluginFunctions *
+GNUNET_TESTING_make_plugin (
+  const struct GNUNET_TESTING_Command *commands)
+{
+  struct GNUNET_TESTING_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_TESTING_PluginFunctions);
+  api->cls = (void *) commands;
+  api->start_testcase = &start_testcase;
+  return api;
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_command_new_ac (
+  void *cls,
+  const char *label,
+  GNUNET_TESTING_CommandRunRoutine run,
+  GNUNET_TESTING_CommandCleanupRoutine cleanup,
+  GNUNET_TESTING_CommandGetTraits traits,
+  struct GNUNET_TESTING_AsyncContext *ac)
+{
+  struct GNUNET_TESTING_Command cmd = {
+    .cls = cls,
+    .run = run,
+    .ac = ac,
+    .cleanup = cleanup,
+    .traits = traits
+  };
+
+  GNUNET_assert (NULL != run);
+  if (NULL != label)
+    GNUNET_TESTING_set_label (&cmd.label,
+                              label);
+  return cmd;
+}
+
+
+void
+GNUNET_TESTING_set_label (struct GNUNET_TESTING_CommandLabel *label,
+                          const char *value)
+{
+  size_t len;
+
+  len = strlen (value);
+  GNUNET_assert (len <=
+                 GNUNET_TESTING_CMD_MAX_LABEL_LENGTH);
+  memcpy (label->value,
+          value,
+          len + 1);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_cmd_end (void)
+{
+  struct GNUNET_TESTING_Command cmd = {
+    .run = NULL
+  };
+
+  return cmd;
+}
+
+
+/**
+ * Closure for #loop_run().
+ */
+struct MainParams
+{
+
+  /**
+   * NULL-label terminated array of commands.
+   */
+  struct GNUNET_TESTING_Command *commands;
+
+  /**
+   * Global timeout for the test.
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * Set to #EXIT_FAILURE on error.
+   */
+  int rv;
+};
+
+
+/**
+ * Function called with the final result of the test.
+ *
+ * @param cls the `struct MainParams`
+ * @param rv #GNUNET_OK if the test passed
+ */
+static void
+handle_result (void *cls,
+               enum GNUNET_GenericReturnValue rv)
+{
+  struct MainParams *mp = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Test exits with status %d\n",
+              rv);
+  if (GNUNET_OK != rv)
+    mp->rv = EXIT_FAILURE;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Main function to run the test cases.
+ *
+ * @param cls a `struct MainParams *`
+ */
+static void
+loop_run (void *cls)
+{
+  struct MainParams *mp = cls;
+
+  GNUNET_TESTING_run (mp->commands,
+                      mp->timeout,
+                      &handle_result,
+                      mp);
+}
+
+
+int
+GNUNET_TESTING_main (struct GNUNET_TESTING_Command *commands,
+                     struct GNUNET_TIME_Relative timeout)
+{
+  struct MainParams mp = {
+    .commands = commands,
+    .timeout = timeout,
+    .rv = EXIT_SUCCESS
+  };
+
+  GNUNET_SCHEDULER_run (&loop_run,
+                        &mp);
+  return mp.rv;
+}
+
+
+void
+GNUNET_TESTING_add_netjail_helper_ (struct GNUNET_TESTING_Interpreter *is,
+                                    struct GNUNET_HELPER_Handle *helper)
+{
+  GNUNET_array_append (is->helpers,
+                       is->n_helpers,
+                       helper);
+}
+
+
+struct GNUNET_TESTING_Barrier *
+GNUNET_TESTING_get_barrier2_ (struct GNUNET_TESTING_Interpreter *is,
+                              const struct GNUNET_ShortHashCode *create_key)
+{
+  return GNUNET_CONTAINER_multishortmap_get (is->barriers,
+                                             create_key);
+}
+
+
+struct GNUNET_TESTING_Barrier *
+GNUNET_TESTING_get_barrier_ (struct GNUNET_TESTING_Interpreter *is,
+                             const char *barrier_name)
+{
+  struct GNUNET_ShortHashCode create_key;
+
+  if (NULL == is->barriers)
+    return NULL;
+  GNUNET_TESTING_barrier_name_hash_ (barrier_name,
+                                     &create_key);
+  return GNUNET_TESTING_get_barrier2_ (is,
+                                       &create_key);
+}
+
+
+void
+GNUNET_TESTING_add_barrier_ (struct GNUNET_TESTING_Interpreter *is,
+                             struct GNUNET_TESTING_Barrier *barrier)
+{
+  if (NULL == is->barriers)
+    is->barriers
+      = GNUNET_CONTAINER_multishortmap_create (1,
+                                               true);
+  /* We always use the barrier we encountered
+     most recently under a given label, thus replace */
+  (void) GNUNET_CONTAINER_multishortmap_put (
+    is->barriers,
+    &barrier->barrier_id,
+    barrier,
+    GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+}
+
+
+/* end of testing_api_loop.c */
diff --git a/src/lib/testing/testing_api_loop.h b/src/lib/testing/testing_api_loop.h
new file mode 100644
index 000000000..2d57cea97
--- /dev/null
+++ b/src/lib/testing/testing_api_loop.h
@@ -0,0 +1,141 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing_api_loop.h
+ * @brief
+ * @author t3sserakt
+ */
+#ifndef TESTING_API_LOOP_H
+#define TESTING_API_LOOP_H
+
+
+#include "barrier.h"
+
+
+/**
+ * Callback function to write messages from the helper process running on a netjail node to the master process.
+ *
+ * @param message The message to write.
+ */
+typedef void
+(*GNUNET_TESTING_cmd_helper_write_cb) (
+  const struct GNUNET_MessageHeader *message);
+
+/**
+ * Callback function which writes a message from the helper process running on a netjail node to the master process * signaling that the test case running on the netjail node finished.
+ */
+typedef void
+(*GNUNET_TESTING_cmd_helper_finish_cb) (
+  enum GNUNET_GenericReturnValue status);
+
+
+/**
+ * The plugin API every test case plugin has to implement.
+ */
+struct GNUNET_TESTING_PluginFunctions
+{
+
+  /**
+   * Closure to pass to start_testcase.
+   */
+  void *cls;
+
+  /**
+   * Function to be implemented for each test case plugin which starts the test case on a netjail node.
+   *
+   * @param topology_data A file name for the file containing the topology configuration, or a string containing
+   *        the topology configuration.
+   * @param barrier_count length of the @a barriers array
+   * @param barriers inherited barriers
+   * @param write_message Callback function to write messages from the helper process running on a
+   * netjail node to the master process.
+   * @param finish_cb Callback function which writes a message from the helper process running on a netjail
+   *                  node to the master process * signaling that the test case running on the netjail node finished.
+   * @return Returns The struct GNUNET_TESTING_Interpreter of the command loop running on this netjail node.
+   */
+  struct GNUNET_TESTING_Interpreter *
+  (*start_testcase) (
+    void *cls,
+    const char *topology_data,
+    uint32_t barrier_count,
+    const struct GNUNET_ShortHashCode *barriers,
+    GNUNET_TESTING_cmd_helper_write_cb write_message,
+    GNUNET_TESTING_cmd_helper_finish_cb finish_cb);
+
+};
+
+
+/**
+ * Send message to our parent. Fails very hard if
+ * we do not have one.
+ *
+ * @param is The interpreter loop.
+ */
+void
+GNUNET_TESTING_loop_notify_parent_ (struct GNUNET_TESTING_Interpreter *is,
+                                    const struct GNUNET_MessageHeader *hdr);
+
+
+/**
+ * Send message to all netjail children (if there
+ * are any).
+ *
+ * @param is The interpreter loop.
+ */
+void
+GNUNET_TESTING_loop_notify_children_ (struct GNUNET_TESTING_Interpreter *is,
+                                      const struct GNUNET_MessageHeader *hdr);
+
+
+/**
+ * Adding a helper handle to the interpreter.
+ *
+ * @param is The interpreter.
+ * @param helper The helper handle.
+ */
+void
+GNUNET_TESTING_add_netjail_helper_ (struct GNUNET_TESTING_Interpreter *is,
+                                    struct GNUNET_HELPER_Handle *helper);
+
+
+/**
+ * Add a barrier to the interpreter to share it with
+ * all children as an inherited barrier.
+ *
+ * @param is The interpreter.
+ * @param barrier The barrier to add.
+ */
+void
+GNUNET_TESTING_add_barrier_ (struct GNUNET_TESTING_Interpreter *is,
+                             struct GNUNET_TESTING_Barrier *barrier);
+
+
+struct GNUNET_TESTING_Barrier *
+GNUNET_TESTING_get_barrier2_ (struct GNUNET_TESTING_Interpreter *is,
+                              const struct GNUNET_ShortHashCode *create_key);
+
+
+struct GNUNET_TESTING_Barrier *
+GNUNET_TESTING_get_barrier_ (struct GNUNET_TESTING_Interpreter *is,
+                             const char *barrier_name);
+
+
+#endif
diff --git a/src/lib/testing/testing_api_traits.c b/src/lib/testing/testing_api_traits.c
new file mode 100644
index 000000000..0b20b6359
--- /dev/null
+++ b/src/lib/testing/testing_api_traits.c
@@ -0,0 +1,87 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_api_traits.c
+ * @brief loop for trait resolution
+ * @author Christian Grothoff (GNU Taler testing)
+ * @author Marcello Stanisci (GNU Taler testing)
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_testing_lib.h"
+
+
+GNUNET_TESTING_LOOP_SIMPLE_TRAITS (GNUNET_TESTING_MAKE_IMPL_SIMPLE_TRAIT,
+                                   GNUNET_TESTING)
+
+GNUNET_TESTING_LOOP_INDEXED_TRAITS (GNUNET_TESTING_MAKE_IMPL_INDEXED_TRAIT,
+                                    GNUNET_TESTING)
+
+/**
+ * End a trait array.  Usually, commands offer several traits,
+ * and put them in arrays.
+ */
+struct GNUNET_TESTING_Trait
+GNUNET_TESTING_trait_end ()
+{
+  struct GNUNET_TESTING_Trait end = {
+    .index = 0,
+    .trait_name = NULL,
+    .ptr = NULL
+  };
+
+  return end;
+}
+
+
+/**
+ * Pick the chosen trait from the traits array.
+ *
+ * @param traits the traits array.
+ * @param ret where to store the result.
+ * @param trait type of the trait to extract.
+ * @param index index number of the object to extract.
+ * @return #GNUNET_OK if no error occurred, #GNUNET_SYSERR otherwise.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_TESTING_get_trait (const struct GNUNET_TESTING_Trait *traits,
+                          const void **ret,
+                          const char *trait,
+                          unsigned int index)
+{
+  for (unsigned int i = 0; NULL != traits[i].trait_name; i++)
+  {
+    if ( (0 == strcmp (trait, traits[i].trait_name)) &&
+         (index == traits[i].index) )
+    {
+      *ret = (void *) traits[i].ptr;
+      return GNUNET_OK;
+    }
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Trait %s/%u not found.\n",
+              trait, index);
+
+  return GNUNET_SYSERR;
+}
+
+
+/* end of testing_api_traits.c */
diff --git a/src/lib/testing/testing_cmds.h b/src/lib/testing/testing_cmds.h
new file mode 100644
index 000000000..3493dbbf9
--- /dev/null
+++ b/src/lib/testing/testing_cmds.h
@@ -0,0 +1,106 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_cmds.h
+ * @brief Message formats for communication between testing cmds helper and testcase plugins.
+ * @author t3sserakt
+ */
+
+#ifndef TESTING_CMDS_H
+#define TESTING_CMDS_H
+
+#define HELPER_CMDS_BINARY "gnunet-cmds-helper"
+#include "gnunet_common.h"
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Initialization message for gnunet-cmds-testbed to start cmd binary.
+ */
+struct GNUNET_TESTING_CommandHelperInit
+{
+  /**
+   * Type is #GNUNET_MESSAGE_TYPE_CMDS_HELPER_INIT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of barriers the helper inherits.
+   */
+  uint32_t barrier_count GNUNET_PACKED;
+
+  /* Followed by barrier_count barrier hashes */
+
+  /* Followed by topology data */
+};
+
+
+struct GNUNET_TESTING_CommandLocalFinished
+{
+  /**
+   * Type is GNUNET_MESSAGE_TYPE_CMDS_HELPER_LOCAL_FINISHED
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * The exit status local test return with in NBO.
+   */
+  uint32_t rv GNUNET_PACKED;
+};
+
+
+/**
+ * Child to parent: I reached the given barrier,
+ * increment the counter (or pass to grandparent).
+ */
+struct GNUNET_TESTING_CommandBarrierReached
+{
+  struct GNUNET_MessageHeader header;
+  struct GNUNET_ShortHashCode barrier_key;
+};
+
+
+/**
+ * Parent to child: you're inheriting a barrier.
+ * If the barrier was already satisfied, the parent
+ * must sent a separate barrier satisfied message.
+ */
+struct GNUNET_TESTING_CommandBarrierInherited
+{
+  struct GNUNET_MessageHeader header;
+  struct GNUNET_ShortHashCode barrier_key;
+};
+
+
+/**
+ * Parent to child: this barrier was satisfied.
+ */
+struct GNUNET_TESTING_CommandBarrierSatisfied
+{
+  struct GNUNET_MessageHeader header;
+  struct GNUNET_ShortHashCode barrier_key;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
+/* end of testing_cmds.h */
diff --git a/src/lib/util/.gitignore b/src/lib/util/.gitignore
new file mode 100644
index 000000000..c31c9ec28
--- /dev/null
+++ b/src/lib/util/.gitignore
@@ -0,0 +1,82 @@
+test_common_logging_dummy
+test_bio
+test_client.nc
+test_client_unix.nc
+test_common_allocation
+test_common_endian
+test_common_logging
+test_common_logging_runtime_loglevels
+test_configuration
+test_connection.nc
+test_connection_addressing.nc
+test_connection_receive_cancel.nc
+test_connection_timeout.nc
+test_connection_timeout_no_connect.nc
+test_connection_transmit_cancel.nc
+test_container_bloomfilter
+test_container_dll
+test_container_heap
+test_container_meta_data
+test_container_multihashmap
+test_container_multihashmap32
+test_container_multipeermap
+test_crypto_blind
+test_crypto_crc
+test_crypto_ecc_dlog
+test_crypto_ecdh_ecdsa
+test_crypto_ecdh_eddsa
+test_crypto_ecdhe
+test_crypto_ecdsa
+test_crypto_eddsa
+test_crypto_edx25519
+test_crypto_elligator
+test_crypto_hash
+test_crypto_hash_context
+test_crypto_hkdf
+test_crypto_kdf
+test_crypto_paillier
+test_crypto_random
+test_crypto_rsa
+test_crypto_cs
+test_crypto_symmetric
+test_disk
+test_getopt
+test_mq
+test_os_network
+test_os_start_process
+test_peer
+test_plugin
+test_program
+test_scheduler
+test_scheduler_delay
+test_server.nc
+test_server_disconnect.nc
+test_server_mst_interrupt.nc
+test_server_with_client.nc
+test_server_with_client_unix
+test_service
+test_speedup
+test_strings
+test_strings_to_data
+test_time
+test_socks.nc
+perf_crypto_asymmetric
+perf_crypto_hash
+perf_crypto_symmetric
+perf_crypto_rsa
+perf_crypto_cs
+perf_crypto_ecc_dlog
+perf_crypto_paillier
+test_hexcoder
+test_regex
+test_tun
+test_uri
+python27_location
+perf_malloc
+perf_mq
+perf_scheduler
+test_crypto_cs
+test_crypto_ecc
+test_child_management
+test_scheduler_hogging_cancel
+test_scheduler_hogging_priority
diff --git a/src/lib/util/Makefile.am b/src/lib/util/Makefile.am
new file mode 100644
index 000000000..4d052c57b
--- /dev/null
+++ b/src/lib/util/Makefile.am
@@ -0,0 +1,608 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+dist_pkgcfg_DATA = \
+  util.conf
+
+
+TEST_CLIENT_UNIX_NC = test_client_unix.nc
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+if ENABLE_BENCHMARK
+  BENCHMARK = benchmark.c benchmark.h
+  PTHREAD = -lpthread
+endif
+
+DLOG = crypto_ecc_dlog.c
+DLOG_TEST = test_crypto_ecc_dlog
+
+test_common_logging_dummy_SOURCES = \
+ test_common_logging_dummy.c
+test_common_logging_dummy_LDADD = \
+ libgnunetutil.la
+
+libgnunetutil_la_SOURCES = \
+  bandwidth.c \
+  $(BENCHMARK) \
+  bio.c \
+  buffer.c \
+  child_management.c \
+  client.c \
+  common_allocation.c \
+  common_endian.c \
+  common_logging.c \
+  compress.c \
+  configuration.c \
+  configuration_helper.c \
+  consttime_memcmp.c \
+  container_bloomfilter.c \
+  container_heap.c \
+  container_multihashmap.c \
+  container_multishortmap.c \
+  container_multiuuidmap.c \
+  container_multipeermap.c \
+  container_multihashmap32.c \
+  crypto_blind_sign.c \
+  crypto_crc.c \
+  crypto_cs.c \
+  crypto_ecc.c \
+  crypto_ecc_gnsrecord.c \
+  $(DLOG) \
+  crypto_ecc_setup.c \
+  crypto_edx25519.c \
+  crypto_elligator.c \
+  crypto_hash.c \
+  crypto_hash_file.c \
+  crypto_hkdf.c \
+  crypto_kdf.c \
+  crypto_mpi.c \
+  crypto_paillier.c \
+  crypto_pkey.c \
+  crypto_pow.c \
+  crypto_random.c \
+  crypto_rsa.c \
+  crypto_symmetric.c \
+  disk.c \
+  disk.h \
+  dnsparser.c \
+  dnsstub.c \
+  getopt.c \
+  getopt_helpers.c \
+  helper.c \
+  load.c \
+  mst.c \
+  mq.c \
+  nc.c \
+  network.c \
+        nt.c \
+  op.c \
+  os_installation.c \
+  os_network.c \
+  os_priority.c \
+  peer.c \
+  plugin.c \
+  program.c \
+  regex.c \
+  resolver_api.c resolver.h \
+  scheduler.c \
+  service.c \
+  signal.c \
+  strings.c \
+  time.c \
+  tun.c \
+  uri.c \
+  speedup.c speedup.h \
+  proc_compat.c \
+        gnunet_error_codes.c
+
+if HAVE_LIBATOMIC
+if DARWIN
+        LIBATOMIC=
+else
+  LIBATOMIC= -latomic
+endif
+else
+  LIBATOMIC=
+endif
+
+if HAVE_LIBIDN
+  LIBIDN= -lidn
+else
+  LIBIDN=
+endif
+
+if HAVE_LIBIDN2
+  LIBIDN2= -lidn2
+else
+  LIBIDN2=
+endif
+
+
+libgnunetutil_la_CFLAGS = \
+  ${MHD_CFLAGS}
+libgnunetutil_la_LIBADD = \
+  $(GCLIBADD) $(WINLIB) \
+  $(LIBATOMIC) \
+  $(LIBGCRYPT_LIBS) \
+  $(LTLIBICONV) \
+  $(LTLIBINTL) \
+  -lltdl \
+  $(LIBIDN) $(LIBIDN2) \
+  $(Z_LIBS) \
+  -lunistring \
+  -lsodium \
+  -lgmp \
+  $(XLIB) \
+  $(PTHREAD)
+
+libgnunetutil_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  -version-info 16:1:0
+
+lib_LTLIBRARIES = libgnunetutil.la
+
+noinst_PROGRAMS = \
+ test_common_logging_dummy
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_utiltest.la
+
+libgnunet_plugin_utiltest_la_SOURCES = \
+  test_plugin_plug.c
+libgnunet_plugin_utiltest_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+if HAVE_BENCHMARKS
+ BENCHMARKS = \
+  perf_crypto_cs \
+  perf_crypto_hash \
+  perf_crypto_rsa \
+  perf_crypto_paillier \
+  perf_crypto_symmetric \
+  perf_crypto_asymmetric \
+  perf_malloc \
+  perf_mq \
+  perf_scheduler \
+  perf_crypto_ecc_dlog
+endif
+
+if HAVE_SSH_KEY
+# SSH_USING_TESTS = test_socks.nc
+endif
+
+check_PROGRAMS = \
+ test_bio \
+ test_child_management \
+ test_client.nc \
+ $(TEST_CLIENT_UNIX_NC) \
+ test_common_allocation \
+ test_common_endian \
+ test_common_logging \
+ test_configuration \
+ test_container_bloomfilter \
+ test_container_dll \
+ test_container_multihashmap \
+ test_container_multihashmap32 \
+ test_container_multipeermap \
+ test_container_heap \
+ test_crypto_blind \
+ test_crypto_crc \
+ test_crypto_cs \
+ test_crypto_ecdsa \
+ test_crypto_eddsa \
+ test_crypto_ecdhe \
+ test_crypto_ecdh_eddsa \
+ test_crypto_ecdh_ecdsa \
+ test_crypto_edx25519 \
+ test_crypto_elligator \
+ $(DLOG_TEST) \
+ test_crypto_hash \
+ test_crypto_hash_context \
+ test_crypto_hkdf \
+ test_crypto_kdf \
+ test_crypto_paillier \
+ test_crypto_random \
+ test_crypto_rsa \
+ test_crypto_symmetric \
+ test_disk \
+ test_getopt \
+ test_hexcoder \
+ test_mq \
+ test_os_network \
+ test_peer \
+ test_plugin \
+ test_program \
+ test_regex \
+ test_scheduler \
+ test_scheduler_delay \
+ test_scheduler_hogging_cancel \
+ test_scheduler_hogging_priority \
+ test_service \
+ test_strings \
+ test_strings_to_data \
+ test_speedup \
+ test_time \
+ test_tun \
+ test_uri \
+ $(BENCHMARKS) \
+ test_os_start_process \
+ test_common_logging_runtime_loglevels
+
+test_child_management_SOURCES = \
+  test_child_management.c
+test_child_management_LDADD = \
+  libgnunetutil.la \
+  $(XLIB)
+
+
+
+# Declare .nc (NO-CONCURRENCY) as a test extension so that we can impart
+# sequential execution order for them
+TEST_EXTENSIONS = .nc
+test_test_client_unix.log: test_client.log
+
+test_bio_SOURCES = \
+ test_bio.c
+test_bio_LDADD = \
+ libgnunetutil.la
+
+test_hexcoder_SOURCES = \
+ test_hexcoder.c
+test_hexcoder_LDADD = \
+ libgnunetutil.la
+
+test_tun_SOURCES = \
+ test_tun.c
+test_tun_LDADD = \
+ libgnunetutil.la
+
+test_regex_SOURCES = \
+ test_regex.c
+test_regex_LDADD = \
+ libgnunetutil.la
+
+test_os_start_process_SOURCES = \
+ test_os_start_process.c
+test_os_start_process_LDADD = \
+ libgnunetutil.la
+
+test_client_nc_SOURCES = \
+ test_client.c
+test_client_nc_LDADD = \
+ libgnunetutil.la
+
+test_client_unix_nc_SOURCES = \
+ test_client.c
+test_client_unix_nc_LDADD = \
+ libgnunetutil.la
+
+#test_socks_nc_SOURCES = \
+# test_socks.c
+#test_socks_nc_LDADD = \
+# libgnunetutil.la
+
+test_common_allocation_SOURCES = \
+ test_common_allocation.c
+test_common_allocation_LDADD = \
+ libgnunetutil.la
+
+test_common_endian_SOURCES = \
+ test_common_endian.c
+test_common_endian_LDADD = \
+ libgnunetutil.la
+
+test_common_logging_SOURCES = \
+ test_common_logging.c
+test_common_logging_LDADD = \
+ libgnunetutil.la
+
+test_common_logging_runtime_loglevels_SOURCES = \
+ test_common_logging_runtime_loglevels.c
+test_common_logging_runtime_loglevels_LDADD = \
+ libgnunetutil.la
+
+test_configuration_SOURCES = \
+ test_configuration.c
+test_configuration_LDADD = \
+ libgnunetutil.la
+
+test_container_bloomfilter_SOURCES = \
+ test_container_bloomfilter.c
+test_container_bloomfilter_LDADD = \
+ libgnunetutil.la
+
+test_container_dll_SOURCES = \
+ test_container_dll.c
+test_container_dll_LDADD = \
+ libgnunetutil.la
+
+test_container_multihashmap_SOURCES = \
+ test_container_multihashmap.c
+test_container_multihashmap_LDADD = \
+ libgnunetutil.la
+
+test_container_multihashmap32_SOURCES = \
+ test_container_multihashmap32.c
+test_container_multihashmap32_LDADD = \
+ libgnunetutil.la
+
+test_container_multipeermap_SOURCES = \
+ test_container_multipeermap.c
+test_container_multipeermap_LDADD = \
+ libgnunetutil.la
+
+test_container_heap_SOURCES = \
+ test_container_heap.c
+test_container_heap_LDADD = \
+ libgnunetutil.la
+
+test_crypto_blind_SOURCES = \
+ test_crypto_blind.c
+test_crypto_blind_LDADD = \
+ libgnunetutil.la
+
+test_crypto_symmetric_SOURCES = \
+ test_crypto_symmetric.c
+test_crypto_symmetric_LDADD = \
+ libgnunetutil.la
+
+test_crypto_crc_SOURCES = \
+ test_crypto_crc.c
+test_crypto_crc_LDADD = \
+ libgnunetutil.la
+
+test_crypto_cs_SOURCES = \
+ test_crypto_cs.c
+test_crypto_cs_LDADD = \
+ libgnunetutil.la \
+ -lsodium
+
+test_crypto_ecdsa_SOURCES = \
+ test_crypto_ecdsa.c
+test_crypto_ecdsa_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_eddsa_SOURCES = \
+ test_crypto_eddsa.c
+test_crypto_eddsa_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_edx25519_SOURCES = \
+ test_crypto_edx25519.c
+test_crypto_edx25519_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+ test_crypto_elligator_SOURCES = \
+ test_crypto_elligator.c
+test_crypto_elligator_LDADD = \
+ libgnunetutil.la \
+ -lsodium \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_ecc_dlog_SOURCES = \
+ test_crypto_ecc_dlog.c
+test_crypto_ecc_dlog_LDADD = \
+ -lsodium \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_ecdhe_SOURCES = \
+ test_crypto_ecdhe.c
+test_crypto_ecdhe_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_ecdh_eddsa_SOURCES = \
+ test_crypto_ecdh_eddsa.c
+test_crypto_ecdh_eddsa_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+test_crypto_ecdh_ecdsa_SOURCES = \
+ test_crypto_ecdh_ecdsa.c
+test_crypto_ecdh_ecdsa_LDADD = \
+ libgnunetutil.la \
+ $(LIBGCRYPT_LIBS)
+
+
+test_crypto_hash_SOURCES = \
+ test_crypto_hash.c
+test_crypto_hash_LDADD = \
+ libgnunetutil.la
+
+test_crypto_hash_context_SOURCES = \
+ test_crypto_hash_context.c
+test_crypto_hash_context_LDADD = \
+ libgnunetutil.la
+
+test_crypto_hkdf_SOURCES = \
+ test_crypto_hkdf.c
+test_crypto_hkdf_LDADD = \
+ libgnunetutil.la
+
+test_crypto_kdf_SOURCES = \
+ test_crypto_kdf.c
+test_crypto_kdf_LDADD = \
+ libgnunetutil.la -lgcrypt
+
+test_crypto_paillier_SOURCES = \
+ test_crypto_paillier.c
+test_crypto_paillier_LDADD = \
+ $(LIBGCRYPT_LIBS) \
+ libgnunetutil.la
+
+test_crypto_random_SOURCES = \
+ test_crypto_random.c
+test_crypto_random_LDADD = \
+ libgnunetutil.la
+
+test_crypto_rsa_SOURCES = \
+ test_crypto_rsa.c
+test_crypto_rsa_LDADD = \
+ libgnunetutil.la -lgcrypt
+
+test_disk_SOURCES = \
+ test_disk.c
+test_disk_LDADD = \
+ libgnunetutil.la
+
+test_getopt_SOURCES = \
+ test_getopt.c
+test_getopt_LDADD = \
+ libgnunetutil.la
+
+test_mq_SOURCES = \
+ test_mq.c
+test_mq_LDADD = \
+ libgnunetutil.la
+
+test_os_network_SOURCES = \
+ test_os_network.c
+test_os_network_LDADD = \
+ libgnunetutil.la
+
+test_peer_SOURCES = \
+ test_peer.c
+test_peer_LDADD = \
+ libgnunetutil.la -lgcrypt
+
+test_plugin_SOURCES = \
+ test_plugin.c
+test_plugin_LDADD = \
+ libgnunetutil.la
+
+test_program_SOURCES = \
+ test_program.c
+test_program_LDADD = \
+ libgnunetutil.la
+
+test_scheduler_SOURCES = \
+ test_scheduler.c
+test_scheduler_LDADD = \
+ libgnunetutil.la
+
+test_scheduler_delay_SOURCES = \
+ test_scheduler_delay.c
+test_scheduler_delay_LDADD = \
+ libgnunetutil.la
+
+test_scheduler_hogging_cancel_SOURCES = \
+ test_scheduler_hogging_cancel.c
+test_scheduler_hogging_cancel_LDADD = \
+ libgnunetutil.la
+
+test_scheduler_hogging_priority_SOURCES = \
+ test_scheduler_hogging_priority.c
+test_scheduler_hogging_priority_LDADD = \
+ libgnunetutil.la
+
+test_service_SOURCES = \
+ test_service.c
+test_service_LDADD = \
+ libgnunetutil.la
+
+test_strings_SOURCES = \
+ test_strings.c
+test_strings_LDADD = \
+ libgnunetutil.la
+
+test_strings_to_data_SOURCES = \
+ test_strings_to_data.c
+test_strings_to_data_LDADD = \
+ libgnunetutil.la
+
+
+test_time_SOURCES = \
+ test_time.c
+test_time_LDADD = \
+ libgnunetutil.la
+
+test_speedup_SOURCES = \
+ test_speedup.c
+test_speedup_LDADD = \
+ libgnunetutil.la
+
+test_uri_SOURCES = \
+ test_uri.c
+test_uri_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_cs_SOURCES = \
+ perf_crypto_cs.c
+perf_crypto_cs_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_hash_SOURCES = \
+ perf_crypto_hash.c
+perf_crypto_hash_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_ecc_dlog_SOURCES = \
+ perf_crypto_ecc_dlog.c
+perf_crypto_ecc_dlog_LDADD = \
+ libgnunetutil.la \
+ -lsodium
+
+perf_crypto_rsa_SOURCES = \
+ perf_crypto_rsa.c
+perf_crypto_rsa_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_symmetric_SOURCES = \
+ perf_crypto_symmetric.c
+perf_crypto_symmetric_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_asymmetric_SOURCES = \
+ perf_crypto_asymmetric.c
+perf_crypto_asymmetric_LDADD = \
+ libgnunetutil.la
+
+perf_crypto_paillier_SOURCES = \
+ perf_crypto_paillier.c
+perf_crypto_paillier_LDADD = \
+ libgnunetutil.la \
+ -lgcrypt
+
+perf_malloc_SOURCES = \
+ perf_malloc.c
+perf_malloc_LDADD = \
+ libgnunetutil.la
+
+perf_mq_SOURCES = \
+ perf_mq.c
+perf_mq_LDADD = \
+ libgnunetutil.la
+
+perf_scheduler_SOURCES = \
+ perf_scheduler.c
+perf_scheduler_LDADD = \
+ libgnunetutil.la
+
+
+EXTRA_DIST = \
+  test_client_data.conf \
+  test_client_unix.conf \
+  test_configuration_data.conf \
+  test_program_data.conf \
+  test_service_data.conf \
+  test_speedup_data.conf \
+  child_management_test.sh
diff --git a/src/lib/util/bandwidth.c b/src/lib/util/bandwidth.c
new file mode 100644
index 000000000..8411c12ee
--- /dev/null
+++ b/src/lib/util/bandwidth.c
@@ -0,0 +1,515 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/bandwidth.c
+ * @brief functions related to bandwidth (unit)
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-bandwidth", __VA_ARGS__)
+
+/**
+ * Create a new bandwidth value.
+ *
+ * @param bytes_per_second value to create
+ * @return the new bandwidth value
+ */
+struct GNUNET_BANDWIDTH_Value32NBO
+GNUNET_BANDWIDTH_value_init (uint32_t bytes_per_second)
+{
+  struct GNUNET_BANDWIDTH_Value32NBO ret;
+
+  ret.value__ = htonl (bytes_per_second);
+  return ret;
+}
+
+
+/**
+ * Compute the MIN of two bandwidth values.
+ *
+ * @param b1 first value
+ * @param b2 second value
+ * @return the min of b1 and b2
+ */
+struct GNUNET_BANDWIDTH_Value32NBO
+GNUNET_BANDWIDTH_value_min (struct GNUNET_BANDWIDTH_Value32NBO b1,
+                            struct GNUNET_BANDWIDTH_Value32NBO b2)
+{
+  return GNUNET_BANDWIDTH_value_init (
+    GNUNET_MIN (ntohl (b1.value__), ntohl (b2.value__)));
+}
+
+
+/**
+ * Compute the MAX of two bandwidth values.
+ *
+ * @param b1 first value
+ * @param b2 second value
+ * @return the min of b1 and b2
+ */
+struct GNUNET_BANDWIDTH_Value32NBO
+GNUNET_BANDWIDTH_value_max (struct GNUNET_BANDWIDTH_Value32NBO b1,
+                            struct GNUNET_BANDWIDTH_Value32NBO b2)
+{
+  return GNUNET_BANDWIDTH_value_init (
+    GNUNET_MAX (ntohl (b1.value__), ntohl (b2.value__)));
+}
+
+
+/**
+ * Compute the SUM of two bandwidth values.
+ *
+ * @param b1 first value
+ * @param b2 second value
+ * @return the sum of b1 and b2
+ */
+struct GNUNET_BANDWIDTH_Value32NBO
+GNUNET_BANDWIDTH_value_sum (struct GNUNET_BANDWIDTH_Value32NBO b1,
+                            struct GNUNET_BANDWIDTH_Value32NBO b2)
+{
+  return GNUNET_BANDWIDTH_value_init (ntohl (b1.value__) + ntohl (b2.value__));
+}
+
+
+uint64_t
+GNUNET_BANDWIDTH_value_get_available_until (
+  struct GNUNET_BANDWIDTH_Value32NBO bps,
+  struct GNUNET_TIME_Relative deadline)
+{
+  uint64_t b;
+
+  b = ntohl (bps.value__);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Bandwidth has %llu bytes available until deadline in %s\n",
+       (unsigned long long) ((b * deadline.rel_value_us + 500000LL)
+                             / 1000000LL),
+       GNUNET_STRINGS_relative_time_to_string (deadline, GNUNET_YES));
+  return (b * deadline.rel_value_us + 500000LL) / 1000000LL;
+}
+
+
+/**
+ * At the given bandwidth, calculate how long it would take for
+ * @a size bytes to be transmitted.
+ *
+ * @param bps bandwidth
+ * @param size number of bytes we want to have available
+ * @return how long it would take
+ */
+struct GNUNET_TIME_Relative
+GNUNET_BANDWIDTH_value_get_delay_for (struct GNUNET_BANDWIDTH_Value32NBO bps,
+                                      uint64_t size)
+{
+  uint64_t b;
+  struct GNUNET_TIME_Relative ret;
+
+  b = ntohl (bps.value__);
+  if (0 == b)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Bandwidth suggests delay of infinity (zero bandwidth)\n");
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+  ret.rel_value_us = size * 1000LL * 1000LL / b;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Bandwidth suggests delay of %s for %llu bytes of traffic\n",
+       GNUNET_STRINGS_relative_time_to_string (ret, GNUNET_YES),
+       (unsigned long long) size);
+  return ret;
+}
+
+
+/**
+ * Task run whenever we hit the bandwidth limit for a tracker.
+ *
+ * @param cls the `struct GNUNET_BANDWIDTH_Tracker`
+ */
+static void
+excess_trigger (void *cls)
+{
+  struct GNUNET_BANDWIDTH_Tracker *av = cls;
+
+  av->excess_task = NULL;
+  if (NULL != av->excess_cb)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Notifying application about excess bandwidth\n");
+    av->excess_cb (av->excess_cb_cls);
+  }
+}
+
+
+/**
+ * Recalculate when we might need to call the excess callback.
+ */
+static void
+update_excess (struct GNUNET_BANDWIDTH_Tracker *av)
+{
+  struct GNUNET_TIME_Relative delay;
+  struct GNUNET_TIME_Absolute now;
+  uint64_t delta_time;
+  uint64_t delta_avail;
+  int64_t left_bytes;
+  uint64_t max_carry;
+  int64_t current_consumption;
+
+  if (NULL == av->excess_cb)
+    return; /* nothing to do */
+  now = GNUNET_TIME_absolute_get ();
+  delta_time = now.abs_value_us - av->last_update__.abs_value_us;
+  delta_avail =
+    (delta_time * ((unsigned long long) av->available_bytes_per_s__)
+     + 500000LL)
+    / 1000000LL;
+  current_consumption = av->consumption_since_last_update__ - delta_avail;
+  if (current_consumption > av->consumption_since_last_update__)
+  {
+    /* integer underflow, cap! */
+    current_consumption = INT64_MIN;
+  }
+  /* negative current_consumption means that we have savings */
+  max_carry = ((uint64_t) av->available_bytes_per_s__) * av->max_carry_s__;
+  if (max_carry < GNUNET_MAX_MESSAGE_SIZE)
+    max_carry = GNUNET_MAX_MESSAGE_SIZE;
+  if (max_carry > INT64_MAX)
+    max_carry = INT64_MAX;
+  left_bytes = current_consumption + max_carry;
+  if (left_bytes < current_consumption)
+  {
+    /* integer overflow, cap! */
+    left_bytes = INT64_MAX;
+  }
+  /* left_bytes now contains the number of bytes needed until
+     we have more savings than allowed */
+  if (left_bytes < 0)
+  {
+    /* having excess already */
+    delay = GNUNET_TIME_UNIT_ZERO;
+  }
+  else
+  {
+    double factor = 1.0 * left_bytes / (double) av->available_bytes_per_s__;
+    delay =
+      GNUNET_TIME_relative_saturating_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                                (unsigned long long) factor);
+  }
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "At %llu bps it will take us %s for %lld bytes to reach excess threshold\n",
+    (unsigned long long) av->available_bytes_per_s__,
+    GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_NO),
+    (long long) left_bytes);
+  if (NULL != av->excess_task)
+    GNUNET_SCHEDULER_cancel (av->excess_task);
+  av->excess_task = GNUNET_SCHEDULER_add_delayed (delay, &excess_trigger, av);
+}
+
+
+/**
+ * Initialize bandwidth tracker.  Note that in addition to the
+ * 'max_carry_s' limit, we also always allow at least
+ * #GNUNET_MAX_MESSAGE_SIZE to accumulate.  So if the
+ * bytes-per-second limit is so small that within 'max_carry_s' not
+ * even #GNUNET_MAX_MESSAGE_SIZE is allowed to accumulate, it is
+ * ignored and replaced by #GNUNET_MAX_MESSAGE_SIZE (which is in
+ * bytes).
+ *
+ * To stop notifications about updates and excess callbacks use
+ * #GNUNET_BANDWIDTH_tracker_notification_stop().
+ *
+ * @param av tracker to initialize
+ * @param update_cb callback to notify a client about the tracker being updated
+ * @param update_cb_cls cls for the callback
+ * @param bytes_per_second_limit initial limit to assume
+ * @param max_carry_s maximum number of seconds unused bandwidth
+ *        may accumulate before it expires
+ * @param excess_cb callback to notify if we have excess bandwidth
+ * @param excess_cb_cls closure for @a excess_cb
+ */
+void
+GNUNET_BANDWIDTH_tracker_init2 (
+  struct GNUNET_BANDWIDTH_Tracker *av,
+  GNUNET_BANDWIDTH_TrackerUpdateCallback update_cb,
+  void *update_cb_cls,
+  struct GNUNET_BANDWIDTH_Value32NBO bytes_per_second_limit,
+  uint32_t max_carry_s,
+  GNUNET_BANDWIDTH_ExcessNotificationCallback excess_cb,
+  void *excess_cb_cls)
+{
+  av->update_cb = update_cb;
+  av->update_cb_cls = update_cb_cls;
+  av->consumption_since_last_update__ = 0;
+  av->last_update__ = GNUNET_TIME_absolute_get ();
+  av->available_bytes_per_s__ = ntohl (bytes_per_second_limit.value__);
+  av->max_carry_s__ = max_carry_s;
+  av->excess_cb = excess_cb;
+  av->excess_cb_cls = excess_cb_cls;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Tracker %p initialized with %u Bps and max carry %u\n",
+       av,
+       (unsigned int) av->available_bytes_per_s__,
+       (unsigned int) max_carry_s);
+  update_excess (av);
+}
+
+
+void
+GNUNET_BANDWIDTH_tracker_init (
+  struct GNUNET_BANDWIDTH_Tracker *av,
+  GNUNET_BANDWIDTH_TrackerUpdateCallback update_cb,
+  void *update_cb_cls,
+  struct GNUNET_BANDWIDTH_Value32NBO bytes_per_second_limit,
+  uint32_t max_carry_s)
+{
+  GNUNET_BANDWIDTH_tracker_init2 (av,
+                                  update_cb,
+                                  update_cb_cls,
+                                  bytes_per_second_limit,
+                                  max_carry_s,
+                                  NULL,
+                                  NULL);
+}
+
+
+/**
+ * Stop notifying about tracker updates and excess notifications
+ *
+ * @param av the respective trackers
+ */
+void
+GNUNET_BANDWIDTH_tracker_notification_stop (struct GNUNET_BANDWIDTH_Tracker *av)
+{
+  if (NULL != av->excess_task)
+    GNUNET_SCHEDULER_cancel (av->excess_task);
+  av->excess_task = NULL;
+  av->excess_cb = NULL;
+  av->excess_cb_cls = NULL;
+  av->update_cb = NULL;
+  av->update_cb_cls = NULL;
+}
+
+
+/**
+ * Update the tracker, looking at the current time and
+ * bandwidth consumption data.
+ *
+ * @param av tracker to update
+ */
+static void
+update_tracker (struct GNUNET_BANDWIDTH_Tracker *av)
+{
+  struct GNUNET_TIME_Absolute now;
+  uint64_t delta_time;
+  uint64_t delta_avail;
+  uint64_t left_bytes;
+  uint64_t max_carry;
+
+  now = GNUNET_TIME_absolute_get ();
+  delta_time = now.abs_value_us - av->last_update__.abs_value_us;
+  delta_avail =
+    (delta_time * ((unsigned long long) av->available_bytes_per_s__)
+     + 500000LL)
+    / 1000000LL;
+  av->consumption_since_last_update__ -= delta_avail;
+  av->last_update__ = now;
+  if (av->consumption_since_last_update__ < 0)
+  {
+    left_bytes = -av->consumption_since_last_update__;
+    max_carry =
+      ((unsigned long long) av->available_bytes_per_s__) * av->max_carry_s__;
+    if (max_carry < GNUNET_MAX_MESSAGE_SIZE)
+      max_carry = GNUNET_MAX_MESSAGE_SIZE;
+    if (max_carry > INT64_MAX)
+      max_carry = INT64_MAX;
+    if (max_carry > left_bytes)
+      av->consumption_since_last_update__ = -left_bytes;
+    else
+      av->consumption_since_last_update__ = -max_carry;
+  }
+#if ! defined(GNUNET_CULL_LOGGING)
+  {
+    struct GNUNET_TIME_Relative delta;
+
+    delta.rel_value_us = delta_time;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Tracker %p updated, consumption at %lld at %u Bps, last update was %s ago\n",
+         av,
+         (long long) av->consumption_since_last_update__,
+         (unsigned int) av->available_bytes_per_s__,
+         GNUNET_STRINGS_relative_time_to_string (delta, GNUNET_YES));
+  }
+#endif
+}
+
+
+int
+GNUNET_BANDWIDTH_tracker_consume (struct GNUNET_BANDWIDTH_Tracker *av,
+                                  ssize_t size)
+{
+  int64_t nc;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Tracker %p consumes %d bytes\n",
+       av,
+       (int) size);
+  if (size > 0)
+  {
+    nc = av->consumption_since_last_update__ + size;
+    if (nc < av->consumption_since_last_update__)
+    {
+      /* integer overflow, very bad */
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    av->consumption_since_last_update__ = nc;
+    update_tracker (av);
+    update_excess (av);
+    if (av->consumption_since_last_update__ > 0)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Tracker %p consumption %llu bytes above limit\n",
+           av,
+           (unsigned long long) av->consumption_since_last_update__);
+      return GNUNET_YES;
+    }
+  }
+  else
+  {
+    nc = av->consumption_since_last_update__ + size;
+    if (nc > av->consumption_since_last_update__)
+    {
+      /* integer underflow, very bad */
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    av->consumption_since_last_update__ = nc;
+    update_excess (av);
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Compute how long we should wait until consuming 'size'
+ * bytes of bandwidth in order to stay within the given
+ * quota.
+ *
+ * @param av tracker to query
+ * @param size number of bytes we would like to consume
+ * @return time in ms to wait for consumption to be OK
+ */
+struct GNUNET_TIME_Relative
+GNUNET_BANDWIDTH_tracker_get_delay (struct GNUNET_BANDWIDTH_Tracker *av,
+                                    size_t size)
+{
+  struct GNUNET_TIME_Relative ret;
+  int64_t bytes_needed;
+
+  if (0 == av->available_bytes_per_s__)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG, "Tracker %p delay is infinity\n", av);
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+  update_tracker (av);
+  bytes_needed = size + av->consumption_since_last_update__;
+  if (bytes_needed <= 0)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Tracker %p delay for %u bytes is zero\n",
+         av,
+         (unsigned int) size);
+    return GNUNET_TIME_UNIT_ZERO;
+  }
+  ret.rel_value_us = (1000LL * 1000LL * bytes_needed)
+                     / (unsigned long long) av->available_bytes_per_s__;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Tracker %p delay for %u bytes is %s\n",
+       av,
+       (unsigned int) size,
+       GNUNET_STRINGS_relative_time_to_string (ret, GNUNET_YES));
+  return ret;
+}
+
+
+/**
+ * Compute how many bytes are available for consumption right now.
+ * quota.
+ *
+ * @param av tracker to query
+ * @return number of bytes available for consumption right now
+ */
+int64_t
+GNUNET_BANDWIDTH_tracker_get_available (struct GNUNET_BANDWIDTH_Tracker *av)
+{
+  struct GNUNET_BANDWIDTH_Value32NBO bps;
+  uint64_t avail;
+  int64_t used;
+
+  update_tracker (av);
+  bps = GNUNET_BANDWIDTH_value_init (av->available_bytes_per_s__);
+  avail =
+    GNUNET_BANDWIDTH_value_get_available_until (bps,
+                                                GNUNET_TIME_absolute_get_duration (
+                                                  av->last_update__));
+  used = av->consumption_since_last_update__;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Tracker %p available bandwidth is %lld bytes\n",
+       av,
+       (long long) (int64_t) (avail - used));
+  return (int64_t) (avail - used);
+}
+
+
+/**
+ * Update quota of bandwidth tracker.
+ *
+ * @param av tracker to initialize
+ * @param bytes_per_second_limit new limit to assume
+ */
+void
+GNUNET_BANDWIDTH_tracker_update_quota (
+  struct GNUNET_BANDWIDTH_Tracker *av,
+  struct GNUNET_BANDWIDTH_Value32NBO bytes_per_second_limit)
+{
+  uint32_t old_limit;
+  uint32_t new_limit;
+
+  new_limit = ntohl (bytes_per_second_limit.value__);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Tracker %p bandwidth changed to %u Bps\n",
+       av,
+       (unsigned int) new_limit);
+  update_tracker (av);
+  old_limit = av->available_bytes_per_s__;
+  av->available_bytes_per_s__ = new_limit;
+  if (NULL != av->update_cb)
+    av->update_cb (av->update_cb_cls);
+  if (old_limit > new_limit)
+    update_tracker (av); /* maximum excess might be less now */
+  update_excess (av);
+}
+
+
+/* end of bandwidth.c */
diff --git a/src/lib/util/benchmark.c b/src/lib/util/benchmark.c
new file mode 100644
index 000000000..c9fc8842e
--- /dev/null
+++ b/src/lib/util/benchmark.c
@@ -0,0 +1,294 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/benchmark.c
+ * @brief benchmarking for various operations
+ * @author Florian Dold <flo@dold.me>
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+#include <pthread.h>
+#include <sys/syscall.h>
+
+/**
+ * Thread-local storage key for the benchmark data.
+ */
+static pthread_key_t key;
+
+/**
+ * One-time initialization marker for key.
+ */
+static pthread_once_t key_once = PTHREAD_ONCE_INIT;
+
+
+/**
+ * Write benchmark data to a file.
+ *
+ * @param bd the benchmark data
+ */
+static void
+write_benchmark_data (struct BenchmarkData *bd)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  pid_t pid = getpid ();
+  pid_t tid = syscall (SYS_gettid);
+  char *benchmark_dir;
+  char *s;
+
+  benchmark_dir = getenv ("GNUNET_BENCHMARK_DIR");
+
+  if (NULL == benchmark_dir)
+    return;
+
+  if (GNUNET_OK != GNUNET_DISK_directory_create (benchmark_dir))
+  {
+    GNUNET_break (0);
+    return;
+  }
+
+  GNUNET_asprintf (&s, "%s/gnunet-benchmark-ops-%s-%llu-%llu.txt",
+                   benchmark_dir,
+                   (pid == tid) ? "main" : "thread",
+                   (unsigned long long) pid,
+                   (unsigned long long) tid);
+
+  fh = GNUNET_DISK_file_open (s,
+                              (GNUNET_DISK_OPEN_WRITE
+                               | GNUNET_DISK_OPEN_TRUNCATE
+                               | GNUNET_DISK_OPEN_CREATE),
+                              (GNUNET_DISK_PERM_USER_READ
+                               | GNUNET_DISK_PERM_USER_WRITE));
+  GNUNET_assert (NULL != fh);
+  GNUNET_free (s);
+
+#define WRITE_BENCHMARK_OP(opname) do { \
+    GNUNET_asprintf (&s, "op " #opname " count %llu time_us %llu\n", \
+                     (unsigned long long) bd->opname ## _count, \
+                     (unsigned long long) bd->opname ## _time.rel_value_us); \
+    GNUNET_assert (GNUNET_SYSERR != GNUNET_DISK_file_write_blocking (fh, s, \
+                                                                     strlen ( \
+                                                                       s))); \
+    GNUNET_free (s); \
+} while (0)
+
+  WRITE_BENCHMARK_OP (ecc_ecdh);
+  WRITE_BENCHMARK_OP (ecdh_eddsa);
+  WRITE_BENCHMARK_OP (ecdhe_key_create);
+  WRITE_BENCHMARK_OP (ecdhe_key_get_public);
+  WRITE_BENCHMARK_OP (ecdsa_ecdh);
+  WRITE_BENCHMARK_OP (ecdsa_key_create);
+  WRITE_BENCHMARK_OP (ecdsa_key_get_public);
+  WRITE_BENCHMARK_OP (ecdsa_sign);
+  WRITE_BENCHMARK_OP (ecdsa_verify);
+  WRITE_BENCHMARK_OP (eddsa_ecdh);
+  WRITE_BENCHMARK_OP (eddsa_key_create);
+  WRITE_BENCHMARK_OP (eddsa_key_get_public);
+  WRITE_BENCHMARK_OP (eddsa_sign);
+  WRITE_BENCHMARK_OP (eddsa_verify);
+  WRITE_BENCHMARK_OP (hash);
+  WRITE_BENCHMARK_OP (hash_context_finish);
+  WRITE_BENCHMARK_OP (hash_context_read);
+  WRITE_BENCHMARK_OP (hash_context_start);
+  WRITE_BENCHMARK_OP (hkdf);
+  WRITE_BENCHMARK_OP (rsa_blind);
+  WRITE_BENCHMARK_OP (rsa_private_key_create);
+  WRITE_BENCHMARK_OP (rsa_private_key_get_public);
+  WRITE_BENCHMARK_OP (rsa_sign_blinded);
+  WRITE_BENCHMARK_OP (rsa_unblind);
+  WRITE_BENCHMARK_OP (rsa_verify);
+
+#undef WRITE_BENCHMARK_OP
+
+  GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fh));
+
+  GNUNET_asprintf (&s, "%s/gnunet-benchmark-urls-%s-%llu-%llu.txt",
+                   benchmark_dir,
+                   (pid == tid) ? "main" : "thread",
+                   (unsigned long long) pid,
+                   (unsigned long long) tid);
+
+  fh = GNUNET_DISK_file_open (s,
+                              (GNUNET_DISK_OPEN_WRITE
+                               | GNUNET_DISK_OPEN_TRUNCATE
+                               | GNUNET_DISK_OPEN_CREATE),
+                              (GNUNET_DISK_PERM_USER_READ
+                               | GNUNET_DISK_PERM_USER_WRITE));
+  GNUNET_assert (NULL != fh);
+  GNUNET_free (s);
+
+  for (unsigned int i = 0; i < bd->urd_len; i++)
+  {
+    struct UrlRequestData *urd = &bd->urd[i];
+    GNUNET_asprintf (&s,
+                     "url %s status %u count %llu time_us %llu time_us_max %llu bytes_sent %llu bytes_received %llu\n",
+                     urd->request_url,
+                     urd->status,
+                     (unsigned long long) urd->count,
+                     (unsigned long long) urd->time.rel_value_us,
+                     (unsigned long long) urd->time_max.rel_value_us,
+                     (unsigned long long) urd->bytes_sent,
+                     (unsigned long long) urd->bytes_received);
+    GNUNET_assert (GNUNET_SYSERR != GNUNET_DISK_file_write_blocking (fh, s,
+                                                                     strlen (
+                                                                       s)));
+    GNUNET_free (s);
+  }
+
+  GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fh));
+}
+
+
+/**
+ * Called when the main thread exits and benchmark data for it was created.
+ */
+static void
+main_thread_destructor ()
+{
+  struct BenchmarkData *bd;
+
+  bd = pthread_getspecific (key);
+  if (NULL != bd)
+    write_benchmark_data (bd);
+}
+
+
+/**
+ * Called when a thread exits and benchmark data for it was created.
+ *
+ * @param cls closure
+ */
+static void
+thread_destructor (void *cls)
+{
+  struct BenchmarkData *bd = cls;
+
+  // main thread will be handled by atexit
+  if (getpid () == (pid_t) syscall (SYS_gettid))
+    return;
+
+  GNUNET_assert (NULL != bd);
+  write_benchmark_data (bd);
+}
+
+
+/**
+ * Initialize the thread-local variable key for benchmark data.
+ */
+static void
+make_key ()
+{
+  (void) pthread_key_create (&key, &thread_destructor);
+}
+
+
+/**
+ * Acquire the benchmark data for the current thread, allocate if necessary.
+ * Installs handler to collect the benchmark data on thread termination.
+ *
+ * @return benchmark data for the current thread
+ */
+struct BenchmarkData *
+get_benchmark_data (void)
+{
+  struct BenchmarkData *bd;
+
+  (void) pthread_once (&key_once, &make_key);
+
+  if (NULL == (bd = pthread_getspecific (key)))
+  {
+    bd = GNUNET_new (struct BenchmarkData);
+    (void) pthread_setspecific (key, bd);
+    if (getpid () == (pid_t) syscall (SYS_gettid))
+    {
+      // We're the main thread!
+      atexit (main_thread_destructor);
+    }
+  }
+  return bd;
+}
+
+
+/**
+ * Get benchmark data for a URL.  If the URL is too long, it's truncated
+ * before looking up the corresponding benchmark data.
+ *
+ * Statistics are bucketed by URL and status code.
+ *
+ * @param url url to get request data for
+ * @param status http status code
+ */
+struct UrlRequestData *
+get_url_benchmark_data (char *url, unsigned int status)
+{
+  char trunc[MAX_BENCHMARK_URL_LEN];
+  struct BenchmarkData *bd;
+
+  if (NULL == url)
+  {
+    /* Should not happen unless curl barfs */
+    GNUNET_break (0);
+    url = "<empty>";
+  }
+
+  memcpy (trunc, url, MAX_BENCHMARK_URL_LEN);
+  trunc[MAX_BENCHMARK_URL_LEN - 1] = 0;
+
+  /* We're not interested in what's after the query string */
+  for (size_t i = 0; i < strlen (trunc); i++)
+  {
+    if (trunc[i] == '?')
+    {
+      trunc[i] = 0;
+      break;
+    }
+  }
+
+  bd = get_benchmark_data ();
+
+  GNUNET_assert (bd->urd_len <= bd->urd_capacity);
+
+  for (unsigned int i = 0; i < bd->urd_len; i++)
+  {
+    if ((0 == strcmp (trunc, bd->urd[i].request_url)) &&
+        (bd->urd[i].status == status))
+      return &bd->urd[i];
+  }
+
+  {
+    struct UrlRequestData urd = { 0 };
+
+    memcpy (&urd.request_url, trunc, MAX_BENCHMARK_URL_LEN);
+    urd.status = status;
+
+    if (bd->urd_len == bd->urd_capacity)
+    {
+      bd->urd_capacity = 2 * (bd->urd_capacity + 1);
+      bd->urd = GNUNET_realloc (bd->urd, bd->urd_capacity * sizeof(struct
+                                                                   UrlRequestData));
+    }
+
+    bd->urd[bd->urd_len++] = urd;
+    return &bd->urd[bd->urd_len - 1];
+  }
+}
diff --git a/src/lib/util/benchmark.h b/src/lib/util/benchmark.h
new file mode 100644
index 000000000..e35fa50bd
--- /dev/null
+++ b/src/lib/util/benchmark.h
@@ -0,0 +1,174 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/benchmark.h
+ * @brief benchmarking for various operations
+ * @author Florian Dold <flo@dold.me>
+ */
+
+#ifndef BENCHMARK_H_
+#define BENCHMARK_H_
+
+#include "gnunet_time_lib.h"
+
+/**
+ * Maximum length of URLs considered for benchmarking.
+ * Shorter URLs are simply truncated.
+ */
+#define MAX_BENCHMARK_URL_LEN 128
+
+#if ENABLE_BENCHMARK
+#define BENCHMARK_START(opname) \
+  struct GNUNET_TIME_Absolute _benchmark_ ## opname ## _start = \
+    GNUNET_TIME_absolute_get ()
+#define BENCHMARK_END(opname) do { \
+    { \
+      struct GNUNET_TIME_Absolute _benchmark_ ## opname ## _end = \
+        GNUNET_TIME_absolute_get (); \
+      struct BenchmarkData *bd = get_benchmark_data (); \
+      bd->opname ## _count++; \
+      bd->opname ## _time = \
+        GNUNET_TIME_relative_add (bd->opname ## _time, \
+                                  GNUNET_TIME_absolute_get_difference ( \
+                                    _benchmark_ ## opname ## _start, \
+                                    _benchmark_ \
+                                    ## opname ## _end)); \
+    } \
+} while (0)
+#else
+#define BENCHMARK_START(opname) do { } while (0)
+#define BENCHMARK_END(opname) do { } while (0)
+#endif
+
+
+/**
+ * Struct for benchmark data for one URL.
+ */
+struct UrlRequestData
+{
+  /**
+   * Request URL, truncated (but 0-terminated).
+   */
+  char request_url[MAX_BENCHMARK_URL_LEN];
+
+  /**
+   * HTTP status code.
+   */
+  unsigned int status;
+
+  /**
+   * How often was the URL requested?
+   */
+  uint64_t count;
+
+  /**
+   * How many bytes were sent in total to request the URL.
+   */
+  uint64_t bytes_sent;
+
+  /**
+   * How many bytes were received in total as response to requesting this URL.
+   */
+  uint64_t bytes_received;
+
+  /**
+   * Total time spent requesting this URL.
+   */
+  struct GNUNET_TIME_Relative time;
+
+  /**
+   * Slowest time to response.
+   */
+  struct GNUNET_TIME_Relative time_max;
+
+  /**
+   * Fastest time to response.
+   */
+  struct GNUNET_TIME_Relative time_min;
+};
+
+#define GNUNET_DECLARE_BENCHMARK_OP(opname) \
+  uint64_t opname ## _count; \
+  struct GNUNET_TIME_Relative opname ## _time
+
+/**
+ * Thread-local struct for benchmarking data.
+ */
+struct BenchmarkData
+{
+  GNUNET_DECLARE_BENCHMARK_OP (ecc_ecdh);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdh_eddsa);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdhe_key_create);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdhe_key_get_public);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdsa_ecdh);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdsa_key_create);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdsa_key_get_public);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdsa_sign);
+  GNUNET_DECLARE_BENCHMARK_OP (ecdsa_verify);
+  GNUNET_DECLARE_BENCHMARK_OP (eddsa_ecdh);
+  GNUNET_DECLARE_BENCHMARK_OP (eddsa_key_create);
+  GNUNET_DECLARE_BENCHMARK_OP (eddsa_key_get_public);
+  GNUNET_DECLARE_BENCHMARK_OP (eddsa_sign);
+  GNUNET_DECLARE_BENCHMARK_OP (eddsa_verify);
+  GNUNET_DECLARE_BENCHMARK_OP (hash);
+  GNUNET_DECLARE_BENCHMARK_OP (hash_context_finish);
+  GNUNET_DECLARE_BENCHMARK_OP (hash_context_read);
+  GNUNET_DECLARE_BENCHMARK_OP (hash_context_start);
+  GNUNET_DECLARE_BENCHMARK_OP (hkdf);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_blind);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_private_key_create);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_private_key_get_public);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_sign_blinded);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_unblind);
+  GNUNET_DECLARE_BENCHMARK_OP (rsa_verify);
+
+  struct UrlRequestData *urd;
+
+  unsigned int urd_len;
+
+  unsigned int urd_capacity;
+};
+
+#undef GNUNET_DECLARE_BENCHMARK_OP
+
+
+/**
+ * Acquire the benchmark data for the current thread, allocate if necessary.
+ * Installs handler to collect the benchmark data on thread termination.
+ *
+ * @return benchmark data for the current thread
+ */
+struct BenchmarkData *
+get_benchmark_data (void);
+
+/**
+ * Get benchmark data for a URL.  If the URL is too long, it's truncated
+ * before looking up the corresponding benchmark data.
+ *
+ * Statistics are bucketed by URL and status code.
+ *
+ * @param url url to get request data for
+ * @param status http status code
+ */
+struct UrlRequestData *
+get_url_benchmark_data (char *url, unsigned int status);
+
+#endif  /* BENCHMARK_H_ */
diff --git a/src/lib/util/bio.c b/src/lib/util/bio.c
new file mode 100644
index 000000000..caf533108
--- /dev/null
+++ b/src/lib/util/bio.c
@@ -0,0 +1,1380 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2006, 2009, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/bio.c
+ * @brief functions for buffering IO
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-bio", __VA_ARGS__)
+
+#ifndef PATH_MAX
+/**
+ * Assumed maximum path length (for source file names).
+ */
+#define PATH_MAX 4096
+#endif
+
+
+/**
+ * Size for I/O buffers.
+ */
+#define BIO_BUFFER_SIZE 65536
+
+
+/**
+ * Enum used internally to know how buffering is handled.
+ *
+ * The idea is that by using an enum, BIO can be extended to support other
+ * kinds of "backend" for buffering (or just formatted I/O.)
+ */
+enum IOType
+{
+  /**
+   * The handle uses a file to read/write data.
+   */
+  IO_FILE = 0,
+
+  /**
+   * The data is stored entirely in memory.
+   */
+  IO_BUFFER,
+};
+
+
+/**
+ * Handle for buffered reading.
+ */
+struct GNUNET_BIO_ReadHandle
+{
+  /**
+   * The "backend" type.
+   */
+  enum IOType type;
+
+  /**
+   * Handle to a file on disk, if @e type is #IO_FILE.
+   */
+  struct GNUNET_DISK_FileHandle *fd;
+
+  /**
+   * Error message, NULL if there were no errors.
+   */
+  char *emsg;
+
+  /**
+   * I/O buffer.  Do @b not free!
+   */
+  char *buffer;
+
+  /**
+   * Number of bytes available in @e buffer.
+   */
+  size_t have;
+
+  /**
+   * Total size of @e buffer.
+   */
+  size_t size;
+
+  /**
+   * Current read offset in @e buffer.
+   */
+  off_t pos;
+};
+
+
+/**
+ * Open a file for reading.
+ *
+ * @param fn file name to be opened
+ * @return IO handle on success, NULL on error
+ */
+struct GNUNET_BIO_ReadHandle *
+GNUNET_BIO_read_open_file (const char *fn)
+{
+  struct GNUNET_DISK_FileHandle *fd;
+  struct GNUNET_BIO_ReadHandle *h;
+
+  fd = GNUNET_DISK_file_open (fn, GNUNET_DISK_OPEN_READ, GNUNET_DISK_PERM_NONE);
+  if (NULL == fd)
+    return NULL;
+  h = GNUNET_malloc (sizeof(struct GNUNET_BIO_ReadHandle) + BIO_BUFFER_SIZE);
+  h->type = IO_FILE;
+  h->buffer = (char *) &h[1];
+  h->size = BIO_BUFFER_SIZE;
+  h->fd = fd;
+  return h;
+}
+
+
+/**
+ * Create a handle from an existing allocated buffer.
+ *
+ * @param buffer the buffer to use as source
+ * @param size the total size in bytes of the buffer
+ * @return IO handle on success, NULL on error
+ */
+struct GNUNET_BIO_ReadHandle *
+GNUNET_BIO_read_open_buffer (void *buffer, size_t size)
+{
+  struct GNUNET_BIO_ReadHandle *h;
+
+  h = GNUNET_new (struct GNUNET_BIO_ReadHandle);
+  h->type = IO_BUFFER;
+  h->buffer = buffer;
+  h->size = size;
+  return h;
+}
+
+
+/**
+ * Close an open handle.  Reports if any errors reading
+ * from the file were encountered.
+ *
+ * @param h file handle
+ * @param emsg set to the (allocated) error message
+ *             if the handle has an error message, the return
+ *             value is #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_close (struct GNUNET_BIO_ReadHandle *h, char **emsg)
+{
+  int err;
+
+  err = (NULL == h->emsg) ? GNUNET_OK : GNUNET_SYSERR;
+  if (NULL != emsg)
+    *emsg = h->emsg;
+  else
+    GNUNET_free (h->emsg);
+  switch (h->type)
+  {
+  case IO_FILE:
+    GNUNET_DISK_file_close (h->fd);
+    break;
+  case IO_BUFFER:
+    break;
+  default:
+    break;
+  }
+  GNUNET_free (h);
+  return err;
+}
+
+
+void
+GNUNET_BIO_read_set_error (struct GNUNET_BIO_ReadHandle *h, const char*emsg)
+{
+  GNUNET_assert (NULL == h->emsg);
+  h->emsg = GNUNET_strdup (emsg);
+}
+
+
+/**
+ * Function used internally to read the contents of a file into a buffer.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to write the data to
+ * @param len the number of bytes to read
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_from_file (struct GNUNET_BIO_ReadHandle *h,
+                const char *what,
+                char *result,
+                size_t len)
+{
+  size_t pos = 0;
+  size_t min;
+  ssize_t ret;
+
+  do
+  {
+    min = h->have - h->pos;
+    if (0 < min)
+    {
+      if (len - pos < min)
+        min = len - pos;
+      GNUNET_memcpy (&result[pos], &h->buffer[h->pos], min);
+      h->pos += min;
+      pos += min;
+    }
+    if (len == pos)
+      return GNUNET_OK;
+    GNUNET_assert (((off_t) h->have) == h->pos);
+    ret = GNUNET_DISK_file_read (h->fd, h->buffer, h->size);
+    if (-1 == ret)
+    {
+      GNUNET_asprintf (&h->emsg,
+                       _ ("Error reading `%s' from file: %s"),
+                       what,
+                       strerror (errno));
+      return GNUNET_SYSERR;
+    }
+    if (0 == ret)
+    {
+      GNUNET_asprintf (&h->emsg,
+                       _ ("Error reading `%s' from file: %s"),
+                       what,
+                       _ ("End of file"));
+      return GNUNET_SYSERR;
+    }
+    h->pos = 0;
+    h->have = ret;
+  }
+  while (pos < len);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function used internally to read the content of a buffer into a buffer.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to write the result to
+ * @param len the number of bytes to read
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_from_buffer (struct GNUNET_BIO_ReadHandle *h,
+                  const char *what,
+                  char *result,
+                  size_t len)
+{
+  if ((h->size < len) || (h->size - h->pos < len))
+  {
+    GNUNET_asprintf (&h->emsg,
+                     _ ("Error while reading `%s' from buffer: %s"),
+                     what,
+                     _ ("Not enough data left"));
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (result, h->buffer + h->pos, len);
+  h->pos += len;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Read some contents into a buffer.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to write the result to
+ * @param len the number of bytes to read
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read (struct GNUNET_BIO_ReadHandle *h,
+                 const char *what,
+                 void *result,
+                 size_t len)
+{
+  char *dst = result;
+
+  if (NULL != h->emsg)
+    return GNUNET_SYSERR;
+
+  if (0 == len)
+    return GNUNET_OK;
+
+  switch (h->type)
+  {
+  case IO_FILE:
+    return read_from_file (h, what, dst, len);
+  case IO_BUFFER:
+    return read_from_buffer (h, what, dst, len);
+  default:
+    GNUNET_asprintf (&h->emsg,
+                     _ ("Invalid handle type while reading `%s'"),
+                     what);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Read 0-terminated string.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param result where to store the pointer to the (allocated) string
+ *        (note that *result could be set to NULL as well)
+ * @param max_length maximum allowed length for the string
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_string (struct GNUNET_BIO_ReadHandle *h,
+                        const char *what,
+                        char **result,
+                        size_t max_length)
+{
+  char *buf;
+  uint32_t big;
+
+  if (GNUNET_OK != GNUNET_BIO_read_int32 (h,
+                                          _ ("string length"),
+                                          (int32_t *) &big))
+  {
+    char *tmp = h->emsg;
+    if (NULL != tmp)
+      GNUNET_asprintf (&h->emsg,
+                       _ ("%s (while reading `%s')"),
+                       tmp,
+                       what);
+    else
+      GNUNET_asprintf (&h->emsg,
+                       _ ("Error reading length of string `%s'"),
+                       what);
+    GNUNET_free (tmp);
+    return GNUNET_SYSERR;
+  }
+  if (0 == big)
+  {
+    *result = NULL;
+    return GNUNET_OK;
+  }
+  if (big > max_length)
+  {
+    GNUNET_asprintf (&h->emsg,
+                     _ ("String `%s' longer than allowed (%u > %lu)"),
+                     what,
+                     big,
+                     (unsigned long) max_length);
+    return GNUNET_SYSERR;
+  }
+  buf = GNUNET_malloc (big);
+  *result = buf;
+  buf[--big] = '\0';
+  if (0 == big)
+    return GNUNET_OK;
+  if (GNUNET_OK != GNUNET_BIO_read (h, what, buf, big))
+  {
+    GNUNET_free (buf);
+    *result = NULL;
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Read a float.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param f address of float to read
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_float (struct GNUNET_BIO_ReadHandle *h,
+                       const char *what,
+                       float *f)
+{
+  int32_t *i = (int32_t *) f;
+  return GNUNET_BIO_read_int32 (h, what, i);
+}
+
+
+/**
+ * Read a double.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param f address of double to read
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_double (struct GNUNET_BIO_ReadHandle *h,
+                        const char *what,
+                        double *f)
+{
+  int64_t *i = (int64_t *) f;
+  return GNUNET_BIO_read_int64 (h, what, i);
+}
+
+
+/**
+ * Read an (u)int32_t.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param i where to store the data
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_int32 (struct GNUNET_BIO_ReadHandle *h,
+                       const char *what,
+                       int32_t *i)
+{
+  int32_t big;
+
+  if (GNUNET_OK != GNUNET_BIO_read (h, what, &big, sizeof(int32_t)))
+    return GNUNET_SYSERR;
+  *i = ntohl (big);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Read an (u)int64_t.
+ *
+ * @param h the IO handle to read from
+ * @param what describes what is being read (for error message creation)
+ * @param i where to store the data
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_int64 (struct GNUNET_BIO_ReadHandle *h,
+                       const char *what,
+                       int64_t *i)
+{
+  int64_t big;
+
+  if (GNUNET_OK != GNUNET_BIO_read (h, what, &big, sizeof(int64_t)))
+    return GNUNET_SYSERR;
+  *i = GNUNET_ntohll (big);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle for buffered writing.
+ */
+struct GNUNET_BIO_WriteHandle
+{
+  /**
+   * The "backend" type.
+   */
+  enum IOType type;
+
+  /**
+   * Handle to a file on disk, if @e type is #IO_FILE.
+   */
+  struct GNUNET_DISK_FileHandle *fd;
+
+  /**
+   * Error message, NULL if there were no errors.
+   */
+  char *emsg;
+
+  /**
+   * I/O buffer.
+   * This field is a void * because it is used to hold pointers to allocated
+   * structures or arrays and will be casted to the appropriate type.
+   */
+  void *buffer;
+
+  /**
+   * Number of bytes available in @e buffer.
+   */
+  size_t have;
+
+  /**
+   * Total size of @e buffer.
+   */
+  size_t size;
+};
+
+
+/**
+ * Open a file for writing.
+ *
+ * @param fn name of the file to be opened
+ * @return IO handle on success, NULL on error
+ */
+struct GNUNET_BIO_WriteHandle *
+GNUNET_BIO_write_open_file (const char *fn)
+{
+  struct GNUNET_DISK_FileHandle *fd;
+  struct GNUNET_BIO_WriteHandle *h;
+
+  fd = GNUNET_DISK_file_open (fn,
+                              GNUNET_DISK_OPEN_WRITE
+                              | GNUNET_DISK_OPEN_TRUNCATE
+                              | GNUNET_DISK_OPEN_CREATE,
+                              GNUNET_DISK_PERM_USER_READ
+                              | GNUNET_DISK_PERM_USER_WRITE);
+  if (NULL == fd)
+    return NULL;
+  h = GNUNET_malloc (sizeof(struct GNUNET_BIO_WriteHandle) + BIO_BUFFER_SIZE);
+  h->buffer = &h[1];
+  h->size = BIO_BUFFER_SIZE;
+  h->fd = fd;
+  return h;
+}
+
+
+/**
+ * Create a handle backed by an in-memory buffer.
+ *
+ * @return IO handle on success, NULL on error
+ */
+struct GNUNET_BIO_WriteHandle *
+GNUNET_BIO_write_open_buffer (void)
+{
+  struct GNUNET_BIO_WriteHandle *h;
+
+  h = GNUNET_new (struct GNUNET_BIO_WriteHandle);
+  h->type = IO_BUFFER;
+  h->buffer = (void *) GNUNET_malloc (sizeof (struct GNUNET_Buffer));
+  return h;
+}
+
+
+/**
+ * Close an IO handle.
+ * If the handle was using a file, the file will be closed.
+ *
+ * @param h file handle
+ * @param emsg set to the (allocated) error message
+ *        if the handle has an error message, the return value is #GNUNET_SYSERR
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_close (struct GNUNET_BIO_WriteHandle *h,
+                        char **emsg)
+{
+  int err;
+
+  err = (NULL == h->emsg) ? GNUNET_OK : GNUNET_SYSERR;
+  if (NULL != emsg)
+    *emsg = h->emsg;
+  else
+    GNUNET_free (h->emsg);
+  switch (h->type)
+  {
+  case IO_FILE:
+    if (NULL == h->fd)
+    {
+      err = GNUNET_SYSERR;
+      break;
+    }
+    if (GNUNET_OK != GNUNET_BIO_flush (h))
+    {
+      if (NULL != emsg)
+        *emsg = h->emsg;
+      else
+        GNUNET_free (h->emsg);
+      err = GNUNET_SYSERR;
+    }
+    else
+    {
+      GNUNET_DISK_file_close (h->fd);
+    }
+    break;
+  case IO_BUFFER:
+    GNUNET_buffer_clear ((struct GNUNET_Buffer *) h->buffer);
+    GNUNET_free (h->buffer);
+    break;
+  }
+  GNUNET_free (h);
+  return err;
+}
+
+
+/**
+ * Force a file-based buffered writer to flush its buffer.
+ * If the handle does not use a file, this function returns #GNUNET_OK
+ * without doing anything.
+ *
+ * @param h the IO handle
+ * @return #GNUNET_OK upon success.  Upon failure #GNUNET_SYSERR is returned
+ *         and the file is closed
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_flush (struct GNUNET_BIO_WriteHandle *h)
+{
+  ssize_t ret;
+
+  if (IO_FILE != h->type)
+    return GNUNET_OK;
+  ret = GNUNET_DISK_file_write (h->fd,
+                                h->buffer,
+                                h->have);
+  if (ret != (ssize_t) h->have)
+  {
+    GNUNET_DISK_file_close (h->fd);
+    h->fd = NULL;
+    GNUNET_free (h->emsg);
+    GNUNET_asprintf (&h->emsg,
+                     "Unable to flush buffer to file");
+    return GNUNET_SYSERR;
+  }
+  h->have = 0;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get the IO handle's contents.
+ * If the handle doesn't use an in-memory buffer, this function returns
+ * #GNUNET_SYSERR.
+ *
+ * @param h the IO handle
+ * @param emsg set to the (allocated) error message
+ *        if the handle has an error message the return value is #GNUNET_SYSERR
+ * @param contents where to store the pointer to the handle's contents
+ * @param size where to store the size of @e contents
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_get_buffer_contents (struct GNUNET_BIO_WriteHandle *h,
+                                char **emsg,
+                                void **contents,
+                                size_t *size)
+{
+  if (IO_BUFFER != h->type)
+    return GNUNET_SYSERR;
+  if ((NULL == contents) || (NULL == size))
+    return GNUNET_SYSERR;
+  enum GNUNET_GenericReturnValue ret
+    = (NULL != h->emsg)
+    ? GNUNET_SYSERR
+    : GNUNET_OK;
+  if (NULL != emsg)
+    *emsg = h->emsg;
+  else
+    GNUNET_free (h->emsg);
+  *contents = GNUNET_buffer_reap ((struct GNUNET_Buffer *) h->buffer, size);
+  return ret;
+}
+
+
+/**
+ * Function used internally to write the contents of a buffer into a file.
+ *
+ * @param h the IO handle to write to
+ * @param what describes what is being written (for error message creation)
+ * @param source the buffer to write
+ * @param len the number of bytes to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static enum GNUNET_GenericReturnValue
+write_to_file (struct GNUNET_BIO_WriteHandle *h,
+               const char *what,
+               const char *source,
+               size_t len)
+{
+  size_t min;
+  size_t pos = 0;
+  char *buffer = (char *) h->buffer;
+
+  if (NULL == h->fd)
+  {
+    GNUNET_asprintf (&h->emsg,
+                     _ ("Error while writing `%s' to file: %s"),
+                     what,
+                     _ ("No associated file"));
+    return GNUNET_SYSERR;
+  }
+
+  do
+  {
+    min = h->size - h->have;
+    if (len - pos < min)
+      min = len - pos;
+    GNUNET_memcpy (&buffer[h->have], &source[pos], min);
+    pos += min;
+    h->have += min;
+    if (len == pos)
+      return GNUNET_OK;
+    GNUNET_assert (h->have == h->size);
+    if (GNUNET_OK != GNUNET_BIO_flush (h))
+    {
+      char *tmp = h->emsg;
+      GNUNET_asprintf (&h->emsg,
+                       _ ("Error while writing `%s' to file: %s"),
+                       what,
+                       tmp);
+      GNUNET_free (tmp);
+      return GNUNET_SYSERR;
+    }
+  }
+  while (pos < len);
+  GNUNET_break (0);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function used internally to write the contents of a buffer to another buffer.
+ *
+ * @param h the IO handle to write to
+ * @param what describes what is being written (for error message creation)
+ * @param source the buffer to write
+ * @param len the number of bytes to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+write_to_buffer (struct GNUNET_BIO_WriteHandle *h,
+                 const char *what,
+                 const char *source,
+                 size_t len)
+{
+  GNUNET_buffer_write ((struct GNUNET_Buffer *) h->buffer, source, len);
+  h->have += len;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Write a buffer to a handle.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param buffer the data to write
+ * @param n number of bytes to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write (struct GNUNET_BIO_WriteHandle *h,
+                  const char *what,
+                  const void *buffer,
+                  size_t n)
+{
+  const char *src = buffer;
+
+  if (NULL != h->emsg)
+    return GNUNET_SYSERR;
+
+  if (0 == n)
+    return GNUNET_OK;
+
+  switch (h->type)
+  {
+  case IO_FILE:
+    return write_to_file (h, what, src, n);
+  case IO_BUFFER:
+    return write_to_buffer (h, what, src, n);
+  default:
+    GNUNET_asprintf (&h->emsg,
+                     _ ("Invalid handle type while writing `%s'"),
+                     what);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Write a 0-terminated string.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param s string to write (can be NULL)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_string (struct GNUNET_BIO_WriteHandle *h,
+                         const char *what,
+                         const char *s)
+{
+  uint32_t slen;
+
+  slen = (uint32_t) ((s == NULL) ? 0 : strlen (s) + 1);
+  if (GNUNET_OK != GNUNET_BIO_write_int32 (h, _ ("string length"), slen))
+    return GNUNET_SYSERR;
+  if (0 != slen)
+    return GNUNET_BIO_write (h, what, s, slen - 1);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Write a float.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param f float to write
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_float (struct GNUNET_BIO_WriteHandle *h,
+                        const char *what,
+                        float f)
+{
+  int32_t i = f;
+  return GNUNET_BIO_write_int32 (h, what, i);
+}
+
+
+/**
+ * Write a double.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param f double to write
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_double (struct GNUNET_BIO_WriteHandle *h,
+                         const char *what,
+                         double f)
+{
+  int64_t i = f;
+  return GNUNET_BIO_write_int64 (h, what, i);
+}
+
+
+/**
+ * Write an (u)int32_t.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param i 32-bit integer to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_int32 (struct GNUNET_BIO_WriteHandle *h,
+                        const char *what,
+                        int32_t i)
+{
+  int32_t big;
+
+  big = htonl (i);
+  return GNUNET_BIO_write (h, what, &big, sizeof(int32_t));
+}
+
+
+/**
+ * Write an (u)int64_t.
+ *
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param i 64-bit integer to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_int64 (struct GNUNET_BIO_WriteHandle *h,
+                        const char *what,
+                        int64_t i)
+{
+  int64_t big;
+
+  big = GNUNET_htonll (i);
+  return GNUNET_BIO_write (h, what, &big, sizeof(int64_t));
+}
+
+
+/**
+ * Function used internally to read some bytes from within a read spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to read from
+ * @param what what is being read (for error message creation)
+ * @param target where to store the data
+ * @param target_size how many bytes to read
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_spec_handler_object (void *cls,
+                          struct GNUNET_BIO_ReadHandle *h,
+                          const char *what,
+                          void *target,
+                          size_t target_size)
+{
+  return GNUNET_BIO_read (h, what, target, target_size);
+}
+
+
+/**
+ * Create the specification to read a certain amount of bytes.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param result the buffer to write the result to
+ * @param len the number of bytes to read
+ * @return the read spec
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_object (const char *what,
+                             void *result,
+                             size_t len)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_object,
+    .cls = NULL,
+    .what = what,
+    .target = result,
+    .size = len,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Function used internally to read a string from within a read spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to read from
+ * @param what what is being read (for error message creation)
+ * @param target where to store the data
+ * @param target_size how many bytes to read
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_spec_handler_string (void *cls,
+                          struct GNUNET_BIO_ReadHandle *h,
+                          const char *what,
+                          void *target,
+                          size_t target_size)
+{
+  char **result = target;
+  return GNUNET_BIO_read_string (h, what, result, target_size);
+}
+
+
+/**
+ * Create the specification to read a 0-terminated string.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param result where to store the pointer to the (allocated) string
+ *        (note that *result could be set to NULL as well)
+ * @param max_length maximum allowed length for the string
+ * @return the read spec
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_string (const char *what,
+                             char **result,
+                             size_t max_length)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_string,
+    .cls = NULL,
+    .target = result,
+    .size = max_length,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Function used internally to read an (u)int32_t from within a read spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to read from
+ * @param what what is being read (for error message creation)
+ * @param target where to store the data
+ * @param target_size ignored
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_spec_handler_int32 (void *cls,
+                         struct GNUNET_BIO_ReadHandle *h,
+                         const char *what,
+                         void *target,
+                         size_t target_size)
+{
+  int32_t *result = target;
+  return GNUNET_BIO_read_int32 (h, what, result);
+}
+
+
+/**
+ * Create the specification to read an (u)int32_t.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param i where to store the data
+ * @return the read spec
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_int32 (const char *what,
+                            int32_t *i)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_int32,
+    .cls = NULL,
+    .target = i,
+    .size = 0,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Function used internally to read an (u)int64_t from within a read spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to read from
+ * @param what what is being read (for error message creation)
+ * @param target where to store the data
+ * @param target_size ignored
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+read_spec_handler_int64 (void *cls,
+                         struct GNUNET_BIO_ReadHandle *h,
+                         const char *what,
+                         void *target,
+                         size_t target_size)
+{
+  int64_t *result = target;
+  return GNUNET_BIO_read_int64 (h, what, result);
+}
+
+
+/**
+ * Create the specification to read an (u)int64_t.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param i where to store the data
+ * @return the read spec
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_int64 (const char *what,
+                            int64_t *i)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_int64,
+    .cls = NULL,
+    .target = i,
+    .size = 0,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Create the specification to read a float.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param f address of float to read
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_float (const char *what, float *f)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_int32,
+    .cls = NULL,
+    .target = (int32_t *) f,
+    .size = 0,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Create the specification to read a double.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param f address of double to read
+ */
+struct GNUNET_BIO_ReadSpec
+GNUNET_BIO_read_spec_double (const char *what, double *f)
+{
+  struct GNUNET_BIO_ReadSpec rs = {
+    .rh = &read_spec_handler_int64,
+    .cls = NULL,
+    .target = (int64_t *) f,
+    .size = 0,
+  };
+
+  return rs;
+}
+
+
+/**
+ * Execute the read specifications in order.
+ *
+ * @param h the IO handle to read from
+ * @param rs array of read specs
+ *        the last element must be #GNUNET_BIO_read_spec_end
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_read_spec_commit (struct GNUNET_BIO_ReadHandle *h,
+                             struct GNUNET_BIO_ReadSpec *rs)
+{
+  int ret = GNUNET_OK;
+
+  for (size_t i = 0; NULL!=rs[i].rh; ++i)
+  {
+    ret = rs[i].rh (rs[i].cls, h, rs[i].what, rs[i].target, rs[i].size);
+    if (GNUNET_OK != ret)
+      return ret;
+  }
+
+  return ret;
+}
+
+
+/**
+ * Function used internally to write some bytes from within a write spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param source the data to write
+ * @param source_size how many bytes to write
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+write_spec_handler_object (void *cls,
+                           struct GNUNET_BIO_WriteHandle *h,
+                           const char *what,
+                           void *source,
+                           size_t source_size)
+{
+  return GNUNET_BIO_write (h, what, source, source_size);
+}
+
+
+/**
+ * Create the specification to read some bytes.
+ *
+ * @param what describes what is being written (for error message creation)
+ * @param source the data to write
+ * @param size how many bytes should be written
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_object (const char *what,
+                              void *source,
+                              size_t size)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_object,
+    .cls = NULL,
+    .what = what,
+    .source = source,
+    .source_size = size,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Function used internally to write a 0-terminated string from within a write
+ * spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param source the data to write
+ * @param source_size ignored
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+write_spec_handler_string (void *cls,
+                           struct GNUNET_BIO_WriteHandle *h,
+                           const char *what,
+                           void *source,
+                           size_t source_size)
+{
+  const char *s = source;
+  return GNUNET_BIO_write_string (h, what, s);
+}
+
+
+/**
+ * Create the specification to write a 0-terminated string.
+ *
+ * @param what describes what is being read (for error message creation)
+ * @param s string to write (can be NULL)
+ * @return the read spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_string (const char *what,
+                              const char *s)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_string,
+    .cls = NULL,
+    .what = what,
+    .source = (void *) s,
+    .source_size = 0,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Function used internally to write an (u)int32_t from within a write spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param source the data to write
+ * @param source_size ignored
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+write_spec_handler_int32 (void *cls,
+                          struct GNUNET_BIO_WriteHandle *h,
+                          const char *what,
+                          void *source,
+                          size_t source_size)
+{
+  int32_t i = *(int32_t *) source;
+  return GNUNET_BIO_write_int32 (h, what, i);
+}
+
+
+/**
+ * Create the specification to write an (u)int32_t.
+ *
+ * @param what describes what is being written (for error message creation)
+ * @param i pointer to a 32-bit integer
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_int32 (const char *what,
+                             int32_t *i)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_int32,
+    .cls = NULL,
+    .what = what,
+    .source = i,
+    .source_size = 0,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Function used internally to write an (u)int64_t from within a write spec.
+ *
+ * @param cls ignored, always NULL
+ * @param h the IO handle to write to
+ * @param what what is being written (for error message creation)
+ * @param source the data to write
+ * @param source_size ignored
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+static int
+write_spec_handler_int64 (void *cls,
+                          struct GNUNET_BIO_WriteHandle *h,
+                          const char *what,
+                          void *source,
+                          size_t source_size)
+{
+  int64_t i = *(int64_t *) source;
+  return GNUNET_BIO_write_int64 (h, what, i);
+}
+
+
+/**
+ * Create the specification to write an (u)int64_t.
+ *
+ * @param what describes what is being written (for error message creation)
+ * @param i pointer to a 64-bit integer
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_int64 (const char *what,
+                             int64_t *i)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_int64,
+    .cls = NULL,
+    .what = what,
+    .source = i,
+    .source_size = 0,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Create the specification to write a float.
+ *
+ * @param what describes what is being written (for error message creation)
+ * @param f pointer to a float
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_float (const char *what, float *f)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_int32,
+    .cls = NULL,
+    .what = what,
+    .source = (int32_t *) f,
+    .source_size = 0,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Create the specification to write an double.
+ *
+ * @param what describes what is being written (for error message creation)
+ * @param f pointer to a double
+ * @return the write spec
+ */
+struct GNUNET_BIO_WriteSpec
+GNUNET_BIO_write_spec_double (const char *what, double *f)
+{
+  struct GNUNET_BIO_WriteSpec ws = {
+    .wh = &write_spec_handler_int64,
+    .cls = NULL,
+    .what = what,
+    .source = (int64_t *) f,
+    .source_size = 0,
+  };
+
+  return ws;
+}
+
+
+/**
+ * Execute the write specifications in order.
+ *
+ * @param h the IO handle to write to
+ * @param ws array of write specs
+ *        the last element must be #GNUNET_BIO_write_spec_end
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BIO_write_spec_commit (struct GNUNET_BIO_WriteHandle *h,
+                              struct GNUNET_BIO_WriteSpec *ws)
+{
+  int ret = GNUNET_OK;
+
+  for (size_t i = 0; NULL!=ws[i].wh; ++i)
+  {
+    ret = ws[i].wh (ws[i].cls, h, ws[i].what, ws[i].source, ws[i].source_size);
+    if (GNUNET_OK != ret)
+      return ret;
+  }
+
+  /* If it's a file-based handle, the flush makes sure that the data in the
+     buffer is actually written to the disk. */
+  if (IO_FILE == h->type)
+    ret = GNUNET_BIO_flush (h);
+
+  return ret;
+}
+
+
+/* end of bio.c */
diff --git a/src/lib/util/buffer.c b/src/lib/util/buffer.c
new file mode 100644
index 000000000..f88c56849
--- /dev/null
+++ b/src/lib/util/buffer.c
@@ -0,0 +1,283 @@
+/*
+  This file is part of GNUnet
+  Copyright (C) 2020 GNUnet e.V.
+
+  GNUnet is free software; you can redistribute it and/or modify it under the
+  terms of the GNU Affero General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
+
+  You should have received a copy of the GNU Affero General Public License along with
+  GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file buffer.c
+ * @brief Common buffer management functions.
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Initialize a buffer with the given capacity.
+ *
+ * When a buffer is allocated with this function, a warning is logged
+ * when the buffer exceeds the initial capacity.
+ *
+ * @param buf the buffer to initialize
+ * @param capacity the capacity (in bytes) to allocate for @a buf
+ */
+void
+GNUNET_buffer_prealloc (struct GNUNET_Buffer *buf,
+                        size_t capacity)
+{
+  /* Buffer should be zero-initialized */
+  GNUNET_assert (0 == buf->mem);
+  GNUNET_assert (0 == buf->capacity);
+  GNUNET_assert (0 == buf->position);
+  buf->mem = GNUNET_malloc (capacity);
+  buf->capacity = capacity;
+  buf->warn_grow = GNUNET_YES;
+}
+
+
+/**
+ * Make sure that at least @a n bytes remaining in the buffer.
+ *
+ * @param buf buffer to potentially grow
+ * @param n number of bytes that should be available to write
+ */
+void
+GNUNET_buffer_ensure_remaining (struct GNUNET_Buffer *buf,
+                                size_t n)
+{
+  size_t new_capacity = buf->position + n;
+
+  /* guard against overflow */
+  GNUNET_assert (new_capacity >= buf->position);
+  if (new_capacity <= buf->capacity)
+    return;
+  /* warn if calculation of expected size was wrong */
+  GNUNET_break (GNUNET_YES != buf->warn_grow);
+  if (new_capacity < buf->capacity * 2)
+    new_capacity = buf->capacity * 2;
+  buf->capacity = new_capacity;
+  if (NULL != buf->mem)
+    buf->mem = GNUNET_realloc (buf->mem, new_capacity);
+  else
+    buf->mem = GNUNET_malloc (new_capacity);
+}
+
+
+/**
+ * Write bytes to the buffer.
+ *
+ * Grows the buffer if necessary.
+ *
+ * @param buf buffer to write to
+ * @param data data to read from
+ * @param len number of bytes to copy from @a data to @a buf
+ */
+void
+GNUNET_buffer_write (struct GNUNET_Buffer *buf,
+                     const char *data,
+                     size_t len)
+{
+  GNUNET_buffer_ensure_remaining (buf, len);
+  memcpy (buf->mem + buf->position, data, len);
+  buf->position += len;
+}
+
+
+/**
+ * Write a 0-terminated string to a buffer, excluding the 0-terminator.
+ *
+ * @param buf the buffer to write to
+ * @param str the string to write to @a buf
+ */
+void
+GNUNET_buffer_write_str (struct GNUNET_Buffer *buf,
+                         const char *str)
+{
+  size_t len = strlen (str);
+
+  GNUNET_buffer_write (buf, str, len);
+}
+
+
+/**
+ * Clear the buffer and return the string it contained.
+ * The caller is responsible to eventually #GNUNET_free
+ * the returned string.
+ *
+ * The returned string is always 0-terminated.
+ *
+ * @param buf the buffer to reap the string from
+ * @returns the buffer contained in the string
+ */
+char *
+GNUNET_buffer_reap_str (struct GNUNET_Buffer *buf)
+{
+  char *res;
+
+  /* ensure 0-termination */
+  if ( (0 == buf->position) || ('\0' != buf->mem[buf->position - 1]))
+  {
+    GNUNET_buffer_ensure_remaining (buf, 1);
+    buf->mem[buf->position++] = '\0';
+  }
+  res = buf->mem;
+  memset (buf, 0, sizeof (struct GNUNET_Buffer));
+  return res;
+}
+
+
+/**
+ * Clear the buffer and return its contents.
+ * The caller is responsible to eventually #GNUNET_free
+ * the returned data.
+ *
+ * @param buf the buffer to reap the contents from
+ * @param size where to store the size of the returned data
+ * @returns the data contained in the string
+ */
+void *
+GNUNET_buffer_reap (struct GNUNET_Buffer *buf, size_t *size)
+{
+  *size = buf->position;
+  void *res = buf->mem;
+  memset (buf, 0, sizeof (struct GNUNET_Buffer));
+  return res;
+}
+
+
+/**
+ * Free the backing memory of the given buffer.
+ * Does not free the memory of the buffer control structure,
+ * which is typically stack-allocated.
+ */
+void
+GNUNET_buffer_clear (struct GNUNET_Buffer *buf)
+{
+  GNUNET_free (buf->mem);
+  memset (buf, 0, sizeof (struct GNUNET_Buffer));
+}
+
+
+/**
+ * Write a path component to a buffer, ensuring that
+ * there is exactly one slash between the previous contents
+ * of the buffer and the new string.
+ *
+ * @param buf buffer to write to
+ * @param str string containing the new path component
+ */
+void
+GNUNET_buffer_write_path (struct GNUNET_Buffer *buf, const char *str)
+{
+  size_t len = strlen (str);
+
+  while ( (0 != len) && ('/' == str[0]) )
+  {
+    str++;
+    len--;
+  }
+  if ( (0 == buf->position) || ('/' != buf->mem[buf->position - 1]) )
+  {
+    GNUNET_buffer_ensure_remaining (buf, 1);
+    buf->mem[buf->position++] = '/';
+  }
+  GNUNET_buffer_write (buf, str, len);
+}
+
+
+/**
+ * Write a 0-terminated formatted string to a buffer, excluding the
+ * 0-terminator.
+ *
+ * Grows the buffer if necessary.
+ *
+ * @param buf the buffer to write to
+ * @param fmt format string
+ * @param ... format arguments
+ */
+void
+GNUNET_buffer_write_fstr (struct GNUNET_Buffer *buf, const char *fmt, ...)
+{
+  va_list args;
+
+  va_start (args, fmt);
+  GNUNET_buffer_write_vfstr (buf, fmt, args);
+  va_end (args);
+}
+
+
+/**
+ * Write a 0-terminated formatted string to a buffer, excluding the
+ * 0-terminator.
+ *
+ * Grows the buffer if necessary.
+ *
+ * @param buf the buffer to write to
+ * @param fmt format string
+ * @param args format argument list
+ */
+void
+GNUNET_buffer_write_vfstr (struct GNUNET_Buffer *buf,
+                           const char *fmt,
+                           va_list args)
+{
+  int res;
+  va_list args2;
+
+  va_copy (args2, args);
+  res = vsnprintf (NULL, 0, fmt, args2);
+  va_end (args2);
+
+  GNUNET_assert (res >= 0);
+  GNUNET_buffer_ensure_remaining (buf, res + 1);
+
+  va_copy (args2, args);
+  res = vsnprintf (buf->mem + buf->position, res + 1, fmt, args2);
+  va_end (args2);
+
+  GNUNET_assert (res >= 0);
+  buf->position += res;
+  GNUNET_assert (buf->position <= buf->capacity);
+}
+
+
+/**
+ * Write data encoded via #GNUNET_STRINGS_data_to_string to the buffer.
+ *
+ * Grows the buffer if necessary.
+ *
+ * @param buf buffer to write to
+ * @param data data to read from
+ * @param data_len number of bytes to copy from @a data to @a buf
+ */
+void
+GNUNET_buffer_write_data_encoded (struct GNUNET_Buffer *buf,
+                                  const void *data,
+                                  size_t data_len)
+{
+  size_t outlen = data_len * 8;
+
+  if (outlen % 5 > 0)
+    outlen += 5 - outlen % 5;
+  outlen /= 5;
+  GNUNET_buffer_ensure_remaining (buf,
+                                  outlen);
+  GNUNET_assert (NULL !=
+                 GNUNET_STRINGS_data_to_string (data,
+                                                data_len,
+                                                (buf->mem
+                                                 + buf->position),
+                                                outlen));
+  buf->position += outlen;
+  GNUNET_assert (buf->position <= buf->capacity);
+}
diff --git a/src/lib/util/child_management.c b/src/lib/util/child_management.c
new file mode 100644
index 000000000..e78ebac9f
--- /dev/null
+++ b/src/lib/util/child_management.c
@@ -0,0 +1,240 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021-2023 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/child_management.c
+ * @brief Handling of child processes in GNUnet.
+ * @author Christian Grothoff (ANASTASIS)
+ * @author Dominik Meister (ANASTASIS)
+ * @author t3sserakt
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+ * Struct which defines a Child Wait handle
+ */
+struct GNUNET_ChildWaitHandle
+{
+  /**
+   * Linked list to the next child
+   */
+  struct GNUNET_ChildWaitHandle *next;
+  /**
+   * Linked list to the previous child
+   */
+  struct GNUNET_ChildWaitHandle *prev;
+  /**
+   * Child process which is managed
+   */
+  struct GNUNET_OS_Process *proc;
+  /**
+   * Callback which is called upon completion/death of the child task
+   */
+  GNUNET_ChildCompletedCallback cb;
+  /**
+   * Closure for the handle
+   */
+  void *cb_cls;
+};
+
+
+/**
+ * Pipe used to communicate shutdown via signal.
+ */
+static struct GNUNET_DISK_PipeHandle *sigpipe;
+
+static struct GNUNET_SIGNAL_Context *shc_chld;
+
+static struct GNUNET_SCHEDULER_Task *sig_task;
+
+static struct GNUNET_ChildWaitHandle *cwh_head;
+
+static struct GNUNET_ChildWaitHandle *cwh_tail;
+
+/**
+ * Task triggered whenever we receive a SIGCHLD (child
+ * process died) or when user presses CTRL-C.
+ *
+ * @param cls closure, NULL
+ */
+static void
+maint_child_death (void *cls)
+{
+  char buf[16];
+  const struct GNUNET_DISK_FileHandle *pr;
+  struct GNUNET_ChildWaitHandle *nxt;
+
+  (void) cls;
+  sig_task = NULL;
+  /* drain pipe */
+  pr = GNUNET_DISK_pipe_handle (sigpipe,
+                                GNUNET_DISK_PIPE_END_READ);
+  GNUNET_assert (! GNUNET_DISK_handle_invalid (pr));
+  (void) GNUNET_DISK_file_read (pr,
+                                buf,
+                                sizeof(buf));
+
+  /* find applicable processes that exited */
+  for (struct GNUNET_ChildWaitHandle *cwh = cwh_head;
+       NULL != cwh;
+       cwh = nxt)
+  {
+    enum GNUNET_OS_ProcessStatusType type;
+    long unsigned int exit_code = 0;
+
+    nxt = cwh->next;
+    if (GNUNET_OK ==
+        GNUNET_OS_process_status (cwh->proc,
+                                  &type,
+                                  &exit_code))
+    {
+      GNUNET_CONTAINER_DLL_remove (cwh_head,
+                                   cwh_tail,
+                                   cwh);
+      cwh->cb (cwh->cb_cls,
+               type,
+               exit_code);
+      GNUNET_free (cwh);
+    }
+  }
+  if (NULL == cwh_head)
+    return;
+  /* wait for more */
+  sig_task = GNUNET_SCHEDULER_add_read_file (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    GNUNET_DISK_pipe_handle (sigpipe,
+                             GNUNET_DISK_PIPE_END_READ),
+    &maint_child_death,
+    NULL);
+}
+
+
+/**
+ * Signal handler called for SIGCHLD.  Triggers the
+ * respective handler by writing to the trigger pipe.
+ */
+static void
+sighandler_child_death (void)
+{
+  static char c;
+  int old_errno = errno; /* back-up errno */
+
+  GNUNET_break (
+    1 ==
+    GNUNET_DISK_file_write (GNUNET_DISK_pipe_handle (sigpipe,
+                                                     GNUNET_DISK_PIPE_END_WRITE),
+                            &c,
+                            sizeof(c)));
+  errno = old_errno; /* restore errno */
+}
+
+
+/**
+ * Initializing the signal pipe for child handling.
+ */
+static void
+child_management_start (void)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Trying to start child management.\n");
+  if (NULL != sigpipe)
+    return; /* already initialized */
+  sigpipe = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+  GNUNET_assert (sigpipe != NULL);
+  shc_chld =
+    GNUNET_SIGNAL_handler_install (GNUNET_SIGCHLD,
+                                   &sighandler_child_death);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Child management started.\n");
+}
+
+
+/**
+ * Clean up.
+ */
+static void
+child_management_done (void)
+{
+  if (NULL != sig_task)
+  {
+    GNUNET_SCHEDULER_cancel (sig_task);
+    sig_task = NULL;
+  }
+  GNUNET_SIGNAL_handler_uninstall (shc_chld);
+  shc_chld = NULL;
+  GNUNET_DISK_pipe_close (sigpipe);
+  sigpipe = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Child management stopped.\n");
+}
+
+
+struct GNUNET_ChildWaitHandle *
+GNUNET_wait_child (struct GNUNET_OS_Process *proc,
+                   GNUNET_ChildCompletedCallback cb,
+                   void *cb_cls)
+{
+  struct GNUNET_ChildWaitHandle *cwh;
+  bool may_race = (NULL == sigpipe);
+
+  child_management_start ();
+  cwh = GNUNET_new (struct GNUNET_ChildWaitHandle);
+  cwh->proc = proc;
+  cwh->cb = cb;
+  cwh->cb_cls = cb_cls;
+  GNUNET_CONTAINER_DLL_insert (cwh_head,
+                               cwh_tail,
+                               cwh);
+  if (NULL == sig_task)
+  {
+    sig_task = GNUNET_SCHEDULER_add_read_file (
+      GNUNET_TIME_UNIT_FOREVER_REL,
+      GNUNET_DISK_pipe_handle (sigpipe,
+                               GNUNET_DISK_PIPE_END_READ),
+      &maint_child_death,
+      NULL);
+  }
+  /* Handle race-condition case where the child terminated just before we
+     installed the signal handler and thus we missed the signal. */
+  if (may_race)
+    sighandler_child_death ();
+  return cwh;
+}
+
+
+void
+GNUNET_wait_child_cancel (struct GNUNET_ChildWaitHandle *cwh)
+{
+  GNUNET_CONTAINER_DLL_remove (cwh_head,
+                               cwh_tail,
+                               cwh);
+  GNUNET_free (cwh);
+  if (NULL != cwh_head)
+    return;
+  child_management_done ();
+}
diff --git a/src/lib/util/child_management_test.sh b/src/lib/util/child_management_test.sh
new file mode 100755
index 000000000..a35b865f3
--- /dev/null
+++ b/src/lib/util/child_management_test.sh
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+echo "$1$2" >> child_management_test.txt
diff --git a/src/lib/util/client.c b/src/lib/util/client.c
new file mode 100644
index 000000000..fb2120ee8
--- /dev/null
+++ b/src/lib/util/client.c
@@ -0,0 +1,1112 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2016, 2019 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/client.c
+ * @brief code for access to services
+ * @author Christian Grothoff
+ *
+ * Generic TCP code for reliable, record-oriented TCP
+ * connections between clients and service providers.
+ */
+
+#include "platform.h"
+#include "gnunet_protocols.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_resolver_service.h"
+#include "gnunet_socks.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-client", __VA_ARGS__)
+
+/**
+ * Timeout we use on TCP connect before trying another
+ * result from the DNS resolver.  Actual value used
+ * is this value divided by the number of address families.
+ * Default is 5s.
+ */
+#define CONNECT_RETRY_TIMEOUT GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_SECONDS, 5)
+
+
+/**
+ * Internal state for a client connected to a GNUnet service.
+ */
+struct ClientState;
+
+
+/**
+ * During connect, we try multiple possible IP addresses
+ * to find out which one might work.
+ */
+struct AddressProbe
+{
+  /**
+   * This is a linked list.
+   */
+  struct AddressProbe *next;
+
+  /**
+   * This is a doubly-linked list.
+   */
+  struct AddressProbe *prev;
+
+  /**
+   * The address; do not free (allocated at the end of this struct).
+   */
+  const struct sockaddr *addr;
+
+  /**
+   * Underlying OS's socket.
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * Connection for which we are probing.
+   */
+  struct ClientState *cstate;
+
+  /**
+   * Length of addr.
+   */
+  socklen_t addrlen;
+
+  /**
+   * Task waiting for the connection to finish connecting.
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+};
+
+
+/**
+ * Internal state for a client connected to a GNUnet service.
+ */
+struct ClientState
+{
+  /**
+   * The connection handle, NULL if not live
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * Handle to a pending DNS lookup request, NULL if DNS is finished.
+   */
+  struct GNUNET_RESOLVER_RequestHandle *dns_active;
+
+  /**
+   * Our configuration.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Linked list of sockets we are currently trying out
+   * (during connect).
+   */
+  struct AddressProbe *ap_head;
+
+  /**
+   * Linked list of sockets we are currently trying out
+   * (during connect).
+   */
+  struct AddressProbe *ap_tail;
+
+  /**
+   * Name of the service we interact with.
+   */
+  char *service_name;
+
+  /**
+   * Hostname, if any.
+   */
+  char *hostname;
+
+  /**
+   * Next message to transmit to the service. NULL for none.
+   */
+  const struct GNUNET_MessageHeader *msg;
+
+  /**
+   * Task for trying to connect to the service.
+   */
+  struct GNUNET_SCHEDULER_Task *retry_task;
+
+  /**
+   * Task for sending messages to the service.
+   */
+  struct GNUNET_SCHEDULER_Task *send_task;
+
+  /**
+   * Task for sending messages to the service.
+   */
+  struct GNUNET_SCHEDULER_Task *recv_task;
+
+  /**
+   * Tokenizer for inbound messages.
+   */
+  struct GNUNET_MessageStreamTokenizer *mst;
+
+  /**
+   * Message queue under our control.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Timeout for receiving a response (absolute time).
+   */
+  struct GNUNET_TIME_Absolute receive_timeout;
+
+  /**
+   * Current value for our incremental back-off (for
+   * connect re-tries).
+   */
+  struct GNUNET_TIME_Relative back_off;
+
+  /**
+   * TCP port (0 for disabled).
+   */
+  unsigned long long port;
+
+  /**
+   * Offset in the message where we are for transmission.
+   */
+  size_t msg_off;
+
+  /**
+   * How often have we tried to connect?
+   */
+  unsigned int attempts;
+
+  /**
+   * Are we supposed to die?  #GNUNET_SYSERR if destruction must be
+   * deferred, #GNUNET_NO by default, #GNUNET_YES if destruction was
+   * deferred.
+   */
+  int in_destroy;
+};
+
+
+/**
+ * Try to connect to the service.
+ *
+ * @param cls the `struct ClientState` to try to connect to the service
+ */
+static void
+start_connect (void *cls);
+
+
+/**
+ * We've failed for good to establish a connection (timeout or
+ * no more addresses to try).
+ *
+ * @param cstate the connection we tried to establish
+ */
+static void
+connect_fail_continuation (struct ClientState *cstate)
+{
+  GNUNET_break (NULL == cstate->ap_head);
+  GNUNET_break (NULL == cstate->ap_tail);
+  GNUNET_break (NULL == cstate->dns_active);
+  GNUNET_break (NULL == cstate->sock);
+  GNUNET_assert (NULL == cstate->send_task);
+  GNUNET_assert (NULL == cstate->recv_task);
+  // GNUNET_assert (NULL == cstate->proxy_handshake);
+
+  cstate->back_off = GNUNET_TIME_STD_BACKOFF (cstate->back_off);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Failed to establish connection to `%s', no further addresses to try, will try again in %s.\n",
+       cstate->service_name,
+       GNUNET_STRINGS_relative_time_to_string (cstate->back_off,
+                                               GNUNET_YES));
+  cstate->retry_task
+    = GNUNET_SCHEDULER_add_delayed (cstate->back_off,
+                                    &start_connect,
+                                    cstate);
+}
+
+
+/**
+ * We are ready to send a message to the service.
+ *
+ * @param cls the `struct ClientState` with the `msg` to transmit
+ */
+static void
+transmit_ready (void *cls)
+{
+  struct ClientState *cstate = cls;
+  ssize_t ret;
+  size_t len;
+  const char *pos;
+  int notify_in_flight;
+
+  cstate->send_task = NULL;
+  if (GNUNET_YES == cstate->in_destroy)
+    return;
+  pos = (const char *) cstate->msg;
+  len = ntohs (cstate->msg->size);
+  GNUNET_assert (cstate->msg_off < len);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "message of type %u and size %u trying to send with socket %p (MQ: %p\n",
+       ntohs (cstate->msg->type),
+       ntohs (cstate->msg->size),
+       cstate->sock,
+       cstate->mq);
+
+RETRY:
+  ret = GNUNET_NETWORK_socket_send (cstate->sock,
+                                    &pos[cstate->msg_off],
+                                    len - cstate->msg_off);
+  if ( (-1 == ret) &&
+       ( (EAGAIN == errno) ||
+         (EINTR == errno) ) )
+  {
+    /* ignore */
+    ret = 0;
+  }
+  if (-1 == ret)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Error during sending message of type %u: %s\n",
+         ntohs (cstate->msg->type),
+         strerror (errno));
+    if (EINTR == errno)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Retrying message of type %u\n",
+           ntohs (cstate->msg->type));
+      goto RETRY;
+    }
+    GNUNET_MQ_inject_error (cstate->mq,
+                            GNUNET_MQ_ERROR_WRITE);
+    return;
+  }
+  notify_in_flight = (0 == cstate->msg_off);
+  cstate->msg_off += ret;
+  if (cstate->msg_off < len)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "rescheduling message of type %u\n",
+         ntohs (cstate->msg->type));
+    cstate->send_task
+      = GNUNET_SCHEDULER_add_write_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                        cstate->sock,
+                                        &transmit_ready,
+                                        cstate);
+    if (notify_in_flight)
+      GNUNET_MQ_impl_send_in_flight (cstate->mq);
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sending message of type %u and size %u successful\n",
+       ntohs (cstate->msg->type),
+       ntohs (cstate->msg->size));
+  cstate->msg = NULL;
+  GNUNET_MQ_impl_send_continue (cstate->mq);
+}
+
+
+/**
+ * We have received a full message, pass to the MQ dispatcher.
+ * Called by the tokenizer via #receive_ready().
+ *
+ * @param cls the `struct ClientState`
+ * @param msg message we received.
+ * @return #GNUNET_OK on success,
+ *     #GNUNET_NO to stop further processing due to disconnect (no error)
+ *     #GNUNET_SYSERR to stop further processing due to error
+ */
+static enum GNUNET_GenericReturnValue
+recv_message (void *cls,
+              const struct GNUNET_MessageHeader *msg)
+{
+  struct ClientState *cstate = cls;
+
+  if (GNUNET_YES == cstate->in_destroy)
+    return GNUNET_NO;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received message of type %u and size %u from %s\n",
+       ntohs (msg->type),
+       ntohs (msg->size),
+       cstate->service_name);
+  GNUNET_MQ_inject_message (cstate->mq,
+                            msg);
+  if (GNUNET_YES == cstate->in_destroy)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cancel all remaining connect attempts
+ *
+ * @param cstate handle of the client state to process
+ */
+static void
+cancel_aps (struct ClientState *cstate)
+{
+  struct AddressProbe *pos;
+
+  while (NULL != (pos = cstate->ap_head))
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (pos->sock));
+    GNUNET_SCHEDULER_cancel (pos->task);
+    GNUNET_CONTAINER_DLL_remove (cstate->ap_head,
+                                 cstate->ap_tail,
+                                 pos);
+    GNUNET_free (pos);
+  }
+}
+
+
+/**
+ * Implement the destruction of a message queue.  Implementations must
+ * not free @a mq, but should take care of @a impl_state.
+ *
+ * @param mq the message queue to destroy
+ * @param impl_state our `struct ClientState`
+ */
+static void
+connection_client_destroy_impl (struct GNUNET_MQ_Handle *mq,
+                                void *impl_state)
+{
+  struct ClientState *cstate = impl_state;
+
+  (void) mq;
+  if (NULL != cstate->dns_active)
+  {
+    GNUNET_RESOLVER_request_cancel (cstate->dns_active);
+    cstate->dns_active = NULL;
+  }
+  if (NULL != cstate->send_task)
+  {
+    GNUNET_SCHEDULER_cancel (cstate->send_task);
+    cstate->send_task = NULL;
+  }
+  if (NULL != cstate->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (cstate->retry_task);
+    cstate->retry_task = NULL;
+  }
+  if (GNUNET_SYSERR == cstate->in_destroy)
+  {
+    /* defer destruction */
+    cstate->in_destroy = GNUNET_YES;
+    cstate->mq = NULL;
+    return;
+  }
+  if (NULL != cstate->recv_task)
+  {
+    GNUNET_SCHEDULER_cancel (cstate->recv_task);
+    cstate->recv_task = NULL;
+  }
+  if (NULL != cstate->sock)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "destroying socket: %p\n",
+         cstate->sock);
+    GNUNET_NETWORK_socket_close (cstate->sock);
+  }
+  cancel_aps (cstate);
+  GNUNET_free (cstate->service_name);
+  GNUNET_free (cstate->hostname);
+  GNUNET_MST_destroy (cstate->mst);
+  GNUNET_free (cstate);
+}
+
+
+/**
+ * This function is called once we have data ready to read.
+ *
+ * @param cls `struct ClientState` with connection to read from
+ */
+static void
+receive_ready (void *cls)
+{
+  struct ClientState *cstate = cls;
+  enum GNUNET_GenericReturnValue ret;
+
+  cstate->recv_task = NULL;
+  cstate->in_destroy = GNUNET_SYSERR;
+  ret = GNUNET_MST_read (cstate->mst,
+                         cstate->sock,
+                         GNUNET_NO,
+                         GNUNET_NO);
+  if (GNUNET_SYSERR == ret)
+  {
+    if (NULL != cstate->mq)
+      GNUNET_MQ_inject_error (cstate->mq,
+                              GNUNET_MQ_ERROR_READ);
+    if (GNUNET_YES == cstate->in_destroy)
+      connection_client_destroy_impl (cstate->mq,
+                                      cstate);
+    return;
+  }
+  if (GNUNET_YES == cstate->in_destroy)
+  {
+    connection_client_destroy_impl (cstate->mq,
+                                    cstate);
+    return;
+  }
+  cstate->in_destroy = GNUNET_NO;
+  GNUNET_assert (NULL == cstate->recv_task);
+  cstate->recv_task
+    = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                     cstate->sock,
+                                     &receive_ready,
+                                     cstate);
+}
+
+
+/**
+ * We've succeeded in establishing a connection.
+ *
+ * @param cstate the connection we tried to establish
+ */
+static void
+connect_success_continuation (struct ClientState *cstate)
+{
+  GNUNET_assert (NULL == cstate->recv_task);
+  cstate->recv_task
+    = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                     cstate->sock,
+                                     &receive_ready,
+                                     cstate);
+  if (NULL != cstate->msg)
+  {
+    GNUNET_assert (NULL == cstate->send_task);
+    cstate->send_task
+      = GNUNET_SCHEDULER_add_write_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                        cstate->sock,
+                                        &transmit_ready,
+                                        cstate);
+  }
+}
+
+
+/**
+ * Try connecting to the server using UNIX domain sockets.
+ *
+ * @param service_name name of service to connect to
+ * @param cfg configuration to use
+ * @return NULL on error, socket connected to UNIX otherwise
+ */
+static struct GNUNET_NETWORK_Handle *
+try_unixpath (const char *service_name,
+              const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+#if AF_UNIX
+  struct GNUNET_NETWORK_Handle *sock;
+  char *unixpath;
+  struct sockaddr_un s_un;
+
+  unixpath = NULL;
+  if ((GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                service_name,
+                                                "UNIXPATH",
+                                                &unixpath)) &&
+      (0 < strlen (unixpath)))
+  {
+    /* We have a non-NULL unixpath, need to validate it */
+    if (strlen (unixpath) >= sizeof(s_un.sun_path))
+    {
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("UNIXPATH `%s' too long, maximum length is %llu\n"),
+           unixpath,
+           (unsigned long long) sizeof(s_un.sun_path));
+      unixpath = GNUNET_NETWORK_shorten_unixpath (unixpath);
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ ("Using `%s' instead\n"),
+           unixpath);
+      if (NULL == unixpath)
+        return NULL;
+    }
+    memset (&s_un,
+            0,
+            sizeof(s_un));
+    s_un.sun_family = AF_UNIX;
+    GNUNET_strlcpy (s_un.sun_path,
+                    unixpath,
+                    sizeof(s_un.sun_path));
+#if HAVE_SOCKADDR_UN_SUN_LEN
+    s_un.sun_len = (u_char) sizeof(struct sockaddr_un);
+#endif
+    sock = GNUNET_NETWORK_socket_create (AF_UNIX,
+                                         SOCK_STREAM,
+                                         0);
+    if ((NULL != sock) &&
+        ((GNUNET_OK ==
+          GNUNET_NETWORK_socket_connect (sock,
+                                         (struct sockaddr *) &s_un,
+                                         sizeof(s_un))) ||
+         (EINPROGRESS == errno)))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Successfully connected to unixpath `%s'!\n",
+           unixpath);
+      GNUNET_free (unixpath);
+      return sock;
+    }
+    if (NULL != sock)
+      GNUNET_NETWORK_socket_close (sock);
+  }
+  GNUNET_free (unixpath);
+#endif
+  return NULL;
+}
+
+
+/**
+ * Scheduler let us know that we're either ready to write on the
+ * socket OR connect timed out.  Do the right thing.
+ *
+ * @param cls the `struct AddressProbe *` with the address that we are probing
+ */
+static void
+connect_probe_continuation (void *cls)
+{
+  struct AddressProbe *ap = cls;
+  struct ClientState *cstate = ap->cstate;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+  int error;
+  socklen_t len;
+
+  ap->task = NULL;
+  GNUNET_assert (NULL != ap->sock);
+  GNUNET_CONTAINER_DLL_remove (cstate->ap_head,
+                               cstate->ap_tail,
+                               ap);
+  len = sizeof(error);
+  error = 0;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  if ((0 == (tc->reason & GNUNET_SCHEDULER_REASON_WRITE_READY)) ||
+      (GNUNET_OK !=
+       GNUNET_NETWORK_socket_getsockopt (ap->sock,
+                                         SOL_SOCKET,
+                                         SO_ERROR,
+                                         &error,
+                                         &len)) ||
+      (0 != error))
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (ap->sock));
+    GNUNET_free (ap);
+    if ((NULL == cstate->ap_head) &&
+        //       (NULL == cstate->proxy_handshake) &&
+        (NULL == cstate->dns_active))
+      connect_fail_continuation (cstate);
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Connection to `%s' succeeded!\n",
+       cstate->service_name);
+  /* trigger jobs that waited for the connection */
+  GNUNET_assert (NULL == cstate->sock);
+  cstate->sock = ap->sock;
+  GNUNET_free (ap);
+  cancel_aps (cstate);
+  connect_success_continuation (cstate);
+}
+
+
+/**
+ * Try to establish a connection given the specified address.
+ * This function is called by the resolver once we have a DNS reply.
+ *
+ * @param cls our `struct ClientState *`
+ * @param addr address to try, NULL for "last call"
+ * @param addrlen length of @a addr
+ */
+static void
+try_connect_using_address (void *cls,
+                           const struct sockaddr *addr,
+                           socklen_t addrlen)
+{
+  struct ClientState *cstate = cls;
+  struct AddressProbe *ap;
+
+  if (NULL == addr)
+  {
+    cstate->dns_active = NULL;
+    if ((NULL == cstate->ap_head) &&
+        //  (NULL == cstate->proxy_handshake) &&
+        (NULL == cstate->sock))
+      connect_fail_continuation (cstate);
+    return;
+  }
+  if (NULL != cstate->sock)
+    return;                     /* already connected */
+  /* try to connect */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Trying to connect using address `%s:%u'\n",
+       GNUNET_a2s (addr,
+                   addrlen),
+       (unsigned int) cstate->port);
+  ap = GNUNET_malloc (sizeof(struct AddressProbe) + addrlen);
+  ap->addr = (const struct sockaddr *) &ap[1];
+  GNUNET_memcpy (&ap[1],
+                 addr,
+                 addrlen);
+  ap->addrlen = addrlen;
+  ap->cstate = cstate;
+
+  switch (ap->addr->sa_family)
+  {
+  case AF_INET:
+    ((struct sockaddr_in *) ap->addr)->sin_port = htons (cstate->port);
+    break;
+
+  case AF_INET6:
+    ((struct sockaddr_in6 *) ap->addr)->sin6_port = htons (cstate->port);
+    break;
+
+  default:
+    GNUNET_break (0);
+    GNUNET_free (ap);
+    return;                     /* not supported by us */
+  }
+  ap->sock = GNUNET_NETWORK_socket_create (ap->addr->sa_family,
+                                           SOCK_STREAM,
+                                           0);
+  if (NULL == ap->sock)
+  {
+    GNUNET_free (ap);
+    return;                     /* not supported by OS */
+  }
+  if ((GNUNET_OK !=
+       GNUNET_NETWORK_socket_connect (ap->sock,
+                                      ap->addr,
+                                      ap->addrlen)) &&
+      (EINPROGRESS != errno))
+  {
+    /* maybe refused / unsupported address, try next */
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_INFO,
+                         "connect");
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (ap->sock));
+    GNUNET_free (ap);
+    return;
+  }
+  GNUNET_CONTAINER_DLL_insert (cstate->ap_head,
+                               cstate->ap_tail,
+                               ap);
+  ap->task = GNUNET_SCHEDULER_add_write_net (CONNECT_RETRY_TIMEOUT,
+                                             ap->sock,
+                                             &connect_probe_continuation,
+                                             ap);
+}
+
+
+/**
+ * Test whether the configuration has proper values for connection
+ * (UNIXPATH || (PORT && HOSTNAME)).
+ *
+ * @param service_name name of service to connect to
+ * @param cfg configuration to use
+ * @return #GNUNET_OK if the configuration is valid, #GNUNET_SYSERR if not
+ */
+static int
+test_service_configuration (const char *service_name,
+                            const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  int ret = GNUNET_SYSERR;
+  char *hostname = NULL;
+  unsigned long long port;
+
+#if AF_UNIX
+  char *unixpath = NULL;
+
+  if ((GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                service_name,
+                                                "UNIXPATH",
+                                                &unixpath)) &&
+      (0 < strlen (unixpath)))
+    ret = GNUNET_OK;
+  else if ((GNUNET_OK ==
+            GNUNET_CONFIGURATION_have_value (cfg,
+                                             service_name,
+                                             "UNIXPATH")))
+  {
+    GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
+                               service_name,
+                               "UNIXPATH",
+                               _ ("not a valid filename"));
+    GNUNET_free (unixpath);
+    return GNUNET_SYSERR;   /* UNIXPATH specified but invalid! */
+  }
+  GNUNET_free (unixpath);
+#endif
+
+  if ((GNUNET_YES ==
+       GNUNET_CONFIGURATION_have_value (cfg,
+                                        service_name,
+                                        "PORT")) &&
+      (GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_number (cfg,
+                                              service_name,
+                                              "PORT",
+                                              &port)) &&
+      (port <= 65535) &&
+      (0 != port) &&
+      (GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_string (cfg,
+                                              service_name,
+                                              "HOSTNAME",
+                                              &hostname)) &&
+      (0 != strlen (hostname)))
+    ret = GNUNET_OK;
+  GNUNET_free (hostname);
+  return ret;
+}
+
+
+/**
+ * Try to connect to the service.
+ *
+ * @param cls the `struct ClientState` to try to connect to the service
+ */
+static void
+start_connect (void *cls)
+{
+  struct ClientState *cstate = cls;
+
+  cstate->retry_task = NULL;
+#if 0
+  /* Never use a local source if a proxy is configured */
+  if (GNUNET_YES ==
+      GNUNET_SOCKS_check_service (cstate->service_name,
+                                  cstate->cfg))
+  {
+    socks_connect (cstate);
+    return;
+  }
+#endif
+
+  if ((0 == (cstate->attempts++ % 2)) ||
+      (0 == cstate->port) ||
+      (NULL == cstate->hostname))
+  {
+    /* on even rounds, try UNIX first, or always
+       if we do not have a DNS name and TCP port. */
+    cstate->sock = try_unixpath (cstate->service_name,
+                                 cstate->cfg);
+    if (NULL != cstate->sock)
+    {
+      connect_success_continuation (cstate);
+      return;
+    }
+  }
+  if ((NULL == cstate->hostname) ||
+      (0 == cstate->port))
+  {
+    /* All options failed. Boo! */
+    connect_fail_continuation (cstate);
+    return;
+  }
+  cstate->dns_active
+    = GNUNET_RESOLVER_ip_get (cstate->hostname,
+                              AF_UNSPEC,
+                              CONNECT_RETRY_TIMEOUT,
+                              &try_connect_using_address,
+                              cstate);
+}
+
+
+/**
+ * Implements the transmission functionality of a message queue.
+ *
+ * @param mq the message queue
+ * @param msg the message to send
+ * @param impl_state our `struct ClientState`
+ */
+static void
+connection_client_send_impl (struct GNUNET_MQ_Handle *mq,
+                             const struct GNUNET_MessageHeader *msg,
+                             void *impl_state)
+{
+  struct ClientState *cstate = impl_state;
+
+  (void) mq;
+  /* only one message at a time allowed */
+  GNUNET_assert (NULL == cstate->msg);
+  GNUNET_assert (NULL == cstate->send_task);
+  cstate->msg = msg;
+  cstate->msg_off = 0;
+  if (NULL == cstate->sock)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "message of type %u waiting for socket\n",
+         ntohs (msg->type));
+    return;   /* still waiting for connection */
+  }
+  cstate->send_task
+    = GNUNET_SCHEDULER_add_now (&transmit_ready,
+                                cstate);
+}
+
+
+/**
+ * Cancel the currently sent message.
+ *
+ * @param mq message queue
+ * @param impl_state our `struct ClientState`
+ */
+static void
+connection_client_cancel_impl (struct GNUNET_MQ_Handle *mq,
+                               void *impl_state)
+{
+  struct ClientState *cstate = impl_state;
+
+  (void) mq;
+  GNUNET_assert (NULL != cstate->msg);
+  GNUNET_assert (0 == cstate->msg_off);
+  cstate->msg = NULL;
+  if (NULL != cstate->send_task)
+  {
+    GNUNET_SCHEDULER_cancel (cstate->send_task);
+    cstate->send_task = NULL;
+  }
+}
+
+
+/**
+ * Test if the port or UNIXPATH of the given @a service_name
+ * is in use and thus (most likely) the respective service is up.
+ *
+ * @param cfg our configuration
+ * @param service_name name of the service to connect to
+ * @return #GNUNET_YES if the service is (likely) up,
+ *         #GNUNET_NO if the service is (definitively) down,
+ *         #GNUNET_SYSERR if the configuration does not give us
+ *          the necessary information about the service, or if
+ *          we could not check (e.g. socket() failed)
+ */
+int
+GNUNET_CLIENT_test (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                    const char *service_name)
+{
+  char *hostname = NULL;
+  unsigned long long port;
+  int ret;
+
+#if AF_UNIX
+  {
+    char *unixpath = NULL;
+
+    if (GNUNET_OK ==
+        GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                 service_name,
+                                                 "UNIXPATH",
+                                                 &unixpath))
+    {
+      if (0 == strlen (unixpath))
+      {
+        GNUNET_free (unixpath);
+        return GNUNET_SYSERR; /* empty string not OK */
+      }
+      if (0 == access (unixpath,
+                       F_OK))
+      {
+        GNUNET_free (unixpath);
+        return GNUNET_OK; /* file exists, we assume service is running */
+      }
+      GNUNET_free (unixpath);
+    }
+    else if (GNUNET_OK ==
+             GNUNET_CONFIGURATION_have_value (cfg,
+                                              service_name,
+                                              "UNIXPATH"))
+    {
+      /* UNIXPATH specified but not a valid path! */
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
+                                 service_name,
+                                 "UNIXPATH",
+                                 _ ("not a valid filename"));
+      return GNUNET_SYSERR;
+    }
+  }
+#endif
+
+  if ( (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_number (cfg,
+                                               service_name,
+                                               "PORT",
+                                               &port)) ||
+       (port > 65535) ||
+       (0 == port) )
+  {
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK ==
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             service_name,
+                                             "HOSTNAME",
+                                             &hostname))
+  {
+    /* We always assume remotes are up */
+    ret = GNUNET_YES;
+  }
+  else
+  {
+    /* We look for evidence the service is up */
+    ret = GNUNET_NO;
+  }
+  if ( (NULL == hostname) ||
+       (0 == strcasecmp (hostname,
+                         "localhost")) ||
+       (0 == strcasecmp (hostname,
+                         "ip6-localnet")) )
+  {
+    /* service runs on loopback */
+    struct sockaddr_in v4;
+    struct sockaddr_in6 v6;
+    int sock;
+
+    memset (&v4, 0, sizeof (v4));
+    memset (&v6, 0, sizeof (v6));
+    v4.sin_family = AF_INET;
+    v4.sin_port = htons ((uint16_t) port);
+#if HAVE_SOCKADDR_IN_SUN_LEN
+    v4.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+    GNUNET_assert (1 == inet_pton (AF_INET,
+                                   "127.0.0.1",
+                                   &v4.sin_addr));
+    ret = GNUNET_NO;
+    sock = socket (AF_INET,
+                   SOCK_STREAM,
+                   0);
+    if (-1 != sock)
+    {
+      if (0 != bind (sock,
+                     (struct sockaddr *) &v4,
+                     sizeof (v4)))
+      {
+        /* bind failed, so someone is listening! */
+        ret = GNUNET_YES;
+      }
+      (void) close (sock);
+    }
+    else
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                           "socket");
+      if (GNUNET_NO == ret)
+        ret = GNUNET_SYSERR;
+    }
+    v6.sin6_family = AF_INET6;
+    v6.sin6_port = htons ((uint16_t) port);
+#if HAVE_SOCKADDR_IN_SUN_LEN
+    v6.sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+    inet_pton (AF_INET6,
+               "::1",
+               &v6.sin6_addr);
+    sock = socket (AF_INET6,
+                   SOCK_STREAM,
+                   0);
+    if (-1 != sock)
+    {
+      if (0 != bind (sock,
+                     (struct sockaddr *) &v6,
+                     sizeof (v6)))
+      {
+        /* bind failed, so someone is listening! */
+        ret = GNUNET_YES;
+      }
+      (void) close (sock);
+    }
+    else
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                           "socket");
+      /* not changing 'ret' intentionally here, as
+         v4 succeeding and v6 failing just means we
+         should use v4 */
+    }
+  }
+  else
+  {
+    /* service running remotely */
+    ret = GNUNET_OK;
+  }
+  GNUNET_free (hostname);
+  return ret;
+}
+
+
+struct GNUNET_MQ_Handle *
+GNUNET_CLIENT_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                       const char *service_name,
+                       const struct GNUNET_MQ_MessageHandler *handlers,
+                       GNUNET_MQ_ErrorHandler error_handler,
+                       void *error_handler_cls)
+{
+  struct ClientState *cstate;
+
+  if (GNUNET_OK !=
+      test_service_configuration (service_name,
+                                  cfg))
+    return NULL;
+  cstate = GNUNET_new (struct ClientState);
+  cstate->service_name = GNUNET_strdup (service_name);
+  cstate->cfg = cfg;
+  cstate->retry_task = GNUNET_SCHEDULER_add_now (&start_connect,
+                                                 cstate);
+  cstate->mst = GNUNET_MST_create (&recv_message,
+                                   cstate);
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_have_value (cfg,
+                                       service_name,
+                                       "PORT"))
+  {
+    if (! ((GNUNET_OK !=
+            GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                   service_name,
+                                                   "PORT",
+                                                   &cstate->port)) ||
+           (cstate->port > 65535) ||
+           (GNUNET_OK !=
+            GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                   service_name,
+                                                   "HOSTNAME",
+                                                   &cstate->hostname))) &&
+        (0 == strlen (cstate->hostname)))
+    {
+      GNUNET_free (cstate->hostname);
+      cstate->hostname = NULL;
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("Need a non-empty hostname for service `%s'.\n"),
+           service_name);
+    }
+  }
+  cstate->mq = GNUNET_MQ_queue_for_callbacks (&connection_client_send_impl,
+                                              &connection_client_destroy_impl,
+                                              &connection_client_cancel_impl,
+                                              cstate,
+                                              handlers,
+                                              error_handler,
+                                              error_handler_cls);
+  return cstate->mq;
+}
+
+
+/* end of client.c */
diff --git a/src/lib/util/common_allocation.c b/src/lib/util/common_allocation.c
new file mode 100644
index 000000000..afd701720
--- /dev/null
+++ b/src/lib/util/common_allocation.c
@@ -0,0 +1,437 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2005, 2006, 2024 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/common_allocation.c
+ * @brief wrapper around malloc/free
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#if HAVE_MALLOC_H
+#include <malloc.h>
+#endif
+#if HAVE_MALLOC_MALLOC_H
+#include <malloc/malloc.h>
+#endif
+
+#define LOG(kind, ...) \
+        GNUNET_log_from (kind, "util-common-allocation", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+        GNUNET_log_from_strerror (kind, "util-common-allocation", syscall)
+
+#ifndef INT_MAX
+#define INT_MAX 0x7FFFFFFF
+#endif
+
+
+void *
+GNUNET_xmalloc_ (size_t size,
+                 const char *filename,
+                 int linenumber)
+{
+  void *ret;
+
+  /* As a security precaution, we generally do not allow very large
+   * allocations using the default 'GNUNET_malloc()' macro */
+  GNUNET_assert_at (size <= GNUNET_MAX_MALLOC_CHECKED,
+                    filename,
+                    linenumber);
+  ret = GNUNET_xmalloc_unchecked_ (size,
+                                   filename,
+                                   linenumber);
+  if (NULL == ret)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "malloc");
+    GNUNET_assert (0);
+  }
+  return ret;
+}
+
+
+void **
+GNUNET_xnew_array_2d_ (size_t n,
+                       size_t m,
+                       size_t elementSize,
+                       const char *filename,
+                       int linenumber)
+{
+  /* use char pointer internally to avoid void pointer arithmetic warnings */
+  char **ret = GNUNET_xmalloc_ (n * sizeof(void *)     /* 1. dim header */
+                                + n * m * elementSize, /* element data */
+                                filename,
+                                linenumber);
+
+  for (size_t i = 0; i < n; i++)
+    ret[i] = (char *) ret    /* base address */
+             + n * sizeof(void *)  /* skip 1. dim header */
+             + i * m * elementSize; /* skip to 2. dim row header */
+  return (void **) ret;
+}
+
+
+void ***
+GNUNET_xnew_array_3d_ (size_t n,
+                       size_t m,
+                       size_t o,
+                       size_t elementSize,
+                       const char *filename,
+                       int linenumber)
+{
+  /* use char pointer internally to avoid void pointer arithmetic warnings */
+  char ***ret = GNUNET_xmalloc_ (n * sizeof(void **)     /* 1. dim header */
+                                 + n * m * sizeof(void *)    /* 2. dim header */
+                                 + n * m * o * elementSize, /* element data */
+                                 filename,
+                                 linenumber);
+
+  for (size_t i = 0; i < n; i++)
+  {
+    /* need to cast to (char *) temporarily for byte level accuracy */
+    ret[i] = (char **) ((char *) ret   /* base address */
+                        + n * sizeof(void **)  /* skip 1. dim header */
+                        + i * m * sizeof(void *)); /* skip to 2. dim header */
+    for (size_t j = 0; j < m; j++)
+      ret[i][j] = (char *) ret    /* base address */
+                  + n * sizeof(void **)   /* skip 1. dim header */
+                  + n * m * sizeof(void *)   /* skip 2. dim header */
+                  + i * m * o * elementSize   /* skip to 2. dim part */
+                  + j * o * elementSize; /* skip to 3. dim row data */
+  }
+  return (void ***) ret;
+}
+
+
+void *
+GNUNET_xmemdup_ (const void *buf,
+                 size_t size,
+                 const char *filename,
+                 int linenumber)
+{
+  void *ret;
+
+  /* As a security precaution, we generally do not allow very large
+   * allocations here */
+  GNUNET_assert_at (size <= GNUNET_MAX_MALLOC_CHECKED,
+                    filename,
+                    linenumber);
+  GNUNET_assert_at (size < INT_MAX,
+                    filename,
+                    linenumber);
+  ret = malloc (size);
+  if (NULL == ret)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "malloc");
+    GNUNET_assert (0);
+  }
+  GNUNET_memcpy (ret,
+                 buf,
+                 size);
+  return ret;
+}
+
+
+void *
+GNUNET_xmalloc_unchecked_ (size_t size,
+                           const char *filename,
+                           int linenumber)
+{
+  void *result;
+
+  (void) filename;
+  (void) linenumber;
+  result = malloc (size);
+  if (NULL == result)
+    return NULL;
+  memset (result,
+          0,
+          size);
+  return result;
+}
+
+
+void *
+GNUNET_xrealloc_ (void *ptr,
+                  size_t n,
+                  const char *filename,
+                  int linenumber)
+{
+  (void) filename;
+  (void) linenumber;
+
+#if defined(M_SIZE)
+#if ENABLE_POISONING
+  {
+    uint64_t *base = ptr;
+    size_t s = M_SIZE (ptr);
+
+    if (s > n)
+    {
+      const uint64_t baadfood = GNUNET_ntohll (0xBAADF00DBAADF00DLL);
+      char *cbase = ptr;
+
+      GNUNET_memcpy (&cbase[n],
+                     &baadfood,
+                     GNUNET_MIN (8 - (n % 8),
+                                 s - n));
+      for (size_t i = 1 + (n + 7) / 8; i < s / 8; i++)
+        base[i] = baadfood;
+      GNUNET_memcpy (&base[s / 8],
+                     &baadfood,
+                     s % 8);
+    }
+  }
+#endif
+#endif
+  ptr = realloc (ptr, n);
+  if ((NULL == ptr) && (n > 0))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "realloc");
+    GNUNET_assert (0);
+  }
+  return ptr;
+}
+
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define BAADFOOD_STR "\x0D\xF0\xAD\xBA"
+#endif
+#if __BYTE_ORDER == __BIG_ENDIAN
+#define BAADFOOD_STR "\xBA\xAD\xF0\x0D"
+#endif
+
+#if HAVE_MALLOC_NP_H
+#include <malloc_np.h>
+#endif
+#if HAVE_MALLOC_USABLE_SIZE
+#define M_SIZE(p) malloc_usable_size (p)
+#elif HAVE_MALLOC_SIZE
+#define M_SIZE(p) malloc_size (p)
+#endif
+
+void
+GNUNET_xfree_ (void *ptr,
+               const char *filename,
+               int linenumber)
+{
+  if (NULL == ptr)
+    return;
+#if defined(M_SIZE)
+#if ENABLE_POISONING
+  {
+    const uint64_t baadfood = GNUNET_ntohll (0xBAADF00DBAADF00DLL);
+    uint64_t *base = ptr;
+    size_t s = M_SIZE (ptr);
+
+    for (size_t i = 0; i < s / 8; i++)
+      base[i] = baadfood;
+    GNUNET_memcpy (&base[s / 8], &baadfood, s % 8);
+  }
+#endif
+#endif
+  free (ptr);
+}
+
+
+char *
+GNUNET_xstrdup_ (const char *str,
+                 const char *filename,
+                 int linenumber)
+{
+  size_t slen = strlen (str) + 1;
+  char *res;
+
+  GNUNET_assert_at (str != NULL,
+                    filename,
+                    linenumber);
+  res = GNUNET_xmalloc_ (slen,
+                         filename,
+                         linenumber);
+  GNUNET_memcpy (res,
+                 str,
+                 slen);
+  return res;
+}
+
+
+#if ! HAVE_STRNLEN
+static size_t
+strnlen (const char *s,
+         size_t n)
+{
+  const char *e;
+
+  e = memchr (s,
+              '\0',
+              n);
+  if (NULL == e)
+    return n;
+  return e - s;
+}
+
+
+#endif
+
+
+char *
+GNUNET_xstrndup_ (const char *str,
+                  size_t len,
+                  const char *filename,
+                  int linenumber)
+{
+  char *res;
+
+  if (0 == len)
+    return GNUNET_strdup ("");
+  GNUNET_assert_at (NULL != str,
+                    filename,
+                    linenumber);
+  len = strnlen (str, len);
+  res = GNUNET_xmalloc_ (len + 1,
+                         filename,
+                         linenumber);
+  GNUNET_memcpy (res, str, len);
+  /* res[len] = '\0'; 'malloc' zeros out anyway */
+  return res;
+}
+
+
+void
+GNUNET_xgrow_ (void **old,
+               size_t elementSize,
+               unsigned int *oldCount,
+               unsigned int newCount,
+               const char *filename,
+               int linenumber)
+{
+  void *tmp;
+  size_t size;
+
+  GNUNET_assert_at (INT_MAX / elementSize > newCount, filename, linenumber);
+  size = newCount * elementSize;
+  if (0 == size)
+  {
+    tmp = NULL;
+  }
+  else
+  {
+    tmp = GNUNET_xmalloc_ (size,
+                           filename,
+                           linenumber);
+    if (NULL != *old)
+    {
+      GNUNET_memcpy (tmp,
+                     *old,
+                     elementSize * GNUNET_MIN (*oldCount,
+                                               newCount));
+    }
+  }
+
+  if (NULL != *old)
+  {
+    GNUNET_xfree_ (*old,
+                   filename,
+                   linenumber);
+  }
+  *old = tmp;
+  *oldCount = newCount;
+}
+
+
+int
+GNUNET_asprintf (char **buf,
+                 const char *format,
+                 ...)
+{
+  int ret;
+  va_list args;
+
+  va_start (args,
+            format);
+  ret = vsnprintf (NULL,
+                   0,
+                   format,
+                   args);
+  va_end (args);
+  GNUNET_assert (ret >= 0);
+  *buf = GNUNET_malloc (ret + 1);
+  va_start (args, format);
+  ret = vsprintf (*buf,
+                  format,
+                  args);
+  va_end (args);
+  return ret;
+}
+
+
+int
+GNUNET_snprintf (char *buf,
+                 size_t size,
+                 const char *format,
+                 ...)
+{
+  int ret;
+  va_list args;
+
+  va_start (args,
+            format);
+  ret = vsnprintf (buf,
+                   size,
+                   format,
+                   args);
+  va_end (args);
+  GNUNET_assert ((ret >= 0) && (((size_t) ret) < size));
+  return ret;
+}
+
+
+struct GNUNET_MessageHeader *
+GNUNET_copy_message (const struct GNUNET_MessageHeader *msg)
+{
+  struct GNUNET_MessageHeader *ret;
+  uint16_t msize;
+
+  msize = ntohs (msg->size);
+  GNUNET_assert (msize >= sizeof(struct GNUNET_MessageHeader));
+  ret = GNUNET_malloc (msize);
+  GNUNET_memcpy (ret, msg, msize);
+  return ret;
+}
+
+
+bool
+GNUNET_is_zero_ (const void *a,
+                 size_t n)
+{
+  const char *b = a;
+
+  for (size_t i = 0; i < n; i++)
+    if (b[i])
+      return false;
+  return true;
+}
+
+
+/* end of common_allocation.c */
diff --git a/src/lib/util/common_endian.c b/src/lib/util/common_endian.c
new file mode 100644
index 000000000..59c15326d
--- /dev/null
+++ b/src/lib/util/common_endian.c
@@ -0,0 +1,95 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2006, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/common_endian.c
+ * @brief endian conversion helpers
+ * @author Christian Grothoff
+ * @author Gabor X Toth
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-common-endian", __VA_ARGS__)
+
+
+#ifndef htonbe64
+uint64_t
+GNUNET_htonll (uint64_t n)
+{
+#if __BYTE_ORDER == __BIG_ENDIAN
+  return n;
+#elif __BYTE_ORDER == __LITTLE_ENDIAN
+  return (((uint64_t) htonl (n)) << 32) + htonl (n >> 32);
+#else
+  #error byteorder undefined
+#endif
+}
+
+
+#endif
+
+
+#ifndef be64toh
+uint64_t
+GNUNET_ntohll (uint64_t n)
+{
+#if __BYTE_ORDER == __BIG_ENDIAN
+  return n;
+#elif __BYTE_ORDER == __LITTLE_ENDIAN
+  return (((uint64_t) ntohl (n)) << 32) + ntohl (n >> 32);
+#else
+  #error byteorder undefined
+#endif
+}
+
+
+#endif
+
+
+double
+GNUNET_hton_double (double d)
+{
+  double res;
+  uint64_t *in = (uint64_t *) &d;
+  uint64_t *out = (uint64_t *) &res;
+
+  out[0] = GNUNET_htonll (in[0]);
+
+  return res;
+}
+
+
+double
+GNUNET_ntoh_double (double d)
+{
+  double res;
+  uint64_t *in = (uint64_t *) &d;
+  uint64_t *out = (uint64_t *) &res;
+
+  out[0] = GNUNET_ntohll (in[0]);
+
+  return res;
+}
+
+
+/* end of common_endian.c */
diff --git a/src/lib/util/common_logging.c b/src/lib/util/common_logging.c
new file mode 100644
index 000000000..37c6064b8
--- /dev/null
+++ b/src/lib/util/common_logging.c
@@ -0,0 +1,1544 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2006-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/common_logging.c
+ * @brief error handling API
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <regex.h>
+
+
+/**
+ * After how many milliseconds do we always print
+ * that "message X was repeated N times"?  Use 12h.
+ */
+#define BULK_DELAY_THRESHOLD (12 * 60 * 60 * 1000LL * 1000LL)
+
+/**
+ * After how many repetitions do we always print
+ * that "message X was repeated N times"? (even if
+ * we have not yet reached the delay threshold)
+ */
+#define BULK_REPEAT_THRESHOLD 1000
+
+/**
+ * How many characters do we use for matching of
+ * bulk messages?
+ */
+#define BULK_TRACK_SIZE 256
+
+/**
+ * How many characters do we use for matching of
+ * bulk components?
+ */
+#define COMP_TRACK_SIZE 32
+
+/**
+ * How many characters can a date/time string
+ * be at most?
+ */
+#define DATE_STR_SIZE 64
+
+/**
+ * How many log files to keep?
+ */
+#define ROTATION_KEEP 3
+
+#ifndef PATH_MAX
+/**
+ * Assumed maximum path length (for the log file name).
+ */
+#define PATH_MAX 4096
+#endif
+
+
+/**
+ * Linked list of active loggers.
+ */
+struct CustomLogger
+{
+  /**
+   * This is a linked list.
+   */
+  struct CustomLogger *next;
+
+  /**
+   * Log function.
+   */
+  GNUNET_Logger logger;
+
+  /**
+   * Closure for logger.
+   */
+  void *logger_cls;
+};
+
+
+/**
+ * Asynchronous scope of the current thread, or NULL if we have not
+ * entered an async scope yet.
+ */
+static GNUNET_THREAD_LOCAL struct GNUNET_AsyncScopeSave current_async_scope;
+
+/**
+ * The last "bulk" error message that we have been logging.
+ * Note that this message maybe truncated to the first BULK_TRACK_SIZE
+ * characters, in which case it is NOT 0-terminated!
+ */
+static GNUNET_THREAD_LOCAL char last_bulk[BULK_TRACK_SIZE] __nonstring;
+
+/**
+ * Type of the last bulk message.
+ */
+static GNUNET_THREAD_LOCAL enum GNUNET_ErrorType last_bulk_kind;
+
+/**
+ * Time of the last bulk error message (0 for none)
+ */
+static GNUNET_THREAD_LOCAL struct GNUNET_TIME_Absolute last_bulk_time;
+
+/**
+ * Number of times that bulk message has been repeated since.
+ */
+static GNUNET_THREAD_LOCAL unsigned int last_bulk_repeat;
+
+/**
+ * Component when the last bulk was logged.  Will be 0-terminated.
+ */
+static GNUNET_THREAD_LOCAL char last_bulk_comp[COMP_TRACK_SIZE + 1];
+
+/**
+ * Running component.
+ */
+static char *component;
+
+/**
+ * Running component (without pid).
+ */
+static char *component_nopid;
+
+/**
+ * Format string describing the name of the log file.
+ */
+static char *log_file_name;
+
+/**
+ * Minimum log level.
+ */
+static enum GNUNET_ErrorType min_level;
+
+/**
+ * Linked list of our custom loggres.
+ */
+static struct CustomLogger *loggers;
+
+/**
+ * Number of log calls to ignore.
+ */
+static GNUNET_THREAD_LOCAL int skip_log = 0;
+
+/**
+ * File descriptor to use for "stderr", or NULL for none.
+ */
+static FILE *GNUNET_stderr;
+
+/**
+ * Represents a single logging definition
+ */
+struct LogDef
+{
+  /**
+   * Component name regex
+   */
+  regex_t component_regex;
+
+  /**
+   * File name regex
+   */
+  regex_t file_regex;
+
+  /**
+   * Function name regex
+   */
+  regex_t function_regex;
+
+  /**
+   * Lowest line at which this definition matches.
+   * Defaults to 0. Must be <= to_line.
+   */
+  int from_line;
+
+  /**
+   * Highest line at which this definition matches.
+   * Defaults to INT_MAX. Must be >= from_line.
+   */
+  int to_line;
+
+  /**
+   * Maximal log level allowed for calls that match this definition.
+   * Calls with higher log level will be disabled.
+   * Must be >= 0
+   */
+  int level;
+
+  /**
+   * 1 if this definition comes from GNUNET_FORCE_LOG, which means that it
+   * overrides any configuration options. 0 otherwise.
+   */
+  int force;
+};
+
+
+#if ! defined(GNUNET_CULL_LOGGING)
+/**
+ * Dynamic array of logging definitions
+ */
+static struct LogDef *logdefs;
+
+/**
+ * Allocated size of logdefs array (in units)
+ */
+static int logdefs_size;
+
+/**
+ * The number of units used in logdefs array.
+ */
+static int logdefs_len;
+
+/**
+ * #GNUNET_YES if GNUNET_LOG environment variable is already parsed.
+ */
+static int gnunet_log_parsed;
+
+/**
+ * #GNUNET_YES if GNUNET_FORCE_LOG environment variable is already parsed.
+ */
+static int gnunet_force_log_parsed;
+
+/**
+ * #GNUNET_YES if at least one definition with forced == 1 is available.
+ */
+static int gnunet_force_log_present;
+#endif
+
+
+/**
+ * Convert a textual description of a loglevel
+ * to the respective enumeration type.
+ *
+ * @param log loglevel to parse
+ * @return GNUNET_ERROR_TYPE_INVALID if log does not parse
+ */
+static enum GNUNET_ErrorType
+get_type (const char *log)
+{
+  if (NULL == log)
+    return GNUNET_ERROR_TYPE_UNSPECIFIED;
+  if (0 == strcasecmp (log, "DEBUG"))
+    return GNUNET_ERROR_TYPE_DEBUG;
+  if (0 == strcasecmp (log, "INFO"))
+    return GNUNET_ERROR_TYPE_INFO;
+  if (0 == strcasecmp (log, "MESSAGE"))
+    return GNUNET_ERROR_TYPE_MESSAGE;
+  if (0 == strcasecmp (log, "WARNING"))
+    return GNUNET_ERROR_TYPE_WARNING;
+  if (0 == strcasecmp (log, "ERROR"))
+    return GNUNET_ERROR_TYPE_ERROR;
+  if (0 == strcasecmp (log, "NONE"))
+    return GNUNET_ERROR_TYPE_NONE;
+  return GNUNET_ERROR_TYPE_INVALID;
+}
+
+
+/**
+ * Abort the process, generate a core dump if possible.
+ */
+void
+GNUNET_abort_ ()
+{
+  abort ();
+}
+
+
+#if ! defined(GNUNET_CULL_LOGGING)
+/**
+ * Utility function - reallocates logdefs array to be twice as large.
+ */
+static void
+resize_logdefs (void)
+{
+  logdefs_size = (logdefs_size + 1) * 2;
+  logdefs = GNUNET_realloc (logdefs, logdefs_size * sizeof(struct LogDef));
+}
+
+
+/**
+ * Rotate logs, deleting the oldest log.
+ *
+ * @param new_name new name to add to the rotation
+ */
+static void
+log_rotate (const char *new_name)
+{
+  static char *rotation[ROTATION_KEEP];
+  static unsigned int rotation_off;
+  char *discard;
+
+  if ('\0' == *new_name)
+    return; /* not a real log file name */
+  discard = rotation[rotation_off % ROTATION_KEEP];
+  if (NULL != discard)
+  {
+    /* Note: can't log errors during logging (recursion!), so this
+       operation MUST silently fail... */
+    (void) unlink (discard);
+    GNUNET_free (discard);
+  }
+  rotation[rotation_off % ROTATION_KEEP] = GNUNET_strdup (new_name);
+  rotation_off++;
+}
+
+
+const char *
+GNUNET_b2s (const void *buf,
+            size_t buf_size)
+{
+  static GNUNET_THREAD_LOCAL char ret[9];
+  struct GNUNET_HashCode hc;
+  char *tmp;
+
+  GNUNET_CRYPTO_hash (buf,
+                      buf_size,
+                      &hc);
+  tmp = GNUNET_STRINGS_data_to_string_alloc (&hc,
+                                             sizeof (hc));
+  memcpy (ret,
+          tmp,
+          8);
+  GNUNET_free (tmp);
+  ret[8] = '\0';
+  return ret;
+}
+
+
+/**
+ * Setup the log file.
+ *
+ * @param tm timestamp for which we should setup logging
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+setup_log_file (const struct tm *tm)
+{
+  static char last_fn[PATH_MAX + 1];
+  char fn[PATH_MAX + 1];
+  int altlog_fd;
+  int dup_return;
+  FILE *altlog;
+  char *leftsquare;
+
+  if (NULL == log_file_name)
+    return GNUNET_SYSERR;
+  if (0 == strftime (fn, sizeof(fn), log_file_name, tm))
+    return GNUNET_SYSERR;
+  leftsquare = strrchr (fn, '[');
+  if ((NULL != leftsquare) && (']' == leftsquare[1]))
+  {
+    char *logfile_copy = GNUNET_strdup (fn);
+
+    logfile_copy[leftsquare - fn] = '\0';
+    logfile_copy[leftsquare - fn + 1] = '\0';
+    snprintf (fn,
+              PATH_MAX,
+              "%s%d%s",
+              logfile_copy,
+              getpid (),
+              &logfile_copy[leftsquare - fn + 2]);
+    GNUNET_free (logfile_copy);
+  }
+  if (0 == strcmp (fn, last_fn))
+    return GNUNET_OK; /* no change */
+  log_rotate (last_fn);
+  strcpy (last_fn, fn);
+  if (GNUNET_SYSERR == GNUNET_DISK_directory_create_for_file (fn))
+  {
+    fprintf (stderr,
+             "Failed to create directory for `%s': %s\n",
+             fn,
+             strerror (errno));
+    return GNUNET_SYSERR;
+  }
+  altlog_fd = open (fn,
+                    O_APPEND | O_WRONLY | O_CREAT,
+                    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+
+  if (-1 != altlog_fd)
+  {
+    if (NULL != GNUNET_stderr)
+      fclose (GNUNET_stderr);
+    dup_return = dup2 (altlog_fd, 2);
+    (void) close (altlog_fd);
+    if (-1 != dup_return)
+    {
+      altlog = fdopen (2, "ab");
+      if (NULL == altlog)
+      {
+        (void) close (2);
+        altlog_fd = -1;
+      }
+    }
+    else
+    {
+      altlog_fd = -1;
+    }
+  }
+  if (-1 == altlog_fd)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "open", fn);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_stderr = altlog;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Utility function - adds a parsed definition to logdefs array.
+ *
+ * @param component see struct LogDef, can't be NULL
+ * @param file see struct LogDef, can't be NULL
+ * @param function see struct LogDef, can't be NULL
+ * @param from_line see struct LogDef
+ * @param to_line see struct LogDef
+ * @param level see struct LogDef, must be >= 0
+ * @param force see struct LogDef
+ * @return 0 on success, regex-specific error otherwise
+ */
+static int
+add_definition (const char *component,
+                const char *file,
+                const char *function,
+                int from_line,
+                int to_line,
+                int level,
+                int force)
+{
+  struct LogDef n;
+  int r;
+
+  if (logdefs_size == logdefs_len)
+    resize_logdefs ();
+  memset (&n, 0, sizeof(n));
+  if (0 == strlen (component))
+    component = (char *) ".*";
+  r = regcomp (&n.component_regex, (const char *) component, REG_NOSUB);
+  if (0 != r)
+  {
+    return r;
+  }
+  if (0 == strlen (file))
+    file = (char *) ".*";
+  r = regcomp (&n.file_regex, (const char *) file, REG_NOSUB);
+  if (0 != r)
+  {
+    regfree (&n.component_regex);
+    return r;
+  }
+  if ((NULL == function) || (0 == strlen (function)))
+    function = (char *) ".*";
+  r = regcomp (&n.function_regex, (const char *) function, REG_NOSUB);
+  if (0 != r)
+  {
+    regfree (&n.component_regex);
+    regfree (&n.file_regex);
+    return r;
+  }
+  n.from_line = from_line;
+  n.to_line = to_line;
+  n.level = level;
+  n.force = force;
+  logdefs[logdefs_len++] = n;
+  return 0;
+}
+
+
+/**
+ * Decides whether a particular logging call should or should not be allowed
+ * to be made. Used internally by GNUNET_log*()
+ *
+ * @param caller_level loglevel the caller wants to use
+ * @param comp component name the caller uses (NULL means that global
+ *   component name is used)
+ * @param file file name containing the logging call, usually __FILE__
+ * @param function function which tries to make a logging call,
+ *   usually __FUNCTION__
+ * @param line line at which the call is made, usually __LINE__
+ * @return 0 to disallow the call, 1 to allow it
+ */
+int
+GNUNET_get_log_call_status (int caller_level,
+                            const char *comp,
+                            const char *file,
+                            const char *function,
+                            int line)
+{
+  struct LogDef *ld;
+  int i;
+  int force_only;
+
+  if (NULL == comp)
+    /* Use default component */
+    comp = component_nopid;
+
+  /* We have no definitions to override globally configured log level,
+   * so just use it right away.
+   */
+  if ((min_level >= 0) && (GNUNET_NO == gnunet_force_log_present))
+    return caller_level <= min_level;
+
+  /* Only look for forced definitions? */
+  force_only = min_level >= 0;
+  for (i = 0; i < logdefs_len; i++)
+  {
+    ld = &logdefs[i];
+    if (((! force_only) || ld->force) &&
+        ((line >= ld->from_line) && (line <= ld->to_line) ) &&
+        (0 == regexec (&ld->component_regex, comp, 0, NULL, 0)) &&
+        (0 == regexec (&ld->file_regex, file, 0, NULL, 0)) &&
+        (0 == regexec (&ld->function_regex, function, 0, NULL, 0)))
+    {
+      /* We're finished */
+      return caller_level <= ld->level;
+    }
+  }
+  /* No matches - use global level, if defined */
+  if (min_level >= 0)
+    return caller_level <= min_level;
+  /* All programs/services previously defaulted to WARNING.
+   * Now *we* default to WARNING, and THEY default to NULL.
+   * Or rather we default to MESSAGE, since things aren't always bad.
+   */
+  return caller_level <= GNUNET_ERROR_TYPE_MESSAGE;
+}
+
+
+/**
+ * Utility function - parses a definition
+ *
+ * Definition format:
+ * component;file;function;from_line-to_line;level[/component...]
+ * All entries are mandatory, but may be empty.
+ * Empty entries for component, file and function are treated as
+ * "matches anything".
+ * Empty line entry is treated as "from 0 to INT_MAX"
+ * Line entry with only one line is treated as "this line only"
+ * Entry for level MUST NOT be empty.
+ * Entries for component, file and function that consist of a
+ * single character "*" are treated (at the moment) the same way
+ * empty entries are treated (wildcard matching is not implemented (yet?)).
+ * file entry is matched to the end of __FILE__. That is, it might be
+ * a base name, or a base name with leading directory names (some compilers
+ * define __FILE__ to absolute file path).
+ *
+ * @param constname name of the environment variable from which to get the
+ *   string to be parsed
+ * @param force 1 if definitions found in constname are to be forced
+ * @return number of added definitions
+ */
+static int
+parse_definitions (const char *constname, int force)
+{
+  char *def;
+  const char *tmp;
+  char *comp = NULL;
+  char *file = NULL;
+  char *function = NULL;
+  char *p;
+  char *start;
+  char *t;
+  short state;
+  int level;
+  int from_line, to_line;
+  int counter = 0;
+  int keep_looking = 1;
+
+  tmp = getenv (constname);
+  if (NULL == tmp)
+    return 0;
+  def = GNUNET_strdup (tmp);
+  from_line = 0;
+  to_line = INT_MAX;
+  for (p = def, state = 0, start = def; keep_looking; p++)
+  {
+    switch (p[0])
+    {
+    case ';':     /* found a field separator */
+      p[0] = '\0';
+      switch (state)
+      {
+      case 0:       /* within a component name */
+        comp = start;
+        break;
+
+      case 1:       /* within a file name */
+        file = start;
+        break;
+
+      case 2:       /* within a function name */
+        /* after a file name there must be a function name */
+        function = start;
+        break;
+
+      case 3:       /* within a from-to line range */
+        if (strlen (start) > 0)
+        {
+          errno = 0;
+          from_line = strtol (start, &t, 10);
+          if ((0 != errno) || (from_line < 0))
+          {
+            GNUNET_free (def);
+            return counter;
+          }
+          if ((t < p) && ('-' == t[0]))
+          {
+            errno = 0;
+            start = t + 1;
+            to_line = strtol (start, &t, 10);
+            if ((0 != errno) || (to_line < 0) || (t != p))
+            {
+              GNUNET_free (def);
+              return counter;
+            }
+          }
+          else         /* one number means "match this line only" */
+            to_line = from_line;
+        }
+        else       /* default to 0-max */
+        {
+          from_line = 0;
+          to_line = INT_MAX;
+        }
+        break;
+
+      default:
+        fprintf (
+          stderr,
+          _ ("ERROR: Unable to parse log definition: Syntax error at `%s'.\n"),
+          p);
+        break;
+      }
+      start = p + 1;
+      state++;
+      break;
+
+    case '\0':     /* found EOL */
+      keep_looking = 0;
+
+    /* fall through to '/' */
+    case '/':     /* found a definition separator */
+      switch (state)
+      {
+      case 4:       /* within a log level */
+        p[0] = '\0';
+        state = 0;
+        level = get_type ((const char *) start);
+        if ((GNUNET_ERROR_TYPE_INVALID == level) ||
+            (GNUNET_ERROR_TYPE_UNSPECIFIED == level) ||
+            (0 != add_definition (comp,
+                                  file,
+                                  function,
+                                  from_line,
+                                  to_line,
+                                  level,
+                                  force)))
+        {
+          GNUNET_free (def);
+          return counter;
+        }
+        counter++;
+        start = p + 1;
+        break;
+
+      default:
+        fprintf (
+          stderr,
+          _ ("ERROR: Unable to parse log definition: Syntax error at `%s'.\n"),
+          p);
+        break;
+      }
+
+    default:
+      break;
+    }
+  }
+  GNUNET_free (def);
+  return counter;
+}
+
+
+/**
+ * Utility function - parses GNUNET_LOG and GNUNET_FORCE_LOG.
+ */
+static void
+parse_all_definitions ()
+{
+  if (GNUNET_NO == gnunet_force_log_parsed)
+    gnunet_force_log_present =
+      parse_definitions ("GNUNET_FORCE_LOG", 1) > 0 ? GNUNET_YES : GNUNET_NO;
+  gnunet_force_log_parsed = GNUNET_YES;
+
+  if (GNUNET_NO == gnunet_log_parsed)
+    parse_definitions ("GNUNET_LOG", 0);
+  gnunet_log_parsed = GNUNET_YES;
+}
+
+
+#endif
+
+
+/**
+ * Setup logging.
+ *
+ * @param comp default component to use
+ * @param loglevel what types of messages should be logged
+ * @param logfile which file to write log messages to (can be NULL)
+ * @return #GNUNET_OK on success
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_log_setup (const char *comp,
+                  const char *loglevel,
+                  const char *logfile)
+{
+  const char *env_logfile;
+
+  min_level = get_type (loglevel);
+#if ! defined(GNUNET_CULL_LOGGING)
+  parse_all_definitions ();
+#endif
+  GNUNET_free (component);
+  GNUNET_asprintf (&component,
+                   "%s-%d",
+                   comp,
+                   getpid ());
+  GNUNET_free (component_nopid);
+  component_nopid = GNUNET_strdup (comp);
+
+  env_logfile = getenv ("GNUNET_FORCE_LOGFILE");
+  if ((NULL != env_logfile) && (strlen (env_logfile) > 0))
+    logfile = env_logfile;
+  if (NULL == logfile)
+    return GNUNET_OK;
+  GNUNET_free (log_file_name);
+  log_file_name = GNUNET_STRINGS_filename_expand (logfile);
+  if (NULL == log_file_name)
+    return GNUNET_SYSERR;
+#if defined(GNUNET_CULL_LOGGING)
+  /* log file option not allowed for wallet logic */
+  GNUNET_assert (NULL == logfile);
+  return GNUNET_OK;
+#else
+  {
+    time_t t;
+    const struct tm *tm;
+
+    t = time (NULL);
+    tm = gmtime (&t);
+    return setup_log_file (tm);
+  }
+#endif
+}
+
+
+void
+GNUNET_logger_add (GNUNET_Logger logger,
+                   void *logger_cls)
+{
+  struct CustomLogger *entry;
+
+  entry = GNUNET_new (struct CustomLogger);
+  entry->logger = logger;
+  entry->logger_cls = logger_cls;
+  entry->next = loggers;
+  loggers = entry;
+}
+
+
+void
+GNUNET_logger_remove (GNUNET_Logger logger,
+                      void *logger_cls)
+{
+  struct CustomLogger *pos;
+  struct CustomLogger *prev;
+
+  prev = NULL;
+  pos = loggers;
+  while ((NULL != pos) &&
+         ((pos->logger != logger) || (pos->logger_cls != logger_cls)))
+  {
+    prev = pos;
+    pos = pos->next;
+  }
+  GNUNET_assert (NULL != pos);
+  if (NULL == prev)
+    loggers = pos->next;
+  else
+    prev->next = pos->next;
+  GNUNET_free (pos);
+}
+
+
+/**
+ * Actually output the log message.
+ *
+ * @param kind how severe was the issue
+ * @param comp component responsible
+ * @param datestr current date/time
+ * @param msg the actual message
+ */
+static void
+output_message (enum GNUNET_ErrorType kind,
+                const char *comp,
+                const char *datestr,
+                const char *msg)
+{
+  static int have_journald = -1;
+  struct CustomLogger *pos;
+
+  if (-1 == have_journald)
+  {
+    /* systemd after version 231 sets this environment
+       variable if we are logging to journald. In this
+       case, skip outputting our component name, PID
+       and timestamp as journald already adds those. (#8032) */
+    if (NULL != getenv ("JOURNAL_STREAM"))
+      have_journald = 1;
+    else
+      have_journald = 0;
+  }
+
+  /* only use the standard logger if no custom loggers are present */
+  if ((NULL != GNUNET_stderr) && (NULL == loggers))
+  {
+    if (kind == GNUNET_ERROR_TYPE_MESSAGE)
+    {
+      /* The idea here is to produce "normal" output messages
+       * for end users while still having the power of the
+       * logging engine for developer needs. So ideally this
+       * is what it should look like when CLI tools are used
+       * interactively, yet the same message shouldn't look
+       * this way if the output is going to logfiles or robots
+       * instead.
+       */
+      fprintf (GNUNET_stderr, "* %s", msg);
+    }
+    else if (GNUNET_YES == current_async_scope.have_scope)
+    {
+      static GNUNET_THREAD_LOCAL char id_buf[27];
+      char *end;
+
+      /* We're logging, so skip_log must be currently 0. */
+      skip_log = 100;
+      end = GNUNET_STRINGS_data_to_string (&current_async_scope.scope_id,
+                                           sizeof(struct GNUNET_AsyncScopeId),
+                                           id_buf,
+                                           sizeof(id_buf) - 1);
+      GNUNET_assert (NULL != end);
+      *end = '\0';
+      skip_log = 0;
+      if (have_journald)
+        fprintf (GNUNET_stderr,
+                 "(%s) %s %s",
+                 id_buf,
+                 GNUNET_error_type_to_string (kind),
+                 msg);
+      else
+        fprintf (GNUNET_stderr,
+                 "%s %s(%s) %s %s",
+                 datestr,
+                 comp,
+                 id_buf,
+                 GNUNET_error_type_to_string (kind),
+                 msg);
+    }
+    else
+    {
+      if (have_journald)
+        fprintf (GNUNET_stderr,
+                 "%s %s",
+                 GNUNET_error_type_to_string (kind),
+                 msg);
+      else
+        fprintf (GNUNET_stderr,
+                 "%s %s %s %s",
+                 datestr,
+                 comp,
+                 GNUNET_error_type_to_string (kind),
+                 msg);
+    }
+    fflush (GNUNET_stderr);
+  }
+  pos = loggers;
+  while (NULL != pos)
+  {
+    pos->logger (pos->logger_cls, kind, comp, datestr, msg);
+    pos = pos->next;
+  }
+}
+
+
+/**
+ * Flush an existing bulk report to the output.
+ *
+ * @param datestr our current timestamp
+ */
+static void
+flush_bulk (const char *datestr)
+{
+  char msg[DATE_STR_SIZE + BULK_TRACK_SIZE + 256];
+  int rev;
+  char *last;
+  const char *ft;
+
+  if ((0 == last_bulk_time.abs_value_us) || (0 == last_bulk_repeat))
+    return;
+  rev = 0;
+  last = memchr (last_bulk, '\0', BULK_TRACK_SIZE);
+  if (last == NULL)
+    last = &last_bulk[BULK_TRACK_SIZE - 1];
+  else if (last != last_bulk)
+    last--;
+  if (last[0] == '\n')
+  {
+    rev = 1;
+    last[0] = '\0';
+  }
+  ft =
+    GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (
+                                              last_bulk_time),
+                                            GNUNET_YES);
+  snprintf (msg,
+            sizeof(msg),
+            _ ("Message `%.*s' repeated %u times in the last %s\n"),
+            BULK_TRACK_SIZE,
+            last_bulk,
+            last_bulk_repeat,
+            ft);
+  if (rev == 1)
+    last[0] = '\n';
+  output_message (last_bulk_kind, last_bulk_comp, datestr, msg);
+  last_bulk_time = GNUNET_TIME_absolute_get ();
+  last_bulk_repeat = 0;
+}
+
+
+void
+GNUNET_log_skip (int n, int check_reset)
+{
+  int ok;
+
+  if (0 == n)
+  {
+    ok = (0 == skip_log);
+    skip_log = 0;
+    if (check_reset)
+      GNUNET_break (ok);
+  }
+  else
+  {
+    skip_log += n;
+  }
+}
+
+
+/**
+ * Get the number of log calls that are going to be skipped
+ *
+ * @return number of log calls to be ignored
+ */
+int
+GNUNET_get_log_skip ()
+{
+  return skip_log;
+}
+
+
+/**
+ * Output a log message using the default mechanism.
+ *
+ * @param kind how severe was the issue
+ * @param comp component responsible
+ * @param message the actual message
+ * @param va arguments to the format string "message"
+ */
+static void
+mylog (enum GNUNET_ErrorType kind,
+       const char *comp,
+       const char *message,
+       va_list va)
+{
+  char date[DATE_STR_SIZE];
+  char date2[DATE_STR_SIZE];
+  struct tm *tmptr;
+  size_t size;
+  va_list vacp;
+
+  va_copy (vacp, va);
+  size = vsnprintf (NULL, 0, message, vacp) + 1;
+  GNUNET_assert (0 != size);
+  va_end (vacp);
+  memset (date, 0, DATE_STR_SIZE);
+  {
+    char buf[size];
+    long long offset;
+
+    struct timeval timeofday;
+
+    gettimeofday (&timeofday, NULL);
+    offset = GNUNET_TIME_get_offset ();
+    if (offset > 0)
+    {
+      timeofday.tv_sec += offset / 1000LL;
+      timeofday.tv_usec += (offset % 1000LL) * 1000LL;
+      if (timeofday.tv_usec > 1000000LL)
+      {
+        timeofday.tv_usec -= 1000000LL;
+        timeofday.tv_sec++;
+      }
+    }
+    else
+    {
+      timeofday.tv_sec += offset / 1000LL;
+      if (timeofday.tv_usec > -(offset % 1000LL) * 1000LL)
+      {
+        timeofday.tv_usec += (offset % 1000LL) * 1000LL;
+      }
+      else
+      {
+        timeofday.tv_usec += 1000000LL + (offset % 1000LL) * 1000LL;
+        timeofday.tv_sec--;
+      }
+    }
+    tmptr = localtime (&timeofday.tv_sec);
+    if (NULL == tmptr)
+    {
+      strcpy (date, "localtime error");
+    }
+    else
+    {
+      /* RFC 3339 timestamp, with snprintf placeholder for microseconds */
+      if (0 == strftime (date2, DATE_STR_SIZE, "%Y-%m-%dT%H:%M:%S.%%06u%z",
+                         tmptr))
+        abort ();
+      /* Fill in microseconds */
+      if (0 > snprintf (date, sizeof(date), date2, timeofday.tv_usec))
+        abort ();
+    }
+
+    vsnprintf (buf, size, message, va);
+#if ! defined(GNUNET_CULL_LOGGING)
+    if (NULL != tmptr)
+      (void) setup_log_file (tmptr);
+#endif
+    if ((0 != (kind & GNUNET_ERROR_TYPE_BULK)) &&
+        (0 != last_bulk_time.abs_value_us) &&
+        (0 == strncmp (buf, last_bulk, sizeof(last_bulk))))
+    {
+      last_bulk_repeat++;
+      if ((GNUNET_TIME_absolute_get_duration (last_bulk_time).rel_value_us >
+           BULK_DELAY_THRESHOLD) ||
+          (last_bulk_repeat > BULK_REPEAT_THRESHOLD))
+        flush_bulk (date);
+      return;
+    }
+    flush_bulk (date);
+    GNUNET_strlcpy (last_bulk, buf, sizeof(last_bulk));
+    last_bulk_repeat = 0;
+    last_bulk_kind = kind;
+    last_bulk_time = GNUNET_TIME_absolute_get ();
+    GNUNET_strlcpy (last_bulk_comp, comp, sizeof(last_bulk_comp));
+    output_message (kind, comp, date, buf);
+  }
+}
+
+
+/**
+ * Main log function.
+ *
+ * @param kind how serious is the error?
+ * @param message what is the message (format string)
+ * @param ... arguments for format string
+ */
+void
+GNUNET_log_nocheck (enum GNUNET_ErrorType kind, const char *message, ...)
+{
+  va_list va;
+
+  va_start (va, message);
+  mylog (kind, component, message, va);
+  va_end (va);
+}
+
+
+/**
+ * Log function that specifies an alternative component.
+ * This function should be used by plugins.
+ *
+ * @param kind how serious is the error?
+ * @param comp component responsible for generating the message
+ * @param message what is the message (format string)
+ * @param ... arguments for format string
+ */
+void
+GNUNET_log_from_nocheck (enum GNUNET_ErrorType kind,
+                         const char *comp,
+                         const char *message,
+                         ...)
+{
+  va_list va;
+  char comp_w_pid[128];
+
+  if (comp == NULL)
+    comp = component_nopid;
+
+  va_start (va, message);
+  GNUNET_snprintf (comp_w_pid, sizeof(comp_w_pid), "%s-%d", comp, getpid ());
+  mylog (kind, comp_w_pid, message, va);
+  va_end (va);
+}
+
+
+const char *
+GNUNET_error_type_to_string (enum GNUNET_ErrorType kind)
+{
+  if ((kind & GNUNET_ERROR_TYPE_ERROR) > 0)
+    return _ ("ERROR");
+  if ((kind & GNUNET_ERROR_TYPE_WARNING) > 0)
+    return _ ("WARNING");
+  if ((kind & GNUNET_ERROR_TYPE_MESSAGE) > 0)
+    return _ ("MESSAGE");
+  if ((kind & GNUNET_ERROR_TYPE_INFO) > 0)
+    return _ ("INFO");
+  if ((kind & GNUNET_ERROR_TYPE_DEBUG) > 0)
+    return _ ("DEBUG");
+  if ((kind & ~GNUNET_ERROR_TYPE_BULK) == 0)
+    return _ ("NONE");
+  return _ ("INVALID");
+}
+
+
+/**
+ * Convert a hash to a string (for printing debug messages).
+ *
+ * @param hc the hash code
+ * @return string form; will be overwritten by next call to GNUNET_h2s.
+ */
+const char *
+GNUNET_h2s (const struct GNUNET_HashCode *hc)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+
+  GNUNET_CRYPTO_hash_to_enc (hc, &ret);
+  ret.encoding[8] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+/**
+ * Convert a hash to a string (for printing debug messages).
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant! Identical to #GNUNET_h2s(), except that another
+ * buffer is used so both #GNUNET_h2s() and #GNUNET_h2s2() can be
+ * used within the same log statement.
+ *
+ * @param hc the hash code
+ * @return string form; will be overwritten by next call to GNUNET_h2s.
+ */
+const char *
+GNUNET_h2s2 (const struct GNUNET_HashCode *hc)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+
+  GNUNET_CRYPTO_hash_to_enc (hc, &ret);
+  ret.encoding[8] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+const char *
+GNUNET_p2s (const struct GNUNET_CRYPTO_EddsaPublicKey *p)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (p, sizeof(*p), &hc);
+  GNUNET_CRYPTO_hash_to_enc (&hc, &ret);
+  ret.encoding[6] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+const char *
+GNUNET_p2s2 (const struct GNUNET_CRYPTO_EddsaPublicKey *p)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (p, sizeof(*p), &hc);
+  GNUNET_CRYPTO_hash_to_enc (&hc, &ret);
+  ret.encoding[6] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+const char *
+GNUNET_e2s (const struct GNUNET_CRYPTO_EcdhePublicKey *p)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (p, sizeof(*p), &hc);
+  GNUNET_CRYPTO_hash_to_enc (&hc, &ret);
+  ret.encoding[6] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+const char *
+GNUNET_e2s2 (const struct GNUNET_CRYPTO_EcdhePublicKey *p)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (p, sizeof(*p), &hc);
+  GNUNET_CRYPTO_hash_to_enc (&hc, &ret);
+  ret.encoding[6] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+/**
+ * @ingroup logging
+ * Convert a short hash value to a string (for printing debug messages).
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param shc the hash code
+ * @return string
+ */
+const char *
+GNUNET_sh2s (const struct GNUNET_ShortHashCode *shc)
+{
+  static GNUNET_THREAD_LOCAL char buf[64];
+
+  GNUNET_STRINGS_data_to_string (shc, sizeof(*shc), buf, sizeof(buf));
+  buf[6] = '\0';
+  return (const char *) buf;
+}
+
+
+/**
+ * @ingroup logging
+ * Convert a UUID to a string (for printing debug messages).
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param uuid the UUID
+ * @return string
+ */
+const char *
+GNUNET_uuid2s (const struct GNUNET_Uuid *uuid)
+{
+  static GNUNET_THREAD_LOCAL char buf[32];
+
+  GNUNET_STRINGS_data_to_string (uuid, sizeof(*uuid), buf, sizeof(buf));
+  buf[6] = '\0';
+  return (const char *) buf;
+}
+
+
+/**
+ * Convert a hash to a string (for printing debug messages).
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param hc the hash code
+ * @return string form; will be overwritten by next call to GNUNET_h2s_full.
+ */
+const char *
+GNUNET_h2s_full (const struct GNUNET_HashCode *hc)
+{
+  static GNUNET_THREAD_LOCAL struct GNUNET_CRYPTO_HashAsciiEncoded ret;
+
+  GNUNET_CRYPTO_hash_to_enc (hc, &ret);
+  ret.encoding[sizeof(ret) - 1] = '\0';
+  return (const char *) ret.encoding;
+}
+
+
+/**
+ * Convert a peer identity to a string (for printing debug messages).
+ *
+ * @param pid the peer identity
+ * @return string form of the pid; will be overwritten by next
+ *         call to #GNUNET_i2s.
+ */
+const char *
+GNUNET_i2s (const struct GNUNET_PeerIdentity *pid)
+{
+  static GNUNET_THREAD_LOCAL char buf[5];
+  char *ret;
+
+  if (NULL == pid)
+    return "NULL";
+  ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&pid->public_key);
+  GNUNET_strlcpy (buf, ret, sizeof(buf));
+  GNUNET_free (ret);
+  return buf;
+}
+
+
+/**
+ * Convert a peer identity to a string (for printing debug messages).
+ * Identical to #GNUNET_i2s(), except that another
+ * buffer is used so both #GNUNET_i2s() and #GNUNET_i2s2() can be
+ * used within the same log statement.
+ *
+ * @param pid the peer identity
+ * @return string form of the pid; will be overwritten by next
+ *         call to #GNUNET_i2s.
+ */
+const char *
+GNUNET_i2s2 (const struct GNUNET_PeerIdentity *pid)
+{
+  static GNUNET_THREAD_LOCAL char buf[5];
+  char *ret;
+
+  if (NULL == pid)
+    return "NULL";
+  ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&pid->public_key);
+  GNUNET_strlcpy (buf, ret, sizeof(buf));
+  GNUNET_free (ret);
+  return buf;
+}
+
+
+/**
+ * Convert a peer identity to a string (for printing debug messages).
+ *
+ * @param pid the peer identity
+ * @return string form of the pid; will be overwritten by next
+ *         call to #GNUNET_i2s_full.
+ */
+const char *
+GNUNET_i2s_full (const struct GNUNET_PeerIdentity *pid)
+{
+  static GNUNET_THREAD_LOCAL char buf[256];
+  char *ret;
+
+  ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&pid->public_key);
+  strcpy (buf, ret);
+  GNUNET_free (ret);
+  return buf;
+}
+
+
+/**
+ * Convert a "struct sockaddr*" (IPv4 or IPv6 address) to a string
+ * (for printing debug messages).  This is one of the very few calls
+ * in the entire API that is NOT reentrant!
+ *
+ * @param addr the address
+ * @param addrlen the length of the address in @a addr
+ * @return nicely formatted string for the address
+ *  will be overwritten by next call to #GNUNET_a2s.
+ */
+const char *
+GNUNET_a2s (const struct sockaddr *addr, socklen_t addrlen)
+{
+#define LEN                           \
+  GNUNET_MAX ((INET6_ADDRSTRLEN + 8), \
+              (1 + sizeof(struct sockaddr_un) - sizeof(sa_family_t)))
+  static GNUNET_THREAD_LOCAL char buf[LEN];
+#undef LEN
+  static GNUNET_THREAD_LOCAL char b2[6];
+  const struct sockaddr_in *v4;
+  const struct sockaddr_un *un;
+  const struct sockaddr_in6 *v6;
+  unsigned int off;
+
+  if (addr == NULL)
+    return _ ("unknown address");
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    if (addrlen != sizeof(struct sockaddr_in))
+      return "<invalid v4 address>";
+    v4 = (const struct sockaddr_in *) addr;
+    inet_ntop (AF_INET, &v4->sin_addr, buf, INET_ADDRSTRLEN);
+    if (0 == ntohs (v4->sin_port))
+      return buf;
+    strcat (buf, ":");
+    GNUNET_snprintf (b2, sizeof(b2), "%u", ntohs (v4->sin_port));
+    strcat (buf, b2);
+    return buf;
+
+  case AF_INET6:
+    if (addrlen != sizeof(struct sockaddr_in6))
+      return "<invalid v6 address>";
+    v6 = (const struct sockaddr_in6 *) addr;
+    buf[0] = '[';
+    inet_ntop (AF_INET6, &v6->sin6_addr, &buf[1], INET6_ADDRSTRLEN);
+    if (0 == ntohs (v6->sin6_port))
+      return &buf[1];
+    strcat (buf, "]:");
+    GNUNET_snprintf (b2, sizeof(b2), "%u", ntohs (v6->sin6_port));
+    strcat (buf, b2);
+    return buf;
+
+  case AF_UNIX:
+    if (addrlen <= sizeof(sa_family_t))
+      return "<unbound UNIX client>";
+    un = (const struct sockaddr_un *) addr;
+    off = 0;
+    if ('\0' == un->sun_path[0])
+      off++;
+    memset (buf, 0, sizeof(buf));
+    GNUNET_snprintf (buf,
+                     sizeof(buf),
+                     "%s%.*s",
+                     (1 == off) ? "@" : "",
+                     (int) (addrlen - sizeof(sa_family_t) - off),
+                     &un->sun_path[off]);
+    return buf;
+
+  default:
+    return _ ("invalid address");
+  }
+}
+
+
+void
+GNUNET_log_config_missing (enum GNUNET_ErrorType kind,
+                           const char *section,
+                           const char *option)
+{
+  GNUNET_log (kind,
+              _ (
+                "Configuration fails to specify option `%s' in section `%s'!\n"),
+              option,
+              section);
+}
+
+
+void
+GNUNET_log_config_invalid (enum GNUNET_ErrorType kind,
+                           const char *section,
+                           const char *option,
+                           const char *required)
+{
+  GNUNET_log (
+    kind,
+    _ (
+      "Configuration specifies invalid value for option `%s' in section `%s': %s\n"),
+    option,
+    section,
+    required);
+}
+
+
+/**
+ * Set the async scope for the current thread.
+ *
+ * @param aid the async scope identifier
+ * @param[out] old_scope location to save the old scope
+ */
+void
+GNUNET_async_scope_enter (const struct GNUNET_AsyncScopeId *aid,
+                          struct GNUNET_AsyncScopeSave *old_scope)
+{
+  *old_scope = current_async_scope;
+  current_async_scope.have_scope = GNUNET_YES;
+  current_async_scope.scope_id = *aid;
+}
+
+
+/**
+ * Clear the current thread's async scope.
+ *
+ * @param old_scope scope to restore
+ */
+void
+GNUNET_async_scope_restore (struct GNUNET_AsyncScopeSave *old_scope)
+{
+  current_async_scope = *old_scope;
+}
+
+
+/**
+ * Generate a fresh async scope identifier.
+ *
+ * @param[out] aid_ret pointer to where the result is stored
+ */
+void
+GNUNET_async_scope_fresh (struct GNUNET_AsyncScopeId *aid_ret)
+{
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              aid_ret,
+                              sizeof(struct GNUNET_AsyncScopeId));
+}
+
+
+/**
+ * Get the current async scope.
+ *
+ * @param[out] scope_ret pointer to where the result is stored
+ */
+void
+GNUNET_async_scope_get (struct GNUNET_AsyncScopeSave *scope_ret)
+{
+  *scope_ret = current_async_scope;
+}
+
+
+/**
+ * Initializer
+ */
+void __attribute__ ((constructor))
+GNUNET_util_cl_init ()
+{
+  GNUNET_stderr = stderr;
+}
+
+
+/**
+ * Destructor
+ */
+void __attribute__ ((destructor))
+GNUNET_util_cl_fini ()
+{
+
+}
+
+
+/* end of common_logging.c */
diff --git a/src/lib/util/compress.c b/src/lib/util/compress.c
new file mode 100644
index 000000000..73fa25bd9
--- /dev/null
+++ b/src/lib/util/compress.c
@@ -0,0 +1,91 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/compress.c
+ * @brief Simple (de)compression logic
+ * @author Philipp Toelke
+ * @author Martin Schanzenbach
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <zlib.h>
+
+int
+GNUNET_try_compression (const char *data,
+                        size_t old_size,
+                        char **result,
+                        size_t *new_size)
+{
+  char *tmp;
+  uLongf dlen;
+
+  *result = NULL;
+  *new_size = 0;
+#ifdef compressBound
+  dlen = compressBound (old_size);
+#else
+  dlen = old_size + (old_size / 100) + 20;
+  /* documentation says 100.1% oldSize + 12 bytes, but we
+   * should be able to overshoot by more to be safe */
+#endif
+  tmp = GNUNET_malloc (dlen);
+  if (Z_OK ==
+      compress2 ((Bytef *) tmp,
+                 &dlen,
+                 (const Bytef *) data,
+                 old_size, 9))
+  {
+    if (dlen < old_size)
+    {
+      *result = tmp;
+      *new_size = dlen;
+      return GNUNET_YES;
+    }
+  }
+  GNUNET_free (tmp);
+  return GNUNET_NO;
+}
+
+
+char *
+GNUNET_decompress (const char *input,
+                   size_t input_size,
+                   size_t output_size)
+{
+  char *output;
+  uLongf olen;
+
+  olen = output_size;
+  output = GNUNET_malloc (olen);
+  if (Z_OK ==
+      uncompress ((Bytef *) output,
+                  &olen,
+                  (const Bytef *) input,
+                  input_size))
+    return output;
+  GNUNET_free (output);
+  return NULL;
+}
+
+
+
+/* end of compress.c */
diff --git a/src/lib/util/configuration.c b/src/lib/util/configuration.c
new file mode 100644
index 000000000..17ba253ff
--- /dev/null
+++ b/src/lib/util/configuration.c
@@ -0,0 +1,2576 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2006, 2007, 2008, 2009, 2013, 2020, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file src/util/configuration.c
+ * @brief configuration management
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_configuration_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+  GNUNET_log_from_strerror_file (kind, "util", syscall, filename)
+
+/**
+ * @brief configuration entry
+ */
+struct ConfigEntry
+{
+  /**
+   * This is a linked list.
+   */
+  struct ConfigEntry *next;
+
+  /**
+   * key for this entry
+   */
+  char *key;
+
+  /**
+   * current, committed value
+   */
+  char *val;
+
+  /**
+   * Diagnostics information for the filename.
+   */
+  char *hint_filename;
+
+  /**
+   * Diagnostics information for the line number.
+   */
+  unsigned int hint_lineno;
+};
+
+
+/**
+ * @brief configuration section
+ */
+struct ConfigSection
+{
+  /**
+   * This is a linked list.
+   */
+  struct ConfigSection *next;
+
+  /**
+   * entries in the section
+   */
+  struct ConfigEntry *entries;
+
+  /**
+   * name of the section
+   */
+  char *name;
+
+  /**
+   * Is the configuration section marked as inaccessible?
+   *
+   * This can happen if the section name is used in an \@inline-secret\@
+   * directive, but the referenced file can't be found or accessed.
+   */
+  bool inaccessible;
+
+  /**
+   * Diagnostics hint for the secret file.
+   */
+  char *hint_secret_filename;
+
+  /**
+   * Extra information regarding permissions of the secret file.
+   */
+  char *hint_secret_stat;
+
+  /**
+   * For secret sections:  Where was this inlined from?
+   */
+  char *hint_inlined_from_filename;
+
+  /**
+   * For secret sections:  Where was this inlined from?
+   */
+  unsigned int hint_inlined_from_line;
+};
+
+struct ConfigFile
+{
+  /**
+   * Source filename.
+   */
+  char *source_filename;
+
+  /**
+   * Level in the tree of loaded config files.
+   */
+  unsigned int level;
+
+  struct ConfigFile *prev;
+
+  struct ConfigFile *next;
+
+  /**
+   * Was this configuration file parsed via
+   * \@inline-secret\@?
+   */
+  char *hint_restrict_section;
+
+  /**
+   * Was this configuration file inaccessible?
+   */
+  bool hint_inaccessible;
+};
+
+
+/**
+ * @brief configuration data
+ */
+struct GNUNET_CONFIGURATION_Handle
+{
+  /**
+   * Configuration sections.
+   */
+  struct ConfigSection *sections;
+
+  /**
+   * Linked list of loaded files.
+   */
+  struct ConfigFile *loaded_files_head;
+
+  /**
+   * Linked list of loaded files.
+   */
+  struct ConfigFile *loaded_files_tail;
+
+  /**
+   * Current nesting level of file loading.
+   */
+  unsigned int current_nest_level;
+
+  /**
+   * Enable diagnostics.
+   */
+  bool diagnostics;
+
+  /**
+   * Modification indication since last save
+   * #GNUNET_NO if clean, #GNUNET_YES if dirty,
+   * #GNUNET_SYSERR on error (i.e. last save failed)
+   */
+  enum GNUNET_GenericReturnValue dirty;
+
+  /**
+   * Was the configuration ever loaded via GNUNET_CONFIGURATION_load?
+   */
+  bool load_called;
+
+  /**
+   * Name of the entry point configuration file.
+   */
+  char *main_filename;
+
+  /**
+   * When parsing into this configuration, and this value
+   * is non-NULL, only parse sections of the same name,
+   * and ban import statements.
+   */
+  const char *restrict_section;
+};
+
+
+/**
+ * Used for diffing a configuration object against
+ * the default one
+ */
+struct DiffHandle
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg_default;
+
+  struct GNUNET_CONFIGURATION_Handle *cfgDiff;
+};
+
+
+void
+GNUNET_CONFIGURATION_enable_diagnostics (struct
+                                         GNUNET_CONFIGURATION_Handle *cfg)
+{
+  cfg->diagnostics = true;
+}
+
+
+struct GNUNET_CONFIGURATION_Handle *
+GNUNET_CONFIGURATION_create ()
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  char *p;
+
+  cfg = GNUNET_new (struct GNUNET_CONFIGURATION_Handle);
+  /* make certain values from the project data available
+     as PATHS */
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DATADIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "DATADIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LIBDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "LIBDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_BINDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "BINDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_PREFIX);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "PREFIX",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LOCALEDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "LOCALEDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_ICONDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "ICONDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DOCDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "DOCDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  p = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LIBEXECDIR);
+  if (NULL != p)
+  {
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "LIBEXECDIR",
+                                           p);
+    GNUNET_free (p);
+  }
+  return cfg;
+}
+
+
+void
+GNUNET_CONFIGURATION_destroy (struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct ConfigSection *sec;
+  struct ConfigFile *cf;
+
+  while (NULL != (sec = cfg->sections))
+    GNUNET_CONFIGURATION_remove_section (cfg, sec->name);
+  while (NULL != (cf = cfg->loaded_files_head))
+  {
+    GNUNET_free (cf->hint_restrict_section);
+    GNUNET_free (cf->source_filename);
+    GNUNET_CONTAINER_DLL_remove (cfg->loaded_files_head,
+                                 cfg->loaded_files_tail,
+                                 cf);
+    GNUNET_free (cf);
+  }
+  GNUNET_free (cfg->main_filename);
+  GNUNET_free (cfg);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_parse_and_run (const char *filename,
+                                    GNUNET_CONFIGURATION_Callback cb,
+                                    void *cb_cls)
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  enum GNUNET_GenericReturnValue ret;
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_load (cfg,
+                                 filename))
+  {
+    GNUNET_break (0);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return GNUNET_SYSERR;
+  }
+  ret = cb (cb_cls, cfg);
+  GNUNET_CONFIGURATION_destroy (cfg);
+  return ret;
+}
+
+
+/**
+ * Closure to collect_files_cb.
+ */
+struct CollectFilesContext
+{
+  /**
+   * Collected files from globbing.
+   */
+  char **files;
+
+  /**
+   * Size of the files array.
+   */
+  unsigned int files_length;
+};
+
+
+/**
+ * Function called with a filename.
+ *
+ * @param cls closure
+ * @param filename complete filename (absolute path)
+ * @return #GNUNET_OK to continue to iterate,
+ *  #GNUNET_NO to stop iteration with no error,
+ *  #GNUNET_SYSERR to abort iteration with error!
+ */
+static enum GNUNET_GenericReturnValue
+collect_files_cb (void *cls,
+                  const char *filename)
+{
+  struct CollectFilesContext *igc = cls;
+
+  GNUNET_array_append (igc->files,
+                       igc->files_length,
+                       GNUNET_strdup (filename));
+  return GNUNET_OK;
+}
+
+
+/**
+ * Find a section entry from a configuration.
+ *
+ * @param cfg configuration to search in
+ * @param section name of the section to look for
+ * @return matching entry, NULL if not found
+ */
+static struct ConfigSection *
+find_section (const struct GNUNET_CONFIGURATION_Handle *cfg,
+              const char *section)
+{
+  struct ConfigSection *pos;
+
+  pos = cfg->sections;
+  while ((pos != NULL) && (0 != strcasecmp (section, pos->name)))
+    pos = pos->next;
+  return pos;
+}
+
+
+static int
+pstrcmp (const void *a, const void *b)
+{
+  return strcmp (*((const char **) a), *((const char **) b));
+}
+
+
+/**
+ * Handle an inline directive.
+ *
+ * @returns #GNUNET_SYSERR on error, #GNUNET_OK otherwise
+ */
+enum GNUNET_GenericReturnValue
+handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
+               const char *path_or_glob,
+               bool path_is_glob,
+               const char *restrict_section,
+               const char *source_filename,
+               unsigned int source_lineno)
+{
+  char *inline_path = NULL;
+  struct GNUNET_CONFIGURATION_Handle *other_cfg = NULL;
+  struct CollectFilesContext igc = {
+    .files = NULL,
+    .files_length = 0,
+  };
+  enum GNUNET_GenericReturnValue fun_ret;
+  unsigned int old_nest_level = cfg->current_nest_level++;
+
+  /* We support the section restriction only for non-globs */
+  GNUNET_assert (! (path_is_glob && (NULL != restrict_section)));
+
+  if (NULL == source_filename)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Refusing to parse inline configurations, "
+         "not allowed without source filename!\n");
+    fun_ret = GNUNET_SYSERR;
+    goto cleanup;
+  }
+
+  if ('/' == *path_or_glob)
+    inline_path = GNUNET_strdup (path_or_glob);
+  else
+  {
+    /* We compute the canonical, absolute path first,
+       so that relative imports resolve properly with symlinked
+       config files.  */
+    char *source_realpath;
+    char *endsep;
+
+    source_realpath = realpath (source_filename,
+                                NULL);
+    if (NULL == source_realpath)
+    {
+      /* Couldn't even resolve path of base dir. */
+      GNUNET_break (0);
+      /* failed to parse included config */
+      fun_ret = GNUNET_SYSERR;
+      goto cleanup;
+    }
+    endsep = strrchr (source_realpath, '/');
+    GNUNET_assert (NULL != endsep);
+    *endsep = '\0';
+    GNUNET_asprintf (&inline_path,
+                     "%s/%s",
+                     source_realpath,
+                     path_or_glob);
+    free (source_realpath);
+  }
+
+  if (path_is_glob)
+  {
+    int nret;
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "processing config glob '%s'\n",
+         inline_path);
+
+    nret = GNUNET_DISK_glob (inline_path, collect_files_cb, &igc);
+    if (-1 == nret)
+    {
+      fun_ret = GNUNET_SYSERR;
+      goto cleanup;
+    }
+    GNUNET_assert (nret == igc.files_length);
+    qsort (igc.files, igc.files_length, sizeof (char *), pstrcmp);
+    for (int i = 0; i < nret; i++)
+    {
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_parse (cfg,
+                                      igc.files[i]))
+      {
+        fun_ret = GNUNET_SYSERR;
+        goto cleanup;
+      }
+    }
+    fun_ret = GNUNET_OK;
+  }
+  else if (NULL != restrict_section)
+  {
+    enum GNUNET_GenericReturnValue inner_ret;
+    struct ConfigSection *cs;
+    struct ConfigFile *cf = GNUNET_new (struct ConfigFile);
+
+    inner_ret = GNUNET_DISK_file_test_read (inline_path);
+
+    cs = find_section (cfg, restrict_section);
+
+    if (NULL == cs)
+    {
+      cs = GNUNET_new (struct ConfigSection);
+      cs->name = GNUNET_strdup (restrict_section);
+      cs->next = cfg->sections;
+      cfg->sections = cs;
+      cs->entries = NULL;
+    }
+    if (cfg->diagnostics)
+    {
+      char *sfn = GNUNET_STRINGS_filename_expand (inline_path);
+      struct stat istat;
+
+      cs->hint_secret_filename = sfn;
+      if (0 == stat (sfn, &istat))
+      {
+        struct passwd *pw = getpwuid (istat.st_uid);
+        struct group *gr = getgrgid (istat.st_gid);
+        char *pwname = (NULL == pw) ? "<unknown>" : pw->pw_name;
+        char *grname = (NULL == gr) ? "<unknown>" : gr->gr_name;
+
+        GNUNET_asprintf (&cs->hint_secret_stat,
+                         "%s:%s %o",
+                         pwname,
+                         grname,
+                         istat.st_mode);
+      }
+      else
+      {
+        cs->hint_secret_stat = GNUNET_strdup ("<can't stat file>");
+      }
+      if (source_filename)
+      {
+        /* Possible that this secret section has been inlined before */
+        GNUNET_free (cs->hint_inlined_from_filename);
+        cs->hint_inlined_from_filename = GNUNET_strdup (source_filename);
+        cs->hint_inlined_from_line = source_lineno;
+      }
+    }
+
+    /* Put file in the load list for diagnostics, even if we can't access it. */
+    {
+      cf->level = cfg->current_nest_level;
+      cf->source_filename = GNUNET_strdup (inline_path);
+      cf->hint_restrict_section = GNUNET_strdup (restrict_section);
+      GNUNET_CONTAINER_DLL_insert_tail (cfg->loaded_files_head,
+                                        cfg->loaded_files_tail,
+                                        cf);
+    }
+
+    if (GNUNET_OK != inner_ret)
+    {
+      cs->inaccessible = true;
+      cf->hint_inaccessible = true;
+      /* File can't be accessed, but that's okay. */
+      fun_ret = GNUNET_OK;
+      goto cleanup;
+    }
+
+    other_cfg = GNUNET_CONFIGURATION_create ();
+    other_cfg->restrict_section = restrict_section;
+    inner_ret = GNUNET_CONFIGURATION_parse (other_cfg,
+                                            inline_path);
+    if (GNUNET_OK != inner_ret)
+    {
+      cf->hint_inaccessible = true;
+      fun_ret = inner_ret;
+      goto cleanup;
+    }
+
+    cs = find_section (other_cfg, restrict_section);
+    if (NULL == cs)
+    {
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           "Configuration file '%s' loaded with @inline-secret@ "
+           "does not contain section '%s'.\n",
+           inline_path,
+           restrict_section);
+      /* Inlined onfiguration is accessible but doesn't contain any values.
+         We treat this as if the inlined section was empty, and do not
+         consider it an error. */
+      fun_ret = GNUNET_OK;
+      goto cleanup;
+    }
+    for (struct ConfigEntry *ce = cs->entries;
+         NULL != ce;
+         ce = ce->next)
+      GNUNET_CONFIGURATION_set_value_string (cfg,
+                                             restrict_section,
+                                             ce->key,
+                                             ce->val);
+    fun_ret = GNUNET_OK;
+  }
+  else if (GNUNET_OK !=
+           GNUNET_CONFIGURATION_parse (cfg,
+                                       inline_path))
+  {
+    fun_ret = GNUNET_SYSERR;
+    goto cleanup;
+  }
+  else
+  {
+    fun_ret = GNUNET_OK;
+  }
+cleanup:
+  cfg->current_nest_level = old_nest_level;
+  if (NULL != other_cfg)
+    GNUNET_CONFIGURATION_destroy (other_cfg);
+  GNUNET_free (inline_path);
+  if (igc.files_length > 0)
+  {
+    for (size_t i = 0; i < igc.files_length; i++)
+      GNUNET_free (igc.files[i]);
+    GNUNET_array_grow (igc.files, igc.files_length, 0);
+  }
+  return fun_ret;
+}
+
+
+/**
+ * Find an entry from a configuration.
+ *
+ * @param cfg handle to the configuration
+ * @param section section the option is in
+ * @param key the option
+ * @return matching entry, NULL if not found
+ */
+static struct ConfigEntry *
+find_entry (const struct GNUNET_CONFIGURATION_Handle *cfg,
+            const char *section,
+            const char *key)
+{
+  struct ConfigSection *sec;
+  struct ConfigEntry *pos;
+
+  if (NULL == (sec = find_section (cfg, section)))
+    return NULL;
+  if (sec->inaccessible)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Section '%s' is marked as inaccessible, because the configuration "
+         " file that contains the section can't be read.  Attempts to use "
+         "option '%s' will fail.\n",
+         section,
+         key);
+    return NULL;
+  }
+  pos = sec->entries;
+  while ((pos != NULL) && (0 != strcasecmp (key, pos->key)))
+    pos = pos->next;
+  return pos;
+}
+
+
+/**
+ * Set a configuration hint.
+ *
+ * @param cfg configuration handle
+ * @param section section
+ * @param option config option
+ * @param hint_filename
+ * @param hint_line
+ */
+static void
+set_entry_hint (struct GNUNET_CONFIGURATION_Handle *cfg,
+                const char *section,
+                const char *option,
+                const char *hint_filename,
+                unsigned int hint_line)
+{
+  struct ConfigEntry *e = find_entry (cfg, section, option);
+  if (! cfg->diagnostics)
+    return;
+  if (! e)
+    return;
+  e->hint_filename = GNUNET_strdup (hint_filename);
+  e->hint_lineno = hint_line;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                  const char *mem,
+                                  size_t size,
+                                  const char *source_filename)
+{
+  size_t line_size;
+  unsigned int nr;
+  size_t r_bytes;
+  size_t to_read;
+  enum GNUNET_GenericReturnValue ret;
+  char *section;
+  char *eq;
+  char *tag;
+  char *value;
+  char *line_orig = NULL;
+
+  ret = GNUNET_OK;
+  section = NULL;
+  nr = 0;
+  r_bytes = 0;
+  while (r_bytes < size)
+  {
+    char *pos;
+    char *line;
+    bool emptyline;
+
+    GNUNET_free (line_orig);
+    /* fgets-like behaviour on buffer */
+    to_read = size - r_bytes;
+    pos = memchr (&mem[r_bytes], '\n', to_read);
+    if (NULL == pos)
+    {
+      line_orig = GNUNET_strndup (&mem[r_bytes],
+                                  line_size = to_read);
+      r_bytes += line_size;
+    }
+    else
+    {
+      line_orig = GNUNET_strndup (&mem[r_bytes],
+                                  line_size = (pos - &mem[r_bytes]));
+      r_bytes += line_size + 1;
+    }
+    line = line_orig;
+    /* increment line number */
+    nr++;
+    /* tabs and '\r' are whitespace */
+    emptyline = GNUNET_YES;
+    for (size_t i = 0; i < line_size; i++)
+    {
+      if (line[i] == '\t')
+        line[i] = ' ';
+      if (line[i] == '\r')
+        line[i] = ' ';
+      if (' ' != line[i])
+        emptyline = GNUNET_NO;
+    }
+    /* ignore empty lines */
+    if (GNUNET_YES == emptyline)
+      continue;
+
+    /* remove tailing whitespace */
+    for (size_t i = line_size - 1;
+         (i >= 1) && (isspace ((unsigned char) line[i]));
+         i--)
+      line[i] = '\0';
+
+    /* remove leading whitespace */
+    for (; line[0] != '\0' && (isspace ((unsigned char) line[0])); line++)
+      ;
+
+    /* ignore comments */
+    if ( ('#' == line[0]) ||
+         ('%' == line[0]) )
+      continue;
+
+    /* Handle special directives. */
+    if ('@' == line[0])
+    {
+      char *end = strchr (line + 1, '@');
+      char *directive;
+      enum GNUNET_GenericReturnValue directive_ret;
+
+      if (NULL != cfg->restrict_section)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Illegal directive in line %u (parsing restricted section %s)\n",
+             nr,
+             cfg->restrict_section);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+
+      if (NULL == end)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Bad directive in line %u\n",
+             nr);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+      *end = '\0';
+      directive = line + 1;
+
+      if (0 == strcasecmp (directive,
+                           "INLINE"))
+      {
+        const char *path = end + 1;
+
+        /* Skip space before path */
+        for (; isspace (*path); path++)
+          ;
+
+        directive_ret = handle_inline (cfg,
+                                       path,
+                                       false,
+                                       NULL,
+                                       source_filename,
+                                       nr);
+      }
+      else if (0 == strcasecmp (directive,
+                                "INLINE-MATCHING"))
+      {
+        const char *path = end + 1;
+
+        /* Skip space before path */
+        for (; isspace (*path); path++)
+          ;
+
+        directive_ret = handle_inline (cfg,
+                                       path,
+                                       true,
+                                       NULL,
+                                       source_filename,
+                                       nr);
+      }
+      else if (0 == strcasecmp (directive,
+                                "INLINE-SECRET"))
+      {
+        char *secname = end + 1;
+        char *secname_end;
+        const char *path;
+
+        /* Skip space before secname */
+        for (; isspace (*secname); secname++)
+          ;
+
+        secname_end = strchr (secname, ' ');
+
+        if (NULL == secname_end)
+        {
+          LOG (GNUNET_ERROR_TYPE_WARNING,
+               "Bad inline-secret directive in line %u\n",
+               nr);
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        *secname_end = '\0';
+        path = secname_end + 1;
+
+        /* Skip space before path */
+        for (; isspace (*path); path++)
+          ;
+
+        directive_ret = handle_inline (cfg,
+                                       path,
+                                       false,
+                                       secname,
+                                       source_filename,
+                                       nr);
+      }
+      else
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Unknown or malformed directive '%s' in line %u\n",
+             directive,
+             nr);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+      if (GNUNET_OK != directive_ret)
+      {
+        ret = directive_ret;
+        break;
+      }
+      continue;
+    }
+    if ( ('[' == line[0]) &&
+         (']' == line[line_size - 1]) )
+    {
+      /* [value] */
+      line[line_size - 1] = '\0';
+      value = &line[1];
+      GNUNET_free (section);
+      section = GNUNET_strdup (value);
+      continue;
+    }
+    if (NULL != (eq = strchr (line, '=')))
+    {
+      size_t i;
+
+      if (NULL == section)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Syntax error while deserializing in line %u (option without section)\n",
+             nr);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+
+      /* tag = value */
+      tag = GNUNET_strndup (line, eq - line);
+      /* remove tailing whitespace */
+      for (i = strlen (tag) - 1;
+           (i >= 1) && (isspace ((unsigned char) tag[i]));
+           i--)
+        tag[i] = '\0';
+
+      /* Strip whitespace */
+      value = eq + 1;
+      while (isspace ((unsigned char) value[0]))
+        value++;
+      for (i = strlen (value) - 1;
+           (i >= 1) && (isspace ((unsigned char) value[i]));
+           i--)
+        value[i] = '\0';
+
+      /* remove quotes */
+      i = 0;
+      if ( ('"' == value[0]) &&
+           ('"' == value[strlen (value) - 1]) )
+      {
+        value[strlen (value) - 1] = '\0';
+        value++;
+      }
+      GNUNET_CONFIGURATION_set_value_string (cfg,
+                                             section,
+                                             tag,
+                                             &value[i]);
+      if (cfg->diagnostics)
+      {
+        set_entry_hint (cfg,
+                        section,
+                        tag,
+                        source_filename
+                        ? source_filename
+                        : "<input>",
+                        nr);
+      }
+      GNUNET_free (tag);
+      continue;
+    }
+    /* parse error */
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Syntax error while deserializing in line %u\n",
+         nr);
+    ret = GNUNET_SYSERR;
+    break;
+  }
+  GNUNET_free (line_orig);
+  GNUNET_free (section);
+  GNUNET_assert ( (GNUNET_OK != ret) ||
+                  (r_bytes == size) );
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_parse (struct GNUNET_CONFIGURATION_Handle *cfg,
+                            const char *filename)
+{
+  uint64_t fs64;
+  size_t fs;
+  char *fn;
+  char *mem;
+  int dirty;
+  enum GNUNET_GenericReturnValue ret;
+  ssize_t sret;
+
+  fn = GNUNET_STRINGS_filename_expand (filename);
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Asked to parse config file `%s'\n", fn);
+  if (NULL == fn)
+    return GNUNET_SYSERR;
+
+
+  /* Check for cycles */
+  {
+    unsigned int lvl = cfg->current_nest_level;
+    struct ConfigFile *cf = cfg->loaded_files_tail;
+    struct ConfigFile *parent = NULL;
+
+
+    for (; NULL != cf; parent = cf, cf = cf->prev)
+    {
+      /* Check parents based on level, skipping children of siblings. */
+      if (cf->level >= lvl)
+        continue;
+      lvl = cf->level;
+      if ( (NULL == cf->source_filename) || (NULL == filename))
+        continue;
+      if (0 == strcmp (cf->source_filename, filename))
+      {
+        if (NULL == parent)
+        {
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "Forbidden direct cyclic configuration import (%s -> %s)\n",
+               cf->source_filename,
+               filename);
+        }
+        else
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "Forbidden indirect cyclic configuration import (%s -> ... -> %s -> %s)\n",
+               cf->source_filename,
+               parent->source_filename,
+               filename);
+        GNUNET_free (fn);
+        return GNUNET_SYSERR;
+      }
+    }
+
+  }
+
+  /* Keep track of loaded files.*/
+  {
+    struct ConfigFile *cf = GNUNET_new (struct ConfigFile);
+
+    cf->level = cfg->current_nest_level;
+    cf->source_filename = GNUNET_strdup (filename ? filename : "<input>");
+    GNUNET_CONTAINER_DLL_insert_tail (cfg->loaded_files_head,
+                                      cfg->loaded_files_tail,
+                                      cf);
+  }
+
+  dirty = cfg->dirty; /* back up value! */
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_file_size (fn,
+                             &fs64,
+                             GNUNET_YES,
+                             GNUNET_YES))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Error while determining the file size of `%s'\n",
+         fn);
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  if (fs64 > SIZE_MAX)
+  {
+    GNUNET_break (0);  /* File size is more than the heap size */
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  fs = fs64;
+  mem = GNUNET_malloc (fs);
+  sret = GNUNET_DISK_fn_read (fn, mem, fs);
+  if ((sret < 0) || (fs != (size_t) sret))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Error while reading file `%s'\n",
+         fn);
+    GNUNET_free (fn);
+    GNUNET_free (mem);
+    return GNUNET_SYSERR;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Deserializing contents of file `%s'\n",
+       fn);
+  ret = GNUNET_CONFIGURATION_deserialize (cfg,
+                                          mem,
+                                          fs,
+                                          fn);
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Failed to parse configuration file `%s'\n"),
+                fn);
+  }
+  GNUNET_free (fn);
+  GNUNET_free (mem);
+  /* restore dirty flag - anything we set in the meantime
+   * came from disk */
+  cfg->dirty = dirty;
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_is_dirty (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  return cfg->dirty;
+}
+
+
+/**
+ * Should we skip this configuration entry when serializing?
+ *
+ * @param sec section name
+ * @param key key
+ * @return true if we should skip it
+ */
+static bool
+do_skip (const char *sec,
+         const char *key)
+{
+  if (0 != strcasecmp ("PATHS",
+                       sec))
+    return false;
+  return ( (0 == strcasecmp ("DATADIR",
+                             key)) ||
+           (0 == strcasecmp ("LIBDIR",
+                             key)) ||
+           (0 == strcasecmp ("BINDIR",
+                             key)) ||
+           (0 == strcasecmp ("PREFIX",
+                             key)) ||
+           (0 == strcasecmp ("LOCALEDIR",
+                             key)) ||
+           (0 == strcasecmp ("ICONDIR",
+                             key)) ||
+           (0 == strcasecmp ("DOCDIR",
+                             key)) ||
+           (0 == strcasecmp ("DEFAULTCONFIG",
+                             key)) ||
+           (0 == strcasecmp ("LIBEXECDIR",
+                             key)) );
+}
+
+
+char *
+GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                                size_t *size)
+{
+  char *mem;
+  char *cbuf;
+  char *val;
+  char *pos;
+  size_t m_size;
+  size_t c_size;
+
+  /* Pass1 : calculate the buffer size required */
+  m_size = 0;
+  for (struct ConfigSection *sec = cfg->sections;
+       NULL != sec;
+       sec = sec->next)
+  {
+    if (sec->inaccessible)
+      continue;
+    /* For each section we need to add 3 characters: {'[',']','\n'} */
+    m_size += strlen (sec->name) + 3;
+    for (struct ConfigEntry *ent = sec->entries;
+         NULL != ent;
+         ent = ent->next)
+    {
+      if (do_skip (sec->name,
+                   ent->key))
+        continue;
+      if (NULL != ent->val)
+      {
+        /* if val has any '\n' then they occupy +1 character as '\n'->'\\','n' */
+        pos = ent->val;
+        while (NULL != (pos = strstr (pos, "\n")))
+        {
+          m_size++;
+          pos++;
+        }
+        /* For each key = value pair we need to add 4 characters (2
+           spaces and 1 equal-to character and 1 new line) */
+        m_size += strlen (ent->key) + strlen (ent->val) + 4;
+      }
+    }
+    /* A new line after section end */
+    m_size++;
+  }
+
+  /* Pass2: Allocate memory and write the configuration to it */
+  mem = GNUNET_malloc (m_size);
+  c_size = 0;
+  *size = c_size;
+  for (struct ConfigSection *sec = cfg->sections;
+       NULL != sec;
+       sec = sec->next)
+  {
+    int len;
+
+    len = GNUNET_asprintf (&cbuf,
+                           "[%s]\n",
+                           sec->name);
+    GNUNET_assert (0 < len);
+    GNUNET_memcpy (mem + c_size,
+                   cbuf,
+                   len);
+    c_size += len;
+    GNUNET_free (cbuf);
+    for (struct ConfigEntry *ent = sec->entries;
+         NULL != ent;
+         ent = ent->next)
+    {
+      if (do_skip (sec->name,
+                   ent->key))
+        continue;
+      if (NULL != ent->val)
+      {
+        val = GNUNET_malloc (strlen (ent->val) * 2 + 1);
+        strcpy (val, ent->val);
+        while (NULL != (pos = strstr (val, "\n")))
+        {
+          memmove (&pos[2], &pos[1], strlen (&pos[1]));
+          pos[0] = '\\';
+          pos[1] = 'n';
+        }
+        len = GNUNET_asprintf (&cbuf, "%s = %s\n", ent->key, val);
+        GNUNET_free (val);
+        GNUNET_memcpy (mem + c_size, cbuf, len);
+        c_size += len;
+        GNUNET_free (cbuf);
+      }
+    }
+    GNUNET_memcpy (mem + c_size, "\n", 1);
+    c_size++;
+  }
+  GNUNET_assert (c_size == m_size);
+  *size = c_size;
+  return mem;
+}
+
+
+char *
+GNUNET_CONFIGURATION_serialize_diagnostics (const struct
+                                            GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_Buffer buf = { 0 };
+
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n# Configuration file diagnostics\n#\n");
+  GNUNET_buffer_write_fstr (&buf,
+                            "# Entry point: %s\n",
+                            cfg->main_filename ? cfg->main_filename :
+                            "<none>");
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n# Files Loaded:\n");
+
+  for (struct ConfigFile *cfil = cfg->loaded_files_head;
+       NULL != cfil;
+       cfil = cfil->next)
+  {
+    GNUNET_buffer_write_fstr (&buf,
+                              "# ");
+    for (unsigned int i = 0; i < cfil->level; i++)
+      GNUNET_buffer_write_fstr (&buf,
+                                "+");
+    if (0 != cfil->level)
+      GNUNET_buffer_write_fstr (&buf,
+                                " ");
+
+    GNUNET_buffer_write_fstr (&buf,
+                              "%s",
+                              cfil->source_filename);
+
+    if (NULL != cfil->hint_restrict_section)
+      GNUNET_buffer_write_fstr (&buf,
+                                " (%s secret section %s)",
+                                cfil->hint_inaccessible
+                                  ? "inaccessible"
+                                  : "loaded",
+                                cfil->hint_restrict_section);
+
+    GNUNET_buffer_write_str (&buf,
+                             "\n");
+  }
+
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n\n");
+
+  for (struct ConfigSection *sec = cfg->sections;
+       NULL != sec;
+       sec = sec->next)
+  {
+    if (sec->hint_secret_filename)
+      GNUNET_buffer_write_fstr (&buf,
+                                "# secret section from %s\n# secret file stat %s\n",
+                                sec->hint_secret_filename,
+                                sec->hint_secret_stat);
+    if (sec->hint_inlined_from_filename)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "# inlined from %s:%u\n",
+                                sec->hint_inlined_from_filename,
+                                sec->hint_inlined_from_line);
+    }
+    GNUNET_buffer_write_fstr (&buf,
+                              "[%s]\n\n",
+                              sec->name);
+    if (sec->inaccessible)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "# <section contents inaccessible>\n\n\n");
+      continue;
+    }
+    for (struct ConfigEntry *ent = sec->entries;
+         NULL != ent;
+         ent = ent->next)
+    {
+      if (do_skip (sec->name,
+                   ent->key))
+        continue;
+      if (NULL != ent->val)
+      {
+        char *pos;
+        char *val = GNUNET_malloc (strlen (ent->val) * 2 + 1);
+        strcpy (val, ent->val);
+        while (NULL != (pos = strstr (val, "\n")))
+        {
+          memmove (&pos[2], &pos[1], strlen (&pos[1]));
+          pos[0] = '\\';
+          pos[1] = 'n';
+        }
+        if (NULL != ent->hint_filename)
+        {
+          GNUNET_buffer_write_fstr (&buf,
+                                    "# %s:%u\n",
+                                    ent->hint_filename,
+                                    ent->hint_lineno);
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%s = %s\n",
+                                  ent->key,
+                                  val);
+        GNUNET_free (val);
+      }
+      GNUNET_buffer_write_str (&buf, "\n");
+    }
+    GNUNET_buffer_write_str (&buf, "\n");
+  }
+  return GNUNET_buffer_reap_str (&buf);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_write (struct GNUNET_CONFIGURATION_Handle *cfg,
+                            const char *filename)
+{
+  char *fn;
+  char *cfg_buf;
+  size_t size;
+
+  fn = GNUNET_STRINGS_filename_expand (filename);
+  if (fn == NULL)
+    return GNUNET_SYSERR;
+  if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (fn))
+  {
+    GNUNET_free (fn);
+    return GNUNET_SYSERR;
+  }
+  cfg_buf = GNUNET_CONFIGURATION_serialize (cfg,
+                                            &size);
+  {
+    struct GNUNET_DISK_FileHandle *h;
+
+    h = GNUNET_DISK_file_open (fn,
+                               GNUNET_DISK_OPEN_WRITE
+                               | GNUNET_DISK_OPEN_TRUNCATE
+                               | GNUNET_DISK_OPEN_CREATE,
+                               GNUNET_DISK_PERM_USER_READ
+                               | GNUNET_DISK_PERM_USER_WRITE
+                               | GNUNET_DISK_PERM_GROUP_READ
+                               | GNUNET_DISK_PERM_GROUP_WRITE);
+    if (NULL == h)
+    {
+      GNUNET_free (fn);
+      GNUNET_free (cfg_buf);
+      return GNUNET_SYSERR;
+    }
+    if (((ssize_t) size) !=
+        GNUNET_DISK_file_write (h,
+                                cfg_buf,
+                                size))
+    {
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                                "write",
+                                fn);
+      GNUNET_DISK_file_close (h);
+      (void) GNUNET_DISK_directory_remove (fn);
+      GNUNET_free (fn);
+      GNUNET_free (cfg_buf);
+      cfg->dirty = GNUNET_SYSERR;   /* last write failed */
+      return GNUNET_SYSERR;
+    }
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_DISK_file_close (h));
+  }
+  GNUNET_free (fn);
+  GNUNET_free (cfg_buf);
+  cfg->dirty = GNUNET_NO; /* last write succeeded */
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CONFIGURATION_iterate (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                              GNUNET_CONFIGURATION_Iterator iter,
+                              void *iter_cls)
+{
+  for (struct ConfigSection *spos = cfg->sections;
+       NULL != spos;
+       spos = spos->next)
+    for (struct ConfigEntry *epos = spos->entries;
+         NULL != epos;
+         epos = epos->next)
+      if (NULL != epos->val)
+        iter (iter_cls,
+              spos->name,
+              epos->key,
+              epos->val);
+}
+
+
+void
+GNUNET_CONFIGURATION_iterate_section_values (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  GNUNET_CONFIGURATION_Iterator iter,
+  void *iter_cls)
+{
+  struct ConfigSection *spos;
+  struct ConfigEntry *epos;
+
+  spos = cfg->sections;
+  while ((spos != NULL) && (0 != strcasecmp (spos->name, section)))
+    spos = spos->next;
+  if (NULL == spos)
+    return;
+  if (spos->inaccessible)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Section '%s' is marked as inaccessible, because the configuration "
+         " file that contains the section can't be read.\n",
+         section);
+    return;
+  }
+  for (epos = spos->entries; NULL != epos; epos = epos->next)
+    if (NULL != epos->val)
+      iter (iter_cls, spos->name, epos->key, epos->val);
+}
+
+
+void
+GNUNET_CONFIGURATION_iterate_sections (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  GNUNET_CONFIGURATION_SectionIterator iter,
+  void *iter_cls)
+{
+  struct ConfigSection *spos;
+  struct ConfigSection *next;
+
+  next = cfg->sections;
+  while (next != NULL)
+  {
+    spos = next;
+    next = spos->next;
+    iter (iter_cls, spos->name);
+  }
+}
+
+
+void
+GNUNET_CONFIGURATION_remove_section (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                     const char *section)
+{
+  struct ConfigSection *spos;
+  struct ConfigSection *prev;
+  struct ConfigEntry *ent;
+
+  prev = NULL;
+  spos = cfg->sections;
+  while (NULL != spos)
+  {
+    if (0 == strcasecmp (section, spos->name))
+    {
+      if (NULL == prev)
+        cfg->sections = spos->next;
+      else
+        prev->next = spos->next;
+      while (NULL != (ent = spos->entries))
+      {
+        spos->entries = ent->next;
+        GNUNET_free (ent->key);
+        GNUNET_free (ent->val);
+        GNUNET_free (ent->hint_filename);
+        GNUNET_free (ent);
+        cfg->dirty = GNUNET_YES;
+      }
+      GNUNET_free (spos->name);
+      GNUNET_free (spos->hint_secret_filename);
+      GNUNET_free (spos->hint_secret_stat);
+      GNUNET_free (spos->hint_inlined_from_filename);
+      GNUNET_free (spos);
+      return;
+    }
+    prev = spos;
+    spos = spos->next;
+  }
+}
+
+
+/**
+ * Copy a configuration value to the given target configuration.
+ * Overwrites existing entries.
+ *
+ * @param cls the destination configuration (`struct GNUNET_CONFIGURATION_Handle *`)
+ * @param section section for the value
+ * @param option option name of the value
+ * @param value value to copy
+ */
+static void
+copy_entry (void *cls,
+            const char *section,
+            const char *option,
+            const char *value)
+{
+  struct GNUNET_CONFIGURATION_Handle *dst = cls;
+
+  GNUNET_CONFIGURATION_set_value_string (dst,
+                                         section,
+                                         option,
+                                         value);
+}
+
+
+struct GNUNET_CONFIGURATION_Handle *
+GNUNET_CONFIGURATION_dup (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_CONFIGURATION_Handle *ret;
+
+  ret = GNUNET_CONFIGURATION_create ();
+  GNUNET_CONFIGURATION_iterate (cfg, &copy_entry, ret);
+  return ret;
+}
+
+
+/**
+ * A callback function, compares entries from two configurations
+ * (default against a new configuration) and write the diffs in a
+ * diff-configuration object (the callback object).
+ *
+ * @param cls the diff configuration (`struct DiffHandle *`)
+ * @param section section for the value (of the default conf.)
+ * @param option option name of the value (of the default conf.)
+ * @param value value to copy (of the default conf.)
+ */
+static void
+compare_entries (void *cls,
+                 const char *section,
+                 const char *option,
+                 const char *value)
+{
+  struct DiffHandle *dh = cls;
+  struct ConfigEntry *entNew;
+
+  entNew = find_entry (dh->cfg_default, section, option);
+  if ((NULL != entNew) && (NULL != entNew->val) &&
+      (0 == strcmp (entNew->val, value)))
+    return;
+  GNUNET_CONFIGURATION_set_value_string (dh->cfgDiff,
+                                         section,
+                                         option,
+                                         value);
+}
+
+
+struct GNUNET_CONFIGURATION_Handle *
+GNUNET_CONFIGURATION_get_diff (
+  const struct GNUNET_CONFIGURATION_Handle *cfg_default,
+  const struct GNUNET_CONFIGURATION_Handle *cfg_new)
+{
+  struct DiffHandle diffHandle;
+
+  diffHandle.cfgDiff = GNUNET_CONFIGURATION_create ();
+  diffHandle.cfg_default = cfg_default;
+  GNUNET_CONFIGURATION_iterate (cfg_new, &compare_entries, &diffHandle);
+  return diffHandle.cfgDiff;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_write_diffs (
+  const struct GNUNET_CONFIGURATION_Handle *cfg_default,
+  const struct GNUNET_CONFIGURATION_Handle *cfg_new,
+  const char *filename)
+{
+  int ret;
+  struct GNUNET_CONFIGURATION_Handle *diff;
+
+  diff = GNUNET_CONFIGURATION_get_diff (cfg_default, cfg_new);
+  ret = GNUNET_CONFIGURATION_write (diff, filename);
+  GNUNET_CONFIGURATION_destroy (diff);
+  return ret;
+}
+
+
+void
+GNUNET_CONFIGURATION_set_value_string (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                       const char *section,
+                                       const char *option,
+                                       const char *value)
+{
+  struct ConfigSection *sec;
+  struct ConfigEntry *e;
+  char *nv;
+
+  e = find_entry (cfg, section, option);
+  if (NULL != e)
+  {
+    if (NULL == value)
+    {
+      GNUNET_free (e->val);
+      e->val = NULL;
+    }
+    else
+    {
+      nv = GNUNET_strdup (value);
+      GNUNET_free (e->val);
+      e->val = nv;
+    }
+    return;
+  }
+  sec = find_section (cfg, section);
+  if (sec == NULL)
+  {
+    sec = GNUNET_new (struct ConfigSection);
+    sec->name = GNUNET_strdup (section);
+    sec->next = cfg->sections;
+    cfg->sections = sec;
+  }
+  e = GNUNET_new (struct ConfigEntry);
+  e->key = GNUNET_strdup (option);
+  e->val = GNUNET_strdup (value);
+  e->next = sec->entries;
+  sec->entries = e;
+}
+
+
+void
+GNUNET_CONFIGURATION_set_value_number (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                       const char *section,
+                                       const char *option,
+                                       unsigned long long number)
+{
+  char s[64];
+
+  GNUNET_snprintf (s,
+                   64,
+                   "%llu",
+                   number);
+  GNUNET_CONFIGURATION_set_value_string (cfg,
+                                         section,
+                                         option,
+                                         s);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_number (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  unsigned long long *number)
+{
+  struct ConfigEntry *e;
+  char dummy[2];
+
+  if (NULL == (e = find_entry (cfg, section, option)))
+    return GNUNET_SYSERR;
+  if (NULL == e->val)
+    return GNUNET_SYSERR;
+  if (1 != sscanf (e->val, "%llu%1s", number, dummy))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_float (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  float *number)
+{
+  struct ConfigEntry *e;
+  char dummy[2];
+
+  if (NULL == (e = find_entry (cfg, section, option)))
+    return GNUNET_SYSERR;
+  if (NULL == e->val)
+    return GNUNET_SYSERR;
+  if (1 != sscanf (e->val, "%f%1s", number, dummy))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_time (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  struct GNUNET_TIME_Relative *time)
+{
+  struct ConfigEntry *e;
+  int ret;
+
+  if (NULL == (e = find_entry (cfg, section, option)))
+    return GNUNET_SYSERR;
+  if (NULL == e->val)
+    return GNUNET_SYSERR;
+  ret = GNUNET_STRINGS_fancy_time_to_relative (e->val, time);
+  if (GNUNET_OK != ret)
+    GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               option,
+                               _ ("Not a valid relative time specification"));
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_size (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  unsigned long long *size)
+{
+  struct ConfigEntry *e;
+
+  if (NULL == (e = find_entry (cfg, section, option)))
+    return GNUNET_SYSERR;
+  if (NULL == e->val)
+    return GNUNET_SYSERR;
+  return GNUNET_STRINGS_fancy_size_to_bytes (e->val, size);
+}
+
+
+/**
+ * Get a configuration value that should be a string.
+ *
+ * @param cfg configuration to inspect
+ * @param section section of interest
+ * @param option option of interest
+ * @param value will be set to a freshly allocated configuration
+ *        value, or NULL if option is not specified
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_string (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  char **value)
+{
+  struct ConfigEntry *e;
+
+  if ((NULL == (e = find_entry (cfg, section, option))) || (NULL == e->val))
+  {
+    *value = NULL;
+    return GNUNET_SYSERR;
+  }
+  *value = GNUNET_strdup (e->val);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_choice (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *const *choices,
+  const char **value)
+{
+  struct ConfigEntry *e;
+  unsigned int i;
+
+  if (NULL == (e = find_entry (cfg, section, option)))
+    return GNUNET_SYSERR;
+  for (i = 0; NULL != choices[i]; i++)
+    if (0 == strcasecmp (choices[i], e->val))
+      break;
+  if (NULL == choices[i])
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Configuration value '%s' for '%s'"
+            " in section '%s' is not in set of legal choices\n"),
+         e->val,
+         option,
+         section);
+    return GNUNET_SYSERR;
+  }
+  *value = choices[i];
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_data (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                               const char *section,
+                               const char *option,
+                               void *buf,
+                               size_t buf_size)
+{
+  char *enc;
+  int res;
+  size_t data_size;
+
+  if (GNUNET_OK !=
+      (res =
+         GNUNET_CONFIGURATION_get_value_string (cfg, section, option, &enc)))
+    return res;
+  data_size = (strlen (enc) * 5) / 8;
+  if (data_size != buf_size)
+  {
+    GNUNET_free (enc);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc, strlen (enc), buf, buf_size))
+  {
+    GNUNET_free (enc);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (enc);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_have_value (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                                 const char *section,
+                                 const char *option)
+{
+  struct ConfigEntry *e;
+
+  if ((NULL == (e = find_entry (cfg, section, option))) || (NULL == e->val))
+    return GNUNET_NO;
+  return GNUNET_YES;
+}
+
+
+/**
+ * Expand an expression of the form "$FOO/BAR" to "DIRECTORY/BAR"
+ * where either in the "PATHS" section or the environment "FOO" is
+ * set to "DIRECTORY".  We also support default expansion,
+ * i.e. ${VARIABLE:-default} will expand to $VARIABLE if VARIABLE is
+ * set in PATHS or the environment, and otherwise to "default".  Note
+ * that "default" itself can also be a $-expression, thus
+ * "${VAR1:-{$VAR2}}" will expand to VAR1 and if that is not defined
+ * to VAR2.
+ *
+ * @param cfg configuration to use for path expansion
+ * @param orig string to $-expand (will be freed!)
+ * @param depth recursion depth, used to detect recursive expansions
+ * @return $-expanded string, never NULL unless @a orig was NULL
+ */
+static char *
+expand_dollar (const struct GNUNET_CONFIGURATION_Handle *cfg,
+               char *orig,
+               unsigned int depth)
+{
+  char *prefix;
+  char *result;
+  char *start;
+  const char *post;
+  const char *env;
+  char *def;
+  char *end;
+  unsigned int lopen;
+  char erased_char;
+  char *erased_pos;
+  size_t len;
+
+  if (NULL == orig)
+    return NULL;
+  if (depth > 128)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Recursive expansion suspected, aborting $-expansion for term `%s'\n",
+         orig);
+    return orig;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Asked to $-expand %s\n",
+       orig);
+  if ('$' != orig[0])
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Doesn't start with $ - not expanding\n");
+    return orig;
+  }
+  erased_char = 0;
+  erased_pos = NULL;
+  if ('{' == orig[1])
+  {
+    start = &orig[2];
+    lopen = 1;
+    end = &orig[1];
+    while (lopen > 0)
+    {
+      end++;
+      switch (*end)
+      {
+      case '}':
+        lopen--;
+        break;
+
+      case '{':
+        lopen++;
+        break;
+
+      case '\0':
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Missing closing `}' in option `%s'\n",
+             orig);
+        return orig;
+
+      default:
+        break;
+      }
+    }
+    erased_char = *end;
+    erased_pos = end;
+    *end = '\0';
+    post = end + 1;
+    def = strchr (orig, ':');
+    if (NULL != def)
+    {
+      *def = '\0';
+      def++;
+      if (('-' == *def) || ('=' == *def))
+        def++;
+      def = GNUNET_strdup (def);
+    }
+  }
+  else
+  {
+    int i;
+
+    start = &orig[1];
+    def = NULL;
+    i = 0;
+    while ( (orig[i] != '/') &&
+            (orig[i] != '\\') &&
+            (orig[i] != '\0') &&
+            (orig[i] != ' ') )
+      i++;
+    if (orig[i] == '\0')
+    {
+      post = "";
+    }
+    else
+    {
+      erased_char = orig[i];
+      erased_pos = &orig[i];
+      orig[i] = '\0';
+      post = &orig[i + 1];
+    }
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Split into `%s' and `%s' with default %s\n",
+       start,
+       post,
+       def);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             "PATHS",
+                                             start,
+                                             &prefix))
+  {
+    if (NULL == (env = getenv (start)))
+    {
+      /* try default */
+      def = expand_dollar (cfg,
+                           def,
+                           depth + 1);
+      env = def;
+    }
+    if (NULL == env)
+    {
+      start = GNUNET_strdup (start);
+      if (erased_pos)
+        *erased_pos = erased_char;
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           "Failed to expand `%s' in `%s' as it is neither found in [PATHS] nor defined as an environmental variable\n",
+           start,
+           orig);
+      GNUNET_free (start);
+      return orig;
+    }
+    prefix = GNUNET_strdup (env);
+  }
+  prefix = GNUNET_CONFIGURATION_expand_dollar (cfg,
+                                               prefix);
+  if ((erased_pos) && ('}' != erased_char))
+  {
+    len = strlen (prefix) + 1;
+    prefix = GNUNET_realloc (prefix, len + 1);
+    prefix[len - 1] = erased_char;
+    prefix[len] = '\0';
+  }
+  result = GNUNET_malloc (strlen (prefix) + strlen (post) + 1);
+  strcpy (result, prefix);
+  strcat (result, post);
+  GNUNET_free (def);
+  GNUNET_free (prefix);
+  GNUNET_free (orig);
+  return result;
+}
+
+
+char *
+GNUNET_CONFIGURATION_expand_dollar (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  char *orig)
+{
+  char *dup;
+  size_t i;
+  size_t len;
+
+  for (i = 0; '\0' != orig[i]; i++)
+  {
+    if ('$' != orig[i])
+      continue;
+    dup = GNUNET_strdup (orig + i);
+    dup = expand_dollar (cfg, dup, 0);
+    GNUNET_assert (NULL != dup); /* make compiler happy */
+    len = strlen (dup) + 1;
+    orig = GNUNET_realloc (orig, i + len);
+    GNUNET_memcpy (orig + i, dup, len);
+    GNUNET_free (dup);
+  }
+  return orig;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_filename (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  char **value)
+{
+  char *tmp;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, section, option, &tmp))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG, "Failed to retrieve filename\n");
+    *value = NULL;
+    return GNUNET_SYSERR;
+  }
+  tmp = GNUNET_CONFIGURATION_expand_dollar (cfg, tmp);
+  *value = GNUNET_STRINGS_filename_expand (tmp);
+  GNUNET_free (tmp);
+  if (*value == NULL)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_get_value_yesno (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option)
+{
+  static const char *yesno[] = { "YES", "NO", NULL };
+  const char *val;
+  int ret;
+
+  ret =
+    GNUNET_CONFIGURATION_get_value_choice (cfg, section, option, yesno, &val);
+  if (ret == GNUNET_SYSERR)
+    return ret;
+  if (val == yesno[0])
+    return GNUNET_YES;
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONFIGURATION_iterate_value_filenames (
+  const struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  GNUNET_FileNameCallback cb,
+  void *cb_cls)
+{
+  char *list;
+  char *pos;
+  char *end;
+  char old;
+  int ret;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, section, option, &list))
+    return 0;
+  GNUNET_assert (list != NULL);
+  ret = 0;
+  pos = list;
+  while (1)
+  {
+    while (pos[0] == ' ')
+      pos++;
+    if (strlen (pos) == 0)
+      break;
+    end = pos + 1;
+    while ((end[0] != ' ') && (end[0] != '\0'))
+    {
+      if (end[0] == '\\')
+      {
+        switch (end[1])
+        {
+        case '\\':
+        case ' ':
+          memmove (end, &end[1], strlen (&end[1]) + 1);
+
+        case '\0':
+          /* illegal, but just keep it */
+          break;
+
+        default:
+          /* illegal, but just ignore that there was a '/' */
+          break;
+        }
+      }
+      end++;
+    }
+    old = end[0];
+    end[0] = '\0';
+    if (strlen (pos) > 0)
+    {
+      ret++;
+      if ((cb != NULL) && (GNUNET_OK != cb (cb_cls, pos)))
+      {
+        ret = GNUNET_SYSERR;
+        break;
+      }
+    }
+    if (old == '\0')
+      break;
+    pos = end + 1;
+  }
+  GNUNET_free (list);
+  return ret;
+}
+
+
+/**
+ * FIXME.
+ *
+ * @param value FIXME
+ * @return FIXME
+ */
+static char *
+escape_name (const char *value)
+{
+  char *escaped;
+  const char *rpos;
+  char *wpos;
+
+  escaped = GNUNET_malloc (strlen (value) * 2 + 1);
+  memset (escaped, 0, strlen (value) * 2 + 1);
+  rpos = value;
+  wpos = escaped;
+  while (rpos[0] != '\0')
+  {
+    switch (rpos[0])
+    {
+    case '\\':
+    case ' ':
+      wpos[0] = '\\';
+      wpos[1] = rpos[0];
+      wpos += 2;
+      break;
+
+    default:
+      wpos[0] = rpos[0];
+      wpos++;
+    }
+    rpos++;
+  }
+  return escaped;
+}
+
+
+/**
+ * FIXME.
+ *
+ * @param cls string we compare with (const char*)
+ * @param fn filename we are currently looking at
+ * @return #GNUNET_OK if the names do not match, #GNUNET_SYSERR if they do
+ */
+static enum GNUNET_GenericReturnValue
+test_match (void *cls, const char *fn)
+{
+  const char *of = cls;
+
+  return (0 == strcmp (of, fn)) ? GNUNET_SYSERR : GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_append_value_filename (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *value)
+{
+  char *escaped;
+  char *old;
+  char *nw;
+
+  if (GNUNET_SYSERR ==
+      GNUNET_CONFIGURATION_iterate_value_filenames (cfg,
+                                                    section,
+                                                    option,
+                                                    &test_match,
+                                                    (void *) value))
+    return GNUNET_NO; /* already exists */
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, section, option, &old))
+    old = GNUNET_strdup ("");
+  escaped = escape_name (value);
+  nw = GNUNET_malloc (strlen (old) + strlen (escaped) + 2);
+  strcpy (nw, old);
+  if (strlen (old) > 0)
+    strcat (nw, " ");
+  strcat (nw, escaped);
+  GNUNET_CONFIGURATION_set_value_string (cfg,
+                                         section,
+                                         option,
+                                         nw);
+  GNUNET_free (old);
+  GNUNET_free (nw);
+  GNUNET_free (escaped);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_remove_value_filename (
+  struct GNUNET_CONFIGURATION_Handle *cfg,
+  const char *section,
+  const char *option,
+  const char *value)
+{
+  char *list;
+  char *pos;
+  char *end;
+  char *match;
+  char old;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             section,
+                                             option,
+                                             &list))
+    return GNUNET_NO;
+  match = escape_name (value);
+  pos = list;
+  while (1)
+  {
+    while (pos[0] == ' ')
+      pos++;
+    if (strlen (pos) == 0)
+      break;
+    end = pos + 1;
+    while ((end[0] != ' ') && (end[0] != '\0'))
+    {
+      if (end[0] == '\\')
+      {
+        switch (end[1])
+        {
+        case '\\':
+        case ' ':
+          end++;
+          break;
+
+        case '\0':
+          /* illegal, but just keep it */
+          break;
+
+        default:
+          /* illegal, but just ignore that there was a '/' */
+          break;
+        }
+      }
+      end++;
+    }
+    old = end[0];
+    end[0] = '\0';
+    if (0 == strcmp (pos, match))
+    {
+      if (old != '\0')
+        memmove (pos,
+                 &end[1],
+                 strlen (&end[1]) + 1);
+      else
+      {
+        if (pos != list)
+          pos[-1] = '\0';
+        else
+          pos[0] = '\0';
+      }
+      GNUNET_CONFIGURATION_set_value_string (cfg,
+                                             section,
+                                             option,
+                                             list);
+      GNUNET_free (list);
+      GNUNET_free (match);
+      return GNUNET_OK;
+    }
+    if (old == '\0')
+      break;
+    end[0] = old;
+    pos = end + 1;
+  }
+  GNUNET_free (list);
+  GNUNET_free (match);
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_load_from (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                const char *defaults_d)
+{
+  struct CollectFilesContext files_context = {
+    .files = NULL,
+    .files_length = 0,
+  };
+  enum GNUNET_GenericReturnValue fun_ret;
+
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_directory_scan (defaults_d, &collect_files_cb,
+                                  &files_context))
+    return GNUNET_SYSERR; /* no configuration at all found */
+  qsort (files_context.files,
+         files_context.files_length,
+         sizeof (char *),
+         pstrcmp);
+  for (unsigned int i = 0; i < files_context.files_length; i++)
+  {
+    char *ext;
+    const char *filename = files_context.files[i];
+
+    /* Examine file extension */
+    ext = strrchr (filename, '.');
+    if ((NULL == ext) || (0 != strcmp (ext, ".conf")))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Skipping file `%s'\n", filename);
+      fun_ret = GNUNET_OK;
+      goto cleanup;
+    }
+    fun_ret = GNUNET_CONFIGURATION_parse (cfg, filename);
+    if (fun_ret != GNUNET_OK)
+      break;
+  }
+cleanup:
+  if (files_context.files_length > 0)
+  {
+    for (size_t i = 0; i < files_context.files_length; i++)
+      GNUNET_free (files_context.files[i]);
+    GNUNET_array_grow (files_context.files,
+                       files_context.files_length,
+                       0);
+  }
+  return fun_ret;
+}
+
+
+char *
+GNUNET_CONFIGURATION_default_filename (void)
+{
+  char *cfg_fn;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  const char *xdg = getenv ("XDG_CONFIG_HOME");
+
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfg_fn,
+                     "%s%s%s",
+                     xdg,
+                     DIR_SEPARATOR_STR,
+                     pd->config_file);
+  else
+    cfg_fn = GNUNET_strdup (pd->user_config_file);
+
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+  GNUNET_free (cfg_fn);
+
+  /* Fall back to /etc/ for the default configuration.
+     Should be okay to use forward slashes here. */
+
+  GNUNET_asprintf (&cfg_fn,
+                   "/etc/%s",
+                   pd->config_file);
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+  GNUNET_free (cfg_fn);
+
+  GNUNET_asprintf (&cfg_fn,
+                   "/etc/%s/%s",
+                   pd->project_dirname,
+                   pd->config_file);
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+
+  GNUNET_free (cfg_fn);
+  return NULL;
+}
+
+
+struct GNUNET_CONFIGURATION_Handle *
+GNUNET_CONFIGURATION_default (void)
+{
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  const struct GNUNET_OS_ProjectData *dpd = GNUNET_OS_project_data_default ();
+  const char *xdg = getenv ("XDG_CONFIG_HOME");
+  char *cfgname = NULL;
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /* Makes sure function implicitly looking at the installation directory (for
+     example GNUNET_CONFIGURATION_load further down) use GNUnet's environment
+     instead of the caller's.  It's done at the start to make sure as many
+     functions as possible are directed to the proper paths. */
+  GNUNET_OS_init (dpd);
+
+  cfg = GNUNET_CONFIGURATION_create ();
+
+  /* First, try user configuration. */
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfgname, "%s/%s", xdg, dpd->config_file);
+  else
+    cfgname = GNUNET_strdup (dpd->user_config_file);
+
+  /* If user config doesn't exist, try in
+     /etc/<projdir>/<cfgfile> and /etc/<cfgfile> */
+  if (GNUNET_OK != GNUNET_DISK_file_test (cfgname))
+  {
+    GNUNET_free (cfgname);
+    GNUNET_asprintf (&cfgname, "/etc/%s", dpd->config_file);
+  }
+  if (GNUNET_OK != GNUNET_DISK_file_test (cfgname))
+  {
+    GNUNET_free (cfgname);
+    GNUNET_asprintf (&cfgname,
+                     "/etc/%s/%s",
+                     dpd->project_dirname,
+                     dpd->config_file);
+  }
+  if (GNUNET_OK != GNUNET_DISK_file_test (cfgname))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Unable to top-level configuration file.\n");
+    GNUNET_OS_init (pd);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    GNUNET_free (cfgname);
+    return NULL;
+  }
+
+  /* We found a configuration file that looks good, try to load it. */
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Loading top-level configuration from '%s'\n",
+       cfgname);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_load (cfg, cfgname))
+  {
+    GNUNET_OS_init (pd);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    GNUNET_free (cfgname);
+    return NULL;
+  }
+  GNUNET_free (cfgname);
+  GNUNET_OS_init (pd);
+  return cfg;
+}
+
+
+/**
+ * Load configuration (starts with defaults, then loads
+ * system-specific configuration).
+ *
+ * @param cfg configuration to update
+ * @param filename name of the configuration file, NULL to load defaults
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_load (struct GNUNET_CONFIGURATION_Handle *cfg,
+                           const char *filename)
+{
+  char *baseconfig;
+  const char *base_config_varname;
+
+  if (cfg->load_called)
+  {
+    /* FIXME:  Make this a GNUNET_assert later */
+    GNUNET_break (0);
+    GNUNET_free (cfg->main_filename);
+  }
+  cfg->load_called = true;
+  if (NULL != filename)
+  {
+    GNUNET_free (cfg->main_filename);
+    cfg->main_filename = GNUNET_strdup (filename);
+  }
+
+  base_config_varname = GNUNET_OS_project_data_get ()->base_config_varname;
+
+  if ((NULL != base_config_varname)
+      && (NULL != (baseconfig = getenv (base_config_varname))))
+  {
+    baseconfig = GNUNET_strdup (baseconfig);
+  }
+  else
+  {
+    char *ipath;
+
+    ipath = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DATADIR);
+    if (NULL == ipath)
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_asprintf (&baseconfig, "%s%s", ipath, "config.d");
+    GNUNET_free (ipath);
+  }
+
+  char *dname = GNUNET_STRINGS_filename_expand (baseconfig);
+  GNUNET_free (baseconfig);
+
+  if ((GNUNET_YES ==
+       GNUNET_DISK_directory_test (dname,
+                                   GNUNET_YES)) &&
+      (GNUNET_SYSERR ==
+       GNUNET_CONFIGURATION_load_from (cfg,
+                                       dname)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Failed to load base configuration from '%s'\n",
+         filename);
+    GNUNET_free (dname);
+    return GNUNET_SYSERR;       /* no configuration at all found */
+  }
+  GNUNET_free (dname);
+  if ((NULL != filename) &&
+      (GNUNET_OK !=
+       GNUNET_CONFIGURATION_parse (cfg,
+                                   filename)))
+  {
+    /* specified configuration not found */
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Failed to load configuration from file '%s'\n",
+         filename);
+    return GNUNET_SYSERR;
+  }
+  if (((GNUNET_YES !=
+        GNUNET_CONFIGURATION_have_value (cfg,
+                                         "PATHS",
+                                         "DEFAULTCONFIG"))) &&
+      (filename != NULL))
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "PATHS",
+                                           "DEFAULTCONFIG",
+                                           filename);
+  return GNUNET_OK;
+}
+
+
+/* end of configuration.c */
diff --git a/src/lib/util/configuration_helper.c b/src/lib/util/configuration_helper.c
new file mode 100644
index 000000000..d4d5fc732
--- /dev/null
+++ b/src/lib/util/configuration_helper.c
@@ -0,0 +1,303 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2006, 2007, 2008, 2009, 2013, 2020, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file src/util/configuration_helper.c
+ * @brief helper logic for gnunet-config
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Print each option in a given section as a filename.
+ *
+ * @param cls closure
+ * @param section name of the section
+ * @param option name of the option
+ * @param value value of the option
+ */
+static void
+print_filename_option (void *cls,
+                       const char *section,
+                       const char *option,
+                       const char *value)
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+
+  char *value_fn;
+  char *fn;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                          section,
+                                                          option,
+                                                          &value_fn));
+  fn = GNUNET_STRINGS_filename_expand (value_fn);
+  if (NULL == fn)
+    fn = value_fn;
+  else
+    GNUNET_free (value_fn);
+  fprintf (stdout,
+           "%s = %s\n",
+           option,
+           fn);
+  GNUNET_free (fn);
+}
+
+
+/**
+ * Print each option in a given section.
+ *
+ * @param cls closure
+ * @param section name of the section
+ * @param option name of the option
+ * @param value value of the option
+ */
+static void
+print_option (void *cls,
+              const char *section,
+              const char *option,
+              const char *value)
+{
+  (void) cls;
+  (void) section;
+
+  fprintf (stdout,
+           "%s = %s\n",
+           option,
+           value);
+}
+
+
+/**
+ * Print out given section name.
+ *
+ * @param cls unused
+ * @param section a section in the configuration file
+ */
+static void
+print_section_name (void *cls,
+                    const char *section)
+{
+  (void) cls;
+  fprintf (stdout,
+           "%s\n",
+           section);
+}
+
+
+void
+GNUNET_CONFIGURATION_config_tool_run (
+  void *cls,
+  char *const *args,
+  const char *cfgfile,
+  const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_CONFIGURATION_ConfigSettings *cs = cls;
+  struct GNUNET_CONFIGURATION_Handle *out = NULL;
+  struct GNUNET_CONFIGURATION_Handle *ncfg = NULL;
+
+  (void) args;
+  if (cs->diagnostics)
+  {
+    /* Re-parse the configuration with diagnostics enabled. */
+    ncfg = GNUNET_CONFIGURATION_create ();
+    GNUNET_CONFIGURATION_enable_diagnostics (ncfg);
+    GNUNET_CONFIGURATION_load (ncfg,
+                               cfgfile);
+    cfg = ncfg;
+  }
+
+  if (cs->full)
+    cs->rewrite = GNUNET_YES;
+  if (cs->list_sections)
+  {
+    fprintf (stderr,
+             _ ("The following sections are available:\n"));
+    GNUNET_CONFIGURATION_iterate_sections (cfg,
+                                           &print_section_name,
+                                           NULL);
+    return;
+  }
+  if ( (! cs->rewrite) &&
+       (NULL == cs->section) )
+  {
+    char *serialization;
+
+    if (! cs->diagnostics)
+    {
+      fprintf (stderr,
+               _ ("%s, %s or %s argument is required\n"),
+               "--section",
+               "--list-sections",
+               "--diagnostics");
+      cs->global_ret = EXIT_INVALIDARGUMENT;
+      return;
+    }
+    serialization = GNUNET_CONFIGURATION_serialize_diagnostics (cfg);
+    fprintf (stdout,
+             "%s",
+             serialization);
+    GNUNET_free (serialization);
+  }
+  else if ( (NULL != cs->section) &&
+            (NULL == cs->value) )
+  {
+    if (NULL == cs->option)
+    {
+      GNUNET_CONFIGURATION_iterate_section_values (
+        cfg,
+        cs->section,
+        cs->is_filename
+        ? &print_filename_option
+        : &print_option,
+        (void *) cfg);
+    }
+    else
+    {
+      char *value;
+
+      if (cs->is_filename)
+      {
+        if (GNUNET_OK !=
+            GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                     cs->section,
+                                                     cs->option,
+                                                     &value))
+        {
+          GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                                     cs->section,
+                                     cs->option);
+          cs->global_ret = EXIT_NOTCONFIGURED;
+          return;
+        }
+      }
+      else
+      {
+        if (GNUNET_OK !=
+            GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                   cs->section,
+                                                   cs->option,
+                                                   &value))
+        {
+          GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                                     cs->section,
+                                     cs->option);
+          cs->global_ret = EXIT_NOTCONFIGURED;
+          return;
+        }
+      }
+      fprintf (stdout,
+               "%s\n",
+               value);
+      GNUNET_free (value);
+    }
+  }
+  else if (NULL != cs->section)
+  {
+    if (NULL == cs->option)
+    {
+      fprintf (stderr,
+               _ ("--option argument required to set value\n"));
+      cs->global_ret = EXIT_INVALIDARGUMENT;
+      return;
+    }
+    out = GNUNET_CONFIGURATION_dup (cfg);
+    GNUNET_CONFIGURATION_set_value_string (out,
+                                           cs->section,
+                                           cs->option,
+                                           cs->value);
+    cs->rewrite = GNUNET_YES;
+  }
+  if (cs->rewrite)
+  {
+    char *cfg_fn = NULL;
+
+    if (NULL == out)
+      out = GNUNET_CONFIGURATION_dup (cfg);
+
+    if (NULL == cfgfile)
+    {
+      const char *xdg = getenv ("XDG_CONFIG_HOME");
+
+      if (NULL != xdg)
+        GNUNET_asprintf (&cfg_fn,
+                         "%s%s%s",
+                         xdg,
+                         DIR_SEPARATOR_STR,
+                         GNUNET_OS_project_data_get ()->config_file);
+      else
+        cfg_fn = GNUNET_strdup (
+          GNUNET_OS_project_data_get ()->user_config_file);
+      cfgfile = cfg_fn;
+    }
+
+    if (! cs->full)
+    {
+      struct GNUNET_CONFIGURATION_Handle *def;
+
+      def = GNUNET_CONFIGURATION_create ();
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_load (def,
+                                     NULL))
+      {
+        fprintf (stderr,
+                 _ ("failed to load configuration defaults"));
+        cs->global_ret = 1;
+        GNUNET_CONFIGURATION_destroy (def);
+        GNUNET_CONFIGURATION_destroy (out);
+        GNUNET_free (cfg_fn);
+        return;
+      }
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_write_diffs (def,
+                                            out,
+                                            cfgfile))
+        cs->global_ret = 2;
+      GNUNET_CONFIGURATION_destroy (def);
+    }
+    else
+    {
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_write (out,
+                                      cfgfile))
+        cs->global_ret = 2;
+    }
+    GNUNET_free (cfg_fn);
+  }
+  if (NULL != out)
+    GNUNET_CONFIGURATION_destroy (out);
+  if (NULL != ncfg)
+    GNUNET_CONFIGURATION_destroy (ncfg);
+}
+
+
+void
+GNUNET_CONFIGURATION_config_settings_free (
+  struct GNUNET_CONFIGURATION_ConfigSettings *cs)
+{
+  GNUNET_free (cs->option);
+  GNUNET_free (cs->section);
+  GNUNET_free (cs->value);
+}
+
+
+/* end of configuration_helper.c */
diff --git a/src/lib/util/consttime_memcmp.c b/src/lib/util/consttime_memcmp.c
new file mode 100644
index 000000000..d4fa45a5b
--- /dev/null
+++ b/src/lib/util/consttime_memcmp.c
@@ -0,0 +1,280 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2015 Christophe Meessen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
+/* Minimally modified for libgnunetutil: added license header
+   (from https://github.com/chmike/cst_time_memcmp, LICENSE file), and
+   renamed the exported symbol: */
+#define consttime_memcmp GNUNET_memcmp_ct_
+/* Rest of the file is 'original' */
+
+
+#include "platform.h"
+#include <stddef.h>
+#include <inttypes.h>
+
+/*
+ * "constant time" memcmp.  Time taken depends on the buffer length, of
+ * course, but not on the content of the buffers.
+ *
+ * Just like the ordinary memcmp function, the return value is
+ * tri-state: <0, 0, or >0.  However, applications that need a
+ * constant-time memory comparison function usually need only a
+ * two-state result, signalling only whether the inputs were identical
+ * or different, but not signalling which of the inputs was larger.
+ * This code could be made significantly faster and simpler if the
+ * requirement for a tri-state result were removed.
+ *
+ * In order to protect against adversaries who can observe timing,
+ * cache hits or misses, page faults, etc., and who can use such
+ * observations to learn something about the relationship between the
+ * contents of the two buffers, we have to perform exactly the same
+ * instructions and memory accesses regardless of the contents of the
+ * buffers.  We can't stop as soon as we find a difference, we can't
+ * take different conditional branches depending on the data, and we
+ * can't use different pointers or array indexes depending on the data.
+ *
+ * Further reading:
+ *
+ * .Rs
+ * .%A Paul C. Kocher
+ * .%T Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems
+ * .%D 1996
+ * .%J CRYPTO 1996
+ * .%P 104-113
+ * .%U http://www.cryptography.com/timingattack/paper.html
+ * .%U http://www.webcitation.org/query?url=http%3A%2F%2Fwww.cryptography.com%2Ftimingattack%2Fpaper.html&date=2012-10-17
+ * .Re
+ *
+ * .Rs
+ * .%A D. Boneh
+ * .%A D. Brumley
+ * .%T Remote timing attacks are practical
+ * .%D August 2003
+ * .%J Proceedings of the 12th Usenix Security Symposium, 2003
+ * .%U https://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html
+ * .%U http://www.webcitation.org/query?url=https%3A%2F%2Fcrypto.stanford.edu%2F%7Edabo%2Fabstracts%2Fssl-timing.html&date=2012-10-17
+ * .%U http://www.webcitation.org/query?url=http%3A%2F%2Fcrypto.stanford.edu%2F%7Edabo%2Fpubs%2Fpapers%2Fssl-timing.pdf&date=2012-10-17
+ * .Es
+ *
+ * .Rs
+ * .%A Coda Hale
+ * .%T A Lesson In Timing Attacks (or, Don't use MessageDigest.isEquals)
+ * .%D 13 Aug 2009
+ * .%U http://codahale.com/a-lesson-in-timing-attacks/
+ * .%U http://www.webcitation.org/query?url=http%3A%2F%2Fcodahale.com%2Fa-lesson-in-timing-attacks%2F&date=2012-10-17
+ * .Re
+ *
+ */
+
+/*
+ * A note on portability:
+ *
+ * We assume that char is exactly 8 bits, the same as uint8_t, and that
+ * integer types with exactly 16 bits and exactly 32 bits exist.  (If
+ * there is ever a need to change this, then the actual requirement is
+ * that we need a type that is at least two bits wider than char, and
+ * another type that is at least two bits wider than that, or we need to
+ * fake it somehow.)
+ *
+ * We do not assume any particular size for the plain "int" type, except
+ * that it is at least 16 bits, as is guaranteed by the C language
+ * standard.
+ *
+ * We do not assume that signed integer overflow is harmless.  We
+ * ensure that signed integer overflow does not occur, so that
+ * implementation-defined overflow behaviour is not invoked.
+ *
+ * We rely on the C standard's guarantees regarding the wraparound
+ * behaviour of unsigned integer arithmetic, and on the analogous
+ * guarantees regarding conversions from signed types to narrower
+ * unsigned types.
+ *
+ * We do not assume that the platform uses two's complement arithmetic.
+ */
+
+/*
+ * How hard do we have to try to prevent unwanted compiler optimisations?
+ *
+ * Try compiling with "#define USE_VOLATILE_TEMPORARY 0", and examine
+ * the compiler output.  If the only conditional tests in the entire
+ * function are to test whether len is zero, then all is well, but try
+ * again with different optimisation flags to be sure.  If the compiler
+ * emitted code with conditional tests that do anything other than
+ * testing whether len is zero, then that's a problem, so try again with
+ * "#define USE_VOLATILE_TEMPORARY 1".  If it's still bad, then you are
+ * out of luck.
+ */
+#define USE_VOLATILE_TEMPORARY 0
+
+int
+consttime_memcmp (const void *b1, const void *b2, size_t len)
+{
+  const uint8_t *c1, *c2;
+  uint16_t d, r, m;
+
+#if USE_VOLATILE_TEMPORARY
+  volatile uint16_t v;
+#else
+  uint16_t v;
+#endif
+
+  c1 = b1;
+  c2 = b2;
+
+  r = 0;
+  while (len)
+  {
+    /*
+     * Take the low 8 bits of r (in the range 0x00 to 0xff,
+     * or 0 to 255);
+     * As explained elsewhere, the low 8 bits of r will be zero
+     * if and only if all bytes compared so far were identical;
+     * Zero-extend to a 16-bit type (in the range 0x0000 to
+     * 0x00ff);
+     * Add 255, yielding a result in the range 255 to 510;
+     * Save that in a volatile variable to prevent
+     * the compiler from trying any shortcuts (the
+     * use of a volatile variable depends on "#ifdef
+     * USE_VOLATILE_TEMPORARY", and most compilers won't
+     * need it);
+     * Divide by 256 yielding a result of 1 if the original
+     * value of r was non-zero, or 0 if r was zero;
+     * Subtract 1, yielding 0 if r was non-zero, or -1 if r
+     * was zero;
+     * Convert to uint16_t, yielding 0x0000 if r was
+     * non-zero, or 0xffff if r was zero;
+     * Save in m.
+     */v = ((uint16_t) (uint8_t) r) + 255;
+    m = v / 256 - 1;
+
+    /*
+     * Get the values from *c1 and *c2 as uint8_t (each will
+     * be in the range 0 to 255, or 0x00 to 0xff);
+     * Convert them to signed int values (still in the
+     * range 0 to 255);
+     * Subtract them using signed arithmetic, yielding a
+     * result in the range -255 to +255;
+     * Convert to uint16_t, yielding a result in the range
+     * 0xff01 to 0xffff (for what was previously -255 to
+     * -1), or 0, or in the range 0x0001 to 0x00ff (for what
+     * was previously +1 to +255).
+     */d = (uint16_t) ((int) *c1 - (int) *c2);
+
+    /*
+     * If the low 8 bits of r were previously 0, then m
+     * is now 0xffff, so (d & m) is the same as d, so we
+     * effectively copy d to r;
+     * Otherwise, if r was previously non-zero, then m is
+     * now 0, so (d & m) is zero, so leave r unchanged.
+     * Note that the low 8 bits of d will be zero if and
+     * only if d == 0, which happens when *c1 == *c2.
+     * The low 8 bits of r are thus zero if and only if the
+     * entirety of r is zero, which happens if and only if
+     * all bytes compared so far were equal.  As soon as a
+     * non-zero value is stored in r, it remains unchanged
+     * for the remainder of the loop.
+     */r |= (d & m);
+
+    /*
+     * Increment pointers, decrement length, and loop.
+     */
+    ++c1;
+    ++c2;
+    --len;
+  }
+
+  /*
+   * At this point, r is an unsigned value, which will be 0 if the
+   * final result should be zero, or in the range 0x0001 to 0x00ff
+   * (1 to 255) if the final result should be positive, or in the
+   * range 0xff01 to 0xffff (65281 to 65535) if the final result
+   * should be negative.
+   *
+   * We want to convert the unsigned values in the range 0xff01
+   * to 0xffff to signed values in the range -255 to -1, while
+   * converting the other unsigned values to equivalent signed
+   * values (0, or +1 to +255).
+   *
+   * On a machine with two's complement arithmetic, simply copying
+   * the underlying bits (with sign extension if int is wider than
+   * 16 bits) would do the job, so something like this might work:
+   *
+   *     return (int16_t)r;
+   *
+   * However, that invokes implementation-defined behaviour,
+   * because values larger than 32767 can't fit in a signed 16-bit
+   * integer without overflow.
+   *
+   * To avoid any implementation-defined behaviour, we go through
+   * these contortions:
+   *
+   * a. Calculate ((uint32_t)r + 0x8000).  The cast to uint32_t
+   *    it to prevent problems on platforms where int is narrower
+   *    than 32 bits.  If int is a larger than 32-bits, then the
+   *    usual arithmetic conversions cause this addition to be
+   *    done in unsigned int arithmetic.  If int is 32 bits
+   *    or narrower, then this addition is done in uint32_t
+   *    arithmetic.  In either case, no overflow or wraparound
+   *    occurs, and the result from this step has a value that
+   *    will be one of 0x00008000 (32768), or in the range
+   *    0x00008001 to 0x000080ff (32769 to 33023), or in the range
+   *    0x00017f01 to 0x00017fff (98049 to 98303).
+   *
+   * b. Cast the result from (a) to uint16_t.  This effectively
+   *    discards the high bits of the result, in a way that is
+   *    well defined by the C language.  The result from this step
+   *    will be of type uint16_t, and its value will be one of
+   *    0x8000 (32768), or in the range 0x8001 to 0x80ff (32769 to
+   *    33023), or in the range 0x7f01 to 0x7fff (32513 to
+   *    32767).
+   *
+   * c. Cast the result from (b) to int32_t.  We use int32_t
+   *    instead of int because we need a type that's strictly
+   *    larger than 16 bits, and the C standard allows
+   *    implementations where int is only 16 bits.  The result
+   *    from this step will be of type int32_t, and its value will
+   *    be one of 0x00008000 (32768), or in the range 0x00008001
+   *    to 0x000080ff (32769 to 33023), or in the range 0x00007f01
+   *    to 0x00007fff (32513 to 32767).
+   *
+   * d. Take the result from (c) and subtract 0x8000 (32768) using
+   *    signed int32_t arithmetic.  The result from this step will
+   *    be of type int32_t and the value will be one of
+   *    0x00000000 (0), or in the range 0x00000001 to 0x000000ff
+   *    (+1 to +255), or in the range 0xffffff01 to 0xffffffff
+   *    (-255 to -1).
+   *
+   * e. Cast the result from (d) to int.  This does nothing
+   *    interesting, except to make explicit what would have been
+   *    implicit in the return statement.  The final result is an
+   *    int in the range -255 to +255.
+   *
+   * Unfortunately, compilers don't seem to be good at figuring
+   * out that most of this can be optimised away by careful choice
+   * of register width and sign extension.
+   *
+   */return (/*e*/ int) (/*d*/
+    (/*c*/ int32_t) (/*b*/ uint16_t) (/*a*/ (uint32_t) r + 0x8000)
+    - 0x8000);
+}
diff --git a/src/lib/util/container_bloomfilter.c b/src/lib/util/container_bloomfilter.c
new file mode 100644
index 000000000..7e4faaf3f
--- /dev/null
+++ b/src/lib/util/container_bloomfilter.c
@@ -0,0 +1,806 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2006, 2008, 2011, 2012, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_bloomfilter.c
+ * @brief data structure used to reduce disk accesses.
+ *
+ * The idea basically: Create a signature for each element in the
+ * database. Add those signatures to a bit array. When doing a lookup,
+ * check if the bit array matches the signature of the requested
+ * element. If yes, address the disk, otherwise return 'not found'.
+ *
+ * A property of the bloom filter is that sometimes we will have
+ * a match even if the element is not on the disk (then we do
+ * an unnecessary disk access), but what's most important is that
+ * we never get a single "false negative".
+ *
+ * To be able to delete entries from the bloom filter, we maintain
+ * a 4 bit counter in the file on the drive (we still use only one
+ * bit in memory).
+ *
+ * @author Igor Wronsky
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-bloomfilter", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-container-bloomfilter", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename)             \
+  GNUNET_log_from_strerror_file (kind,                         \
+                                 "util-container-bloomfilter", \
+                                 syscall,                      \
+                                 filename)
+
+struct GNUNET_CONTAINER_BloomFilter
+{
+  /**
+   * The actual bloomfilter bit array
+   */
+  char *bitArray;
+
+  /**
+   * Filename of the filter
+   */
+  char *filename;
+
+  /**
+   * The bit counter file on disk
+   */
+  struct GNUNET_DISK_FileHandle *fh;
+
+  /**
+   * How many bits we set for each stored element
+   */
+  unsigned int addressesPerElement;
+
+  /**
+   * Size of bitArray in bytes
+   */
+  size_t bitArraySize;
+};
+
+
+size_t
+GNUNET_CONTAINER_bloomfilter_get_element_addresses (
+  const struct GNUNET_CONTAINER_BloomFilter *bf)
+{
+  if (bf == NULL)
+    return 0;
+  return bf->addressesPerElement;
+}
+
+
+size_t
+GNUNET_CONTAINER_bloomfilter_get_size (
+  const struct GNUNET_CONTAINER_BloomFilter *bf)
+{
+  if (bf == NULL)
+    return 0;
+  return bf->bitArraySize;
+}
+
+
+struct GNUNET_CONTAINER_BloomFilter *
+GNUNET_CONTAINER_bloomfilter_copy (
+  const struct GNUNET_CONTAINER_BloomFilter *bf)
+{
+  return GNUNET_CONTAINER_bloomfilter_init (bf->bitArray,
+                                            bf->bitArraySize,
+                                            bf->addressesPerElement);
+}
+
+
+/**
+ * Sets a bit active in the bitArray. Increment bit-specific
+ * usage counter on disk only if below 4bit max (==15).
+ *
+ * @param bitArray memory area to set the bit in
+ * @param bitIdx which bit to set
+ */
+static void
+setBit (char *bitArray,
+        unsigned int bitIdx)
+{
+  size_t arraySlot;
+  unsigned int targetBit;
+
+  arraySlot = bitIdx / 8;
+  targetBit = (1L << (bitIdx % 8));
+  bitArray[arraySlot] |= targetBit;
+}
+
+
+/**
+ * Clears a bit from bitArray. Bit is cleared from the array
+ * only if the respective usage counter on the disk hits/is zero.
+ *
+ * @param bitArray memory area to set the bit in
+ * @param bitIdx which bit to unset
+ */
+static void
+clearBit (char *bitArray, unsigned int bitIdx)
+{
+  size_t slot;
+  unsigned int targetBit;
+
+  slot = bitIdx / 8;
+  targetBit = (1L << (bitIdx % 8));
+  bitArray[slot] = bitArray[slot] & (~targetBit);
+}
+
+
+/**
+ * Checks if a bit is active in the bitArray
+ *
+ * @param bitArray memory area to set the bit in
+ * @param bitIdx which bit to test
+ * @return true if the bit is set, false if not.
+ */
+static bool
+testBit (char *bitArray,
+         unsigned int bitIdx)
+{
+  size_t slot;
+  unsigned int targetBit;
+
+  slot = bitIdx / 8;
+  targetBit = (1L << (bitIdx % 8));
+  if (bitArray[slot] & targetBit)
+    return true;
+  return false;
+}
+
+
+/**
+ * Sets a bit active in the bitArray and increments
+ * bit-specific usage counter on disk (but only if
+ * the counter was below 4 bit max (==15)).
+ *
+ * @param bitArray memory area to set the bit in
+ * @param bitIdx which bit to test
+ * @param fh A file to keep the 4 bit address usage counters in
+ */
+static void
+incrementBit (char *bitArray,
+              unsigned int bitIdx,
+              const struct GNUNET_DISK_FileHandle *fh)
+{
+  off_t fileSlot;
+  unsigned char value;
+  unsigned int high;
+  unsigned int low;
+  unsigned int targetLoc;
+
+  setBit (bitArray,
+          bitIdx);
+  if (GNUNET_DISK_handle_invalid (fh))
+    return;
+  /* Update the counter file on disk */
+  fileSlot = bitIdx / 2;
+  targetLoc = bitIdx % 2;
+
+  GNUNET_assert (fileSlot ==
+                 GNUNET_DISK_file_seek (fh, fileSlot, GNUNET_DISK_SEEK_SET));
+  if (1 != GNUNET_DISK_file_read (fh, &value, 1))
+    value = 0;
+  low = value & 0xF;
+  high = (value & (~0xF)) >> 4;
+
+  if (targetLoc == 0)
+  {
+    if (low < 0xF)
+      low++;
+  }
+  else
+  {
+    if (high < 0xF)
+      high++;
+  }
+  value = ((high << 4) | low);
+  GNUNET_assert (fileSlot ==
+                 GNUNET_DISK_file_seek (fh, fileSlot, GNUNET_DISK_SEEK_SET));
+  GNUNET_assert (1 == GNUNET_DISK_file_write (fh, &value, 1));
+}
+
+
+/**
+ * Clears a bit from bitArray if the respective usage
+ * counter on the disk hits/is zero.
+ *
+ * @param bitArray memory area to set the bit in
+ * @param bitIdx which bit to test
+ * @param fh A file to keep the 4bit address usage counters in
+ */
+static void
+decrementBit (char *bitArray,
+              unsigned int bitIdx,
+              const struct GNUNET_DISK_FileHandle *fh)
+{
+  off_t fileslot;
+  unsigned char value;
+  unsigned int high;
+  unsigned int low;
+  unsigned int targetLoc;
+
+  if (GNUNET_DISK_handle_invalid (fh))
+    return; /* cannot decrement! */
+  /* Each char slot in the counter file holds two 4 bit counters */
+  fileslot = bitIdx / 2;
+  targetLoc = bitIdx % 2;
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_file_seek (fh, fileslot, GNUNET_DISK_SEEK_SET))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "seek");
+    return;
+  }
+  if (1 != GNUNET_DISK_file_read (fh, &value, 1))
+    value = 0;
+  low = value & 0xF;
+  high = (value & 0xF0) >> 4;
+
+  /* decrement, but once we have reached the max, never go back! */
+  if (targetLoc == 0)
+  {
+    if ((low > 0) && (low < 0xF))
+      low--;
+    if (low == 0)
+    {
+      clearBit (bitArray, bitIdx);
+    }
+  }
+  else
+  {
+    if ((high > 0) && (high < 0xF))
+      high--;
+    if (high == 0)
+    {
+      clearBit (bitArray, bitIdx);
+    }
+  }
+  value = ((high << 4) | low);
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_file_seek (fh, fileslot, GNUNET_DISK_SEEK_SET))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "seek");
+    return;
+  }
+  GNUNET_assert (1 == GNUNET_DISK_file_write (fh, &value, 1));
+}
+
+
+#define BUFFSIZE 65536
+
+/**
+ * Creates a file filled with zeroes
+ *
+ * @param fh the file handle
+ * @param size the size of the file
+ * @return #GNUNET_OK if created ok, #GNUNET_SYSERR otherwise
+ */
+static enum GNUNET_GenericReturnValue
+make_empty_file (const struct GNUNET_DISK_FileHandle *fh,
+                 size_t size)
+{
+  char buffer[BUFFSIZE];
+  size_t bytesleft = size;
+  int res = 0;
+
+  if (GNUNET_DISK_handle_invalid (fh))
+    return GNUNET_SYSERR;
+  memset (buffer, 0, sizeof(buffer));
+  GNUNET_DISK_file_seek (fh, 0, GNUNET_DISK_SEEK_SET);
+  while (bytesleft > 0)
+  {
+    if (bytesleft > sizeof(buffer))
+    {
+      res = GNUNET_DISK_file_write (fh, buffer, sizeof(buffer));
+      if (res >= 0)
+        bytesleft -= res;
+    }
+    else
+    {
+      res = GNUNET_DISK_file_write (fh, buffer, bytesleft);
+      if (res >= 0)
+        bytesleft -= res;
+    }
+    if (GNUNET_SYSERR == res)
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/* ************** GNUNET_CONTAINER_BloomFilter iterator ********* */
+
+/**
+ * Iterator (callback) method to be called by the
+ * bloomfilter iterator on each bit that is to be
+ * set or tested for the key.
+ *
+ * @param cls closure
+ * @param bf the filter to manipulate
+ * @param bit the current bit
+ * @return #GNUNET_YES to continue, #GNUNET_NO to stop early
+ */
+typedef enum GNUNET_GenericReturnValue
+(*BitIterator)(void *cls,
+               const struct GNUNET_CONTAINER_BloomFilter *bf,
+               unsigned int bit);
+
+
+/**
+ * Call an iterator for each bit that the bloomfilter
+ * must test or set for this element.
+ *
+ * @param bf the filter
+ * @param callback the method to call
+ * @param arg extra argument to callback
+ * @param key the key for which we iterate over the BF bits
+ */
+static void
+iterateBits (const struct GNUNET_CONTAINER_BloomFilter *bf,
+             BitIterator callback,
+             void *arg,
+             const struct GNUNET_HashCode *key)
+{
+  struct GNUNET_HashCode tmp = *key;
+  int bitCount;
+  unsigned int slot = 0;
+
+  bitCount = bf->addressesPerElement;
+  GNUNET_assert (bf->bitArraySize > 0);
+  GNUNET_assert (bf->bitArraySize * 8LL > bf->bitArraySize);
+  while (bitCount > 0)
+  {
+    while ( (0 != bitCount) &&
+            (slot < (sizeof(struct GNUNET_HashCode) / sizeof(uint32_t))) )
+    {
+      if (GNUNET_YES !=
+          callback (arg,
+                    bf,
+                    ntohl ((((uint32_t *) &tmp)[slot]))
+                    % ((bf->bitArraySize * 8LL))))
+        return;
+      slot++;
+      bitCount--;
+    }
+    if (0 == bitCount)
+      break;
+    GNUNET_CRYPTO_hash (&tmp,
+                        sizeof(tmp),
+                        &tmp);
+    slot = 0;
+  }
+}
+
+
+/**
+ * Callback: increment bit
+ *
+ * @param cls pointer to writeable form of bf
+ * @param bf the filter to manipulate
+ * @param bit the bit to increment
+ * @return #GNUNET_YES
+ */
+static enum GNUNET_GenericReturnValue
+incrementBitCallback (void *cls,
+                      const struct GNUNET_CONTAINER_BloomFilter *bf,
+                      unsigned int bit)
+{
+  struct GNUNET_CONTAINER_BloomFilter *b = cls;
+
+  incrementBit (b->bitArray,
+                bit,
+                bf->fh);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Callback: decrement bit
+ *
+ * @param cls pointer to writeable form of bf
+ * @param bf the filter to manipulate
+ * @param bit the bit to decrement
+ * @return #GNUNET_YES
+ */
+static enum GNUNET_GenericReturnValue
+decrementBitCallback (void *cls,
+                      const struct GNUNET_CONTAINER_BloomFilter *bf,
+                      unsigned int bit)
+{
+  struct GNUNET_CONTAINER_BloomFilter *b = cls;
+
+  decrementBit (b->bitArray,
+                bit,
+                bf->fh);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Callback: test if all bits are set
+ *
+ * @param cls pointer set to false if bit is not set
+ * @param bf the filter
+ * @param bit the bit to test
+ * @return #GNUNET_YES if the bit is set, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+testBitCallback (void *cls,
+                 const struct GNUNET_CONTAINER_BloomFilter *bf,
+                 unsigned int bit)
+{
+  bool *arg = cls;
+
+  if (! testBit (bf->bitArray, bit))
+  {
+    *arg = false;
+    return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+
+/* *********************** INTERFACE **************** */
+
+struct GNUNET_CONTAINER_BloomFilter *
+GNUNET_CONTAINER_bloomfilter_load (const char *filename,
+                                   size_t size,
+                                   unsigned int k)
+{
+  struct GNUNET_CONTAINER_BloomFilter *bf;
+  char *rbuff;
+  off_t pos;
+  int i;
+  size_t ui;
+  off_t fsize;
+  int must_read;
+
+  GNUNET_assert (NULL != filename);
+  if ((k == 0) || (size == 0))
+    return NULL;
+  if (size < BUFFSIZE)
+    size = BUFFSIZE;
+  ui = 1;
+  while ((ui < size) && (ui * 2 > ui))
+    ui *= 2;
+  size = ui; /* make sure it's a power of 2 */
+
+  bf = GNUNET_new (struct GNUNET_CONTAINER_BloomFilter);
+  /* Try to open a bloomfilter file */
+  if (GNUNET_YES == GNUNET_DISK_file_test (filename))
+    bf->fh = GNUNET_DISK_file_open (filename,
+                                    GNUNET_DISK_OPEN_READWRITE,
+                                    GNUNET_DISK_PERM_USER_READ
+                                    | GNUNET_DISK_PERM_USER_WRITE);
+  if (NULL != bf->fh)
+  {
+    /* file existed, try to read it! */
+    must_read = GNUNET_YES;
+    if (GNUNET_OK !=
+        GNUNET_DISK_file_handle_size (bf->fh,
+                                      &fsize))
+    {
+      GNUNET_DISK_file_close (bf->fh);
+      GNUNET_free (bf);
+      return NULL;
+    }
+    if (0 == fsize)
+    {
+      /* found existing empty file, just overwrite */
+      if (GNUNET_OK !=
+          make_empty_file (bf->fh,
+                           size * 4LL))
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                             "write");
+        GNUNET_DISK_file_close (bf->fh);
+        GNUNET_free (bf);
+        return NULL;
+      }
+    }
+    else if (fsize != ((off_t) size) * 4LL)
+    {
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_ERROR,
+        _ (
+          "Size of file on disk is incorrect for this Bloom filter (want %llu, have %llu)\n"),
+        (unsigned long long) (size * 4LL),
+        (unsigned long long) fsize);
+      GNUNET_DISK_file_close (bf->fh);
+      GNUNET_free (bf);
+      return NULL;
+    }
+  }
+  else
+  {
+    /* file did not exist, don't read, just create */
+    must_read = GNUNET_NO;
+    bf->fh = GNUNET_DISK_file_open (filename,
+                                    GNUNET_DISK_OPEN_CREATE
+                                    | GNUNET_DISK_OPEN_READWRITE,
+                                    GNUNET_DISK_PERM_USER_READ
+                                    | GNUNET_DISK_PERM_USER_WRITE);
+    if (NULL == bf->fh)
+    {
+      GNUNET_free (bf);
+      return NULL;
+    }
+    if (GNUNET_OK != make_empty_file (bf->fh, size * 4LL))
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "write");
+      GNUNET_DISK_file_close (bf->fh);
+      GNUNET_free (bf);
+      return NULL;
+    }
+  }
+  bf->filename = GNUNET_strdup (filename);
+  /* Alloc block */
+  bf->bitArray = GNUNET_malloc_large (size);
+  if (NULL == bf->bitArray)
+  {
+    if (NULL != bf->fh)
+      GNUNET_DISK_file_close (bf->fh);
+    GNUNET_free (bf->filename);
+    GNUNET_free (bf);
+    return NULL;
+  }
+  bf->bitArraySize = size;
+  bf->addressesPerElement = k;
+  if (GNUNET_YES != must_read)
+    return bf; /* already done! */
+  /* Read from the file what bits we can */
+  rbuff = GNUNET_malloc (BUFFSIZE);
+  pos = 0;
+  while (pos < ((off_t) size) * 8LL)
+  {
+    int res;
+
+    res = GNUNET_DISK_file_read (bf->fh, rbuff, BUFFSIZE);
+    if (res == -1)
+    {
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "read", bf->filename);
+      GNUNET_free (rbuff);
+      GNUNET_free (bf->filename);
+      GNUNET_DISK_file_close (bf->fh);
+      GNUNET_free (bf);
+      return NULL;
+    }
+    if (res == 0)
+      break;   /* is ok! we just did not use that many bits yet */
+    for (i = 0; i < res; i++)
+    {
+      if ((rbuff[i] & 0x0F) != 0)
+        setBit (bf->bitArray, pos + i * 2);
+      if ((rbuff[i] & 0xF0) != 0)
+        setBit (bf->bitArray, pos + i * 2 + 1);
+    }
+    if (res < BUFFSIZE)
+      break;
+    pos += BUFFSIZE * 2;   /* 2 bits per byte in the buffer */
+  }
+  GNUNET_free (rbuff);
+  return bf;
+}
+
+
+struct GNUNET_CONTAINER_BloomFilter *
+GNUNET_CONTAINER_bloomfilter_init (const char *data,
+                                   size_t size,
+                                   unsigned int k)
+{
+  struct GNUNET_CONTAINER_BloomFilter *bf;
+
+  if ((0 == k) || (0 == size))
+    return NULL;
+  bf = GNUNET_new (struct GNUNET_CONTAINER_BloomFilter);
+  bf->filename = NULL;
+  bf->fh = NULL;
+  bf->bitArray = GNUNET_malloc_large (size);
+  if (NULL == bf->bitArray)
+  {
+    GNUNET_free (bf);
+    return NULL;
+  }
+  bf->bitArraySize = size;
+  bf->addressesPerElement = k;
+  if (NULL != data)
+    GNUNET_memcpy (bf->bitArray, data, size);
+  return bf;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_bloomfilter_get_raw_data (
+  const struct GNUNET_CONTAINER_BloomFilter *bf,
+  char *data,
+  size_t size)
+{
+  if (NULL == bf)
+    return GNUNET_SYSERR;
+  if (bf->bitArraySize != size)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (data, bf->bitArray, size);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CONTAINER_bloomfilter_free (struct GNUNET_CONTAINER_BloomFilter *bf)
+{
+  if (NULL == bf)
+    return;
+  if (bf->fh != NULL)
+    GNUNET_DISK_file_close (bf->fh);
+  GNUNET_free (bf->filename);
+  GNUNET_free (bf->bitArray);
+  GNUNET_free (bf);
+}
+
+
+void
+GNUNET_CONTAINER_bloomfilter_clear (struct GNUNET_CONTAINER_BloomFilter *bf)
+{
+  if (NULL == bf)
+    return;
+
+  memset (bf->bitArray, 0, bf->bitArraySize);
+  if (bf->filename != NULL)
+    make_empty_file (bf->fh, bf->bitArraySize * 4LL);
+}
+
+
+bool
+GNUNET_CONTAINER_bloomfilter_test (
+  const struct GNUNET_CONTAINER_BloomFilter *bf,
+  const struct GNUNET_HashCode *e)
+{
+  bool res;
+
+  if (NULL == bf)
+    return true;
+  res = true;
+  iterateBits (bf,
+               &testBitCallback,
+               &res,
+               e);
+  return res;
+}
+
+
+void
+GNUNET_CONTAINER_bloomfilter_add (struct GNUNET_CONTAINER_BloomFilter *bf,
+                                  const struct GNUNET_HashCode *e)
+{
+  if (NULL == bf)
+    return;
+  iterateBits (bf,
+               &incrementBitCallback,
+               bf,
+               e);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_bloomfilter_or (struct GNUNET_CONTAINER_BloomFilter *bf,
+                                 const char *data,
+                                 size_t size)
+{
+  unsigned int i;
+  unsigned int n;
+  unsigned long long *fc;
+  const unsigned long long *dc;
+
+  if (NULL == bf)
+    return GNUNET_YES;
+  if (bf->bitArraySize != size)
+    return GNUNET_SYSERR;
+  fc = (unsigned long long *) bf->bitArray;
+  dc = (const unsigned long long *) data;
+  n = size / sizeof(unsigned long long);
+
+  for (i = 0; i < n; i++)
+    fc[i] |= dc[i];
+  for (i = n * sizeof(unsigned long long); i < size; i++)
+    bf->bitArray[i] |= data[i];
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_bloomfilter_or2 (
+  struct GNUNET_CONTAINER_BloomFilter *bf,
+  const struct GNUNET_CONTAINER_BloomFilter *to_or)
+{
+  unsigned int i;
+  unsigned int n;
+  unsigned long long *fc;
+  const unsigned long long *dc;
+  size_t size;
+
+  if (NULL == bf)
+    return GNUNET_OK;
+  if (bf->bitArraySize != to_or->bitArraySize)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  size = bf->bitArraySize;
+  fc = (unsigned long long *) bf->bitArray;
+  dc = (const unsigned long long *) to_or->bitArray;
+  n = size / sizeof(unsigned long long);
+
+  for (i = 0; i < n; i++)
+    fc[i] |= dc[i];
+  for (i = n * sizeof(unsigned long long); i < size; i++)
+    bf->bitArray[i] |= to_or->bitArray[i];
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CONTAINER_bloomfilter_remove (struct GNUNET_CONTAINER_BloomFilter *bf,
+                                     const struct GNUNET_HashCode *e)
+{
+  if (NULL == bf)
+    return;
+  if (NULL == bf->filename)
+    return;
+  iterateBits (bf,
+               &decrementBitCallback,
+               bf,
+               e);
+}
+
+
+void
+GNUNET_CONTAINER_bloomfilter_resize (struct GNUNET_CONTAINER_BloomFilter *bf,
+                                     GNUNET_CONTAINER_HashCodeIterator iterator,
+                                     void *iterator_cls,
+                                     size_t size,
+                                     unsigned int k)
+{
+  struct GNUNET_HashCode hc;
+  unsigned int i;
+
+  GNUNET_free (bf->bitArray);
+  i = 1;
+  while (i < size)
+    i *= 2;
+  size = i; /* make sure it's a power of 2 */
+  bf->addressesPerElement = k;
+  bf->bitArraySize = size;
+  bf->bitArray = GNUNET_malloc (size);
+  if (NULL != bf->filename)
+    make_empty_file (bf->fh, bf->bitArraySize * 4LL);
+  while (GNUNET_YES == iterator (iterator_cls, &hc))
+    GNUNET_CONTAINER_bloomfilter_add (bf, &hc);
+}
+
+
+/* end of container_bloomfilter.c */
diff --git a/src/lib/util/container_heap.c b/src/lib/util/container_heap.c
new file mode 100644
index 000000000..232e66bf9
--- /dev/null
+++ b/src/lib/util/container_heap.c
@@ -0,0 +1,501 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2008, 2009 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/container_heap.c
+ * @brief Implementation of a heap
+ * @author Nathan Evans
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-container-heap", \
+                                        __VA_ARGS__)
+
+#define EXTRA_CHECKS 0
+
+/**
+ * Node in the heap.
+ */
+struct GNUNET_CONTAINER_HeapNode
+{
+  /**
+   * Heap this node belongs to.
+   */
+  struct GNUNET_CONTAINER_Heap *heap;
+
+  /**
+   * Parent node.
+   */
+  struct GNUNET_CONTAINER_HeapNode *parent;
+
+  /**
+   * Left child.
+   */
+  struct GNUNET_CONTAINER_HeapNode *left_child;
+
+  /**
+   * Right child.
+   */
+  struct GNUNET_CONTAINER_HeapNode *right_child;
+
+  /**
+   * Our element.
+   */
+  void *element;
+
+  /**
+   * Cost for this element.
+   */
+  GNUNET_CONTAINER_HeapCostType cost;
+
+  /**
+   * Number of elements below this node in the heap
+   * (excluding this node itself).
+   */
+  unsigned int tree_size;
+};
+
+/**
+ * Handle to a node in a heap.
+ */
+struct GNUNET_CONTAINER_Heap
+{
+  /**
+   * Root of the heap.
+   */
+  struct GNUNET_CONTAINER_HeapNode *root;
+
+  /**
+   * Current position of our random walk.
+   */
+  struct GNUNET_CONTAINER_HeapNode *walk_pos;
+
+  /**
+   * Number of elements in the heap.
+   */
+  unsigned int size;
+
+  /**
+   * How is the heap sorted?
+   */
+  enum GNUNET_CONTAINER_HeapOrder order;
+};
+
+
+#if EXTRA_CHECKS
+/**
+ * Check if internal invariants hold for the given node.
+ *
+ * @param node subtree to check
+ */
+static void
+check (const struct GNUNET_CONTAINER_HeapNode *node)
+{
+  if (NULL == node)
+    return;
+  GNUNET_assert (node->tree_size ==
+                 ((node->left_child ==
+                   NULL) ? 0 : 1 + node->left_child->tree_size)
+                 + ((node->right_child ==
+                     NULL) ? 0 : 1 + node->right_child->tree_size));
+  check (node->left_child);
+  check (node->right_child);
+}
+
+
+#define CHECK(n) check (n)
+#else
+#define CHECK(n) do {} while (0)
+#endif
+
+
+struct GNUNET_CONTAINER_Heap *
+GNUNET_CONTAINER_heap_create (enum GNUNET_CONTAINER_HeapOrder order)
+{
+  struct GNUNET_CONTAINER_Heap *heap;
+
+  heap = GNUNET_new (struct GNUNET_CONTAINER_Heap);
+  heap->order = order;
+  return heap;
+}
+
+
+void
+GNUNET_CONTAINER_heap_destroy (struct GNUNET_CONTAINER_Heap *heap)
+{
+  GNUNET_break (heap->size == 0);
+  GNUNET_free (heap);
+}
+
+
+void *
+GNUNET_CONTAINER_heap_peek (const struct GNUNET_CONTAINER_Heap *heap)
+{
+  if (heap->root == NULL)
+    return NULL;
+  return heap->root->element;
+}
+
+
+/**
+ * Get @a element and @a cost stored at the root of @a heap.
+ *
+ * @param[in]  heap     Heap to inspect.
+ * @param[out] element  Root element is returned here.
+ * @param[out] cost     Cost of @a element is returned here.
+ * @return #GNUNET_YES if an element is returned,
+ *         #GNUNET_NO  if the heap is empty.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_heap_peek2 (const struct GNUNET_CONTAINER_Heap *heap,
+                             void **element,
+                             GNUNET_CONTAINER_HeapCostType *cost)
+{
+  if (NULL == heap->root)
+    return GNUNET_NO;
+  if (NULL != element)
+    *element = heap->root->element;
+  if (NULL != cost)
+    *cost = heap->root->cost;
+  return GNUNET_YES;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_heap_get_size (const struct GNUNET_CONTAINER_Heap *heap)
+{
+  return heap->size;
+}
+
+
+GNUNET_CONTAINER_HeapCostType
+GNUNET_CONTAINER_heap_node_get_cost (const struct GNUNET_CONTAINER_HeapNode
+                                     *node)
+{
+  return node->cost;
+}
+
+
+/**
+ * Iterate over the children of the given node.
+ *
+ * @param heap argument to give to iterator
+ * @param node node to iterate over
+ * @param iterator function to call on each node
+ * @param iterator_cls closure for iterator
+ * @return GNUNET_YES to continue to iterate
+ */
+static int
+node_iterator (const struct GNUNET_CONTAINER_Heap *heap,
+               struct GNUNET_CONTAINER_HeapNode *node,
+               GNUNET_CONTAINER_HeapIterator iterator, void *iterator_cls)
+{
+  if (node == NULL)
+    return GNUNET_YES;
+  if (GNUNET_YES !=
+      node_iterator (heap, node->left_child, iterator, iterator_cls))
+    return GNUNET_NO;
+  if (GNUNET_YES !=
+      node_iterator (heap, node->right_child, iterator, iterator_cls))
+    return GNUNET_NO;
+  return iterator (iterator_cls, node, node->element, node->cost);
+}
+
+
+void
+GNUNET_CONTAINER_heap_iterate (const struct GNUNET_CONTAINER_Heap *heap,
+                               GNUNET_CONTAINER_HeapIterator iterator,
+                               void *iterator_cls)
+{
+  (void) node_iterator (heap, heap->root, iterator, iterator_cls);
+}
+
+
+void *
+GNUNET_CONTAINER_heap_walk_get_next (struct GNUNET_CONTAINER_Heap *heap)
+{
+  struct GNUNET_CONTAINER_HeapNode *pos;
+  void *element;
+
+  if (heap->root == NULL)
+    return NULL;
+  pos = heap->walk_pos;
+  if (pos == NULL)
+    pos = heap->root;
+  element = pos->element;
+  heap->walk_pos =
+    (0 ==
+     GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                               2)) ? pos->right_child : pos->left_child;
+  return element;
+}
+
+
+/**
+ * Insert the given node 'node' into the subtree starting
+ * at 'pos' (while keeping the tree somewhat balanced).
+ *
+ * @param heap heap to modify
+ * @param pos existing tree
+ * @param node node to insert (which may be a subtree itself)
+ */
+static void
+insert_node (struct GNUNET_CONTAINER_Heap *heap,
+             struct GNUNET_CONTAINER_HeapNode *pos,
+             struct GNUNET_CONTAINER_HeapNode *node)
+{
+  struct GNUNET_CONTAINER_HeapNode *parent;
+
+  GNUNET_assert (node->parent == NULL);
+  while ((heap->order == GNUNET_CONTAINER_HEAP_ORDER_MAX) ? (pos->cost >=
+                                                             node->cost)
+         : (pos->cost <= node->cost))
+  {
+    /* node is descendent of pos */
+    pos->tree_size += (1 + node->tree_size);
+    if (pos->left_child == NULL)
+    {
+      pos->left_child = node;
+      node->parent = pos;
+      return;
+    }
+    if (pos->right_child == NULL)
+    {
+      pos->right_child = node;
+      node->parent = pos;
+      return;
+    }
+    /* keep it balanced by descending into smaller subtree */
+    if (pos->left_child->tree_size < pos->right_child->tree_size)
+      pos = pos->left_child;
+    else
+      pos = pos->right_child;
+  }
+  /* make 'node' parent of 'pos' */
+  parent = pos->parent;
+  pos->parent = NULL;
+  node->parent = parent;
+  if (NULL == parent)
+  {
+    heap->root = node;
+  }
+  else
+  {
+    if (parent->left_child == pos)
+      parent->left_child = node;
+    else
+      parent->right_child = node;
+  }
+  /* insert 'pos' below 'node' */
+  insert_node (heap, node, pos);
+  CHECK (pos);
+}
+
+
+struct GNUNET_CONTAINER_HeapNode *
+GNUNET_CONTAINER_heap_insert (struct GNUNET_CONTAINER_Heap *heap, void *element,
+                              GNUNET_CONTAINER_HeapCostType cost)
+{
+  struct GNUNET_CONTAINER_HeapNode *node;
+
+  node = GNUNET_new (struct GNUNET_CONTAINER_HeapNode);
+  node->heap = heap;
+  node->element = element;
+  node->cost = cost;
+  heap->size++;
+  if (NULL == heap->root)
+    heap->root = node;
+  else
+    insert_node (heap, heap->root, node);
+  GNUNET_assert (heap->size == heap->root->tree_size + 1);
+  CHECK (heap->root);
+  return node;
+}
+
+
+/**
+ * Remove root of the heap.
+ *
+ * @param heap heap to modify
+ * @return element data stored at the root node, NULL if heap is empty
+ */
+void *
+GNUNET_CONTAINER_heap_remove_root (struct GNUNET_CONTAINER_Heap *heap)
+{
+  void *ret;
+  struct GNUNET_CONTAINER_HeapNode *root;
+
+  if (NULL == (root = heap->root))
+    return NULL;
+  heap->size--;
+  ret = root->element;
+  if (root->left_child == NULL)
+  {
+    heap->root = root->right_child;
+    if (root->right_child != NULL)
+      root->right_child->parent = NULL;
+  }
+  else if (root->right_child == NULL)
+  {
+    heap->root = root->left_child;
+    root->left_child->parent = NULL;
+  }
+  else
+  {
+    root->left_child->parent = NULL;
+    root->right_child->parent = NULL;
+    heap->root = root->left_child;
+    insert_node (heap, heap->root, root->right_child);
+  }
+  if (heap->walk_pos == root)
+    heap->walk_pos = heap->root;
+  GNUNET_free (root);
+#if EXTRA_CHECKS
+  GNUNET_assert (((heap->size == 0) && (heap->root == NULL)) ||
+                 (heap->size == heap->root->tree_size + 1));
+  CHECK (heap->root);
+#endif
+  return ret;
+}
+
+
+/**
+ * Remove the given node 'node' from the tree and update
+ * the 'tree_size' fields accordingly.  Preserves the
+ * children of 'node' and does NOT change the overall
+ * 'size' field of the tree.
+ */
+static void
+remove_node (struct GNUNET_CONTAINER_HeapNode *node)
+{
+  struct GNUNET_CONTAINER_HeapNode *ancestor;
+  struct GNUNET_CONTAINER_Heap *heap = node->heap;
+
+  /* update 'size' of the ancestors */
+  ancestor = node;
+  while (NULL != (ancestor = ancestor->parent))
+    ancestor->tree_size--;
+
+  /* update 'size' of node itself */
+  if (node->left_child != NULL)
+    node->tree_size -= (1 + node->left_child->tree_size);
+  if (node->right_child != NULL)
+    node->tree_size -= (1 + node->right_child->tree_size);
+
+  /* unlink 'node' itself and insert children in its place */
+  if (node->parent == NULL)
+  {
+    if (node->left_child != NULL)
+    {
+      heap->root = node->left_child;
+      node->left_child->parent = NULL;
+      if (node->right_child != NULL)
+      {
+        node->right_child->parent = NULL;
+        insert_node (heap, heap->root, node->right_child);
+      }
+    }
+    else
+    {
+      heap->root = node->right_child;
+      if (node->right_child != NULL)
+        node->right_child->parent = NULL;
+    }
+  }
+  else
+  {
+    if (node->parent->left_child == node)
+      node->parent->left_child = NULL;
+    else
+      node->parent->right_child = NULL;
+    if (node->left_child != NULL)
+    {
+      node->left_child->parent = NULL;
+      node->parent->tree_size -= (1 + node->left_child->tree_size);
+      insert_node (heap, node->parent, node->left_child);
+    }
+    if (node->right_child != NULL)
+    {
+      node->right_child->parent = NULL;
+      node->parent->tree_size -= (1 + node->right_child->tree_size);
+      insert_node (heap, node->parent, node->right_child);
+    }
+  }
+  node->parent = NULL;
+  node->left_child = NULL;
+  node->right_child = NULL;
+  GNUNET_assert (node->tree_size == 0);
+  CHECK (heap->root);
+}
+
+
+/**
+ * Removes a node from the heap.
+ *
+ * @param node node to remove
+ * @return element data stored at the node
+ */
+void *
+GNUNET_CONTAINER_heap_remove_node (struct GNUNET_CONTAINER_HeapNode *node)
+{
+  void *ret;
+  struct GNUNET_CONTAINER_Heap *heap;
+
+  heap = node->heap;
+  CHECK (heap->root);
+  if (heap->walk_pos == node)
+    (void) GNUNET_CONTAINER_heap_walk_get_next (heap);
+  remove_node (node);
+  heap->size--;
+  ret = node->element;
+  if (heap->walk_pos == node)
+    heap->walk_pos = NULL;
+  GNUNET_free (node);
+#if EXTRA_CHECKS
+  CHECK (heap->root);
+  GNUNET_assert (((heap->size == 0) && (heap->root == NULL)) ||
+                 (heap->size == heap->root->tree_size + 1));
+#endif
+  return ret;
+}
+
+
+void
+GNUNET_CONTAINER_heap_update_cost (struct GNUNET_CONTAINER_HeapNode *node,
+                                   GNUNET_CONTAINER_HeapCostType new_cost)
+{
+  struct GNUNET_CONTAINER_Heap *heap = node->heap;
+
+  remove_node (node);
+  node->cost = new_cost;
+  if (NULL == heap->root)
+    heap->root = node;
+  else
+    insert_node (heap,
+                 heap->root,
+                 node);
+}
+
+
+/* end of heap.c */
diff --git a/src/lib/util/container_multihashmap.c b/src/lib/util/container_multihashmap.c
new file mode 100644
index 000000000..d403cd220
--- /dev/null
+++ b/src/lib/util/container_multihashmap.c
@@ -0,0 +1,974 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_multihashmap.c
+ * @brief hash map where the same key may be present multiple times
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-multihashmap", __VA_ARGS__)
+
+/**
+ * Maximum recursion depth for callbacks of
+ * #GNUNET_CONTAINER_multihashmap_get_multiple() themselves s
+ * again calling #GNUNET_CONTAINER_multihashmap_get_multiple().
+ * Should be totally excessive, but if violated we die.
+ */
+#define NEXT_CACHE_SIZE 16
+
+
+/**
+ * An entry in the hash map with the full key.
+ */
+struct BigMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct BigMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  struct GNUNET_HashCode key;
+};
+
+
+/**
+ * An entry in the hash map with just a pointer to the key.
+ */
+struct SmallMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct SmallMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  const struct GNUNET_HashCode *key;
+};
+
+
+/**
+ * Entry in the map.
+ */
+union MapEntry
+{
+  /**
+   * Variant used if map entries only contain a pointer to the key.
+   */
+  struct SmallMapEntry *sme;
+
+  /**
+   * Variant used if map entries contain the full key.
+   */
+  struct BigMapEntry *bme;
+};
+
+
+/**
+ * Internal representation of the hash map.
+ */
+struct GNUNET_CONTAINER_MultiHashMap
+{
+  /**
+   * All of our buckets.
+   */
+  union MapEntry *map;
+
+  /**
+   * Number of entries in the map.
+   */
+  unsigned int size;
+
+  /**
+   * Length of the "map" array.
+   */
+  unsigned int map_length;
+
+  /**
+   * #GNUNET_NO if the map entries are of type 'struct BigMapEntry',
+   * #GNUNET_YES if the map entries are of type 'struct SmallMapEntry'.
+   */
+  int use_small_entries;
+
+  /**
+   * Counts the destructive modifications (grow, remove)
+   * to the map, so that iterators can check if they are still valid.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map entries indicating iteration positions currently
+   * in use by #GNUNET_CONTAINER_multihashmap_get_multiple().
+   * Only used up to @e next_cache_off.
+   */
+  union MapEntry next_cache[NEXT_CACHE_SIZE];
+
+  /**
+   * Offset of @e next_cache entries in use, must be smaller
+   * than #NEXT_CACHE_SIZE.
+   */
+  unsigned int next_cache_off;
+};
+
+
+/**
+ * Cursor into a multihashmap.
+ * Allows to enumerate elements asynchronously.
+ */
+struct GNUNET_CONTAINER_MultiHashMapIterator
+{
+  /**
+   * Position in the bucket @e idx
+   */
+  union MapEntry me;
+
+  /**
+   * Current bucket index.
+   */
+  unsigned int idx;
+
+  /**
+   * Modification counter as observed on the map when the iterator
+   * was created.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map that we are iterating over.
+   */
+  const struct GNUNET_CONTAINER_MultiHashMap *map;
+};
+
+
+struct GNUNET_CONTAINER_MultiHashMap *
+GNUNET_CONTAINER_multihashmap_create (unsigned int len, int do_not_copy_keys)
+{
+  struct GNUNET_CONTAINER_MultiHashMap *hm;
+
+  GNUNET_assert (len > 0);
+  hm = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap);
+  if (len * sizeof(union MapEntry) > GNUNET_MAX_MALLOC_CHECKED)
+  {
+    size_t s;
+    /* application *explicitly* requested very large map, hopefully
+       it checks the return value... */
+    s = len * sizeof(union MapEntry);
+    if ((s / sizeof(union MapEntry)) != len)
+      return NULL;   /* integer overflow on multiplication */
+    if (NULL == (hm->map = GNUNET_malloc_large (s)))
+    {
+      /* out of memory */
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Out of memory allocating large hash map (%u entries)\n",
+                  len);
+      GNUNET_free (hm);
+      return NULL;
+    }
+  }
+  else
+  {
+    hm->map = GNUNET_new_array (len, union MapEntry);
+  }
+  hm->map_length = len;
+  hm->use_small_entries = do_not_copy_keys;
+  return hm;
+}
+
+
+void
+GNUNET_CONTAINER_multihashmap_destroy (
+  struct GNUNET_CONTAINER_MultiHashMap *map)
+{
+  GNUNET_assert (0 == map->next_cache_off);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    union MapEntry me;
+
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        GNUNET_free (sme);
+      }
+      me.sme = NULL;
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        GNUNET_free (bme);
+      }
+      me.bme = NULL;
+    }
+  }
+  GNUNET_free (map->map);
+  GNUNET_free (map);
+}
+
+
+/**
+ * Compute the index of the bucket for the given key.
+ *
+ * @param map hash map for which to compute the index
+ * @param key what key should the index be computed for
+ * @return offset into the "map" array of "map"
+ */
+static unsigned int
+idx_of (const struct GNUNET_CONTAINER_MultiHashMap *map,
+        const struct GNUNET_HashCode *key)
+{
+  GNUNET_assert (map != NULL);
+  return (*(unsigned int *) key) % map->map_length;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_multihashmap_size (
+  const struct GNUNET_CONTAINER_MultiHashMap *map)
+{
+  return map->size;
+}
+
+
+void *
+GNUNET_CONTAINER_multihashmap_get (
+  const struct GNUNET_CONTAINER_MultiHashMap *map,
+  const struct GNUNET_HashCode *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    for (sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return sme->value;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    for (bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return bme->value;
+  }
+  return NULL;
+}
+
+
+int
+GNUNET_CONTAINER_multihashmap_iterate (
+  struct GNUNET_CONTAINER_MultiHashMap *map,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+  struct GNUNET_HashCode kc;
+
+  GNUNET_assert (NULL != map);
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  count = 0;
+  for (unsigned i = 0; i < map->map_length; i++)
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      ce->sme = me.sme;
+      while (NULL != (sme = ce->sme))
+      {
+        ce->sme = sme->next;
+        if (NULL != it)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      ce->bme = me.bme;
+      while (NULL != (bme = ce->bme))
+      {
+        ce->bme = bme->next;
+        if (NULL != it)
+        {
+          kc = bme->key;
+          if (GNUNET_OK != it (it_cls, &kc, bme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * We are about to free() the @a bme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param bme the entry that is about to be free'd
+ */
+static void
+update_next_cache_bme (struct GNUNET_CONTAINER_MultiHashMap *map,
+                       const struct BigMapEntry *bme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].bme == bme)
+      map->next_cache[i].bme = bme->next;
+}
+
+
+/**
+ * We are about to free() the @a sme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param sme the entry that is about to be free'd
+ */
+static void
+update_next_cache_sme (struct GNUNET_CONTAINER_MultiHashMap *map,
+                       const struct SmallMapEntry *sme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].sme == sme)
+      map->next_cache[i].sme = sme->next;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_remove (struct GNUNET_CONTAINER_MultiHashMap *map,
+                                      const struct GNUNET_HashCode *key,
+                                      const void *value)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  map->modification_counter++;
+
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *p;
+
+    p = NULL;
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (value == sme->value))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = sme;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *p;
+
+    p = NULL;
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (value == bme->value))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = bme;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multihashmap_remove_all (
+  struct GNUNET_CONTAINER_MultiHashMap *map,
+  const struct GNUNET_HashCode *key)
+{
+  union MapEntry me;
+  unsigned int i;
+  int ret;
+
+  map->modification_counter++;
+
+  ret = 0;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+    struct SmallMapEntry *p;
+
+    p = NULL;
+    sme = me.sme;
+    while (NULL != sme)
+    {
+      if (0 == GNUNET_memcmp (key, sme->key))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        if (NULL == p)
+          sme = map->map[i].sme;
+        else
+          sme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = sme;
+        sme = sme->next;
+      }
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+    struct BigMapEntry *p;
+
+    p = NULL;
+    bme = me.bme;
+    while (NULL != bme)
+    {
+      if (0 == GNUNET_memcmp (key, &bme->key))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        if (NULL == p)
+          bme = map->map[i].bme;
+        else
+          bme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = bme;
+        bme = bme->next;
+      }
+    }
+  }
+  return ret;
+}
+
+
+/**
+ * Callback used to remove all entries from the map.
+ *
+ * @param cls the `struct GNUNET_CONTAINER_MultiHashMap`
+ * @param key the key
+ * @param value the value
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+remove_all (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  struct GNUNET_CONTAINER_MultiHashMap *map = cls;
+
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (map, key, value));
+  return GNUNET_OK;
+}
+
+
+/**
+ * @ingroup hashmap
+ * Remove all entries from the map.
+ * Note that the values would not be "freed".
+ *
+ * @param map the map
+ * @return number of values removed
+ */
+unsigned int
+GNUNET_CONTAINER_multihashmap_clear (struct GNUNET_CONTAINER_MultiHashMap *map)
+{
+  unsigned int ret;
+
+  ret = map->size;
+  GNUNET_CONTAINER_multihashmap_iterate (map, &remove_all, map);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_contains (
+  const struct GNUNET_CONTAINER_MultiHashMap *map,
+  const struct GNUNET_HashCode *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    for (sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return GNUNET_YES;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    for (bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_contains_value (
+  const struct GNUNET_CONTAINER_MultiHashMap *map,
+  const struct GNUNET_HashCode *key,
+  const void *value)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    for (sme = me.sme; NULL != sme; sme = sme->next)
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (sme->value == value))
+        return GNUNET_YES;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    for (bme = me.bme; NULL != bme; bme = bme->next)
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (bme->value == value))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Grow the given map to a more appropriate size.
+ *
+ * @param map the hash map to grow
+ */
+static void
+grow (struct GNUNET_CONTAINER_MultiHashMap *map)
+{
+  union MapEntry *old_map;
+  union MapEntry *new_map;
+  unsigned int old_len;
+  unsigned int new_len;
+  unsigned int idx;
+
+  old_map = map->map;
+  old_len = map->map_length;
+  GNUNET_assert (0 != old_len);
+  new_len = old_len * 2;
+  if (0 == new_len) /* 2^31 * 2 == 0 */
+    new_len = old_len; /* never use 0 */
+  if (new_len == old_len)
+    return; /* nothing changed */
+  new_map = GNUNET_malloc_large (new_len * sizeof(union MapEntry));
+  if (NULL == new_map)
+    return; /* grow not possible */
+  map->modification_counter++;
+  map->map_length = new_len;
+  map->map = new_map;
+  for (unsigned int i = 0; i < old_len; i++)
+  {
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      while (NULL != (sme = old_map[i].sme))
+      {
+        old_map[i].sme = sme->next;
+        idx = idx_of (map, sme->key);
+        sme->next = new_map[idx].sme;
+        new_map[idx].sme = sme;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      while (NULL != (bme = old_map[i].bme))
+      {
+        old_map[i].bme = bme->next;
+        idx = idx_of (map, &bme->key);
+        bme->next = new_map[idx].bme;
+        new_map[idx].bme = bme;
+      }
+    }
+  }
+  GNUNET_free (old_map);
+}
+
+
+/**
+ * Store a key-value pair in the map.
+ *
+ * @param map the map
+ * @param key key to use
+ * @param value value to use
+ * @param opt options for put
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if a value was replaced (with REPLACE)
+ *         #GNUNET_SYSERR if UNIQUE_ONLY was the option and the
+ *                       value already exists
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_put (struct GNUNET_CONTAINER_MultiHashMap *map,
+                                   const struct GNUNET_HashCode *key,
+                                   void *value,
+                                   enum GNUNET_CONTAINER_MultiHashMapOption opt)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  i = idx_of (map, key);
+  if ((opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE) &&
+      (opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      for (sme = me.sme; NULL != sme; sme = sme->next)
+        if (0 == GNUNET_memcmp (key, sme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          sme->value = value;
+          return GNUNET_NO;
+        }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      for (bme = me.bme; NULL != bme; bme = bme->next)
+        if (0 == GNUNET_memcmp (key, &bme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          bme->value = value;
+          return GNUNET_NO;
+        }
+    }
+  }
+  if (map->size / 3 >= map->map_length / 4)
+  {
+    grow (map);
+    i = idx_of (map, key);
+  }
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    sme = GNUNET_new (struct SmallMapEntry);
+    sme->key = key;
+    sme->value = value;
+    sme->next = map->map[i].sme;
+    map->map[i].sme = sme;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    bme = GNUNET_new (struct BigMapEntry);
+    bme->key = *key;
+    bme->value = value;
+    bme->next = map->map[i].bme;
+    map->map[i].bme = bme;
+  }
+  map->size++;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_get_multiple (
+  struct GNUNET_CONTAINER_MultiHashMap *map,
+  const struct GNUNET_HashCode *key,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry *me;
+  union MapEntry *ce;
+
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  count = 0;
+  me = &map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    ce->sme = me->sme;
+    while (NULL != (sme = ce->sme))
+    {
+      ce->sme = sme->next;
+      if (0 != GNUNET_memcmp (key, sme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, sme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    ce->bme = me->bme;
+    while (NULL != (bme = ce->bme))
+    {
+      ce->bme = bme->next;
+      if (0 != GNUNET_memcmp (key, &bme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, bme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * @ingroup hashmap
+ * Call @a it on a random value from the map, or not at all
+ * if the map is empty. Note that this function has linear
+ * complexity (in the size of the map).
+ *
+ * @param map the map
+ * @param it function to call on a random entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed, zero or one.
+ */
+unsigned int
+GNUNET_CONTAINER_multihashmap_get_random (
+  const struct GNUNET_CONTAINER_MultiHashMap *map,
+  GNUNET_CONTAINER_MultiHashMapIteratorCallback it,
+  void *it_cls)
+{
+  unsigned int off;
+  unsigned int idx;
+  union MapEntry me;
+
+  if (0 == map->size)
+    return 0;
+  if (NULL == it)
+    return 1;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, map->size);
+  for (idx = 0; idx < map->map_length; idx++)
+  {
+    me = map->map[idx];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, &bme->key, bme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+  }
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CONTAINER_MultiHashMapIterator *
+GNUNET_CONTAINER_multihashmap_iterator_create (
+  const struct GNUNET_CONTAINER_MultiHashMap *map)
+{
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+
+  iter = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMapIterator);
+  iter->map = map;
+  iter->modification_counter = map->modification_counter;
+  iter->me = map->map[0];
+  return iter;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap_iterator_next (
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter,
+  struct GNUNET_HashCode *key,
+  const void **value)
+{
+  /* make sure the map has not been modified */
+  GNUNET_assert (iter->modification_counter == iter->map->modification_counter);
+
+  /* look for the next entry, skipping empty buckets */
+  while (1)
+  {
+    if (iter->idx >= iter->map->map_length)
+      return GNUNET_NO;
+    if (GNUNET_YES == iter->map->use_small_entries)
+    {
+      if (NULL != iter->me.sme)
+      {
+        if (NULL != key)
+          *key = *iter->me.sme->key;
+        if (NULL != value)
+          *value = iter->me.sme->value;
+        iter->me.sme = iter->me.sme->next;
+        return GNUNET_YES;
+      }
+    }
+    else
+    {
+      if (NULL != iter->me.bme)
+      {
+        if (NULL != key)
+          *key = iter->me.bme->key;
+        if (NULL != value)
+          *value = iter->me.bme->value;
+        iter->me.bme = iter->me.bme->next;
+        return GNUNET_YES;
+      }
+    }
+    iter->idx += 1;
+    if (iter->idx < iter->map->map_length)
+      iter->me = iter->map->map[iter->idx];
+  }
+}
+
+
+void
+GNUNET_CONTAINER_multihashmap_iterator_destroy (
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter)
+{
+  GNUNET_free (iter);
+}
+
+
+/* end of container_multihashmap.c */
diff --git a/src/lib/util/container_multihashmap32.c b/src/lib/util/container_multihashmap32.c
new file mode 100644
index 000000000..3b4c92426
--- /dev/null
+++ b/src/lib/util/container_multihashmap32.c
@@ -0,0 +1,606 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_multihashmap32.c
+ * @brief a version of hash map implemented in container_multihashmap.c but with
+ *          uint32_t as keys
+ * @author Christian Grothoff
+ * @author Sree Harsha Totakura
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-multihashmap32", __VA_ARGS__)
+
+
+/**
+ * Maximum recursion depth for callbacks of
+ * #GNUNET_CONTAINER_multihashmap_get_multiple() themselves
+ * again calling #GNUNET_CONTAINER_multihashmap_get_multiple().
+ * Should be totally excessive, but if violated we die.
+ */
+#define NEXT_CACHE_SIZE 16
+
+/**
+ * An entry in the hash map.
+ */
+struct MapEntry
+{
+  /**
+   * Key for the entry.
+   */
+  uint32_t key;
+
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct MapEntry *next;
+};
+
+/**
+ * Internal representation of the hash map.
+ */
+struct GNUNET_CONTAINER_MultiHashMap32
+{
+  /**
+   * All of our buckets.
+   */
+  struct MapEntry **map;
+
+  /**
+   * Number of entries in the map.
+   */
+  unsigned int size;
+
+  /**
+   * Length of the @e map array.
+   */
+  unsigned int map_length;
+
+  /**
+   * Counts the destructive modifications (grow, remove)
+   * to the map, so that iterators can check if they are still valid.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map entries indicating iteration positions currently
+   * in use by #GNUNET_CONTAINER_multihashmap_get_multiple().
+   * Only used up to @e next_cache_off.
+   */
+  struct MapEntry *next_cache[NEXT_CACHE_SIZE];
+
+  /**
+   * Offset of @e next_cache entries in use, must be smaller
+   * than #NEXT_CACHE_SIZE.
+   */
+  unsigned int next_cache_off;
+};
+
+
+/**
+ * Cursor into a multihashmap.
+ * Allows to enumerate elements asynchronously.
+ */
+struct GNUNET_CONTAINER_MultiHashMap32Iterator
+{
+  /**
+   * Position in the bucket @e idx
+   */
+  struct MapEntry *me;
+
+  /**
+   * Current bucket index.
+   */
+  unsigned int idx;
+
+  /**
+   * Modification counter as observed on the map when the iterator
+   * was created.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map that we are iterating over.
+   */
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map;
+};
+
+
+/**
+ * Create a multi hash map.
+ *
+ * @param len initial size (map will grow as needed)
+ * @return NULL on error
+ */
+struct GNUNET_CONTAINER_MultiHashMap32 *
+GNUNET_CONTAINER_multihashmap32_create (unsigned int len)
+{
+  struct GNUNET_CONTAINER_MultiHashMap32 *ret;
+
+  GNUNET_assert (len > 0);
+  ret = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap32);
+  ret->map = GNUNET_malloc_large (len * sizeof(struct MapEntry *));
+  if (NULL == ret->map)
+  {
+    GNUNET_free (ret);
+    return NULL;
+  }
+  ret->map_length = len;
+  return ret;
+}
+
+
+/**
+ * Destroy a hash map.  Will not free any values
+ * stored in the hash map!
+ *
+ * @param map the map
+ */
+void
+GNUNET_CONTAINER_multihashmap32_destroy (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map)
+{
+  struct MapEntry *e;
+
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    while (NULL != (e = map->map[i]))
+    {
+      map->map[i] = e->next;
+      GNUNET_free (e);
+    }
+  }
+  GNUNET_free (map->map);
+  GNUNET_free (map);
+}
+
+
+/**
+ * Compute the index of the bucket for the given key.
+ *
+ * @param m hash map for which to compute the index
+ * @param key what key should the index be computed for
+ * @return offset into the "map" array of "m"
+ */
+static unsigned int
+idx_of (const struct GNUNET_CONTAINER_MultiHashMap32 *m, const uint32_t key)
+{
+  GNUNET_assert (NULL != m);
+  return ((unsigned int) key) % m->map_length;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_multihashmap32_size (
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map)
+{
+  return map->size;
+}
+
+
+void *
+GNUNET_CONTAINER_multihashmap32_get (
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key)
+{
+  struct MapEntry *e;
+
+  e = map->map[idx_of (map, key)];
+  while (NULL != e)
+  {
+    if (key == e->key)
+      return e->value;
+    e = e->next;
+  }
+  return NULL;
+}
+
+
+int
+GNUNET_CONTAINER_multihashmap32_iterate (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  GNUNET_CONTAINER_MultiHashMapIterator32Callback it,
+  void *it_cls)
+{
+  int count;
+  struct MapEntry **ce;
+
+  count = 0;
+  GNUNET_assert (NULL != map);
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    struct MapEntry *e;
+
+    *ce = map->map[i];
+    while (NULL != (e = *ce))
+    {
+      *ce = e->next;
+      if (NULL != it)
+      {
+        if (GNUNET_OK != it (it_cls, e->key, e->value))
+        {
+          GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+          return GNUNET_SYSERR;
+        }
+      }
+      count++;
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * We are about to free() the @a me, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param me the entry that is about to be free'd
+ */
+static void
+update_next_cache (struct GNUNET_CONTAINER_MultiHashMap32 *map,
+                   const struct MapEntry *me)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i] == me)
+      map->next_cache[i] = me->next;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap32_remove (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key,
+  const void *value)
+{
+  struct MapEntry *e;
+  struct MapEntry *p;
+  unsigned int i;
+
+  map->modification_counter++;
+
+  i = idx_of (map, key);
+  p = NULL;
+  e = map->map[i];
+  while (e != NULL)
+  {
+    if ((key == e->key) && (value == e->value))
+    {
+      if (p == NULL)
+        map->map[i] = e->next;
+      else
+        p->next = e->next;
+      update_next_cache (map, e);
+      GNUNET_free (e);
+      map->size--;
+      return GNUNET_YES;
+    }
+    p = e;
+    e = e->next;
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multihashmap32_remove_all (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key)
+{
+  struct MapEntry *e;
+  struct MapEntry *p;
+  unsigned int i;
+  int ret;
+
+  map->modification_counter++;
+
+  ret = 0;
+  i = idx_of (map, key);
+  p = NULL;
+  e = map->map[i];
+  while (e != NULL)
+  {
+    if (key == e->key)
+    {
+      if (p == NULL)
+        map->map[i] = e->next;
+      else
+        p->next = e->next;
+      update_next_cache (map, e);
+      GNUNET_free (e);
+      map->size--;
+      if (p == NULL)
+        e = map->map[i];
+      else
+        e = p->next;
+      ret++;
+    }
+    else
+    {
+      p = e;
+      e = e->next;
+    }
+  }
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap32_contains (
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key)
+{
+  struct MapEntry *e;
+
+  e = map->map[idx_of (map, key)];
+  while (e != NULL)
+  {
+    if (key == e->key)
+      return GNUNET_YES;
+    e = e->next;
+  }
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap32_contains_value (
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key,
+  const void *value)
+{
+  struct MapEntry *e;
+
+  e = map->map[idx_of (map, key)];
+  while (e != NULL)
+  {
+    if ((key == e->key) && (e->value == value))
+      return GNUNET_YES;
+    e = e->next;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Grow the given map to a more appropriate size.
+ *
+ * @param map the hash map to grow
+ */
+static void
+grow (struct GNUNET_CONTAINER_MultiHashMap32 *map)
+{
+  struct MapEntry **old_map;
+  struct MapEntry **new_map;
+  struct MapEntry *e;
+  unsigned int old_len;
+  unsigned int new_len;
+  unsigned int idx;
+
+  old_map = map->map;
+  old_len = map->map_length;
+  new_len = old_len * 2;
+  if (0 == new_len) /* 2^31 * 2 == 0 */
+    new_len = old_len; /* never use 0 */
+  if (new_len == old_len)
+    return; /* nothing changed */
+  new_map = GNUNET_malloc_large (new_len * sizeof(struct MapEntry *));
+  if (NULL == new_map)
+    return; /* grow not possible */
+  map->modification_counter++;
+  map->map_length = new_len;
+  map->map = new_map;
+  for (unsigned int i = 0; i < old_len; i++)
+  {
+    while (NULL != (e = old_map[i]))
+    {
+      old_map[i] = e->next;
+      idx = idx_of (map, e->key);
+      e->next = new_map[idx];
+      new_map[idx] = e;
+    }
+  }
+  GNUNET_free (old_map);
+}
+
+
+/**
+ * Store a key-value pair in the map.
+ *
+ * @param map the map
+ * @param key key to use
+ * @param value value to use
+ * @param opt options for put
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if a value was replaced (with REPLACE)
+ *         #GNUNET_SYSERR if UNIQUE_ONLY was the option and the
+ *                       value already exists
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap32_put (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key,
+  void *value,
+  enum GNUNET_CONTAINER_MultiHashMapOption opt)
+{
+  struct MapEntry *e;
+  unsigned int i;
+
+  i = idx_of (map, key);
+  if ((opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE) &&
+      (opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+  {
+    e = map->map[i];
+    while (e != NULL)
+    {
+      if (key == e->key)
+      {
+        if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+          return GNUNET_SYSERR;
+        e->value = value;
+        return GNUNET_NO;
+      }
+      e = e->next;
+    }
+  }
+  if (map->size / 3 >= map->map_length / 4)
+  {
+    grow (map);
+    i = idx_of (map, key);
+  }
+  e = GNUNET_new (struct MapEntry);
+  e->key = key;
+  e->value = value;
+  e->next = map->map[i];
+  map->map[i] = e;
+  map->size++;
+  return GNUNET_OK;
+}
+
+
+int
+GNUNET_CONTAINER_multihashmap32_get_multiple (
+  struct GNUNET_CONTAINER_MultiHashMap32 *map,
+  uint32_t key,
+  GNUNET_CONTAINER_MultiHashMapIterator32Callback it,
+  void *it_cls)
+{
+  int count;
+  struct MapEntry *e;
+  struct MapEntry **ce;
+
+  count = 0;
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+
+  *ce = map->map[idx_of (map, key)];
+  while (NULL != (e = *ce))
+  {
+    *ce = e->next;
+    if (key != e->key)
+      continue;
+    if ((NULL != it) && (GNUNET_OK != it (it_cls, key, e->value)))
+    {
+      GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+      return GNUNET_SYSERR;
+    }
+    count++;
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * Create an iterator for a multihashmap.
+ * The iterator can be used to retrieve all the elements in the multihashmap
+ * one by one, without having to handle all elements at once (in contrast to
+ * GNUNET_CONTAINER_multihashmap_iterate()).  Note that the iterator can not be
+ * used anymore if elements have been removed from 'map' after the creation of
+ * the iterator, or 'map' has been destroyed.  Adding elements to 'map' may
+ * result in skipped or repeated elements.
+ *
+ * @param map the map to create an iterator for
+ * @return an iterator over the given multihashmap @a map
+ */
+struct GNUNET_CONTAINER_MultiHashMap32Iterator *
+GNUNET_CONTAINER_multihashmap32_iterator_create (
+  const struct GNUNET_CONTAINER_MultiHashMap32 *map)
+{
+  struct GNUNET_CONTAINER_MultiHashMap32Iterator *iter;
+
+  iter = GNUNET_new (struct GNUNET_CONTAINER_MultiHashMap32Iterator);
+  iter->map = map;
+  iter->modification_counter = map->modification_counter;
+  iter->me = map->map[0];
+  return iter;
+}
+
+
+/**
+ * Retrieve the next element from the hash map at the iterator's position.
+ * If there are no elements left, GNUNET_NO is returned, and 'key' and 'value'
+ * are not modified.
+ * This operation is only allowed if no elements have been removed from the
+ * multihashmap since the creation of 'iter', and the map has not been destroyed.
+ * Adding elements may result in repeating or skipping elements.
+ *
+ * @param iter the iterator to get the next element from
+ * @param key pointer to store the key in, can be NULL
+ * @param value pointer to store the value in, can be NULL
+ * @return #GNUNET_YES we returned an element,
+ *         #GNUNET_NO if we are out of elements
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multihashmap32_iterator_next (
+  struct GNUNET_CONTAINER_MultiHashMap32Iterator *iter,
+  uint32_t *key,
+  const void **value)
+{
+  /* make sure the map has not been modified */
+  GNUNET_assert (iter->modification_counter == iter->map->modification_counter);
+
+  /* look for the next entry, skipping empty buckets */
+  while (1)
+  {
+    if (iter->idx >= iter->map->map_length)
+      return GNUNET_NO;
+    if (NULL != iter->me)
+    {
+      if (NULL != key)
+        *key = iter->me->key;
+      if (NULL != value)
+        *value = iter->me->value;
+      iter->me = iter->me->next;
+      return GNUNET_YES;
+    }
+    iter->idx += 1;
+    if (iter->idx < iter->map->map_length)
+      iter->me = iter->map->map[iter->idx];
+  }
+}
+
+
+/**
+ * Destroy a multihashmap iterator.
+ *
+ * @param iter the iterator to destroy
+ */
+void
+GNUNET_CONTAINER_multihashmap32_iterator_destroy (
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter)
+{
+  GNUNET_free (iter);
+}
+
+
+/* end of container_multihashmap.c */
diff --git a/src/lib/util/container_multipeermap.c b/src/lib/util/container_multipeermap.c
new file mode 100644
index 000000000..7ccfb62c8
--- /dev/null
+++ b/src/lib/util/container_multipeermap.c
@@ -0,0 +1,895 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_multipeermap.c
+ * @brief hash map where the same key may be present multiple times
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-multipeermap", __VA_ARGS__)
+
+/**
+ * Maximum recursion depth for callbacks of
+ * #GNUNET_CONTAINER_multihashmap_get_multiple() themselves s
+ * again calling #GNUNET_CONTAINER_multihashmap_get_multiple().
+ * Should be totally excessive, but if violated we die.
+ */
+#define NEXT_CACHE_SIZE 16
+
+/**
+ * An entry in the hash map with the full key.
+ */
+struct BigMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct BigMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  struct GNUNET_PeerIdentity key;
+};
+
+
+/**
+ * An entry in the hash map with just a pointer to the key.
+ */
+struct SmallMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct SmallMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  const struct GNUNET_PeerIdentity *key;
+};
+
+
+/**
+ * Entry in the map.
+ */
+union MapEntry
+{
+  /**
+   * Variant used if map entries only contain a pointer to the key.
+   */
+  struct SmallMapEntry *sme;
+
+  /**
+   * Variant used if map entries contain the full key.
+   */
+  struct BigMapEntry *bme;
+};
+
+
+/**
+ * Internal representation of the hash map.
+ */
+struct GNUNET_CONTAINER_MultiPeerMap
+{
+  /**
+   * All of our buckets.
+   */
+  union MapEntry *map;
+
+  /**
+   * Number of entries in the map.
+   */
+  unsigned int size;
+
+  /**
+   * Length of the "map" array.
+   */
+  unsigned int map_length;
+
+  /**
+   * #GNUNET_NO if the map entries are of type 'struct BigMapEntry',
+   * #GNUNET_YES if the map entries are of type 'struct SmallMapEntry'.
+   */
+  int use_small_entries;
+
+  /**
+   * Counts the destructive modifications (grow, remove)
+   * to the map, so that iterators can check if they are still valid.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map entries indicating iteration positions currently
+   * in use by #GNUNET_CONTAINER_multihashmap_get_multiple().
+   * Only used up to @e next_cache_off.
+   */
+  union MapEntry next_cache[NEXT_CACHE_SIZE];
+
+  /**
+   * Offset of @e next_cache entries in use, must be smaller
+   * than #NEXT_CACHE_SIZE.
+   */
+  unsigned int next_cache_off;
+};
+
+
+/**
+ * Cursor into a multipeermap.
+ * Allows to enumerate elements asynchronously.
+ */
+struct GNUNET_CONTAINER_MultiPeerMapIterator
+{
+  /**
+   * Position in the bucket 'idx'
+   */
+  union MapEntry me;
+
+  /**
+   * Current bucket index.
+   */
+  unsigned int idx;
+
+  /**
+   * Modification counter as observed on the map when the iterator
+   * was created.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map that we are iterating over.
+   */
+  const struct GNUNET_CONTAINER_MultiPeerMap *map;
+};
+
+
+struct GNUNET_CONTAINER_MultiPeerMap *
+GNUNET_CONTAINER_multipeermap_create (unsigned int len,
+                                      int do_not_copy_keys)
+{
+  struct GNUNET_CONTAINER_MultiPeerMap *map;
+
+  GNUNET_assert (len > 0);
+  map = GNUNET_new (struct GNUNET_CONTAINER_MultiPeerMap);
+  map->map = GNUNET_malloc_large (len * sizeof(union MapEntry));
+  if (NULL == map->map)
+  {
+    GNUNET_free (map);
+    return NULL;
+  }
+  map->map_length = len;
+  map->use_small_entries = do_not_copy_keys;
+  return map;
+}
+
+
+void
+GNUNET_CONTAINER_multipeermap_destroy (
+  struct GNUNET_CONTAINER_MultiPeerMap *map)
+{
+  GNUNET_assert (0 == map->next_cache_off);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    union MapEntry me;
+
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        GNUNET_free (sme);
+      }
+      me.sme = NULL;
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        GNUNET_free (bme);
+      }
+      me.bme = NULL;
+    }
+  }
+  GNUNET_free (map->map);
+  GNUNET_free (map);
+}
+
+
+/**
+ * Compute the index of the bucket for the given key.
+ *
+ * @param map hash map for which to compute the index
+ * @param key what key should the index be computed for
+ * @return offset into the "map" array of "map"
+ */
+static unsigned int
+idx_of (const struct GNUNET_CONTAINER_MultiPeerMap *map,
+        const struct GNUNET_PeerIdentity *key)
+{
+  unsigned int kx;
+
+  GNUNET_assert (NULL != map);
+  GNUNET_memcpy (&kx, key, sizeof(kx));
+  return kx % map->map_length;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_multipeermap_size (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map)
+{
+  return map->size;
+}
+
+
+void *
+GNUNET_CONTAINER_multipeermap_get (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map,
+  const struct GNUNET_PeerIdentity *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return sme->value;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return bme->value;
+  }
+  return NULL;
+}
+
+
+int
+GNUNET_CONTAINER_multipeermap_iterate (
+  struct GNUNET_CONTAINER_MultiPeerMap *map,
+  GNUNET_CONTAINER_PeerMapIterator it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+  struct GNUNET_PeerIdentity kc;
+
+  count = 0;
+  GNUNET_assert (NULL != map);
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      ce->sme = me.sme;
+      while (NULL != (sme = ce->sme))
+      {
+        ce->sme = sme->next;
+        if (NULL != it)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      ce->bme = me.bme;
+      while (NULL != (bme = ce->bme))
+      {
+        ce->bme = bme->next;
+        if (NULL != it)
+        {
+          kc = bme->key;
+          if (GNUNET_OK != it (it_cls, &kc, bme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * We are about to free() the @a bme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param bme the entry that is about to be free'd
+ */
+static void
+update_next_cache_bme (struct GNUNET_CONTAINER_MultiPeerMap *map,
+                       const struct BigMapEntry *bme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].bme == bme)
+      map->next_cache[i].bme = bme->next;
+}
+
+
+/**
+ * We are about to free() the @a sme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param sme the entry that is about to be free'd
+ */
+static void
+update_next_cache_sme (struct GNUNET_CONTAINER_MultiPeerMap *map,
+                       const struct SmallMapEntry *sme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].sme == sme)
+      map->next_cache[i].sme = sme->next;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multipeermap_remove (struct GNUNET_CONTAINER_MultiPeerMap *map,
+                                      const struct GNUNET_PeerIdentity *key,
+                                      const void *value)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  map->modification_counter++;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *p = NULL;
+
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (value == sme->value))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = sme;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *p = NULL;
+
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (value == bme->value))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = bme;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multipeermap_remove_all (
+  struct GNUNET_CONTAINER_MultiPeerMap *map,
+  const struct GNUNET_PeerIdentity *key)
+{
+  union MapEntry me;
+  unsigned int i;
+  int ret;
+
+  map->modification_counter++;
+
+  ret = 0;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+    struct SmallMapEntry *p;
+
+    p = NULL;
+    sme = me.sme;
+    while (NULL != sme)
+    {
+      if (0 == GNUNET_memcmp (key, sme->key))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        if (NULL == p)
+          sme = map->map[i].sme;
+        else
+          sme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = sme;
+        sme = sme->next;
+      }
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+    struct BigMapEntry *p;
+
+    p = NULL;
+    bme = me.bme;
+    while (NULL != bme)
+    {
+      if (0 == GNUNET_memcmp (key, &bme->key))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        if (NULL == p)
+          bme = map->map[i].bme;
+        else
+          bme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = bme;
+        bme = bme->next;
+      }
+    }
+  }
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multipeermap_contains (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map,
+  const struct GNUNET_PeerIdentity *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multipeermap_contains_value (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map,
+  const struct GNUNET_PeerIdentity *key,
+  const void *value)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (sme->value == value))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (bme->value == value))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Grow the given map to a more appropriate size.
+ *
+ * @param map the hash map to grow
+ */
+static void
+grow (struct GNUNET_CONTAINER_MultiPeerMap *map)
+{
+  union MapEntry *old_map;
+  union MapEntry *new_map;
+  unsigned int old_len;
+  unsigned int new_len;
+  unsigned int idx;
+
+  old_map = map->map;
+  old_len = map->map_length;
+  GNUNET_assert (0 != old_len);
+  new_len = old_len * 2;
+  if (0 == new_len) /* 2^31 * 2 == 0 */
+    new_len = old_len; /* never use 0 */
+  if (new_len == old_len)
+    return; /* nothing changed */
+  new_map = GNUNET_malloc_large (new_len * sizeof(union MapEntry));
+  if (NULL == new_map)
+    return; /* grow not possible */
+  map->modification_counter++;
+  map->map_length = new_len;
+  map->map = new_map;
+  for (unsigned int i = 0; i < old_len; i++)
+  {
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      while (NULL != (sme = old_map[i].sme))
+      {
+        old_map[i].sme = sme->next;
+        idx = idx_of (map, sme->key);
+        sme->next = new_map[idx].sme;
+        new_map[idx].sme = sme;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      while (NULL != (bme = old_map[i].bme))
+      {
+        old_map[i].bme = bme->next;
+        idx = idx_of (map, &bme->key);
+        bme->next = new_map[idx].bme;
+        new_map[idx].bme = bme;
+      }
+    }
+  }
+  GNUNET_free (old_map);
+}
+
+
+int
+GNUNET_CONTAINER_multipeermap_put (struct GNUNET_CONTAINER_MultiPeerMap *map,
+                                   const struct GNUNET_PeerIdentity *key,
+                                   void *value,
+                                   enum GNUNET_CONTAINER_MultiHashMapOption opt)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  i = idx_of (map, key);
+  if ((opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE) &&
+      (opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      for (sme = me.sme; NULL != sme; sme = sme->next)
+        if (0 == GNUNET_memcmp (key, sme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          sme->value = value;
+          return GNUNET_NO;
+        }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      for (bme = me.bme; NULL != bme; bme = bme->next)
+        if (0 == GNUNET_memcmp (key, &bme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          bme->value = value;
+          return GNUNET_NO;
+        }
+    }
+  }
+  if (map->size / 3 >= map->map_length / 4)
+  {
+    grow (map);
+    i = idx_of (map, key);
+  }
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    sme = GNUNET_new (struct SmallMapEntry);
+    sme->key = key;
+    sme->value = value;
+    sme->next = map->map[i].sme;
+    map->map[i].sme = sme;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    bme = GNUNET_new (struct BigMapEntry);
+    bme->key = *key;
+    bme->value = value;
+    bme->next = map->map[i].bme;
+    map->map[i].bme = bme;
+  }
+  map->size++;
+  return GNUNET_OK;
+}
+
+
+int
+GNUNET_CONTAINER_multipeermap_get_multiple (
+  struct GNUNET_CONTAINER_MultiPeerMap *map,
+  const struct GNUNET_PeerIdentity *key,
+  GNUNET_CONTAINER_PeerMapIterator it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  count = 0;
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    ce->sme = me.sme;
+    while (NULL != (sme = ce->sme))
+    {
+      ce->sme = sme->next;
+      if (0 != GNUNET_memcmp (key, sme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, sme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    ce->bme = me.bme;
+    while (NULL != (bme = ce->bme))
+    {
+      ce->bme = bme->next;
+      if (0 != GNUNET_memcmp (key, &bme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, bme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * @ingroup hashmap
+ * Call @a it on a random value from the map, or not at all
+ * if the map is empty.  Note that this function has linear
+ * complexity (in the size of the map).
+ *
+ * @param map the map
+ * @param it function to call on a random entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed, zero or one.
+ */
+unsigned int
+GNUNET_CONTAINER_multipeermap_get_random (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map,
+  GNUNET_CONTAINER_PeerMapIterator it,
+  void *it_cls)
+{
+  unsigned int off;
+  union MapEntry me;
+
+  if (0 == map->size)
+    return 0;
+  if (NULL == it)
+    return 1;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, map->size);
+  for (unsigned int idx = 0; idx < map->map_length; idx++)
+  {
+    me = map->map[idx];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, &bme->key, bme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+  }
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CONTAINER_MultiPeerMapIterator *
+GNUNET_CONTAINER_multipeermap_iterator_create (
+  const struct GNUNET_CONTAINER_MultiPeerMap *map)
+{
+  struct GNUNET_CONTAINER_MultiPeerMapIterator *iter;
+
+  iter = GNUNET_new (struct GNUNET_CONTAINER_MultiPeerMapIterator);
+  iter->map = map;
+  iter->modification_counter = map->modification_counter;
+  iter->me = map->map[0];
+  return iter;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multipeermap_iterator_next (
+  struct GNUNET_CONTAINER_MultiPeerMapIterator *iter,
+  struct GNUNET_PeerIdentity *key,
+  const void **value)
+{
+  /* make sure the map has not been modified */
+  GNUNET_assert (iter->modification_counter == iter->map->modification_counter);
+
+  /* look for the next entry, skipping empty buckets */
+  while (1)
+  {
+    if (iter->idx >= iter->map->map_length)
+      return GNUNET_NO;
+    if (GNUNET_YES == iter->map->use_small_entries)
+    {
+      if (NULL != iter->me.sme)
+      {
+        if (NULL != key)
+          *key = *iter->me.sme->key;
+        if (NULL != value)
+          *value = iter->me.sme->value;
+        iter->me.sme = iter->me.sme->next;
+        return GNUNET_YES;
+      }
+    }
+    else
+    {
+      if (NULL != iter->me.bme)
+      {
+        if (NULL != key)
+          *key = iter->me.bme->key;
+        if (NULL != value)
+          *value = iter->me.bme->value;
+        iter->me.bme = iter->me.bme->next;
+        return GNUNET_YES;
+      }
+    }
+    iter->idx += 1;
+    if (iter->idx < iter->map->map_length)
+      iter->me = iter->map->map[iter->idx];
+  }
+}
+
+
+void
+GNUNET_CONTAINER_multipeermap_iterator_destroy (
+  struct GNUNET_CONTAINER_MultiPeerMapIterator *iter)
+{
+  GNUNET_free (iter);
+}
+
+
+/* end of container_multipeermap.c */
diff --git a/src/lib/util/container_multishortmap.c b/src/lib/util/container_multishortmap.c
new file mode 100644
index 000000000..c626b55e5
--- /dev/null
+++ b/src/lib/util/container_multishortmap.c
@@ -0,0 +1,904 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_multishortmap.c
+ * @brief hash map where the same key may be present multiple times
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-multishortmap", __VA_ARGS__)
+
+/**
+ * Maximum recursion depth for callbacks of
+ * #GNUNET_CONTAINER_multihashmap_get_multiple() themselves s
+ * again calling #GNUNET_CONTAINER_multihashmap_get_multiple().
+ * Should be totally excessive, but if violated we die.
+ */
+#define NEXT_CACHE_SIZE 16
+
+
+/**
+ * An entry in the hash map with the full key.
+ */
+struct BigMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct BigMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  struct GNUNET_ShortHashCode key;
+};
+
+
+/**
+ * An entry in the hash map with just a pointer to the key.
+ */
+struct SmallMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct SmallMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  const struct GNUNET_ShortHashCode *key;
+};
+
+
+/**
+ * Entry in the map.
+ */
+union MapEntry
+{
+  /**
+   * Variant used if map entries only contain a pointer to the key.
+   */
+  struct SmallMapEntry *sme;
+
+  /**
+   * Variant used if map entries contain the full key.
+   */
+  struct BigMapEntry *bme;
+};
+
+
+/**
+ * Internal representation of the hash map.
+ */
+struct GNUNET_CONTAINER_MultiShortmap
+{
+  /**
+   * All of our buckets.
+   */
+  union MapEntry *map;
+
+  /**
+   * Number of entries in the map.
+   */
+  unsigned int size;
+
+  /**
+   * Length of the "map" array.
+   */
+  unsigned int map_length;
+
+  /**
+   * #GNUNET_NO if the map entries are of type 'struct BigMapEntry',
+   * #GNUNET_YES if the map entries are of type 'struct SmallMapEntry'.
+   */
+  int use_small_entries;
+
+  /**
+   * Counts the destructive modifications (grow, remove)
+   * to the map, so that iterators can check if they are still valid.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map entries indicating iteration positions currently
+   * in use by #GNUNET_CONTAINER_multihashmap_get_multiple().
+   * Only used up to @e next_cache_off.
+   */
+  union MapEntry next_cache[NEXT_CACHE_SIZE];
+
+  /**
+   * Offset of @e next_cache entries in use, must be smaller
+   * than #NEXT_CACHE_SIZE.
+   */
+  unsigned int next_cache_off;
+};
+
+
+/**
+ * Cursor into a multishortmap.
+ * Allows to enumerate elements asynchronously.
+ */
+struct GNUNET_CONTAINER_MultiShortmapIterator
+{
+  /**
+   * Position in the bucket 'idx'
+   */
+  union MapEntry me;
+
+  /**
+   * Current bucket index.
+   */
+  unsigned int idx;
+
+  /**
+   * Modification counter as observed on the map when the iterator
+   * was created.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map that we are iterating over.
+   */
+  const struct GNUNET_CONTAINER_MultiShortmap *map;
+};
+
+
+/**
+ * Create a multi hash map.
+ *
+ * @param len initial size (map will grow as needed)
+ * @param do_not_copy_keys #GNUNET_NO is always safe and should be used by default;
+ *                         #GNUNET_YES means that on 'put', the 'key' does not have
+ *                         to be copied as the destination of the pointer is
+ *                         guaranteed to be life as long as the value is stored in
+ *                         the hashmap.  This can significantly reduce memory
+ *                         consumption, but of course is also a recipe for
+ *                         heap corruption if the assumption is not true.  Only
+ *                         use this if (1) memory use is important in this case and
+ *                         (2) you have triple-checked that the invariant holds
+ * @return NULL on error
+ */
+struct GNUNET_CONTAINER_MultiShortmap *
+GNUNET_CONTAINER_multishortmap_create (unsigned int len, int do_not_copy_keys)
+{
+  struct GNUNET_CONTAINER_MultiShortmap *map;
+
+  GNUNET_assert (len > 0);
+  map = GNUNET_new (struct GNUNET_CONTAINER_MultiShortmap);
+  map->map = GNUNET_malloc_large (len * sizeof(union MapEntry));
+  if (NULL == map->map)
+  {
+    GNUNET_free (map);
+    return NULL;
+  }
+  map->map_length = len;
+  map->use_small_entries = do_not_copy_keys;
+  return map;
+}
+
+
+void
+GNUNET_CONTAINER_multishortmap_destroy (
+  struct GNUNET_CONTAINER_MultiShortmap *map)
+{
+  GNUNET_assert (0 == map->next_cache_off);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    union MapEntry me;
+
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        GNUNET_free (sme);
+      }
+      me.sme = NULL;
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        GNUNET_free (bme);
+      }
+      me.bme = NULL;
+    }
+  }
+  GNUNET_free (map->map);
+  GNUNET_free (map);
+}
+
+
+/**
+ * Compute the index of the bucket for the given key.
+ *
+ * @param map hash map for which to compute the index
+ * @param key what key should the index be computed for
+ * @return offset into the "map" array of "map"
+ */
+static unsigned int
+idx_of (const struct GNUNET_CONTAINER_MultiShortmap *map,
+        const struct GNUNET_ShortHashCode *key)
+{
+  unsigned int kx;
+
+  GNUNET_assert (NULL != map);
+  GNUNET_memcpy (&kx, key, sizeof(kx));
+  return kx % map->map_length;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_multishortmap_size (
+  const struct GNUNET_CONTAINER_MultiShortmap *map)
+{
+  return map->size;
+}
+
+
+void *
+GNUNET_CONTAINER_multishortmap_get (
+  const struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return sme->value;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return bme->value;
+  }
+  return NULL;
+}
+
+
+int
+GNUNET_CONTAINER_multishortmap_iterate (
+  struct GNUNET_CONTAINER_MultiShortmap *map,
+  GNUNET_CONTAINER_ShortmapIterator it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+  struct GNUNET_ShortHashCode kc;
+
+  count = 0;
+  GNUNET_assert (NULL != map);
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      ce->sme = me.sme;
+      while (NULL != (sme = ce->sme))
+      {
+        ce->sme = sme->next;
+        if ((NULL != it) && (GNUNET_OK != it (it_cls, sme->key, sme->value)))
+        {
+          GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+          return GNUNET_SYSERR;
+        }
+        count++;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      ce->bme = me.bme;
+      while (NULL != (bme = ce->bme))
+      {
+        ce->bme = bme->next;
+        if (NULL != it)
+        {
+          kc = bme->key;
+          if (GNUNET_OK != it (it_cls, &kc, bme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * We are about to free() the @a bme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param bme the entry that is about to be free'd
+ */
+static void
+update_next_cache_bme (struct GNUNET_CONTAINER_MultiShortmap *map,
+                       const struct BigMapEntry *bme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].bme == bme)
+      map->next_cache[i].bme = bme->next;
+}
+
+
+/**
+ * We are about to free() the @a sme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param sme the entry that is about to be free'd
+ */
+static void
+update_next_cache_sme (struct GNUNET_CONTAINER_MultiShortmap *map,
+                       const struct SmallMapEntry *sme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].sme == sme)
+      map->next_cache[i].sme = sme->next;
+}
+
+
+int
+GNUNET_CONTAINER_multishortmap_remove (
+  struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key,
+  const void *value)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  map->modification_counter++;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *p = NULL;
+
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (value == sme->value))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = sme;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *p = NULL;
+
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (value == bme->value))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = bme;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multishortmap_remove_all (
+  struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key)
+{
+  union MapEntry me;
+  unsigned int i;
+  int ret;
+
+  map->modification_counter++;
+
+  ret = 0;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+    struct SmallMapEntry *p;
+
+    p = NULL;
+    sme = me.sme;
+    while (NULL != sme)
+    {
+      if (0 == GNUNET_memcmp (key, sme->key))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        if (NULL == p)
+          sme = map->map[i].sme;
+        else
+          sme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = sme;
+        sme = sme->next;
+      }
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+    struct BigMapEntry *p;
+
+    p = NULL;
+    bme = me.bme;
+    while (NULL != bme)
+    {
+      if (0 == GNUNET_memcmp (key, &bme->key))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        if (NULL == p)
+          bme = map->map[i].bme;
+        else
+          bme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = bme;
+        bme = bme->next;
+      }
+    }
+  }
+  return ret;
+}
+
+
+int
+GNUNET_CONTAINER_multishortmap_contains (
+  const struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multishortmap_contains_value (
+  const struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key,
+  const void *value)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (sme->value == value))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (bme->value == value))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Grow the given map to a more appropriate size.
+ *
+ * @param map the hash map to grow
+ */
+static void
+grow (struct GNUNET_CONTAINER_MultiShortmap *map)
+{
+  union MapEntry *old_map;
+  union MapEntry *new_map;
+  unsigned int old_len;
+  unsigned int new_len;
+  unsigned int idx;
+
+  old_map = map->map;
+  old_len = map->map_length;
+  new_len = old_len * 2;
+  if (0 == new_len) /* 2^31 * 2 == 0 */
+    new_len = old_len; /* never use 0 */
+  if (new_len == old_len)
+    return; /* nothing changed */
+  new_map = GNUNET_malloc_large (new_len * sizeof(union MapEntry));
+  if (NULL == new_map)
+    return; /* grow not possible */
+  map->modification_counter++;
+  map->map_length = new_len;
+  map->map = new_map;
+  for (unsigned int i = 0; i < old_len; i++)
+  {
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      while (NULL != (sme = old_map[i].sme))
+      {
+        old_map[i].sme = sme->next;
+        idx = idx_of (map, sme->key);
+        sme->next = new_map[idx].sme;
+        new_map[idx].sme = sme;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      while (NULL != (bme = old_map[i].bme))
+      {
+        old_map[i].bme = bme->next;
+        idx = idx_of (map, &bme->key);
+        bme->next = new_map[idx].bme;
+        new_map[idx].bme = bme;
+      }
+    }
+  }
+  GNUNET_free (old_map);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multishortmap_put (
+  struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key,
+  void *value,
+  enum GNUNET_CONTAINER_MultiHashMapOption opt)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  i = idx_of (map, key);
+  if ((opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE) &&
+      (opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+        if (0 == GNUNET_memcmp (key, sme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          sme->value = value;
+          return GNUNET_NO;
+        }
+    }
+    else
+    {
+      for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+        if (0 == GNUNET_memcmp (key, &bme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          bme->value = value;
+          return GNUNET_NO;
+        }
+    }
+  }
+  if (map->size / 3 >= map->map_length / 4)
+  {
+    grow (map);
+    i = idx_of (map, key);
+  }
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    sme = GNUNET_new (struct SmallMapEntry);
+    sme->key = key;
+    sme->value = value;
+    sme->next = map->map[i].sme;
+    map->map[i].sme = sme;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    bme = GNUNET_new (struct BigMapEntry);
+    bme->key = *key;
+    bme->value = value;
+    bme->next = map->map[i].bme;
+    map->map[i].bme = bme;
+  }
+  map->size++;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over all entries in the map that match a particular key.
+ *
+ * @param map the map
+ * @param key key that the entries must correspond to
+ * @param it function to call on each entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed,
+ *         #GNUNET_SYSERR if it aborted iteration
+ */
+int
+GNUNET_CONTAINER_multishortmap_get_multiple (
+  struct GNUNET_CONTAINER_MultiShortmap *map,
+  const struct GNUNET_ShortHashCode *key,
+  GNUNET_CONTAINER_ShortmapIterator it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  count = 0;
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    ce->sme = me.sme;
+    while (NULL != (sme = ce->sme))
+    {
+      ce->sme = sme->next;
+      if (0 != GNUNET_memcmp (key, sme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, sme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    ce->bme = me.bme;
+    while (NULL != (bme = ce->bme))
+    {
+      ce->bme = bme->next;
+      if (0 != GNUNET_memcmp (key, &bme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, bme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * @ingroup hashmap
+ * Call @a it on a random value from the map, or not at all
+ * if the map is empty.  Note that this function has linear
+ * complexity (in the size of the map).
+ *
+ * @param map the map
+ * @param it function to call on a random entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed, zero or one.
+ */
+unsigned int
+GNUNET_CONTAINER_multishortmap_get_random (
+  const struct GNUNET_CONTAINER_MultiShortmap *map,
+  GNUNET_CONTAINER_ShortmapIterator it,
+  void *it_cls)
+{
+  unsigned int off;
+  union MapEntry me;
+
+  if (0 == map->size)
+    return 0;
+  if (NULL == it)
+    return 1;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, map->size);
+  for (unsigned int idx = 0; idx < map->map_length; idx++)
+  {
+    me = map->map[idx];
+    if (map->use_small_entries)
+    {
+      for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      {
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+    else
+    {
+      for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      {
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, &bme->key, bme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+  }
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CONTAINER_MultiShortmapIterator *
+GNUNET_CONTAINER_multishortmap_iterator_create (
+  const struct GNUNET_CONTAINER_MultiShortmap *map)
+{
+  struct GNUNET_CONTAINER_MultiShortmapIterator *iter;
+
+  iter = GNUNET_new (struct GNUNET_CONTAINER_MultiShortmapIterator);
+  iter->map = map;
+  iter->modification_counter = map->modification_counter;
+  iter->me = map->map[0];
+  return iter;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multishortmap_iterator_next (
+  struct GNUNET_CONTAINER_MultiShortmapIterator *iter,
+  struct GNUNET_ShortHashCode *key,
+  const void **value)
+{
+  /* make sure the map has not been modified */
+  GNUNET_assert (iter->modification_counter == iter->map->modification_counter);
+
+  /* look for the next entry, skipping empty buckets */
+  while (1)
+  {
+    if (iter->idx >= iter->map->map_length)
+      return GNUNET_NO;
+    if (GNUNET_YES == iter->map->use_small_entries)
+    {
+      if (NULL != iter->me.sme)
+      {
+        if (NULL != key)
+          *key = *iter->me.sme->key;
+        if (NULL != value)
+          *value = iter->me.sme->value;
+        iter->me.sme = iter->me.sme->next;
+        return GNUNET_YES;
+      }
+    }
+    else
+    {
+      if (NULL != iter->me.bme)
+      {
+        if (NULL != key)
+          *key = iter->me.bme->key;
+        if (NULL != value)
+          *value = iter->me.bme->value;
+        iter->me.bme = iter->me.bme->next;
+        return GNUNET_YES;
+      }
+    }
+    iter->idx += 1;
+    if (iter->idx < iter->map->map_length)
+      iter->me = iter->map->map[iter->idx];
+  }
+}
+
+
+void
+GNUNET_CONTAINER_multishortmap_iterator_destroy (
+  struct GNUNET_CONTAINER_MultiShortmapIterator *iter)
+{
+  GNUNET_free (iter);
+}
+
+
+/* end of container_multishortmap.c */
diff --git a/src/lib/util/container_multiuuidmap.c b/src/lib/util/container_multiuuidmap.c
new file mode 100644
index 000000000..3e957d47b
--- /dev/null
+++ b/src/lib/util/container_multiuuidmap.c
@@ -0,0 +1,902 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/container_multiuuidmap.c
+ * @brief hash map for UUIDs where the same key may be present multiple times
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-container-multiuuidmap", __VA_ARGS__)
+
+/**
+ * Maximum recursion depth for callbacks of
+ * #GNUNET_CONTAINER_multihashmap_get_multiple() themselves s
+ * again calling #GNUNET_CONTAINER_multihashmap_get_multiple().
+ * Should be totally excessive, but if violated we die.
+ */
+#define NEXT_CACHE_SIZE 16
+
+
+/**
+ * An entry in the hash map with the full key.
+ */
+struct BigMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct BigMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  struct GNUNET_Uuid key;
+};
+
+
+/**
+ * An entry in the hash map with just a pointer to the key.
+ */
+struct SmallMapEntry
+{
+  /**
+   * Value of the entry.
+   */
+  void *value;
+
+  /**
+   * If there is a hash collision, we create a linked list.
+   */
+  struct SmallMapEntry *next;
+
+  /**
+   * Key for the entry.
+   */
+  const struct GNUNET_Uuid *key;
+};
+
+
+/**
+ * Entry in the map.
+ */
+union MapEntry
+{
+  /**
+   * Variant used if map entries only contain a pointer to the key.
+   */
+  struct SmallMapEntry *sme;
+
+  /**
+   * Variant used if map entries contain the full key.
+   */
+  struct BigMapEntry *bme;
+};
+
+
+/**
+ * Internal representation of the hash map.
+ */
+struct GNUNET_CONTAINER_MultiUuidmap
+{
+  /**
+   * All of our buckets.
+   */
+  union MapEntry *map;
+
+  /**
+   * Number of entries in the map.
+   */
+  unsigned int size;
+
+  /**
+   * Length of the "map" array.
+   */
+  unsigned int map_length;
+
+  /**
+   * #GNUNET_NO if the map entries are of type 'struct BigMapEntry',
+   * #GNUNET_YES if the map entries are of type 'struct SmallMapEntry'.
+   */
+  int use_small_entries;
+
+  /**
+   * Counts the destructive modifications (grow, remove)
+   * to the map, so that iterators can check if they are still valid.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map entries indicating iteration positions currently
+   * in use by #GNUNET_CONTAINER_multihashmap_get_multiple().
+   * Only used up to @e next_cache_off.
+   */
+  union MapEntry next_cache[NEXT_CACHE_SIZE];
+
+  /**
+   * Offset of @e next_cache entries in use, must be smaller
+   * than #NEXT_CACHE_SIZE.
+   */
+  unsigned int next_cache_off;
+};
+
+
+/**
+ * Cursor into a multiuuidmap.
+ * Allows to enumerate elements asynchronously.
+ */
+struct GNUNET_CONTAINER_MultiUuidmapIterator
+{
+  /**
+   * Position in the bucket 'idx'
+   */
+  union MapEntry me;
+
+  /**
+   * Current bucket index.
+   */
+  unsigned int idx;
+
+  /**
+   * Modification counter as observed on the map when the iterator
+   * was created.
+   */
+  unsigned int modification_counter;
+
+  /**
+   * Map that we are iterating over.
+   */
+  const struct GNUNET_CONTAINER_MultiUuidmap *map;
+};
+
+
+/**
+ * Create a multi hash map.
+ *
+ * @param len initial size (map will grow as needed)
+ * @param do_not_copy_keys #GNUNET_NO is always safe and should be used by default;
+ *                         #GNUNET_YES means that on 'put', the 'key' does not have
+ *                         to be copied as the destination of the pointer is
+ *                         guaranteed to be life as long as the value is stored in
+ *                         the hashmap.  This can significantly reduce memory
+ *                         consumption, but of course is also a recipe for
+ *                         heap corruption if the assumption is not true.  Only
+ *                         use this if (1) memory use is important in this case and
+ *                         (2) you have triple-checked that the invariant holds
+ * @return NULL on error
+ */
+struct GNUNET_CONTAINER_MultiUuidmap *
+GNUNET_CONTAINER_multiuuidmap_create (unsigned int len, int do_not_copy_keys)
+{
+  struct GNUNET_CONTAINER_MultiUuidmap *map;
+
+  GNUNET_assert (len > 0);
+  map = GNUNET_new (struct GNUNET_CONTAINER_MultiUuidmap);
+  map->map = GNUNET_malloc_large (len * sizeof(union MapEntry));
+  if (NULL == map->map)
+  {
+    GNUNET_free (map);
+    return NULL;
+  }
+  map->map_length = len;
+  map->use_small_entries = do_not_copy_keys;
+  return map;
+}
+
+
+void
+GNUNET_CONTAINER_multiuuidmap_destroy (
+  struct GNUNET_CONTAINER_MultiUuidmap *map)
+{
+  GNUNET_assert (0 == map->next_cache_off);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    union MapEntry me;
+
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+      struct SmallMapEntry *nxt;
+
+      nxt = me.sme;
+      while (NULL != (sme = nxt))
+      {
+        nxt = sme->next;
+        GNUNET_free (sme);
+      }
+      me.sme = NULL;
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+      struct BigMapEntry *nxt;
+
+      nxt = me.bme;
+      while (NULL != (bme = nxt))
+      {
+        nxt = bme->next;
+        GNUNET_free (bme);
+      }
+      me.bme = NULL;
+    }
+  }
+  GNUNET_free (map->map);
+  GNUNET_free (map);
+}
+
+
+/**
+ * Compute the index of the bucket for the given key.
+ *
+ * @param map hash map for which to compute the index
+ * @param key what key should the index be computed for
+ * @return offset into the "map" array of "map"
+ */
+static unsigned int
+idx_of (const struct GNUNET_CONTAINER_MultiUuidmap *map,
+        const struct GNUNET_Uuid *key)
+{
+  unsigned int kx;
+
+  GNUNET_assert (NULL != map);
+  GNUNET_memcpy (&kx, key, sizeof(kx));
+  return kx % map->map_length;
+}
+
+
+unsigned int
+GNUNET_CONTAINER_multiuuidmap_size (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map)
+{
+  return map->size;
+}
+
+
+void *
+GNUNET_CONTAINER_multiuuidmap_get (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map,
+  const struct GNUNET_Uuid *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return sme->value;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return bme->value;
+  }
+  return NULL;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_iterate (
+  struct GNUNET_CONTAINER_MultiUuidmap *map,
+  GNUNET_CONTAINER_MultiUuidmapIteratorCallback it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+  struct GNUNET_Uuid kc;
+
+  count = 0;
+  GNUNET_assert (NULL != map);
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  for (unsigned int i = 0; i < map->map_length; i++)
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      ce->sme = me.sme;
+      while (NULL != (sme = ce->sme))
+      {
+        ce->sme = sme->next;
+        if ((NULL != it) && (GNUNET_OK != it (it_cls, sme->key, sme->value)))
+        {
+          GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+          return GNUNET_SYSERR;
+        }
+        count++;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      ce->bme = me.bme;
+      while (NULL != (bme = ce->bme))
+      {
+        ce->bme = bme->next;
+        if (NULL != it)
+        {
+          kc = bme->key;
+          if (GNUNET_OK != it (it_cls, &kc, bme->value))
+          {
+            GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+            return GNUNET_SYSERR;
+          }
+        }
+        count++;
+      }
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * We are about to free() the @a bme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param bme the entry that is about to be free'd
+ */
+static void
+update_next_cache_bme (struct GNUNET_CONTAINER_MultiUuidmap *map,
+                       const struct BigMapEntry *bme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].bme == bme)
+      map->next_cache[i].bme = bme->next;
+}
+
+
+/**
+ * We are about to free() the @a sme, make sure it is not in
+ * the list of next values for any iterator in the @a map's next_cache.
+ *
+ * @param map the map to check
+ * @param sme the entry that is about to be free'd
+ */
+static void
+update_next_cache_sme (struct GNUNET_CONTAINER_MultiUuidmap *map,
+                       const struct SmallMapEntry *sme)
+{
+  for (unsigned int i = 0; i < map->next_cache_off; i++)
+    if (map->next_cache[i].sme == sme)
+      map->next_cache[i].sme = sme->next;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_remove (struct GNUNET_CONTAINER_MultiUuidmap *map,
+                                      const struct GNUNET_Uuid *key,
+                                      const void *value)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  map->modification_counter++;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *p = NULL;
+
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (value == sme->value))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = sme;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *p = NULL;
+
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+    {
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (value == bme->value))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        return GNUNET_YES;
+      }
+      p = bme;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+int
+GNUNET_CONTAINER_multiuuidmap_remove_all (
+  struct GNUNET_CONTAINER_MultiUuidmap *map,
+  const struct GNUNET_Uuid *key)
+{
+  union MapEntry me;
+  unsigned int i;
+  int ret;
+
+  map->modification_counter++;
+
+  ret = 0;
+  i = idx_of (map, key);
+  me = map->map[i];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+    struct SmallMapEntry *p;
+
+    p = NULL;
+    sme = me.sme;
+    while (NULL != sme)
+    {
+      if (0 == GNUNET_memcmp (key, sme->key))
+      {
+        if (NULL == p)
+          map->map[i].sme = sme->next;
+        else
+          p->next = sme->next;
+        update_next_cache_sme (map, sme);
+        GNUNET_free (sme);
+        map->size--;
+        if (NULL == p)
+          sme = map->map[i].sme;
+        else
+          sme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = sme;
+        sme = sme->next;
+      }
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+    struct BigMapEntry *p;
+
+    p = NULL;
+    bme = me.bme;
+    while (NULL != bme)
+    {
+      if (0 == GNUNET_memcmp (key, &bme->key))
+      {
+        if (NULL == p)
+          map->map[i].bme = bme->next;
+        else
+          p->next = bme->next;
+        update_next_cache_bme (map, bme);
+        GNUNET_free (bme);
+        map->size--;
+        if (NULL == p)
+          bme = map->map[i].bme;
+        else
+          bme = p->next;
+        ret++;
+      }
+      else
+      {
+        p = bme;
+        bme = bme->next;
+      }
+    }
+  }
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_contains (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map,
+  const struct GNUNET_Uuid *key)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if (0 == GNUNET_memcmp (key, sme->key))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if (0 == GNUNET_memcmp (key, &bme->key))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_contains_value (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map,
+  const struct GNUNET_Uuid *key,
+  const void *value)
+{
+  union MapEntry me;
+
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      if ((0 == GNUNET_memcmp (key, sme->key)) && (sme->value == value))
+        return GNUNET_YES;
+  }
+  else
+  {
+    for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      if ((0 == GNUNET_memcmp (key, &bme->key)) && (bme->value == value))
+        return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Grow the given map to a more appropriate size.
+ *
+ * @param map the hash map to grow
+ */
+static void
+grow (struct GNUNET_CONTAINER_MultiUuidmap *map)
+{
+  union MapEntry *old_map;
+  union MapEntry *new_map;
+  unsigned int old_len;
+  unsigned int new_len;
+  unsigned int idx;
+
+  old_map = map->map;
+  old_len = map->map_length;
+  new_len = old_len * 2;
+  if (0 == new_len) /* 2^31 * 2 == 0 */
+    new_len = old_len; /* never use 0 */
+  if (new_len == old_len)
+    return; /* nothing changed */
+  new_map = GNUNET_malloc_large (new_len * sizeof(union MapEntry));
+  if (NULL == new_map)
+    return; /* grow not possible */
+  map->modification_counter++;
+  map->map_length = new_len;
+  map->map = new_map;
+  for (unsigned int i = 0; i < old_len; i++)
+  {
+    if (map->use_small_entries)
+    {
+      struct SmallMapEntry *sme;
+
+      while (NULL != (sme = old_map[i].sme))
+      {
+        old_map[i].sme = sme->next;
+        idx = idx_of (map, sme->key);
+        sme->next = new_map[idx].sme;
+        new_map[idx].sme = sme;
+      }
+    }
+    else
+    {
+      struct BigMapEntry *bme;
+
+      while (NULL != (bme = old_map[i].bme))
+      {
+        old_map[i].bme = bme->next;
+        idx = idx_of (map, &bme->key);
+        bme->next = new_map[idx].bme;
+        new_map[idx].bme = bme;
+      }
+    }
+  }
+  GNUNET_free (old_map);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_put (struct GNUNET_CONTAINER_MultiUuidmap *map,
+                                   const struct GNUNET_Uuid *key,
+                                   void *value,
+                                   enum GNUNET_CONTAINER_MultiHashMapOption opt)
+{
+  union MapEntry me;
+  unsigned int i;
+
+  i = idx_of (map, key);
+  if ((opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE) &&
+      (opt != GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+  {
+    me = map->map[i];
+    if (map->use_small_entries)
+    {
+      for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+        if (0 == GNUNET_memcmp (key, sme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          sme->value = value;
+          return GNUNET_NO;
+        }
+    }
+    else
+    {
+      for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+        if (0 == GNUNET_memcmp (key, &bme->key))
+        {
+          if (opt == GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)
+            return GNUNET_SYSERR;
+          bme->value = value;
+          return GNUNET_NO;
+        }
+    }
+  }
+  if (map->size / 3 >= map->map_length / 4)
+  {
+    grow (map);
+    i = idx_of (map, key);
+  }
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    sme = GNUNET_new (struct SmallMapEntry);
+    sme->key = key;
+    sme->value = value;
+    sme->next = map->map[i].sme;
+    map->map[i].sme = sme;
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    bme = GNUNET_new (struct BigMapEntry);
+    bme->key = *key;
+    bme->value = value;
+    bme->next = map->map[i].bme;
+    map->map[i].bme = bme;
+  }
+  map->size++;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over all entries in the map that match a particular key.
+ *
+ * @param map the map
+ * @param key key that the entries must correspond to
+ * @param it function to call on each entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed,
+ *         #GNUNET_SYSERR if it aborted iteration
+ */
+int
+GNUNET_CONTAINER_multiuuidmap_get_multiple (
+  struct GNUNET_CONTAINER_MultiUuidmap *map,
+  const struct GNUNET_Uuid *key,
+  GNUNET_CONTAINER_MultiUuidmapIteratorCallback it,
+  void *it_cls)
+{
+  int count;
+  union MapEntry me;
+  union MapEntry *ce;
+
+  ce = &map->next_cache[map->next_cache_off];
+  GNUNET_assert (++map->next_cache_off < NEXT_CACHE_SIZE);
+  count = 0;
+  me = map->map[idx_of (map, key)];
+  if (map->use_small_entries)
+  {
+    struct SmallMapEntry *sme;
+
+    ce->sme = me.sme;
+    while (NULL != (sme = ce->sme))
+    {
+      ce->sme = sme->next;
+      if (0 != GNUNET_memcmp (key, sme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, sme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  else
+  {
+    struct BigMapEntry *bme;
+
+    ce->bme = me.bme;
+    while (NULL != (bme = ce->bme))
+    {
+      ce->bme = bme->next;
+      if (0 != GNUNET_memcmp (key, &bme->key))
+        continue;
+      if ((NULL != it) && (GNUNET_OK != it (it_cls, key, bme->value)))
+      {
+        GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+        return GNUNET_SYSERR;
+      }
+      count++;
+    }
+  }
+  GNUNET_assert (--map->next_cache_off < NEXT_CACHE_SIZE);
+  return count;
+}
+
+
+/**
+ * @ingroup hashmap
+ * Call @a it on a random value from the map, or not at all
+ * if the map is empty.  Note that this function has linear
+ * complexity (in the size of the map).
+ *
+ * @param map the map
+ * @param it function to call on a random entry
+ * @param it_cls extra argument to @a it
+ * @return the number of key value pairs processed, zero or one.
+ */
+unsigned int
+GNUNET_CONTAINER_multiuuidmap_get_random (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map,
+  GNUNET_CONTAINER_MultiUuidmapIteratorCallback it,
+  void *it_cls)
+{
+  unsigned int off;
+  union MapEntry me;
+
+  if (0 == map->size)
+    return 0;
+  if (NULL == it)
+    return 1;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, map->size);
+  for (unsigned int idx = 0; idx < map->map_length; idx++)
+  {
+    me = map->map[idx];
+    if (map->use_small_entries)
+    {
+      for (struct SmallMapEntry *sme = me.sme; NULL != sme; sme = sme->next)
+      {
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, sme->key, sme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+    else
+    {
+      for (struct BigMapEntry *bme = me.bme; NULL != bme; bme = bme->next)
+      {
+        if (0 == off)
+        {
+          if (GNUNET_OK != it (it_cls, &bme->key, bme->value))
+            return GNUNET_SYSERR;
+          return 1;
+        }
+        off--;
+      }
+    }
+  }
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CONTAINER_MultiUuidmapIterator *
+GNUNET_CONTAINER_multiuuidmap_iterator_create (
+  const struct GNUNET_CONTAINER_MultiUuidmap *map)
+{
+  struct GNUNET_CONTAINER_MultiUuidmapIterator *iter;
+
+  iter = GNUNET_new (struct GNUNET_CONTAINER_MultiUuidmapIterator);
+  iter->map = map;
+  iter->modification_counter = map->modification_counter;
+  iter->me = map->map[0];
+  return iter;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CONTAINER_multiuuidmap_iterator_next (
+  struct GNUNET_CONTAINER_MultiUuidmapIterator *iter,
+  struct GNUNET_Uuid *key,
+  const void **value)
+{
+  /* make sure the map has not been modified */
+  GNUNET_assert (iter->modification_counter == iter->map->modification_counter);
+
+  /* look for the next entry, skipping empty buckets */
+  while (1)
+  {
+    if (iter->idx >= iter->map->map_length)
+      return GNUNET_NO;
+    if (GNUNET_YES == iter->map->use_small_entries)
+    {
+      if (NULL != iter->me.sme)
+      {
+        if (NULL != key)
+          *key = *iter->me.sme->key;
+        if (NULL != value)
+          *value = iter->me.sme->value;
+        iter->me.sme = iter->me.sme->next;
+        return GNUNET_YES;
+      }
+    }
+    else
+    {
+      if (NULL != iter->me.bme)
+      {
+        if (NULL != key)
+          *key = iter->me.bme->key;
+        if (NULL != value)
+          *value = iter->me.bme->value;
+        iter->me.bme = iter->me.bme->next;
+        return GNUNET_YES;
+      }
+    }
+    iter->idx += 1;
+    if (iter->idx < iter->map->map_length)
+      iter->me = iter->map->map[iter->idx];
+  }
+}
+
+
+void
+GNUNET_CONTAINER_multiuuidmap_iterator_destroy (
+  struct GNUNET_CONTAINER_MultiUuidmapIterator *iter)
+{
+  GNUNET_free (iter);
+}
+
+
+/* end of container_multiuuidmap.c */
diff --git a/src/lib/util/crypto_blind_sign.c b/src/lib/util/crypto_blind_sign.c
new file mode 100644
index 000000000..33a587acd
--- /dev/null
+++ b/src/lib/util/crypto_blind_sign.c
@@ -0,0 +1,712 @@
+/*
+  This file is part of GNUNET
+  Copyright (C) 2021, 2022, 2023 GNUnet e.V.
+
+  GNUNET is free software; you can redistribute it and/or modify it under the
+  terms of the GNU General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  GNUNET is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License along with
+  GNUNET; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file crypto_blind_sign.c
+ * @brief blind signatures (abstraction over RSA or CS)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+void
+GNUNET_CRYPTO_blinding_input_values_decref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm)
+{
+  GNUNET_assert (bm->rc > 0);
+  bm->rc--;
+  if (0 != bm->rc)
+    return;
+  switch (bm->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    bm->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    bm->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (bm);
+}
+
+
+void
+GNUNET_CRYPTO_blind_sign_priv_decref (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv)
+{
+  GNUNET_assert (bsign_priv->rc > 0);
+  bsign_priv->rc--;
+  if (0 != bsign_priv->rc)
+    return;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != bsign_priv->details.rsa_private_key)
+    {
+      GNUNET_CRYPTO_rsa_private_key_free (bsign_priv->details.rsa_private_key);
+      bsign_priv->details.rsa_private_key = NULL;
+    }
+    bsign_priv->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    bsign_priv->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (bsign_priv);
+}
+
+
+void
+GNUNET_CRYPTO_blind_sign_pub_decref (struct
+                                     GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  GNUNET_assert (bsign_pub->rc > 0);
+  bsign_pub->rc--;
+  if (0 != bsign_pub->rc)
+    return;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != bsign_pub->details.rsa_public_key)
+    {
+      GNUNET_CRYPTO_rsa_public_key_free (bsign_pub->details.rsa_public_key);
+      bsign_pub->details.rsa_public_key = NULL;
+    }
+    bsign_pub->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    break;
+  }
+  GNUNET_free (bsign_pub);
+}
+
+
+void
+GNUNET_CRYPTO_unblinded_sig_decref (struct
+                                    GNUNET_CRYPTO_UnblindedSignature *ub_sig)
+{
+  GNUNET_assert (ub_sig->rc > 0);
+  ub_sig->rc--;
+  if (0 != ub_sig->rc)
+    return;
+  switch (ub_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != ub_sig->details.rsa_signature)
+    {
+      GNUNET_CRYPTO_rsa_signature_free (ub_sig->details.rsa_signature);
+      ub_sig->details.rsa_signature = NULL;
+    }
+    ub_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    ub_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (ub_sig);
+}
+
+
+void
+GNUNET_CRYPTO_blinded_sig_decref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig)
+{
+  GNUNET_assert (blind_sig->rc > 0);
+  blind_sig->rc--;
+  if (0 != blind_sig->rc)
+    return;
+  switch (blind_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != blind_sig->details.blinded_rsa_signature)
+    {
+      GNUNET_CRYPTO_rsa_signature_free (
+        blind_sig->details.blinded_rsa_signature);
+      blind_sig->details.blinded_rsa_signature = NULL;
+    }
+    blind_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    blind_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (blind_sig);
+}
+
+
+void
+GNUNET_CRYPTO_blinded_message_decref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm)
+{
+  GNUNET_assert (bm->rc > 0);
+  bm->rc--;
+  if (0 != bm->rc)
+    return;
+  switch (bm->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    GNUNET_free (bm->details.rsa_blinded_message.blinded_msg);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    break;
+  }
+  GNUNET_free (bm);
+}
+
+
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_blinded_message_incref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm)
+{
+  bm->rc++;
+  return bm;
+}
+
+
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_blinding_input_values_incref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm)
+{
+  bm->rc++;
+  return bm;
+}
+
+
+struct GNUNET_CRYPTO_BlindSignPublicKey *
+GNUNET_CRYPTO_bsign_pub_incref (
+  struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  bsign_pub->rc++;
+  return bsign_pub;
+}
+
+
+struct GNUNET_CRYPTO_BlindSignPrivateKey *
+GNUNET_CRYPTO_bsign_priv_incref (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv)
+{
+  bsign_priv->rc++;
+  return bsign_priv;
+}
+
+
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_ub_sig_incref (struct GNUNET_CRYPTO_UnblindedSignature *ub_sig)
+{
+  ub_sig->rc++;
+  return ub_sig;
+}
+
+
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sig_incref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig)
+{
+  blind_sig->rc++;
+  return blind_sig;
+}
+
+
+int
+GNUNET_CRYPTO_bsign_pub_cmp (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp1,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp2)
+{
+  if (bp1->cipher != bp2->cipher)
+    return (bp1->cipher > bp2->cipher) ? 1 : -1;
+  switch (bp1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_memcmp (&bp1->pub_key_hash,
+                          &bp2->pub_key_hash);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&bp1->pub_key_hash,
+                          &bp2->pub_key_hash);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_ub_sig_cmp (
+  const struct GNUNET_CRYPTO_UnblindedSignature *sig1,
+  const struct GNUNET_CRYPTO_UnblindedSignature *sig2)
+{
+  if (sig1->cipher != sig2->cipher)
+    return (sig1->cipher > sig2->cipher) ? 1 : -1;
+  switch (sig1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_CRYPTO_rsa_signature_cmp (sig1->details.rsa_signature,
+                                            sig2->details.rsa_signature);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&sig1->details.cs_signature,
+                          &sig2->details.cs_signature);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_blind_sig_cmp (
+  const struct GNUNET_CRYPTO_BlindedSignature *sig1,
+  const struct GNUNET_CRYPTO_BlindedSignature *sig2)
+{
+  if (sig1->cipher != sig2->cipher)
+    return (sig1->cipher > sig2->cipher) ? 1 : -1;
+  switch (sig1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_CRYPTO_rsa_signature_cmp (sig1->details.blinded_rsa_signature,
+                                            sig2->details.blinded_rsa_signature);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&sig1->details.blinded_cs_answer,
+                          &sig2->details.blinded_cs_answer);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_blinded_message_cmp (
+  const struct GNUNET_CRYPTO_BlindedMessage *bp1,
+  const struct GNUNET_CRYPTO_BlindedMessage *bp2)
+{
+  if (bp1->cipher != bp2->cipher)
+    return (bp1->cipher > bp2->cipher) ? 1 : -1;
+  switch (bp1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (bp1->details.rsa_blinded_message.blinded_msg_size !=
+        bp2->details.rsa_blinded_message.blinded_msg_size)
+      return (bp1->details.rsa_blinded_message.blinded_msg_size >
+              bp2->details.rsa_blinded_message.blinded_msg_size) ? 1 : -1;
+    return memcmp (bp1->details.rsa_blinded_message.blinded_msg,
+                   bp2->details.rsa_blinded_message.blinded_msg,
+                   bp1->details.rsa_blinded_message.blinded_msg_size);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&bp1->details.cs_blinded_message,
+                          &bp2->details.cs_blinded_message);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  ...)
+{
+  enum GNUNET_GenericReturnValue ret;
+  va_list ap;
+
+  va_start (ap,
+            cipher);
+  ret = GNUNET_CRYPTO_blind_sign_keys_create_va (bsign_priv,
+                                                 bsign_pub,
+                                                 cipher,
+                                                 ap);
+  va_end (ap);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create_va (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  va_list ap)
+{
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *priv;
+  struct GNUNET_CRYPTO_BlindSignPublicKey *pub;
+
+  priv = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPrivateKey);
+  priv->rc = 1;
+  priv->cipher = cipher;
+  *bsign_priv = priv;
+  pub = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPublicKey);
+  pub->rc = 1;
+  pub->cipher = cipher;
+  *bsign_pub = pub;
+  switch (cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    {
+      unsigned int bits;
+
+      bits = va_arg (ap,
+                     unsigned int);
+      if (bits < 512)
+      {
+        GNUNET_break (0);
+        break;
+      }
+      priv->details.rsa_private_key
+        = GNUNET_CRYPTO_rsa_private_key_create (bits);
+    }
+    if (NULL == priv->details.rsa_private_key)
+    {
+      GNUNET_break (0);
+      break;
+    }
+    pub->details.rsa_public_key
+      = GNUNET_CRYPTO_rsa_private_key_get_public (
+          priv->details.rsa_private_key);
+    GNUNET_CRYPTO_rsa_public_key_hash (pub->details.rsa_public_key,
+                                       &pub->pub_key_hash);
+    return GNUNET_OK;
+  case GNUNET_CRYPTO_BSA_CS:
+    GNUNET_CRYPTO_cs_private_key_generate (&priv->details.cs_private_key);
+    GNUNET_CRYPTO_cs_private_key_get_public (
+      &priv->details.cs_private_key,
+      &pub->details.cs_public_key);
+    GNUNET_CRYPTO_hash (&pub->details.cs_public_key,
+                        sizeof(pub->details.cs_public_key),
+                        &pub->pub_key_hash);
+    return GNUNET_OK;
+  }
+  GNUNET_free (priv);
+  GNUNET_free (pub);
+  *bsign_priv = NULL;
+  *bsign_pub = NULL;
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_get_blinding_input_values (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const char *salt)
+{
+  struct GNUNET_CRYPTO_BlindingInputValues *biv;
+
+  biv = GNUNET_new (struct GNUNET_CRYPTO_BlindingInputValues);
+  biv->cipher = bsign_priv->cipher;
+  biv->rc = 1;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (biv);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return biv;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsRSecret cspriv[2];
+
+      GNUNET_CRYPTO_cs_r_derive (&nonce->cs_nonce,
+                                 salt,
+                                 &bsign_priv->details.cs_private_key,
+                                 cspriv);
+      GNUNET_CRYPTO_cs_r_get_public (&cspriv[0],
+                                     &biv->details.cs_values.r_pub[0]);
+      GNUNET_CRYPTO_cs_r_get_public (&cspriv[1],
+                                     &biv->details.cs_values.r_pub[1]);
+      return biv;
+    }
+  }
+  GNUNET_break (0);
+  GNUNET_free (biv);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_message_blind_to_sign (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values)
+{
+  struct GNUNET_CRYPTO_BlindedMessage *bm;
+
+  bm = GNUNET_new (struct GNUNET_CRYPTO_BlindedMessage);
+  bm->cipher = bsign_pub->cipher;
+  bm->rc = 1;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (bm);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (GNUNET_YES !=
+        GNUNET_CRYPTO_rsa_blind (
+          message,
+          message_size,
+          &bks->rsa_bks,
+          bsign_pub->details.rsa_public_key,
+          &bm->details.rsa_blinded_message))
+    {
+      GNUNET_break (0);
+      GNUNET_free (bm);
+      return NULL;
+    }
+    return bm;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CSPublicRPairP blinded_r_pub;
+      struct GNUNET_CRYPTO_CsBlindingSecret bs[2];
+
+      if (NULL == nonce)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (bm);
+        return NULL;
+      }
+      GNUNET_CRYPTO_cs_blinding_secrets_derive (&bks->nonce,
+                                                bs);
+      GNUNET_CRYPTO_cs_calc_blinded_c (
+        bs,
+        alg_values->details.cs_values.r_pub,
+        &bsign_pub->details.cs_public_key,
+        message,
+        message_size,
+        bm->details.cs_blinded_message.c,
+        &blinded_r_pub);
+      bm->details.cs_blinded_message.nonce = nonce->cs_nonce;
+      (void) blinded_r_pub;
+      return bm;
+    }
+  }
+  GNUNET_break (0);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sign (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const char *salt,
+  const struct GNUNET_CRYPTO_BlindedMessage *blinded_message)
+{
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig;
+
+  if (blinded_message->cipher != bsign_priv->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+
+  blind_sig = GNUNET_new (struct GNUNET_CRYPTO_BlindedSignature);
+  blind_sig->cipher = bsign_priv->cipher;
+  blind_sig->rc = 1;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (blind_sig);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    blind_sig->details.blinded_rsa_signature
+      = GNUNET_CRYPTO_rsa_sign_blinded (
+          bsign_priv->details.rsa_private_key,
+          &blinded_message->details.rsa_blinded_message);
+    if (NULL == blind_sig->details.blinded_rsa_signature)
+    {
+      GNUNET_break (0);
+      GNUNET_free (blind_sig);
+      return NULL;
+    }
+    return blind_sig;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsRSecret r[2];
+
+      GNUNET_CRYPTO_cs_r_derive (
+        &blinded_message->details.cs_blinded_message.nonce,
+        salt,
+        &bsign_priv->details.cs_private_key,
+        r);
+      GNUNET_CRYPTO_cs_sign_derive (
+        &bsign_priv->details.cs_private_key,
+        r,
+        &blinded_message->details.cs_blinded_message,
+        &blind_sig->details.blinded_cs_answer);
+    }
+    return blind_sig;
+  }
+  GNUNET_break (0);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_blind_sig_unblind (
+  const struct GNUNET_CRYPTO_BlindedSignature *blinded_sig,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  struct GNUNET_CRYPTO_UnblindedSignature *ub_sig;
+
+  if (blinded_sig->cipher != bsign_pub->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (blinded_sig->cipher != alg_values->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  ub_sig = GNUNET_new (struct GNUNET_CRYPTO_UnblindedSignature);
+  ub_sig->cipher = blinded_sig->cipher;
+  ub_sig->rc = 1;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (ub_sig);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    ub_sig->details.rsa_signature
+      = GNUNET_CRYPTO_rsa_unblind (
+          blinded_sig->details.blinded_rsa_signature,
+          &bks->rsa_bks,
+          bsign_pub->details.rsa_public_key);
+    if (NULL == ub_sig->details.rsa_signature)
+    {
+      GNUNET_break (0);
+      GNUNET_free (ub_sig);
+      return NULL;
+    }
+    return ub_sig;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsBlindingSecret bs[2];
+      struct GNUNET_CRYPTO_CsC c[2];
+      struct GNUNET_CRYPTO_CSPublicRPairP r_pub_blind;
+      unsigned int b;
+
+      GNUNET_CRYPTO_cs_blinding_secrets_derive (&bks->nonce,
+                                                bs);
+      GNUNET_CRYPTO_cs_calc_blinded_c (
+        bs,
+        alg_values->details.cs_values.r_pub,
+        &bsign_pub->details.cs_public_key,
+        message,
+        message_size,
+        c,
+        &r_pub_blind);
+      b = blinded_sig->details.blinded_cs_answer.b;
+      ub_sig->details.cs_signature.r_point
+        = r_pub_blind.r_pub[b];
+      GNUNET_CRYPTO_cs_unblind (
+        &blinded_sig->details.blinded_cs_answer.s_scalar,
+        &bs[b],
+        &ub_sig->details.cs_signature.s_scalar);
+      return ub_sig;
+    }
+  }
+  GNUNET_break (0);
+  GNUNET_free (ub_sig);
+  return NULL;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sig_verify (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const struct GNUNET_CRYPTO_UnblindedSignature *ub_sig,
+  const void *message,
+  size_t message_size)
+{
+  if (bsign_pub->cipher != ub_sig->cipher)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return GNUNET_NO;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_rsa_verify (message,
+                                  message_size,
+                                  ub_sig->details.rsa_signature,
+                                  bsign_pub->details.rsa_public_key))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  case GNUNET_CRYPTO_BSA_CS:
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_cs_verify (&ub_sig->details.cs_signature,
+                                 &bsign_pub->details.cs_public_key,
+                                 message,
+                                 message_size))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  }
+  GNUNET_break (0);
+  return GNUNET_NO;
+}
+
+
+/* end of crypto_blind_sign.c */
diff --git a/src/lib/util/crypto_crc.c b/src/lib/util/crypto_crc.c
new file mode 100644
index 000000000..f93b5b0b3
--- /dev/null
+++ b/src/lib/util/crypto_crc.c
@@ -0,0 +1,173 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+     For the actual CRC-32 code:
+     Copyright abandoned; this code is in the public domain.
+     Provided to GNUnet by peter@horizon.com
+ */
+
+/**
+ * @file util/crypto_crc.c
+ * @brief implementation of CRC16 and CRC32
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-crc", __VA_ARGS__)
+
+/* Avoid wasting space on 8-byte longs. */
+#if UINT_MAX >= 0xffffffff
+typedef unsigned int GNUNET_uLong;
+#elif ULONG_MAX >= 0xffffffff
+typedef unsigned long GNUNET_uLong;
+#else
+#error This compiler is not ANSI-compliant!
+#endif
+
+#define Z_NULL  0
+
+
+#define POLYNOMIAL (GNUNET_uLong) 0xedb88320
+static GNUNET_uLong crc_table[256];
+
+/*
+ * This routine writes each crc_table entry exactly once,
+ * with the correct final value.  Thus, it is safe to call
+ * even on a table that someone else is using concurrently.
+ */
+static void
+crc_init ()
+{
+  static int once;
+  GNUNET_uLong h = 1;
+
+  if (once)
+    return;
+  once = 1;
+  crc_table[0] = 0;
+  for (unsigned int i = 128; i; i >>= 1)
+  {
+    h = (h >> 1) ^ ((h & 1) ? POLYNOMIAL : 0);
+    /* h is now crc_table[i] */
+    for (unsigned int j = 0; j < 256; j += 2 * i)
+      crc_table[i + j] = crc_table[j] ^ h;
+  }
+}
+
+
+/*
+ * This computes the standard preset and inverted CRC, as used
+ * by most networking standards.  Start by passing in an initial
+ * chaining value of 0, and then pass in the return value from the
+ * previous crc32() call.  The final return value is the CRC.
+ * Note that this is a little-endian CRC, which is best used with
+ * data transmitted lsbit-first, and it should, itself, be appended
+ * to data in little-endian byte and bit order to preserve the
+ * property of detecting all burst errors of length 32 bits or less.
+ */
+static GNUNET_uLong
+gn_crc32 (GNUNET_uLong crc, const char *buf, size_t len)
+{
+  crc_init ();
+  GNUNET_assert (crc_table[255] != 0);
+  crc ^= 0xffffffff;
+  while (len--)
+    crc = (crc >> 8) ^ crc_table[(crc ^ *buf++) & 0xff];
+  return crc ^ 0xffffffff;
+}
+
+
+int32_t
+GNUNET_CRYPTO_crc32_n (const void *buf, size_t len)
+{
+  GNUNET_uLong crc;
+
+  crc = gn_crc32 (0L, Z_NULL, 0);
+  crc = gn_crc32 (crc, (char *) buf, len);
+  return crc;
+}
+
+
+uint32_t
+GNUNET_CRYPTO_crc16_step (uint32_t sum, const void *buf, size_t len)
+{
+  const uint16_t *hdr = buf;
+
+  for (; len >= 2; len -= 2)
+    sum += *(hdr++);
+  if (len == 1)
+    sum += ntohs(*((uint8_t *)hdr) << 8);
+  return sum;
+}
+
+
+uint16_t
+GNUNET_CRYPTO_crc16_finish (uint32_t sum)
+{
+  sum = (sum >> 16) + (sum & 0xFFFF);
+  sum += (sum >> 16);
+
+  return ~sum;
+}
+
+
+uint16_t
+GNUNET_CRYPTO_crc16_n (const void *buf, size_t len)
+{
+  const uint16_t *hdr = buf;
+  uint32_t sum = GNUNET_CRYPTO_crc16_step (0, hdr, len);
+
+  return GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * @ingroup hash
+ * Calculate the checksum of a buffer in one step.
+ *
+ * @param buf buffer to calculate CRC over
+ * @param len number of bytes in @a buf
+ * @return crc8 value
+ */
+uint8_t
+GNUNET_CRYPTO_crc8_n (const void *buf,
+                      size_t len)
+{
+  const uint8_t *data = buf;
+  unsigned int crc = 0;
+  int i;
+  int j;
+
+  for (j = len; 0 != j; j--)
+  {
+    crc ^= (*data++ << 8);
+    for (i = 8; 0 != i; i--)
+    {
+      if (0 != (crc & 0x8000))
+        crc ^= (0x1070 << 3);
+      crc <<= 1;
+    }
+  }
+  return (uint8_t) (crc >> 8);
+}
+
+
+/* end of crypto_crc.c */
diff --git a/src/lib/util/crypto_cs.c b/src/lib/util/crypto_cs.c
new file mode 100644
index 000000000..049f63062
--- /dev/null
+++ b/src/lib/util/crypto_cs.c
@@ -0,0 +1,366 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014,2016,2019, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_cs.c
+ * @brief Clause Blind Schnorr signatures using Curve25519
+ * @author Lucien Heuzeveldt <lucienclaude.heuzeveldt@students.bfh.ch>
+ * @author Gian Demarmels <gian@demarmels.org>
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <sodium.h>
+#include <gcrypt.h>
+
+/**
+ * IMPLEMENTATION NOTICE:
+ *
+ * This is an implementation of the Clause Blind Schnorr Signature Scheme using Curve25519.
+ * Further details about the Clause Blind Schnorr Signature Scheme can be found here:
+ * https://eprint.iacr.org/2019/877.pdf
+ *
+ * We use libsodium wherever possible.
+ */
+
+
+void
+GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
+{
+  crypto_core_ed25519_scalar_random (priv->scalar.d);
+}
+
+
+void
+GNUNET_CRYPTO_cs_private_key_get_public (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  struct GNUNET_CRYPTO_CsPublicKey *pub)
+{
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_base_noclamp (pub->point.y,
+                                                         priv->scalar.d));
+}
+
+
+/**
+ * Maps 32 random bytes to a scalar.  This is necessary because libsodium
+ * expects scalar to be in the prime order subgroup.
+ *
+ * @param[in,out] scalar containing 32 byte char array, is modified to be in prime order subgroup
+ */
+static void
+map_to_scalar_subgroup (struct GNUNET_CRYPTO_Cs25519Scalar *scalar)
+{
+  /* perform clamping as described in RFC7748 */
+  scalar->d[0] &= 248;
+  scalar->d[31] &= 127;
+  scalar->d[31] |= 64;
+}
+
+
+void
+GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsSessionNonce *nonce,
+                           const char *seed,
+                           const struct GNUNET_CRYPTO_CsPrivateKey *lts,
+                           struct GNUNET_CRYPTO_CsRSecret r[2])
+{
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CRYPTO_kdf (
+      r,     sizeof (struct GNUNET_CRYPTO_CsRSecret) * 2,
+      seed,  strlen (seed),
+      lts,   sizeof (*lts),
+      nonce, sizeof (*nonce),
+      NULL,  0));
+  map_to_scalar_subgroup (&r[0].scalar);
+  map_to_scalar_subgroup (&r[1].scalar);
+}
+
+
+void
+GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
+                               struct GNUNET_CRYPTO_CsRPublic *r_pub)
+{
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_base_noclamp (r_pub->point.y,
+                                                         r_priv->scalar.d));
+}
+
+
+void
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
+  const struct GNUNET_CRYPTO_CsBlindingNonce *blind_seed,
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
+{
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CRYPTO_hkdf (bs,
+                        sizeof (struct GNUNET_CRYPTO_CsBlindingSecret) * 2,
+                        GCRY_MD_SHA512,
+                        GCRY_MD_SHA256,
+                        "alphabeta",
+                        strlen ("alphabeta"),
+                        blind_seed,
+                        sizeof(*blind_seed),
+                        NULL,
+                        0));
+  map_to_scalar_subgroup (&bs[0].alpha);
+  map_to_scalar_subgroup (&bs[0].beta);
+  map_to_scalar_subgroup (&bs[1].alpha);
+  map_to_scalar_subgroup (&bs[1].beta);
+}
+
+
+/*
+order of subgroup required for scalars by libsodium
+2^252 + 27742317777372353535851937790883648493
+copied from https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
+and converted to big endian
+*/
+static const unsigned char L_BIG_ENDIAN[32] = {
+  0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7,
+  0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed
+};
+
+
+/**
+ * Computes a Hash of (R', m) mapped to a Curve25519 scalar
+ *
+ * @param hash initial hash of the message to be signed
+ * @param pub denomination public key (used as salt)
+ * @param[out] c C containing scalar
+ */
+static void
+cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash,
+                     const void *msg,
+                     size_t msg_len,
+                     const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                     struct GNUNET_CRYPTO_CsC *c)
+{
+  // SHA-512 hash of R' and message
+  size_t r_m_concat_len = sizeof(struct GNUNET_CRYPTO_CsRPublic) + msg_len;
+  char r_m_concat[r_m_concat_len];
+  memcpy (r_m_concat,
+          r_dash,
+          sizeof(struct GNUNET_CRYPTO_CsRPublic));
+  memcpy (r_m_concat + sizeof(struct GNUNET_CRYPTO_CsRPublic),
+          msg,
+          msg_len);
+  struct GNUNET_HashCode prehash;
+
+  GNUNET_CRYPTO_hash (r_m_concat,
+                      r_m_concat_len,
+                      &prehash);
+
+  // modulus converted to MPI representation
+  gcry_mpi_t l_mpi;
+  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi,
+                                   L_BIG_ENDIAN,
+                                   sizeof(L_BIG_ENDIAN));
+
+  // calculate full domain hash
+  gcry_mpi_t c_mpi;
+  GNUNET_CRYPTO_kdf_mod_mpi (&c_mpi,
+                             l_mpi,
+                             pub,
+                             sizeof(struct GNUNET_CRYPTO_CsPublicKey),
+                             &prehash,
+                             sizeof(struct GNUNET_HashCode),
+                             "Curve25519FDH");
+  gcry_mpi_release (l_mpi);
+
+  // convert c from mpi
+  unsigned char c_big_endian[256 / 8];
+  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian,
+                                    sizeof(c_big_endian),
+                                    c_mpi);
+  gcry_mpi_release (c_mpi);
+  for (size_t i = 0; i<32; i++)
+    c->scalar.d[i] = c_big_endian[31 - i];
+}
+
+
+/**
+ * calculate R'
+ *
+ * @param bs blinding secret
+ * @param r_pub R
+ * @param pub public key
+ * @param[out] blinded_r_pub R'
+ */
+static void
+calc_r_dash (const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+             const struct GNUNET_CRYPTO_CsRPublic *r_pub,
+             const struct GNUNET_CRYPTO_CsPublicKey *pub,
+             struct GNUNET_CRYPTO_CsRPublic *blinded_r_pub)
+{
+  // R'i = Ri + alpha i*G + beta i*pub
+  struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base;
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_base_noclamp (
+                   alpha_mul_base.y,
+                   bs->alpha.d));
+  struct GNUNET_CRYPTO_Cs25519Point beta_mul_pub;
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_noclamp (
+                   beta_mul_pub.y,
+                   bs->beta.d,
+                   pub->point.y));
+  struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base_plus_beta_mul_pub;
+  GNUNET_assert (0 == crypto_core_ed25519_add (
+                   alpha_mul_base_plus_beta_mul_pub.y,
+                   alpha_mul_base.y,
+                   beta_mul_pub.y));
+  GNUNET_assert (0 ==
+                 crypto_core_ed25519_add (
+                   blinded_r_pub->point.y,
+                   r_pub->point.y,
+                   alpha_mul_base_plus_beta_mul_pub.y));
+}
+
+
+void
+GNUNET_CRYPTO_cs_calc_blinded_c (
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const void *msg,
+  size_t msg_len,
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CSPublicRPairP *r_pub_blind)
+{
+  /* for i 0/1: R'i = Ri + alpha i*G + beta i*pub */
+  calc_r_dash (&bs[0],
+               &r_pub[0],
+               pub,
+               &r_pub_blind->r_pub[0]);
+  calc_r_dash (&bs[1],
+               &r_pub[1],
+               pub,
+               &r_pub_blind->r_pub[1]);
+
+  /* for i 0/1: c'i = H(R'i, msg) */
+  struct GNUNET_CRYPTO_CsC c_dash_0;
+  struct GNUNET_CRYPTO_CsC c_dash_1;
+  cs_full_domain_hash (&r_pub_blind->r_pub[0],
+                       msg,
+                       msg_len,
+                       pub,
+                       &c_dash_0);
+  cs_full_domain_hash (&r_pub_blind->r_pub[1],
+                       msg,
+                       msg_len,
+                       pub,
+                       &c_dash_1);
+
+  /* for i 0/1: ci = c'i + beta i mod p */
+  crypto_core_ed25519_scalar_add (blinded_c[0].scalar.d,
+                                  c_dash_0.scalar.d,
+                                  bs[0].beta.d);
+  crypto_core_ed25519_scalar_add (blinded_c[1].scalar.d,
+                                  c_dash_1.scalar.d,
+                                  bs[1].beta.d);
+}
+
+
+void
+GNUNET_CRYPTO_cs_sign_derive (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsBlindedMessage *bm,
+  struct GNUNET_CRYPTO_CsBlindSignature *cs_blind_sig)
+{
+  struct GNUNET_CRYPTO_Cs25519Scalar c_b_mul_priv;
+  uint32_t hkdf_out;
+
+  /* derive clause session identifier b (random bit) */
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_hkdf (&hkdf_out,
+                                     sizeof (hkdf_out),
+                                     GCRY_MD_SHA512,
+                                     GCRY_MD_SHA256,
+                                     "b",
+                                     strlen ("b"),
+                                     priv,
+                                     sizeof (*priv),
+                                     &bm->nonce,
+                                     sizeof (bm->nonce),
+                                     NULL,
+                                     0));
+  cs_blind_sig->b = hkdf_out % 2;
+
+  /* s = r_b + c_b * priv */
+  crypto_core_ed25519_scalar_mul (c_b_mul_priv.d,
+                                  bm->c[cs_blind_sig->b].scalar.d,
+                                  priv->scalar.d);
+  crypto_core_ed25519_scalar_add (cs_blind_sig->s_scalar.scalar.d,
+                                  r[cs_blind_sig->b].scalar.d,
+                                  c_b_mul_priv.d);
+}
+
+
+void
+GNUNET_CRYPTO_cs_unblind (
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  struct GNUNET_CRYPTO_CsS *signature_scalar)
+{
+  crypto_core_ed25519_scalar_add (signature_scalar->scalar.d,
+                                  blinded_signature_scalar->scalar.d,
+                                  bs->alpha.d);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
+                         const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                         const void *msg,
+                         size_t msg_len)
+{
+  // calculate c' = H(R, m)
+  struct GNUNET_CRYPTO_CsC c_dash;
+
+  cs_full_domain_hash (&sig->r_point,
+                       msg,
+                       msg_len,
+                       pub,
+                       &c_dash);
+
+  // s'G ?= R' + c' pub
+  struct GNUNET_CRYPTO_Cs25519Point sig_scal_mul_base;
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_base_noclamp (
+                   sig_scal_mul_base.y,
+                   sig->s_scalar.scalar.d));
+  struct GNUNET_CRYPTO_Cs25519Point c_dash_mul_pub;
+  GNUNET_assert (0 == crypto_scalarmult_ed25519_noclamp (c_dash_mul_pub.y,
+                                                         c_dash.scalar.d,
+                                                         pub->point.y));
+  struct GNUNET_CRYPTO_Cs25519Point R_add_c_dash_mul_pub;
+  GNUNET_assert (0 == crypto_core_ed25519_add (R_add_c_dash_mul_pub.y,
+                                               sig->r_point.point.y,
+                                               c_dash_mul_pub.y));
+
+  return 0 == GNUNET_memcmp (&sig_scal_mul_base,
+                             &R_add_c_dash_mul_pub)
+    ? GNUNET_OK
+    : GNUNET_SYSERR;
+}
diff --git a/src/lib/util/crypto_ecc.c b/src/lib/util/crypto_ecc.c
new file mode 100644
index 000000000..8ea17fda0
--- /dev/null
+++ b/src/lib/util/crypto_ecc.c
@@ -0,0 +1,971 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_ecc.c
+ * @brief public key cryptography (ECC) with libgcrypt
+ * @author Christian Grothoff
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include <sodium.h>
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+
+#define EXTRA_CHECKS 0
+
+/**
+ * IMPLEMENTATION NOTICE:
+ *
+ * ECDSA: We use a non-standard curve for ECDSA: Ed25519.
+ * For performance reasons, we use cryptographic operations from
+ * libsodium wherever we can get away with it, even though libsodium
+ * itself does not support ECDSA.
+ * This is why the sign and verifiy functionality from libgcrypt is
+ * required and used.
+ *
+ * EdDSA: We use a standard EdDSA construction.
+ * (We still use libgcrypt for hashing and RNG, but not EC)
+ *
+ * ECDHE: For both EdDSA and ECDSA keys, we use libsodium for
+ * ECDHE due to performance benefits over libgcrypt.
+ */
+
+/**
+ * Name of the curve we are using.  Note that we have hard-coded
+ * structs that use 256 bits, so using a bigger curve will require
+ * changes that break stuff badly.  The name of the curve given here
+ * must be agreed by all peers and be supported by libgcrypt.
+ */
+#define CURVE "Ed25519"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-ecc", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+        GNUNET_log_from_strerror (kind, "util-crypto-ecc", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+        GNUNET_log_from_strerror_file (kind, "util-crypto-ecc", syscall, \
+                                       filename)
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' with the message given
+ * by gcry_strerror(rc).
+ */
+#define LOG_GCRY(level, cmd, rc)                      \
+        do                                                  \
+        {                                                   \
+          LOG (level,                                       \
+               _ ("`%s' failed at %s:%d with error: %s\n"), \
+               cmd,                                         \
+               __FILE__,                                    \
+               __LINE__,                                    \
+               gcry_strerror (rc));                         \
+        } while (0)
+
+
+/**
+ * Extract values from an S-expression.
+ *
+ * @param array where to store the result(s)
+ * @param sexp S-expression to parse
+ * @param topname top-level name in the S-expression that is of interest
+ * @param elems names of the elements to extract
+ * @return 0 on success
+ */
+static int
+key_from_sexp (gcry_mpi_t *array,
+               gcry_sexp_t sexp,
+               const char *topname,
+               const char *elems)
+{
+  gcry_sexp_t list;
+  gcry_sexp_t l2;
+  unsigned int idx;
+
+  list = gcry_sexp_find_token (sexp, topname, 0);
+  if (! list)
+    return 1;
+  l2 = gcry_sexp_cadr (list);
+  gcry_sexp_release (list);
+  list = l2;
+  if (! list)
+    return 2;
+
+  idx = 0;
+  for (const char *s = elems; *s; s++, idx++)
+  {
+    l2 = gcry_sexp_find_token (list, s, 1);
+    if (! l2)
+    {
+      for (unsigned int i = 0; i < idx; i++)
+      {
+        gcry_free (array[i]);
+        array[i] = NULL;
+      }
+      gcry_sexp_release (list);
+      return 3;     /* required parameter not found */
+    }
+    array[idx] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
+    gcry_sexp_release (l2);
+    if (! array[idx])
+    {
+      for (unsigned int i = 0; i < idx; i++)
+      {
+        gcry_free (array[i]);
+        array[i] = NULL;
+      }
+      gcry_sexp_release (list);
+      return 4;     /* required parameter is invalid */
+    }
+  }
+  gcry_sexp_release (list);
+  return 0;
+}
+
+
+/**
+ * Convert the given private key from the network format to the
+ * S-expression that can be used by libgcrypt.
+ *
+ * @param priv private key to decode
+ * @return NULL on error
+ */
+static gcry_sexp_t
+decode_private_ecdsa_key (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv)
+{
+  gcry_sexp_t result;
+  int rc;
+  uint8_t d[32];
+
+  for (size_t i = 0; i<32; i++)
+    d[i] = priv->d[31 - i];
+
+  rc = gcry_sexp_build (&result,
+                        NULL,
+                        "(private-key(ecc(curve \"" CURVE "\")"
+                        "(d %b)))",
+                        32,
+                        d);
+  if (0 != rc)
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
+    GNUNET_assert (0);
+  }
+#if EXTRA_CHECKS
+  if (0 != (rc = gcry_pk_testkey (result)))
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_pk_testkey", rc);
+    GNUNET_assert (0);
+  }
+#endif
+  return result;
+}
+
+
+void
+GNUNET_CRYPTO_ecdsa_key_get_public (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+  struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
+{
+  BENCHMARK_START (ecdsa_key_get_public);
+  crypto_scalarmult_ed25519_base_noclamp (pub->q_y, priv->d);
+  BENCHMARK_END (ecdsa_key_get_public);
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_key_get_public (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  struct GNUNET_CRYPTO_EddsaPublicKey *pub)
+{
+  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
+  unsigned char sk[crypto_sign_SECRETKEYBYTES];
+
+  BENCHMARK_START (eddsa_key_get_public);
+  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
+  GNUNET_memcpy (pub->q_y, pk, crypto_sign_PUBLICKEYBYTES);
+  sodium_memzero (sk, crypto_sign_SECRETKEYBYTES);
+  BENCHMARK_END (eddsa_key_get_public);
+}
+
+
+void
+GNUNET_CRYPTO_ecdhe_key_get_public (
+  const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
+  struct GNUNET_CRYPTO_EcdhePublicKey *pub)
+{
+  BENCHMARK_START (ecdhe_key_get_public);
+  GNUNET_assert (0 == crypto_scalarmult_base (pub->q_y, priv->d));
+  BENCHMARK_END (ecdhe_key_get_public);
+}
+
+
+char *
+GNUNET_CRYPTO_ecdsa_public_key_to_string (
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
+{
+  char *pubkeybuf;
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) * 8;
+  char *end;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  pubkeybuf = GNUNET_malloc (keylen + 1);
+  end =
+    GNUNET_STRINGS_data_to_string ((unsigned char *) pub,
+                                   sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                                   pubkeybuf,
+                                   keylen);
+  if (NULL == end)
+  {
+    GNUNET_free (pubkeybuf);
+    return NULL;
+  }
+  *end = '\0';
+  return pubkeybuf;
+}
+
+
+char *
+GNUNET_CRYPTO_eddsa_public_key_to_string (
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
+{
+  char *pubkeybuf;
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EddsaPublicKey)) * 8;
+  char *end;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  pubkeybuf = GNUNET_malloc (keylen + 1);
+  end =
+    GNUNET_STRINGS_data_to_string ((unsigned char *) pub,
+                                   sizeof(struct GNUNET_CRYPTO_EddsaPublicKey),
+                                   pubkeybuf,
+                                   keylen);
+  if (NULL == end)
+  {
+    GNUNET_free (pubkeybuf);
+    return NULL;
+  }
+  *end = '\0';
+  return pubkeybuf;
+}
+
+
+char *
+GNUNET_CRYPTO_eddsa_private_key_to_string (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  char *privkeybuf;
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey)) * 8;
+  char *end;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  privkeybuf = GNUNET_malloc (keylen + 1);
+  end = GNUNET_STRINGS_data_to_string ((unsigned char *) priv,
+                                       sizeof(
+                                         struct GNUNET_CRYPTO_EddsaPrivateKey),
+                                       privkeybuf,
+                                       keylen);
+  if (NULL == end)
+  {
+    GNUNET_free (privkeybuf);
+    return NULL;
+  }
+  *end = '\0';
+  return privkeybuf;
+}
+
+
+char *
+GNUNET_CRYPTO_ecdsa_private_key_to_string (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv)
+{
+  char *privkeybuf;
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey)) * 8;
+  char *end;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  privkeybuf = GNUNET_malloc (keylen + 1);
+  end = GNUNET_STRINGS_data_to_string ((unsigned char *) priv,
+                                       sizeof(
+                                         struct GNUNET_CRYPTO_EcdsaPrivateKey),
+                                       privkeybuf,
+                                       keylen);
+  if (NULL == end)
+  {
+    GNUNET_free (privkeybuf);
+    return NULL;
+  }
+  *end = '\0';
+  return privkeybuf;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_public_key_from_string (
+  const char *enc,
+  size_t enclen,
+  struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
+{
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)) * 8;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  if (enclen != keylen)
+    return GNUNET_SYSERR;
+
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc,
+                                     enclen,
+                                     pub,
+                                     sizeof(
+                                       struct GNUNET_CRYPTO_EcdsaPublicKey)))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_public_key_from_string (
+  const char *enc,
+  size_t enclen,
+  struct GNUNET_CRYPTO_EddsaPublicKey *pub)
+{
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EddsaPublicKey)) * 8;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  if (enclen != keylen)
+    return GNUNET_SYSERR;
+
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc,
+                                     enclen,
+                                     pub,
+                                     sizeof(
+                                       struct GNUNET_CRYPTO_EddsaPublicKey)))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_private_key_from_string (
+  const char *enc,
+  size_t enclen,
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  size_t keylen = (sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey)) * 8;
+
+  if (keylen % 5 > 0)
+    keylen += 5 - keylen % 5;
+  keylen /= 5;
+  if (enclen != keylen)
+    return GNUNET_SYSERR;
+
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (enc,
+                                     enclen,
+                                     priv,
+                                     sizeof(
+                                       struct GNUNET_CRYPTO_EddsaPrivateKey)))
+    return GNUNET_SYSERR;
+#if CRYPTO_BUG
+  if (GNUNET_OK != check_eddsa_key (priv))
+  {
+    GNUNET_break (0);
+    return GNUNET_OK;
+  }
+#endif
+  return GNUNET_OK;
+}
+
+
+static void
+buffer_clear (void *buf, size_t len)
+{
+#if HAVE_MEMSET_S
+  memset_s (buf, len, 0, len);
+#elif HAVE_EXPLICIT_BZERO
+  explicit_bzero (buf, len);
+#else
+  volatile unsigned char *p = buf;
+  while (len--)
+    *p++ = 0;
+#endif
+}
+
+
+void
+GNUNET_CRYPTO_ecdhe_key_clear (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
+{
+  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EcdhePrivateKey));
+}
+
+
+void
+GNUNET_CRYPTO_ecdsa_key_clear (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
+{
+  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_key_clear (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
+{
+  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey));
+}
+
+
+void
+GNUNET_CRYPTO_ecdhe_key_create (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
+{
+  BENCHMARK_START (ecdhe_key_create);
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                              pk,
+                              sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+  BENCHMARK_END (ecdhe_key_create);
+}
+
+
+void
+GNUNET_CRYPTO_ecdsa_key_create (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
+{
+  BENCHMARK_START (ecdsa_key_create);
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                              pk,
+                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
+  pk->d[0] &= 248;
+  pk->d[31] &= 127;
+  pk->d[31] |= 64;
+
+  BENCHMARK_END (ecdsa_key_create);
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
+{
+  BENCHMARK_START (eddsa_key_create);
+  /*
+   * We do not clamp for EdDSA, since all functions that use the private key do
+   * their own clamping (just like in libsodium).  What we call "private key"
+   * here, actually corresponds to the seed in libsodium.
+   *
+   * (Contrast this to ECDSA, where functions using the private key can't clamp
+   * due to properties needed for GNS.  That is a worse/unsafer API, but
+   * required for the GNS constructions to work.)
+   */
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                              pk,
+                              sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+  BENCHMARK_END (eddsa_key_create);
+}
+
+
+const struct GNUNET_CRYPTO_EcdsaPrivateKey *
+GNUNET_CRYPTO_ecdsa_key_get_anonymous ()
+{
+  /**
+   * 'anonymous' pseudonym (global static, d=1, public key = G
+   * (generator).
+   */
+  static struct GNUNET_CRYPTO_EcdsaPrivateKey anonymous;
+  static int once;
+
+  if (once)
+    return &anonymous;
+  GNUNET_CRYPTO_mpi_print_unsigned (anonymous.d,
+                                    sizeof(anonymous.d),
+                                    GCRYMPI_CONST_ONE);
+  anonymous.d[0] &= 248;
+  anonymous.d[31] &= 127;
+  anonymous.d[31] |= 64;
+
+  once = 1;
+  return &anonymous;
+}
+
+
+/**
+ * Convert the data specified in the given purpose argument to an
+ * S-expression suitable for signature operations.
+ *
+ * @param purpose data to convert
+ * @return converted s-expression
+ */
+static gcry_sexp_t
+data_to_ecdsa_value (const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose)
+{
+  gcry_sexp_t data;
+  int rc;
+  /* Unlike EdDSA, libgcrypt expects a hash for ECDSA. */
+  struct GNUNET_HashCode hc;
+
+  GNUNET_CRYPTO_hash (purpose, ntohl (purpose->size), &hc);
+  if (0 != (rc = gcry_sexp_build (&data,
+                                  NULL,
+                                  "(data(flags rfc6979)(hash %s %b))",
+                                  "sha512",
+                                  (int) sizeof(hc),
+                                  &hc)))
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
+    return NULL;
+  }
+  return data;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_sign_ (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_EcdsaSignature *sig)
+{
+  gcry_sexp_t priv_sexp;
+  gcry_sexp_t sig_sexp;
+  gcry_sexp_t data;
+  int rc;
+  gcry_mpi_t rs[2];
+
+  BENCHMARK_START (ecdsa_sign);
+
+  priv_sexp = decode_private_ecdsa_key (priv);
+  data = data_to_ecdsa_value (purpose);
+  if (0 != (rc = gcry_pk_sign (&sig_sexp, data, priv_sexp)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("ECC signing failed at %s:%d: %s\n"),
+         __FILE__,
+         __LINE__,
+         gcry_strerror (rc));
+    gcry_sexp_release (data);
+    gcry_sexp_release (priv_sexp);
+    return GNUNET_SYSERR;
+  }
+  gcry_sexp_release (priv_sexp);
+  gcry_sexp_release (data);
+
+  /* extract 'r' and 's' values from sexpression 'sig_sexp' and store in
+     'signature' */
+  if (0 != (rc = key_from_sexp (rs, sig_sexp, "sig-val", "rs")))
+  {
+    GNUNET_break (0);
+    gcry_sexp_release (sig_sexp);
+    return GNUNET_SYSERR;
+  }
+  gcry_sexp_release (sig_sexp);
+  GNUNET_CRYPTO_mpi_print_unsigned (sig->r, sizeof(sig->r), rs[0]);
+  GNUNET_CRYPTO_mpi_print_unsigned (sig->s, sizeof(sig->s), rs[1]);
+  gcry_mpi_release (rs[0]);
+  gcry_mpi_release (rs[1]);
+
+  BENCHMARK_END (ecdsa_sign);
+
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_sign_raw (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  void *data,
+  size_t size,
+  struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  unsigned char sk[crypto_sign_SECRETKEYBYTES];
+  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
+  int res;
+
+  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
+  res = crypto_sign_detached ((uint8_t *) sig,
+                              NULL,
+                              (uint8_t *) data,
+                              size,
+                              sk);
+  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_sign_ (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+
+  size_t mlen = ntohl (purpose->size);
+  unsigned char sk[crypto_sign_SECRETKEYBYTES];
+  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
+  int res;
+
+  BENCHMARK_START (eddsa_sign);
+  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
+  res = crypto_sign_detached ((uint8_t *) sig,
+                              NULL,
+                              (uint8_t *) purpose,
+                              mlen,
+                              sk);
+  BENCHMARK_END (eddsa_sign);
+  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_verify_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const struct GNUNET_CRYPTO_EcdsaSignature *sig,
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
+{
+  gcry_sexp_t data;
+  gcry_sexp_t sig_sexpr;
+  gcry_sexp_t pub_sexpr;
+  int rc;
+
+  BENCHMARK_START (ecdsa_verify);
+
+  if (purpose != ntohl (validate->purpose))
+    return GNUNET_SYSERR; /* purpose mismatch */
+
+  /* build s-expression for signature */
+  if (0 != (rc = gcry_sexp_build (&sig_sexpr,
+                                  NULL,
+                                  "(sig-val(ecdsa(r %b)(s %b)))",
+                                  (int) sizeof(sig->r),
+                                  sig->r,
+                                  (int) sizeof(sig->s),
+                                  sig->s)))
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
+    return GNUNET_SYSERR;
+  }
+  data = data_to_ecdsa_value (validate);
+  if (0 != (rc = gcry_sexp_build (&pub_sexpr,
+                                  NULL,
+                                  "(public-key(ecc(curve " CURVE ")(q %b)))",
+                                  (int) sizeof(pub->q_y),
+                                  pub->q_y)))
+  {
+    gcry_sexp_release (data);
+    gcry_sexp_release (sig_sexpr);
+    return GNUNET_SYSERR;
+  }
+  rc = gcry_pk_verify (sig_sexpr, data, pub_sexpr);
+  gcry_sexp_release (pub_sexpr);
+  gcry_sexp_release (data);
+  gcry_sexp_release (sig_sexpr);
+  if (0 != rc)
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         _ ("ECDSA signature verification failed at %s:%d: %s\n"),
+         __FILE__,
+         __LINE__,
+         gcry_strerror (rc));
+    BENCHMARK_END (ecdsa_verify);
+    return GNUNET_SYSERR;
+  }
+  BENCHMARK_END (ecdsa_verify);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_verify_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const struct GNUNET_CRYPTO_EddsaSignature *sig,
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
+{
+  const unsigned char *m = (const void *) validate;
+  size_t mlen = ntohl (validate->size);
+  const unsigned char *s = (const void *) sig;
+
+  int res;
+
+  if (purpose != ntohl (validate->purpose))
+    return GNUNET_SYSERR; /* purpose mismatch */
+
+  BENCHMARK_START (eddsa_verify);
+
+  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
+  BENCHMARK_END (eddsa_verify);
+  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecc_ecdh (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
+                        const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+                        struct GNUNET_HashCode *key_material)
+{
+  uint8_t p[crypto_scalarmult_BYTES];
+  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
+    return GNUNET_SYSERR;
+  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_ecdh (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                          const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+                          struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode hc;
+  uint8_t a[crypto_scalarmult_SCALARBYTES];
+  uint8_t p[crypto_scalarmult_BYTES];
+
+  GNUNET_CRYPTO_hash (priv,
+                      sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey),
+                      &hc);
+  memcpy (a, &hc, sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+  if (0 != crypto_scalarmult (p, a, pub->q_y))
+    return GNUNET_SYSERR;
+  GNUNET_CRYPTO_hash (p,
+                      crypto_scalarmult_BYTES,
+                      key_material);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_kem_decaps (const struct
+                                GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                                const struct GNUNET_CRYPTO_EcdhePublicKey *c,
+                                struct GNUNET_HashCode *key_material)
+{
+  return GNUNET_CRYPTO_eddsa_ecdh (priv, c, key_material);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_ecdh (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+                          const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+                          struct GNUNET_HashCode *key_material)
+{
+  uint8_t p[crypto_scalarmult_BYTES];
+
+  BENCHMARK_START (ecdsa_ecdh);
+  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
+    return GNUNET_SYSERR;
+  GNUNET_CRYPTO_hash (p,
+                      crypto_scalarmult_BYTES,
+                      key_material);
+  BENCHMARK_END (ecdsa_ecdh);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdh_eddsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
+                          const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+                          struct GNUNET_HashCode *key_material)
+{
+  uint8_t p[crypto_scalarmult_BYTES];
+  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
+
+  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
+    return GNUNET_SYSERR;
+  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
+    return GNUNET_SYSERR;
+  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+                                struct GNUNET_CRYPTO_EcdhePublicKey *c,
+                                struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
+
+  GNUNET_CRYPTO_ecdhe_key_create (&sk);
+  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, c);
+  return GNUNET_CRYPTO_ecdh_eddsa (&sk, pub, key_material);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_fo_kem_encaps (const struct
+                                   GNUNET_CRYPTO_EcdsaPublicKey *pub,
+                                   struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode x;
+  struct GNUNET_HashCode ux;
+  struct GNUNET_HashCode w;
+  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
+
+  // This is the input to the FO OWTF
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE, &x, sizeof(x));
+
+  // We build our OWTF using a FO-transformation of ElGamal:
+  // U(x)
+  GNUNET_CRYPTO_hash (&x, sizeof (x), &ux);
+  GNUNET_memcpy (&sk, &ux, sizeof (sk));
+
+  // B := g^U(x)
+  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, &c->pub);
+
+  if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdh_ecdsa (&sk, pub, &w))
+    return -1;
+  // w xor x (one-time pad)
+  GNUNET_CRYPTO_hash_xor (&w, &x, &c->y);
+
+  // k := H(x) FIXME: U and H must be different?
+  GNUNET_memcpy (key_material, &ux, sizeof (ux));
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_fo_kem_encaps (const struct
+                                   GNUNET_CRYPTO_EddsaPublicKey *pub,
+                                   struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode x;
+  struct GNUNET_HashCode ux;
+  struct GNUNET_HashCode w;
+  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
+  enum GNUNET_GenericReturnValue ret;
+
+  // This is the input to the FO OWTF
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE, &x, sizeof(x));
+
+  // We build our OWTF using a FO-transformation of ElGamal:
+  // U(x)
+  GNUNET_CRYPTO_hash (&x, sizeof (x), &ux);
+  GNUNET_memcpy (&sk, &ux, sizeof (sk));
+
+  // B := g^U(x)
+  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, &c->pub);
+
+  ret = GNUNET_CRYPTO_ecdh_eddsa (&sk, pub, &w);
+  if (GNUNET_OK != ret)
+    return ret;
+  // w xor x (one-time pad)
+  GNUNET_CRYPTO_hash_xor (&w, &x, &c->y);
+
+  // k := H(x) FIXME: U and H must be different?
+  GNUNET_memcpy (key_material, &ux, sizeof (ux));
+  return GNUNET_OK;
+}
+
+
+static enum GNUNET_GenericReturnValue
+fo_kem_decaps (const struct GNUNET_HashCode *w,
+               const struct GNUNET_CRYPTO_FoKemC *c,
+               struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode x;
+  struct GNUNET_HashCode ux;
+  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
+  struct GNUNET_CRYPTO_EcdhePublicKey pub_test;
+
+  // w xor x (one-time pad)
+  GNUNET_CRYPTO_hash_xor (w, &c->y, &x);
+
+  // We build our OWTF using a FO-transformation of ElGamal:
+  // U(x)
+  GNUNET_CRYPTO_hash (&x, sizeof (x), &ux);
+  GNUNET_memcpy (&sk, &ux, sizeof (sk));
+
+  // B := g^U(x)
+  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, &pub_test);
+
+  if (0 != memcmp (&pub_test, &c->pub, sizeof (c->pub)))
+    return GNUNET_SYSERR; // Reject
+
+  // k := H(x) FIXME: U and H must be different?
+  GNUNET_memcpy (key_material, &ux, sizeof (ux));
+  return GNUNET_OK;
+}
+
+
+/**
+ * This implementation is not testes/publicly exposed yet
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_fo_kem_decaps (const struct
+                                   GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                                   const struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode w;
+  enum GNUNET_GenericReturnValue ret;
+
+  ret = GNUNET_CRYPTO_eddsa_ecdh (priv, &c->pub, &w);
+  if (GNUNET_OK != ret)
+    return ret;
+  return fo_kem_decaps (&w, c, key_material);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_fo_kem_decaps (const struct
+                                   GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+                                   struct GNUNET_CRYPTO_FoKemC *c,
+                                   struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_HashCode w;
+  enum GNUNET_GenericReturnValue ret;
+
+  ret = GNUNET_CRYPTO_ecdsa_ecdh (priv, &c->pub, &w);
+  if (GNUNET_OK != ret)
+    return ret;
+  return fo_kem_decaps (&w, c, key_material);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdh_ecdsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv,
+                          const struct GNUNET_CRYPTO_EcdsaPublicKey *pub,
+                          struct GNUNET_HashCode *key_material)
+{
+  uint8_t p[crypto_scalarmult_BYTES];
+  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
+
+  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
+    return GNUNET_SYSERR;
+  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
+    return GNUNET_SYSERR;
+  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
+  return GNUNET_OK;
+}
+
+
+/* end of crypto_ecc.c */
diff --git a/src/lib/util/crypto_ecc_dlog.c b/src/lib/util/crypto_ecc_dlog.c
new file mode 100644
index 000000000..6e333686f
--- /dev/null
+++ b/src/lib/util/crypto_ecc_dlog.c
@@ -0,0 +1,336 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_ecc_dlog.c
+ * @brief ECC addition and discreate logarithm for small values.
+ *        Allows us to use ECC for computations as long as the
+ *        result is relativey small.
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Internal structure used to cache pre-calculated values for DLOG calculation.
+ */
+struct GNUNET_CRYPTO_EccDlogContext
+{
+  /**
+   * Maximum absolute value the calculation supports.
+   */
+  unsigned int max;
+
+  /**
+   * How much memory should we use (relates to the number of entries in the map).
+   */
+  unsigned int mem;
+
+  /**
+   * Map mapping points (here "interpreted" as EdDSA public keys) to
+   * a "void * = long" which corresponds to the numeric value of the
+   * point.  As NULL is used to represent "unknown", the actual value
+   * represented by the entry in the map is the "long" minus @e max.
+   */
+  struct GNUNET_CONTAINER_MultiPeerMap *map;
+
+  /**
+   * Context to use for operations on the elliptic curve.
+   */
+  gcry_ctx_t ctx;
+};
+
+
+struct GNUNET_CRYPTO_EccDlogContext *
+GNUNET_CRYPTO_ecc_dlog_prepare (unsigned int max,
+                                unsigned int mem)
+{
+  struct GNUNET_CRYPTO_EccDlogContext *edc;
+  int K = ((max + (mem - 1)) / mem);
+
+  GNUNET_assert (max < INT32_MAX);
+  edc = GNUNET_new (struct GNUNET_CRYPTO_EccDlogContext);
+  edc->max = max;
+  edc->mem = mem;
+  edc->map = GNUNET_CONTAINER_multipeermap_create (mem * 2,
+                                                   GNUNET_NO);
+  for (int i = -(int) mem; i <= (int) mem; i++)
+  {
+    struct GNUNET_CRYPTO_EccScalar Ki;
+    struct GNUNET_PeerIdentity key;
+
+    GNUNET_CRYPTO_ecc_scalar_from_int (K * i,
+                                       &Ki);
+    if (0 == i) /* libsodium does not like to multiply with zero */
+      GNUNET_assert (
+        0 ==
+        crypto_core_ed25519_sub ((unsigned char *) &key,
+                                 (unsigned char *) &key,
+                                 (unsigned char *) &key));
+    else
+      GNUNET_assert (
+        0 ==
+        crypto_scalarmult_ed25519_base_noclamp ((unsigned char*) &key,
+                                                Ki.v));
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "K*i: %d (mem=%u, i=%d) => %s\n",
+                K * i,
+                mem,
+                i,
+                GNUNET_i2s (&key));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multipeermap_put (edc->map,
+                                                      &key,
+                                                      (void *) (long) i + max,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  }
+  return edc;
+}
+
+
+int
+GNUNET_CRYPTO_ecc_dlog (struct GNUNET_CRYPTO_EccDlogContext *edc,
+                        const struct GNUNET_CRYPTO_EccPoint *input)
+{
+  unsigned int K = ((edc->max + (edc->mem - 1)) / edc->mem);
+  int res;
+  struct GNUNET_CRYPTO_EccPoint g;
+  struct GNUNET_CRYPTO_EccPoint q;
+  struct GNUNET_CRYPTO_EccPoint nq;
+
+  {
+    struct GNUNET_CRYPTO_EccScalar fact;
+
+    memset (&fact,
+            0,
+            sizeof (fact));
+    sodium_increment (fact.v,
+                      sizeof (fact.v));
+    GNUNET_assert (0 ==
+                   crypto_scalarmult_ed25519_base_noclamp (g.v,
+                                                           fact.v));
+  }
+  /* make compiler happy: initialize q and nq, technically not needed! */
+  memset (&q,
+          0,
+          sizeof (q));
+  memset (&nq,
+          0,
+          sizeof (nq));
+  res = INT_MAX;
+  for (unsigned int i = 0; i <= edc->max / edc->mem; i++)
+  {
+    struct GNUNET_PeerIdentity key;
+    void *retp;
+
+    GNUNET_assert (sizeof (key) == crypto_scalarmult_BYTES);
+    if (0 == i)
+    {
+      memcpy (&key,
+              input,
+              sizeof (key));
+    }
+    else
+    {
+      memcpy (&key,
+              &q,
+              sizeof (key));
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Trying offset i=%u): %s\n",
+                i,
+                GNUNET_i2s (&key));
+    retp = GNUNET_CONTAINER_multipeermap_get (edc->map,
+                                              &key);
+    if (NULL != retp)
+    {
+      res = (((long) retp) - edc->max) * K - i;
+      /* we continue the loop here to make the implementation
+         "constant-time". If we do not care about this, we could just
+         'break' here and do fewer operations... */
+    }
+    if (i == edc->max / edc->mem)
+      break;
+    /* q = q + g */
+    if (0 == i)
+    {
+      GNUNET_assert (0 ==
+                     crypto_core_ed25519_add (q.v,
+                                              input->v,
+                                              g.v));
+    }
+    else
+    {
+      GNUNET_assert (0 ==
+                     crypto_core_ed25519_add (q.v,
+                                              q.v,
+                                              g.v));
+    }
+  }
+  return res;
+}
+
+
+void
+GNUNET_CRYPTO_ecc_random_mod_n (struct GNUNET_CRYPTO_EccScalar *r)
+{
+  crypto_core_ed25519_scalar_random (r->v);
+}
+
+
+void
+GNUNET_CRYPTO_ecc_dlog_release (struct GNUNET_CRYPTO_EccDlogContext *edc)
+{
+  GNUNET_CONTAINER_multipeermap_destroy (edc->map);
+  GNUNET_free (edc);
+}
+
+
+void
+GNUNET_CRYPTO_ecc_dexp (int val,
+                        struct GNUNET_CRYPTO_EccPoint *r)
+{
+  struct GNUNET_CRYPTO_EccScalar fact;
+
+  GNUNET_CRYPTO_ecc_scalar_from_int (val,
+                                     &fact);
+  crypto_scalarmult_ed25519_base_noclamp (r->v,
+                                          fact.v);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecc_dexp_mpi (const struct GNUNET_CRYPTO_EccScalar *val,
+                            struct GNUNET_CRYPTO_EccPoint *r)
+{
+  if (0 ==
+      crypto_scalarmult_ed25519_base_noclamp (r->v,
+                                              val->v))
+    return GNUNET_OK;
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecc_add (const struct GNUNET_CRYPTO_EccPoint *a,
+                       const struct GNUNET_CRYPTO_EccPoint *b,
+                       struct GNUNET_CRYPTO_EccPoint *r)
+{
+  if (0 ==
+      crypto_core_ed25519_add (r->v,
+                               a->v,
+                               b->v))
+    return GNUNET_OK;
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecc_pmul_mpi (const struct GNUNET_CRYPTO_EccPoint *p,
+                            const struct GNUNET_CRYPTO_EccScalar *val,
+                            struct GNUNET_CRYPTO_EccPoint *r)
+{
+  if (0 ==
+      crypto_scalarmult_ed25519_noclamp (r->v,
+                                         val->v,
+                                         p->v))
+    return GNUNET_OK;
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecc_rnd (struct GNUNET_CRYPTO_EccPoint *r,
+                       struct GNUNET_CRYPTO_EccPoint *r_inv)
+{
+  struct GNUNET_CRYPTO_EccScalar s;
+  unsigned char inv_s[crypto_scalarmult_ed25519_SCALARBYTES];
+
+  GNUNET_CRYPTO_ecc_random_mod_n (&s);
+  if (0 !=
+      crypto_scalarmult_ed25519_base_noclamp (r->v,
+                                              s.v))
+    return GNUNET_SYSERR;
+  crypto_core_ed25519_scalar_negate (inv_s,
+                                     s.v);
+  if (0 !=
+      crypto_scalarmult_ed25519_base_noclamp (r_inv->v,
+                                              inv_s))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CRYPTO_ecc_rnd_mpi (struct GNUNET_CRYPTO_EccScalar *r,
+                           struct GNUNET_CRYPTO_EccScalar *r_neg)
+{
+  GNUNET_CRYPTO_ecc_random_mod_n (r);
+  crypto_core_ed25519_scalar_negate (r_neg->v,
+                                     r->v);
+}
+
+
+void
+GNUNET_CRYPTO_ecc_scalar_from_int (int64_t val,
+                                   struct GNUNET_CRYPTO_EccScalar *r)
+{
+  unsigned char fact[crypto_scalarmult_ed25519_SCALARBYTES];
+  uint64_t valBe;
+
+  GNUNET_assert (sizeof (*r) == sizeof (fact));
+  if (val < 0)
+  {
+    if (INT64_MIN == val)
+      valBe = GNUNET_htonll ((uint64_t) INT64_MAX);
+    else
+      valBe = GNUNET_htonll ((uint64_t) (-val));
+  }
+  else
+  {
+    valBe = GNUNET_htonll ((uint64_t) val);
+  }
+  memset (fact,
+          0,
+          sizeof (fact));
+  for (unsigned int i = 0; i < sizeof (val); i++)
+    fact[i] = ((unsigned char*) &valBe)[sizeof (val) - 1 - i];
+  if (val < 0)
+  {
+    if (INT64_MIN == val)
+      /* See above: fact is one too small, increment now that we can */
+      sodium_increment (fact,
+                        sizeof (fact));
+    crypto_core_ed25519_scalar_negate (r->v,
+                                       fact);
+  }
+  else
+  {
+    memcpy (r,
+            fact,
+            sizeof (fact));
+  }
+}
+
+
+/* end of crypto_ecc_dlog.c */
diff --git a/src/lib/util/crypto_ecc_gnsrecord.c b/src/lib/util/crypto_ecc_gnsrecord.c
new file mode 100644
index 000000000..fb8ba3ac9
--- /dev/null
+++ b/src/lib/util/crypto_ecc_gnsrecord.c
@@ -0,0 +1,451 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_ecc_gnsrecord.c
+ * @brief public key cryptography (ECC) for GNS records (LSD0001)
+ * @author Christian Grothoff
+ * @author Florian Dold
+ * @author Martin Schanzenbach
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include <sodium.h>
+#include "gnunet_util_lib.h"
+
+#define CURVE "Ed25519"
+
+/**
+ * Derive the 'h' value for key derivation, where
+ * 'h = H(l,P)'.
+ *
+ * @param pub public key for deriviation
+ * @param pubsize the size of the public key
+ * @param label label for deriviation
+ * @param context additional context to use for HKDF of 'h';
+ *        typically the name of the subsystem/application
+ * @param hc where to write the result
+ */
+void
+derive_h (const void *pub,
+          size_t pubsize,
+          const char *label,
+          const char *context,
+          struct GNUNET_HashCode *hc)
+{
+  static const char *const salt = "key-derivation";
+
+  GNUNET_CRYPTO_kdf (hc,
+                     sizeof(*hc),
+                     salt,
+                     strlen (salt),
+                     pub,
+                     pubsize,
+                     label,
+                     strlen (label),
+                     context,
+                     strlen (context),
+                     NULL,
+                     0);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_sign_derived (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *pkey,
+  const char *label,
+  const char *context,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct GNUNET_CRYPTO_EddsaPrivateScalar priv;
+  crypto_hash_sha512_state hs;
+  unsigned char sk[64];
+  unsigned char r[64];
+  unsigned char hram[64];
+  unsigned char R[32];
+  unsigned char zk[32];
+  unsigned char tmp[32];
+
+  /**
+   * Derive the private key
+   */
+  GNUNET_CRYPTO_eddsa_private_key_derive (pkey,
+                                          label,
+                                          context,
+                                          &priv);
+
+  crypto_hash_sha512_init (&hs);
+
+  /**
+   * Instead of expanding the private here, we already
+   * have the secret scalar as input. Use it.
+   * Note that sk is not plain SHA512 (d).
+   * sk[0..31] contains the derived private scalar
+   * sk[0..31] = h * SHA512 (d)[0..31]
+   * sk[32..63] = SHA512 (d)[32..63]
+   */
+  memcpy (sk, priv.s, 64);
+
+  /**
+   * Calculate the derived zone key zk' from the
+   * derived private scalar.
+   */
+  crypto_scalarmult_ed25519_base_noclamp (zk,
+                                          sk);
+
+  /**
+   * Calculate r:
+   * r = SHA512 (sk[32..63] | M)
+   * where M is our message (purpose).
+   * Note that sk[32..63] is the other half of the
+   * expansion from the original, non-derived private key
+   * "d".
+   */
+  crypto_hash_sha512_update (&hs, sk + 32, 32);
+  crypto_hash_sha512_update (&hs, (uint8_t*) purpose, ntohl (purpose->size));
+  crypto_hash_sha512_final (&hs, r);
+
+  /**
+   * Temporarily put zk into S
+   */
+  memcpy (sig->s, zk, 32);
+
+  /**
+   * Reduce the scalar value r
+   */
+  unsigned char r_mod[64];
+  crypto_core_ed25519_scalar_reduce (r_mod, r);
+
+  /**
+   * Calculate R := r * G of the signature
+   */
+  crypto_scalarmult_ed25519_base_noclamp (R, r_mod);
+  memcpy (sig->r, R, sizeof (R));
+
+  /**
+   * Calculate
+   * hram := SHA512 (R | zk' | M)
+   */
+  crypto_hash_sha512_init (&hs);
+  crypto_hash_sha512_update (&hs, (uint8_t*) sig, 64);
+  crypto_hash_sha512_update (&hs, (uint8_t*) purpose,
+                             ntohl (purpose->size));
+  crypto_hash_sha512_final (&hs, hram);
+
+  /**
+   * Reduce the resulting scalar value
+   */
+  unsigned char hram_mod[64];
+  crypto_core_ed25519_scalar_reduce (hram_mod, hram);
+
+  /**
+   * Calculate
+   * S := r + hram * s mod L
+   */
+  crypto_core_ed25519_scalar_mul (tmp, hram_mod, sk);
+  crypto_core_ed25519_scalar_add (sig->s, tmp, r_mod);
+
+  sodium_memzero (sk, sizeof (sk));
+  sodium_memzero (r, sizeof (r));
+  sodium_memzero (r_mod, sizeof (r_mod));
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_sign_derived (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+  const char *label,
+  const char *context,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_EcdsaSignature *sig)
+{
+  struct GNUNET_CRYPTO_EcdsaPrivateKey *key;
+  enum GNUNET_GenericReturnValue res;
+  key = GNUNET_CRYPTO_ecdsa_private_key_derive (priv,
+                                                label,
+                                                context);
+  res = GNUNET_CRYPTO_ecdsa_sign_ (key,
+                                   purpose,
+                                   sig);
+  GNUNET_free (key);
+  return res;
+}
+
+
+struct GNUNET_CRYPTO_EcdsaPrivateKey *
+GNUNET_CRYPTO_ecdsa_private_key_derive (
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+  const char *label,
+  const char *context)
+{
+  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey *ret;
+  struct GNUNET_HashCode hc;
+  uint8_t dc[32];
+  gcry_mpi_t h;
+  gcry_mpi_t x;
+  gcry_mpi_t d;
+  gcry_mpi_t n;
+  gcry_ctx_t ctx;
+
+  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
+
+  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
+  GNUNET_CRYPTO_ecdsa_key_get_public (priv, &pub);
+
+  derive_h (&pub, sizeof (pub), label, context, &hc);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
+
+  /* Convert to big endian for libgcrypt */
+  for (size_t i = 0; i < 32; i++)
+    dc[i] = priv->d[31 - i];
+  GNUNET_CRYPTO_mpi_scan_unsigned (&x, dc, sizeof(dc));
+  d = gcry_mpi_new (256);
+  gcry_mpi_mulm (d, h, x, n);
+  gcry_mpi_release (h);
+  gcry_mpi_release (x);
+  gcry_mpi_release (n);
+  gcry_ctx_release (ctx);
+  ret = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
+  /* Convert to big endian for libgcrypt */
+  for (size_t i = 0; i < 32; i++)
+    ret->d[i] = dc[31 - i];
+  sodium_memzero (dc, sizeof(dc));
+  gcry_mpi_release (d);
+  return ret;
+}
+
+
+void
+GNUNET_CRYPTO_ecdsa_public_key_derive (
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *pub,
+  const char *label,
+  const char *context,
+  struct GNUNET_CRYPTO_EcdsaPublicKey *result)
+{
+  struct GNUNET_HashCode hc;
+  gcry_ctx_t ctx;
+  gcry_mpi_t q_y;
+  gcry_mpi_t h;
+  gcry_mpi_t n;
+  gcry_mpi_t h_mod_n;
+  gcry_mpi_point_t q;
+  gcry_mpi_point_t v;
+
+  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
+
+  /* obtain point 'q' from original public key.  The provided 'q' is
+     compressed thus we first store it in the context and then get it
+     back as a (decompresssed) point.  */
+  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
+  GNUNET_assert (NULL != q_y);
+  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
+  gcry_mpi_release (q_y);
+  q = gcry_mpi_ec_get_point ("q", ctx, 0);
+  GNUNET_assert (q);
+
+  /* calculate h_mod_n = h % n */
+  derive_h (pub, sizeof (*pub), label, context, &hc);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
+  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
+  h_mod_n = gcry_mpi_new (256);
+  gcry_mpi_mod (h_mod_n, h, n);
+  /* calculate v = h_mod_n * q */
+  v = gcry_mpi_point_new (0);
+  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
+  gcry_mpi_release (h_mod_n);
+  gcry_mpi_release (h);
+  gcry_mpi_release (n);
+  gcry_mpi_point_release (q);
+
+  /* convert point 'v' to public key that we return */
+  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
+  gcry_mpi_point_release (v);
+  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
+  GNUNET_assert (q_y);
+  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
+  gcry_mpi_release (q_y);
+  gcry_ctx_release (ctx);
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_private_key_derive (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  const char *label,
+  const char *context,
+  struct GNUNET_CRYPTO_EddsaPrivateScalar *result)
+{
+  struct GNUNET_CRYPTO_EddsaPublicKey pub;
+  struct GNUNET_HashCode hc;
+  uint8_t dc[32];
+  unsigned char sk[64];
+  gcry_mpi_t h;
+  gcry_mpi_t h_mod_L;
+  gcry_mpi_t a;
+  gcry_mpi_t d;
+  gcry_mpi_t L;
+  gcry_ctx_t ctx;
+
+  /**
+   * Libsodium does not offer an API with arbitrary arithmetic.
+   * Hence we have to use libgcrypt here.
+   */
+  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
+
+  /**
+   * Get our modulo L
+   */
+  L = gcry_mpi_ec_get_mpi ("n", ctx, 1);
+  GNUNET_CRYPTO_eddsa_key_get_public (priv, &pub);
+
+  /**
+   * This is the standard private key expansion in Ed25519.
+   * The first 32 octets are used as a little-endian private
+   * scalar.
+   * We derive this scalar using our "h".
+   */
+  crypto_hash_sha512 (sk, priv->d, 32);
+  sk[0] &= 248;
+  sk[31] &= 127;
+  sk[31] |= 64;
+
+  /**
+   * Get h mod L
+   */
+  derive_h (&pub, sizeof (pub), label, context, &hc);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
+  h_mod_L = gcry_mpi_new (256);
+  gcry_mpi_mod (h_mod_L, h, L);
+  /* Convert scalar to big endian for libgcrypt */
+  for (size_t i = 0; i < 32; i++)
+    dc[i] = sk[31 - i];
+
+  /**
+   * dc now contains the private scalar "a".
+   * We calculate:
+   * d' := h * a mod L
+   */
+  GNUNET_CRYPTO_mpi_scan_unsigned (&a, dc, sizeof(dc)); // a
+  d = gcry_mpi_new (256);
+  gcry_mpi_mulm (d, h_mod_L, a, L); // d := h * a mod L
+  gcry_mpi_release (h);
+  gcry_mpi_release (a);
+  gcry_mpi_release (L);
+  gcry_mpi_release (h_mod_L);
+  gcry_ctx_release (ctx);
+  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
+  /**
+   * We hash the derived "h" parameter with the
+   * other half of the expanded private key. This ensures
+   * that for signature generation, the "R" is derived from
+   * the same derivation path as "h" and is not reused.
+   */
+  crypto_hash_sha256_state hs;
+  crypto_hash_sha256_init (&hs);
+  crypto_hash_sha256_update (&hs, sk + 32, 32);
+  crypto_hash_sha256_update (&hs, (unsigned char*) &hc, sizeof (hc));
+  crypto_hash_sha256_final (&hs, result->s + 32);
+  // memcpy (result->s, sk, sizeof (sk));
+  /* Convert to little endian for libsodium */
+  for (size_t i = 0; i < 32; i++)
+    result->s[i] = dc[31 - i];
+
+  sodium_memzero (dc, sizeof(dc));
+  gcry_mpi_release (d);
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_public_key_derive (
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+  const char *label,
+  const char *context,
+  struct GNUNET_CRYPTO_EddsaPublicKey *result)
+{
+  struct GNUNET_HashCode hc;
+  gcry_ctx_t ctx;
+  gcry_mpi_t q_y;
+  gcry_mpi_t h;
+  gcry_mpi_t n;
+  gcry_mpi_t h_mod_n;
+  gcry_mpi_point_t q;
+  gcry_mpi_point_t v;
+
+  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
+
+  /* obtain point 'q' from original public key.  The provided 'q' is
+     compressed thus we first store it in the context and then get it
+     back as a (decompresssed) point.  */
+  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
+  GNUNET_assert (NULL != q_y);
+  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
+  gcry_mpi_release (q_y);
+  q = gcry_mpi_ec_get_point ("q", ctx, 0);
+  GNUNET_assert (q);
+
+  /* calculate h_mod_n = h % n */
+  derive_h (pub, sizeof (*pub), label, context, &hc);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
+
+  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
+  h_mod_n = gcry_mpi_new (256);
+  gcry_mpi_mod (h_mod_n, h, n);
+
+  /* calculate v = h_mod_n * q */
+  v = gcry_mpi_point_new (0);
+  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
+  gcry_mpi_release (h_mod_n);
+  gcry_mpi_release (h);
+  gcry_mpi_release (n);
+  gcry_mpi_point_release (q);
+
+  /* convert point 'v' to public key that we return */
+  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
+  gcry_mpi_point_release (v);
+  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
+  GNUNET_assert (q_y);
+  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
+  gcry_mpi_release (q_y);
+  gcry_ctx_release (ctx);
+
+}
+
+
+void
+GNUNET_CRYPTO_eddsa_key_get_public_from_scalar (
+  const struct GNUNET_CRYPTO_EddsaPrivateScalar *priv,
+  struct GNUNET_CRYPTO_EddsaPublicKey *pkey)
+{
+  unsigned char sk[32];
+
+  memcpy (sk, priv->s, 32);
+
+  /**
+   * Calculate the derived zone key zk' from the
+   * derived private scalar.
+   */
+  crypto_scalarmult_ed25519_base_noclamp (pkey->q_y,
+                                          sk);
+}
diff --git a/src/lib/util/crypto_ecc_setup.c b/src/lib/util/crypto_ecc_setup.c
new file mode 100644
index 000000000..07e28f89d
--- /dev/null
+++ b/src/lib/util/crypto_ecc_setup.c
@@ -0,0 +1,351 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013, 2015, 2020, 2023 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_ecc_setup.c
+ * @brief helper function for easy EdDSA key setup
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-ecc", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-crypto-ecc", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+  GNUNET_log_from_strerror_file (kind, "util-crypto-ecc", syscall, filename)
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' with the message given
+ * by gcry_strerror(rc).
+ */
+#define LOG_GCRY(level, cmd, rc)                      \
+  do                                                  \
+  {                                                   \
+    LOG (level,                                       \
+         _ ("`%s' failed at %s:%d with error: %s\n"), \
+         cmd,                                         \
+         __FILE__,                                    \
+         __LINE__,                                    \
+         gcry_strerror (rc));                         \
+  } while (0)
+
+
+/**
+ * Read file to @a buf. Fails if the file does not exist or
+ * does not have precisely @a buf_size bytes.
+ *
+ * @param filename file to read
+ * @param[out] buf where to write the file contents
+ * @param buf_size number of bytes in @a buf
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+read_from_file (const char *filename,
+                void *buf,
+                size_t buf_size)
+{
+  int fd;
+  struct stat sb;
+
+  fd = open (filename,
+             O_RDONLY);
+  if (-1 == fd)
+  {
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (0 != fstat (fd,
+                  &sb))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "stat",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (sb.st_size != buf_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "File `%s' has wrong size (%llu), expected %llu bytes\n",
+                filename,
+                (unsigned long long) sb.st_size,
+                (unsigned long long) buf_size);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (buf_size !=
+      read (fd,
+            buf,
+            buf_size))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "read",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 == close (fd));
+  return GNUNET_OK;
+}
+
+
+/**
+ * @ingroup crypto
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
+ *
+ * @param filename name of file to use to store the key
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return - #GNUNET_OK on success,
+ *  - #GNUNET_NO if @a do_create was set but we found an existing file,
+ *  - #GNUNET_SYSERR on failure _or_ if the file didn't exist and @a
+ *    do_create was not set
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EddsaPrivateKey *pkey)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
+  {
+    /* file existed, report that we didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
+  }
+  else if (! do_create)
+  {
+    return GNUNET_SYSERR;
+  }
+
+  GNUNET_CRYPTO_eddsa_key_create (pkey);
+  ret = GNUNET_DISK_fn_write (filename,
+                              pkey,
+                              sizeof (*pkey),
+                              GNUNET_DISK_PERM_USER_READ);
+  if ( (GNUNET_OK == ret) ||
+       (GNUNET_SYSERR == ret) )
+    return ret;
+  /* maybe another process succeeded in the meantime, try reading one more time */
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
+  {
+    /* file existed, report that *we* didn't create it... */
+    return GNUNET_NO;
+  }
+  /* give up */
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * @ingroup crypto
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
+ *
+ * @param filename name of file to use to store the key
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
+ *         we found an existing file, #GNUNET_SYSERR on failure
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey)
+{
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
+  {
+    /* file existed, report that we didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
+  }
+  else if (! do_create)
+  {
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CRYPTO_ecdsa_key_create (pkey);
+  if (GNUNET_OK ==
+      GNUNET_DISK_fn_write (filename,
+                            pkey,
+                            sizeof (*pkey),
+                            GNUNET_DISK_PERM_USER_READ))
+    return GNUNET_OK;
+  /* maybe another process succeeded in the meantime, try reading one more time */
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
+  {
+    /* file existed, report that *we* didn't create it... */
+    return GNUNET_NO;
+  }
+  /* give up */
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Create a new private key by reading our peer's key from
+ * the file specified in the configuration.
+ *
+ * @param cfg the configuration to use
+ * @return new private key, NULL on error (for example,
+ *   permission denied)
+ */
+struct GNUNET_CRYPTO_EddsaPrivateKey *
+GNUNET_CRYPTO_eddsa_key_create_from_configuration (
+  const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+  char *fn;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                               "PEER",
+                                               "PRIVATE_KEY",
+                                               &fn))
+    return NULL;
+  priv = GNUNET_new (struct GNUNET_CRYPTO_EddsaPrivateKey);
+  if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_key_from_file (fn,
+                                                          GNUNET_YES,
+                                                          priv))
+  {
+    GNUNET_free (fn);
+    GNUNET_free (priv);
+    return NULL;
+  }
+  GNUNET_free (fn);
+  return priv;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_get_peer_identity (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                                 struct GNUNET_PeerIdentity *dst)
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+
+  if (NULL == (priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Could not load peer's private key\n"));
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CRYPTO_eddsa_key_get_public (priv,
+                                      &dst->public_key);
+  GNUNET_free (priv);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_by_peer_identity (const struct
+                                     GNUNET_CONFIGURATION_Handle *cfg,
+                                     const struct
+                                     GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+                                     struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+  enum GNUNET_GenericReturnValue result;
+
+  if (NULL == (priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Could not load peer's private key\n"));
+    return GNUNET_SYSERR;
+  }
+
+  result = GNUNET_CRYPTO_eddsa_sign_ (priv, purpose, sig);
+  GNUNET_CRYPTO_eddsa_key_clear (priv);
+  return result;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_verify_peer_identity (uint32_t purpose,
+                                    const struct
+                                    GNUNET_CRYPTO_EccSignaturePurpose *validate,
+                                    const struct
+                                    GNUNET_CRYPTO_EddsaSignature *sig,
+                                    const struct GNUNET_PeerIdentity *identity)
+{
+  return GNUNET_CRYPTO_eddsa_verify_ (purpose, validate, sig,
+                                      &identity->public_key);
+}
+
+
+/**
+ * Setup a key file for a peer given the name of the
+ * configuration file (!).  This function is used so that
+ * at a later point code can be certain that reading a
+ * key is fast (for example in time-dependent testcases).
+ *
+ * @param cfg_name name of the configuration file to use
+ */
+void
+GNUNET_CRYPTO_eddsa_setup_key (const char *cfg_name)
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  (void) GNUNET_CONFIGURATION_load (cfg, cfg_name);
+  priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg);
+  if (NULL != priv)
+    GNUNET_free (priv);
+  GNUNET_CONFIGURATION_destroy (cfg);
+}
+
+
+/* end of crypto_ecc_setup.c */
diff --git a/src/lib/util/crypto_edx25519.c b/src/lib/util/crypto_edx25519.c
new file mode 100644
index 000000000..2d9a76aa3
--- /dev/null
+++ b/src/lib/util/crypto_edx25519.c
@@ -0,0 +1,354 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_edx25519.c
+ * @brief An variant of EdDSA which allows for iterative derivation of key pairs.
+ * @author Özgür Kesim
+ * @author Christian Grothoff
+ * @author Florian Dold
+ * @author Martin Schanzenbach
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include <sodium.h>
+#include "gnunet_util_lib.h"
+
+#define CURVE "Ed25519"
+
+void
+GNUNET_CRYPTO_edx25519_key_clear (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
+{
+  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_Edx25519PrivateKey));
+}
+
+
+void
+GNUNET_CRYPTO_edx25519_key_create_from_seed (
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
+{
+
+  GNUNET_static_assert (sizeof(*pk) == sizeof(struct GNUNET_HashCode));
+  GNUNET_CRYPTO_hash (seed,
+                      seedsize,
+                      (struct GNUNET_HashCode *) pk);
+
+  /* Clamp the first half of the key. The second half is used in the signature
+   * process. */
+  pk->a[0] &= 248;
+  pk->a[31] &= 127;
+  pk->a[31] |= 64;
+}
+
+
+void
+GNUNET_CRYPTO_edx25519_key_create (
+  struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
+{
+  char seed[256 / 8];
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                              seed,
+                              sizeof (seed));
+  GNUNET_CRYPTO_edx25519_key_create_from_seed (seed,
+                                               sizeof(seed),
+                                               pk);
+}
+
+
+void
+GNUNET_CRYPTO_edx25519_key_get_public (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
+{
+  crypto_scalarmult_ed25519_base_noclamp (pub->q_y,
+                                          priv->a);
+}
+
+
+/**
+ * This function operates the basically same way as the signature function for
+ * EdDSA. But instead of expanding a private seed (which is usually the case
+ * for crypto APIs) and using the resulting scalars, it takes the scalars
+ * directly from Edx25519PrivateKey.  We require this functionality in order to
+ * use derived private keys for signatures.
+ *
+ * The resulting signature is a standard EdDSA signature
+ * which can be verified using the usual APIs.
+ *
+ * @param priv the private key (containing two scalars .a and .b)
+ * @param purp the signature purpose
+ * @param sig the resulting signature
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_edx25519_sign_ (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+  struct GNUNET_CRYPTO_Edx25519Signature *sig)
+{
+
+  crypto_hash_sha512_state hs;
+  unsigned char r[64];
+  unsigned char hram[64];
+  unsigned char P[32];
+  unsigned char r_mod[64];
+  unsigned char R[32];
+  unsigned char tmp[32];
+
+  crypto_hash_sha512_init (&hs);
+
+  /**
+   * Calculate the public key P from the private scalar in the key.
+   */
+  crypto_scalarmult_ed25519_base_noclamp (P,
+                                          priv->a);
+
+  /**
+   * Calculate r:
+   * r = SHA512 (b ∥ M)
+   * where M is our message (purpose).
+   */
+  crypto_hash_sha512_update (&hs,
+                             priv->b,
+                             sizeof(priv->b));
+  crypto_hash_sha512_update (&hs,
+                             (uint8_t*) purpose,
+                             ntohl (purpose->size));
+  crypto_hash_sha512_final (&hs,
+                            r);
+
+  /**
+   * Temporarily put P into S
+   */
+  memcpy (sig->s, P, 32);
+
+  /**
+   * Reduce the scalar value r
+   */
+  crypto_core_ed25519_scalar_reduce (r_mod, r);
+
+  /**
+   * Calculate R := r * G of the signature
+   */
+  crypto_scalarmult_ed25519_base_noclamp (R, r_mod);
+  memcpy (sig->r, R, sizeof (R));
+
+  /**
+   * Calculate
+   * hram := SHA512 (R ∥ P ∥ M)
+   */
+  crypto_hash_sha512_init (&hs);
+  crypto_hash_sha512_update (&hs, (uint8_t*) sig, 64);
+  crypto_hash_sha512_update (&hs, (uint8_t*) purpose,
+                             ntohl (purpose->size));
+  crypto_hash_sha512_final (&hs, hram);
+
+  /**
+   * Reduce the resulting scalar value
+   */
+  unsigned char hram_mod[64];
+  crypto_core_ed25519_scalar_reduce (hram_mod, hram);
+
+  /**
+   * Calculate
+   * S := r + hram * s mod L
+   */
+  crypto_core_ed25519_scalar_mul (tmp, hram_mod, priv->a);
+  crypto_core_ed25519_scalar_add (sig->s, tmp, r_mod);
+
+  sodium_memzero (r, sizeof (r));
+  sodium_memzero (r_mod, sizeof (r_mod));
+
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_edx25519_verify_ (
+  uint32_t purpose,
+  const struct GNUNET_CRYPTO_EccSignaturePurpose *validate,
+  const struct GNUNET_CRYPTO_Edx25519Signature *sig,
+  const struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
+{
+  const unsigned char *m = (const void *) validate;
+  size_t mlen = ntohl (validate->size);
+  const unsigned char *s = (const void *) sig;
+
+  int res;
+
+  if (purpose != ntohl (validate->purpose))
+    return GNUNET_SYSERR; /* purpose mismatch */
+
+  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
+  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * Derive the 'h' value for key derivation, where
+ * 'h = H(P ∥ seed) mod n' and 'n' is the size of the cyclic subroup.
+ *
+ * @param pub public key for deriviation
+ * @param seed seed for key the deriviation
+ * @param seedsize the size of the seed
+ * @param[out] phc if not NULL, the output of H() will be written into
+ * return h_mod_n (allocated by this function)
+ */
+static void
+derive_h (
+  const struct GNUNET_CRYPTO_Edx25519PublicKey *pub,
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_HashCode *phc)
+{
+  static const char *const salt = "edx25519-derivation";
+
+  GNUNET_CRYPTO_kdf (/* output*/
+                     phc, sizeof(*phc),
+                     /* salt */
+                     seed, seedsize,
+                     /* ikm */
+                     pub, sizeof(*pub),
+                     /* ctx chunks*/
+                     salt, strlen (salt),
+                     NULL, 0);
+
+}
+
+
+void
+GNUNET_CRYPTO_edx25519_private_key_derive (
+  const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv,
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PrivateKey *result)
+{
+  struct GNUNET_CRYPTO_Edx25519PublicKey pub;
+  struct GNUNET_HashCode hc;
+  uint8_t a[32];
+  uint8_t eight[32] = { 8 };
+  uint8_t eight_inv[32];
+  uint8_t h[64] = { 0 };
+
+  GNUNET_CRYPTO_edx25519_key_get_public (priv, &pub);
+
+  /* Get h mod n */
+  derive_h (&pub,
+            seed,
+            seedsize,
+            &hc);
+
+  memcpy (h, &hc, 64);
+  crypto_core_ed25519_scalar_reduce (h,
+                                     h);
+#ifdef CHECK_RARE_CASES
+  /**
+   * Note that the following cases would be problematic:
+   *    1.) h == 0 mod n
+   *    2.) h == 1 mod n
+   *    3.) [h] * P == E
+   * We assume that the probalities for these cases to occur are neglegible.
+   */
+  {
+    char zero[32] = { 0 };
+    char one[32] = { 1 };
+
+    GNUNET_assert (0 != memcmp (zero, h, 32));
+    GNUNET_assert (0 != memcmp (one, h, 32));
+  }
+#endif
+
+  /**
+   * dc now contains the private scalar "a".
+   * We carefully remove the clamping and derive a'.
+   * Calculate:
+   * a1 := a / 8
+   * a2 := h * a1 mod n
+   * a' := a2 * 8 mod n
+   */
+
+  GNUNET_assert (0 == crypto_core_ed25519_scalar_invert (eight_inv,
+                                                         eight));
+
+  crypto_core_ed25519_scalar_mul (a, priv->a, eight_inv);
+  crypto_core_ed25519_scalar_mul (a, a, h);
+  crypto_core_ed25519_scalar_mul (a, a, eight);
+
+#ifdef CHECK_RARE_CASES
+  /* The likelihood for a' == 0 or a' == 1 is neglegible */
+  {
+    char zero[32] = { 0 };
+    char one[32] = { 1 };
+
+    GNUNET_assert (0 != memcmp (zero, a, 32));
+    GNUNET_assert (0 != memcmp (one, a, 32));
+  }
+#endif
+
+  /* We hash the derived "h" parameter with the other half of the expanded
+   * private key (that is: priv->b). This ensures that for signature
+   * generation, the "R" is derived from the same derivation path as "h" and is
+   * not reused. */
+  {
+    struct GNUNET_HashCode hcb;
+    struct GNUNET_HashContext *hctx;
+
+    hctx = GNUNET_CRYPTO_hash_context_start ();
+    GNUNET_CRYPTO_hash_context_read (hctx, priv->b, sizeof(priv->b));
+    GNUNET_CRYPTO_hash_context_read (hctx, (unsigned char*) &hc, sizeof (hc));
+    GNUNET_CRYPTO_hash_context_finish (hctx, &hcb);
+
+    /* Truncate result, effectively doing SHA512/256 */
+    for (size_t i = 0; i < 32; i++)
+      result->b[i] = ((unsigned char *) &hcb)[i];
+  }
+
+  for (size_t i = 0; i < 32; i++)
+    result->a[i] = a[i];
+
+  sodium_memzero (a, sizeof(a));
+}
+
+
+void
+GNUNET_CRYPTO_edx25519_public_key_derive (
+  const struct GNUNET_CRYPTO_Edx25519PublicKey *pub,
+  const void *seed,
+  size_t seedsize,
+  struct GNUNET_CRYPTO_Edx25519PublicKey *result)
+{
+  struct GNUNET_HashCode hc;
+  uint8_t h[64] = { 0 };
+
+  derive_h (pub,
+            seed,
+            seedsize,
+            &hc);
+  memcpy (h,
+          &hc,
+          64);
+  crypto_core_ed25519_scalar_reduce (h,
+                                     h);
+  GNUNET_assert (0 == crypto_scalarmult_ed25519_noclamp (result->q_y,
+                                                         h,
+                                                         pub->q_y));
+}
diff --git a/src/lib/util/crypto_elligator.c b/src/lib/util/crypto_elligator.c
new file mode 100644
index 000000000..91db517b0
--- /dev/null
+++ b/src/lib/util/crypto_elligator.c
@@ -0,0 +1,674 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+
+    Portions of this code are derived from the Elligator-2 project,
+    which is licensed under the Creative Commons CC0 1.0 Universal Public Domain Dedication.
+    The Elligator-2 project can be found at: https://github.com/Kleshni/Elligator-2
+
+    Note that gmp is already a dependency of GnuTLS
+
+*/
+
+#include "platform.h"
+#include <gcrypt.h>
+#include <sodium.h>
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <string.h>
+#include <gmp.h>
+
+// Ed25519 subgroup of points with a low order
+static const uint8_t lookupTable[8][crypto_scalarmult_SCALARBYTES] = {
+  {
+    0x26,  0xE8,  0x95,  0x8F,  0xC2,  0xB2,  0x27,  0xB0,
+    0x45,  0xC3,  0xF4,  0x89,  0xF2,  0xEF,  0x98,  0xF0,
+    0xD5,  0xDF,  0xAC,  0x05,  0xD3,  0xC6,  0x33,  0x39,
+    0xB1,  0x38,  0x02,  0x88,  0x6D,  0x53,  0xFC,  0x05
+  },
+  {
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00
+  },
+  {
+    0xC7,  0x17,  0x6A,  0x70,  0x3D,  0x4D,  0xD8,  0x4F,
+    0xBA,  0x3C,  0x0B,  0x76,  0x0D,  0x10,  0x67,  0x0F,
+    0x2A,  0x20,  0x53,  0xFA,  0x2C,  0x39,  0xCC,  0xC6,
+    0x4E,  0xC7,  0xFD,  0x77,  0x92,  0xAC,  0x03,  0x7A
+  },
+  {
+    0xEC,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,
+    0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,
+    0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,
+    0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0xFF,  0x7F
+  },  {
+    0xC7,  0x17,  0x6A,  0x70,  0x3D,  0x4D,  0xD8,  0x4F,
+    0xBA,  0x3C,  0x0B,  0x76,  0x0D,  0x10,  0x67,  0x0F,
+    0x2A,  0x20,  0x53,  0xFA,  0x2C,  0x39,  0xCC,  0xC6,
+    0x4E,  0xC7,  0xFD,  0x77,  0x92,  0xAC,  0x03,  0xFA
+  }, {
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x80
+  }, {
+    0x26,  0xE8,  0x95,  0x8F,  0xC2,  0xB2,  0x27,  0xB0,
+    0x45,  0xC3,  0xF4,  0x89,  0xF2,  0xEF,  0x98,  0xF0,
+    0xD5,  0xDF,  0xAC,  0x05,  0xD3,  0xC6,  0x33,  0x39,
+    0xB1,  0x38,  0x02,  0x88,  0x6D,  0x53,  0xFC,  0x85
+  },{
+    0x01,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
+    0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00
+  }
+};
+
+// main.h from Kleshnis's elligator implementation
+#include <limits.h>
+
+#define P_BITS (256) // 255 significant bits + 1 for carry
+#define P_BYTES ((P_BITS + CHAR_BIT - 1) / CHAR_BIT)
+#define P_LIMBS ((P_BITS + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
+
+
+// main.c from Kleshnis's elligator implementation
+static const unsigned char p_bytes[P_BYTES] = {
+  0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
+};
+
+static const unsigned char negative_1_bytes[P_BYTES] = {
+  0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
+};
+
+static const unsigned char negative_2_bytes[P_BYTES] = {
+  0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
+};
+
+static const unsigned char divide_negative_1_2_bytes[P_BYTES] = {
+  0xf6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
+};
+
+static const unsigned char divide_plus_p_3_8_bytes[P_BYTES] = {
+  0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0f
+};
+
+static const unsigned char divide_minus_p_1_2_bytes[P_BYTES] = {
+  0xf6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
+};
+
+static const unsigned char square_root_negative_1_bytes[P_BYTES] = {
+  0xb0, 0xa0, 0x0e, 0x4a, 0x27, 0x1b, 0xee, 0xc4,
+  0x78, 0xe4, 0x2f, 0xad, 0x06, 0x18, 0x43, 0x2f,
+  0xa7, 0xd7, 0xfb, 0x3d, 0x99, 0x00, 0x4d, 0x2b,
+  0x0b, 0xdf, 0xc1, 0x4f, 0x80, 0x24, 0x83, 0x2b
+};
+
+static const unsigned char A_bytes[P_BYTES] = {
+  0x06, 0x6d, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+static const unsigned char negative_A_bytes[P_BYTES] = {
+  0xe7, 0x92, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
+};
+
+static const unsigned char u_bytes[P_BYTES] = {
+  0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+static const unsigned char inverted_u_bytes[P_BYTES] = {
+  0xf7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
+};
+
+static const unsigned char d_bytes[P_BYTES] = {
+  0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
+  0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
+  0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
+  0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52
+};
+
+static mp_limb_t p[P_LIMBS];
+static mp_limb_t negative_1[P_LIMBS];
+static mp_limb_t negative_2[P_LIMBS];
+static mp_limb_t divide_negative_1_2[P_LIMBS];
+static mp_limb_t divide_plus_p_3_8[P_LIMBS];
+static mp_limb_t divide_minus_p_1_2[P_LIMBS];
+static mp_limb_t square_root_negative_1[P_LIMBS];
+static mp_limb_t A[P_LIMBS];
+static mp_limb_t negative_A[P_LIMBS];
+static mp_limb_t u[P_LIMBS];
+static mp_limb_t inverted_u[P_LIMBS];
+static mp_limb_t d[P_LIMBS];
+
+static mp_size_t scratch_space_length;
+
+// TODO
+static void
+decode_bytes (mp_limb_t *number, const uint8_t *bytes)
+{
+  mp_limb_t scratch_space[1];
+
+  for (size_t i = 0; i < P_BYTES; ++i)
+  {
+    mpn_lshift (number, number, P_LIMBS, 8);
+    mpn_sec_add_1 (number, number, 1, bytes[P_BYTES - i - 1], scratch_space);
+  }
+}
+
+
+// TODO
+static void
+encode_bytes (uint8_t *bytes, mp_limb_t *number)
+{
+  for (size_t i = 0; i < P_BYTES; ++i)
+  {
+    bytes[P_BYTES - i - 1] = mpn_lshift (number, number, P_LIMBS, 8);
+  }
+}
+
+
+/**
+ * Initialize elligator scratch space.
+*/
+void __attribute__ ((constructor))
+GNUNET_CRYPTO_ecdhe_elligator_initialize ()
+{
+  static bool initialized = false;
+
+  if (initialized)
+  {
+    return;
+  }
+
+  decode_bytes (p, p_bytes);
+  decode_bytes (negative_1, negative_1_bytes);
+  decode_bytes (negative_2, negative_2_bytes);
+  decode_bytes (divide_negative_1_2, divide_negative_1_2_bytes);
+  decode_bytes (divide_plus_p_3_8, divide_plus_p_3_8_bytes);
+  decode_bytes (divide_minus_p_1_2, divide_minus_p_1_2_bytes);
+  decode_bytes (square_root_negative_1, square_root_negative_1_bytes);
+  decode_bytes (A, A_bytes);
+  decode_bytes (negative_A, negative_A_bytes);
+  decode_bytes (u, u_bytes);
+  decode_bytes (inverted_u, inverted_u_bytes);
+  decode_bytes (d, d_bytes);
+
+  mp_size_t scratch_space_lengths[] = {
+    // For least_square_root
+
+    mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
+    mpn_sec_sqr_itch (P_LIMBS),
+    mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
+    mpn_sec_sub_1_itch (P_LIMBS),
+    mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
+
+    // For Elligator_2_Curve25519_encode
+
+    mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
+    mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
+    mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
+    mpn_sec_sqr_itch (P_LIMBS),
+    mpn_sec_sub_1_itch (P_LIMBS),
+
+    // For Elligator_2_Curve25519_decode
+
+    mpn_sec_sqr_itch (P_LIMBS),
+    mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
+    mpn_sec_div_r_itch (P_LIMBS, P_LIMBS),
+    mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
+    mpn_sec_add_1_itch (P_LIMBS),
+    mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
+
+    // For Elligator_2_Curve25519_convert_from_Ed25519
+    mpn_sec_sqr_itch (P_LIMBS),
+    mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
+    mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
+    mpn_sec_add_1_itch (P_LIMBS),
+    mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
+    mpn_sec_sub_1_itch (P_LIMBS)
+  };
+
+  for (size_t i = 0; i < sizeof scratch_space_lengths
+       / sizeof *scratch_space_lengths; ++i)
+  {
+    if (scratch_space_lengths[i] > scratch_space_length)
+    {
+      scratch_space_length = scratch_space_lengths[i];
+    }
+  }
+
+  initialized = true;
+}
+
+
+/**
+ * Calculates the root of a given number.
+ * Returns trash if the number is a quadratic non-residue.
+ *
+ * @param root storage for calculated root
+ * @param number value for which the root is calculated
+ * @param scratch_space buffer for calculation
+ */
+static void
+least_square_root (mp_limb_t *root,
+                   const mp_limb_t *number,
+                   mp_limb_t *scratch_space)
+{
+  mp_limb_t a[P_LIMBS + P_LIMBS];
+  mp_limb_t b[P_LIMBS];
+
+  // root := number ^ ((p + 3) / 8)
+
+  mpn_add_n (b, number, p, P_LIMBS); // The next function requires a nonzero input
+  mpn_sec_powm (root, b, P_LIMBS, divide_plus_p_3_8, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+
+  // If root ^ 2 != number, root := root * square_root(-1)
+
+  mpn_sec_sqr (a, root, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sub_n (b, a, number, P_LIMBS);
+
+  mp_limb_t condition = mpn_sec_sub_1 (b, b, P_LIMBS, 1, scratch_space) ^ 1;
+
+  mpn_sec_mul (a, root, P_LIMBS, square_root_negative_1, P_LIMBS,
+               scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+
+  mpn_cnd_swap (condition, root, a, P_LIMBS);
+
+  // If root > (p - 1) / 2, root := -root
+
+  condition = mpn_sub_n (a, divide_minus_p_1_2, root, P_LIMBS);
+
+  mpn_sub_n (a, p, root, P_LIMBS); // If root = 0, a := p
+
+  mpn_cnd_swap (condition, root, a, P_LIMBS);
+}
+
+
+bool
+GNUNET_CRYPTO_ecdhe_elligator_encoding (
+  struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  const struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+  bool high_y)
+{
+  uint8_t *representative = (uint8_t *) r->r;
+  uint8_t *point = (uint8_t *) pub->q_y;
+
+  mp_limb_t scratch_space[scratch_space_length];
+
+  mp_limb_t a[P_LIMBS + P_LIMBS];
+  mp_limb_t b[P_LIMBS + P_LIMBS];
+  mp_limb_t c[P_LIMBS + P_LIMBS];
+
+  // a := point
+
+  decode_bytes (a, point);
+
+  // b := -a / (a + A), or b := p if a = 0
+
+  mpn_add_n (b, a, A, P_LIMBS);
+  mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  mpn_sec_mul (b, c, P_LIMBS, a, P_LIMBS, scratch_space);
+  mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sub_n (b, p, b, P_LIMBS);
+
+  // If high_y = true, b := 1 / b or b := 0 if it was = p
+
+  mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  mpn_cnd_swap (high_y, b, c, P_LIMBS);
+
+  // c := b / u
+
+  mpn_sec_mul (c, b, P_LIMBS, inverted_u, P_LIMBS, scratch_space);
+  mpn_sec_div_r (c, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+
+  // If c is a square modulo p, b := least_square_root(c)
+
+  least_square_root (b, c, scratch_space);
+
+  // Determine, whether b ^ 2 = c
+
+  mpn_sec_sqr (a, b, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sub_n (a, a, c, P_LIMBS);
+
+  bool result = mpn_sec_sub_1 (a, a, P_LIMBS, 1, scratch_space);
+
+  encode_bytes (representative, b);
+
+  return result;
+}
+
+
+/**
+ * Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve.
+ * This function works deterministically.
+ * This step is also known as elligators "decoding" step.
+ * Taken from https://github.com/Kleshni/Elligator-2/blob/master/main.c.
+ *
+ * @param point storage for calculated point on Curve25519
+ * @param high_y The 'high_y' argument of the corresponding GNUNET_CRYPTO_ecdhe_elligator_encoding call
+ * @param representative Given representative
+ * @return 'false' if extra step during direct map calculation is needed, otherwise 'true'
+ */
+static bool
+elligator_direct_map (uint8_t *point,
+                      bool *high_y,
+                      uint8_t *representative)
+{
+  mp_limb_t scratch_space[scratch_space_length];
+
+  mp_limb_t a[P_LIMBS + P_LIMBS];
+  mp_limb_t b[P_LIMBS + P_LIMBS];
+  mp_limb_t c[P_LIMBS];
+  mp_limb_t e[P_LIMBS + P_LIMBS];
+
+  // a := representative
+
+  decode_bytes (a, representative);
+
+  // Determine whether a < (p - 1) / 2
+
+  bool result = mpn_sub_n (b, divide_minus_p_1_2, a, P_LIMBS) ^ 1;
+
+  // b := -A / (1 + u * a ^ 2)
+
+  mpn_sec_sqr (b, a, P_LIMBS, scratch_space);
+  mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sec_mul (a, u, P_LIMBS, b, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sec_add_1 (b, a, P_LIMBS, 1, scratch_space);
+  mpn_sec_powm (a, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  mpn_sec_mul (b, a, P_LIMBS, negative_A, P_LIMBS, scratch_space);
+  mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+
+  // a := b ^ 3 + A * b ^ 2 + b (with 1-bit overflow)
+
+  mpn_sec_sqr (a, b, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_add_n (c, b, A, P_LIMBS);
+  mpn_sec_mul (e, c, P_LIMBS, a, P_LIMBS, scratch_space);
+  mpn_sec_div_r (e, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_add_n (a, e, b, P_LIMBS);
+
+  // If a is a quadratic residue modulo p, point := b and high_y := 1
+  // Otherwise point := -b - A and high_y := 0
+
+  mpn_sub_n (c, p, b, P_LIMBS);
+  mpn_add_n (c, c, negative_A, P_LIMBS);
+  mpn_sec_div_r (c, P_LIMBS, p, P_LIMBS, scratch_space);
+
+  mpn_sec_powm (e, a, P_LIMBS, divide_minus_p_1_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  *high_y = mpn_sub_n (e, e, divide_minus_p_1_2, P_LIMBS);
+
+  mpn_cnd_swap (*high_y, b, c, P_LIMBS);
+
+  encode_bytes (point, c);
+
+  return result;
+}
+
+
+void
+GNUNET_CRYPTO_ecdhe_elligator_decoding (
+  struct GNUNET_CRYPTO_EcdhePublicKey *point,
+  bool *high_y,
+  const struct GNUNET_CRYPTO_ElligatorRepresentative *representative)
+{
+  // if sign of direct map transformation not needed throw it away
+  bool high_y_local;
+  bool *high_y_ptr;
+  if (NULL == high_y)
+    high_y_ptr = &high_y_local;
+  else
+    high_y_ptr = high_y;
+
+  struct GNUNET_CRYPTO_ElligatorRepresentative r_tmp;
+  memcpy (&r_tmp.r, &representative->r, sizeof(r_tmp.r));
+  r_tmp.r[31] &= 63;
+  // GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"Print high_y\n");
+  elligator_direct_map ((uint8_t *) point->q_y,
+                        high_y_ptr,
+                        (uint8_t *) r_tmp.r);
+}
+
+
+/**
+ * Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve.
+ * This function works deterministically.
+ * This step is also known as elligators "decoding" step.
+ * Taken from https://github.com/Kleshni/Elligator-2/blob/master/main.c.
+ *
+ * @param point storage for calculated point on Curve25519
+ * @param source Ed25519 curve point
+ * @return 'false' if source is not a valid Ed25519 point. In this case the 'point' array will be undefined but dependend on source.
+ */
+static bool
+convert_from_ed_to_curve (uint8_t *point,
+                          const uint8_t *source)
+{
+  mp_limb_t scratch_space[scratch_space_length];
+
+  mp_limb_t y[P_LIMBS];
+  mp_limb_t a[P_LIMBS + P_LIMBS];
+  mp_limb_t b[P_LIMBS + P_LIMBS];
+  mp_limb_t c[P_LIMBS + P_LIMBS];
+
+  uint8_t y_bytes[P_BYTES];
+
+  memcpy (y_bytes, source, 31);
+
+  y_bytes[31] = source[31] & 0x7f;
+
+  decode_bytes (y, y_bytes);
+
+  // Check if y < p
+
+  bool result = mpn_sub_n (a, y, p, P_LIMBS);
+
+  // a := (y ^ 2 - 1) / (1 + d * y ^ 2)
+
+  mpn_sec_sqr (a, y, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sec_mul (b, a, P_LIMBS, d, P_LIMBS, scratch_space);
+  mpn_sec_add_1 (b, b, P_LIMBS, 1, scratch_space);
+  mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+  mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  mpn_add_n (b, a, negative_1, P_LIMBS);
+  mpn_sec_mul (a, b, P_LIMBS, c, P_LIMBS, scratch_space);
+  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+
+  // Check, whether a is a square modulo p (including a = 0)
+
+  mpn_add_n (a, a, p, P_LIMBS);
+  mpn_sec_powm (b, a, P_LIMBS, divide_negative_1_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+
+  result &= mpn_sub_n (c, b, divide_minus_p_1_2, P_LIMBS);
+
+  // If a = p, the parity bit must be 0
+
+  mpn_sub_n (a, a, p, P_LIMBS);
+
+  result ^= mpn_sec_sub_1 (a, a, P_LIMBS, 1, scratch_space) & source[31] >> 7;
+
+  // If y != 1, c := (1 + y) / (1 - y), otherwise c := 0
+
+  mpn_sub_n (a, p, y, P_LIMBS);
+  mpn_sec_add_1 (a, a, P_LIMBS, 1, scratch_space);
+  mpn_sec_powm (b, a, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
+                scratch_space);
+  mpn_sec_add_1 (a, y, P_LIMBS, 1, scratch_space);
+  mpn_sec_mul (c, a, P_LIMBS, b, P_LIMBS, scratch_space);
+  mpn_sec_div_r (c, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
+
+  encode_bytes (point, c);
+
+  return result;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (
+  struct GNUNET_CRYPTO_EcdhePublicKey *pub,
+  struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
+{
+  // eHigh
+  // crypto_scalarmult_ed25519_base clamps the scalar pk->d and return only 0 if pk->d is zero
+  unsigned char eHigh[crypto_scalarmult_SCALARBYTES] = {0};
+  GNUNET_assert (0 == crypto_scalarmult_ed25519_base (eHigh, pk->d));
+
+  // eLow: choose a random point of low order
+  int sLow = (pk->d)[0] % 8;
+  unsigned char eLow[crypto_scalarmult_SCALARBYTES] = {0};
+  memcpy (eLow, lookupTable[sLow], crypto_scalarmult_SCALARBYTES);
+
+  // eHigh + eLow
+  unsigned char edPub[crypto_scalarmult_SCALARBYTES] = {0};
+  if (crypto_core_ed25519_add (edPub, eLow, eHigh) == -1)
+  {
+    return GNUNET_SYSERR;
+  }
+
+  if (convert_from_ed_to_curve (pub->q_y, edPub) == false)
+  {
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_CRYPTO_ecdhe_elligator_key_create (
+  struct GNUNET_CRYPTO_ElligatorRepresentative  *repr,
+  struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
+{
+  // inverse map can fail for some public keys generated by GNUNET_CRYPTO_ecdhe_elligator_generate_public_key
+  bool validKey = 0;
+  struct GNUNET_CRYPTO_EcdhePublicKey pub = {0};
+  int8_t random_tweak;
+  bool high_y;
+  bool msb_set;
+  bool smsb_set;
+
+  while (! validKey)
+  {
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                                pk,
+                                sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+
+    // Continue if generate_public_key fails
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (&pub, pk))
+    {
+      continue;
+    }
+
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                                &random_tweak,
+                                sizeof(int8_t));
+    high_y = random_tweak & 1;
+
+    validKey = GNUNET_CRYPTO_ecdhe_elligator_encoding (repr,
+                                                       &pub,
+                                                       high_y ?
+                                                       GNUNET_YES :
+                                                       GNUNET_NO);
+  }
+
+  // Setting most significant bit and second most significant bit randomly
+  msb_set = (random_tweak >> 1) & 1;
+  smsb_set = (random_tweak >> 2) & 1;
+  if (msb_set)
+  {
+    repr->r[31] |= 128;
+  }
+  if (smsb_set)
+  {
+    repr->r[31] |= 64;
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_elligator_kem_encaps (
+  const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
+  struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
+
+  GNUNET_CRYPTO_ecdhe_elligator_key_create (r, &sk);
+
+  return GNUNET_CRYPTO_ecdh_eddsa (&sk, pub, key_material);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_eddsa_elligator_kem_decaps (
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+  const struct GNUNET_CRYPTO_ElligatorRepresentative *r,
+  struct GNUNET_HashCode *key_material)
+{
+  struct GNUNET_CRYPTO_EcdhePublicKey pub;
+  GNUNET_CRYPTO_ecdhe_elligator_decoding (&pub, NULL, r);
+  return GNUNET_CRYPTO_eddsa_ecdh (priv, &pub, key_material);
+}
diff --git a/src/lib/util/crypto_hash.c b/src/lib/util/crypto_hash.c
new file mode 100644
index 000000000..4f3acde77
--- /dev/null
+++ b/src/lib/util/crypto_hash.c
@@ -0,0 +1,415 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/crypto_hash.c
+ * @brief SHA-512 #GNUNET_CRYPTO_hash() related functions
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+#include <gcrypt.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-hash", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, syscall, \
+                          filename) GNUNET_log_from_strerror_file (kind, \
+                                                                   "util-crypto-hash", \
+                                                                   syscall, \
+                                                                   filename)
+
+void
+GNUNET_CRYPTO_hash (const void *block,
+                    size_t size,
+                    struct GNUNET_HashCode *ret)
+{
+  BENCHMARK_START (hash);
+  gcry_md_hash_buffer (GCRY_MD_SHA512, ret, block, size);
+  BENCHMARK_END (hash);
+}
+
+
+/* ***************** binary-ASCII encoding *************** */
+
+
+void
+GNUNET_CRYPTO_hash_to_enc (const struct GNUNET_HashCode *block,
+                           struct GNUNET_CRYPTO_HashAsciiEncoded *result)
+{
+  char *np;
+
+  np = GNUNET_STRINGS_data_to_string ((const unsigned char *) block,
+                                      sizeof(struct GNUNET_HashCode),
+                                      (char *) result,
+                                      sizeof(struct
+                                             GNUNET_CRYPTO_HashAsciiEncoded)
+                                      - 1);
+  GNUNET_assert (NULL != np);
+  *np = '\0';
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_hash_from_string2 (const char *enc,
+                                 size_t enclen,
+                                 struct GNUNET_HashCode *result)
+{
+  char upper_enc[enclen + 1];
+  char *up_ptr = upper_enc;
+
+  if (GNUNET_OK != GNUNET_STRINGS_utf8_toupper (enc, up_ptr))
+    return GNUNET_SYSERR;
+
+  return GNUNET_STRINGS_string_to_data (upper_enc, enclen,
+                                        (unsigned char *) result,
+                                        sizeof(struct GNUNET_HashCode));
+}
+
+
+unsigned int
+GNUNET_CRYPTO_hash_distance_u32 (const struct GNUNET_HashCode *a,
+                                 const struct GNUNET_HashCode *b)
+{
+  unsigned int x1 = (a->bits[1] - b->bits[1]) >> 16;
+  unsigned int x2 = (b->bits[1] - a->bits[1]) >> 16;
+
+  return(x1 * x2);
+}
+
+
+void
+GNUNET_CRYPTO_hash_create_random (enum GNUNET_CRYPTO_Quality mode,
+                                  struct GNUNET_HashCode *result)
+{
+  for (ssize_t i = (sizeof(struct GNUNET_HashCode) / sizeof(uint32_t)) - 1;
+       i >= 0;
+       i--)
+    result->bits[i] = GNUNET_CRYPTO_random_u32 (mode, UINT32_MAX);
+}
+
+
+void
+GNUNET_CRYPTO_hash_difference (const struct GNUNET_HashCode *a,
+                               const struct GNUNET_HashCode *b,
+                               struct GNUNET_HashCode *result)
+{
+  for (ssize_t i = (sizeof(struct GNUNET_HashCode) / sizeof(unsigned int)) - 1;
+       i >= 0;
+       i--)
+    result->bits[i] = b->bits[i] - a->bits[i];
+}
+
+
+void
+GNUNET_CRYPTO_hash_sum (const struct GNUNET_HashCode *a,
+                        const struct GNUNET_HashCode *delta, struct
+                        GNUNET_HashCode *result)
+{
+  for (ssize_t i = (sizeof(struct GNUNET_HashCode) / sizeof(unsigned int)) - 1;
+       i >= 0;
+       i--)
+    result->bits[i] = delta->bits[i] + a->bits[i];
+}
+
+
+void
+GNUNET_CRYPTO_hash_xor (const struct GNUNET_HashCode *a,
+                        const struct GNUNET_HashCode *b,
+                        struct GNUNET_HashCode *result)
+{
+  const unsigned long long *lla = (const unsigned long long *) a;
+  const unsigned long long *llb = (const unsigned long long *) b;
+  unsigned long long *llr = (unsigned long long *) result;
+
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*a) % sizeof (unsigned long long));
+
+  for (int i = sizeof (*result) / sizeof (*llr) - 1; i>=0; i--)
+    llr[i] = lla[i] ^ llb[i];
+}
+
+
+void
+GNUNET_CRYPTO_hash_to_aes_key (
+  const struct GNUNET_HashCode *hc,
+  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv)
+{
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (
+                   skey,
+                   sizeof(*skey),
+                   "Hash key derivation",
+                   strlen ("Hash key derivation"),
+                   hc, sizeof(*hc),
+                   NULL, 0));
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (
+                   iv,
+                   sizeof(*iv),
+                   "Initialization vector derivation",
+                   strlen ("Initialization vector derivation"),
+                   hc, sizeof(*hc),
+                   NULL, 0));
+}
+
+
+unsigned int
+GNUNET_CRYPTO_hash_count_leading_zeros (const struct GNUNET_HashCode *h)
+{
+  const unsigned long long *llp = (const unsigned long long *) h;
+  unsigned int ret = 0;
+  unsigned int i;
+
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*h) % sizeof (unsigned long long));
+  for (i = 0; i<sizeof (*h) / sizeof (*llp); i++)
+  {
+    if (0LLU != llp[i])
+      break;
+    ret += sizeof (*llp) * 8;
+  }
+  if (ret == 8 * sizeof (*h))
+    return ret;
+  ret += __builtin_clzll (GNUNET_ntohll ((uint64_t) llp[i]));
+  return ret;
+}
+
+
+unsigned int
+GNUNET_CRYPTO_hash_count_tailing_zeros (const struct GNUNET_HashCode *h)
+{
+  const unsigned long long *llp = (const unsigned long long *) h;
+  unsigned int ret = 0;
+  int i;
+
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*h) % sizeof (unsigned long long));
+  for (i = sizeof (*h) / sizeof (*llp) - 1; i>=0; i--)
+  {
+    if (0LLU != llp[i])
+      break;
+    ret += sizeof (*llp) * 8;
+  }
+  if (ret == 8 * sizeof (*h))
+    return ret;
+  ret += __builtin_ctzll (GNUNET_ntohll ((uint64_t) llp[i]));
+  return ret;
+}
+
+
+int
+GNUNET_CRYPTO_hash_cmp (const struct GNUNET_HashCode *h1,
+                        const struct GNUNET_HashCode *h2)
+{
+  unsigned int *i1;
+  unsigned int *i2;
+
+  i1 = (unsigned int *) h1;
+  i2 = (unsigned int *) h2;
+  for (ssize_t i = (sizeof(struct GNUNET_HashCode) / sizeof(unsigned int)) - 1;
+       i >= 0;
+       i--)
+  {
+    if (i1[i] > i2[i])
+      return 1;
+    if (i1[i] < i2[i])
+      return -1;
+  }
+  return 0;
+}
+
+
+int
+GNUNET_CRYPTO_hash_xorcmp (const struct GNUNET_HashCode *h1,
+                           const struct GNUNET_HashCode *h2,
+                           const struct GNUNET_HashCode *target)
+{
+  const unsigned long long *l1 = (const unsigned long long *) h1;
+  const unsigned long long *l2 = (const unsigned long long *) h2;
+  const unsigned long long *t = (const unsigned long long *) target;
+
+  GNUNET_static_assert (0 == sizeof (*h1) % sizeof (*l1));
+  for (size_t i = 0; i < sizeof(*h1) / sizeof(*l1); i++)
+  {
+    unsigned long long x1 = l1[i] ^ t[i];
+    unsigned long long x2 = l2[i] ^ t[i];
+
+    if (x1 > x2)
+      return 1;
+    if (x1 < x2)
+      return -1;
+  }
+  return 0;
+}
+
+
+void
+GNUNET_CRYPTO_hmac_derive_key (
+  struct GNUNET_CRYPTO_AuthKey *key,
+  const struct GNUNET_CRYPTO_SymmetricSessionKey *rkey,
+  const void *salt, size_t salt_len,
+  ...)
+{
+  va_list argp;
+
+  va_start (argp,
+            salt_len);
+  GNUNET_CRYPTO_hmac_derive_key_v (key,
+                                   rkey,
+                                   salt, salt_len,
+                                   argp);
+  va_end (argp);
+}
+
+
+void
+GNUNET_CRYPTO_hmac_derive_key_v (
+  struct GNUNET_CRYPTO_AuthKey *key,
+  const struct GNUNET_CRYPTO_SymmetricSessionKey *rkey,
+  const void *salt, size_t salt_len,
+  va_list argp)
+{
+  GNUNET_CRYPTO_kdf_v (key->key, sizeof(key->key),
+                       salt, salt_len,
+                       rkey, sizeof(struct GNUNET_CRYPTO_SymmetricSessionKey),
+                       argp);
+}
+
+
+void
+GNUNET_CRYPTO_hmac_raw (const void *key, size_t key_len,
+                        const void *plaintext, size_t plaintext_len,
+                        struct GNUNET_HashCode *hmac)
+{
+  static int once;
+  static gcry_md_hd_t md;
+  const unsigned char *mc;
+
+  if (! once)
+  {
+    once = 1;
+    GNUNET_assert (GPG_ERR_NO_ERROR ==
+                   gcry_md_open (&md,
+                                 GCRY_MD_SHA512,
+                                 GCRY_MD_FLAG_HMAC));
+  }
+  else
+  {
+    gcry_md_reset (md);
+  }
+  GNUNET_assert (GPG_ERR_NO_ERROR ==
+                 gcry_md_setkey (md, key, key_len));
+  gcry_md_write (md, plaintext, plaintext_len);
+  mc = gcry_md_read (md, GCRY_MD_SHA512);
+  GNUNET_assert (NULL != mc);
+  GNUNET_memcpy (hmac->bits, mc, sizeof(hmac->bits));
+}
+
+
+void
+GNUNET_CRYPTO_hmac (const struct GNUNET_CRYPTO_AuthKey *key,
+                    const void *plaintext, size_t plaintext_len,
+                    struct GNUNET_HashCode *hmac)
+{
+  GNUNET_CRYPTO_hmac_raw ((void *) key->key, sizeof(key->key),
+                          plaintext, plaintext_len,
+                          hmac);
+}
+
+
+struct GNUNET_HashContext
+{
+  /**
+   * Internal state of the hash function.
+   */
+  gcry_md_hd_t hd;
+};
+
+
+struct GNUNET_HashContext *
+GNUNET_CRYPTO_hash_context_start ()
+{
+  struct GNUNET_HashContext *hc;
+
+  BENCHMARK_START (hash_context_start);
+  hc = GNUNET_new (struct GNUNET_HashContext);
+  GNUNET_assert (0 ==
+                 gcry_md_open (&hc->hd,
+                               GCRY_MD_SHA512,
+                               0));
+  BENCHMARK_END (hash_context_start);
+  return hc;
+}
+
+
+void
+GNUNET_CRYPTO_hash_context_read (struct GNUNET_HashContext *hc,
+                                 const void *buf,
+                                 size_t size)
+{
+  BENCHMARK_START (hash_context_read);
+  gcry_md_write (hc->hd, buf, size);
+  BENCHMARK_END (hash_context_read);
+}
+
+
+struct GNUNET_HashContext *
+GNUNET_CRYPTO_hash_context_copy (const struct GNUNET_HashContext *hc)
+{
+  struct GNUNET_HashContext *cp;
+
+  cp = GNUNET_new (struct GNUNET_HashContext);
+  GNUNET_assert (0 ==
+                 gcry_md_copy (&cp->hd,
+                               hc->hd));
+  return cp;
+}
+
+
+void
+GNUNET_CRYPTO_hash_context_finish (struct GNUNET_HashContext *hc,
+                                   struct GNUNET_HashCode *r_hash)
+{
+  const void *res = gcry_md_read (hc->hd, 0);
+
+  BENCHMARK_START (hash_context_finish);
+
+  GNUNET_assert (NULL != res);
+  if (NULL != r_hash)
+    GNUNET_memcpy (r_hash,
+                   res,
+                   sizeof(struct GNUNET_HashCode));
+  GNUNET_CRYPTO_hash_context_abort (hc);
+  BENCHMARK_END (hash_context_finish);
+}
+
+
+void
+GNUNET_CRYPTO_hash_context_abort (struct GNUNET_HashContext *hc)
+{
+  gcry_md_close (hc->hd);
+  GNUNET_free (hc);
+}
+
+
+/* end of crypto_hash.c */
diff --git a/src/lib/util/crypto_hash_file.c b/src/lib/util/crypto_hash_file.c
new file mode 100644
index 000000000..96d364d2b
--- /dev/null
+++ b/src/lib/util/crypto_hash_file.c
@@ -0,0 +1,236 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/crypto_hash_file.c
+ * @brief incremental hashing of files
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-hash-file", \
+                                        __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, syscall, \
+                          filename) GNUNET_log_from_strerror_file (kind, \
+                                                                   "util-crypto-hash-file", \
+                                                                   syscall, \
+                                                                   filename)
+
+
+/**
+ * Context used when hashing a file.
+ */
+struct GNUNET_CRYPTO_FileHashContext
+{
+  /**
+   * Function to call upon completion.
+   */
+  GNUNET_CRYPTO_HashCompletedCallback callback;
+
+  /**
+   * Closure for callback.
+   */
+  void *callback_cls;
+
+  /**
+   * IO buffer.
+   */
+  unsigned char *buffer;
+
+  /**
+   * Name of the file we are hashing.
+   */
+  char *filename;
+
+  /**
+   * File descriptor.
+   */
+  struct GNUNET_DISK_FileHandle *fh;
+
+  /**
+   * Cummulated hash.
+   */
+  gcry_md_hd_t md;
+
+  /**
+   * Size of the file.
+   */
+  uint64_t fsize;
+
+  /**
+   * Current offset.
+   */
+  uint64_t offset;
+
+  /**
+   * Current task for hashing.
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+
+  /**
+   * Priority we use.
+   */
+  enum GNUNET_SCHEDULER_Priority priority;
+
+  /**
+   * Blocksize.
+   */
+  size_t bsize;
+};
+
+
+/**
+ * Report result of hash computation to callback
+ * and free associated resources.
+ */
+static void
+file_hash_finish (struct GNUNET_CRYPTO_FileHashContext *fhc,
+                  const struct GNUNET_HashCode *res)
+{
+  fhc->callback (fhc->callback_cls, res);
+  GNUNET_free (fhc->filename);
+  if (! GNUNET_DISK_handle_invalid (fhc->fh))
+    GNUNET_break (GNUNET_OK == GNUNET_DISK_file_close (fhc->fh));
+  gcry_md_close (fhc->md);
+  GNUNET_free (fhc);             /* also frees fhc->buffer */
+}
+
+
+/**
+ * File hashing task.
+ *
+ * @param cls closure
+ */
+static void
+file_hash_task (void *cls)
+{
+  struct GNUNET_CRYPTO_FileHashContext *fhc = cls;
+  struct GNUNET_HashCode *res;
+  size_t delta;
+  ssize_t sret;
+
+  fhc->task = NULL;
+  GNUNET_assert (fhc->offset <= fhc->fsize);
+  delta = fhc->bsize;
+  if (fhc->fsize - fhc->offset < delta)
+    delta = fhc->fsize - fhc->offset;
+  sret = GNUNET_DISK_file_read (fhc->fh,
+                                fhc->buffer,
+                                delta);
+  if ((sret < 0) ||
+      (delta != (size_t) sret))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING,
+                       "read",
+                       fhc->filename);
+    file_hash_finish (fhc,
+                      NULL);
+    return;
+  }
+  gcry_md_write (fhc->md,
+                 fhc->buffer,
+                 delta);
+  fhc->offset += delta;
+  if (fhc->offset == fhc->fsize)
+  {
+    res = (struct GNUNET_HashCode *) gcry_md_read (fhc->md,
+                                                   GCRY_MD_SHA512);
+    file_hash_finish (fhc, res);
+    return;
+  }
+  fhc->task = GNUNET_SCHEDULER_add_with_priority (fhc->priority,
+                                                  &file_hash_task,
+                                                  fhc);
+}
+
+
+struct GNUNET_CRYPTO_FileHashContext *
+GNUNET_CRYPTO_hash_file (enum GNUNET_SCHEDULER_Priority priority,
+                         const char *filename,
+                         size_t blocksize,
+                         GNUNET_CRYPTO_HashCompletedCallback callback,
+                         void *callback_cls)
+{
+  struct GNUNET_CRYPTO_FileHashContext *fhc;
+
+  GNUNET_assert (blocksize > 0);
+  fhc =
+    GNUNET_malloc (sizeof(struct GNUNET_CRYPTO_FileHashContext) + blocksize);
+  fhc->callback = callback;
+  fhc->callback_cls = callback_cls;
+  fhc->buffer = (unsigned char *) &fhc[1];
+  fhc->filename = GNUNET_strdup (filename);
+  if (GPG_ERR_NO_ERROR != gcry_md_open (&fhc->md, GCRY_MD_SHA512, 0))
+  {
+    GNUNET_break (0);
+    GNUNET_free (fhc->filename);
+    GNUNET_free (fhc);
+    return NULL;
+  }
+  fhc->bsize = blocksize;
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_size (filename,
+                             &fhc->fsize,
+                             GNUNET_NO,
+                             GNUNET_YES))
+  {
+    GNUNET_free (fhc->filename);
+    GNUNET_free (fhc);
+    return NULL;
+  }
+  fhc->fh = GNUNET_DISK_file_open (filename,
+                                   GNUNET_DISK_OPEN_READ,
+                                   GNUNET_DISK_PERM_NONE);
+  if (! fhc->fh)
+  {
+    GNUNET_free (fhc->filename);
+    GNUNET_free (fhc);
+    return NULL;
+  }
+  fhc->priority = priority;
+  fhc->task = GNUNET_SCHEDULER_add_with_priority (priority,
+                                                  &file_hash_task,
+                                                  fhc);
+  return fhc;
+}
+
+
+/**
+ * Cancel a file hashing operation.
+ *
+ * @param fhc operation to cancel (callback must not yet have been invoked)
+ */
+void
+GNUNET_CRYPTO_hash_file_cancel (struct GNUNET_CRYPTO_FileHashContext *fhc)
+{
+  GNUNET_SCHEDULER_cancel (fhc->task);
+  GNUNET_free (fhc->filename);
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_file_close (fhc->fh));
+  gcry_md_close (fhc->md);
+  GNUNET_free (fhc);
+}
+
+
+/* end of crypto_hash_file.c */
diff --git a/src/lib/util/crypto_hkdf.c b/src/lib/util/crypto_hkdf.c
new file mode 100644
index 000000000..e724bc9ba
--- /dev/null
+++ b/src/lib/util/crypto_hkdf.c
@@ -0,0 +1,369 @@
+/*
+    Copyright (c) 2010 Nils Durner
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+ */
+
+/**
+ * @file src/util/crypto_hkdf.c
+ * @brief Hash-based KDF as defined in RFC 5869
+ * @see http://www.rfc-editor.org/rfc/rfc5869.txt
+ * @todo remove GNUNET references
+ * @author Nils Durner
+ *
+ * The following list of people have reviewed this code and considered
+ * it correct on the date given (if you reviewed it, please
+ * have your name added to the list):
+ *
+ * - Christian Grothoff (08.10.2010)
+ * - Nathan Evans (08.10.2010)
+ * - Matthias Wachs (08.10.2010)
+ */
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-hkdf", __VA_ARGS__)
+
+/**
+ * Set this to 0 if you compile this code outside of GNUnet.
+ */
+#define GNUNET_BUILD 1
+
+/**
+ * Enable debugging.
+ */
+#define DEBUG_HKDF 0
+
+
+#if GNUNET_BUILD
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+#else
+#define GNUNET_NO 0
+#define GNUNET_YES 1
+#define GNUNET_SYSERR -1
+#include <stdlib.h>
+#endif
+
+#include <gcrypt.h>
+
+
+/**
+ * @brief Compute the HMAC
+ * @todo use chunked buffers
+ * @param mac gcrypt MAC handle
+ * @param key HMAC key
+ * @param key_len length of key
+ * @param buf message to be processed
+ * @param buf_len length of buf
+ * @return HMAC, freed by caller via gcry_md_close/_reset
+ */
+static const void *
+doHMAC (gcry_md_hd_t mac,
+        const void *key,
+        size_t key_len,
+        const void *buf,
+        size_t buf_len)
+{
+  if (GPG_ERR_NO_ERROR !=
+      gcry_md_setkey (mac, key, key_len))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  gcry_md_write (mac,
+                 buf,
+                 buf_len);
+  return (const void *) gcry_md_read (mac, 0);
+}
+
+
+/**
+ * @brief Generate pseudo-random key
+ * @param mac gcrypt HMAC handle
+ * @param xts salt
+ * @param xts_len length of the @a xts salt
+ * @param skm source key material
+ * @param skm_len length of @a skm
+ * @param prk result buffer (allocated by caller; at least gcry_md_dlen() bytes)
+ * @return #GNUNET_YES on success
+ */
+static enum GNUNET_GenericReturnValue
+getPRK (gcry_md_hd_t mac,
+        const void *xts,
+        size_t xts_len,
+        const void *skm,
+        size_t skm_len,
+        void *prk)
+{
+  const void *ret;
+  size_t dlen;
+
+  dlen = gcry_md_get_algo_dlen (gcry_md_get_algo (mac));
+
+  /* sanity check to bound stack allocation */
+  GNUNET_assert (dlen <= 512);
+
+  /* From RFC 5869:
+   * salt - optional salt value (a non-secret random value);
+   * if not provided, it is set to a string of HashLen zeros. */
+
+  if (0 == xts_len)
+  {
+    char zero_salt[dlen];
+
+    memset (zero_salt, 0, dlen);
+    ret = doHMAC (mac, zero_salt, dlen, skm, skm_len);
+  }
+  else
+  {
+    ret = doHMAC (mac, xts, xts_len, skm, skm_len);
+  }
+  if (NULL == ret)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (prk,
+                 ret,
+                 dlen);
+  return GNUNET_YES;
+}
+
+
+#if DEBUG_HKDF
+static void
+dump (const char *src,
+      const void *p,
+      unsigned int l)
+{
+  printf ("\n%s: ", src);
+  for (unsigned int i = 0; i < l; i++)
+  {
+    printf ("%2x", (int) ((const unsigned char *) p)[i]);
+  }
+  printf ("\n");
+}
+
+
+#endif
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_hkdf_v (void *result,
+                      size_t out_len,
+                      int xtr_algo,
+                      int prf_algo,
+                      const void *xts,
+                      size_t xts_len,
+                      const void *skm,
+                      size_t skm_len,
+                      va_list argp)
+{
+  gcry_md_hd_t xtr;
+  gcry_md_hd_t prf;
+  const void *hc;
+  unsigned long i;
+  unsigned long t;
+  unsigned long d;
+  unsigned int k = gcry_md_get_algo_dlen (prf_algo);
+  unsigned int xtr_len = gcry_md_get_algo_dlen (xtr_algo);
+  char prk[xtr_len];
+  int ret;
+  size_t ctx_len;
+  va_list args;
+
+  BENCHMARK_START (hkdf);
+
+  if (0 == k)
+    return GNUNET_SYSERR;
+  if (GPG_ERR_NO_ERROR !=
+      gcry_md_open (&xtr,
+                    xtr_algo,
+                    GCRY_MD_FLAG_HMAC))
+    return GNUNET_SYSERR;
+  if (GPG_ERR_NO_ERROR !=
+      gcry_md_open (&prf,
+                    prf_algo,
+                    GCRY_MD_FLAG_HMAC))
+  {
+    gcry_md_close (xtr);
+    return GNUNET_SYSERR;
+  }
+  va_copy (args, argp);
+
+  ctx_len = 0;
+  while (NULL != va_arg (args, void *))
+  {
+    size_t nxt = va_arg (args, size_t);
+    if (nxt + ctx_len < nxt)
+    {
+      /* integer overflow */
+      GNUNET_break (0);
+      va_end (args);
+      goto hkdf_error;
+    }
+    ctx_len += nxt;
+  }
+
+  va_end (args);
+
+  if ( (k + ctx_len < ctx_len) ||
+       (k + ctx_len + 1 < ctx_len) )
+  {
+    /* integer overflow */
+    GNUNET_break (0);
+    goto hkdf_error;
+  }
+
+  memset (result, 0, out_len);
+  if (GNUNET_YES !=
+      getPRK (xtr, xts, xts_len, skm, skm_len, prk))
+    goto hkdf_error;
+#if DEBUG_HKDF
+  dump ("PRK", prk, xtr_len);
+#endif
+
+  t = out_len / k;
+  d = out_len % k;
+
+  /* K(1) */
+  {
+    size_t plain_len = k + ctx_len + 1;
+    char *plain;
+    const void *ctx;
+    char *dst;
+
+    plain = GNUNET_malloc (plain_len);
+    dst = plain + k;
+    va_copy (args, argp);
+    while ((ctx = va_arg (args, void *)))
+    {
+      size_t len;
+
+      len = va_arg (args, size_t);
+      GNUNET_memcpy (dst, ctx, len);
+      dst += len;
+    }
+    va_end (args);
+
+    if (t > 0)
+    {
+      plain[k + ctx_len] = (char) 1;
+#if DEBUG_HKDF
+      dump ("K(1)", plain, plain_len);
+#endif
+      hc = doHMAC (prf, prk, xtr_len, &plain[k], ctx_len + 1);
+      if (hc == NULL)
+      {
+        GNUNET_free (plain);
+        goto hkdf_error;
+      }
+      GNUNET_memcpy (result, hc, k);
+      result += k;
+    }
+
+    /* K(i+1) */
+    for (i = 1; i < t; i++)
+    {
+      GNUNET_memcpy (plain, result - k, k);
+      plain[k + ctx_len] = (char) (i + 1);
+      gcry_md_reset (prf);
+#if DEBUG_HKDF
+      dump ("K(i+1)", plain, plain_len);
+#endif
+      hc = doHMAC (prf, prk, xtr_len, plain, plain_len);
+      if (NULL == hc)
+      {
+        GNUNET_free (plain);
+        goto hkdf_error;
+      }
+      GNUNET_memcpy (result, hc, k);
+      result += k;
+    }
+
+    /* K(t):d */
+    if (d > 0)
+    {
+      if (t > 0)
+      {
+        GNUNET_memcpy (plain, result - k, k);
+        i++;
+      }
+      plain[k + ctx_len] = (char) i;
+      gcry_md_reset (prf);
+#if DEBUG_HKDF
+      dump ("K(t):d", plain, plain_len);
+#endif
+      if (t > 0)
+        hc = doHMAC (prf, prk, xtr_len, plain, plain_len);
+      else
+        hc = doHMAC (prf, prk, xtr_len, plain + k, plain_len - k);
+      if (hc == NULL)
+      {
+        GNUNET_free (plain);
+        goto hkdf_error;
+      }
+      GNUNET_memcpy (result, hc, d);
+    }
+#if DEBUG_HKDF
+    dump ("result", result - k, out_len);
+#endif
+
+    ret = GNUNET_YES;
+    GNUNET_free (plain);
+    goto hkdf_ok;
+  }
+hkdf_error:
+  ret = GNUNET_SYSERR;
+hkdf_ok:
+  gcry_md_close (xtr);
+  gcry_md_close (prf);
+  BENCHMARK_END (hkdf);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_hkdf (void *result,
+                    size_t out_len,
+                    int xtr_algo,
+                    int prf_algo,
+                    const void *xts,
+                    size_t xts_len,
+                    const void *skm,
+                    size_t skm_len, ...)
+{
+  va_list argp;
+  enum GNUNET_GenericReturnValue ret;
+
+  va_start (argp, skm_len);
+  ret =
+    GNUNET_CRYPTO_hkdf_v (result,
+                          out_len,
+                          xtr_algo,
+                          prf_algo,
+                          xts,
+                          xts_len,
+                          skm,
+                          skm_len,
+                          argp);
+  va_end (argp);
+  return ret;
+}
+
+
+/* end of crypto_hkdf.c */
diff --git a/src/lib/util/crypto_kdf.c b/src/lib/util/crypto_kdf.c
new file mode 100644
index 000000000..7cfd8fea4
--- /dev/null
+++ b/src/lib/util/crypto_kdf.c
@@ -0,0 +1,145 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file src/util/crypto_kdf.c
+ * @brief Key derivation
+ * @author Nils Durner
+ * @author Jeffrey Burdges <burdges@gnunet.org>
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+
+
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-kdf", __VA_ARGS__)
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_kdf_v (void *result,
+                     size_t out_len,
+                     const void *xts,
+                     size_t xts_len,
+                     const void *skm,
+                     size_t skm_len,
+                     va_list argp)
+{
+  /*
+   * "Finally, we point out to a particularly advantageous instantiation using
+   * HMAC-SHA512 as XTR and HMAC-SHA256 in PRF* (in which case the output from SHA-512 is
+   * truncated to 256 bits). This makes sense in two ways: First, the extraction part is where we need a
+   * stronger hash function due to the unconventional demand from the hash function in the extraction
+   * setting. Second, as shown in Section 6, using HMAC with a truncated output as an extractor
+   * allows to prove the security of HKDF under considerably weaker assumptions on the underlying
+   * hash function."
+   *
+   * http://eprint.iacr.org/2010/264
+   */
+  return GNUNET_CRYPTO_hkdf_v (result,
+                               out_len,
+                               GCRY_MD_SHA512,
+                               GCRY_MD_SHA256,
+                               xts,
+                               xts_len,
+                               skm,
+                               skm_len,
+                               argp);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_kdf (void *result,
+                   size_t out_len,
+                   const void *xts,
+                   size_t xts_len,
+                   const void *skm,
+                   size_t skm_len, ...)
+{
+  va_list argp;
+  int ret;
+
+  va_start (argp, skm_len);
+  ret = GNUNET_CRYPTO_kdf_v (result,
+                             out_len,
+                             xts,
+                             xts_len,
+                             skm,
+                             skm_len,
+                             argp);
+  va_end (argp);
+
+  return ret;
+}
+
+
+void
+GNUNET_CRYPTO_kdf_mod_mpi (gcry_mpi_t *r,
+                           gcry_mpi_t n,
+                           const void *xts, size_t xts_len,
+                           const void *skm, size_t skm_len,
+                           const char *ctx)
+{
+  gcry_error_t rc;
+  unsigned int nbits;
+  size_t rsize;
+  uint16_t ctr;
+
+  nbits = gcry_mpi_get_nbits (n);
+  /* GNUNET_assert (nbits > 512); */
+  ctr = 0;
+  while (1)
+  {
+    /* Ain't clear if n is always divisible by 8 */
+    size_t bsize = (nbits - 1) / 8 + 1;
+    uint8_t buf[bsize];
+    uint16_t ctr_nbo = htons (ctr);
+
+    rc = GNUNET_CRYPTO_kdf (buf,
+                            bsize,
+                            xts, xts_len,
+                            skm, skm_len,
+                            ctx, strlen (ctx),
+                            &ctr_nbo, sizeof(ctr_nbo),
+                            NULL, 0);
+    GNUNET_assert (GNUNET_YES == rc);
+    rc = gcry_mpi_scan (r,
+                        GCRYMPI_FMT_USG,
+                        (const unsigned char *) buf,
+                        bsize,
+                        &rsize);
+    GNUNET_assert (GPG_ERR_NO_ERROR == rc);  /* Allocation error? */
+    GNUNET_assert (rsize == bsize);
+    gcry_mpi_clear_highbit (*r,
+                            nbits);
+    GNUNET_assert (0 ==
+                   gcry_mpi_test_bit (*r,
+                                      nbits));
+    ++ctr;
+    /* We reject this FDH if either *r > n and retry with another ctr */
+    if (0 > gcry_mpi_cmp (*r, n))
+      break;
+    gcry_mpi_release (*r);
+  }
+}
+
+
+/* end of crypto_kdf.c */
diff --git a/src/lib/util/crypto_mpi.c b/src/lib/util/crypto_mpi.c
new file mode 100644
index 000000000..06f2fd786
--- /dev/null
+++ b/src/lib/util/crypto_mpi.c
@@ -0,0 +1,178 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_mpi.c
+ * @brief Helper functions for libgcrypt MPIs
+ * @author Christian Grothoff
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-mpi", __VA_ARGS__)
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' with the message given
+ * by gcry_strerror(rc).
+ */
+#define LOG_GCRY(level, cmd, rc) do { LOG (level, _ ( \
+                                             "`%s' failed at %s:%d with error: %s\n"), \
+                                           cmd, __FILE__, __LINE__, \
+                                           gcry_strerror (rc)); } while (0)
+
+
+/**
+ * If target != size, move @a target bytes to the end of the size-sized
+ * buffer and zero out the first @a target - @a size bytes.
+ *
+ * @param buf original buffer
+ * @param size number of bytes in @a buf
+ * @param target target size of the buffer
+ */
+static void
+adjust (void *buf,
+        size_t size,
+        size_t target)
+{
+  char *p = buf;
+
+  if (size < target)
+  {
+    memmove (&p[target - size], buf, size);
+    memset (buf, 0, target - size);
+  }
+}
+
+
+/**
+ * Output the given MPI value to the given buffer in
+ * network byte order.
+ * The MPI @a val may not be negative.
+ *
+ * @param buf where to output to
+ * @param size number of bytes in @a buf
+ * @param val value to write to @a buf
+ */
+void
+GNUNET_CRYPTO_mpi_print_unsigned (void *buf,
+                                  size_t size,
+                                  gcry_mpi_t val)
+{
+  size_t rsize;
+  int rc;
+
+  if (gcry_mpi_get_flag (val, GCRYMPI_FLAG_OPAQUE))
+  {
+    /* Store opaque MPIs left aligned into the buffer.  */
+    unsigned int nbits;
+    const void *p;
+
+    p = gcry_mpi_get_opaque (val, &nbits);
+    GNUNET_assert (p);
+    rsize = (nbits + 7) / 8;
+    if (rsize > size)
+      rsize = size;
+    GNUNET_memcpy (buf, p, rsize);
+    if (rsize < size)
+      memset (buf + rsize, 0, size - rsize);
+  }
+  else
+  {
+    /* Store regular MPIs as unsigned integers right aligned into
+       the buffer.  */
+    rsize = size;
+    if (0 !=
+        (rc = gcry_mpi_print (GCRYMPI_FMT_USG,
+                              buf,
+                              rsize, &rsize,
+                              val)))
+    {
+      LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+                "gcry_mpi_print",
+                rc);
+      GNUNET_assert (0);
+    }
+    adjust (buf, rsize, size);
+  }
+}
+
+
+/**
+ * Convert data buffer into MPI value.
+ * The buffer is interpreted as network
+ * byte order, unsigned integer.
+ *
+ * @param result where to store MPI value (allocated)
+ * @param data raw data (GCRYMPI_FMT_USG)
+ * @param size number of bytes in @a data
+ */
+void
+GNUNET_CRYPTO_mpi_scan_unsigned (gcry_mpi_t *result,
+                                 const void *data,
+                                 size_t size)
+{
+  int rc;
+
+  if (0 != (rc = gcry_mpi_scan (result,
+                                GCRYMPI_FMT_USG,
+                                data, size, &size)))
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "gcry_mpi_scan",
+              rc);
+    GNUNET_assert (0);
+  }
+}
+
+
+/**
+ * Convert little endian data buffer into MPI value.
+ * The buffer is interpreted as network
+ * byte order, unsigned integer.
+ *
+ * @param result where to store MPI value (allocated)
+ * @param data raw data (GCRYMPI_FMT_USG)
+ * @param size number of bytes in @a data
+ */
+void
+GNUNET_CRYPTO_mpi_scan_unsigned_le (gcry_mpi_t *result,
+                                    const void *data,
+                                    size_t size)
+{
+  int rc;
+
+  if (0 != (rc = gcry_mpi_scan (result,
+                                GCRYMPI_FMT_USG,
+                                data, size, &size)))
+  {
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "gcry_mpi_scan",
+              rc);
+    GNUNET_assert (0);
+  }
+}
+
+
+/* end of crypto_mpi.c */
diff --git a/src/lib/util/crypto_paillier.c b/src/lib/util/crypto_paillier.c
new file mode 100644
index 000000000..169d1e49e
--- /dev/null
+++ b/src/lib/util/crypto_paillier.c
@@ -0,0 +1,463 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_paillier.c
+ * @brief implementation of the paillier crypto system with libgcrypt
+ * @author Florian Dold
+ * @author Christian Fuchs
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Create a freshly generated paillier public key.
+ *
+ * @param[out] public_key Where to store the public key?
+ * @param[out] private_key Where to store the private key?
+ */
+void
+GNUNET_CRYPTO_paillier_create (struct
+                               GNUNET_CRYPTO_PaillierPublicKey *public_key,
+                               struct GNUNET_CRYPTO_PaillierPrivateKey *
+                               private_key)
+{
+  gcry_mpi_t p;
+  gcry_mpi_t q;
+  gcry_mpi_t phi;
+  gcry_mpi_t mu;
+  gcry_mpi_t n;
+
+  /* Generate two distinct primes.  The probability that the loop body
+     is executed more than once is very very low... */
+  p = NULL;
+  q = NULL;
+  do
+  {
+    if (NULL != p)
+      gcry_mpi_release (p);
+    if (NULL != q)
+      gcry_mpi_release (q);
+    GNUNET_assert (0 ==
+                   gcry_prime_generate (&p,
+                                        GNUNET_CRYPTO_PAILLIER_BITS / 2,
+                                        0, NULL, NULL, NULL,
+                                        GCRY_STRONG_RANDOM, 0));
+    GNUNET_assert (0 ==
+                   gcry_prime_generate (&q,
+                                        GNUNET_CRYPTO_PAILLIER_BITS / 2,
+                                        0, NULL, NULL, NULL,
+                                        GCRY_STRONG_RANDOM, 0));
+  }
+  while (0 == gcry_mpi_cmp (p, q));
+  /* n = p * q */
+  GNUNET_assert (NULL != (n = gcry_mpi_new (0)));
+  gcry_mpi_mul (n,
+                p,
+                q);
+  GNUNET_CRYPTO_mpi_print_unsigned (public_key,
+                                    sizeof(struct
+                                           GNUNET_CRYPTO_PaillierPublicKey),
+                                    n);
+
+  /* compute phi(n) = (p-1)(q-1) */
+  GNUNET_assert (NULL != (phi = gcry_mpi_new (0)));
+  gcry_mpi_sub_ui (p, p, 1);
+  gcry_mpi_sub_ui (q, q, 1);
+  gcry_mpi_mul (phi, p, q);
+  gcry_mpi_release (p);
+  gcry_mpi_release (q);
+
+  /* lambda equals phi(n) in the simplified key generation */
+  GNUNET_CRYPTO_mpi_print_unsigned (private_key->lambda,
+                                    GNUNET_CRYPTO_PAILLIER_BITS / 8,
+                                    phi);
+  /* mu = phi^{-1} mod n, as we use g = n + 1 */
+  GNUNET_assert (NULL != (mu = gcry_mpi_new (0)));
+  GNUNET_assert (0 != gcry_mpi_invm (mu,
+                                     phi,
+                                     n));
+  gcry_mpi_release (phi);
+  gcry_mpi_release (n);
+  GNUNET_CRYPTO_mpi_print_unsigned (private_key->mu,
+                                    GNUNET_CRYPTO_PAILLIER_BITS / 8,
+                                    mu);
+  gcry_mpi_release (mu);
+}
+
+
+/**
+ * Encrypt a plaintext with a paillier public key.
+ *
+ * @param public_key Public key to use.
+ * @param m Plaintext to encrypt.
+ * @param desired_ops How many homomorphic ops the caller intends to use
+ * @param[out] ciphertext Encryption of @a plaintext with @a public_key.
+ * @return guaranteed number of supported homomorphic operations >= 1,
+ *         or desired_ops, in case that is lower,
+ *         or -1 if less than one homomorphic operation is possible
+ */
+int
+GNUNET_CRYPTO_paillier_encrypt1 (const struct
+                                 GNUNET_CRYPTO_PaillierPublicKey *public_key,
+                                 const gcry_mpi_t m,
+                                 int desired_ops,
+                                 struct GNUNET_CRYPTO_PaillierCiphertext *
+                                 ciphertext)
+{
+  int possible_opts;
+  gcry_mpi_t n_square;
+  gcry_mpi_t r;
+  gcry_mpi_t c;
+  gcry_mpi_t n;
+  gcry_mpi_t tmp1;
+  gcry_mpi_t tmp2;
+  unsigned int highbit;
+
+  /* determine how many operations we could allow, if the other number
+     has the same length. */
+  GNUNET_assert (NULL != (tmp1 = gcry_mpi_set_ui (NULL, 1)));
+  GNUNET_assert (NULL != (tmp2 = gcry_mpi_set_ui (NULL, 2)));
+  gcry_mpi_mul_2exp (tmp1, tmp1, GNUNET_CRYPTO_PAILLIER_BITS);
+
+  /* count number of possible operations
+     this would be nicer with gcry_mpi_get_nbits, however it does not return
+     the BITLENGTH of the given MPI's value, but the bits required
+     to represent the number as MPI. */
+  for (possible_opts = -2; gcry_mpi_cmp (tmp1, m) > 0; possible_opts++)
+    gcry_mpi_div (tmp1, NULL, tmp1, tmp2, 0);
+  gcry_mpi_release (tmp1);
+  gcry_mpi_release (tmp2);
+
+  if (possible_opts < 1)
+    possible_opts = 0;
+  /* soft-cap by caller */
+  possible_opts = (desired_ops < possible_opts) ? desired_ops : possible_opts;
+
+  ciphertext->remaining_ops = htonl (possible_opts);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   public_key,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+  highbit = GNUNET_CRYPTO_PAILLIER_BITS - 1;
+  while ((! gcry_mpi_test_bit (n, highbit)) &&
+         (0 != highbit))
+    highbit--;
+  if (0 == highbit)
+  {
+    /* invalid public key */
+    GNUNET_break_op (0);
+    gcry_mpi_release (n);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 != (n_square = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (r = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (c = gcry_mpi_new (0)));
+  gcry_mpi_mul (n_square, n, n);
+
+  /* generate r < n (without bias) */
+  do
+  {
+    gcry_mpi_randomize (r, highbit + 1, GCRY_STRONG_RANDOM);
+  }
+  while (gcry_mpi_cmp (r, n) >= 0);
+
+  /* c = (n+1)^m mod n^2 */
+  /* c = n + 1 */
+  gcry_mpi_add_ui (c, n, 1);
+  /* c = (n+1)^m mod n^2 */
+  gcry_mpi_powm (c, c, m, n_square);
+  /* r <- r^n mod n^2 */
+  gcry_mpi_powm (r, r, n, n_square);
+  /* c <- r*c mod n^2 */
+  gcry_mpi_mulm (c, r, c, n_square);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (ciphertext->bits,
+                                    sizeof ciphertext->bits,
+                                    c);
+
+  gcry_mpi_release (n_square);
+  gcry_mpi_release (n);
+  gcry_mpi_release (r);
+  gcry_mpi_release (c);
+
+  return possible_opts;
+}
+
+
+/**
+ * Encrypt a plaintext with a paillier public key.
+ *
+ * @param public_key Public key to use.
+ * @param m Plaintext to encrypt.
+ * @param desired_ops How many homomorphic ops the caller intends to use
+ * @param[out] ciphertext Encryption of @a plaintext with @a public_key.
+ * @return guaranteed number of supported homomorphic operations >= 1,
+ *         or desired_ops, in case that is lower,
+ *         or -1 if less than one homomorphic operation is possible
+ */
+int
+GNUNET_CRYPTO_paillier_encrypt (const struct
+                                GNUNET_CRYPTO_PaillierPublicKey *public_key,
+                                const gcry_mpi_t m,
+                                int desired_ops,
+                                struct GNUNET_CRYPTO_PaillierCiphertext *
+                                ciphertext)
+{
+  int possible_opts;
+  gcry_mpi_t n_square;
+  gcry_mpi_t r;
+  gcry_mpi_t rn;
+  gcry_mpi_t g;
+  gcry_mpi_t gm;
+  gcry_mpi_t c;
+  gcry_mpi_t n;
+  gcry_mpi_t max_num;
+  unsigned int highbit;
+
+  /* set max_num = 2^{GNUNET_CRYPTO_PAILLIER_BITS}, the largest
+     number we can have as a result */
+  GNUNET_assert (NULL != (max_num = gcry_mpi_set_ui (NULL, 1)));
+  gcry_mpi_mul_2exp (max_num,
+                     max_num,
+                     GNUNET_CRYPTO_PAILLIER_BITS);
+
+  /* Determine how many operations we could allow, assuming the other
+     number has the same length (or is smaller), by counting the
+     number of possible operations.  We essentially divide max_num by
+     2 until the result is no longer larger than 'm', incrementing the
+     maximum number of operations in each round, starting at -2 */for (possible_opts = -2; gcry_mpi_cmp (max_num, m) > 0; possible_opts++)
+    gcry_mpi_div (max_num,
+                  NULL,
+                  max_num,
+                  GCRYMPI_CONST_TWO,
+                  0);
+  gcry_mpi_release (max_num);
+
+  if (possible_opts < 1)
+    possible_opts = 0;
+  /* Enforce soft-cap by caller */
+  possible_opts = GNUNET_MIN (desired_ops, possible_opts);
+  ciphertext->remaining_ops = htonl (possible_opts);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   public_key,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+
+  /* check public key for number of bits, bail out if key is all zeros */
+  highbit = GNUNET_CRYPTO_PAILLIER_BITS - 1;
+  while ((! gcry_mpi_test_bit (n, highbit)) &&
+         (0 != highbit))
+    highbit--;
+  if (0 == highbit)
+  {
+    /* invalid public key */
+    GNUNET_break_op (0);
+    gcry_mpi_release (n);
+    return GNUNET_SYSERR;
+  }
+
+  /* generate r < n (without bias) */
+  GNUNET_assert (NULL != (r = gcry_mpi_new (0)));
+  do
+  {
+    gcry_mpi_randomize (r, highbit + 1, GCRY_STRONG_RANDOM);
+  }
+  while (gcry_mpi_cmp (r, n) >= 0);
+
+  /* g = n + 1 */
+  GNUNET_assert (0 != (g = gcry_mpi_new (0)));
+  gcry_mpi_add_ui (g, n, 1);
+
+  /* n_square = n^2 */
+  GNUNET_assert (0 != (n_square = gcry_mpi_new (0)));
+  gcry_mpi_mul (n_square,
+                n,
+                n);
+
+  /* gm = g^m mod n^2 */
+  GNUNET_assert (0 != (gm = gcry_mpi_new (0)));
+  gcry_mpi_powm (gm, g, m, n_square);
+  gcry_mpi_release (g);
+
+  /* rn <- r^n mod n^2 */
+  GNUNET_assert (0 != (rn = gcry_mpi_new (0)));
+  gcry_mpi_powm (rn, r, n, n_square);
+  gcry_mpi_release (r);
+  gcry_mpi_release (n);
+
+  /* c <- rn * gm mod n^2 */
+  GNUNET_assert (0 != (c = gcry_mpi_new (0)));
+  gcry_mpi_mulm (c, rn, gm, n_square);
+  gcry_mpi_release (n_square);
+  gcry_mpi_release (gm);
+  gcry_mpi_release (rn);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (ciphertext->bits,
+                                    sizeof(ciphertext->bits),
+                                    c);
+  gcry_mpi_release (c);
+
+  return possible_opts;
+}
+
+
+void
+GNUNET_CRYPTO_paillier_decrypt (const struct
+                                GNUNET_CRYPTO_PaillierPrivateKey *private_key,
+                                const struct
+                                GNUNET_CRYPTO_PaillierPublicKey *public_key,
+                                const struct
+                                GNUNET_CRYPTO_PaillierCiphertext *ciphertext,
+                                gcry_mpi_t m)
+{
+  gcry_mpi_t mu;
+  gcry_mpi_t lambda;
+  gcry_mpi_t n;
+  gcry_mpi_t n_square;
+  gcry_mpi_t c;
+  gcry_mpi_t cmu;
+  gcry_mpi_t cmum1;
+  gcry_mpi_t mod;
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&lambda,
+                                   private_key->lambda,
+                                   sizeof(private_key->lambda));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&mu,
+                                   private_key->mu,
+                                   sizeof(private_key->mu));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   public_key,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&c,
+                                   ciphertext->bits,
+                                   sizeof(ciphertext->bits));
+
+  /* n_square = n * n */
+  GNUNET_assert (0 != (n_square = gcry_mpi_new (0)));
+  gcry_mpi_mul (n_square, n, n);
+
+  /* cmu = c^lambda mod n^2 */
+  GNUNET_assert (0 != (cmu = gcry_mpi_new (0)));
+  gcry_mpi_powm (cmu,
+                 c,
+                 lambda,
+                 n_square);
+  gcry_mpi_release (n_square);
+  gcry_mpi_release (lambda);
+  gcry_mpi_release (c);
+
+  /* cmum1 = cmu - 1 */
+  GNUNET_assert (0 != (cmum1 = gcry_mpi_new (0)));
+  gcry_mpi_sub_ui (cmum1, cmu, 1);
+  gcry_mpi_release (cmu);
+
+  /* mod = cmum1 / n (mod n) */
+  GNUNET_assert (0 != (mod = gcry_mpi_new (0)));
+  gcry_mpi_div (mod, NULL, cmum1, n, 0);
+  gcry_mpi_release (cmum1);
+
+  /* m = mod * mu mod n */
+  gcry_mpi_mulm (m, mod, mu, n);
+  gcry_mpi_release (mod);
+  gcry_mpi_release (mu);
+  gcry_mpi_release (n);
+}
+
+
+int
+GNUNET_CRYPTO_paillier_hom_add (const struct
+                                GNUNET_CRYPTO_PaillierPublicKey *public_key,
+                                const struct
+                                GNUNET_CRYPTO_PaillierCiphertext *c1,
+                                const struct
+                                GNUNET_CRYPTO_PaillierCiphertext *c2,
+                                struct GNUNET_CRYPTO_PaillierCiphertext *result)
+{
+  gcry_mpi_t a;
+  gcry_mpi_t b;
+  gcry_mpi_t c;
+  gcry_mpi_t n;
+  gcry_mpi_t n_square;
+  int32_t o1;
+  int32_t o2;
+
+  o1 = (int32_t) ntohl (c1->remaining_ops);
+  o2 = (int32_t) ntohl (c2->remaining_ops);
+  if ((0 >= o1) || (0 >= o2))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&a,
+                                   c1->bits,
+                                   sizeof(c1->bits));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&b,
+                                   c2->bits,
+                                   sizeof(c2->bits));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   public_key,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+
+  /* n_square = n * n */
+  GNUNET_assert (0 != (n_square = gcry_mpi_new (0)));
+  gcry_mpi_mul (n_square, n, n);
+  gcry_mpi_release (n);
+
+  /* c = a * b mod n_square */
+  GNUNET_assert (0 != (c = gcry_mpi_new (0)));
+  gcry_mpi_mulm (c, a, b, n_square);
+  gcry_mpi_release (n_square);
+  gcry_mpi_release (a);
+  gcry_mpi_release (b);
+
+  result->remaining_ops = htonl (GNUNET_MIN (o1, o2) - 1);
+  GNUNET_CRYPTO_mpi_print_unsigned (result->bits,
+                                    sizeof(result->bits),
+                                    c);
+  gcry_mpi_release (c);
+  return ntohl (result->remaining_ops);
+}
+
+
+/**
+ * Get the number of remaining supported homomorphic operations.
+ *
+ * @param c Paillier cipher text.
+ * @return the number of remaining homomorphic operations
+ */
+int
+GNUNET_CRYPTO_paillier_hom_get_remaining (const struct
+                                          GNUNET_CRYPTO_PaillierCiphertext *c)
+{
+  GNUNET_assert (NULL != c);
+  return ntohl (c->remaining_ops);
+}
+
+
+/* end of crypto_paillier.c */
diff --git a/src/lib/util/crypto_pkey.c b/src/lib/util/crypto_pkey.c
new file mode 100644
index 000000000..92e0fba36
--- /dev/null
+++ b/src/lib/util/crypto_pkey.c
@@ -0,0 +1,639 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2016, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_pkey.c
+ * @brief api to interact handle generic public keys
+ * @author Martin Schanzenbach
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static enum GNUNET_GenericReturnValue
+check_key_type (uint32_t type)
+{
+  switch (type)
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_SYSERR;
+}
+
+
+void
+GNUNET_CRYPTO_private_key_clear (struct GNUNET_CRYPTO_PrivateKey *key)
+{
+  switch (ntohl (key->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    GNUNET_CRYPTO_ecdsa_key_clear (&key->ecdsa_key);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    GNUNET_CRYPTO_eddsa_key_clear (&key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+}
+
+
+ssize_t
+GNUNET_CRYPTO_private_key_get_length (const struct
+                                      GNUNET_CRYPTO_PrivateKey *key)
+{
+  switch (ntohl (key->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return sizeof (key->type) + sizeof (key->ecdsa_key);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return sizeof (key->type) + sizeof (key->eddsa_key);
+    break;
+  default:
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Got key type %u\n", ntohl (key->type));
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_public_key_get_length (const struct
+                                     GNUNET_CRYPTO_PublicKey *key)
+{
+  switch (ntohl (key->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return sizeof (key->type) + sizeof (key->ecdsa_key);
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return sizeof (key->type) + sizeof (key->eddsa_key);
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_private_key_length_by_type (enum GNUNET_CRYPTO_KeyType kt)
+{
+  switch (kt)
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_read_public_key_from_buffer (const void *buffer,
+                                           size_t len,
+                                           struct GNUNET_CRYPTO_PublicKey *
+                                           key,
+                                           size_t *kb_read)
+{
+  if (len < sizeof (key->type))
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->type,
+                 buffer,
+                 sizeof (key->type));
+  ssize_t length = GNUNET_CRYPTO_public_key_get_length (key);
+  if (len < length)
+    return GNUNET_SYSERR;
+  if (length < 0)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->ecdsa_key,
+                 buffer + sizeof (key->type),
+                 length - sizeof (key->type));
+  *kb_read = length;
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_write_public_key_to_buffer (const struct
+                                          GNUNET_CRYPTO_PublicKey *key,
+                                          void*buffer,
+                                          size_t len)
+{
+  const ssize_t length = GNUNET_CRYPTO_public_key_get_length (key);
+  if (len < length)
+    return -1;
+  if (length < 0)
+    return -2;
+  GNUNET_memcpy (buffer, &(key->type), sizeof (key->type));
+  GNUNET_memcpy (buffer + sizeof (key->type), &(key->ecdsa_key), length
+                 - sizeof (key->type));
+  return length;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_read_private_key_from_buffer (const void *buffer,
+                                            size_t len,
+                                            struct
+                                            GNUNET_CRYPTO_PrivateKey *key,
+                                            size_t *kb_read)
+{
+  if (len < sizeof (key->type))
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->type,
+                 buffer,
+                 sizeof (key->type));
+  ssize_t length = GNUNET_CRYPTO_private_key_get_length (key);
+  if (len < length)
+    return GNUNET_SYSERR;
+  if (length < 0)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->ecdsa_key,
+                 buffer + sizeof (key->type),
+                 length - sizeof (key->type));
+  *kb_read = length;
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_write_private_key_to_buffer (const struct
+                                           GNUNET_CRYPTO_PrivateKey *key,
+                                           void *buffer,
+                                           size_t len)
+{
+  const ssize_t length = GNUNET_CRYPTO_private_key_get_length (key);
+  if (len < length)
+    return -1;
+  if (length < 0)
+    return -2;
+  GNUNET_memcpy (buffer, &(key->type), sizeof (key->type));
+  GNUNET_memcpy (buffer + sizeof (key->type), &(key->ecdsa_key), length
+                 - sizeof (key->type));
+  return length;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_signature_get_length (const struct
+                                    GNUNET_CRYPTO_Signature *sig)
+{
+  switch (ntohl (sig->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return sizeof (sig->type) + sizeof (sig->ecdsa_signature);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return sizeof (sig->type) + sizeof (sig->eddsa_signature);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_signature_get_raw_length_by_type (uint32_t type)
+{
+  switch (ntohl (type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return sizeof (struct GNUNET_CRYPTO_EcdsaSignature);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return sizeof (struct GNUNET_CRYPTO_EddsaSignature);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_read_signature_from_buffer (struct
+                                          GNUNET_CRYPTO_Signature *sig,
+                                          const void*buffer,
+                                          size_t len)
+{
+  if (len < sizeof (sig->type))
+    return -1;
+  GNUNET_memcpy (&(sig->type), buffer, sizeof (sig->type));
+  const ssize_t length = GNUNET_CRYPTO_signature_get_length (sig);
+  if (len < length)
+    return -1;
+  if (length < 0)
+    return -2;
+  GNUNET_memcpy (&(sig->ecdsa_signature), buffer + sizeof (sig->type), length
+                 - sizeof (sig->type));
+  return length;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_write_signature_to_buffer (const struct
+                                         GNUNET_CRYPTO_Signature *sig,
+                                         void*buffer,
+                                         size_t len)
+{
+  const ssize_t length = GNUNET_CRYPTO_signature_get_length (sig);
+  if (len < length)
+    return -1;
+  if (length < 0)
+    return -2;
+  GNUNET_memcpy (buffer, &(sig->type), sizeof (sig->type));
+  GNUNET_memcpy (buffer + sizeof (sig->type), &(sig->ecdsa_signature), length
+                 - sizeof (sig->type));
+  return length;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_raw_ (const struct
+                         GNUNET_CRYPTO_PrivateKey *priv,
+                         const struct
+                         GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+                         unsigned char *sig)
+{
+  switch (ntohl (priv->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return GNUNET_CRYPTO_ecdsa_sign_ (&(priv->ecdsa_key), purpose,
+                                      (struct
+                                       GNUNET_CRYPTO_EcdsaSignature*) sig);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return GNUNET_CRYPTO_eddsa_sign_ (&(priv->eddsa_key), purpose,
+                                      (struct
+                                       GNUNET_CRYPTO_EddsaSignature*) sig);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_sign_ (const struct
+                     GNUNET_CRYPTO_PrivateKey *priv,
+                     const struct
+                     GNUNET_CRYPTO_EccSignaturePurpose *purpose,
+                     struct GNUNET_CRYPTO_Signature *sig)
+{
+  sig->type = priv->type;
+  switch (ntohl (priv->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return GNUNET_CRYPTO_ecdsa_sign_ (&(priv->ecdsa_key), purpose,
+                                      &(sig->ecdsa_signature));
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return GNUNET_CRYPTO_eddsa_sign_ (&(priv->eddsa_key), purpose,
+                                      &(sig->eddsa_signature));
+    break;
+  default:
+    GNUNET_break (0);
+  }
+
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_signature_verify_ (uint32_t purpose,
+                                 const struct
+                                 GNUNET_CRYPTO_EccSignaturePurpose *validate,
+                                 const struct GNUNET_CRYPTO_Signature *sig,
+                                 const struct GNUNET_CRYPTO_PublicKey *pub)
+{
+  /* check type matching of 'sig' and 'pub' */
+  GNUNET_assert (ntohl (pub->type) == ntohl (sig->type));
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return GNUNET_CRYPTO_ecdsa_verify_ (purpose, validate,
+                                        &(sig->ecdsa_signature),
+                                        &(pub->ecdsa_key));
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return GNUNET_CRYPTO_eddsa_verify_ (purpose, validate,
+                                        &(sig->eddsa_signature),
+                                        &(pub->eddsa_key));
+    break;
+  default:
+    GNUNET_break (0);
+  }
+
+  return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_signature_verify_raw_ (uint32_t purpose,
+                                     const struct
+                                     GNUNET_CRYPTO_EccSignaturePurpose *
+                                     validate,
+                                     const unsigned char *sig,
+                                     const struct
+                                     GNUNET_CRYPTO_PublicKey *pub)
+{
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    return GNUNET_CRYPTO_ecdsa_verify_ (purpose, validate,
+                                        (struct
+                                         GNUNET_CRYPTO_EcdsaSignature*) sig,
+                                        &(pub->ecdsa_key));
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    return GNUNET_CRYPTO_eddsa_verify_ (purpose, validate,
+                                        (struct
+                                         GNUNET_CRYPTO_EddsaSignature*) sig,
+                                        &(pub->eddsa_key));
+    break;
+  default:
+    GNUNET_break (0);
+  }
+
+  return GNUNET_SYSERR;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_encrypt_old (const void *block,
+                           size_t size,
+                           const struct GNUNET_CRYPTO_PublicKey *pub,
+                           struct GNUNET_CRYPTO_EcdhePublicKey *ecc,
+                           void *result)
+{
+  struct GNUNET_CRYPTO_EcdhePrivateKey pk;
+  GNUNET_CRYPTO_ecdhe_key_create (&pk);
+  struct GNUNET_HashCode hash;
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdh_ecdsa (&pk, &(pub->ecdsa_key),
+                                                   &hash))
+      return -1;
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdh_eddsa (&pk, &(pub->eddsa_key),
+                                                   &hash))
+      return -1;
+    break;
+  default:
+    return -1;
+  }
+  GNUNET_CRYPTO_ecdhe_key_get_public (&pk, ecc);
+  GNUNET_CRYPTO_ecdhe_key_clear (&pk);
+  struct GNUNET_CRYPTO_SymmetricSessionKey key;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+  GNUNET_CRYPTO_hash_to_aes_key (&hash, &key, &iv);
+  GNUNET_CRYPTO_zero_keys (&hash, sizeof(hash));
+  const ssize_t encrypted = GNUNET_CRYPTO_symmetric_encrypt (block, size, &key,
+                                                             &iv, result);
+  GNUNET_CRYPTO_zero_keys (&key, sizeof(key));
+  GNUNET_CRYPTO_zero_keys (&iv, sizeof(iv));
+  return encrypted;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_encrypt (const void *pt,
+                       size_t pt_size,
+                       const struct GNUNET_CRYPTO_PublicKey *pub,
+                       void *ct_buf,
+                       size_t ct_size)
+{
+  struct GNUNET_HashCode k;
+  struct GNUNET_CRYPTO_FoKemC kemc;
+  struct GNUNET_CRYPTO_FoKemC *kemc_buf = (struct GNUNET_CRYPTO_FoKemC*) ct_buf;
+  unsigned char *encrypted_data = (unsigned char*) &kemc_buf[1];
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char key[crypto_secretbox_KEYBYTES];
+
+  if (ct_size < pt_size + GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Output buffer size for ciphertext too small: Got %llu, want >= %llu\n",
+                (unsigned long long) ct_size,
+                (unsigned long long) (pt_size
+                                      + GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES));
+    return GNUNET_SYSERR;
+  }
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdsa_fo_kem_encaps (&(pub->ecdsa_key),
+                                                            &kemc,
+                                                            &k))
+      return GNUNET_SYSERR;
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_fo_kem_encaps (&pub->eddsa_key,
+                                                            &kemc,
+                                                            &k))
+      return GNUNET_SYSERR;
+    break;
+  default:
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Unsupported key type\n");
+    return GNUNET_SYSERR;
+  }
+  memcpy (key, &k, crypto_secretbox_KEYBYTES);
+  memcpy (nonce, ((char* ) &k) + crypto_secretbox_KEYBYTES,
+          crypto_secretbox_NONCEBYTES);
+  if (crypto_secretbox_easy (encrypted_data, pt, pt_size, nonce, key))
+    return GNUNET_SYSERR;
+  memcpy (kemc_buf, &kemc, sizeof (kemc));
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_decrypt (const void *ct_buf,
+                       size_t ct_size,
+                       const struct GNUNET_CRYPTO_PrivateKey *priv,
+                       void *pt,
+                       size_t pt_size)
+{
+  struct GNUNET_HashCode k;
+  struct GNUNET_CRYPTO_FoKemC *kemc = (struct GNUNET_CRYPTO_FoKemC*) ct_buf;
+  unsigned char *encrypted_data = (unsigned char*) &kemc[1];
+  unsigned char nonce[crypto_secretbox_NONCEBYTES];
+  unsigned char key[crypto_secretbox_KEYBYTES];
+  size_t expected_pt_len = ct_size - GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES;
+
+  if (pt_size < expected_pt_len)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Output buffer size for plaintext too small: Got %llu, want >= %llu\n",
+                (unsigned long long) pt_size,
+                (unsigned long long) expected_pt_len);
+    return GNUNET_SYSERR;
+  }
+  switch (ntohl (priv->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdsa_fo_kem_decaps (&(priv->ecdsa_key),
+                                                            kemc,
+                                                            &k))
+      return GNUNET_SYSERR;
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_fo_kem_decaps (&(priv->eddsa_key),
+                                                            kemc,
+                                                            &k))
+      return GNUNET_SYSERR;
+    break;
+  default:
+    return GNUNET_SYSERR;
+  }
+  memcpy (key, &k, crypto_secretbox_KEYBYTES);
+  memcpy (nonce, ((char* ) &k) + crypto_secretbox_KEYBYTES,
+          crypto_secretbox_NONCEBYTES);
+  if (crypto_secretbox_open_easy (pt, encrypted_data, ct_size - sizeof (*kemc),
+                                  nonce, key))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_CRYPTO_decrypt_old (const void *block,
+                           size_t size,
+                           const struct GNUNET_CRYPTO_PrivateKey *priv,
+                           const struct GNUNET_CRYPTO_EcdhePublicKey *ecc,
+                           void *result)
+{
+  struct GNUNET_HashCode hash;
+  switch (ntohl (priv->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdsa_ecdh (&(priv->ecdsa_key), ecc,
+                                                   &hash))
+      return -1;
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_ecdh (&(priv->eddsa_key), ecc,
+                                                   &hash))
+      return -1;
+    break;
+  default:
+    return -1;
+  }
+  struct GNUNET_CRYPTO_SymmetricSessionKey key;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+  GNUNET_CRYPTO_hash_to_aes_key (&hash, &key, &iv);
+  GNUNET_CRYPTO_zero_keys (&hash, sizeof(hash));
+  const ssize_t decrypted = GNUNET_CRYPTO_symmetric_decrypt (block, size, &key,
+                                                             &iv, result);
+  GNUNET_CRYPTO_zero_keys (&key, sizeof(key));
+  GNUNET_CRYPTO_zero_keys (&iv, sizeof(iv));
+  return decrypted;
+}
+
+
+char *
+GNUNET_CRYPTO_public_key_to_string (const struct
+                                    GNUNET_CRYPTO_PublicKey *key)
+{
+  size_t size = GNUNET_CRYPTO_public_key_get_length (key);
+  return GNUNET_STRINGS_data_to_string_alloc (key,
+                                              size);
+}
+
+
+char *
+GNUNET_CRYPTO_private_key_to_string (const struct
+                                     GNUNET_CRYPTO_PrivateKey *key)
+{
+  size_t size = GNUNET_CRYPTO_private_key_get_length (key);
+  return GNUNET_STRINGS_data_to_string_alloc (key,
+                                              size);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_public_key_from_string (const char *str,
+                                      struct GNUNET_CRYPTO_PublicKey *key)
+{
+  enum GNUNET_GenericReturnValue ret;
+  ret = GNUNET_STRINGS_string_to_data (str,
+                                       strlen (str),
+                                       key,
+                                       sizeof (*key));
+  if (GNUNET_OK != ret)
+    return GNUNET_SYSERR;
+  return check_key_type (ntohl (key->type));
+
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_private_key_from_string (const char *str,
+                                       struct GNUNET_CRYPTO_PrivateKey *key)
+{
+  enum GNUNET_GenericReturnValue ret;
+  ret = GNUNET_STRINGS_string_to_data (str,
+                                       strlen (str),
+                                       key,
+                                       sizeof (*key));
+  if (GNUNET_OK != ret)
+    return GNUNET_SYSERR;
+  return check_key_type (ntohl (key->type));
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_key_get_public (const struct
+                              GNUNET_CRYPTO_PrivateKey *privkey,
+                              struct GNUNET_CRYPTO_PublicKey *key)
+{
+  key->type = privkey->type;
+  switch (ntohl (privkey->type))
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    GNUNET_CRYPTO_ecdsa_key_get_public (&privkey->ecdsa_key,
+                                        &key->ecdsa_key);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    GNUNET_CRYPTO_eddsa_key_get_public (&privkey->eddsa_key,
+                                        &key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
diff --git a/src/lib/util/crypto_pow.c b/src/lib/util/crypto_pow.c
new file mode 100644
index 000000000..bfaaf555d
--- /dev/null
+++ b/src/lib/util/crypto_pow.c
@@ -0,0 +1,60 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2013, 2019 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/crypto_pow.c
+ * @brief proof-of-work hashing
+ * @author Christian Grothoff
+ * @author Bart Polot
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <sodium.h>
+
+/**
+ * Calculate the 'proof-of-work' hash (an expensive hash).
+ * We're using a non-standard formula to avoid issues with
+ * ASICs appearing (see #3795).
+ *
+ * @param salt salt for the hash. Must be crypto_pwhash_argon2id_SALTBYTES long.
+ * @param buf data to hash
+ * @param buf_len number of bytes in @a buf
+ * @param result where to write the resulting hash
+ */
+void
+GNUNET_CRYPTO_pow_hash (const struct GNUNET_CRYPTO_PowSalt *salt,
+                        const void *buf,
+                        size_t buf_len,
+                        struct GNUNET_HashCode *result)
+{
+  /* Threads hardcoded at 1 in libsodium */
+  GNUNET_break (0 ==
+                crypto_pwhash_argon2id ((unsigned char *) result,
+                                        sizeof (struct GNUNET_HashCode),
+                                        buf,
+                                        buf_len,
+                                        (unsigned char*) salt,
+                                        3, /* iterations */
+                                        1024 * 1024, /* memory (1 MiB) */
+                                        crypto_pwhash_argon2id_ALG_ARGON2ID13));
+}
+
+
+/* end of crypto_pow.c */
diff --git a/src/lib/util/crypto_random.c b/src/lib/util/crypto_random.c
new file mode 100644
index 000000000..72474d04b
--- /dev/null
+++ b/src/lib/util/crypto_random.c
@@ -0,0 +1,412 @@
+/*
+     This file is part of GNUnet.  Copyright (C) 2001-2014 Christian Grothoff
+     (and other contributing authors)
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+
+/**
+ * @file util/crypto_random.c
+ * @brief functions to gather random numbers
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-random", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-crypto-random", syscall)
+
+
+/* TODO: ndurner, move this to plibc? */
+/* The code is derived from glibc, obviously */
+#if ! HAVE_RANDOM || ! HAVE_SRANDOM
+#ifdef RANDOM
+#undef RANDOM
+#endif
+#ifdef SRANDOM
+#undef SRANDOM
+#endif
+#define RANDOM() glibc_weak_rand32 ()
+#define SRANDOM(s) glibc_weak_srand32 (s)
+#if defined(RAND_MAX)
+#undef RAND_MAX
+#endif
+#define RAND_MAX 0x7fffffff /* Hopefully this is correct */
+
+
+static int32_t glibc_weak_rand32_state = 1;
+
+
+void
+glibc_weak_srand32 (int32_t s)
+{
+  glibc_weak_rand32_state = s;
+}
+
+
+int32_t
+glibc_weak_rand32 ()
+{
+  int32_t val = glibc_weak_rand32_state;
+
+  val = ((glibc_weak_rand32_state * 1103515245) + 12345) & 0x7fffffff;
+  glibc_weak_rand32_state = val;
+  return val;
+}
+
+
+#endif
+
+/**
+ * Create a cryptographically weak pseudo-random number in the interval of 0 to 1.
+ *
+ * @return number between 0 and 1.
+ */
+static double
+get_weak_random (void)
+{
+  return((double) random () / RAND_MAX);
+}
+
+
+void
+GNUNET_CRYPTO_seed_weak_random (int32_t seed)
+{
+#ifdef OPENBSD
+  srandom_deterministic (seed);
+#else
+  srandom (seed);
+#endif
+}
+
+
+/**
+ * @ingroup crypto
+ * Zero out @a buffer, securely against compiler optimizations.
+ * Used to delete key material.
+ *
+ * @param buffer the buffer to zap
+ * @param length buffer length
+ */
+void
+GNUNET_CRYPTO_zero_keys (void *buffer, size_t length)
+{
+#if HAVE_MEMSET_S
+  memset_s (buffer, length, 0, length);
+#elif HAVE_EXPLICIT_BZERO
+  explicit_bzero (buffer, length);
+#else
+  volatile unsigned char *p = buffer;
+  while (length--)
+    *p++ = 0;
+#endif
+}
+
+
+/**
+ * @ingroup crypto
+ * Fill block with a random values.
+ *
+ * @param mode desired quality of the random number
+ * @param buffer the buffer to fill
+ * @param length buffer length
+ */
+void
+GNUNET_CRYPTO_random_block (enum GNUNET_CRYPTO_Quality mode,
+                            void *buffer,
+                            size_t length)
+{
+#ifdef gcry_fast_random_poll
+  static unsigned int invokeCount;
+#endif
+  switch (mode)
+  {
+  case GNUNET_CRYPTO_QUALITY_STRONG:
+    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
+#ifdef gcry_fast_random_poll
+    if ((invokeCount++ % 256) == 0)
+      gcry_fast_random_poll ();
+#endif
+    gcry_randomize (buffer, length, GCRY_STRONG_RANDOM);
+    return;
+
+  case GNUNET_CRYPTO_QUALITY_NONCE:
+    gcry_create_nonce (buffer, length);
+    return;
+
+  case GNUNET_CRYPTO_QUALITY_WEAK:
+    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
+#ifdef gcry_fast_random_poll
+    if ((invokeCount++ % 256) == 0)
+      gcry_fast_random_poll ();
+#endif
+    gcry_randomize (buffer, length, GCRY_WEAK_RANDOM);
+    return;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+/**
+ * Produce a random unsigned 32-bit number modulo @a i.
+ *
+ * @param mode desired quality of the random number
+ * @param i the upper limit (exclusive) for the random number
+ * @return a random value in the interval [0,i[.
+ */
+uint32_t
+GNUNET_CRYPTO_random_u32 (enum GNUNET_CRYPTO_Quality mode,
+                          uint32_t i)
+{
+#ifdef gcry_fast_random_poll
+  static unsigned int invokeCount;
+#endif
+  uint32_t ret;
+  uint32_t ul;
+
+  GNUNET_assert (i > 0);
+
+  switch (mode)
+  {
+  case GNUNET_CRYPTO_QUALITY_STRONG:
+    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
+#ifdef gcry_fast_random_poll
+    if ((invokeCount++ % 256) == 0)
+      gcry_fast_random_poll ();
+#endif
+    ul = UINT32_MAX - (UINT32_MAX % i);
+    do
+    {
+      gcry_randomize ((unsigned char *) &ret,
+                      sizeof(uint32_t),
+                      GCRY_STRONG_RANDOM);
+    }
+    while (ret >= ul);
+    return ret % i;
+
+  case GNUNET_CRYPTO_QUALITY_NONCE:
+    ul = UINT32_MAX - (UINT32_MAX % i);
+    do
+    {
+      gcry_create_nonce (&ret, sizeof(ret));
+    }
+    while (ret >= ul);
+    return ret % i;
+
+  case GNUNET_CRYPTO_QUALITY_WEAK:
+    ret = i * get_weak_random ();
+    if (ret >= i)
+      ret = i - 1;
+    return ret;
+
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
+ * Get an array with a random permutation of the
+ * numbers 0...n-1.
+ * @param mode #GNUNET_RANDOM_QUALITY_STRONG if the strong (but expensive)
+ *        PRNG should be used, #GNUNET_RANDOM_QUALITY_WEAK otherwise
+ * @param n the size of the array
+ * @return the permutation array (allocated from heap)
+ */
+unsigned int *
+GNUNET_CRYPTO_random_permute (enum GNUNET_CRYPTO_Quality mode,
+                              unsigned int n)
+{
+  unsigned int *ret;
+  unsigned int i;
+  unsigned int tmp;
+  uint32_t x;
+
+  GNUNET_assert (n > 0);
+  ret = GNUNET_malloc (n * sizeof(unsigned int));
+  for (i = 0; i < n; i++)
+    ret[i] = i;
+  for (i = n - 1; i > 0; i--)
+  {
+    x = GNUNET_CRYPTO_random_u32 (mode, i + 1);
+    tmp = ret[x];
+    ret[x] = ret[i];
+    ret[i] = tmp;
+  }
+  return ret;
+}
+
+
+uint64_t
+GNUNET_CRYPTO_random_u64 (enum GNUNET_CRYPTO_Quality mode,
+                          uint64_t max)
+{
+  uint64_t ret;
+  uint64_t ul;
+
+  GNUNET_assert (max > 0);
+  switch (mode)
+  {
+  case GNUNET_CRYPTO_QUALITY_STRONG:
+    ul = UINT64_MAX - (UINT64_MAX % max);
+    do
+    {
+      gcry_randomize ((unsigned char *) &ret,
+                      sizeof(uint64_t),
+                      GCRY_STRONG_RANDOM);
+    }
+    while (ret >= ul);
+    return ret % max;
+
+  case GNUNET_CRYPTO_QUALITY_NONCE:
+    ul = UINT64_MAX - (UINT64_MAX % max);
+    do
+    {
+      gcry_create_nonce (&ret, sizeof(ret));
+    }
+    while (ret >= ul);
+
+    return ret % max;
+
+  case GNUNET_CRYPTO_QUALITY_WEAK:
+    ret = max * get_weak_random ();
+    if (ret >= max)
+      ret = max - 1;
+    return ret;
+
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
+ * @ingroup crypto
+ * Fill UUID with a timeflake pseudo-random value.  Note that
+ * timeflakes use only 80 bits of randomness and 48 bits
+ * to encode a timestamp in milliseconds. So what we return
+ * here is not a completely random number.
+ *
+ * @param mode desired quality of the random number
+ * @param uuid the value to fill
+ */
+void
+GNUNET_CRYPTO_random_timeflake (enum GNUNET_CRYPTO_Quality mode,
+                                struct GNUNET_Uuid *uuid)
+{
+  struct GNUNET_TIME_Absolute now;
+  uint64_t ms;
+  uint64_t be;
+  char *base;
+
+  GNUNET_CRYPTO_random_block (mode,
+                              uuid,
+                              sizeof (struct GNUNET_Uuid));
+  now = GNUNET_TIME_absolute_get ();
+  ms = now.abs_value_us / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us;
+  be = GNUNET_htonll (ms);
+  base = (char *) &be;
+  memcpy (uuid,
+          base + 2,
+          sizeof (be) - 2);
+}
+
+
+/**
+ * Allocation wrapper for libgcrypt, used to avoid bad locking
+ * strategy of libgcrypt implementation.
+ */
+static void *
+w_malloc (size_t n)
+{
+  return calloc (n, 1);
+}
+
+
+/**
+ * Allocation wrapper for libgcrypt, used to avoid bad locking
+ * strategy of libgcrypt implementation.
+ */
+static int
+w_check (const void *p)
+{
+  (void) p;
+  return 0; /* not secure memory */
+}
+
+
+/**
+ * Initialize libgcrypt.
+ */
+void __attribute__ ((constructor))
+GNUNET_CRYPTO_random_init ()
+{
+  gcry_error_t rc;
+
+  if (! gcry_check_version (NEED_LIBGCRYPT_VERSION))
+  {
+    fprintf (
+      stderr,
+      _ ("libgcrypt has not the expected version (version %s is required).\n"),
+      NEED_LIBGCRYPT_VERSION);
+    GNUNET_assert (0);
+  }
+  /* set custom allocators */
+  gcry_set_allocation_handler (&w_malloc, &w_malloc, &w_check, &realloc, &free);
+  /* Disable use of secure memory */
+  if ((rc = gcry_control (GCRYCTL_DISABLE_SECMEM, 0)))
+    fprintf (stderr,
+             "Failed to set libgcrypt option %s: %s\n",
+             "DISABLE_SECMEM",
+             gcry_strerror (rc));
+  /* Otherwise gnunet-ecc takes forever to complete, besides
+     we are fine with "just" using GCRY_STRONG_RANDOM */
+  if ((rc = gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0)))
+    fprintf (stderr,
+             "Failed to set libgcrypt option %s: %s\n",
+             "ENABLE_QUICK_RANDOM",
+             gcry_strerror (rc));
+  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  gcry_fast_random_poll ();
+  GNUNET_CRYPTO_seed_weak_random (
+    time (NULL)
+    ^ GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, UINT32_MAX));
+}
+
+
+/**
+ * Nicely shut down libgcrypt.
+ */
+void __attribute__ ((destructor))
+GNUNET_CRYPTO_random_fini ()
+{
+  gcry_set_progress_handler (NULL, NULL);
+#ifdef GCRYCTL_CLOSE_RANDOM_DEVICE
+  (void) gcry_control (GCRYCTL_CLOSE_RANDOM_DEVICE, 0);
+#endif
+}
+
+
+/* end of crypto_random.c */
diff --git a/src/lib/util/crypto_rsa.c b/src/lib/util/crypto_rsa.c
new file mode 100644
index 000000000..aeae3de8f
--- /dev/null
+++ b/src/lib/util/crypto_rsa.c
@@ -0,0 +1,1290 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014,2016,2019,2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_rsa.c
+ * @brief Chaum-style Blind signatures based on RSA
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ * @author Christian Grothoff
+ * @author Jeffrey Burdges <burdges@gnunet.org>
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+#include "benchmark.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-rsa", __VA_ARGS__)
+
+
+/**
+ * The private information of an RSA key pair.
+ */
+struct GNUNET_CRYPTO_RsaPrivateKey
+{
+  /**
+   * Libgcrypt S-expression for the RSA private key.
+   */
+  gcry_sexp_t sexp;
+};
+
+
+/**
+ * The public information of an RSA key pair.
+ */
+struct GNUNET_CRYPTO_RsaPublicKey
+{
+  /**
+   * Libgcrypt S-expression for the RSA public key.
+   */
+  gcry_sexp_t sexp;
+};
+
+
+/**
+ * @brief an RSA signature
+ */
+struct GNUNET_CRYPTO_RsaSignature
+{
+  /**
+   * Libgcrypt S-expression for the RSA signature.
+   */
+  gcry_sexp_t sexp;
+};
+
+
+/**
+ * @brief RSA blinding key
+ */
+struct RsaBlindingKey
+{
+  /**
+   * Random value used for blinding.
+   */
+  gcry_mpi_t r;
+};
+
+
+/**
+ * Extract values from an S-expression.
+ *
+ * @param array where to store the result(s)
+ * @param sexp S-expression to parse
+ * @param topname top-level name in the S-expression that is of interest
+ * @param elems names of the elements to extract
+ * @return 0 on success
+ */
+static int
+key_from_sexp (gcry_mpi_t *array,
+               gcry_sexp_t sexp,
+               const char *topname,
+               const char *elems)
+{
+  gcry_sexp_t list;
+  gcry_sexp_t l2;
+  const char *s;
+  unsigned int idx;
+
+  if (! (list = gcry_sexp_find_token (sexp, topname, 0)))
+    return 1;
+  l2 = gcry_sexp_cadr (list);
+  gcry_sexp_release (list);
+  list = l2;
+  if (! list)
+    return 2;
+  idx = 0;
+  for (s = elems; *s; s++, idx++)
+  {
+    if (! (l2 = gcry_sexp_find_token (list, s, 1)))
+    {
+      for (unsigned int i = 0; i < idx; i++)
+      {
+        gcry_free (array[i]);
+        array[i] = NULL;
+      }
+      gcry_sexp_release (list);
+      return 3;                 /* required parameter not found */
+    }
+    array[idx] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
+    gcry_sexp_release (l2);
+    if (! array[idx])
+    {
+      for (unsigned int i = 0; i < idx; i++)
+      {
+        gcry_free (array[i]);
+        array[i] = NULL;
+      }
+      gcry_sexp_release (list);
+      return 4;                 /* required parameter is invalid */
+    }
+  }
+  gcry_sexp_release (list);
+  return 0;
+}
+
+
+struct GNUNET_CRYPTO_RsaPrivateKey *
+GNUNET_CRYPTO_rsa_private_key_create (unsigned int len)
+{
+  struct GNUNET_CRYPTO_RsaPrivateKey *ret;
+  gcry_sexp_t s_key;
+  gcry_sexp_t s_keyparam;
+
+  BENCHMARK_START (rsa_private_key_create);
+
+  GNUNET_assert (0 ==
+                 gcry_sexp_build (&s_keyparam,
+                                  NULL,
+                                  "(genkey(rsa(nbits %d)))",
+                                  len));
+  GNUNET_assert (0 ==
+                 gcry_pk_genkey (&s_key,
+                                 s_keyparam));
+  gcry_sexp_release (s_keyparam);
+#if EXTRA_CHECKS
+  GNUNET_assert (0 ==
+                 gcry_pk_testkey (s_key));
+#endif
+  ret = GNUNET_new (struct GNUNET_CRYPTO_RsaPrivateKey);
+  ret->sexp = s_key;
+  BENCHMARK_END (rsa_private_key_create);
+  return ret;
+}
+
+
+void
+GNUNET_CRYPTO_rsa_private_key_free (struct GNUNET_CRYPTO_RsaPrivateKey *key)
+{
+  gcry_sexp_release (key->sexp);
+  GNUNET_free (key);
+}
+
+
+size_t
+GNUNET_CRYPTO_rsa_private_key_encode (
+  const struct GNUNET_CRYPTO_RsaPrivateKey *key,
+  void **buffer)
+{
+  size_t n;
+  char *b;
+
+  n = gcry_sexp_sprint (key->sexp,
+                        GCRYSEXP_FMT_DEFAULT,
+                        NULL,
+                        0);
+  b = GNUNET_malloc (n);
+  GNUNET_assert ((n - 1) ==      /* since the last byte is \0 */
+                 gcry_sexp_sprint (key->sexp,
+                                   GCRYSEXP_FMT_DEFAULT,
+                                   b,
+                                   n));
+  *buffer = b;
+  return n;
+}
+
+
+struct GNUNET_CRYPTO_RsaPrivateKey *
+GNUNET_CRYPTO_rsa_private_key_decode (const void *buf,
+                                      size_t buf_size)
+{
+  struct GNUNET_CRYPTO_RsaPrivateKey *key;
+
+  key = GNUNET_new (struct GNUNET_CRYPTO_RsaPrivateKey);
+  if (0 !=
+      gcry_sexp_new (&key->sexp,
+                     buf,
+                     buf_size,
+                     0))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Decoded private key is not valid\n");
+    GNUNET_free (key);
+    return NULL;
+  }
+  if (0 != gcry_pk_testkey (key->sexp))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Decoded private key is not valid\n");
+    GNUNET_CRYPTO_rsa_private_key_free (key);
+    return NULL;
+  }
+  return key;
+}
+
+
+struct GNUNET_CRYPTO_RsaPublicKey *
+GNUNET_CRYPTO_rsa_private_key_get_public (
+  const struct GNUNET_CRYPTO_RsaPrivateKey *priv)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *pub;
+  gcry_mpi_t ne[2];
+  int rc;
+  gcry_sexp_t result;
+
+  BENCHMARK_START (rsa_private_key_get_public);
+
+  rc = key_from_sexp (ne, priv->sexp, "public-key", "ne");
+  if (0 != rc)
+    rc = key_from_sexp (ne, priv->sexp, "private-key", "ne");
+  if (0 != rc)
+    rc = key_from_sexp (ne, priv->sexp, "rsa", "ne");
+  if (0 != rc)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  rc = gcry_sexp_build (&result,
+                        NULL,
+                        "(public-key(rsa(n %m)(e %m)))",
+                        ne[0],
+                        ne[1]);
+  gcry_mpi_release (ne[0]);
+  gcry_mpi_release (ne[1]);
+  pub = GNUNET_new (struct GNUNET_CRYPTO_RsaPublicKey);
+  pub->sexp = result;
+  BENCHMARK_END (rsa_private_key_get_public);
+  return pub;
+}
+
+
+void
+GNUNET_CRYPTO_rsa_public_key_free (struct GNUNET_CRYPTO_RsaPublicKey *key)
+{
+  gcry_sexp_release (key->sexp);
+  GNUNET_free (key);
+}
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Format of the header of a serialized RSA public key.
+ */
+struct GNUNET_CRYPTO_RsaPublicKeyHeaderP
+{
+  /**
+   * length of modulus 'n' in bytes, in NBO
+   */
+  uint16_t modulus_length GNUNET_PACKED;
+
+  /**
+   * length of exponent in bytes, in NBO
+   */
+  uint16_t public_exponent_length GNUNET_PACKED;
+
+  /* followed by variable-size modulus and
+     public exponent follows as big-endian encoded
+     integers */
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+bool
+GNUNET_CRYPTO_rsa_public_key_check (
+  const struct GNUNET_CRYPTO_RsaPublicKey *key)
+{
+  gcry_mpi_t ne[2];
+  int ret;
+
+  ret = key_from_sexp (ne,
+                       key->sexp,
+                       "public-key",
+                       "ne");
+  if (0 != ret)
+    ret = key_from_sexp (ne,
+                         key->sexp,
+                         "rsa",
+                         "ne");
+  if (0 != ret)
+    return false;
+  gcry_mpi_release (ne[0]);
+  gcry_mpi_release (ne[1]);
+  return true;
+}
+
+
+size_t
+GNUNET_CRYPTO_rsa_public_key_encode (
+  const struct GNUNET_CRYPTO_RsaPublicKey *key,
+  void **buffer)
+{
+  gcry_mpi_t ne[2];
+  size_t n_size;
+  size_t e_size;
+  size_t rsize;
+  size_t buf_size;
+  char *buf;
+  struct GNUNET_CRYPTO_RsaPublicKeyHeaderP hdr;
+  int ret;
+
+  ret = key_from_sexp (ne,
+                       key->sexp,
+                       "public-key",
+                       "ne");
+  if (0 != ret)
+    ret = key_from_sexp (ne,
+                         key->sexp,
+                         "rsa",
+                         "ne");
+  if (0 != ret)
+  {
+    GNUNET_break (0);
+    *buffer = NULL;
+    return 0;
+  }
+  gcry_mpi_print (GCRYMPI_FMT_USG,
+                  NULL,
+                  0,
+                  &n_size,
+                  ne[0]);
+  gcry_mpi_print (GCRYMPI_FMT_USG,
+                  NULL,
+                  0,
+                  &e_size,
+                  ne[1]);
+  if ( (e_size > UINT16_MAX) ||
+       (n_size > UINT16_MAX) )
+  {
+    GNUNET_break (0);
+    if (NULL != buffer)
+      *buffer = NULL;
+    gcry_mpi_release (ne[0]);
+    gcry_mpi_release (ne[1]);
+    return 0;
+  }
+  buf_size = n_size + e_size + sizeof (hdr);
+  if (NULL == buffer)
+  {
+    gcry_mpi_release (ne[0]);
+    gcry_mpi_release (ne[1]);
+    return buf_size;
+  }
+  buf = GNUNET_malloc (buf_size);
+  hdr.modulus_length = htons ((uint16_t) n_size);
+  hdr.public_exponent_length = htons ((uint16_t) e_size);
+  memcpy (buf,
+          &hdr,
+          sizeof (hdr));
+  GNUNET_assert (0 ==
+                 gcry_mpi_print (GCRYMPI_FMT_USG,
+                                 (unsigned char *) &buf[sizeof (hdr)],
+                                 n_size,
+                                 &rsize,
+                                 ne[0]));
+
+  GNUNET_assert (0 ==
+                 gcry_mpi_print (GCRYMPI_FMT_USG,
+                                 (unsigned char *) &buf[sizeof (hdr) + n_size],
+                                 e_size,
+                                 &rsize,
+                                 ne[1]));
+  *buffer = buf;
+  gcry_mpi_release (ne[0]);
+  gcry_mpi_release (ne[1]);
+  return buf_size;
+}
+
+
+void
+GNUNET_CRYPTO_rsa_public_key_hash (const struct GNUNET_CRYPTO_RsaPublicKey *key,
+                                   struct GNUNET_HashCode *hc)
+{
+  void *buf;
+  size_t buf_size;
+
+  buf_size = GNUNET_CRYPTO_rsa_public_key_encode (key,
+                                                  &buf);
+  GNUNET_CRYPTO_hash (buf,
+                      buf_size,
+                      hc);
+  GNUNET_free (buf);
+}
+
+
+struct GNUNET_CRYPTO_RsaPublicKey *
+GNUNET_CRYPTO_rsa_public_key_decode (const char *buf,
+                                     size_t len)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *key;
+  struct GNUNET_CRYPTO_RsaPublicKeyHeaderP hdr;
+  size_t e_size;
+  size_t n_size;
+  gcry_mpi_t n;
+  gcry_mpi_t e;
+  gcry_sexp_t data;
+
+  if (len < sizeof (hdr))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  memcpy (&hdr, buf, sizeof (hdr));
+  n_size = ntohs (hdr.modulus_length);
+  e_size = ntohs (hdr.public_exponent_length);
+  if (len != sizeof (hdr) + e_size + n_size)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (0 !=
+      gcry_mpi_scan (&n,
+                     GCRYMPI_FMT_USG,
+                     &buf[sizeof (hdr)],
+                     n_size,
+                     NULL))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (0 !=
+      gcry_mpi_scan (&e,
+                     GCRYMPI_FMT_USG,
+                     &buf[sizeof (hdr) + n_size],
+                     e_size,
+                     NULL))
+  {
+    GNUNET_break_op (0);
+    gcry_mpi_release (n);
+    return NULL;
+  }
+
+  if (0 !=
+      gcry_sexp_build (&data,
+                       NULL,
+                       "(public-key(rsa(n %m)(e %m)))",
+                       n,
+                       e))
+  {
+    GNUNET_break (0);
+    gcry_mpi_release (n);
+    gcry_mpi_release (e);
+    return NULL;
+  }
+  gcry_mpi_release (n);
+  gcry_mpi_release (e);
+  key = GNUNET_new (struct GNUNET_CRYPTO_RsaPublicKey);
+  key->sexp = data;
+  return key;
+}
+
+
+/**
+ * Test for malicious RSA key.
+ *
+ * Assuming n is an RSA modulous and r is generated using a call to
+ * GNUNET_CRYPTO_kdf_mod_mpi, if gcd(r,n) != 1 then n must be a
+ * malicious RSA key designed to deanomize the user.
+ *
+ * @param r KDF result
+ * @param n RSA modulus
+ * @return True if gcd(r,n) = 1, False means RSA key is malicious
+ */
+static int
+rsa_gcd_validate (gcry_mpi_t r,
+                  gcry_mpi_t n)
+{
+  gcry_mpi_t g;
+  int t;
+
+  g = gcry_mpi_new (0);
+  t = gcry_mpi_gcd (g, r, n);
+  gcry_mpi_release (g);
+  return t;
+}
+
+
+/**
+ * Create a blinding key
+ *
+ * @param len length of the key in bits (e.g. 2048)
+ * @param bks pre-secret to use to derive the blinding key
+ * @return the newly created blinding key, NULL if RSA key is malicious
+ */
+static struct RsaBlindingKey *
+rsa_blinding_key_derive (const struct GNUNET_CRYPTO_RsaPublicKey *pkey,
+                         const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks)
+{
+  const char *xts = "Blinding KDF extractor HMAC key";  /* Trusts bks' randomness more */
+  struct RsaBlindingKey *blind;
+  gcry_mpi_t n;
+
+  blind = GNUNET_new (struct RsaBlindingKey);
+
+  /* Extract the composite n from the RSA public key */
+  GNUNET_assert (0 ==
+                 key_from_sexp (&n,
+                                pkey->sexp,
+                                "rsa",
+                                "n"));
+  /* Assert that it at least looks like an RSA key */
+  GNUNET_assert (0 ==
+                 gcry_mpi_get_flag (n,
+                                    GCRYMPI_FLAG_OPAQUE));
+  GNUNET_CRYPTO_kdf_mod_mpi (&blind->r,
+                             n,
+                             xts, strlen (xts),
+                             bks, sizeof(*bks),
+                             "Blinding KDF");
+  if (0 == rsa_gcd_validate (blind->r,
+                             n))
+  {
+    gcry_mpi_release (blind->r);
+    GNUNET_free (blind);
+    blind = NULL;
+  }
+  gcry_mpi_release (n);
+  return blind;
+}
+
+
+/*
+   We originally added GNUNET_CRYPTO_kdf_mod_mpi for the benefit of the
+   previous routine.
+
+   There was previously a call to GNUNET_CRYPTO_kdf in
+   bkey = rsa_blinding_key_derive (len, bks);
+   that gives exactly len bits where
+   len = GNUNET_CRYPTO_rsa_public_key_len (pkey);
+
+   Now r = 2^(len-1)/pkey.n is the probability that a set high bit being
+   okay, meaning bkey < pkey.n.  It follows that (1-r)/2 of the time bkey >
+   pkey.n making the effective bkey be
+   bkey mod pkey.n = bkey - pkey.n
+   so the effective bkey has its high bit set with probability r/2.
+
+   We expect r to be close to 1/2 if the exchange is honest, but the
+   exchange can choose r otherwise.
+
+   In blind signing, the exchange sees
+   B = bkey * S mod pkey.n
+   On deposit, the exchange sees S so they can compute bkey' = B/S mod
+   pkey.n for all B they recorded to see if bkey' has it's high bit set.
+   Also, note the exchange can compute 1/S efficiently since they know the
+   factors of pkey.n.
+
+   I suppose that happens with probability r/(1+r) if its the wrong B, not
+   completely sure.  If otoh we've the right B, then we've the probability
+   r/2 of a set high bit in the effective bkey.
+
+   Interestingly, r^2-r has a maximum at the default r=1/2 anyways, giving
+   the wrong and right probabilities 1/3 and 1/4, respectively.
+
+   I feared this gives the exchange a meaningful fraction of a bit of
+   information per coin involved in the transaction.  It sounds damaging if
+   numerous coins were involved.  And it could run across transactions in
+   some scenarios.
+
+   We fixed this by using a more uniform deterministic pseudo-random number
+   generator for blinding factors.  I do not believe this to be a problem
+   for the rsa_full_domain_hash routine, but better safe than sorry.
+ */
+
+
+int
+GNUNET_CRYPTO_rsa_signature_cmp (const struct GNUNET_CRYPTO_RsaSignature *s1,
+                                 const struct GNUNET_CRYPTO_RsaSignature *s2)
+{
+  void *b1;
+  void *b2;
+  size_t z1;
+  size_t z2;
+  int ret;
+
+  z1 = GNUNET_CRYPTO_rsa_signature_encode (s1,
+                                           &b1);
+  z2 = GNUNET_CRYPTO_rsa_signature_encode (s2,
+                                           &b2);
+  if (z1 != z2)
+    ret = 1;
+  else
+    ret = memcmp (b1,
+                  b2,
+                  z1);
+  GNUNET_free (b1);
+  GNUNET_free (b2);
+  return ret;
+}
+
+
+int
+GNUNET_CRYPTO_rsa_public_key_cmp (const struct GNUNET_CRYPTO_RsaPublicKey *p1,
+                                  const struct GNUNET_CRYPTO_RsaPublicKey *p2)
+{
+  void *b1;
+  void *b2;
+  size_t z1;
+  size_t z2;
+  int ret;
+
+  z1 = GNUNET_CRYPTO_rsa_public_key_encode (p1,
+                                            &b1);
+  z2 = GNUNET_CRYPTO_rsa_public_key_encode (p2,
+                                            &b2);
+  if (z1 != z2)
+    ret = 1;
+  else
+    ret = memcmp (b1,
+                  b2,
+                  z1);
+  GNUNET_free (b1);
+  GNUNET_free (b2);
+  return ret;
+}
+
+
+int
+GNUNET_CRYPTO_rsa_private_key_cmp (const struct GNUNET_CRYPTO_RsaPrivateKey *p1,
+                                   const struct GNUNET_CRYPTO_RsaPrivateKey *p2)
+{
+  void *b1;
+  void *b2;
+  size_t z1;
+  size_t z2;
+  int ret;
+
+  z1 = GNUNET_CRYPTO_rsa_private_key_encode (p1,
+                                             &b1);
+  z2 = GNUNET_CRYPTO_rsa_private_key_encode (p2,
+                                             &b2);
+  if (z1 != z2)
+    ret = 1;
+  else
+    ret = memcmp (b1,
+                  b2,
+                  z1);
+  GNUNET_free (b1);
+  GNUNET_free (b2);
+  return ret;
+}
+
+
+unsigned int
+GNUNET_CRYPTO_rsa_public_key_len (const struct GNUNET_CRYPTO_RsaPublicKey *key)
+{
+  gcry_mpi_t n;
+  unsigned int rval;
+
+  if (0 != key_from_sexp (&n, key->sexp, "rsa", "n"))
+  {   /* Not an RSA public key */
+    GNUNET_break (0);
+    return 0;
+  }
+  rval = gcry_mpi_get_nbits (n);
+  gcry_mpi_release (n);
+  return rval;
+}
+
+
+/**
+ * Destroy a blinding key
+ *
+ * @param bkey the blinding key to destroy
+ */
+static void
+rsa_blinding_key_free (struct RsaBlindingKey *bkey)
+{
+  gcry_mpi_release (bkey->r);
+  GNUNET_free (bkey);
+}
+
+
+/**
+ * Print an MPI to a newly created buffer
+ *
+ * @param v MPI to print.
+ * @param[out] buffer newly allocated buffer containing the result
+ * @return number of bytes stored in @a buffer
+ */
+static size_t
+numeric_mpi_alloc_n_print (gcry_mpi_t v,
+                           char **buffer)
+{
+  size_t n;
+  char *b;
+  size_t rsize;
+
+  gcry_mpi_print (GCRYMPI_FMT_USG,
+                  NULL,
+                  0,
+                  &n,
+                  v);
+  b = GNUNET_malloc (n);
+  GNUNET_assert (0 ==
+                 gcry_mpi_print (GCRYMPI_FMT_USG,
+                                 (unsigned char *) b,
+                                 n,
+                                 &rsize,
+                                 v));
+  *buffer = b;
+  return n;
+}
+
+
+/**
+ * Computes a full domain hash seeded by the given public key.
+ * This gives a measure of provable security to the Taler exchange
+ * against one-more forgery attacks.  See:
+ *   https://eprint.iacr.org/2001/002.pdf
+ *   http://www.di.ens.fr/~pointche/Documents/Papers/2001_fcA.pdf
+ *
+ * @param message the message to sign
+ * @param message_size number of bytes in @a message
+ * @param pkey the public key of the signer
+ * @param rsize If not NULL, the number of bytes actually stored in buffer
+ * @return MPI value set to the FDH, NULL if RSA key is malicious
+ */
+static gcry_mpi_t
+rsa_full_domain_hash (const struct GNUNET_CRYPTO_RsaPublicKey *pkey,
+                      const void *message,
+                      size_t message_size)
+{
+  gcry_mpi_t r;
+  gcry_mpi_t n;
+  void *xts;
+  size_t xts_len;
+  int ok;
+
+  /* Extract the composite n from the RSA public key */
+  GNUNET_assert (0 ==
+                 key_from_sexp (&n,
+                                pkey->sexp,
+                                "rsa",
+                                "n"));
+  /* Assert that it at least looks like an RSA key */
+  GNUNET_assert (0 ==
+                 gcry_mpi_get_flag (n,
+                                    GCRYMPI_FLAG_OPAQUE));
+
+  /* We key with the public denomination key as a homage to RSA-PSS by  *
+  * Mihir Bellare and Phillip Rogaway.  Doing this lowers the degree   *
+  * of the hypothetical polyomial-time attack on RSA-KTI created by a  *
+  * polynomial-time one-more forgary attack.  Yey seeding!       */
+  xts_len = GNUNET_CRYPTO_rsa_public_key_encode (pkey,
+                                                 &xts);
+
+  GNUNET_CRYPTO_kdf_mod_mpi (&r,
+                             n,
+                             xts, xts_len,
+                             message, message_size,
+                             "RSA-FDA FTpsW!");
+  GNUNET_free (xts);
+  ok = rsa_gcd_validate (r, n);
+  gcry_mpi_release (n);
+  if (ok)
+    return r;
+  gcry_mpi_release (r);
+  return NULL;
+}
+
+
+void
+GNUNET_CRYPTO_rsa_blinded_message_free (
+  struct GNUNET_CRYPTO_RsaBlindedMessage *bm)
+{
+  GNUNET_free (bm->blinded_msg);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_rsa_blind (const void *message,
+                         size_t message_size,
+                         const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks,
+                         struct GNUNET_CRYPTO_RsaPublicKey *pkey,
+                         struct GNUNET_CRYPTO_RsaBlindedMessage *bm)
+{
+  struct RsaBlindingKey *bkey;
+  gcry_mpi_t data;
+  gcry_mpi_t ne[2];
+  gcry_mpi_t r_e;
+  gcry_mpi_t data_r_e;
+  int ret;
+
+  BENCHMARK_START (rsa_blind);
+  ret = key_from_sexp (ne,
+                       pkey->sexp,
+                       "public-key",
+                       "ne");
+  if (0 != ret)
+    ret = key_from_sexp (ne,
+                         pkey->sexp,
+                         "rsa",
+                         "ne");
+  if (0 != ret)
+  {
+    GNUNET_break (0);
+    bm->blinded_msg = NULL;
+    bm->blinded_msg_size = 0;
+    BENCHMARK_END (rsa_blind);
+    return GNUNET_NO;
+  }
+
+  data = rsa_full_domain_hash (pkey,
+                               message,
+                               message_size);
+  if (NULL == data)
+    goto rsa_gcd_validate_failure;
+  bkey = rsa_blinding_key_derive (pkey,
+                                  bks);
+  if (NULL == bkey)
+  {
+    gcry_mpi_release (data);
+    goto rsa_gcd_validate_failure;
+  }
+  r_e = gcry_mpi_new (0);
+  gcry_mpi_powm (r_e,
+                 bkey->r,
+                 ne[1],
+                 ne[0]);
+  data_r_e = gcry_mpi_new (0);
+  gcry_mpi_mulm (data_r_e,
+                 data,
+                 r_e,
+                 ne[0]);
+  gcry_mpi_release (data);
+  gcry_mpi_release (ne[0]);
+  gcry_mpi_release (ne[1]);
+  gcry_mpi_release (r_e);
+  rsa_blinding_key_free (bkey);
+
+  bm->blinded_msg_size
+    = numeric_mpi_alloc_n_print (data_r_e,
+                                 (char **) &bm->blinded_msg);
+  gcry_mpi_release (data_r_e);
+
+  BENCHMARK_END (rsa_blind);
+  return GNUNET_YES;
+
+rsa_gcd_validate_failure:
+  /* We know the RSA key is malicious here, so warn the wallet. */
+  /* GNUNET_break_op (0); */
+  gcry_mpi_release (ne[0]);
+  gcry_mpi_release (ne[1]);
+  bm->blinded_msg = NULL;
+  bm->blinded_msg_size = 0;
+  BENCHMARK_END (rsa_blind);
+  return GNUNET_NO;
+}
+
+
+/**
+ * Convert an MPI to an S-expression suitable for signature operations.
+ *
+ * @param value pointer to the data to convert
+ * @return converted s-expression
+ */
+static gcry_sexp_t
+mpi_to_sexp (gcry_mpi_t value)
+{
+  gcry_sexp_t data = NULL;
+
+  GNUNET_assert (0 ==
+                 gcry_sexp_build (&data,
+                                  NULL,
+                                  "(data (flags raw) (value %M))",
+                                  value));
+  return data;
+}
+
+
+/**
+ * Sign the given MPI.
+ *
+ * @param key private key to use for the signing
+ * @param value the MPI to sign
+ * @return NULL on error, signature on success
+ */
+static struct GNUNET_CRYPTO_RsaSignature *
+rsa_sign_mpi (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
+              gcry_mpi_t value)
+{
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  gcry_sexp_t data;
+  gcry_sexp_t result;
+  int rc;
+
+  data = mpi_to_sexp (value);
+
+  if (0 !=
+      (rc = gcry_pk_sign (&result,
+                          data,
+                          key->sexp)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("RSA signing failed at %s:%d: %s\n"),
+         __FILE__,
+         __LINE__,
+         gcry_strerror (rc));
+    gcry_sexp_release (data);
+    GNUNET_break (0);
+    return NULL;
+  }
+
+  /* Lenstra protection was first added to libgcrypt 1.6.4
+   * with commit c17f84bd02d7ee93845e92e20f6ddba814961588.
+   */
+#if GCRYPT_VERSION_NUMBER < 0x010604
+  /* verify signature (guards against Lenstra's attack with fault injection...) */
+  struct GNUNET_CRYPTO_RsaPublicKey *public_key =
+    GNUNET_CRYPTO_rsa_private_key_get_public (key);
+  if (0 !=
+      gcry_pk_verify (result,
+                      data,
+                      public_key->sexp))
+  {
+    GNUNET_break (0);
+    GNUNET_CRYPTO_rsa_public_key_free (public_key);
+    gcry_sexp_release (data);
+    gcry_sexp_release (result);
+    return NULL;
+  }
+  GNUNET_CRYPTO_rsa_public_key_free (public_key);
+#endif
+
+  /* return signature */
+  gcry_sexp_release (data);
+  sig = GNUNET_new (struct GNUNET_CRYPTO_RsaSignature);
+  sig->sexp = result;
+  return sig;
+}
+
+
+struct GNUNET_CRYPTO_RsaSignature *
+GNUNET_CRYPTO_rsa_sign_blinded (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
+                                const struct GNUNET_CRYPTO_RsaBlindedMessage *bm)
+{
+  gcry_mpi_t v = NULL;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+
+  BENCHMARK_START (rsa_sign_blinded);
+  GNUNET_assert (0 ==
+                 gcry_mpi_scan (&v,
+                                GCRYMPI_FMT_USG,
+                                bm->blinded_msg,
+                                bm->blinded_msg_size,
+                                NULL));
+  sig = rsa_sign_mpi (key,
+                      v);
+  gcry_mpi_release (v);
+  BENCHMARK_END (rsa_sign_blinded);
+  return sig;
+}
+
+
+struct GNUNET_CRYPTO_RsaSignature *
+GNUNET_CRYPTO_rsa_sign_fdh (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
+                            const void *message,
+                            size_t message_size)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *pkey;
+  gcry_mpi_t v = NULL;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+
+  pkey = GNUNET_CRYPTO_rsa_private_key_get_public (key);
+  v = rsa_full_domain_hash (pkey,
+                            message,
+                            message_size);
+  GNUNET_CRYPTO_rsa_public_key_free (pkey);
+  if (NULL == v)   /* rsa_gcd_validate failed meaning */
+    return NULL;   /* our *own* RSA key is malicious. */
+
+  sig = rsa_sign_mpi (key, v);
+  gcry_mpi_release (v);
+  return sig;
+}
+
+
+void
+GNUNET_CRYPTO_rsa_signature_free (struct GNUNET_CRYPTO_RsaSignature *sig)
+{
+  gcry_sexp_release (sig->sexp);
+  GNUNET_free (sig);
+}
+
+
+size_t
+GNUNET_CRYPTO_rsa_signature_encode (
+  const struct GNUNET_CRYPTO_RsaSignature *sig,
+  void **buffer)
+{
+  gcry_mpi_t s;
+  size_t buf_size;
+  size_t rsize;
+  unsigned char *buf;
+  int ret;
+
+  ret = key_from_sexp (&s,
+                       sig->sexp,
+                       "sig-val",
+                       "s");
+  if (0 != ret)
+    ret = key_from_sexp (&s,
+                         sig->sexp,
+                         "rsa",
+                         "s");
+  GNUNET_assert (0 == ret);
+  gcry_mpi_print (GCRYMPI_FMT_USG,
+                  NULL,
+                  0,
+                  &buf_size,
+                  s);
+  buf = GNUNET_malloc (buf_size);
+  GNUNET_assert (0 ==
+                 gcry_mpi_print (GCRYMPI_FMT_USG,
+                                 buf,
+                                 buf_size,
+                                 &rsize,
+                                 s));
+  GNUNET_assert (rsize == buf_size);
+  *buffer = (void *) buf;
+  gcry_mpi_release (s);
+  return buf_size;
+}
+
+
+struct GNUNET_CRYPTO_RsaSignature *
+GNUNET_CRYPTO_rsa_signature_decode (const void *buf,
+                                    size_t buf_size)
+{
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  gcry_mpi_t s;
+  gcry_sexp_t data;
+
+  if (0 !=
+      gcry_mpi_scan (&s,
+                     GCRYMPI_FMT_USG,
+                     buf,
+                     buf_size,
+                     NULL))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+
+  if (0 !=
+      gcry_sexp_build (&data,
+                       NULL,
+                       "(sig-val(rsa(s %M)))",
+                       s))
+  {
+    GNUNET_break (0);
+    gcry_mpi_release (s);
+    return NULL;
+  }
+  gcry_mpi_release (s);
+  sig = GNUNET_new (struct GNUNET_CRYPTO_RsaSignature);
+  sig->sexp = data;
+  return sig;
+}
+
+
+struct GNUNET_CRYPTO_RsaPublicKey *
+GNUNET_CRYPTO_rsa_public_key_dup (const struct GNUNET_CRYPTO_RsaPublicKey *key)
+{
+  struct GNUNET_CRYPTO_RsaPublicKey *dup;
+  gcry_sexp_t dup_sexp;
+  size_t erroff;
+
+  /* check if we really are exporting a public key */
+  dup_sexp = gcry_sexp_find_token (key->sexp, "public-key", 0);
+  GNUNET_assert (NULL != dup_sexp);
+  gcry_sexp_release (dup_sexp);
+  /* copy the sexp */
+  GNUNET_assert (0 == gcry_sexp_build (&dup_sexp, &erroff, "%S", key->sexp));
+  dup = GNUNET_new (struct GNUNET_CRYPTO_RsaPublicKey);
+  dup->sexp = dup_sexp;
+  return dup;
+}
+
+
+struct GNUNET_CRYPTO_RsaSignature *
+GNUNET_CRYPTO_rsa_unblind (const struct GNUNET_CRYPTO_RsaSignature *sig,
+                           const struct GNUNET_CRYPTO_RsaBlindingKeySecret *bks,
+                           struct GNUNET_CRYPTO_RsaPublicKey *pkey)
+{
+  struct RsaBlindingKey *bkey;
+  gcry_mpi_t n;
+  gcry_mpi_t s;
+  gcry_mpi_t r_inv;
+  gcry_mpi_t ubsig;
+  int ret;
+  struct GNUNET_CRYPTO_RsaSignature *sret;
+
+  BENCHMARK_START (rsa_unblind);
+
+  ret = key_from_sexp (&n, pkey->sexp, "public-key", "n");
+  if (0 != ret)
+    ret = key_from_sexp (&n, pkey->sexp, "rsa", "n");
+  if (0 != ret)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  ret = key_from_sexp (&s, sig->sexp, "sig-val", "s");
+  if (0 != ret)
+    ret = key_from_sexp (&s, sig->sexp, "rsa", "s");
+  if (0 != ret)
+  {
+    gcry_mpi_release (n);
+    GNUNET_break_op (0);
+    return NULL;
+  }
+
+  bkey = rsa_blinding_key_derive (pkey, bks);
+  if (NULL == bkey)
+  {
+    /* RSA key is malicious since rsa_gcd_validate failed here.
+     * It should have failed during GNUNET_CRYPTO_rsa_blind too though,
+     * so the exchange is being malicious in an unfamilair way, maybe
+     * just trying to crash us.  */
+    GNUNET_break_op (0);
+    gcry_mpi_release (n);
+    gcry_mpi_release (s);
+    return NULL;
+  }
+
+  r_inv = gcry_mpi_new (0);
+  if (1 !=
+      gcry_mpi_invm (r_inv,
+                     bkey->r,
+                     n))
+  {
+    /* We cannot find r mod n, so gcd(r,n) != 1, which should get *
+    * caught above, but we handle it the same here.              */
+    GNUNET_break_op (0);
+    gcry_mpi_release (r_inv);
+    rsa_blinding_key_free (bkey);
+    gcry_mpi_release (n);
+    gcry_mpi_release (s);
+    return NULL;
+  }
+
+  ubsig = gcry_mpi_new (0);
+  gcry_mpi_mulm (ubsig, s, r_inv, n);
+  gcry_mpi_release (n);
+  gcry_mpi_release (r_inv);
+  gcry_mpi_release (s);
+  rsa_blinding_key_free (bkey);
+
+  sret = GNUNET_new (struct GNUNET_CRYPTO_RsaSignature);
+  GNUNET_assert (0 ==
+                 gcry_sexp_build (&sret->sexp,
+                                  NULL,
+                                  "(sig-val (rsa (s %M)))",
+                                  ubsig));
+  gcry_mpi_release (ubsig);
+  BENCHMARK_END (rsa_unblind);
+  return sret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_rsa_verify (const void *message,
+                          size_t message_size,
+                          const struct GNUNET_CRYPTO_RsaSignature *sig,
+                          const struct GNUNET_CRYPTO_RsaPublicKey *pkey)
+{
+  gcry_sexp_t data;
+  gcry_mpi_t r;
+  int rc;
+
+  BENCHMARK_START (rsa_verify);
+
+  r = rsa_full_domain_hash (pkey,
+                            message,
+                            message_size);
+  if (NULL == r)
+  {
+    GNUNET_break_op (0);
+    /* RSA key is malicious since rsa_gcd_validate failed here.
+     * It should have failed during GNUNET_CRYPTO_rsa_blind too though,
+     * so the exchange is being malicious in an unfamilair way, maybe
+     * just trying to crash us.  Arguably, we've only an internal error
+     * though because we should've detected this in our previous call
+     * to GNUNET_CRYPTO_rsa_unblind. *///
+    return GNUNET_NO;
+  }
+
+  data = mpi_to_sexp (r);
+  gcry_mpi_release (r);
+
+  rc = gcry_pk_verify (sig->sexp,
+                       data,
+                       pkey->sexp);
+  gcry_sexp_release (data);
+  if (0 != rc)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("RSA signature verification failed at %s:%d: %s\n"),
+         __FILE__,
+         __LINE__,
+         gcry_strerror (rc));
+    BENCHMARK_END (rsa_verify);
+    return GNUNET_SYSERR;
+  }
+  BENCHMARK_END (rsa_verify);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_CRYPTO_RsaPrivateKey *
+GNUNET_CRYPTO_rsa_private_key_dup (
+  const struct GNUNET_CRYPTO_RsaPrivateKey *key)
+{
+  struct GNUNET_CRYPTO_RsaPrivateKey *dup;
+  gcry_sexp_t dup_sexp;
+  size_t erroff;
+
+  /* check if we really are exporting a private key */
+  dup_sexp = gcry_sexp_find_token (key->sexp, "private-key", 0);
+  GNUNET_assert (NULL != dup_sexp);
+  gcry_sexp_release (dup_sexp);
+  /* copy the sexp */
+  GNUNET_assert (0 == gcry_sexp_build (&dup_sexp, &erroff, "%S", key->sexp));
+  dup = GNUNET_new (struct GNUNET_CRYPTO_RsaPrivateKey);
+  dup->sexp = dup_sexp;
+  return dup;
+}
+
+
+struct GNUNET_CRYPTO_RsaSignature *
+GNUNET_CRYPTO_rsa_signature_dup (const struct GNUNET_CRYPTO_RsaSignature *sig)
+{
+  struct GNUNET_CRYPTO_RsaSignature *dup;
+  gcry_sexp_t dup_sexp;
+  size_t erroff;
+  gcry_mpi_t s;
+  int ret;
+
+  /* verify that this is an RSA signature */
+  ret = key_from_sexp (&s, sig->sexp, "sig-val", "s");
+  if (0 != ret)
+    ret = key_from_sexp (&s, sig->sexp, "rsa", "s");
+  GNUNET_assert (0 == ret);
+  gcry_mpi_release (s);
+  /* copy the sexp */
+  GNUNET_assert (0 == gcry_sexp_build (&dup_sexp, &erroff, "%S", sig->sexp));
+  dup = GNUNET_new (struct GNUNET_CRYPTO_RsaSignature);
+  dup->sexp = dup_sexp;
+  return dup;
+}
+
+
+/* end of crypto_rsa.c */
diff --git a/src/lib/util/crypto_symmetric.c b/src/lib/util/crypto_symmetric.c
new file mode 100644
index 000000000..c08b84c17
--- /dev/null
+++ b/src/lib/util/crypto_symmetric.c
@@ -0,0 +1,254 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/crypto_symmetric.c
+ * @brief Symmetric encryption services; combined cipher AES+TWOFISH (256-bit each)
+ * @author Christian Grothoff
+ * @author Ioana Patrascu
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-crypto-symmetric", \
+                                        __VA_ARGS__)
+
+/**
+ * Create a new SessionKey (for symmetric encryption).
+ *
+ * @param key session key to initialize
+ */
+void
+GNUNET_CRYPTO_symmetric_create_session_key (struct
+                                            GNUNET_CRYPTO_SymmetricSessionKey *
+                                            key)
+{
+  gcry_randomize (key->aes_key,
+                  GNUNET_CRYPTO_AES_KEY_LENGTH,
+                  GCRY_STRONG_RANDOM);
+  gcry_randomize (key->twofish_key,
+                  GNUNET_CRYPTO_AES_KEY_LENGTH,
+                  GCRY_STRONG_RANDOM);
+}
+
+
+/**
+ * Initialize AES cipher.
+ *
+ * @param handle handle to initialize
+ * @param sessionkey session key to use
+ * @param iv initialization vector to use
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static int
+setup_cipher_aes (gcry_cipher_hd_t *handle,
+                  const struct GNUNET_CRYPTO_SymmetricSessionKey *sessionkey,
+                  const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv)
+{
+  int rc;
+
+  GNUNET_assert (0 ==
+                 gcry_cipher_open (handle, GCRY_CIPHER_AES256,
+                                   GCRY_CIPHER_MODE_CFB, 0));
+  rc = gcry_cipher_setkey (*handle,
+                           sessionkey->aes_key,
+                           sizeof(sessionkey->aes_key));
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  rc = gcry_cipher_setiv (*handle,
+                          iv->aes_iv,
+                          sizeof(iv->aes_iv));
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  return GNUNET_OK;
+}
+
+
+/**
+ * Initialize TWOFISH cipher.
+ *
+ * @param handle handle to initialize
+ * @param sessionkey session key to use
+ * @param iv initialization vector to use
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static int
+setup_cipher_twofish (gcry_cipher_hd_t *handle,
+                      const struct
+                      GNUNET_CRYPTO_SymmetricSessionKey *sessionkey,
+                      const struct
+                      GNUNET_CRYPTO_SymmetricInitializationVector *iv)
+{
+  int rc;
+
+  GNUNET_assert (0 ==
+                 gcry_cipher_open (handle, GCRY_CIPHER_TWOFISH,
+                                   GCRY_CIPHER_MODE_CFB, 0));
+  rc = gcry_cipher_setkey (*handle,
+                           sessionkey->twofish_key,
+                           sizeof(sessionkey->twofish_key));
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  rc = gcry_cipher_setiv (*handle,
+                          iv->twofish_iv,
+                          sizeof(iv->twofish_iv));
+  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
+  return GNUNET_OK;
+}
+
+
+/**
+ * Encrypt a block with a symmetric session key.
+ *
+ * @param block the block to encrypt
+ * @param size the size of the @a block
+ * @param sessionkey the key used to encrypt
+ * @param iv the initialization vector to use, use INITVALUE for streams
+ * @param result the output parameter in which to store the encrypted result
+ *               can be the same or overlap with @c block
+ * @returns the size of the encrypted block, -1 for errors.
+ *          Due to the use of CFB and therefore an effective stream cipher,
+ *          this size should be the same as @c len.
+ */
+ssize_t
+GNUNET_CRYPTO_symmetric_encrypt (const void *block,
+                                 size_t size,
+                                 const struct
+                                 GNUNET_CRYPTO_SymmetricSessionKey *sessionkey,
+                                 const struct
+                                 GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+                                 void *result)
+{
+  gcry_cipher_hd_t handle;
+  char tmp[GNUNET_NZL(size)];
+
+  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
+    return -1;
+  GNUNET_assert (0 == gcry_cipher_encrypt (handle, tmp, size, block, size));
+  gcry_cipher_close (handle);
+  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
+    return -1;
+  GNUNET_assert (0 == gcry_cipher_encrypt (handle, result, size, tmp, size));
+  gcry_cipher_close (handle);
+  memset (tmp, 0, sizeof(tmp));
+  return size;
+}
+
+
+/**
+ * Decrypt a given block with the session key.
+ *
+ * @param block the data to decrypt, encoded as returned by encrypt
+ * @param size the size of the @a block to decrypt
+ * @param sessionkey the key used to decrypt
+ * @param iv the initialization vector to use, use INITVALUE for streams
+ * @param result address to store the result at
+ *               can be the same or overlap with @c block
+ * @return -1 on failure, size of decrypted block on success.
+ *         Due to the use of CFB and therefore an effective stream cipher,
+ *         this size should be the same as @c size.
+ */
+ssize_t
+GNUNET_CRYPTO_symmetric_decrypt (const void *block,
+                                 size_t size,
+                                 const struct
+                                 GNUNET_CRYPTO_SymmetricSessionKey *sessionkey,
+                                 const struct
+                                 GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+                                 void *result)
+{
+  gcry_cipher_hd_t handle;
+  char tmp[size];
+
+  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
+    return -1;
+  GNUNET_assert (0 == gcry_cipher_decrypt (handle, tmp, size, block, size));
+  gcry_cipher_close (handle);
+  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
+    return -1;
+  GNUNET_assert (0 == gcry_cipher_decrypt (handle, result, size, tmp, size));
+  gcry_cipher_close (handle);
+  memset (tmp, 0, sizeof(tmp));
+  return size;
+}
+
+
+/**
+ * @brief Derive an IV
+ *
+ * @param iv initialization vector
+ * @param skey session key
+ * @param salt salt for the derivation
+ * @param salt_len size of the @a salt
+ * @param ... pairs of void * & size_t for context chunks, terminated by NULL
+ */
+void
+GNUNET_CRYPTO_symmetric_derive_iv (struct
+                                   GNUNET_CRYPTO_SymmetricInitializationVector *
+                                   iv,
+                                   const struct
+                                   GNUNET_CRYPTO_SymmetricSessionKey *skey,
+                                   const void *salt,
+                                   size_t salt_len,
+                                   ...)
+{
+  va_list argp;
+
+  va_start (argp, salt_len);
+  GNUNET_CRYPTO_symmetric_derive_iv_v (iv, skey, salt, salt_len, argp);
+  va_end (argp);
+}
+
+
+void
+GNUNET_CRYPTO_symmetric_derive_iv_v (struct
+                                     GNUNET_CRYPTO_SymmetricInitializationVector
+                                     *iv,
+                                     const struct
+                                     GNUNET_CRYPTO_SymmetricSessionKey *skey,
+                                     const void *salt,
+                                     size_t salt_len,
+                                     va_list argp)
+{
+  char aes_salt[salt_len + 4];
+  char twofish_salt[salt_len + 4];
+
+  GNUNET_memcpy (aes_salt, salt, salt_len);
+  GNUNET_memcpy (&aes_salt[salt_len], "AES!", 4);
+  GNUNET_memcpy (twofish_salt, salt, salt_len);
+  GNUNET_memcpy (&twofish_salt[salt_len], "FISH", 4);
+  GNUNET_CRYPTO_kdf_v (iv->aes_iv,
+                       sizeof(iv->aes_iv),
+                       aes_salt,
+                       salt_len + 4,
+                       skey->aes_key,
+                       sizeof(skey->aes_key),
+                       argp);
+  GNUNET_CRYPTO_kdf_v (iv->twofish_iv,
+                       sizeof(iv->twofish_iv),
+                       twofish_salt,
+                       salt_len + 4,
+                       skey->twofish_key,
+                       sizeof(skey->twofish_key),
+                       argp);
+}
+
+
+/* end of crypto_symmetric.c */
diff --git a/src/lib/util/disk.c b/src/lib/util/disk.c
new file mode 100644
index 000000000..567c2b5bc
--- /dev/null
+++ b/src/lib/util/disk.c
@@ -0,0 +1,1689 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001--2013, 2016, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/disk.c
+ * @brief disk IO convenience methods
+ * @author Christian Grothoff
+ * @author Nils Durner
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-disk", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-disk", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+  GNUNET_log_from_strerror_file (kind, "util-disk", syscall, filename)
+
+/**
+ * Block size for IO for copying files.
+ */
+#define COPY_BLK_SIZE 65536
+
+#include <sys/types.h>
+#if HAVE_SYS_VFS_H
+#include <sys/vfs.h>
+#endif
+#if HAVE_SYS_PARAM_H
+#include <sys/param.h>
+#endif
+#if HAVE_SYS_MOUNT_H
+#include <sys/mount.h>
+#endif
+#if HAVE_SYS_STATVFS_H
+#include <sys/statvfs.h>
+#endif
+
+#ifndef S_ISLNK
+#define _IFMT 0170000 /* type of file */
+#define _IFLNK 0120000 /* symbolic link */
+#define S_ISLNK(m) (((m) & _IFMT) == _IFLNK)
+#endif
+
+
+/**
+ * Handle used to manage a pipe.
+ */
+struct GNUNET_DISK_PipeHandle
+{
+  /**
+   * File descriptors for the pipe.
+   * One or both of them could be NULL.
+   */
+  struct GNUNET_DISK_FileHandle *fd[2];
+};
+
+
+/**
+ * Closure for the recursion to determine the file size
+ * of a directory.
+ */
+struct GetFileSizeData
+{
+  /**
+   * Set to the total file size.
+   */
+  uint64_t total;
+
+  /**
+   * GNUNET_YES if symbolic links should be included.
+   */
+  int include_sym_links;
+
+  /**
+   * #GNUNET_YES if mode is file-only (return total == -1 for directories).
+   */
+  int single_file_mode;
+};
+
+
+/**
+ * Translate GNUnet-internal permission bitmap to UNIX file
+ * access permission bitmap.
+ *
+ * @param perm file permissions, GNUnet style
+ * @return file permissions, UNIX style
+ */
+static int
+translate_unix_perms (enum GNUNET_DISK_AccessPermissions perm)
+{
+  int mode;
+
+  mode = 0;
+  if (perm & GNUNET_DISK_PERM_USER_READ)
+    mode |= S_IRUSR;
+  if (perm & GNUNET_DISK_PERM_USER_WRITE)
+    mode |= S_IWUSR;
+  if (perm & GNUNET_DISK_PERM_USER_EXEC)
+    mode |= S_IXUSR;
+  if (perm & GNUNET_DISK_PERM_GROUP_READ)
+    mode |= S_IRGRP;
+  if (perm & GNUNET_DISK_PERM_GROUP_WRITE)
+    mode |= S_IWGRP;
+  if (perm & GNUNET_DISK_PERM_GROUP_EXEC)
+    mode |= S_IXGRP;
+  if (perm & GNUNET_DISK_PERM_OTHER_READ)
+    mode |= S_IROTH;
+  if (perm & GNUNET_DISK_PERM_OTHER_WRITE)
+    mode |= S_IWOTH;
+  if (perm & GNUNET_DISK_PERM_OTHER_EXEC)
+    mode |= S_IXOTH;
+
+  return mode;
+}
+
+
+/**
+ * Iterate over all files in the given directory and
+ * accumulate their size.
+ *
+ * @param cls closure of type `struct GetFileSizeData`
+ * @param fn current filename we are looking at
+ * @return #GNUNET_SYSERR on serious errors, otherwise #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+get_size_rec (void *cls, const char *fn)
+{
+  struct GetFileSizeData *gfsd = cls;
+
+#if defined(HAVE_STAT64) && \
+  ! (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64)
+  struct stat64 buf;
+
+  if (0 != stat64 (fn, &buf))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "stat64", fn);
+    return GNUNET_SYSERR;
+  }
+#else
+  struct stat buf;
+
+  if (0 != stat (fn, &buf))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "stat", fn);
+    return GNUNET_SYSERR;
+  }
+#endif
+  if ((S_ISDIR (buf.st_mode)) && (gfsd->single_file_mode == GNUNET_YES))
+  {
+    errno = EISDIR;
+    return GNUNET_SYSERR;
+  }
+  if ((! S_ISLNK (buf.st_mode)) || (gfsd->include_sym_links == GNUNET_YES))
+    gfsd->total += buf.st_size;
+  if ((S_ISDIR (buf.st_mode)) && (0 == access (fn, X_OK)) &&
+      ((! S_ISLNK (buf.st_mode)) || (gfsd->include_sym_links == GNUNET_YES)))
+  {
+    if (GNUNET_SYSERR == GNUNET_DISK_directory_scan (fn, &get_size_rec, gfsd))
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_handle_invalid (const struct GNUNET_DISK_FileHandle *h)
+{
+  return ((! h) || (h->fd == -1)) ? GNUNET_YES : GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_handle_size (struct GNUNET_DISK_FileHandle *fh,
+                              off_t *size)
+{
+  struct stat sbuf;
+
+  if (0 != fstat (fh->fd, &sbuf))
+    return GNUNET_SYSERR;
+  *size = sbuf.st_size;
+  return GNUNET_OK;
+}
+
+
+off_t
+GNUNET_DISK_file_seek (const struct GNUNET_DISK_FileHandle *h,
+                       off_t offset,
+                       enum GNUNET_DISK_Seek whence)
+{
+  static int t[] = { SEEK_SET, SEEK_CUR, SEEK_END };
+
+  if (h == NULL)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  return lseek (h->fd, offset, t[whence]);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_size (const char *filename,
+                       uint64_t *size,
+                       int include_symbolic_links,
+                       int single_file_mode)
+{
+  struct GetFileSizeData gfsd;
+  enum GNUNET_GenericReturnValue ret;
+
+  GNUNET_assert (size != NULL);
+  gfsd.total = 0;
+  gfsd.include_sym_links = include_symbolic_links;
+  gfsd.single_file_mode = single_file_mode;
+  ret = get_size_rec (&gfsd, filename);
+  *size = gfsd.total;
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_get_identifiers (const char *filename,
+                                  uint64_t *dev,
+                                  uint64_t *ino)
+{
+#if HAVE_STAT
+  {
+    struct stat sbuf;
+
+    if (0 != stat (filename, &sbuf))
+    {
+      return GNUNET_SYSERR;
+    }
+    *ino = (uint64_t) sbuf.st_ino;
+  }
+#else
+  *ino = 0;
+#endif
+#if HAVE_STATVFS
+  {
+    struct statvfs fbuf;
+
+    if (0 != statvfs (filename, &fbuf))
+    {
+      return GNUNET_SYSERR;
+    }
+    *dev = (uint64_t) fbuf.f_fsid;
+  }
+#elif HAVE_STATFS
+  {
+    struct statfs fbuf;
+
+    if (0 != statfs (filename, &fbuf))
+    {
+      return GNUNET_SYSERR;
+    }
+    *dev =
+      ((uint64_t) fbuf.f_fsid.val[0]) << 32 || ((uint64_t) fbuf.f_fsid.val[1]);
+  }
+#else
+  *dev = 0;
+#endif
+  return GNUNET_OK;
+}
+
+
+/**
+ * Create the name for a temporary file or directory from a template.
+ *
+ * @param t template (without XXXXX or "/tmp/")
+ * @return name ready for passing to 'mktemp' or 'mkdtemp', NULL on error
+ */
+static char *
+mktemp_name (const char *t)
+{
+  const char *tmpdir;
+  char *tmpl;
+  char *fn;
+
+  if ((t[0] != '/') && (t[0] != '\\'))
+  {
+    /* FIXME: This uses system codepage on W32, not UTF-8 */
+    tmpdir = getenv ("TMPDIR");
+    if (NULL == tmpdir)
+      tmpdir = getenv ("TMP");
+    if (NULL == tmpdir)
+      tmpdir = getenv ("TEMP");
+    if (NULL == tmpdir)
+      tmpdir = "/tmp";
+    GNUNET_asprintf (&tmpl, "%s/%s%s", tmpdir, t, "XXXXXX");
+  }
+  else
+  {
+    GNUNET_asprintf (&tmpl, "%s%s", t, "XXXXXX");
+  }
+  fn = tmpl;
+  return fn;
+}
+
+
+void
+GNUNET_DISK_fix_permissions (const char *fn,
+                             int require_uid_match,
+                             int require_gid_match)
+{
+  mode_t mode;
+
+  if (GNUNET_YES == require_uid_match)
+    mode = S_IRUSR | S_IWUSR | S_IXUSR;
+  else if (GNUNET_YES == require_gid_match)
+    mode = S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP;
+  else
+    mode = S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH
+           | S_IWOTH | S_IXOTH;
+  if (0 != chmod (fn, mode))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "chmod", fn);
+}
+
+
+char *
+GNUNET_DISK_mkdtemp (const char *t)
+{
+  char *fn;
+  mode_t omask;
+
+  omask = umask (S_IWGRP | S_IWOTH | S_IRGRP | S_IROTH);
+  fn = mktemp_name (t);
+  if (fn != mkdtemp (fn))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "mkdtemp", fn);
+    GNUNET_free (fn);
+    umask (omask);
+    return NULL;
+  }
+  umask (omask);
+  return fn;
+}
+
+
+void
+GNUNET_DISK_file_backup (const char *fil)
+{
+  size_t slen;
+  char *target;
+  unsigned int num;
+
+  slen = strlen (fil) + 20;
+  target = GNUNET_malloc (slen);
+  num = 0;
+  do
+  {
+    GNUNET_snprintf (target, slen, "%s.%u~", fil, num++);
+  }
+  while (0 == access (target, F_OK));
+  if (0 != rename (fil, target))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "rename", fil);
+  GNUNET_free (target);
+}
+
+
+char *
+GNUNET_DISK_mktemp (const char *t)
+{
+  int fd;
+  char *fn;
+  mode_t omask;
+
+  omask = umask (S_IWGRP | S_IWOTH | S_IRGRP | S_IROTH);
+  fn = mktemp_name (t);
+  if (-1 == (fd = mkstemp (fn)))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "mkstemp", fn);
+    GNUNET_free (fn);
+    umask (omask);
+    return NULL;
+  }
+  umask (omask);
+  if (0 != close (fd))
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "close", fn);
+  return fn;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_directory_test (const char *fil, int is_readable)
+{
+  struct stat filestat;
+  int ret;
+
+  ret = stat (fil, &filestat);
+  if (ret != 0)
+  {
+    if (errno != ENOENT)
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", fil);
+    return GNUNET_SYSERR;
+  }
+  if (! S_ISDIR (filestat.st_mode))
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         "A file already exits with the same name %s\n",
+         fil);
+    return GNUNET_NO;
+  }
+  if (GNUNET_YES == is_readable)
+    ret = access (fil, R_OK | X_OK);
+  else
+    ret = access (fil, X_OK);
+  if (ret < 0)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "access", fil);
+    return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Check if fil can be accessed using amode.
+ *
+ * @param fil file to check for
+ * @param amode access mode
+ * @returns GNUnet error code
+ */
+static enum GNUNET_GenericReturnValue
+file_test_internal (const char *fil, int amode)
+{
+  struct stat filestat;
+  int ret;
+  char *rdir;
+
+  rdir = GNUNET_STRINGS_filename_expand (fil);
+  if (rdir == NULL)
+    return GNUNET_SYSERR;
+
+  ret = stat (rdir, &filestat);
+  if (0 != ret)
+  {
+    if (errno != ENOENT)
+    {
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "stat", rdir);
+      GNUNET_free (rdir);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_free (rdir);
+    return GNUNET_NO;
+  }
+  if (! S_ISREG (filestat.st_mode))
+  {
+    GNUNET_free (rdir);
+    return GNUNET_NO;
+  }
+  if (access (rdir, amode) < 0)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "access", rdir);
+    GNUNET_free (rdir);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (rdir);
+  return GNUNET_YES;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_test (const char *fil)
+{
+  return file_test_internal (fil, F_OK);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_test_read (const char *fil)
+{
+  return file_test_internal (fil, R_OK);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_directory_create (const char *dir)
+{
+  char *rdir;
+  unsigned int len;
+  unsigned int pos;
+  unsigned int pos2;
+  int ret = GNUNET_OK;
+
+  rdir = GNUNET_STRINGS_filename_expand (dir);
+  if (rdir == NULL)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  len = strlen (rdir);
+
+  pos = 1; /* skip heading '/' */
+
+  /* Check which low level directories already exist */
+  pos2 = len;
+  rdir[len] = DIR_SEPARATOR;
+  while (pos <= pos2)
+  {
+    if (DIR_SEPARATOR == rdir[pos2])
+    {
+      rdir[pos2] = '\0';
+      ret = GNUNET_DISK_directory_test (rdir, GNUNET_NO);
+      if (GNUNET_NO == ret)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Creating directory `%s' failed",
+                    rdir);
+        GNUNET_free (rdir);
+        return GNUNET_SYSERR;
+      }
+      rdir[pos2] = DIR_SEPARATOR;
+      if (GNUNET_YES == ret)
+      {
+        pos2++;
+        break;
+      }
+    }
+    pos2--;
+  }
+  rdir[len] = '\0';
+  if (pos < pos2)
+    pos = pos2;
+  /* Start creating directories */
+  while (pos <= len)
+  {
+    if ((rdir[pos] == DIR_SEPARATOR) || (pos == len))
+    {
+      rdir[pos] = '\0';
+      ret = GNUNET_DISK_directory_test (rdir, GNUNET_NO);
+      if (GNUNET_NO == ret)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Creating directory `%s' failed",
+                    rdir);
+        GNUNET_free (rdir);
+        return GNUNET_SYSERR;
+      }
+      if (GNUNET_SYSERR == ret)
+      {
+        ret = mkdir (rdir,
+                     S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP | S_IROTH
+                     | S_IXOTH);    /* 755 */
+
+        if ((ret != 0) && (errno != EEXIST))
+        {
+          LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "mkdir", rdir);
+          GNUNET_free (rdir);
+          return GNUNET_SYSERR;
+        }
+      }
+      rdir[pos] = DIR_SEPARATOR;
+    }
+    pos++;
+  }
+  GNUNET_free (rdir);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_directory_create_for_file (const char *filename)
+{
+  char *rdir;
+  size_t len;
+  int eno;
+  enum GNUNET_GenericReturnValue res;
+
+  rdir = GNUNET_STRINGS_filename_expand (filename);
+  if (NULL == rdir)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  if (0 == access (rdir, W_OK))
+  {
+    GNUNET_free (rdir);
+    return GNUNET_OK;
+  }
+  len = strlen (rdir);
+  while ((len > 0) && (rdir[len] != DIR_SEPARATOR))
+    len--;
+  rdir[len] = '\0';
+  /* The empty path is invalid and in this case refers to / */
+  if (0 == len)
+  {
+    GNUNET_free (rdir);
+    rdir = GNUNET_strdup ("/");
+  }
+  res = GNUNET_DISK_directory_create (rdir);
+  if ( (GNUNET_OK == res) &&
+       (0 != access (rdir, W_OK)) )
+    res = GNUNET_NO;
+  eno = errno;
+  GNUNET_free (rdir);
+  errno = eno;
+  return res;
+}
+
+
+ssize_t
+GNUNET_DISK_file_read (const struct GNUNET_DISK_FileHandle *h,
+                       void *result,
+                       size_t len)
+{
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  return read (h->fd, result, len);
+}
+
+
+ssize_t
+GNUNET_DISK_file_read_non_blocking (const struct GNUNET_DISK_FileHandle *h,
+                                    void *result,
+                                    size_t len)
+{
+  int flags;
+  ssize_t ret;
+
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  /* set to non-blocking, read, then set back */
+  flags = fcntl (h->fd, F_GETFL);
+  if (0 == (flags & O_NONBLOCK))
+    (void) fcntl (h->fd, F_SETFL, flags | O_NONBLOCK);
+  ret = read (h->fd, result, len);
+  if (0 == (flags & O_NONBLOCK))
+  {
+    int eno = errno;
+    (void) fcntl (h->fd, F_SETFL, flags);
+    errno = eno;
+  }
+  return ret;
+}
+
+
+ssize_t
+GNUNET_DISK_fn_read (const char *fn,
+                     void *result,
+                     size_t len)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  ssize_t ret;
+  int eno;
+
+  fh = GNUNET_DISK_file_open (fn,
+                              GNUNET_DISK_OPEN_READ,
+                              GNUNET_DISK_PERM_NONE);
+  if (NULL == fh)
+    return GNUNET_SYSERR;
+  ret = GNUNET_DISK_file_read (fh, result, len);
+  eno = errno;
+  GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fh));
+  errno = eno;
+  return ret;
+}
+
+
+ssize_t
+GNUNET_DISK_file_write (const struct GNUNET_DISK_FileHandle *h,
+                        const void *buffer,
+                        size_t n)
+{
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+
+  return write (h->fd, buffer, n);
+}
+
+
+ssize_t
+GNUNET_DISK_file_write_blocking (const struct GNUNET_DISK_FileHandle *h,
+                                 const void *buffer,
+                                 size_t n)
+{
+  int flags;
+  ssize_t ret;
+
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  /* set to blocking, write, then set back */
+  flags = fcntl (h->fd, F_GETFL);
+  if (0 != (flags & O_NONBLOCK))
+    (void) fcntl (h->fd, F_SETFL, flags - O_NONBLOCK);
+  ret = write (h->fd, buffer, n);
+  if (0 == (flags & O_NONBLOCK))
+    (void) fcntl (h->fd, F_SETFL, flags);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_fn_write (const char *fn,
+                      const void *buf,
+                      size_t buf_size,
+                      enum GNUNET_DISK_AccessPermissions mode)
+{
+  char *tmpl;
+  int fd;
+
+  if (GNUNET_OK !=
+      GNUNET_DISK_directory_create_for_file (fn))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "mkstemp",
+                              fn);
+    return GNUNET_SYSERR;
+  }
+  {
+    char *dname;
+
+    dname = GNUNET_strdup (fn);
+    GNUNET_asprintf (&tmpl,
+                     "%s/XXXXXX",
+                     dirname (dname));
+    GNUNET_free (dname);
+  }
+  fd = mkstemp (tmpl);
+  if (-1 == fd)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "mkstemp",
+                              tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
+  }
+
+  if (0 != fchmod (fd,
+                   translate_unix_perms (mode)))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "chmod",
+                              tmpl);
+    GNUNET_assert (0 == close (fd));
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
+  }
+  if (buf_size !=
+      write (fd,
+             buf,
+             buf_size))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "write",
+                              tmpl);
+    GNUNET_assert (0 == close (fd));
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 == close (fd));
+
+  if (0 != link (tmpl,
+                 fn))
+  {
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_NO;
+  }
+  if (0 != unlink (tmpl))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                              "unlink",
+                              tmpl);
+  GNUNET_free (tmpl);
+  return GNUNET_OK;
+
+
+}
+
+
+int
+GNUNET_DISK_directory_scan (const char *dir_name,
+                            GNUNET_FileNameCallback callback,
+                            void *callback_cls)
+{
+  DIR *dinfo;
+  struct dirent *finfo;
+  struct stat istat;
+  int count = 0;
+  enum GNUNET_GenericReturnValue ret;
+  char *name;
+  char *dname;
+  unsigned int name_len;
+  unsigned int n_size;
+
+  GNUNET_assert (NULL != dir_name);
+  dname = GNUNET_STRINGS_filename_expand (dir_name);
+  if (NULL == dname)
+    return GNUNET_SYSERR;
+  while ((strlen (dname) > 0) && (dname[strlen (dname) - 1] == DIR_SEPARATOR))
+    dname[strlen (dname) - 1] = '\0';
+  if (0 != stat (dname, &istat))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", dname);
+    GNUNET_free (dname);
+    return GNUNET_SYSERR;
+  }
+  if (! S_ISDIR (istat.st_mode))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Expected `%s' to be a directory!\n"),
+         dir_name);
+    GNUNET_free (dname);
+    return GNUNET_SYSERR;
+  }
+  errno = 0;
+  dinfo = opendir (dname);
+  if ((EACCES == errno) || (NULL == dinfo))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "opendir", dname);
+    if (NULL != dinfo)
+      closedir (dinfo);
+    GNUNET_free (dname);
+    return GNUNET_SYSERR;
+  }
+  name_len = 256;
+  n_size = strlen (dname) + name_len + strlen (DIR_SEPARATOR_STR) + 1;
+  name = GNUNET_malloc (n_size);
+  while (NULL != (finfo = readdir (dinfo)))
+  {
+    if ((0 == strcmp (finfo->d_name, ".")) ||
+        (0 == strcmp (finfo->d_name, "..")))
+      continue;
+    if (NULL != callback)
+    {
+      if (name_len < strlen (finfo->d_name))
+      {
+        GNUNET_free (name);
+        name_len = strlen (finfo->d_name);
+        n_size = strlen (dname) + name_len + strlen (DIR_SEPARATOR_STR) + 1;
+        name = GNUNET_malloc (n_size);
+      }
+      /* dname can end in "/" only if dname == "/";
+       * if dname does not end in "/", we need to add
+       * a "/" (otherwise, we must not!) */
+      GNUNET_snprintf (name,
+                       n_size,
+                       "%s%s%s",
+                       dname,
+                       (0 == strcmp (dname, DIR_SEPARATOR_STR))
+                       ? ""
+                       : DIR_SEPARATOR_STR,
+                       finfo->d_name);
+      ret = callback (callback_cls, name);
+      if (GNUNET_OK != ret)
+      {
+        closedir (dinfo);
+        GNUNET_free (name);
+        GNUNET_free (dname);
+        if (GNUNET_NO == ret)
+          return count;
+        return GNUNET_SYSERR;
+      }
+    }
+    count++;
+  }
+  closedir (dinfo);
+  GNUNET_free (name);
+  GNUNET_free (dname);
+  return count;
+}
+
+
+/**
+ * Check for a simple wildcard match.
+ * Only asterisks are allowed.
+ * Asterisks match everything, including slashes.
+ *
+ * @param pattern pattern with wildcards
+ * @param str string to match against
+ * @returns true on match, false otherwise
+ */
+static bool
+glob_match (const char *pattern, const char *str)
+{
+  /* Position in the input string */
+  const char *str_pos = str;
+  /* Position in the pattern */
+  const char *pat_pos = pattern;
+  /* Backtrack position in string */
+  const char *str_bt = NULL;
+  /* Backtrack position in pattern */
+  const char *pat_bt = NULL;
+
+  for (;;)
+  {
+    if (*pat_pos == '*')
+    {
+      str_bt = str_pos;
+      pat_bt = pat_pos++;
+    }
+    else if (*pat_pos == *str_pos)
+    {
+      if ('\0' == *pat_pos)
+        return true;
+      str_pos++;
+      pat_pos++;
+    }
+    else
+    {
+      if (NULL == str_bt)
+        return false;
+      /* Backtrack to match one more
+         character as part of the asterisk. */
+      str_pos = str_bt + 1;
+      if ('\0' == *str_pos)
+        return false;
+      pat_pos = pat_bt;
+    }
+  }
+}
+
+
+struct GlobClosure
+{
+  const char *glob;
+  GNUNET_FileNameCallback cb;
+  void *cls;
+
+  /**
+   * Number of files that actually matched the glob pattern.
+   */
+  int nres;
+};
+
+/**
+ * Function called with a filename.
+ *
+ * @param cls closure
+ * @param filename complete filename (absolute path)
+ * @return #GNUNET_OK to continue to iterate,
+ *  #GNUNET_NO to stop iteration with no error,
+ *  #GNUNET_SYSERR to abort iteration with error!
+ */
+static enum GNUNET_GenericReturnValue
+glob_cb (void *cls,
+         const char *filename)
+{
+  struct GlobClosure *gc = cls;
+  const char *fn;
+
+  fn = strrchr (filename, DIR_SEPARATOR);
+  fn = (NULL == fn) ? filename : (fn + 1);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "checking glob '%s' against '%s'\n",
+       gc->glob,
+       fn);
+
+  if (glob_match (gc->glob, fn))
+  {
+    enum GNUNET_GenericReturnValue cbret;
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "found glob match '%s'\n",
+         filename);
+    gc->nres++;
+    cbret = gc->cb (gc->cls, filename);
+    if (GNUNET_OK != cbret)
+      return cbret;
+  }
+  return GNUNET_OK;
+}
+
+
+int
+GNUNET_DISK_glob (const char *glob_pattern,
+                  GNUNET_FileNameCallback callback,
+                  void *callback_cls)
+{
+  char *mypat = GNUNET_strdup (glob_pattern);
+  char *sep;
+  int ret;
+
+  if ( (NULL != strrchr (glob_pattern, '+')) ||
+       (NULL != strrchr (glob_pattern, '[')) ||
+       (NULL != strrchr (glob_pattern, '+')) ||
+       (NULL != strrchr (glob_pattern, '~')) )
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "unsupported glob pattern: '%s'\n",
+         glob_pattern);
+    GNUNET_free (mypat);
+    return -1;
+  }
+
+  sep = strrchr (mypat, DIR_SEPARATOR);
+  if (NULL == sep)
+  {
+    GNUNET_free (mypat);
+    return -1;
+  }
+
+  *sep = '\0';
+
+  if (NULL != strchr (mypat, '*'))
+  {
+    GNUNET_free (mypat);
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "glob pattern may only contain '*' in the final path component\n");
+    return -1;
+  }
+
+  {
+    struct GlobClosure gc = {
+      .glob = sep + 1,
+      .cb = callback,
+      .cls = callback_cls,
+      .nres = 0,
+    };
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "scanning directory '%s' for glob matches on '%s'\n",
+         mypat,
+         gc.glob);
+    ret = GNUNET_DISK_directory_scan (mypat,
+                                      glob_cb,
+                                      &gc
+                                      );
+    GNUNET_free (mypat);
+    return (ret < 0) ? ret : gc.nres;
+  }
+}
+
+
+/**
+ * Function that removes the given directory by calling
+ * #GNUNET_DISK_directory_remove().
+ *
+ * @param unused not used
+ * @param fn directory to remove
+ * @return #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+remove_helper (void *unused,
+               const char *fn)
+{
+  (void) unused;
+  (void) GNUNET_DISK_directory_remove (fn);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_directory_remove (const char *filename)
+{
+  struct stat istat;
+
+  if (NULL == filename)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != lstat (filename, &istat))
+    return GNUNET_NO; /* file may not exist... */
+  (void) chmod (filename,
+                S_IWUSR | S_IRUSR | S_IXUSR);
+  if (0 == unlink (filename))
+    return GNUNET_OK;
+  if ( (errno != EISDIR) &&
+       /* EISDIR is not sufficient in all cases, e.g.
+        * sticky /tmp directory may result in EPERM on BSD.
+        * So we also explicitly check "isDirectory" */
+       (GNUNET_YES !=
+        GNUNET_DISK_directory_test (filename,
+                                    GNUNET_YES)) )
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "rmdir", filename);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_directory_scan (filename, &remove_helper, NULL))
+    return GNUNET_SYSERR;
+  if (0 != rmdir (filename))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "rmdir", filename);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_copy (const char *src,
+                       const char *dst)
+{
+  char *buf;
+  uint64_t pos;
+  uint64_t size;
+  size_t len;
+  ssize_t sret;
+  struct GNUNET_DISK_FileHandle *in;
+  struct GNUNET_DISK_FileHandle *out;
+
+  if (GNUNET_OK != GNUNET_DISK_file_size (src, &size, GNUNET_YES, GNUNET_YES))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "stat", src);
+    return GNUNET_SYSERR;
+  }
+  pos = 0;
+  in =
+    GNUNET_DISK_file_open (src, GNUNET_DISK_OPEN_READ, GNUNET_DISK_PERM_NONE);
+  if (! in)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "open", src);
+    return GNUNET_SYSERR;
+  }
+  out =
+    GNUNET_DISK_file_open (dst,
+                           GNUNET_DISK_OPEN_WRITE | GNUNET_DISK_OPEN_CREATE
+                           | GNUNET_DISK_OPEN_FAILIFEXISTS,
+                           GNUNET_DISK_PERM_USER_READ
+                           | GNUNET_DISK_PERM_USER_WRITE
+                           | GNUNET_DISK_PERM_GROUP_READ
+                           | GNUNET_DISK_PERM_GROUP_WRITE);
+  if (! out)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "open", dst);
+    GNUNET_DISK_file_close (in);
+    return GNUNET_SYSERR;
+  }
+  buf = GNUNET_malloc (COPY_BLK_SIZE);
+  while (pos < size)
+  {
+    len = COPY_BLK_SIZE;
+    if (len > size - pos)
+      len = size - pos;
+    sret = GNUNET_DISK_file_read (in, buf, len);
+    if ((sret < 0) || (len != (size_t) sret))
+      goto FAIL;
+    sret = GNUNET_DISK_file_write (out, buf, len);
+    if ((sret < 0) || (len != (size_t) sret))
+      goto FAIL;
+    pos += len;
+  }
+  GNUNET_free (buf);
+  GNUNET_DISK_file_close (in);
+  GNUNET_DISK_file_close (out);
+  return GNUNET_OK;
+  FAIL:
+  GNUNET_free (buf);
+  GNUNET_DISK_file_close (in);
+  GNUNET_DISK_file_close (out);
+  return GNUNET_SYSERR;
+}
+
+
+void
+GNUNET_DISK_filename_canonicalize (char *fn)
+{
+  char *idx;
+  char c;
+
+  for (idx = fn; *idx; idx++)
+  {
+    c = *idx;
+
+    if ((c == '/') || (c == '\\') || (c == ':') || (c == '*') || (c == '?') ||
+        (c ==
+         '"')
+        ||
+        (c == '<') || (c == '>') || (c == '|') )
+    {
+      *idx = '_';
+    }
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_change_owner (const char *filename,
+                               const char *user)
+{
+  struct passwd *pws;
+
+  pws = getpwnam (user);
+  if (NULL == pws)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Cannot obtain information about user `%s': %s\n"),
+         user,
+         strerror (errno));
+    return GNUNET_SYSERR;
+  }
+  if (0 != chown (filename, pws->pw_uid, pws->pw_gid))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "chown", filename);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_DISK_FileHandle *
+GNUNET_DISK_file_open (const char *fn,
+                       enum GNUNET_DISK_OpenFlags flags,
+                       enum GNUNET_DISK_AccessPermissions perm)
+{
+  char *expfn;
+  struct GNUNET_DISK_FileHandle *ret;
+
+  int oflags;
+  int mode;
+  int fd;
+
+  expfn = GNUNET_STRINGS_filename_expand (fn);
+  if (NULL == expfn)
+    return NULL;
+
+  mode = 0;
+  if (GNUNET_DISK_OPEN_READWRITE == (flags & GNUNET_DISK_OPEN_READWRITE))
+    oflags = O_RDWR; /* note: O_RDWR is NOT always O_RDONLY | O_WRONLY */
+  else if (flags & GNUNET_DISK_OPEN_READ)
+    oflags = O_RDONLY;
+  else if (flags & GNUNET_DISK_OPEN_WRITE)
+    oflags = O_WRONLY;
+  else
+  {
+    GNUNET_break (0);
+    GNUNET_free (expfn);
+    return NULL;
+  }
+  if (flags & GNUNET_DISK_OPEN_FAILIFEXISTS)
+    oflags |= (O_CREAT | O_EXCL);
+  if (flags & GNUNET_DISK_OPEN_TRUNCATE)
+    oflags |= O_TRUNC;
+  if (flags & GNUNET_DISK_OPEN_APPEND)
+    oflags |= O_APPEND;
+  if (GNUNET_NO == GNUNET_DISK_file_test (fn))
+  {
+    if (flags & GNUNET_DISK_OPEN_CREATE)
+    {
+      (void) GNUNET_DISK_directory_create_for_file (expfn);
+      oflags |= O_CREAT;
+      mode = translate_unix_perms (perm);
+    }
+  }
+
+  fd = open (expfn,
+             oflags
+#if O_CLOEXEC
+             | O_CLOEXEC
+#endif
+             | O_LARGEFILE,
+             mode);
+  if (fd == -1)
+  {
+    if (0 == (flags & GNUNET_DISK_OPEN_FAILIFEXISTS))
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "open", expfn);
+    else
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "open", expfn);
+    GNUNET_free (expfn);
+    return NULL;
+  }
+
+  ret = GNUNET_new (struct GNUNET_DISK_FileHandle);
+
+  ret->fd = fd;
+
+  GNUNET_free (expfn);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_close (struct GNUNET_DISK_FileHandle *h)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+
+  ret = GNUNET_OK;
+  if (0 != close (h->fd))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING, "close");
+    ret = GNUNET_SYSERR;
+  }
+  GNUNET_free (h);
+  return ret;
+}
+
+
+struct GNUNET_DISK_FileHandle *
+GNUNET_DISK_get_handle_from_int_fd (int fno)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+
+  if ((((off_t) -1) == lseek (fno, 0, SEEK_CUR)) && (EBADF == errno))
+    return NULL; /* invalid FD */
+
+  fh = GNUNET_new (struct GNUNET_DISK_FileHandle);
+
+  fh->fd = fno;
+
+  return fh;
+}
+
+
+struct GNUNET_DISK_FileHandle *
+GNUNET_DISK_get_handle_from_native (FILE *fd)
+{
+  int fno;
+
+  fno = fileno (fd);
+  if (-1 == fno)
+    return NULL;
+  return GNUNET_DISK_get_handle_from_int_fd (fno);
+}
+
+
+/**
+ * Handle for a memory-mapping operation.
+ */
+struct GNUNET_DISK_MapHandle
+{
+  /**
+   * Address where the map is in memory.
+   */
+  void *addr;
+
+  /**
+   * Number of bytes mapped.
+   */
+  size_t len;
+};
+
+
+#ifndef MAP_FAILED
+#define MAP_FAILED ((void *) -1)
+#endif
+
+
+void *
+GNUNET_DISK_file_map (const struct GNUNET_DISK_FileHandle *h,
+                      struct GNUNET_DISK_MapHandle **m,
+                      enum GNUNET_DISK_MapType access,
+                      size_t len)
+{
+  int prot;
+
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return NULL;
+  }
+  prot = 0;
+  if (access & GNUNET_DISK_MAP_TYPE_READ)
+    prot = PROT_READ;
+  if (access & GNUNET_DISK_MAP_TYPE_WRITE)
+    prot |= PROT_WRITE;
+  *m = GNUNET_new (struct GNUNET_DISK_MapHandle);
+  (*m)->addr = mmap (NULL, len, prot, MAP_SHARED, h->fd, 0);
+  GNUNET_assert (NULL != (*m)->addr);
+  if (MAP_FAILED == (*m)->addr)
+  {
+    GNUNET_free (*m);
+    return NULL;
+  }
+  (*m)->len = len;
+  return (*m)->addr;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_unmap (struct GNUNET_DISK_MapHandle *h)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  if (NULL == h)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+  ret = munmap (h->addr, h->len) != -1 ? GNUNET_OK : GNUNET_SYSERR;
+  GNUNET_free (h);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_file_sync (const struct GNUNET_DISK_FileHandle *h)
+{
+  if (h == NULL)
+  {
+    errno = EINVAL;
+    return GNUNET_SYSERR;
+  }
+
+#if ! defined(__linux__) || ! defined(GNU)
+  return fsync (h->fd) == -1 ? GNUNET_SYSERR : GNUNET_OK;
+#else
+  return fdatasync (h->fd) == -1 ? GNUNET_SYSERR : GNUNET_OK;
+#endif
+}
+
+
+struct GNUNET_DISK_PipeHandle *
+GNUNET_DISK_pipe (enum GNUNET_DISK_PipeFlags pf)
+{
+  int fd[2];
+
+  if (-1 == pipe (fd))
+  {
+    int eno = errno;
+
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "pipe");
+    errno = eno;
+    return NULL;
+  }
+  return GNUNET_DISK_pipe_from_fd (pf, fd);
+}
+
+
+struct GNUNET_DISK_PipeHandle *
+GNUNET_DISK_pipe_from_fd (enum GNUNET_DISK_PipeFlags pf,
+                          int fd[2])
+{
+  struct GNUNET_DISK_PipeHandle *p;
+  int ret = 0;
+  int flags;
+  int eno = 0; /* make gcc happy */
+
+  p = GNUNET_new (struct GNUNET_DISK_PipeHandle);
+  if (fd[0] >= 0)
+  {
+    p->fd[0] = GNUNET_new (struct GNUNET_DISK_FileHandle);
+    p->fd[0]->fd = fd[0];
+    if (0 == (GNUNET_DISK_PF_BLOCKING_READ & pf))
+    {
+      flags = fcntl (fd[0], F_GETFL);
+      flags |= O_NONBLOCK;
+      if (0 > fcntl (fd[0], F_SETFL, flags))
+      {
+        ret = -1;
+        eno = errno;
+      }
+    }
+    flags = fcntl (fd[0], F_GETFD);
+    flags |= FD_CLOEXEC;
+    if (0 > fcntl (fd[0], F_SETFD, flags))
+    {
+      ret = -1;
+      eno = errno;
+    }
+  }
+
+  if (fd[1] >= 0)
+  {
+    p->fd[1] = GNUNET_new (struct GNUNET_DISK_FileHandle);
+    p->fd[1]->fd = fd[1];
+    if (0 == (GNUNET_DISK_PF_BLOCKING_WRITE & pf))
+    {
+      flags = fcntl (fd[1], F_GETFL);
+      flags |= O_NONBLOCK;
+      if (0 > fcntl (fd[1], F_SETFL, flags))
+      {
+        ret = -1;
+        eno = errno;
+      }
+    }
+    flags = fcntl (fd[1], F_GETFD);
+    flags |= FD_CLOEXEC;
+    if (0 > fcntl (fd[1], F_SETFD, flags))
+    {
+      ret = -1;
+      eno = errno;
+    }
+  }
+  if (ret == -1)
+  {
+    errno = eno;
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "fcntl");
+    if (p->fd[0]->fd >= 0)
+      GNUNET_break (0 == close (p->fd[0]->fd));
+    if (p->fd[1]->fd >= 0)
+      GNUNET_break (0 == close (p->fd[1]->fd));
+    GNUNET_free (p->fd[0]);
+    GNUNET_free (p->fd[1]);
+    GNUNET_free (p);
+    errno = eno;
+    return NULL;
+  }
+  return p;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_pipe_close_end (struct GNUNET_DISK_PipeHandle *p,
+                            enum GNUNET_DISK_PipeEnd end)
+{
+  enum GNUNET_GenericReturnValue ret = GNUNET_OK;
+
+  if (end == GNUNET_DISK_PIPE_END_READ)
+  {
+    if (p->fd[0])
+    {
+      ret = GNUNET_DISK_file_close (p->fd[0]);
+      p->fd[0] = NULL;
+    }
+  }
+  else if (end == GNUNET_DISK_PIPE_END_WRITE)
+  {
+    if (p->fd[1])
+    {
+      ret = GNUNET_DISK_file_close (p->fd[1]);
+      p->fd[1] = NULL;
+    }
+  }
+  return ret;
+}
+
+
+struct GNUNET_DISK_FileHandle *
+GNUNET_DISK_pipe_detach_end (struct GNUNET_DISK_PipeHandle *p,
+                             enum GNUNET_DISK_PipeEnd end)
+{
+  struct GNUNET_DISK_FileHandle *ret = NULL;
+
+  if (end == GNUNET_DISK_PIPE_END_READ)
+  {
+    if (p->fd[0])
+    {
+      ret = p->fd[0];
+      p->fd[0] = NULL;
+    }
+  }
+  else if (end == GNUNET_DISK_PIPE_END_WRITE)
+  {
+    if (p->fd[1])
+    {
+      ret = p->fd[1];
+      p->fd[1] = NULL;
+    }
+  }
+
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_pipe_close (struct GNUNET_DISK_PipeHandle *p)
+{
+  enum GNUNET_GenericReturnValue ret = GNUNET_OK;
+  enum GNUNET_GenericReturnValue read_end_close;
+  enum GNUNET_GenericReturnValue write_end_close;
+  int read_end_close_errno;
+  int write_end_close_errno;
+
+  read_end_close = GNUNET_DISK_pipe_close_end (p, GNUNET_DISK_PIPE_END_READ);
+  read_end_close_errno = errno;
+  write_end_close = GNUNET_DISK_pipe_close_end (p, GNUNET_DISK_PIPE_END_WRITE);
+  write_end_close_errno = errno;
+  GNUNET_free (p);
+
+  if (GNUNET_OK != read_end_close)
+  {
+    errno = read_end_close_errno;
+    ret = read_end_close;
+  }
+  else if (GNUNET_OK != write_end_close)
+  {
+    errno = write_end_close_errno;
+    ret = write_end_close;
+  }
+
+  return ret;
+}
+
+
+const struct GNUNET_DISK_FileHandle *
+GNUNET_DISK_pipe_handle (const struct GNUNET_DISK_PipeHandle *p,
+                         enum GNUNET_DISK_PipeEnd n)
+{
+  switch (n)
+  {
+  case GNUNET_DISK_PIPE_END_READ:
+  case GNUNET_DISK_PIPE_END_WRITE:
+    return p->fd[n];
+
+  default:
+    GNUNET_break (0);
+    return NULL;
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_DISK_internal_file_handle_ (const struct GNUNET_DISK_FileHandle *fh,
+                                   void *dst,
+                                   size_t dst_len)
+{
+  if (NULL == fh)
+    return GNUNET_SYSERR;
+  if (dst_len < sizeof(int))
+    return GNUNET_SYSERR;
+  *((int *) dst) = fh->fd;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Helper function for #GNUNET_DISK_purge_cfg_dir.
+ *
+ * @param cls a `const char *` with the option to purge
+ * @param cfg our configuration
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+purge_cfg_dir (void *cls,
+               const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  const char *option = cls;
+  char *tmpname;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (cfg, "PATHS", option, &tmpname))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "PATHS", option);
+    return GNUNET_NO;
+  }
+  if (GNUNET_SYSERR == GNUNET_DISK_directory_remove (tmpname))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "remove", tmpname);
+    GNUNET_free (tmpname);
+    return GNUNET_OK;
+  }
+  GNUNET_free (tmpname);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_DISK_purge_cfg_dir (const char *cfg_filename,
+                           const char *option)
+{
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_CONFIGURATION_parse_and_run (cfg_filename,
+                                                    &purge_cfg_dir,
+                                                    (void *) option));
+}
+
+
+/* end of disk.c */
diff --git a/src/lib/util/disk.h b/src/lib/util/disk.h
new file mode 100644
index 000000000..bca398e26
--- /dev/null
+++ b/src/lib/util/disk.h
@@ -0,0 +1,44 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/disk.h
+ * @brief Internal DISK related helper functions
+ * @author Nils Durner
+ */
+#ifndef GNUNET_DISK_H_
+#define GNUNET_DISK_H_
+
+#include "gnunet_util_lib.h"
+
+/**
+ * Retrieve OS file handle
+ *
+ * @internal
+ * @param fh GNUnet file descriptor
+ * @param dst destination buffer
+ * @param dst_len length of @a dst
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+int
+GNUNET_DISK_internal_file_handle_ (const struct GNUNET_DISK_FileHandle *fh,
+                                   void *dst, size_t dst_len);
+
+#endif /* GNUNET_DISK_H_ */
diff --git a/src/lib/util/dnsparser.c b/src/lib/util/dnsparser.c
new file mode 100644
index 000000000..93b2b590b
--- /dev/null
+++ b/src/lib/util/dnsparser.c
@@ -0,0 +1,1535 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2010-2014, 2018 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/dnsparser.c
+ * @brief helper library to parse DNS packets.
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#if HAVE_LIBIDN2
+#if HAVE_IDN2_H
+#include <idn2.h>
+#elif HAVE_IDN2_IDN2_H
+#include <idn2/idn2.h>
+#endif
+#elif HAVE_LIBIDN
+#if HAVE_IDNA_H
+#include <idna.h>
+#elif HAVE_IDN_IDNA_H
+#include <idn/idna.h>
+#endif
+#endif
+
+/**
+ * Check if a label in UTF-8 format can be coded into valid IDNA.
+ * This can fail if the ASCII-conversion becomes longer than 63 characters.
+ *
+ * @param label label to check (UTF-8 string)
+ * @return #GNUNET_OK if the label can be converted to IDNA,
+ *         #GNUNET_SYSERR if the label is not valid for DNS names
+ */
+int
+GNUNET_DNSPARSER_check_label (const char *label)
+{
+  char *output;
+  size_t slen;
+
+  if (NULL != strchr (label, '.'))
+    return GNUNET_SYSERR; /* not a label! Did you mean GNUNET_DNSPARSER_check_name? */
+  if (0 == strcmp (label, "@")) /* '@' is reserved for the empty label, see #GNUNET_GNS_EMPTY_LABEL_AT */
+    return GNUNET_SYSERR;
+  if (IDNA_SUCCESS != idna_to_ascii_8z (label, &output, IDNA_ALLOW_UNASSIGNED))
+    return GNUNET_SYSERR;
+  slen = strlen (output);
+  free (output);
+  return (slen > 63) ? GNUNET_SYSERR : GNUNET_OK;
+}
+
+
+/**
+ * Check if a label in UTF-8 format can be coded into valid IDNA.
+ * This can fail if the ASCII-conversion becomes longer than 253 characters.
+ *
+ * @param name name to check (UTF-8 string)
+ * @return #GNUNET_OK if the label can be converted to IDNA,
+ *         #GNUNET_SYSERR if the label is not valid for DNS names
+ */
+int
+GNUNET_DNSPARSER_check_name (const char *name)
+{
+  char *ldup;
+  char *output;
+  size_t slen;
+  char *tok;
+
+  ldup = GNUNET_strdup (name);
+  for (tok = strtok (ldup, "."); NULL != tok; tok = strtok (NULL, "."))
+    if (GNUNET_OK != GNUNET_DNSPARSER_check_label (tok))
+    {
+      GNUNET_free (ldup);
+      return GNUNET_SYSERR;
+    }
+  GNUNET_free (ldup);
+  if (IDNA_SUCCESS != idna_to_ascii_8z (name, &output, IDNA_ALLOW_UNASSIGNED))
+    return GNUNET_SYSERR;
+  slen = strlen (output);
+  free (output);
+  return (slen > 253) ? GNUNET_SYSERR : GNUNET_OK;
+}
+
+
+/**
+ * Free SOA information record.
+ *
+ * @param soa record to free
+ */
+void
+GNUNET_DNSPARSER_free_soa (struct GNUNET_DNSPARSER_SoaRecord *soa)
+{
+  if (NULL == soa)
+    return;
+  GNUNET_free (soa->mname);
+  GNUNET_free (soa->rname);
+  GNUNET_free (soa);
+}
+
+
+/**
+ * Free CERT information record.
+ *
+ * @param cert record to free
+ */
+void
+GNUNET_DNSPARSER_free_cert (struct GNUNET_DNSPARSER_CertRecord *cert)
+{
+  if (NULL == cert)
+    return;
+  GNUNET_free (cert->certificate_data);
+  GNUNET_free (cert);
+}
+
+
+/**
+ * Free SRV information record.
+ *
+ * @param srv record to free
+ */
+void
+GNUNET_DNSPARSER_free_srv (struct GNUNET_DNSPARSER_SrvRecord *srv)
+{
+  if (NULL == srv)
+    return;
+  GNUNET_free (srv->target);
+  GNUNET_free (srv);
+}
+
+
+/**
+ * Free URI information record.
+ *
+ * @param uri record to free
+ */
+void
+GNUNET_DNSPARSER_free_uri (struct GNUNET_DNSPARSER_UriRecord *uri)
+{
+  if (NULL == uri)
+    return;
+  GNUNET_free (uri->target);
+  GNUNET_free (uri);
+}
+
+
+/**
+ * Free MX information record.
+ *
+ * @param mx record to free
+ */
+void
+GNUNET_DNSPARSER_free_mx (struct GNUNET_DNSPARSER_MxRecord *mx)
+{
+  if (NULL == mx)
+    return;
+  GNUNET_free (mx->mxhost);
+  GNUNET_free (mx);
+}
+
+
+/**
+ * Free the given DNS record.
+ *
+ * @param r record to free
+ */
+void
+GNUNET_DNSPARSER_free_record (struct GNUNET_DNSPARSER_Record *r)
+{
+  GNUNET_free (r->name);
+  switch (r->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_MX:
+    GNUNET_DNSPARSER_free_mx (r->data.mx);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    GNUNET_DNSPARSER_free_soa (r->data.soa);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    GNUNET_DNSPARSER_free_srv (r->data.srv);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_URI:
+    GNUNET_DNSPARSER_free_uri (r->data.uri);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_CERT:
+    GNUNET_DNSPARSER_free_cert (r->data.cert);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    GNUNET_free (r->data.hostname);
+    break;
+
+  default:
+    GNUNET_free (r->data.raw.data);
+    break;
+  }
+}
+
+
+/**
+ * Parse name inside of a DNS query or record.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the name to parse in the udp_payload (to be
+ *                    incremented by the size of the name)
+ * @param depth current depth of our recursion (to prevent stack overflow)
+ * @return name as 0-terminated C string on success, NULL if the payload is malformed
+ */
+static char *
+parse_name (const char *udp_payload,
+            size_t udp_payload_length,
+            size_t *off,
+            unsigned int depth)
+{
+  const uint8_t *input = (const uint8_t *) udp_payload;
+  char *ret;
+  char *tmp;
+  char *xstr;
+  uint8_t len;
+  size_t xoff;
+  char *utf8;
+  Idna_rc rc;
+
+  ret = GNUNET_strdup ("");
+  while (1)
+  {
+    if (*off >= udp_payload_length)
+    {
+      GNUNET_break_op (0);
+      goto error;
+    }
+    len = input[*off];
+    if (0 == len)
+    {
+      (*off)++;
+      break;
+    }
+    if (len < 64)
+    {
+      if (*off + 1 + len > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      GNUNET_asprintf (&tmp, "%.*s", (int) len, &udp_payload[*off + 1]);
+      if (IDNA_SUCCESS !=
+          (rc = idna_to_unicode_8z8z (tmp, &utf8, IDNA_ALLOW_UNASSIGNED)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    _ ("Failed to convert DNS IDNA name `%s' to UTF-8: %s\n"),
+                    tmp,
+                    idna_strerror (rc));
+        GNUNET_free (tmp);
+        GNUNET_asprintf (&tmp,
+                         "%s%.*s.",
+                         ret,
+                         (int) len,
+                         &udp_payload[*off + 1]);
+      }
+      else
+      {
+        GNUNET_free (tmp);
+        GNUNET_asprintf (&tmp, "%s%s.", ret, utf8);
+        free (utf8);
+      }
+      GNUNET_free (ret);
+      ret = tmp;
+      *off += 1 + len;
+    }
+    else if ((64 | 128) == (len & (64 | 128)))
+    {
+      if (depth > 32)
+      {
+        GNUNET_break_op (0);
+        goto error;       /* hard bound on stack to prevent "infinite" recursion, disallow! */
+      }
+      /* pointer to string */
+      if (*off + 1 > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      xoff = ((len - (64 | 128)) << 8) + input[*off + 1];
+      xstr = parse_name (udp_payload, udp_payload_length, &xoff, depth + 1);
+      if (NULL == xstr)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      GNUNET_asprintf (&tmp, "%s%s.", ret, xstr);
+      GNUNET_free (ret);
+      GNUNET_free (xstr);
+      ret = tmp;
+      if (strlen (ret) > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error;       /* we are looping (building an infinite string) */
+      }
+      *off += 2;
+      /* pointers always terminate names */
+      break;
+    }
+    else
+    {
+      /* neither pointer nor inline string, not supported... */
+      GNUNET_break_op (0);
+      goto error;
+    }
+  }
+  if (0 < strlen (ret))
+    ret[strlen (ret) - 1] = '\0'; /* eat tailing '.' */
+  return ret;
+error:
+  GNUNET_break_op (0);
+  GNUNET_free (ret);
+  return NULL;
+}
+
+
+/**
+ * Parse name inside of a DNS query or record.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the name to parse in the udp_payload (to be
+ *                    incremented by the size of the name)
+ * @return name as 0-terminated C string on success, NULL if the payload is malformed
+ */
+char *
+GNUNET_DNSPARSER_parse_name (const char *udp_payload,
+                             size_t udp_payload_length,
+                             size_t *off)
+{
+  return parse_name (udp_payload, udp_payload_length, off, 0);
+}
+
+
+/**
+ * Parse a DNS query entry.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the udp_payload (to be
+ *                    incremented by the size of the query)
+ * @param q where to write the query information
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the query is malformed
+ */
+int
+GNUNET_DNSPARSER_parse_query (const char *udp_payload,
+                              size_t udp_payload_length,
+                              size_t *off,
+                              struct GNUNET_DNSPARSER_Query *q)
+{
+  char *name;
+  struct GNUNET_TUN_DnsQueryLine ql;
+
+  name = GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  if (NULL == name)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  q->name = name;
+  if (*off + sizeof(struct GNUNET_TUN_DnsQueryLine) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&ql, &udp_payload[*off], sizeof(ql));
+  *off += sizeof(ql);
+  q->type = ntohs (ql.type);
+  q->dns_traffic_class = ntohs (ql.dns_traffic_class);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a DNS SOA record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the SOA record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed SOA record, NULL on error
+ */
+struct GNUNET_DNSPARSER_SoaRecord *
+GNUNET_DNSPARSER_parse_soa (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off)
+{
+  struct GNUNET_DNSPARSER_SoaRecord *soa;
+  struct GNUNET_TUN_DnsSoaRecord soa_bin;
+  size_t old_off;
+
+  old_off = *off;
+  soa = GNUNET_new (struct GNUNET_DNSPARSER_SoaRecord);
+  soa->mname =
+    GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  soa->rname =
+    GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  if ((NULL == soa->mname) || (NULL == soa->rname) ||
+      (*off + sizeof(struct GNUNET_TUN_DnsSoaRecord) > udp_payload_length))
+  {
+    GNUNET_break_op (0);
+    GNUNET_DNSPARSER_free_soa (soa);
+    *off = old_off;
+    return NULL;
+  }
+  GNUNET_memcpy (&soa_bin,
+                 &udp_payload[*off],
+                 sizeof(struct GNUNET_TUN_DnsSoaRecord));
+  soa->serial = ntohl (soa_bin.serial);
+  soa->refresh = ntohl (soa_bin.refresh);
+  soa->retry = ntohl (soa_bin.retry);
+  soa->expire = ntohl (soa_bin.expire);
+  soa->minimum_ttl = ntohl (soa_bin.minimum);
+  (*off) += sizeof(struct GNUNET_TUN_DnsSoaRecord);
+  return soa;
+}
+
+
+/**
+ * Parse a DNS MX record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the MX record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed MX record, NULL on error
+ */
+struct GNUNET_DNSPARSER_MxRecord *
+GNUNET_DNSPARSER_parse_mx (const char *udp_payload,
+                           size_t udp_payload_length,
+                           size_t *off)
+{
+  struct GNUNET_DNSPARSER_MxRecord *mx;
+  uint16_t mxpref;
+  size_t old_off;
+
+  old_off = *off;
+  if (*off + sizeof(uint16_t) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  GNUNET_memcpy (&mxpref, &udp_payload[*off], sizeof(uint16_t));
+  (*off) += sizeof(uint16_t);
+  mx = GNUNET_new (struct GNUNET_DNSPARSER_MxRecord);
+  mx->preference = ntohs (mxpref);
+  mx->mxhost =
+    GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  if (NULL == mx->mxhost)
+  {
+    GNUNET_break_op (0);
+    GNUNET_DNSPARSER_free_mx (mx);
+    *off = old_off;
+    return NULL;
+  }
+  return mx;
+}
+
+
+/**
+ * Parse a DNS SRV record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the SRV record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed SRV record, NULL on error
+ */
+struct GNUNET_DNSPARSER_SrvRecord *
+GNUNET_DNSPARSER_parse_srv (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off)
+{
+  struct GNUNET_DNSPARSER_SrvRecord *srv;
+  struct GNUNET_TUN_DnsSrvRecord srv_bin;
+  size_t old_off;
+
+  old_off = *off;
+  if (*off + sizeof(struct GNUNET_TUN_DnsSrvRecord) > udp_payload_length)
+    return NULL;
+  GNUNET_memcpy (&srv_bin,
+                 &udp_payload[*off],
+                 sizeof(struct GNUNET_TUN_DnsSrvRecord));
+  (*off) += sizeof(struct GNUNET_TUN_DnsSrvRecord);
+  srv = GNUNET_new (struct GNUNET_DNSPARSER_SrvRecord);
+  srv->priority = ntohs (srv_bin.prio);
+  srv->weight = ntohs (srv_bin.weight);
+  srv->port = ntohs (srv_bin.port);
+  srv->target =
+    GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  if (NULL == srv->target)
+  {
+    GNUNET_DNSPARSER_free_srv (srv);
+    *off = old_off;
+    return NULL;
+  }
+  return srv;
+}
+
+
+/**
+ * Parse a DNS URI record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the URI record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed URI record, NULL on error
+ */
+struct GNUNET_DNSPARSER_UriRecord *
+GNUNET_DNSPARSER_parse_uri (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off)
+{
+  struct GNUNET_DNSPARSER_UriRecord *uri;
+  struct GNUNET_TUN_DnsUriRecord uri_bin;
+  size_t old_off;
+
+  old_off = *off;
+  if (*off + sizeof(struct GNUNET_TUN_DnsUriRecord) > udp_payload_length)
+    return NULL;
+  GNUNET_memcpy (&uri_bin,
+                 &udp_payload[*off],
+                 sizeof(struct GNUNET_TUN_DnsUriRecord));
+  (*off) += sizeof(struct GNUNET_TUN_DnsUriRecord);
+  uri = GNUNET_new (struct GNUNET_DNSPARSER_UriRecord);
+  uri->priority = ntohs (uri_bin.prio);
+  uri->weight = ntohs (uri_bin.weight);
+  int max_len = udp_payload_length - sizeof(struct GNUNET_TUN_DnsUriRecord);
+  int len =  GNUNET_asprintf (&(uri->target), "%.*s", max_len,
+                              &udp_payload[*off]);
+  (*off) += len;
+  if (NULL == uri->target)
+  {
+    GNUNET_DNSPARSER_free_uri (uri);
+    *off = old_off;
+    return NULL;
+  }
+  return uri;
+}
+
+
+/**
+ * Parse a DNS CERT record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the CERT record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed CERT record, NULL on error
+ */
+struct GNUNET_DNSPARSER_CertRecord *
+GNUNET_DNSPARSER_parse_cert (const char *udp_payload,
+                             size_t udp_payload_length,
+                             size_t *off)
+{
+  struct GNUNET_DNSPARSER_CertRecord *cert;
+  struct GNUNET_TUN_DnsCertRecord dcert;
+
+  if (*off + sizeof(struct GNUNET_TUN_DnsCertRecord) >= udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  GNUNET_memcpy (&dcert,
+                 &udp_payload[*off],
+                 sizeof(struct GNUNET_TUN_DnsCertRecord));
+  (*off) += sizeof(struct GNUNET_TUN_DnsCertRecord);
+  cert = GNUNET_new (struct GNUNET_DNSPARSER_CertRecord);
+  cert->cert_type = ntohs (dcert.cert_type);
+  cert->cert_tag = ntohs (dcert.cert_tag);
+  cert->algorithm = dcert.algorithm;
+  cert->certificate_size = udp_payload_length - (*off);
+  cert->certificate_data = GNUNET_malloc (cert->certificate_size);
+  GNUNET_memcpy (cert->certificate_data,
+                 &udp_payload[*off],
+                 cert->certificate_size);
+  (*off) += cert->certificate_size;
+  return cert;
+}
+
+
+/**
+ * Parse a DNS record entry.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the record to parse in the udp_payload (to be
+ *                    incremented by the size of the record)
+ * @param r where to write the record information
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the record is malformed
+ */
+int
+GNUNET_DNSPARSER_parse_record (const char *udp_payload,
+                               size_t udp_payload_length,
+                               size_t *off,
+                               struct GNUNET_DNSPARSER_Record *r)
+{
+  char *name;
+  struct GNUNET_TUN_DnsRecordLine rl;
+  size_t old_off;
+  uint16_t data_len;
+
+  name = GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+  if (NULL == name)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  r->name = name;
+  if (*off + sizeof(struct GNUNET_TUN_DnsRecordLine) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&rl, &udp_payload[*off], sizeof(rl));
+  (*off) += sizeof(rl);
+  r->type = ntohs (rl.type);
+  r->dns_traffic_class = ntohs (rl.dns_traffic_class);
+  r->expiration_time = GNUNET_TIME_relative_to_absolute (
+    GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, ntohl (rl.ttl)));
+  data_len = ntohs (rl.data_len);
+  if (*off + data_len > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  old_off = *off;
+  switch (r->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_DNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    r->data.hostname =
+      GNUNET_DNSPARSER_parse_name (udp_payload, udp_payload_length, off);
+    if ((NULL == r->data.hostname) || (old_off + data_len != *off))
+      return GNUNET_SYSERR;
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    r->data.soa =
+      GNUNET_DNSPARSER_parse_soa (udp_payload, udp_payload_length, off);
+    if ((NULL == r->data.soa) || (old_off + data_len != *off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_MX:
+    r->data.mx =
+      GNUNET_DNSPARSER_parse_mx (udp_payload, udp_payload_length, off);
+    if ((NULL == r->data.mx) || (old_off + data_len != *off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    r->data.srv =
+      GNUNET_DNSPARSER_parse_srv (udp_payload, udp_payload_length, off);
+    if ((NULL == r->data.srv) || (old_off + data_len != *off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_URI:
+    r->data.uri =
+      GNUNET_DNSPARSER_parse_uri (udp_payload, udp_payload_length, off);
+    if ((NULL == r->data.uri) || (old_off + data_len != *off))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+
+  default:
+    r->data.raw.data = GNUNET_malloc (data_len);
+    r->data.raw.data_len = data_len;
+    GNUNET_memcpy (r->data.raw.data, &udp_payload[*off], data_len);
+    break;
+  }
+  (*off) += data_len;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a UDP payload of a DNS packet in to a nice struct for further
+ * processing and manipulation.
+ *
+ * @param udp_payload wire-format of the DNS packet
+ * @param udp_payload_length number of bytes in @a udp_payload
+ * @return NULL on error, otherwise the parsed packet
+ */
+struct GNUNET_DNSPARSER_Packet *
+GNUNET_DNSPARSER_parse (const char *udp_payload, size_t udp_payload_length)
+{
+  struct GNUNET_DNSPARSER_Packet *p;
+  const struct GNUNET_TUN_DnsHeader *dns;
+  size_t off;
+  unsigned int n;
+
+  if (udp_payload_length < sizeof(struct GNUNET_TUN_DnsHeader))
+    return NULL;
+  dns = (const struct GNUNET_TUN_DnsHeader *) udp_payload;
+  off = sizeof(struct GNUNET_TUN_DnsHeader);
+  p = GNUNET_new (struct GNUNET_DNSPARSER_Packet);
+  p->flags = dns->flags;
+  p->id = dns->id;
+  n = ntohs (dns->query_count);
+  if (n > 0)
+  {
+    p->queries = GNUNET_new_array (n, struct GNUNET_DNSPARSER_Query);
+    p->num_queries = n;
+    for (unsigned int i = 0; i < n; i++)
+      if (GNUNET_OK != GNUNET_DNSPARSER_parse_query (udp_payload,
+                                                     udp_payload_length,
+                                                     &off,
+                                                     &p->queries[i]))
+        goto error;
+  }
+  n = ntohs (dns->answer_rcount);
+  if (n > 0)
+  {
+    p->answers = GNUNET_new_array (n, struct GNUNET_DNSPARSER_Record);
+    p->num_answers = n;
+    for (unsigned int i = 0; i < n; i++)
+      if (GNUNET_OK != GNUNET_DNSPARSER_parse_record (udp_payload,
+                                                      udp_payload_length,
+                                                      &off,
+                                                      &p->answers[i]))
+        goto error;
+  }
+  n = ntohs (dns->authority_rcount);
+  if (n > 0)
+  {
+    p->authority_records = GNUNET_new_array (n, struct GNUNET_DNSPARSER_Record);
+    p->num_authority_records = n;
+    for (unsigned int i = 0; i < n; i++)
+      if (GNUNET_OK != GNUNET_DNSPARSER_parse_record (udp_payload,
+                                                      udp_payload_length,
+                                                      &off,
+                                                      &p->authority_records[i]))
+        goto error;
+  }
+  n = ntohs (dns->additional_rcount);
+  if (n > 0)
+  {
+    p->additional_records =
+      GNUNET_new_array (n, struct GNUNET_DNSPARSER_Record);
+    p->num_additional_records = n;
+    for (unsigned int i = 0; i < n; i++)
+    {
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_parse_record (udp_payload,
+                                         udp_payload_length,
+                                         &off,
+                                         &p->additional_records[i]))
+        goto error;
+    }
+  }
+  return p;
+error:
+  GNUNET_break_op (0);
+  GNUNET_DNSPARSER_free_packet (p);
+  return NULL;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_Record *
+GNUNET_DNSPARSER_duplicate_record (const struct GNUNET_DNSPARSER_Record *r)
+{
+  struct GNUNET_DNSPARSER_Record *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->name = GNUNET_strdup (r->name);
+  switch (r->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR: {
+      dup->data.hostname = GNUNET_strdup (r->data.hostname);
+      break;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SOA: {
+      dup->data.soa = GNUNET_DNSPARSER_duplicate_soa_record (r->data.soa);
+      break;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CERT: {
+      dup->data.cert = GNUNET_DNSPARSER_duplicate_cert_record (r->data.cert);
+      break;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_MX: {
+      dup->data.mx = GNUNET_DNSPARSER_duplicate_mx_record (r->data.mx);
+      break;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SRV: {
+      dup->data.srv = GNUNET_DNSPARSER_duplicate_srv_record (r->data.srv);
+      break;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_URI: {
+      dup->data.uri = GNUNET_DNSPARSER_duplicate_uri_record (r->data.uri);
+      break;
+    }
+
+  default: {
+      dup->data.raw.data = GNUNET_memdup (r->data.raw.data,
+                                          r->data.raw.data_len);
+    }
+  }
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_SoaRecord *
+GNUNET_DNSPARSER_duplicate_soa_record (
+  const struct GNUNET_DNSPARSER_SoaRecord *r)
+{
+  struct GNUNET_DNSPARSER_SoaRecord *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->mname = GNUNET_strdup (r->mname);
+  dup->rname = GNUNET_strdup (r->rname);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_CertRecord *
+GNUNET_DNSPARSER_duplicate_cert_record (
+  const struct GNUNET_DNSPARSER_CertRecord *r)
+{
+  struct GNUNET_DNSPARSER_CertRecord *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->certificate_data = GNUNET_strdup (r->certificate_data);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_MxRecord *
+GNUNET_DNSPARSER_duplicate_mx_record (const struct GNUNET_DNSPARSER_MxRecord *r)
+{
+  struct GNUNET_DNSPARSER_MxRecord *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->mxhost = GNUNET_strdup (r->mxhost);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_SrvRecord *
+GNUNET_DNSPARSER_duplicate_srv_record (
+  const struct GNUNET_DNSPARSER_SrvRecord *r)
+{
+  struct GNUNET_DNSPARSER_SrvRecord *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->target = GNUNET_strdup (r->target);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_UriRecord *
+GNUNET_DNSPARSER_duplicate_uri_record (
+  const struct GNUNET_DNSPARSER_UriRecord *r)
+{
+  struct GNUNET_DNSPARSER_UriRecord *dup = GNUNET_memdup (r, sizeof(*r));
+
+  dup->target = GNUNET_strdup (r->target);
+  return dup;
+}
+
+
+/**
+ * Free memory taken by a packet.
+ *
+ * @param p packet to free
+ */
+void
+GNUNET_DNSPARSER_free_packet (struct GNUNET_DNSPARSER_Packet *p)
+{
+  for (unsigned int i = 0; i < p->num_queries; i++)
+    GNUNET_free (p->queries[i].name);
+  GNUNET_free (p->queries);
+  for (unsigned int i = 0; i < p->num_answers; i++)
+    GNUNET_DNSPARSER_free_record (&p->answers[i]);
+  GNUNET_free (p->answers);
+  for (unsigned int i = 0; i < p->num_authority_records; i++)
+    GNUNET_DNSPARSER_free_record (&p->authority_records[i]);
+  GNUNET_free (p->authority_records);
+  for (unsigned int i = 0; i < p->num_additional_records; i++)
+    GNUNET_DNSPARSER_free_record (&p->additional_records[i]);
+  GNUNET_free (p->additional_records);
+  GNUNET_free (p);
+}
+
+
+/* ********************** DNS packet assembly code **************** */
+
+
+/**
+ * Add a DNS name to the UDP packet at the given location, converting
+ * the name to IDNA notation as necessary.
+ *
+ * @param dst where to write the name (UDP packet)
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the name (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param name name to write
+ * @return #GNUNET_SYSERR if @a name is invalid
+ *         #GNUNET_NO if @a name did not fit
+ *         #GNUNET_OK if @a name was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_name (char *dst,
+                                   size_t dst_len,
+                                   size_t *off,
+                                   const char *name)
+{
+  const char *dot;
+  const char *idna_name;
+  char *idna_start;
+  size_t start;
+  size_t pos;
+  size_t len;
+  Idna_rc rc;
+
+  if (NULL == name)
+    return GNUNET_SYSERR;
+
+  if (IDNA_SUCCESS !=
+      (rc = idna_to_ascii_8z (name, &idna_start, IDNA_ALLOW_UNASSIGNED)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ (
+                  "Failed to convert UTF-8 name `%s' to DNS IDNA format: %s\n"),
+                name,
+                idna_strerror (rc));
+    return GNUNET_NO;
+  }
+  idna_name = idna_start;
+  start = *off;
+  if (start + strlen (idna_name) + 2 > dst_len)
+    goto fail;
+  pos = start;
+  do
+  {
+    dot = strchr (idna_name, '.');
+    if (NULL == dot)
+      len = strlen (idna_name);
+    else
+      len = dot - idna_name;
+    if (len == 0)
+      break;
+    if (len >= 64)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Invalid DNS name `%s': label with %u characters encountered\n",
+                  name,
+                  (unsigned int) len);
+      goto fail;     /* label too long or empty */
+    }
+    dst[pos++] = (char) (uint8_t) len;
+    GNUNET_memcpy (&dst[pos], idna_name, len);
+    pos += len;
+    idna_name += len + 1;   /* also skip dot */
+  }
+  while (NULL != dot);
+  dst[pos++] = '\0'; /* terminator */
+  *off = pos;
+  free (idna_start);
+  return GNUNET_OK;
+fail:
+  free (idna_start);
+  return GNUNET_NO;
+}
+
+
+/**
+ * Add a DNS query to the UDP packet at the given location.
+ *
+ * @param dst where to write the query
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the query (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param query query to write
+ * @return #GNUNET_SYSERR if @a query is invalid
+ *         #GNUNET_NO if @a query did not fit
+ *         #GNUNET_OK if @a query was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_query (char *dst,
+                                    size_t dst_len,
+                                    size_t *off,
+                                    const struct GNUNET_DNSPARSER_Query *query)
+{
+  int ret;
+  struct GNUNET_TUN_DnsQueryLine ql;
+
+  ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                           dst_len
+                                           - sizeof(
+                                             struct GNUNET_TUN_DnsQueryLine),
+                                           off,
+                                           query->name);
+  if (ret != GNUNET_OK)
+    return ret;
+  ql.type = htons (query->type);
+  ql.dns_traffic_class = htons (query->dns_traffic_class);
+  GNUNET_memcpy (&dst[*off], &ql, sizeof(ql));
+  (*off) += sizeof(ql);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an MX record to the UDP packet at the given location.
+ *
+ * @param dst where to write the mx record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the mx information (increment by bytes used);
+ *            can also change if there was an error
+ * @param mx mx information to write
+ * @return #GNUNET_SYSERR if @a mx is invalid
+ *         #GNUNET_NO if @a mx did not fit
+ *         #GNUNET_OK if @a mx was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_mx (char *dst,
+                                 size_t dst_len,
+                                 size_t *off,
+                                 const struct GNUNET_DNSPARSER_MxRecord *mx)
+{
+  uint16_t mxpref;
+
+  if (*off + sizeof(uint16_t) > dst_len)
+    return GNUNET_NO;
+  mxpref = htons (mx->preference);
+  GNUNET_memcpy (&dst[*off], &mxpref, sizeof(mxpref));
+  (*off) += sizeof(mxpref);
+  return GNUNET_DNSPARSER_builder_add_name (dst, dst_len, off, mx->mxhost);
+}
+
+
+/**
+ * Add a CERT record to the UDP packet at the given location.
+ *
+ * @param dst where to write the CERT record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the CERT information (increment by bytes used);
+ *            can also change if there was an error
+ * @param cert CERT information to write
+ * @return #GNUNET_SYSERR if @a cert is invalid
+ *         #GNUNET_NO if @a cert did not fit
+ *         #GNUNET_OK if @a cert was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_cert (
+  char *dst,
+  size_t dst_len,
+  size_t *off,
+  const struct GNUNET_DNSPARSER_CertRecord *cert)
+{
+  struct GNUNET_TUN_DnsCertRecord dcert;
+
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wtautological-constant-out-of-range-compare"
+#endif
+  if ((cert->cert_type > UINT16_MAX) || (cert->algorithm > UINT8_MAX))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+  if (*off + sizeof(struct GNUNET_TUN_DnsCertRecord) + cert->certificate_size >
+      dst_len)
+    return GNUNET_NO;
+  dcert.cert_type = htons ((uint16_t) cert->cert_type);
+  dcert.cert_tag = htons ((uint16_t) cert->cert_tag);
+  dcert.algorithm = (uint8_t) cert->algorithm;
+  GNUNET_memcpy (&dst[*off], &dcert, sizeof(dcert));
+  (*off) += sizeof(dcert);
+  GNUNET_memcpy (&dst[*off], cert->certificate_data, cert->certificate_size);
+  (*off) += cert->certificate_size;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an SOA record to the UDP packet at the given location.
+ *
+ * @param dst where to write the SOA record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the SOA information (increment by bytes used)
+ *            can also change if there was an error
+ * @param soa SOA information to write
+ * @return #GNUNET_SYSERR if @a soa is invalid
+ *         #GNUNET_NO if @a soa did not fit
+ *         #GNUNET_OK if @a soa was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_soa (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_SoaRecord *soa)
+{
+  struct GNUNET_TUN_DnsSoaRecord sd;
+  int ret;
+
+  if ((GNUNET_OK !=
+       (ret =
+          GNUNET_DNSPARSER_builder_add_name (dst, dst_len, off, soa->mname))) ||
+      (GNUNET_OK !=
+       (ret =
+          GNUNET_DNSPARSER_builder_add_name (dst, dst_len, off, soa->rname))))
+    return ret;
+  if (*off + sizeof(struct GNUNET_TUN_DnsSoaRecord) > dst_len)
+    return GNUNET_NO;
+  sd.serial = htonl (soa->serial);
+  sd.refresh = htonl (soa->refresh);
+  sd.retry = htonl (soa->retry);
+  sd.expire = htonl (soa->expire);
+  sd.minimum = htonl (soa->minimum_ttl);
+  GNUNET_memcpy (&dst[*off], &sd, sizeof(sd));
+  (*off) += sizeof(sd);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an SRV record to the UDP packet at the given location.
+ *
+ * @param dst where to write the SRV record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the SRV information (increment by bytes used)
+ *            can also change if there was an error
+ * @param srv SRV information to write
+ * @return #GNUNET_SYSERR if @a srv is invalid
+ *         #GNUNET_NO if @a srv did not fit
+ *         #GNUNET_OK if @a srv was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_srv (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_SrvRecord *srv)
+{
+  struct GNUNET_TUN_DnsSrvRecord sd;
+  int ret;
+
+  if (*off + sizeof(struct GNUNET_TUN_DnsSrvRecord) > dst_len)
+    return GNUNET_NO;
+  sd.prio = htons (srv->priority);
+  sd.weight = htons (srv->weight);
+  sd.port = htons (srv->port);
+  GNUNET_memcpy (&dst[*off], &sd, sizeof(sd));
+  (*off) += sizeof(sd);
+  if (GNUNET_OK !=
+      (ret =
+         GNUNET_DNSPARSER_builder_add_name (dst, dst_len, off, srv->target)))
+    return ret;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an URI record to the UDP packet at the given location.
+ *
+ * @param dst where to write the URI record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the URI information (increment by bytes used)
+ *            can also change if there was an error
+ * @param uri URI information to write
+ * @return #GNUNET_SYSERR if @a uri is invalid
+ *         #GNUNET_NO if @a uri did not fit
+ *         #GNUNET_OK if @a uri was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_uri (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_UriRecord *uri)
+{
+  struct GNUNET_TUN_DnsUriRecord sd;
+
+  if (*off + sizeof(struct GNUNET_TUN_DnsUriRecord) > dst_len)
+    return GNUNET_NO;
+  sd.prio = htons (uri->priority);
+  sd.weight = htons (uri->weight);
+  GNUNET_memcpy (&dst[*off], &sd, sizeof(sd));
+  (*off) += sizeof(sd);
+  strncpy (&dst[*off], uri->target, dst_len - sizeof(struct
+                                                     GNUNET_TUN_DnsUriRecord)
+           - 1);
+  (*off) += strlen (uri->target);
+  dst[*off] = '\0';
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add a DNS record to the UDP packet at the given location.
+ *
+ * @param dst where to write the query
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the query (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param record record to write
+ * @return #GNUNET_SYSERR if @a record is invalid
+ *         #GNUNET_NO if @a record did not fit
+ *         #GNUNET_OK if @a record was added to @a dst
+ */
+static int
+add_record (char *dst,
+            size_t dst_len,
+            size_t *off,
+            const struct GNUNET_DNSPARSER_Record *record)
+{
+  int ret;
+  size_t start;
+  size_t pos;
+  struct GNUNET_TUN_DnsRecordLine rl;
+
+  start = *off;
+  ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                           dst_len
+                                           - sizeof(
+                                             struct GNUNET_TUN_DnsRecordLine),
+                                           off,
+                                           record->name);
+  if (GNUNET_OK != ret)
+    return ret;
+  /* '*off' is now the position where we will need to write the record line */
+
+  pos = *off + sizeof(struct GNUNET_TUN_DnsRecordLine);
+  switch (record->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_MX:
+    ret = GNUNET_DNSPARSER_builder_add_mx (dst, dst_len, &pos, record->data.mx);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_CERT:
+    ret =
+      GNUNET_DNSPARSER_builder_add_cert (dst, dst_len, &pos, record->data.cert);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    ret =
+      GNUNET_DNSPARSER_builder_add_soa (dst, dst_len, &pos, record->data.soa);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                             dst_len,
+                                             &pos,
+                                             record->data.hostname);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    ret =
+      GNUNET_DNSPARSER_builder_add_srv (dst, dst_len, &pos, record->data.srv);
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_URI:
+    ret =
+      GNUNET_DNSPARSER_builder_add_uri (dst, dst_len, &pos, record->data.uri);
+    break;
+
+  default:
+    if (pos + record->data.raw.data_len > dst_len)
+    {
+      ret = GNUNET_NO;
+      break;
+    }
+    GNUNET_memcpy (&dst[pos], record->data.raw.data, record->data.raw.data_len);
+    pos += record->data.raw.data_len;
+    ret = GNUNET_OK;
+    break;
+  }
+  if (GNUNET_OK != ret)
+  {
+    *off = start;
+    return GNUNET_NO;
+  }
+
+  if (pos - (*off + sizeof(struct GNUNET_TUN_DnsRecordLine)) > UINT16_MAX)
+  {
+    /* record data too long */
+    *off = start;
+    return GNUNET_NO;
+  }
+  rl.type = htons (record->type);
+  rl.dns_traffic_class = htons (record->dns_traffic_class);
+  rl.ttl = htonl (
+    GNUNET_TIME_absolute_get_remaining (record->expiration_time).rel_value_us
+    / 1000LL / 1000LL); /* in seconds */
+  rl.data_len = htons (
+    (uint16_t) (pos - (*off + sizeof(struct GNUNET_TUN_DnsRecordLine))));
+  GNUNET_memcpy (&dst[*off], &rl, sizeof(struct GNUNET_TUN_DnsRecordLine));
+  *off = pos;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Given a DNS packet @a p, generate the corresponding UDP payload.
+ * Note that we do not attempt to pack the strings with pointers
+ * as this would complicate the code and this is about being
+ * simple and secure, not fast, fancy and broken like bind.
+ *
+ * @param p packet to pack
+ * @param max maximum allowed size for the resulting UDP payload
+ * @param buf set to a buffer with the packed message
+ * @param buf_length set to the length of @a buf
+ * @return #GNUNET_SYSERR if @a p is invalid
+ *         #GNUNET_NO if @a p was truncated (but there is still a result in @a buf)
+ *         #GNUNET_OK if @a p was packed completely into @a buf
+ */
+int
+GNUNET_DNSPARSER_pack (const struct GNUNET_DNSPARSER_Packet *p,
+                       uint16_t max,
+                       char **buf,
+                       size_t *buf_length)
+{
+  struct GNUNET_TUN_DnsHeader dns;
+  size_t off;
+  char tmp[max];
+  int ret;
+  int trc;
+
+  if ((p->num_queries > UINT16_MAX) || (p->num_answers > UINT16_MAX) ||
+      (p->num_authority_records > UINT16_MAX) ||
+      (p->num_additional_records > UINT16_MAX))
+    return GNUNET_SYSERR;
+  dns.id = p->id;
+  dns.flags = p->flags;
+  dns.query_count = htons (p->num_queries);
+  dns.answer_rcount = htons (p->num_answers);
+  dns.authority_rcount = htons (p->num_authority_records);
+  dns.additional_rcount = htons (p->num_additional_records);
+
+  off = sizeof(struct GNUNET_TUN_DnsHeader);
+  trc = GNUNET_NO;
+  for (unsigned int i = 0; i < p->num_queries; i++)
+  {
+    ret = GNUNET_DNSPARSER_builder_add_query (tmp,
+                                              sizeof(tmp),
+                                              &off,
+                                              &p->queries[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.query_count = htons ((uint16_t) (i - 1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i = 0; i < p->num_answers; i++)
+  {
+    ret = add_record (tmp, sizeof(tmp), &off, &p->answers[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.answer_rcount = htons ((uint16_t) (i - 1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i = 0; i < p->num_authority_records; i++)
+  {
+    ret = add_record (tmp, sizeof(tmp), &off, &p->authority_records[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.authority_rcount = htons ((uint16_t) (i - 1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i = 0; i < p->num_additional_records; i++)
+  {
+    ret = add_record (tmp, sizeof(tmp), &off, &p->additional_records[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.additional_rcount = htons (i - 1);
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+
+  if (GNUNET_YES == trc)
+    dns.flags.message_truncated = 1;
+  GNUNET_memcpy (tmp, &dns, sizeof(struct GNUNET_TUN_DnsHeader));
+
+  *buf = GNUNET_malloc (off);
+  *buf_length = off;
+  GNUNET_memcpy (*buf, tmp, off);
+  if (GNUNET_YES == trc)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Convert a block of binary data to HEX.
+ *
+ * @param data binary data to convert
+ * @param data_size number of bytes in @a data
+ * @return HEX string (lower case)
+ */
+char *
+GNUNET_DNSPARSER_bin_to_hex (const void *data, size_t data_size)
+{
+  char *ret;
+  size_t off;
+  const uint8_t *idata;
+
+  idata = data;
+  ret = GNUNET_malloc (data_size * 2 + 1);
+  for (off = 0; off < data_size; off++)
+    sprintf (&ret[off * 2], "%02x", idata[off]);
+  return ret;
+}
+
+
+/**
+ * Convert a HEX string to block of binary data.
+ *
+ * @param hex HEX string to convert (may contain mixed case)
+ * @param data where to write result, must be
+ *             at least `strlen(hex)/2` bytes long
+ * @return number of bytes written to data
+ */
+size_t
+GNUNET_DNSPARSER_hex_to_bin (const char *hex, void *data)
+{
+  size_t data_size;
+  size_t off;
+  uint8_t *idata;
+  unsigned int h;
+  char in[3];
+
+  data_size = strlen (hex) / 2;
+  idata = data;
+  in[2] = '\0';
+  for (off = 0; off < data_size; off++)
+  {
+    in[0] = tolower ((unsigned char) hex[off * 2]);
+    in[1] = tolower ((unsigned char) hex[off * 2 + 1]);
+    if (1 != sscanf (in, "%x", &h))
+      return off;
+    idata[off] = (uint8_t) h;
+  }
+  return off;
+}
+
+
+/* end of dnsparser.c */
diff --git a/src/lib/util/dnsstub.c b/src/lib/util/dnsstub.c
new file mode 100644
index 000000000..c259b51dd
--- /dev/null
+++ b/src/lib/util/dnsstub.c
@@ -0,0 +1,721 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file dns/dnsstub.c
+ * @brief DNS stub resolver which sends DNS requests to an actual resolver
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Timeout for retrying DNS queries.
+ */
+#define DNS_RETRANSMIT_DELAY \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 250)
+
+
+/**
+ * DNS Server used for resolution.
+ */
+struct DnsServer;
+
+
+/**
+ * UDP socket we are using for sending DNS requests to the Internet.
+ */
+struct GNUNET_DNSSTUB_RequestSocket
+{
+  /**
+   * UDP socket we use for this request for IPv4
+   */
+  struct GNUNET_NETWORK_Handle *dnsout4;
+
+  /**
+   * UDP socket we use for this request for IPv6
+   */
+  struct GNUNET_NETWORK_Handle *dnsout6;
+
+  /**
+   * Function to call with result.
+   */
+  GNUNET_DNSSTUB_ResultCallback rc;
+
+  /**
+   * Closure for @e rc.
+   */
+  void *rc_cls;
+
+  /**
+   * Task for reading from dnsout4 and dnsout6.
+   */
+  struct GNUNET_SCHEDULER_Task *read_task;
+
+  /**
+   * Task for retrying transmission of the query.
+   */
+  struct GNUNET_SCHEDULER_Task *retry_task;
+
+  /**
+   * Next address we sent the DNS request to.
+   */
+  struct DnsServer *ds_pos;
+
+  /**
+   * Context this request executes in.
+   */
+  struct GNUNET_DNSSTUB_Context *ctx;
+
+  /**
+   * Query we sent to @e addr.
+   */
+  void *request;
+
+  /**
+   * Number of bytes in @a request.
+   */
+  size_t request_len;
+};
+
+
+/**
+ * DNS Server used for resolution.
+ */
+struct DnsServer
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *prev;
+
+  /**
+   * IP address of the DNS resolver.
+   */
+  struct sockaddr_storage ss;
+};
+
+
+/**
+ * Handle to the stub resolver.
+ */
+struct GNUNET_DNSSTUB_Context
+{
+  /**
+   * Array of all open sockets for DNS requests.
+   */
+  struct GNUNET_DNSSTUB_RequestSocket *sockets;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_head;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_tail;
+
+  /**
+   * How frequently do we retry requests?
+   */
+  struct GNUNET_TIME_Relative retry_freq;
+
+  /**
+   * Length of @e sockets array.
+   */
+  unsigned int num_sockets;
+};
+
+
+/**
+ * We're done with a `struct GNUNET_DNSSTUB_RequestSocket`, close it for now.
+ *
+ * @param rs request socket to clean up
+ */
+static void
+cleanup_rs (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  if (NULL != rs->dnsout4)
+  {
+    GNUNET_NETWORK_socket_close (rs->dnsout4);
+    rs->dnsout4 = NULL;
+  }
+  if (NULL != rs->dnsout6)
+  {
+    GNUNET_NETWORK_socket_close (rs->dnsout6);
+    rs->dnsout6 = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->request)
+  {
+    GNUNET_free (rs->request);
+    rs->request = NULL;
+  }
+}
+
+
+/**
+ * Open source port for sending DNS requests
+ *
+ * @param af AF_INET or AF_INET6
+ * @return #GNUNET_OK on success
+ */
+static struct GNUNET_NETWORK_Handle *
+open_socket (int af)
+{
+  struct sockaddr_in a4;
+  struct sockaddr_in6 a6;
+  struct sockaddr *sa;
+  socklen_t alen;
+  struct GNUNET_NETWORK_Handle *ret;
+
+  ret = GNUNET_NETWORK_socket_create (af, SOCK_DGRAM, 0);
+  if (NULL == ret)
+    return NULL;
+  switch (af)
+  {
+  case AF_INET:
+    memset (&a4, 0, alen = sizeof(struct sockaddr_in));
+    sa = (struct sockaddr *) &a4;
+    break;
+
+  case AF_INET6:
+    memset (&a6, 0, alen = sizeof(struct sockaddr_in6));
+    sa = (struct sockaddr *) &a6;
+    break;
+
+  default:
+    GNUNET_break (0);
+    GNUNET_NETWORK_socket_close (ret);
+    return NULL;
+  }
+  sa->sa_family = af;
+  if (GNUNET_OK != GNUNET_NETWORK_socket_bind (ret, sa, alen))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Could not bind to any port: %s\n"),
+                strerror (errno));
+    GNUNET_NETWORK_socket_close (ret);
+    return NULL;
+  }
+  return ret;
+}
+
+
+/**
+ * Get a socket of the specified address family to send out a
+ * UDP DNS request to the Internet.
+ *
+ * @param ctx the DNSSTUB context
+ * @return NULL on error
+ */
+static struct GNUNET_DNSSTUB_RequestSocket *
+get_request_socket (struct GNUNET_DNSSTUB_Context *ctx)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  for (unsigned int i = 0; i < 256; i++)
+  {
+    rs = &ctx->sockets[GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                                 ctx->num_sockets)];
+    if (NULL == rs->rc)
+      break;
+  }
+  if (NULL != rs->rc)
+  {
+    /* signal "failure" */
+    rs->rc (rs->rc_cls, NULL, 0);
+    rs->rc = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->request)
+  {
+    GNUNET_free (rs->request);
+    rs->request = NULL;
+  }
+  rs->ctx = ctx;
+  return rs;
+}
+
+
+/**
+ * Actually do the reading of a DNS packet from our UDP socket and see
+ * if we have a valid, matching, pending request.
+ *
+ * @param rs request socket with callback details
+ * @param dnsout socket to read from
+ * @return #GNUNET_OK on success, #GNUNET_NO on drop, #GNUNET_SYSERR on IO-errors (closed socket)
+ */
+static int
+do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
+             struct GNUNET_NETWORK_Handle *dnsout)
+{
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  ssize_t r;
+  int len;
+
+  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout), FIONREAD, &len))
+  {
+    /* conservative choice: */
+    len = UINT16_MAX;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Receiving %d byte DNS reply\n", len);
+  {
+    unsigned char buf[len] GNUNET_ALIGN;
+    int found;
+    struct sockaddr_storage addr;
+    socklen_t addrlen;
+    struct GNUNET_TUN_DnsHeader *dns;
+
+    addrlen = sizeof(addr);
+    memset (&addr, 0, sizeof(addr));
+    r = GNUNET_NETWORK_socket_recvfrom (dnsout,
+                                        buf,
+                                        sizeof(buf),
+                                        (struct sockaddr *) &addr,
+                                        &addrlen);
+    if (-1 == r)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "recvfrom");
+      GNUNET_NETWORK_socket_close (dnsout);
+      return GNUNET_SYSERR;
+    }
+    found = GNUNET_NO;
+    for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
+    {
+      if (ds->ss.ss_family != addr.ss_family)
+        continue;
+      if (addr.ss_family == AF_INET)
+      {
+        struct sockaddr_in *v4 = (struct sockaddr_in *) &addr;
+        struct sockaddr_in *ds_v4 = (struct sockaddr_in *) &ds->ss;
+
+
+        if ((0 == memcmp (&v4->sin_addr,
+                         &ds_v4->sin_addr,
+                         sizeof(struct sockaddr_in))) &&
+            (v4->sin_port == ds_v4->sin_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
+      }
+      else
+      {
+        struct sockaddr_in6 *v6 = (struct sockaddr_in6 *) &addr;
+        struct sockaddr_in6 *ds_v6 = (struct sockaddr_in6 *) &ds->ss;
+
+        if (0 == memcmp (&v6->sin6_addr,
+                         &ds_v6->sin6_addr,
+                         sizeof (v6->sin6_addr)) &&
+            (v6->sin6_port == ds_v6->sin6_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
+
+      }
+    }
+    if (GNUNET_NO == found)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Received DNS response from server we never asked (ignored)\n");
+
+      return GNUNET_NO;
+    }
+    if (sizeof(struct GNUNET_TUN_DnsHeader) > (size_t) r)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Received DNS response that is too small (%u bytes)\n"),
+                  (unsigned int) r);
+      return GNUNET_NO;
+    }
+    dns = (struct GNUNET_TUN_DnsHeader *) buf;
+    if (NULL == rs->rc)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Request timeout or cancelled; ignoring reply\n");
+      return GNUNET_NO;
+    }
+    rs->rc (rs->rc_cls, dns, r);
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls `struct GNUNET_DNSSTUB_RequestSocket` to read from
+ */
+static void
+read_response (void *cls);
+
+
+/**
+ * Schedule #read_response() task for @a rs.
+ *
+ * @param rs request to schedule read operation for
+ */
+static void
+schedule_read (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  struct GNUNET_NETWORK_FDSet *rset;
+
+  if (NULL != rs->read_task)
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+  rset = GNUNET_NETWORK_fdset_create ();
+  if (NULL != rs->dnsout4)
+    GNUNET_NETWORK_fdset_set (rset, rs->dnsout4);
+  if (NULL != rs->dnsout6)
+    GNUNET_NETWORK_fdset_set (rset, rs->dnsout6);
+  rs->read_task =
+    GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                 GNUNET_TIME_UNIT_FOREVER_REL,
+                                 rset,
+                                 NULL,
+                                 &read_response,
+                                 rs);
+  GNUNET_NETWORK_fdset_destroy (rset);
+}
+
+
+static void
+read_response (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  rs->read_task = NULL;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  /* read and process ready sockets */
+  if ((NULL != rs->dnsout4) &&
+      (GNUNET_NETWORK_fdset_isset (tc->read_ready, rs->dnsout4)) &&
+      (GNUNET_SYSERR == do_dns_read (rs, rs->dnsout4)))
+    rs->dnsout4 = NULL;
+  if ((NULL != rs->dnsout6) &&
+      (GNUNET_NETWORK_fdset_isset (tc->read_ready, rs->dnsout6)) &&
+      (GNUNET_SYSERR == do_dns_read (rs, rs->dnsout6)))
+    rs->dnsout6 = NULL;
+  /* re-schedule read task */
+  schedule_read (rs);
+}
+
+
+/**
+ * Task to (re)transmit the DNS query, possibly repeatedly until
+ * we succeed.
+ *
+ * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
+ */
+static void
+transmit_query (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  const struct sockaddr *sa;
+  socklen_t salen;
+  struct DnsServer *ds;
+  struct GNUNET_NETWORK_Handle *dnsout;
+
+  rs->retry_task =
+    GNUNET_SCHEDULER_add_delayed (ctx->retry_freq, &transmit_query, rs);
+  ds = rs->ds_pos;
+  rs->ds_pos = ds->next;
+  if (NULL == rs->ds_pos)
+    rs->ds_pos = ctx->dns_head;
+  GNUNET_assert (NULL != ds);
+  dnsout = NULL;
+  switch (ds->ss.ss_family)
+  {
+  case AF_INET:
+    if (NULL == rs->dnsout4)
+      rs->dnsout4 = open_socket (AF_INET);
+    dnsout = rs->dnsout4;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof(struct sockaddr_in);
+    break;
+
+  case AF_INET6:
+    if (NULL == rs->dnsout6)
+      rs->dnsout6 = open_socket (AF_INET6);
+    dnsout = rs->dnsout6;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof(struct sockaddr_in6);
+    break;
+
+  default:
+    return;
+  }
+  if (NULL == dnsout)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to use configure DNS server, skipping\n");
+    return;
+  }
+  if (GNUNET_SYSERR == GNUNET_NETWORK_socket_sendto (dnsout,
+                                                     rs->request,
+                                                     rs->request_len,
+                                                     sa,
+                                                     salen))
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Failed to send DNS request to %s: %s\n"),
+                GNUNET_a2s (sa, salen),
+                strerror (errno));
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                _ ("Sent DNS request to %s\n"),
+                GNUNET_a2s (sa, salen));
+  schedule_read (rs);
+}
+
+
+/**
+ * Perform DNS resolution using our default IP from init.
+ *
+ * @param ctx stub resolver to use
+ * @param request DNS request to transmit
+ * @param request_len number of bytes in msg
+ * @param rc function to call with result
+ * @param rc_cls closure for 'rc'
+ * @return socket used for the request, NULL on error
+ */
+struct GNUNET_DNSSTUB_RequestSocket *
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                        const void *request,
+                        size_t request_len,
+                        GNUNET_DNSSTUB_ResultCallback rc,
+                        void *rc_cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  if (NULL == ctx->dns_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DNS server configured for resolution\n");
+    return NULL;
+  }
+  if (NULL == (rs = get_request_socket (ctx)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No request socket available for DNS resolution\n");
+    return NULL;
+  }
+  rs->ds_pos = ctx->dns_head;
+  rs->rc = rc;
+  rs->rc_cls = rc_cls;
+  rs->request = GNUNET_memdup (request, request_len);
+  rs->request_len = request_len;
+  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query, rs);
+  return rs;
+}
+
+
+/**
+ * Cancel DNS resolution.
+ *
+ * @param rs resolution to cancel
+ */
+void
+GNUNET_DNSSTUB_resolve_cancel (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  rs->rc = NULL;
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+}
+
+
+/**
+ * Start a DNS stub resolver.
+ *
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
+ * @return NULL on error
+ */
+struct GNUNET_DNSSTUB_Context *
+GNUNET_DNSSTUB_start (unsigned int num_sockets)
+{
+  struct GNUNET_DNSSTUB_Context *ctx;
+
+  if (0 == num_sockets)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  ctx = GNUNET_new (struct GNUNET_DNSSTUB_Context);
+  ctx->num_sockets = num_sockets;
+  ctx->sockets =
+    GNUNET_new_array (num_sockets, struct GNUNET_DNSSTUB_RequestSocket);
+  ctx->retry_freq = DNS_RETRANSMIT_DELAY;
+  return ctx;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip)
+{
+  struct DnsServer *ds;
+  struct in_addr i4;
+  struct in6_addr i6;
+
+  ds = GNUNET_new (struct DnsServer);
+  if (1 == inet_pton (AF_INET, dns_ip, &i4))
+  {
+    struct sockaddr_in *s4 = (struct sockaddr_in *) &ds->ss;
+
+    s4->sin_family = AF_INET;
+    s4->sin_port = htons (53);
+    s4->sin_addr = i4;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s4->sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+  }
+  else if (1 == inet_pton (AF_INET6, dns_ip, &i6))
+  {
+    struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) &ds->ss;
+
+    s6->sin6_family = AF_INET6;
+    s6->sin6_port = htons (53);
+    s6->sin6_addr = i6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s6->sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Malformed IP address `%s' for DNS server\n",
+                dns_ip);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head, ctx->dns_tail, ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa)
+{
+  struct DnsServer *ds;
+
+  ds = GNUNET_new (struct DnsServer);
+  switch (sa->sa_family)
+  {
+  case AF_INET :
+    GNUNET_memcpy (&ds->ss, sa, sizeof(struct sockaddr_in));
+    break;
+
+  case AF_INET6:
+    GNUNET_memcpy (&ds->ss, sa, sizeof(struct sockaddr_in6));
+    break;
+
+  default:
+    GNUNET_break (0);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head, ctx->dns_tail, ds);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq)
+{
+  ctx->retry_freq = retry_freq;
+}
+
+
+/**
+ * Cleanup DNSSTUB resolver.
+ *
+ * @param ctx stub resolver to clean up
+ */
+void
+GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx)
+{
+  struct DnsServer *ds;
+
+  while (NULL != (ds = ctx->dns_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (ctx->dns_head, ctx->dns_tail, ds);
+    GNUNET_free (ds);
+  }
+  for (unsigned int i = 0; i < ctx->num_sockets; i++)
+    cleanup_rs (&ctx->sockets[i]);
+  GNUNET_free (ctx->sockets);
+  GNUNET_free (ctx);
+}
+
+
+/* end of dnsstub.c */
diff --git a/src/lib/util/getopt.c b/src/lib/util/getopt.c
new file mode 100644
index 000000000..b1737bbc7
--- /dev/null
+++ b/src/lib/util/getopt.c
@@ -0,0 +1,1015 @@
+/* Getopt for GNU.
+   NOTE: getopt is now part of the C library, so if you don't know what
+   "Keep this file name-space clean" means, talk to roland@gnu.ai.mit.edu
+   before changing it!
+
+   Copyright (C) 1987, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97
+     Free Software Foundation, Inc.
+
+   NOTE: The canonical source of this file is maintained with the GNU C Library.
+   Bugs can be reported to bug-glibc@prep.ai.mit.edu.
+
+   This program is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by the
+   Free Software Foundation; either version 3, or (at your option) any
+   later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+   USA.
+
+
+   This code was heavily modified for GNUnet.
+   Copyright (C) 2006, 2017 Christian Grothoff
+ */
+
+/**
+ * @file util/getopt.c
+ * @brief GNU style option parsing
+ *
+ * TODO: get rid of statics (make reentrant) and
+ * replace main GNU getopt parser with one that
+ * actually fits our API.
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#ifdef VMS
+#include <unixlib.h>
+#if HAVE_STRING_H - 0
+#include <string.h>
+#endif
+#endif
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-getopt", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-getopt", syscall)
+
+#ifndef _
+/* This is for other GNU distributions with internationalized messages.
+   When compiling libc, the _ macro is predefined.  */
+#ifdef HAVE_LIBINTL_H
+#include <libintl.h>
+#define _(msgid) gettext (msgid)
+#else
+#define _(msgid) (msgid)
+#endif
+#endif
+
+/* Describe the long-named options requested by the application.
+   The LONG_OPTIONS argument to getopt_long or getopt_long_only is a vector
+   of `struct GNoption' terminated by an element containing a name which is
+   zero.
+
+   The field `has_arg' is:
+   no_argument          (or 0) if the option does not take an argument,
+   required_argument  (or 1) if the option requires an argument,
+   optional_argument   (or 2) if the option takes an optional argument.
+
+   If the field `flag' is not NULL, it points to a variable that is set
+   to the value given in the field `val' when the option is found, but
+   left unchanged if the option is not found.
+
+   To have a long-named option do something other than set an `int' to
+   a compiled-in constant, such as set a value from `GNoptarg', set the
+   option's `flag' field to zero and its `val' field to a nonzero
+   value (the equivalent single-letter option character, if there is
+   one).  For long options that have a zero `flag' field, `getopt'
+   returns the contents of the `val' field.  */
+
+struct GNoption
+{
+  const char *name;
+  /* has_arg can't be an enum because some compilers complain about
+   * type mismatches in all the code that assumes it is an int.  */
+  int has_arg;
+  int *flag;
+  int val;
+};
+
+
+/* This version of `getopt' appears to the caller like standard Unix `getopt'
+   but it behaves differently for the user, since it allows the user
+   to intersperse the options with the other arguments.
+
+   As `getopt' works, it permutes the elements of ARGV so that,
+   when it is done, all the options precede everything else.  Thus
+   all application programs are extended to handle flexible argument order.
+
+   Setting the environment variable POSIXLY_CORRECT disables permutation.
+   Then the behavior is completely standard.
+
+   GNU application programs can use a third alternative mode in which
+   they can distinguish the relative order of options and other arguments.  */
+
+/* For communication from `getopt' to the caller.
+   When `getopt' finds an option that takes an argument,
+   the argument value is returned here.
+   Also, when `ordering' is RETURN_IN_ORDER,
+   each non-option ARGV-element is returned here.  */
+
+static char *GNoptarg = NULL;
+
+/* Index in ARGV of the next element to be scanned.
+   This is used for communication to and from the caller
+   and for communication between successive calls to `getopt'.
+
+   On entry to `getopt', zero means this is the first call; initialize.
+
+   When `getopt' returns -1, this is the index of the first of the
+   non-option elements that the caller should itself scan.
+
+   Otherwise, `GNoptind' communicates from one call to the next
+   how much of ARGV has been scanned so far.  */
+
+/* 1003.2 says this must be 1 before any call.  */
+static int GNoptind = 1;
+
+/* The next char to be scanned in the option-element
+   in which the last option character we returned was found.
+   This allows us to pick up the scan where we left off.
+
+   If this is zero, or a null string, it means resume the scan
+   by advancing to the next ARGV-element.  */
+
+static char *nextchar;
+
+
+/* Describe how to deal with options that follow non-option ARGV-elements.
+
+   If the caller did not specify anything,
+   the default is REQUIRE_ORDER if the environment variable
+   POSIXLY_CORRECT is defined, PERMUTE otherwise.
+
+   REQUIRE_ORDER means don't recognize them as options;
+   stop option processing when the first non-option is seen.
+   This is what Unix does.
+   This mode of operation is selected by either setting the environment
+   variable POSIXLY_CORRECT, or using `+' as the first character
+   of the list of option characters.
+
+   PERMUTE is the default.  We GNUNET_CRYPTO_random_permute the contents of ARGV as we scan,
+   so that eventually all the non-options are at the end.  This allows options
+   to be given in any order, even with programs that were not written to
+   expect this.
+
+   RETURN_IN_ORDER is an option available to programs that were written
+   to expect GNoptions and other ARGV-elements in any order and that care about
+   the ordering of the two.  We describe each non-option ARGV-element
+   as if it were the argument of an option with character code 1.
+   Using `-' as the first character of the list of option characters
+   selects this mode of operation.
+
+   The special argument `--' forces an end of option-scanning regardless
+   of the value of `ordering'.  In the case of RETURN_IN_ORDER, only
+   `--' can cause `getopt' to return -1 with `GNoptind' != ARGC.  */
+
+static enum { REQUIRE_ORDER, PERMUTE, RETURN_IN_ORDER } ordering;
+
+/* Value of POSIXLY_CORRECT environment variable.  */
+static char *posixly_correct;
+
+#ifdef __GNU_LIBRARY__
+/* We want to avoid inclusion of string.h with non-GNU libraries
+   because there are many ways it can cause trouble.
+   On some systems, it contains special magic macros that don't work
+   in GCC.  */
+#include <string.h>
+#define my_index strchr
+#else
+
+/* Avoid depending on library functions or files
+   whose names are inconsistent.  */
+
+char *
+getenv ();
+
+static char *
+my_index (const char *str, int chr)
+{
+  while (*str)
+  {
+    if (*str == chr)
+      return (char *) str;
+    str++;
+  }
+  return 0;
+}
+
+
+/* If using GCC, we can safely declare strlen this way.
+   If not using GCC, it is ok not to declare it.  */
+#ifdef __GNUC__
+/* Note that Motorola Delta 68k R3V7 comes with GCC but not stddef.h.
+   That was relevant to code that was here before.  */
+#if ! defined(__STDC__) || ! __STDC__
+/* gcc with -traditional declares the built-in strlen to return int,
+   and has done so at least since version 2.4.5. -- rms.  */
+extern int
+strlen (const char *);
+
+#endif /* not __STDC__ */
+#endif /* __GNUC__ */
+
+#endif /* not __GNU_LIBRARY__ */
+
+/* Handle permutation of arguments.  */
+
+/* Describe the part of ARGV that contains non-options that have
+   been skipped.  `first_nonopt' is the index in ARGV of the first of them;
+   `last_nonopt' is the index after the last of them.  */
+
+static int first_nonopt;
+static int last_nonopt;
+
+#define SWAP_FLAGS(ch1, ch2)
+
+/* Exchange two adjacent subsequences of ARGV.
+   One subsequence is elements [first_nonopt,last_nonopt)
+   which contains all the non-options that have been skipped so far.
+   The other is elements [last_nonopt,GNoptind), which contains all
+   the options processed since those non-options were skipped.
+
+   `first_nonopt' and `last_nonopt' are relocated so that they describe
+   the new indices of the non-options in ARGV after they are moved.  */
+
+#if defined(__STDC__) && __STDC__
+static void
+exchange (char **);
+
+#endif
+
+static void
+exchange (char **argv)
+{
+  int bottom = first_nonopt;
+  int middle = last_nonopt;
+  int top = GNoptind;
+  char *tem;
+
+  /* Exchange the shorter segment with the far end of the longer segment.
+   * That puts the shorter segment into the right place.
+   * It leaves the longer segment in the right place overall,
+   * but it consists of two parts that need to be swapped next.  */
+
+  while (top > middle && middle > bottom)
+  {
+    if (top - middle > middle - bottom)
+    {
+      /* Bottom segment is the short one.  */
+      int len = middle - bottom;
+      register int i;
+
+      /* Swap it with the top part of the top segment.  */
+      for (i = 0; i < len; i++)
+      {
+        tem = argv[bottom + i];
+        argv[bottom + i] = argv[top - (middle - bottom) + i];
+        argv[top - (middle - bottom) + i] = tem;
+        SWAP_FLAGS (bottom + i, top - (middle - bottom) + i);
+      }
+      /* Exclude the moved bottom segment from further swapping.  */
+      top -= len;
+    }
+    else
+    {
+      /* Top segment is the short one.  */
+      int len = top - middle;
+      register int i;
+
+      /* Swap it with the bottom part of the bottom segment.  */
+      for (i = 0; i < len; i++)
+      {
+        tem = argv[bottom + i];
+        argv[bottom + i] = argv[middle + i];
+        argv[middle + i] = tem;
+        SWAP_FLAGS (bottom + i, middle + i);
+      }
+      /* Exclude the moved top segment from further swapping.  */
+      bottom += len;
+    }
+  }
+
+  /* Update records for the slots the non-options now occupy.  */
+
+  first_nonopt += (GNoptind - last_nonopt);
+  last_nonopt = GNoptind;
+}
+
+
+/* Initialize the internal data when the first call is made.  */
+
+#if defined(__STDC__) && __STDC__
+static const char *
+_getopt_initialize (int, char *const *, const char *);
+
+#endif
+static const char *
+_getopt_initialize (int argc, char *const *argv, const char *optstring)
+{
+  /* Start processing options with ARGV-element 1 (since ARGV-element 0
+   * is the program name); the sequence of previously skipped
+   * non-option ARGV-elements is empty.  */
+
+  first_nonopt = last_nonopt = GNoptind;
+
+  nextchar = NULL;
+
+  posixly_correct = getenv ("POSIXLY_CORRECT");
+
+  /* Determine how to handle the ordering of options and nonoptions.  */
+
+  if (optstring[0] == '-')
+  {
+    ordering = RETURN_IN_ORDER;
+    ++optstring;
+  }
+  else if (optstring[0] == '+')
+  {
+    ordering = REQUIRE_ORDER;
+    ++optstring;
+  }
+  else if (posixly_correct != NULL)
+    ordering = REQUIRE_ORDER;
+  else
+    ordering = PERMUTE;
+
+  return optstring;
+}
+
+
+/* Scan elements of ARGV (whose length is ARGC) for option characters
+   given in OPTSTRING.
+
+   If an element of ARGV starts with '-', and is not exactly "-" or "--",
+   then it is an option element.  The characters of this element
+   (aside from the initial '-') are option characters.  If `getopt'
+   is called repeatedly, it returns successively each of the option characters
+   from each of the option elements.
+
+   If `getopt' finds another option character, it returns that character,
+   updating `GNoptind' and `nextchar' so that the next call to `getopt' can
+   resume the scan with the following option character or ARGV-element.
+
+   If there are no more option characters, `getopt' returns -1.
+   Then `GNoptind' is the index in ARGV of the first ARGV-element
+   that is not an option.  (The ARGV-elements have been permuted
+   so that those that are not options now come last.)
+
+   OPTSTRING is a string containing the legitimate option characters.
+   If an option character is seen that is not listed in OPTSTRING,
+   return '?' after printing an error message.  If you set `GNopterr' to
+   zero, the error message is suppressed but we still return '?'.
+
+   If a char in OPTSTRING is followed by a colon, that means it wants an arg,
+   so the following text in the same ARGV-element, or the text of the following
+   ARGV-element, is returned in `GNoptarg'.  Two colons mean an option that
+   wants an optional arg; if there is text in the current ARGV-element,
+   it is returned in `GNoptarg', otherwise `GNoptarg' is set to zero.
+
+   If OPTSTRING starts with `-' or `+', it requests different methods of
+   handling the non-option ARGV-elements.
+   See the comments about RETURN_IN_ORDER and REQUIRE_ORDER, above.
+
+   Long-named options begin with `--' instead of `-'.
+   Their names may be abbreviated as long as the abbreviation is unique
+   or is an exact match for some defined option.  If they have an
+   argument, it follows the option name in the same ARGV-element, separated
+   from the option name by a `=', or else the in next ARGV-element.
+   When `getopt' finds a long-named option, it returns 0 if that option's
+   `flag' field is nonzero, the value of the option's `val' field
+   if the `flag' field is zero.
+
+   The elements of ARGV aren't really const, because we GNUNET_CRYPTO_random_permute them.
+   But we pretend they're const in the prototype to be compatible
+   with other systems.
+
+   LONGOPTS is a vector of `struct GNoption' terminated by an
+   element containing a name which is zero.
+
+   LONGIND returns the index in LONGOPT of the long-named option found.
+   It is only valid when a long-named option has been found by the most
+   recent call.
+
+   If LONG_ONLY is nonzero, '-' as well as '--' can introduce
+   long-named options.  */
+
+static int
+GN_getopt_internal (int argc,
+                    char *const *argv,
+                    const char *optstring,
+                    const struct GNoption *longopts,
+                    int *longind,
+                    int long_only)
+{
+  static int __getopt_initialized = 0;
+  static int GNopterr = 1;
+
+  GNoptarg = NULL;
+
+  if ((GNoptind == 0) || ! __getopt_initialized)
+  {
+    if (GNoptind == 0)
+      GNoptind = 1;   /* Don't scan ARGV[0], the program name.  */
+    optstring = _getopt_initialize (argc, argv, optstring);
+    __getopt_initialized = 1;
+  }
+
+  /* Test whether ARGV[GNoptind] points to a non-option argument.
+   * Either it does not have option syntax, or there is an environment flag
+   * from the shell indicating it is not an option.  The later information
+   * is only used when the used in the GNU libc.  */
+#define NONOPTION_P (argv[GNoptind][0] != '-' || argv[GNoptind][1] == '\0')
+
+  if ((nextchar == NULL) || (*nextchar == '\0'))
+  {
+    /* Advance to the next ARGV-element.  */
+
+    /* Give FIRST_NONOPT & LAST_NONOPT rational values if GNoptind has been
+    * moved back by the user (who may also have changed the arguments).  */
+    if (last_nonopt > GNoptind)
+      last_nonopt = GNoptind;
+    if (first_nonopt > GNoptind)
+      first_nonopt = GNoptind;
+
+    if (ordering == PERMUTE)
+    {
+      /* If we have just processed some options following some non-options,
+       * exchange them so that the options come first.  */
+
+      if ((first_nonopt != last_nonopt) && (last_nonopt != GNoptind) )
+        exchange ((char **) argv);
+      else if (last_nonopt != GNoptind)
+        first_nonopt = GNoptind;
+
+      /* Skip any additional non-options
+       * and extend the range of non-options previously skipped.  */
+
+      while (GNoptind < argc && NONOPTION_P)
+        GNoptind++;
+      last_nonopt = GNoptind;
+    }
+
+    /* The special ARGV-element `--' means premature end of options.
+     * Skip it like a null option,
+     * then exchange with previous non-options as if it were an option,
+     * then skip everything else like a non-option.  */
+    if ((GNoptind != argc) && ! strcmp (argv[GNoptind], "--"))
+    {
+      GNoptind++;
+
+      if ((first_nonopt != last_nonopt) && (last_nonopt != GNoptind) )
+        exchange ((char **) argv);
+      else if (first_nonopt == last_nonopt)
+        first_nonopt = GNoptind;
+      last_nonopt = argc;
+
+      GNoptind = argc;
+    }
+
+    /* If we have done all the ARGV-elements, stop the scan
+     * and back over any non-options that we skipped and permuted.  */
+
+    if (GNoptind == argc)
+    {
+      /* Set the next-arg-index to point at the non-options
+       * that we previously skipped, so the caller will digest them.  */
+      if (first_nonopt != last_nonopt)
+        GNoptind = first_nonopt;
+      return -1;
+    }
+
+    /* If we have come to a non-option and did not permute it,
+     * either stop the scan or describe it to the caller and pass it by.  */
+
+    if (NONOPTION_P)
+    {
+      if (ordering == REQUIRE_ORDER)
+        return -1;
+      GNoptarg = argv[GNoptind++];
+      return 1;
+    }
+
+    /* We have found another option-ARGV-element.
+     * Skip the initial punctuation.  */
+
+    nextchar =
+      (argv[GNoptind] + 1 + (longopts != NULL && argv[GNoptind][1] == '-'));
+  }
+
+  /* Decode the current option-ARGV-element.  */
+
+  /* Check whether the ARGV-element is a long option.
+   *
+   * If long_only and the ARGV-element has the form "-f", where f is
+   * a valid short option, don't consider it an abbreviated form of
+   * a long option that starts with f.  Otherwise there would be no
+   * way to give the -f short option.
+   *
+   * On the other hand, if there's a long option "fubar" and
+   * the ARGV-element is "-fu", do consider that an abbreviation of
+   * the long option, just like "--fu", and not "-f" with arg "u".
+   *
+   * This distinction seems to be the most useful approach.  */if ((longopts != NULL) &&
+      ((argv[GNoptind][1] == '-') ||
+       (long_only &&
+        (argv[GNoptind][2] || ! my_index (optstring, argv[GNoptind][1])))))
+  {
+    char *nameend;
+    const struct GNoption *p;
+    const struct GNoption *pfound = NULL;
+    int exact = 0;
+    int ambig = 0;
+    int indfound = -1;
+    int option_index;
+
+    for (nameend = nextchar; *nameend && *nameend != '='; nameend++)
+      /* Do nothing.  */;
+
+    /* Test all long options for either exact match
+     * or abbreviated matches.  */
+    for (p = longopts, option_index = 0; p->name; p++, option_index++)
+      if (! strncmp (p->name, nextchar, nameend - nextchar))
+      {
+        if ((unsigned int) (nameend - nextchar) ==
+            (unsigned int) strlen (p->name))
+        {
+          /* Exact match found.  */
+          pfound = p;
+          indfound = option_index;
+          exact = 1;
+          break;
+        }
+        else if (pfound == NULL)
+        {
+          /* First nonexact match found.  */
+          pfound = p;
+          indfound = option_index;
+        }
+        else
+          /* Second or later nonexact match found.  */
+          ambig = 1;
+      }
+
+    if (ambig && ! exact)
+    {
+      if (GNopterr)
+        fprintf (stderr,
+                 _ ("%s: option `%s' is ambiguous\n"),
+                 argv[0],
+                 argv[GNoptind]);
+      nextchar += strlen (nextchar);
+      GNoptind++;
+      return '?';
+    }
+
+    if (pfound != NULL)
+    {
+      option_index = indfound;
+      GNoptind++;
+      if (*nameend)
+      {
+        /* Don't test has_arg with >, because some C compilers don't
+         * allow it to be used on enums.  */
+        if (pfound->has_arg)
+          GNoptarg = nameend + 1;
+        else
+        {
+          if (GNopterr)
+          {
+            if (argv[GNoptind - 1][1] == '-')
+              /* --option */
+              fprintf (stderr,
+                       _ ("%s: option `--%s' does not allow an argument\n"),
+                       argv[0],
+                       pfound->name);
+            else
+              /* +option or -option */
+              fprintf (stderr,
+                       _ ("%s: option `%c%s' does not allow an argument\n"),
+                       argv[0],
+                       argv[GNoptind - 1][0],
+                       pfound->name);
+          }
+          nextchar += strlen (nextchar);
+          return '?';
+        }
+      }
+      else if (pfound->has_arg == 1)
+      {
+        if (GNoptind < argc)
+        {
+          GNoptarg = argv[GNoptind++];
+        }
+        else
+        {
+          if (GNopterr)
+          {
+            fprintf (stderr,
+                     _ ("%s: option `%s' requires an argument\n"),
+                     argv[0],
+                     argv[GNoptind - 1]);
+          }
+          nextchar += strlen (nextchar);
+          return (optstring[0] == ':') ? ':' : '?';
+        }
+      }
+      nextchar += strlen (nextchar);
+      if (longind != NULL)
+        *longind = option_index;
+      if (pfound->flag)
+      {
+        *(pfound->flag) = pfound->val;
+        return 0;
+      }
+      return pfound->val;
+    }
+
+    /* Can't find it as a long option.  If this is not getopt_long_only,
+     * or the option starts with '--' or is not a valid short
+     * option, then it's an error.
+     * Otherwise interpret it as a short option.  */
+    if (! long_only || (argv[GNoptind][1] == '-') ||
+        (my_index (optstring, *nextchar) == NULL) )
+    {
+      if (GNopterr)
+      {
+        if (argv[GNoptind][1] == '-')
+          /* --option */
+          fprintf (stderr,
+                   _ ("%s: unrecognized option `--%s'\n"),
+                   argv[0],
+                   nextchar);
+        else
+          /* +option or -option */
+          fprintf (stderr,
+                   _ ("%s: unrecognized option `%c%s'\n"),
+                   argv[0],
+                   argv[GNoptind][0],
+                   nextchar);
+      }
+      nextchar = (char *) "";
+      GNoptind++;
+      return '?';
+    }
+  }
+
+  /* Look at and handle the next short option-character.  */
+
+  {
+    char c = *nextchar++;
+    char *temp = my_index (optstring, c);
+
+    /* Increment `GNoptind' when we start to process its last character.  */
+    if (*nextchar == '\0')
+      ++GNoptind;
+
+    if ((temp == NULL) || (c == ':'))
+    {
+      if (GNopterr)
+      {
+        if (posixly_correct)
+          /* 1003.2 specifies the format of this message.  */
+          fprintf (stderr, _ ("%s: illegal option -- %c\n"), argv[0], c);
+        else
+          fprintf (stderr, _ ("%s: invalid option -- %c\n"), argv[0], c);
+      }
+      return '?';
+    }
+    /* Convenience. Treat POSIX -W foo same as long option --foo */
+    if ((temp[0] == 'W') && (temp[1] == ';'))
+    {
+      char *nameend;
+      const struct GNoption *p;
+      const struct GNoption *pfound = NULL;
+      int exact = 0;
+      int ambig = 0;
+      int indfound = 0;
+      int option_index;
+
+      /* This is an option that requires an argument.  */
+      if (*nextchar != '\0')
+      {
+        GNoptarg = nextchar;
+        /* If we end this ARGV-element by taking the rest as an arg,
+         * we must advance to the next element now.  */
+        GNoptind++;
+      }
+      else if (GNoptind == argc)
+      {
+        if (GNopterr)
+        {
+          /* 1003.2 specifies the format of this message.  */
+          fprintf (stderr,
+                   _ ("%s: option requires an argument -- %c\n"),
+                   argv[0],
+                   c);
+        }
+        if (optstring[0] == ':')
+          c = ':';
+        else
+          c = '?';
+        return c;
+      }
+      else
+        /* We already incremented `GNoptind' once;
+         * increment it again when taking next ARGV-elt as argument.  */
+        GNoptarg = argv[GNoptind++];
+
+      /* GNoptarg is now the argument, see if it's in the
+       * table of longopts.  */
+
+      for (nextchar = nameend = GNoptarg; *nameend && *nameend != '=';
+           nameend++)
+        /* Do nothing.  */;
+
+      /* Test all long options for either exact match
+       * or abbreviated matches.  */
+      if (longopts != NULL)
+        for (p = longopts, option_index = 0; p->name; p++, option_index++)
+          if (! strncmp (p->name, nextchar, nameend - nextchar))
+          {
+            if ((unsigned int) (nameend - nextchar) == strlen (p->name))
+            {
+              /* Exact match found.  */
+              pfound = p;
+              indfound = option_index;
+              exact = 1;
+              break;
+            }
+            else if (pfound == NULL)
+            {
+              /* First nonexact match found.  */
+              pfound = p;
+              indfound = option_index;
+            }
+            else
+              /* Second or later nonexact match found.  */
+              ambig = 1;
+          }
+      if (ambig && ! exact)
+      {
+        if (GNopterr)
+          fprintf (stderr,
+                   _ ("%s: option `-W %s' is ambiguous\n"),
+                   argv[0],
+                   argv[GNoptind]);
+        nextchar += strlen (nextchar);
+        GNoptind++;
+        return '?';
+      }
+      if (pfound != NULL)
+      {
+        option_index = indfound;
+        if (*nameend)
+        {
+          /* Don't test has_arg with >, because some C compilers don't
+           * allow it to be used on enums.  */
+          if (pfound->has_arg)
+            GNoptarg = nameend + 1;
+          else
+          {
+            if (GNopterr)
+              fprintf (stderr,
+                       _ ("%s: option `-W %s' does not allow an argument\n"),
+                       argv[0],
+                       pfound->name);
+
+            nextchar += strlen (nextchar);
+            return '?';
+          }
+        }
+        else if (pfound->has_arg == 1)
+        {
+          if (GNoptind < argc)
+            GNoptarg = argv[GNoptind++];
+          else
+          {
+            if (GNopterr)
+              fprintf (stderr,
+                       _ ("%s: option `%s' requires an argument\n"),
+                       argv[0],
+                       argv[GNoptind - 1]);
+            nextchar += strlen (nextchar);
+            return optstring[0] == ':' ? ':' : '?';
+          }
+        }
+        nextchar += strlen (nextchar);
+        if (longind != NULL)
+          *longind = option_index;
+        if (pfound->flag)
+        {
+          *(pfound->flag) = pfound->val;
+          return 0;
+        }
+        return pfound->val;
+      }
+      nextchar = NULL;
+      return 'W';   /* Let the application handle it.   */
+    }
+    if (temp[1] == ':')
+    {
+      if (temp[2] == ':')
+      {
+        /* This is an option that accepts an argument optionally.  */
+        if (*nextchar != '\0')
+        {
+          GNoptarg = nextchar;
+          GNoptind++;
+        }
+        else
+          GNoptarg = NULL;
+        nextchar = NULL;
+      }
+      else
+      {
+        /* This is an option that requires an argument.  */
+        if (*nextchar != '\0')
+        {
+          GNoptarg = nextchar;
+          /* If we end this ARGV-element by taking the rest as an arg,
+           * we must advance to the next element now.  */
+          GNoptind++;
+        }
+        else if (GNoptind == argc)
+        {
+          if (GNopterr)
+          {
+            /* 1003.2 specifies the format of this message.  */
+            fprintf (stderr,
+                     _ ("%s: option requires an argument -- %c\n"),
+                     argv[0],
+                     c);
+          }
+          if (optstring[0] == ':')
+            c = ':';
+          else
+            c = '?';
+        }
+        else
+          /* We already incremented `GNoptind' once;
+           * increment it again when taking next ARGV-elt as argument.  */
+          GNoptarg = argv[GNoptind++];
+        nextchar = NULL;
+      }
+    }
+    return c;
+  }
+}
+
+
+static int
+GNgetopt_long (int argc,
+               char *const *argv,
+               const char *options,
+               const struct GNoption *long_options,
+               int *opt_index)
+{
+  return GN_getopt_internal (argc, argv, options, long_options, opt_index, 0);
+}
+
+
+/* ******************** now the GNUnet specific modifications... ********************* */
+
+
+int
+GNUNET_GETOPT_run (const char *binaryOptions,
+                   const struct GNUNET_GETOPT_CommandLineOption *allOptions,
+                   unsigned int argc,
+                   char *const *argv)
+{
+  struct GNoption *long_options;
+  struct GNUNET_GETOPT_CommandLineProcessorContext clpc;
+  int count;
+  char *shorts;
+  int spos;
+  enum GNUNET_GenericReturnValue cont;
+  uint8_t *seen;
+  unsigned int optmatch = 0;
+  const char *have_exclusive = NULL;
+
+  GNUNET_assert (argc > 0);
+  GNoptind = 0;
+  clpc.binaryName = argv[0];
+  clpc.binaryOptions = binaryOptions;
+  clpc.allOptions = allOptions;
+  clpc.argv = argv;
+  clpc.argc = argc;
+  for (count = 0; NULL != allOptions[count].name; count++)
+    ;
+
+  /* transform our option representation into the format
+     used by the GNU getopt copylib */
+  long_options = GNUNET_new_array (count + 1, struct GNoption);
+  seen = GNUNET_new_array (count, uint8_t);
+  shorts = GNUNET_malloc (count * 2 + 1);
+  spos = 0;
+  for (unsigned i = 0; i < count; i++)
+  {
+    long_options[i].name = allOptions[i].name;
+    long_options[i].has_arg = allOptions[i].require_argument;
+    long_options[i].flag = NULL;
+    long_options[i].val = allOptions[i].shortName;
+    shorts[spos++] = allOptions[i].shortName;
+    if (allOptions[i].require_argument != 0)
+      shorts[spos++] = ':';
+  }
+  long_options[count].name = NULL;
+  long_options[count].has_arg = 0;
+  long_options[count].flag = NULL;
+  long_options[count].val = '\0';
+  shorts[spos] = '\0';
+  cont = GNUNET_OK;
+
+  /* main getopt loop */
+  while (1)
+  {
+    int option_index = 0;
+    unsigned int i;
+    int c;
+
+    c = GNgetopt_long (argc,
+                       argv,
+                       shorts,
+                       long_options,
+                       &option_index);
+    if (c == GNUNET_SYSERR)
+      break;   /* No more flags to process */
+
+    /* Check which of our program's options was given by the user */
+    for (i = 0; i < count; i++)
+    {
+      clpc.currentArgument = GNoptind - 1;
+      if ((char) c == allOptions[i].shortName)
+      {
+        optmatch++;
+        if (allOptions[i].option_exclusive)
+          have_exclusive = allOptions[i].name;
+        if (GNUNET_OK == cont)
+        {
+          /* parse the option using the option-specific processor */
+          cont = allOptions[i].processor (&clpc,
+                                          allOptions[i].scls,
+                                          allOptions[i].name,
+                                          GNoptarg);
+        }
+        seen[i] = 1;
+        break;
+      }
+    }
+    if (i == count)
+    {
+      fprintf (stderr,
+               _ ("Use %s to get a list of options.\n"),
+               "--help");
+      cont = GNUNET_SYSERR;
+    }
+  }
+  GNUNET_free (shorts);
+  GNUNET_free (long_options);
+
+  /* check that if any option that was marked as exclusive
+     is the only option that was provided */
+  if ((NULL != have_exclusive) && (optmatch > 1))
+  {
+    fprintf (stderr,
+             _ ("Option `%s' can't be used with other options.\n"),
+             have_exclusive);
+    cont = GNUNET_SYSERR;
+  }
+  if (GNUNET_YES == cont)
+  {
+    /* check that all mandatory options are present */
+    for (count = 0; NULL != allOptions[count].name; count++)
+    {
+      if ((0 == seen[count]) && (allOptions[count].option_mandatory))
+      {
+        fprintf (stderr,
+                 _ ("Missing mandatory option `%s'.\n"),
+                 allOptions[count].name);
+        cont = GNUNET_SYSERR;
+      }
+    }
+  }
+  GNUNET_free (seen);
+
+  /* call cleaners, if available */
+  for (unsigned int i = 0; NULL != allOptions[i].name; i++)
+    if (NULL != allOptions[i].cleaner)
+      allOptions[i].cleaner (allOptions[i].scls);
+
+  if (GNUNET_OK != cont)
+    return cont;
+  return GNoptind;
+}
+
+
+/* end of getopt.c */
diff --git a/src/lib/util/getopt_helpers.c b/src/lib/util/getopt_helpers.c
new file mode 100644
index 000000000..31020f185
--- /dev/null
+++ b/src/lib/util/getopt_helpers.c
@@ -0,0 +1,1017 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2006, 2011, 2020 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file src/util/getopt_helpers.c
+ * @brief implements command line that sets option
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-getopt", __VA_ARGS__)
+
+
+/**
+ * Print out program version (implements --version).
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (points to version string)
+ * @param option name of the option
+ * @param value not used (NULL)
+ * @return #GNUNET_NO (do not continue, not an error)
+ */
+static enum GNUNET_GenericReturnValue
+print_version (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+               void *scls,
+               const char *option,
+               const char *value)
+{
+  const char *version = scls;
+
+  (void) option;
+  (void) value;
+  printf ("%s v%s\n", ctx->binaryName, version);
+  return GNUNET_NO;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_version (const char *version)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'v',
+    .name = "version",
+    .description = gettext_noop (
+      "print the version number"),
+    .option_exclusive = 1,
+    .processor = &print_version,
+    .scls = (void *) version
+  };
+
+  return clo;
+}
+
+
+/**
+ * At what offset does the help text start?
+ */
+#define BORDER 29
+
+/**
+ * Print out details on command line options (implements --help).
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (points to about text)
+ * @param option name of the option
+ * @param value not used (NULL)
+ * @return #GNUNET_NO (do not continue, not an error)
+ */
+static enum GNUNET_GenericReturnValue
+format_help (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+             void *scls,
+             const char *option,
+             const char *value)
+{
+  const char *about = scls;
+  size_t slen;
+  unsigned int i;
+  int j;
+  size_t ml;
+  size_t p;
+  char *scp;
+  const char *trans;
+  const struct GNUNET_GETOPT_CommandLineOption *opt;
+  const struct GNUNET_OS_ProjectData *pd;
+
+  (void) option;
+  (void) value;
+  if (NULL != about)
+  {
+    printf ("%s\n%s\n", ctx->binaryOptions, gettext (about));
+    printf (_ (
+              "Arguments mandatory for long options are also mandatory for short options.\n"));
+  }
+  i = 0;
+  opt = ctx->allOptions;
+  while (NULL != opt[i].description)
+  {
+    if (opt[i].shortName == '\0')
+      printf ("      ");
+    else
+      printf ("  -%c, ", opt[i].shortName);
+    printf ("--%s", opt[i].name);
+    slen = 8 + strlen (opt[i].name);
+    if (NULL != opt[i].argumentHelp)
+    {
+      printf ("=%s", opt[i].argumentHelp);
+      slen += 1 + strlen (opt[i].argumentHelp);
+    }
+    if (slen > BORDER)
+    {
+      printf ("\n%*s", BORDER, "");
+      slen = BORDER;
+    }
+    if (slen < BORDER)
+    {
+      printf ("%*s", (int) (BORDER - slen), "");
+      slen = BORDER;
+    }
+    if (0 < strlen (opt[i].description))
+      trans = gettext (opt[i].description);
+    else
+      trans = "";
+    ml = strlen (trans);
+    p = 0;
+OUTER:
+    while (ml - p > 78 - slen)
+    {
+      for (j = p + 78 - slen; j > (int) p; j--)
+      {
+        if (isspace ((unsigned char) trans[j]))
+        {
+          scp = GNUNET_malloc (j - p + 1);
+          GNUNET_memcpy (scp, &trans[p], j - p);
+          scp[j - p] = '\0';
+          printf ("%s\n%*s", scp, BORDER + 2, "");
+          GNUNET_free (scp);
+          p = j + 1;
+          slen = BORDER + 2;
+          goto OUTER;
+        }
+      }
+      /* could not find space to break line */
+      scp = GNUNET_malloc (78 - slen + 1);
+      GNUNET_memcpy (scp, &trans[p], 78 - slen);
+      scp[78 - slen] = '\0';
+      printf ("%s\n%*s", scp, BORDER + 2, "");
+      GNUNET_free (scp);
+      slen = BORDER + 2;
+      p = p + 78 - slen;
+    }
+    /* print rest */
+    if (p < ml)
+      printf ("%s\n", &trans[p]);
+    if (strlen (trans) == 0)
+      printf ("\n");
+    i++;
+  }
+  pd = GNUNET_OS_project_data_get ();
+  printf ("\n"
+          "Report bugs to %s.\n"
+          "Home page: %s\n",
+          pd->bug_email,
+          pd->homepage);
+
+  if (0 != pd->is_gnu)
+    printf ("General help using GNU software: http://www.gnu.org/gethelp/\n");
+
+  return GNUNET_NO;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_help (const char *about)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'h',
+    .name = "help",
+    .description = gettext_noop (
+      "print this help"),
+    .option_exclusive = 1,
+    .processor = format_help,
+    .scls = (void *) about
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'unsigned int' from the command line. Each
+ * time the option flag is given, the value is incremented by one.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'int'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'unsigned int')
+ * @param option name of the option
+ * @param value not used (NULL)
+ * @return #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+increment_value (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+                 void *scls,
+                 const char *option,
+                 const char *value)
+{
+  unsigned int *val = scls;
+
+  (void) ctx;
+  (void) option;
+  (void) value;
+  (*val)++;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_increment_uint (char shortName,
+                                     const char *name,
+                                     const char *description,
+                                     unsigned int *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .description = description,
+    .processor = &increment_value,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_verbose (unsigned int *level)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'V',
+    .name = "verbose",
+    .description =
+      gettext_noop ("be verbose"),
+    .processor = &increment_value,
+    .scls = (void *) level
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'int' from the command line to 1 if the
+ * given option is present.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'int'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'int')
+ * @param option name of the option
+ * @param value not used (NULL)
+ * @return #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+set_one (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+         void *scls,
+         const char *option,
+         const char *value)
+{
+  int *val = scls;
+
+  (void) ctx;
+  (void) option;
+  (void) value;
+  *val = 1;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_flag (char shortName,
+                           const char *name,
+                           const char *description,
+                           int *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .description = description,
+    .processor = &set_one,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'char *' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'char *', which will be allocated with the requested string.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'char *',
+ *             which will be allocated)
+ * @param option name of the option
+ * @param value actual value of the option (a string)
+ * @return #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+set_string (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+            void *scls,
+            const char *option,
+            const char *value)
+{
+  char **val = scls;
+
+  (void) ctx;
+  (void) option;
+  GNUNET_assert (NULL != value);
+  GNUNET_free (*val);
+  *val = GNUNET_strdup (value);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_string (char shortName,
+                             const char *name,
+                             const char *argumentHelp,
+                             const char *description,
+                             char **str)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_string,
+    .scls = (void *) str
+  };
+
+  return clo;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_loglevel (char **level)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'L',
+    .name = "log",
+    .argumentHelp = "LOGLEVEL",
+    .description = gettext_noop ("configure logging to use LOGLEVEL"),
+    .require_argument = 1,
+    .processor = &set_string,
+    .scls = (void *) level
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'char *' from the command line with
+ * filename expansion a la #GNUNET_STRINGS_filename_expand().
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the `char *`,
+ *             which will be allocated)
+ * @param option name of the option
+ * @param value actual value of the option (a string)
+ * @return #GNUNET_OK
+ */
+static enum GNUNET_GenericReturnValue
+set_filename (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+              void *scls,
+              const char *option,
+              const char *value)
+{
+  char **val = scls;
+
+  (void) ctx;
+  (void) option;
+  GNUNET_assert (NULL != value);
+  GNUNET_free (*val);
+  *val = GNUNET_STRINGS_filename_expand (value);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_filename (char shortName,
+                               const char *name,
+                               const char *argumentHelp,
+                               const char *description,
+                               char **str)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_filename,
+    .scls = (void *) str
+  };
+
+  return clo;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_logfile (char **logfn)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'l',
+    .name = "logfile",
+    .argumentHelp = "FILENAME",
+    .description =
+      gettext_noop ("configure logging to write logs to FILENAME"),
+    .require_argument = 1,
+    .processor = &set_filename,
+    .scls = (void *) logfn
+  };
+
+  return clo;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_cfgfile (char **fn)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = 'c',
+    .name = "config",
+    .argumentHelp = "FILENAME",
+    .description = gettext_noop ("use configuration file FILENAME"),
+    .require_argument = 1,
+    .processor = &set_filename,
+    .scls = (void *) fn
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'unsigned long long' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'unsigned long long'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'unsigned long long')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_ulong (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+           void *scls,
+           const char *option,
+           const char *value)
+{
+  unsigned long long *val = scls;
+  char dummy[2];
+
+  (void) ctx;
+  if (1 != sscanf (value, "%llu%1s", val, dummy))
+  {
+    fprintf (stderr,
+             _ ("You must pass a number to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_ulong (char shortName,
+                            const char *name,
+                            const char *argumentHelp,
+                            const char *description,
+                            unsigned long long *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_ulong,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'struct GNUNET_TIME_Relative' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'struct GNUNET_TIME_Relative'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'struct GNUNET_TIME_Relative')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_timetravel_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+                     void *scls,
+                     const char *option,
+                     const char *value)
+{
+  long long delta;
+  long long minus;
+  struct GNUNET_TIME_Relative rt;
+
+  (void) scls;
+  (void) ctx;
+  while (isspace (value[0]))
+    value++;
+  minus = 1;
+  if (value[0] == '-')
+  {
+    minus = -1;
+    value++;
+  }
+  else if (value[0] == '+')
+  {
+    value++;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_fancy_time_to_relative (value,
+                                             &rt))
+  {
+    fprintf (stderr,
+             _ (
+               "You must pass a relative time (optionally with sign) to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  if (rt.rel_value_us > LLONG_MAX)
+  {
+    fprintf (stderr,
+             _ ("Value given for time travel `%s' option is too big.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  delta = (long long) rt.rel_value_us;
+  delta *= minus;
+  GNUNET_TIME_set_offset (delta);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_timetravel (char shortName,
+                                 const char *name)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = _ ("[+/-]MICROSECONDS"),
+    .description = _ (
+      "modify system time by given offset (for debugging/testing only)"),
+    .require_argument = 1,
+    .processor = &set_timetravel_time
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'struct GNUNET_TIME_Relative' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'struct GNUNET_TIME_Relative'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'struct GNUNET_TIME_Relative')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_relative_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+                   void *scls,
+                   const char *option,
+                   const char *value)
+{
+  struct GNUNET_TIME_Relative *val = scls;
+
+  (void) ctx;
+  if (GNUNET_OK != GNUNET_STRINGS_fancy_time_to_relative (value, val))
+  {
+    fprintf (stderr,
+             _ ("You must pass relative time to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_relative_time (char shortName,
+                                    const char *name,
+                                    const char *argumentHelp,
+                                    const char *description,
+                                    struct GNUNET_TIME_Relative *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_relative_time,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'struct GNUNET_TIME_Absolute' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'struct GNUNET_TIME_Absolute'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the `struct GNUNET_TIME_Absolute`)
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_absolute_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+                   void *scls,
+                   const char *option,
+                   const char *value)
+{
+  struct GNUNET_TIME_Absolute *val = scls;
+
+  (void) ctx;
+  if (GNUNET_OK != GNUNET_STRINGS_fancy_time_to_absolute (value, val))
+  {
+    fprintf (stderr,
+             _ ("You must pass absolute time to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_absolute_time (char shortName,
+                                    const char *name,
+                                    const char *argumentHelp,
+                                    const char *description,
+                                    struct GNUNET_TIME_Absolute *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_absolute_time,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'struct GNUNET_TIME_Timestamp' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'struct GNUNET_TIME_Absolute'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the `struct GNUNET_TIME_Absolute`)
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_timestamp (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+               void *scls,
+               const char *option,
+               const char *value)
+{
+  struct GNUNET_TIME_Timestamp *t = scls;
+  struct GNUNET_TIME_Absolute abs;
+
+  (void) ctx;
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_fancy_time_to_absolute (value,
+                                             &abs))
+  {
+    fprintf (stderr,
+             _ ("You must pass a timestamp to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  if (0 != abs.abs_value_us % GNUNET_TIME_UNIT_SECONDS.rel_value_us)
+  {
+    fprintf (stderr,
+             _ ("The maximum precision allowed for timestamps is seconds.\n"));
+    return GNUNET_SYSERR;
+  }
+  t->abs_time = abs;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_timestamp (char shortName,
+                                const char *name,
+                                const char *argumentHelp,
+                                const char *description,
+                                struct GNUNET_TIME_Timestamp *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_timestamp,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'unsigned int' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'unsigned int'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'unsigned int')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_uint (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+          void *scls,
+          const char *option,
+          const char *value)
+{
+  unsigned int *val = scls;
+  char dummy[2];
+
+  (void) ctx;
+  if ('-' == *value)
+  {
+    fprintf (stderr,
+             _ (
+               "Your input for the '%s' option has to be a non negative number\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  if (1 != sscanf (value, "%u%1s", val, dummy))
+  {
+    fprintf (stderr,
+             _ ("You must pass a number to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_uint (char shortName,
+                           const char *name,
+                           const char *argumentHelp,
+                           const char *description,
+                           unsigned int *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_uint,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'uint16_t' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'uint16_t'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'unsigned int')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_uint16 (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+            void *scls,
+            const char *option,
+            const char *value)
+{
+  uint16_t *val = scls;
+  unsigned int v;
+  char dummy[2];
+
+  (void) ctx;
+  if (1 != sscanf (value, "%u%1s", &v, dummy))
+  {
+    fprintf (stderr,
+             _ ("You must pass a number to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  if (v > UINT16_MAX)
+  {
+    fprintf (stderr,
+             _ ("You must pass a number below %u to the `%s' option.\n"),
+             (unsigned int) UINT16_MAX,
+             option);
+    return GNUNET_SYSERR;
+  }
+  *val = (uint16_t) v;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_uint16 (char shortName,
+                             const char *name,
+                             const char *argumentHelp,
+                             const char *description,
+                             uint16_t *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_uint16,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Closure for #set_base32().
+ */
+struct Base32Context
+{
+  /**
+   * Value to initialize (already allocated)
+   */
+  void *val;
+
+  /**
+   * Number of bytes expected for @e val.
+   */
+  size_t val_size;
+};
+
+
+/**
+ * Set an option of type 'unsigned int' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'unsigned int'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the 'unsigned int')
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_base32 (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+            void *scls,
+            const char *option,
+            const char *value)
+{
+  struct Base32Context *bc = scls;
+
+  (void) ctx;
+  if (GNUNET_OK != GNUNET_STRINGS_string_to_data (value,
+                                                  strlen (value),
+                                                  bc->val,
+                                                  bc->val_size))
+  {
+    fprintf (
+      stderr,
+      _ (
+        "Argument `%s' malformed. Expected base32 (Crockford) encoded value.\n"),
+      option);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Helper function to clean up after
+ * #GNUNET_GETOPT_option_base32_fixed_size.
+ *
+ * @param cls value to GNUNET_free()
+ */
+static void
+free_bc (void *cls)
+{
+  GNUNET_free (cls);
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_base32_fixed_size (char shortName,
+                                        const char *name,
+                                        const char *argumentHelp,
+                                        const char *description,
+                                        void *val,
+                                        size_t val_size)
+{
+  struct Base32Context *bc = GNUNET_new (struct Base32Context);
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_base32,
+    .cleaner = &free_bc,
+    .scls = (void *) bc
+  };
+
+  bc->val = val;
+  bc->val_size = val_size;
+  return clo;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_mandatory (struct GNUNET_GETOPT_CommandLineOption opt)
+{
+  opt.option_mandatory = 1;
+  return opt;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_exclusive (struct GNUNET_GETOPT_CommandLineOption opt)
+{
+  opt.option_exclusive = 1;
+  return opt;
+}
+
+
+/* end of getopt_helpers.c */
diff --git a/src/lib/util/gnunet_error_codes.c b/src/lib/util/gnunet_error_codes.c
new file mode 100644
index 000000000..11ce2d0c8
--- /dev/null
+++ b/src/lib/util/gnunet_error_codes.c
@@ -0,0 +1,262 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012-2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+#include "gnunet_error_codes.h"
+#include <stddef.h>
+#include <microhttpd.h>
+#include <gettext.h>
+
+/**
+ * MHD does not define our value for 0 (client-side generated code).
+ */
+#define MHD_HTTP_UNINITIALIZED 0
+
+/**
+ * A pair containing an error code and its hint.
+ */
+struct ErrorCodeAndHint
+{
+  /**
+   * The error code.
+   */
+  enum GNUNET_ErrorCode ec;
+
+  /**
+   * The hint.
+   */
+  const char *hint;
+
+  /**
+   * The HTTP status code.
+   */
+  unsigned int http_code;
+};
+
+
+/**
+ * The list of all error codes with their hints.
+ */
+static const struct ErrorCodeAndHint code_hint_pairs[] = {
+
+  {
+    .ec = GNUNET_EC_NONE,
+    .hint = gettext_noop ("No error (success)."),
+    .http_code = MHD_HTTP_UNINITIALIZED
+  },
+
+  {
+    .ec = GNUNET_EC_UNKNOWN,
+    .hint = gettext_noop ("Unknown and unspecified error."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_SERVICE_COMMUNICATION_FAILED,
+    .hint = gettext_noop ("Communication with service failed."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_IDENTITY_NOT_FOUND,
+    .hint = gettext_noop ("Ego not found."),
+    .http_code = MHD_HTTP_NOT_FOUND
+  },
+
+  {
+    .ec = GNUNET_EC_IDENTITY_NAME_CONFLICT,
+    .hint = gettext_noop ("Identifier already in use for another ego."),
+    .http_code = MHD_HTTP_CONFLICT
+  },
+
+  {
+    .ec = GNUNET_EC_IDENTITY_INVALID,
+    .hint = gettext_noop ("The given ego is invalid or malformed."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_UNKNOWN,
+    .hint = gettext_noop ("Unknown namestore error."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_ITERATION_FAILED,
+    .hint = gettext_noop ("Zone iteration failed."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND,
+    .hint = gettext_noop ("Zone not found."),
+    .http_code = MHD_HTTP_NOT_FOUND
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_RECORD_NOT_FOUND,
+    .hint = gettext_noop ("Record not found."),
+    .http_code = MHD_HTTP_NOT_FOUND
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_RECORD_DELETE_FAILED,
+    .hint = gettext_noop ("Zone iteration failed."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_ZONE_EMPTY,
+    .hint = gettext_noop ("Zone does not contain any records."),
+    .http_code = MHD_HTTP_NOT_FOUND
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_LOOKUP_ERROR,
+    .hint = gettext_noop ("Failed to lookup record."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_NO_RECORDS_GIVEN,
+    .hint = gettext_noop ("No records given."),
+    .http_code = MHD_HTTP_BAD_REQUEST
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID,
+    .hint = gettext_noop ("Record data invalid."),
+    .http_code = MHD_HTTP_BAD_REQUEST
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_NO_LABEL_GIVEN,
+    .hint = gettext_noop ("No label given."),
+    .http_code = MHD_HTTP_BAD_REQUEST
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_NO_RESULTS,
+    .hint = gettext_noop ("No results given."),
+    .http_code = MHD_HTTP_NOT_FOUND
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_RECORD_EXISTS,
+    .hint = gettext_noop ("Record already exists."),
+    .http_code = MHD_HTTP_CONFLICT
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_RECORD_TOO_BIG,
+    .hint = gettext_noop ("Record size exceeds maximum limit."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_BACKEND_FAILED,
+    .hint = gettext_noop ("There was an error in the database backend."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_STORE_FAILED,
+    .hint = gettext_noop ("Failed to store the given records."),
+    .http_code = MHD_HTTP_INTERNAL_SERVER_ERROR
+  },
+
+  {
+    .ec = GNUNET_EC_NAMESTORE_LABEL_INVALID,
+    .hint = gettext_noop ("Label invalid or malformed."),
+    .http_code = MHD_HTTP_BAD_REQUEST
+  },
+
+
+};
+
+
+/**
+ * The length of @e code_hint_pairs.
+ */
+static const unsigned int code_hint_pairs_length = 22;
+
+
+
+const char *
+GNUNET_ErrorCode_get_hint (enum GNUNET_ErrorCode ec)
+{
+  unsigned int lower = 0;
+  unsigned int upper = code_hint_pairs_length - 1;
+  unsigned int mid = upper / 2;
+  while (lower <= upper)
+  {
+    mid = (upper + lower) / 2;
+    if (code_hint_pairs[mid].ec < ec)
+    {
+      lower = mid + 1;
+    }
+    else if (code_hint_pairs[mid].ec > ec)
+    {
+      upper = mid - 1;
+    }
+    else
+    {
+      return code_hint_pairs[mid].hint;
+    }
+  }
+  return "<no hint found>";
+}
+
+
+unsigned int
+GNUNET_ErrorCode_get_http_status (enum GNUNET_ErrorCode ec)
+{
+  unsigned int lower = 0;
+  unsigned int upper = code_hint_pairs_length - 1;
+  unsigned int mid = upper / 2;
+  while (lower <= upper)
+  {
+    mid = (upper + lower) / 2;
+    if (code_hint_pairs[mid].ec < ec)
+    {
+      lower = mid + 1;
+    }
+    else if (code_hint_pairs[mid].ec > ec)
+    {
+      upper = mid - 1;
+    }
+    else
+    {
+      return code_hint_pairs[mid].http_code;
+    }
+  }
+  return UINT_MAX;
+}
+
+
+unsigned int
+GNUNET_ErrorCode_get_http_status_safe (enum GNUNET_ErrorCode ec)
+{
+  unsigned int hc;
+
+  hc = GNUNET_ErrorCode_get_http_status (ec);
+  if ( (0 == hc) ||
+       (UINT_MAX == hc) )
+    return MHD_HTTP_INTERNAL_SERVER_ERROR;
+  return hc;
+}
diff --git a/src/lib/util/helper.c b/src/lib/util/helper.c
new file mode 100644
index 000000000..87ea749e9
--- /dev/null
+++ b/src/lib/util/helper.c
@@ -0,0 +1,672 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011, 2012 Christian Grothoff
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/helper.c
+ * @brief API for dealing with (SUID) helper processes that communicate via
+ *          GNUNET_MessageHeaders on stdin/stdout
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Entry in the queue of messages we need to transmit to the helper.
+ */
+struct GNUNET_HELPER_SendHandle
+{
+  /**
+   * This is an entry in a DLL.
+   */
+  struct GNUNET_HELPER_SendHandle *next;
+
+  /**
+   * This is an entry in a DLL.
+   */
+  struct GNUNET_HELPER_SendHandle *prev;
+
+  /**
+   * Message to transmit (allocated at the end of this struct)
+   */
+  const struct GNUNET_MessageHeader *msg;
+
+  /**
+   * The handle to a helper process.
+   */
+  struct GNUNET_HELPER_Handle *h;
+
+  /**
+   * Function to call upon completion.
+   */
+  GNUNET_HELPER_Continuation cont;
+
+  /**
+   * Closure to 'cont'.
+   */
+  void *cont_cls;
+
+  /**
+   * Current write position.
+   */
+  unsigned int wpos;
+};
+
+
+/**
+ * The handle to a helper process.
+ */
+struct GNUNET_HELPER_Handle
+{
+  /**
+   * PipeHandle to receive data from the helper
+   */
+  struct GNUNET_DISK_PipeHandle *helper_in;
+
+  /**
+   * PipeHandle to send data to the helper
+   */
+  struct GNUNET_DISK_PipeHandle *helper_out;
+
+  /**
+   * FileHandle to receive data from the helper
+   */
+  const struct GNUNET_DISK_FileHandle *fh_from_helper;
+
+  /**
+   * FileHandle to send data to the helper
+   */
+  const struct GNUNET_DISK_FileHandle *fh_to_helper;
+
+  /**
+   * The process id of the helper
+   */
+  struct GNUNET_OS_Process *helper_proc;
+
+  /**
+   * The Message-Tokenizer that tokenizes the messages coming from the helper
+   */
+  struct GNUNET_MessageStreamTokenizer *mst;
+
+  /**
+   * The exception callback
+   */
+  GNUNET_HELPER_ExceptionCallback exp_cb;
+
+  /**
+   * The closure for callbacks
+   */
+  void *cb_cls;
+
+  /**
+   * First message queued for transmission to helper.
+   */
+  struct GNUNET_HELPER_SendHandle *sh_head;
+
+  /**
+   * Last message queued for transmission to helper.
+   */
+  struct GNUNET_HELPER_SendHandle *sh_tail;
+
+  /**
+   * Binary to run.
+   */
+  char *binary_name;
+
+  /**
+   * NULL-terminated list of command-line arguments.
+   */
+  char **binary_argv;
+
+  /**
+   * Task to read from the helper.
+   */
+  struct GNUNET_SCHEDULER_Task *read_task;
+
+  /**
+   * Task to read from the helper.
+   */
+  struct GNUNET_SCHEDULER_Task *write_task;
+
+  /**
+   * Restart task.
+   */
+  struct GNUNET_SCHEDULER_Task *restart_task;
+
+  /**
+   * Does the helper support the use of a control pipe for signalling?
+   */
+  int with_control_pipe;
+
+  /**
+   * Count start attempts to increase linear back off
+   */
+  unsigned int retry_back_off;
+};
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELPER_kill (struct GNUNET_HELPER_Handle *h, int soft_kill)
+{
+  struct GNUNET_HELPER_SendHandle *sh;
+  int ret;
+
+  while (NULL != (sh = h->sh_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->sh_head, h->sh_tail, sh);
+    if (NULL != sh->cont)
+      sh->cont (sh->cont_cls, GNUNET_NO);
+    GNUNET_free (sh);
+  }
+  if (NULL != h->restart_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->restart_task);
+    h->restart_task = NULL;
+  }
+  if (NULL != h->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->read_task);
+    h->read_task = NULL;
+  }
+  if (NULL == h->helper_proc)
+    return GNUNET_SYSERR;
+  if (GNUNET_YES == soft_kill)
+  {
+    /* soft-kill only possible with pipes */
+    GNUNET_assert (NULL != h->helper_in);
+    ret = GNUNET_DISK_pipe_close (h->helper_in);
+    h->helper_in = NULL;
+    h->fh_to_helper = NULL;
+    return ret;
+  }
+  if (0 != GNUNET_OS_process_kill (h->helper_proc, GNUNET_TERM_SIG))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELPER_wait (struct GNUNET_HELPER_Handle *h)
+{
+  struct GNUNET_HELPER_SendHandle *sh;
+  int ret;
+
+  ret = GNUNET_SYSERR;
+  if (NULL != h->helper_proc)
+  {
+    ret = GNUNET_OS_process_wait (h->helper_proc);
+    GNUNET_OS_process_destroy (h->helper_proc);
+    h->helper_proc = NULL;
+  }
+  if (NULL != h->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->read_task);
+    h->read_task = NULL;
+  }
+  if (NULL != h->write_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->write_task);
+    h->write_task = NULL;
+  }
+  if (NULL != h->helper_in)
+  {
+    GNUNET_DISK_pipe_close (h->helper_in);
+    h->helper_in = NULL;
+    h->fh_to_helper = NULL;
+  }
+  if (NULL != h->helper_out)
+  {
+    GNUNET_DISK_pipe_close (h->helper_out);
+    h->helper_out = NULL;
+    h->fh_from_helper = NULL;
+  }
+  while (NULL != (sh = h->sh_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->sh_head, h->sh_tail, sh);
+    if (NULL != sh->cont)
+      sh->cont (sh->cont_cls, GNUNET_NO);
+    GNUNET_free (sh);
+  }
+  /* purge MST buffer */
+  if (NULL != h->mst)
+    (void) GNUNET_MST_from_buffer (h->mst, NULL, 0, GNUNET_YES, GNUNET_NO);
+  return ret;
+}
+
+
+/**
+ * Stop the helper process, we're closing down or had an error.
+ *
+ * @param h handle to the helper process
+ * @param soft_kill if #GNUNET_YES, signals termination by closing the helper's
+ *          stdin; #GNUNET_NO to signal termination by sending SIGTERM to helper
+ */
+static void
+stop_helper (struct GNUNET_HELPER_Handle *h, int soft_kill)
+{
+  if (NULL != h->restart_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->restart_task);
+    h->restart_task = NULL;
+  }
+  else
+  {
+    GNUNET_break (GNUNET_OK == GNUNET_HELPER_kill (h, soft_kill));
+    GNUNET_break (GNUNET_OK == GNUNET_HELPER_wait (h));
+  }
+}
+
+
+/**
+ * Restart the helper process.
+ *
+ * @param cls handle to the helper process
+ */
+static void
+restart_task (void *cls);
+
+
+/**
+ * Read from the helper-process
+ *
+ * @param cls handle to the helper process
+ */
+static void
+helper_read (void *cls)
+{
+  struct GNUNET_HELPER_Handle *h = cls;
+  char buf[GNUNET_MAX_MESSAGE_SIZE] GNUNET_ALIGN;
+  ssize_t t;
+
+  h->read_task = NULL;
+  t = GNUNET_DISK_file_read (h->fh_from_helper, &buf, sizeof(buf));
+  if (t < 0)
+  {
+    /* On read-error, restart the helper */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Error reading from `%s': %s\n"),
+                h->binary_name,
+                strerror (errno));
+    if (NULL != h->exp_cb)
+    {
+      h->exp_cb (h->cb_cls);
+      GNUNET_HELPER_stop (h, GNUNET_NO);
+      return;
+    }
+    stop_helper (h, GNUNET_NO);
+    /* Restart the helper */
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+  if (0 == t)
+  {
+    /* this happens if the helper is shut down via a
+       signal, so it is not a "hard" error */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got 0 bytes from helper `%s' (EOF)\n",
+                h->binary_name);
+    if (NULL != h->exp_cb)
+    {
+      h->exp_cb (h->cb_cls);
+      GNUNET_HELPER_stop (h, GNUNET_NO);
+      return;
+    }
+    stop_helper (h, GNUNET_NO);
+    /* Restart the helper */
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got %u bytes from helper `%s'\n",
+              (unsigned int) t,
+              h->binary_name);
+  h->read_task = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                                 h->fh_from_helper,
+                                                 &helper_read,
+                                                 h);
+  if (GNUNET_SYSERR ==
+      GNUNET_MST_from_buffer (h->mst, buf, t, GNUNET_NO, GNUNET_NO))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Failed to parse inbound message from helper `%s'\n"),
+                h->binary_name);
+    if (NULL != h->exp_cb)
+    {
+      h->exp_cb (h->cb_cls);
+      GNUNET_HELPER_stop (h, GNUNET_NO);
+      return;
+    }
+    stop_helper (h, GNUNET_NO);
+    /* Restart the helper */
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+}
+
+
+/**
+ * Start the helper process.
+ *
+ * @param h handle to the helper process
+ */
+static void
+start_helper (struct GNUNET_HELPER_Handle *h)
+{
+  h->helper_in =
+    GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  h->helper_out =
+    GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  if ((h->helper_in == NULL) || (h->helper_out == NULL))
+  {
+    /* out of file descriptors? try again later... */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "out of file descriptors? try again later\n");
+    stop_helper (h, GNUNET_NO);
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting HELPER process `%s'\n",
+              h->binary_name);
+  h->fh_from_helper =
+    GNUNET_DISK_pipe_handle (h->helper_out, GNUNET_DISK_PIPE_END_READ);
+  h->fh_to_helper =
+    GNUNET_DISK_pipe_handle (h->helper_in, GNUNET_DISK_PIPE_END_WRITE);
+  h->helper_proc = GNUNET_OS_start_process_vap (h->with_control_pipe
+                                                ? GNUNET_OS_INHERIT_STD_ERR
+                                                | GNUNET_OS_USE_PIPE_CONTROL
+                                                : GNUNET_OS_INHERIT_STD_ERR,
+                                                h->helper_in,
+                                                h->helper_out,
+                                                NULL,
+                                                h->binary_name,
+                                                h->binary_argv);
+  if (NULL == h->helper_proc)
+  {
+    /* failed to start process? try again later... */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "failed to start process? try again later\n");
+    stop_helper (h, GNUNET_NO);
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+  GNUNET_DISK_pipe_close_end (h->helper_out, GNUNET_DISK_PIPE_END_WRITE);
+  GNUNET_DISK_pipe_close_end (h->helper_in, GNUNET_DISK_PIPE_END_READ);
+  if (NULL != h->mst)
+    h->read_task = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                                   h->fh_from_helper,
+                                                   &helper_read,
+                                                   h);
+}
+
+
+/**
+ * Restart the helper process.
+ *
+ * @param cls handle to the helper process
+ */
+static void
+restart_task (void *cls)
+{
+  struct GNUNET_HELPER_Handle *h = cls;
+
+  h->restart_task = NULL;
+  h->retry_back_off++;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Restarting helper with back-off %u\n",
+              h->retry_back_off);
+  start_helper (h);
+}
+
+
+struct GNUNET_HELPER_Handle *
+GNUNET_HELPER_start (int with_control_pipe,
+                     const char *binary_name,
+                     char *const binary_argv[],
+                     GNUNET_MessageTokenizerCallback cb,
+                     GNUNET_HELPER_ExceptionCallback exp_cb,
+                     void *cb_cls)
+{
+  struct GNUNET_HELPER_Handle *h;
+  unsigned int c;
+
+  h = GNUNET_new (struct GNUNET_HELPER_Handle);
+  h->with_control_pipe = with_control_pipe;
+  /* Lookup in libexec path only if we are starting gnunet helpers */
+  if (NULL != strstr (binary_name, "gnunet"))
+    h->binary_name = GNUNET_OS_get_libexec_binary_path (binary_name);
+  else
+    h->binary_name = GNUNET_strdup (binary_name);
+  for (c = 0; NULL != binary_argv[c]; c++)
+    ;
+  h->binary_argv = GNUNET_malloc (sizeof(char *) * (c + 1));
+  for (c = 0; NULL != binary_argv[c]; c++)
+    h->binary_argv[c] = GNUNET_strdup (binary_argv[c]);
+  h->binary_argv[c] = NULL;
+  h->cb_cls = cb_cls;
+  if (NULL != cb)
+    h->mst = GNUNET_MST_create (cb, h->cb_cls);
+  h->exp_cb = exp_cb;
+  h->retry_back_off = 0;
+  start_helper (h);
+  return h;
+}
+
+
+/**
+ * Free's the resources occupied by the helper handle
+ *
+ * @param h the helper handle to free
+ */
+void
+GNUNET_HELPER_destroy (struct GNUNET_HELPER_Handle *h)
+{
+  unsigned int c;
+  struct GNUNET_HELPER_SendHandle *sh;
+
+  if (NULL != h->write_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->write_task);
+    h->write_task = NULL;
+  }
+  GNUNET_assert (NULL == h->read_task);
+  GNUNET_assert (NULL == h->restart_task);
+  while (NULL != (sh = h->sh_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->sh_head, h->sh_tail, sh);
+    if (NULL != sh->cont)
+      sh->cont (sh->cont_cls, GNUNET_SYSERR);
+    GNUNET_free (sh);
+  }
+  if (NULL != h->mst)
+    GNUNET_MST_destroy (h->mst);
+  GNUNET_free (h->binary_name);
+  for (c = 0; h->binary_argv[c] != NULL; c++)
+    GNUNET_free (h->binary_argv[c]);
+  GNUNET_free (h->binary_argv);
+  GNUNET_free (h);
+}
+
+
+/**
+ * Kills the helper, closes the pipe and frees the handle
+ *
+ * @param h handle to helper to stop
+ * @param soft_kill if #GNUNET_YES, signals termination by closing the helper's
+ *          stdin; #GNUNET_NO to signal termination by sending SIGTERM to helper
+ */
+void
+GNUNET_HELPER_stop (struct GNUNET_HELPER_Handle *h, int soft_kill)
+{
+  h->exp_cb = NULL;
+  stop_helper (h, soft_kill);
+  GNUNET_HELPER_destroy (h);
+}
+
+
+/**
+ * Write to the helper-process
+ *
+ * @param cls handle to the helper process
+ */
+static void
+helper_write (void *cls)
+{
+  struct GNUNET_HELPER_Handle *h = cls;
+  struct GNUNET_HELPER_SendHandle *sh;
+  const char *buf;
+  ssize_t t;
+
+  h->write_task = NULL;
+  if (NULL == (sh = h->sh_head))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Helper write had no work!\n");
+    return;   /* how did this happen? */
+  }
+  buf = (const char *) sh->msg;
+  t = GNUNET_DISK_file_write (h->fh_to_helper,
+                              &buf[sh->wpos],
+                              ntohs (sh->msg->size) - sh->wpos);
+  if (-1 == t)
+  {
+    /* On write-error, restart the helper */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Error writing to `%s': %s\n"),
+                h->binary_name,
+                strerror (errno));
+    if (NULL != h->exp_cb)
+    {
+      h->exp_cb (h->cb_cls);
+      GNUNET_HELPER_stop (h, GNUNET_NO);
+      return;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Stopping and restarting helper task!\n");
+    stop_helper (h, GNUNET_NO);
+    /* Restart the helper */
+    h->restart_task = GNUNET_SCHEDULER_add_delayed (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                     h->retry_back_off),
+      &restart_task,
+      h);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Transmitted %u bytes to %s\n",
+              (unsigned int) t,
+              h->binary_name);
+  sh->wpos += t;
+  if (sh->wpos == ntohs (sh->msg->size))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->sh_head, h->sh_tail, sh);
+    if (NULL != sh->cont)
+      sh->cont (sh->cont_cls, GNUNET_YES);
+    GNUNET_free (sh);
+  }
+  if (NULL != h->sh_head)
+    h->write_task =
+      GNUNET_SCHEDULER_add_write_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                       h->fh_to_helper,
+                                       &helper_write,
+                                       h);
+}
+
+
+struct GNUNET_HELPER_SendHandle *
+GNUNET_HELPER_send (struct GNUNET_HELPER_Handle *h,
+                    const struct GNUNET_MessageHeader *msg,
+                    bool can_drop,
+                    GNUNET_HELPER_Continuation cont,
+                    void *cont_cls)
+{
+  struct GNUNET_HELPER_SendHandle *sh;
+  uint16_t mlen;
+
+  if (NULL == h->fh_to_helper)
+    return NULL;
+  if (can_drop && (NULL != h->sh_head))
+    return NULL;
+  mlen = ntohs (msg->size);
+  sh = GNUNET_malloc (sizeof(struct GNUNET_HELPER_SendHandle) + mlen);
+  sh->msg = (const struct GNUNET_MessageHeader *) &sh[1];
+  GNUNET_memcpy (&sh[1], msg, mlen);
+  sh->h = h;
+  sh->cont = cont;
+  sh->cont_cls = cont_cls;
+  GNUNET_CONTAINER_DLL_insert_tail (h->sh_head, h->sh_tail, sh);
+  if (NULL == h->write_task)
+    h->write_task =
+      GNUNET_SCHEDULER_add_write_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                       h->fh_to_helper,
+                                       &helper_write,
+                                       h);
+
+  return sh;
+}
+
+
+/**
+ * Cancel a #GNUNET_HELPER_send operation.  If possible, transmitting the
+ * message is also aborted, but at least 'cont' won't be
+ * called.
+ *
+ * @param sh operation to cancel
+ */
+void
+GNUNET_HELPER_send_cancel (struct GNUNET_HELPER_SendHandle *sh)
+{
+  struct GNUNET_HELPER_Handle *h = sh->h;
+
+  sh->cont = NULL;
+  sh->cont_cls = NULL;
+  if (0 == sh->wpos)
+  {
+    GNUNET_CONTAINER_DLL_remove (h->sh_head, h->sh_tail, sh);
+    GNUNET_free (sh);
+    if (NULL == h->sh_head)
+    {
+      GNUNET_SCHEDULER_cancel (h->write_task);
+      h->write_task = NULL;
+    }
+  }
+}
+
+
+/* end of helper.c */
diff --git a/src/lib/util/load.c b/src/lib/util/load.c
new file mode 100644
index 000000000..a64171bd4
--- /dev/null
+++ b/src/lib/util/load.c
@@ -0,0 +1,257 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/load.c
+ * @brief functions related to load calculations
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-load", __VA_ARGS__)
+
+/**
+ * Values we track for load calculations.
+ */
+struct GNUNET_LOAD_Value
+{
+  /**
+   * How fast should the load decline if no values are added?
+   */
+  struct GNUNET_TIME_Relative autodecline;
+
+  /**
+   * Last time this load value was updated by an event.
+   */
+  struct GNUNET_TIME_Absolute last_update;
+
+  /**
+   * Sum of all datastore delays ever observed (in ms).  Note that
+   * delays above 64k ms are excluded (to avoid overflow within
+   * first 4 billion requests).
+   */
+  uint64_t cummulative_delay;
+
+  /**
+   * Sum of squares of all datastore delays ever observed (in ms).   Note that
+   * delays above 64k ms are excluded (to avoid overflow within
+   * first 4 billion requests).
+   */
+  uint64_t cummulative_squared_delay;
+
+  /**
+   * Total number of requests included in the cumulative datastore delay values.
+   */
+  uint64_t cummulative_request_count;
+
+  /**
+   * Current running average datastore delay.  Its relation to the
+   * average datastore delay and it std. dev. (as calculated from the
+   * cumulative values) tells us our current load.
+   */
+  double runavg_delay;
+
+  /**
+   * How high is the load?  0 for below average, otherwise
+   * the number of std. devs we are above average, or 100 if the
+   * load is so high that we currently cannot calculate it.
+   */
+  double load;
+};
+
+
+static void
+internal_update (struct GNUNET_LOAD_Value *load)
+{
+  struct GNUNET_TIME_Relative delta;
+  unsigned int n;
+
+  if (load->autodecline.rel_value_us ==
+      GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+    return;
+  delta = GNUNET_TIME_absolute_get_duration (load->last_update);
+  if (delta.rel_value_us < load->autodecline.rel_value_us)
+    return;
+  if (0 == load->autodecline.rel_value_us)
+  {
+    load->runavg_delay = 0.0;
+    load->load = 0;
+    return;
+  }
+  n = delta.rel_value_us / load->autodecline.rel_value_us;
+  if (n > 16)
+  {
+    load->runavg_delay = 0.0;
+    load->load = 0;
+    return;
+  }
+  while (n > 0)
+  {
+    n--;
+    load->runavg_delay = (load->runavg_delay * 7.0) / 8.0;
+  }
+}
+
+
+/**
+ * Create a new load value.
+ *
+ * @param autodecline speed at which this value should automatically
+ *        decline in the absence of external events; at the given
+ *        frequency, 0-load values will be added to the load
+ * @return the new load value
+ */
+struct GNUNET_LOAD_Value *
+GNUNET_LOAD_value_init (struct GNUNET_TIME_Relative autodecline)
+{
+  struct GNUNET_LOAD_Value *ret;
+
+  ret = GNUNET_new (struct GNUNET_LOAD_Value);
+  ret->autodecline = autodecline;
+  ret->last_update = GNUNET_TIME_absolute_get ();
+  return ret;
+}
+
+
+/**
+ * Change the value by which the load automatically declines.
+ *
+ * @param load load to update
+ * @param autodecline frequency of load decline
+ */
+void
+GNUNET_LOAD_value_set_decline (struct GNUNET_LOAD_Value *load,
+                               struct GNUNET_TIME_Relative autodecline)
+{
+  internal_update (load);
+  load->autodecline = autodecline;
+}
+
+
+/**
+ * Recalculate our load value.
+ *
+ * @param load load to update
+ */
+static void
+calculate_load (struct GNUNET_LOAD_Value *load)
+{
+  double stddev;
+  double avgdel;
+  double sum_val_i;
+  double n;
+  double nm1;
+
+  if (load->cummulative_request_count <= 1)
+    return;
+  /* calculate std dev of latency; we have for n values of "i" that:
+   *
+   * avg = (sum val_i) / n
+   * stddev = (sum (val_i - avg)^2) / (n-1)
+   * = (sum (val_i^2 - 2 avg val_i + avg^2) / (n-1)
+   * = (sum (val_i^2) - 2 avg sum (val_i) + n * avg^2) / (n-1)
+   */sum_val_i = (double) load->cummulative_delay;
+  n = ((double) load->cummulative_request_count);
+  nm1 = n - 1.0;
+  avgdel = sum_val_i / n;
+  stddev =
+    (((double) load->cummulative_squared_delay) - 2.0 * avgdel * sum_val_i
+     + n * avgdel * avgdel) / nm1;
+  if (stddev <= 0)
+    stddev = 0.01;              /* must have been rounding error or zero; prevent division by zero */
+  /* now calculate load based on how far out we are from
+   * std dev; or if we are below average, simply assume load zero */
+  if (load->runavg_delay < avgdel)
+    load->load = 0.0;
+  else
+    load->load = (load->runavg_delay - avgdel) / stddev;
+}
+
+
+/**
+ * Get the current load.
+ *
+ * @param load load handle
+ * @return zero for below-average load, otherwise
+ *         number of std. devs we are above average;
+ *         100 if the latest updates were so large
+ *         that we could not do proper calculations
+ */
+double
+GNUNET_LOAD_get_load (struct GNUNET_LOAD_Value *load)
+{
+  internal_update (load);
+  calculate_load (load);
+  return load->load;
+}
+
+
+/**
+ * Get the average value given to update so far.
+ *
+ * @param load load handle
+ * @return zero if update was never called
+ */
+double
+GNUNET_LOAD_get_average (struct GNUNET_LOAD_Value *load)
+{
+  double n;
+  double sum_val_i;
+
+  internal_update (load);
+  if (load->cummulative_request_count == 0)
+    return 0.0;
+  n = ((double) load->cummulative_request_count);
+  sum_val_i = (double) load->cummulative_delay;
+  return sum_val_i / n;
+}
+
+
+/**
+ * Update the current load.
+ *
+ * @param load to update
+ * @param data latest measurement value (for example, delay)
+ */
+void
+GNUNET_LOAD_update (struct GNUNET_LOAD_Value *load, uint64_t data)
+{
+  uint32_t dv;
+
+  internal_update (load);
+  load->last_update = GNUNET_TIME_absolute_get ();
+  if (data > 64 * 1024)
+  {
+    /* very large */
+    load->load = 100.0;
+    return;
+  }
+  dv = (uint32_t) data;
+  load->cummulative_delay += dv;
+  load->cummulative_squared_delay += dv * dv;
+  load->cummulative_request_count++;
+  load->runavg_delay = ((load->runavg_delay * 7.0) + dv) / 8.0;
+}
+
+
+/* end of load.c */
diff --git a/src/lib/util/meson.build b/src/lib/util/meson.build
new file mode 100644
index 000000000..cc7c20201
--- /dev/null
+++ b/src/lib/util/meson.build
@@ -0,0 +1,669 @@
+libgnunetutil_src = ['bandwidth.c',
+       # $(BENCHMARK)',
+       'bio.c',
+       'buffer.c',
+       'child_management.c',
+       'client.c',
+       'common_allocation.c',
+       'common_endian.c',
+       'common_logging.c',
+       'compress.c',
+       'configuration.c',
+       'configuration_helper.c',
+       'consttime_memcmp.c',
+       'container_bloomfilter.c',
+       'container_heap.c',
+       'container_multihashmap.c',
+       'container_multishortmap.c',
+       'container_multiuuidmap.c',
+       'container_multipeermap.c',
+       'container_multihashmap32.c',
+       'crypto_blind_sign.c',
+       'crypto_symmetric.c',
+       'crypto_crc.c',
+       'crypto_cs.c',
+       'crypto_ecc.c',
+       'crypto_ecc_gnsrecord.c',
+       'crypto_ecc_dlog.c',
+       'crypto_ecc_setup.c',
+       'crypto_edx25519.c',
+       'crypto_elligator.c',
+       'crypto_hash.c',
+       'crypto_hash_file.c',
+       'crypto_hkdf.c',
+       'crypto_kdf.c',
+       'crypto_mpi.c',
+       'crypto_paillier.c',
+       'crypto_pkey.c',
+       'crypto_pow.c',
+       'crypto_random.c',
+       'crypto_rsa.c',
+       'disk.c',
+       'disk.h',
+       'dnsparser.c',
+       'dnsstub.c',
+       'getopt.c',
+       'getopt_helpers.c',
+       'helper.c',
+       'load.c',
+       'mst.c',
+       'mq.c',
+       'nc.c',
+       'network.c',
+       'nt.c',
+       'op.c',
+       'os_installation.c',
+       'os_network.c',
+       'os_priority.c',
+       'peer.c',
+       'plugin.c',
+       'program.c',
+       'regex.c',
+       'resolver_api.c',
+       'resolver.h',
+       'scheduler.c',
+       'service.c',
+       'signal.c',
+       'strings.c',
+       'time.c',
+       'tun.c',
+       'uri.c',
+       'speedup.c',
+       'speedup.h',
+       'proc_compat.c',
+             'gnunet_error_codes.c']
+
+configure_file(input : 'util.conf',
+               output : 'util.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+libgnunetutil = library('gnunetutil',
+        libgnunetutil_src,
+        soversion: '15',
+        version: '15.0.0',
+        dependencies: [
+          lgmp_dep,
+          mhd_dep,
+          sodium_dep,
+          gcrypt_dep,
+          curl_dep,
+          json_dep,
+          zlib_dep,
+          sqlite_dep,
+          unistr_dep,
+          ltdl_dep,
+          idn_dep
+        ],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetutil_dep = declare_dependency(link_with : libgnunetutil)
+pkg.generate(libgnunetutil, url: 'https://www.gnunet.org',
+             description : 'Provides miscellaneous utility functions and API for GNUnet')
+
+logging_dummy = executable ('test_common_logging_dummy',
+                            ['test_common_logging_dummy.c'],
+                            dependencies: [libgnunetutil_dep],
+                            include_directories: [incdir, configuration_inc],
+                            install: false)
+configure_file(input : 'test_client_data.conf',
+               output : 'test_client_data.conf',
+               copy: true)
+configure_file(input : 'test_speedup_data.conf',
+               output : 'test_speedup_data.conf',
+               copy: true)
+configure_file(input : 'test_program_data.conf',
+               output : 'test_program_data.conf',
+               copy: true)
+configure_file(input : 'test_service_data.conf',
+               output : 'test_service_data.conf',
+               copy: true)
+configure_file(input : 'test_configuration_data.conf',
+               output : 'test_configuration_data.conf',
+               copy: true)
+configure_file(input : 'child_management_test.sh',
+               output : 'child_management_test.sh',
+               copy: true)
+
+test_bio = executable ('test_bio',
+                       ['test_bio.c'],
+                       dependencies: [libgnunetutil_dep],
+                       include_directories: [incdir, configuration_inc],
+                       install: false)
+test('test_bio', test_bio,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-bio'])
+test_child_management = executable ('test_child_management',
+                                    ['test_child_management.c'],
+                                    dependencies: [libgnunetutil_dep],
+                                    include_directories: [incdir, configuration_inc],
+                                    install: false)
+test('test_child_management', test_child_management,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-child'])
+
+# test_client.nc
+
+testcommonalloc = executable ('test_common_allocation',
+                              ['test_common_allocation.c'],
+                              dependencies: [libgnunetutil_dep],
+                              build_by_default: false,
+                              include_directories: [incdir, configuration_inc],
+                              install: false)
+test('test_common_allocation', testcommonalloc,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-common'])
+
+testcommonlog = executable ('test_common_logging',
+                            ['test_common_logging.c'],
+                            dependencies: [libgnunetutil_dep],
+                            build_by_default: false,
+                            include_directories: [incdir, configuration_inc],
+                            install: false)
+test('test_common_logging', testcommonlog,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-common'])
+testcommonendian = executable ('test_common_endian',
+                               ['test_common_endian.c'],
+                               dependencies: [libgnunetutil_dep],
+                               build_by_default: false,
+                               include_directories: [incdir, configuration_inc],
+                               install: false)
+test('test_common_endian', testcommonendian,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-common'])
+testconf = executable ('test_configuration',
+                       ['test_configuration.c'],
+                       dependencies: [libgnunetutil_dep],
+                       build_by_default: false,
+                       include_directories: [incdir, configuration_inc],
+                       install: false)
+test('test_configuration', testconf,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-configuration'])
+testcontainerbloom = executable ('test_container_bloomfilter',
+                                 ['test_container_bloomfilter.c'],
+                                 dependencies: [libgnunetutil_dep],
+                                 include_directories: [incdir, configuration_inc],
+                                 build_by_default: false,
+                                 install: false)
+test('test_container_bloomfilter', testcontainerbloom,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcontainerdll = executable ('test_container_dll',
+                               ['test_container_dll.c'],
+                               dependencies: [libgnunetutil_dep],
+                               include_directories: [incdir, configuration_inc],
+                               build_by_default: false,
+                               install: false)
+test('test_container_dll', testcontainerdll,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcontainermhm = executable ('test_container_multihashmap',
+                               ['test_container_multihashmap.c'],
+                               dependencies: [libgnunetutil_dep],
+                               include_directories: [incdir, configuration_inc],
+                               build_by_default: false,
+                               install: false)
+test('test_container_multihashmap', testcontainermhm,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcontainermhm32 = executable ('test_container_multihashmap32',
+                                 ['test_container_multihashmap32.c'],
+                                 dependencies: [libgnunetutil_dep],
+                                 include_directories: [incdir, configuration_inc],
+                                 build_by_default: false,
+                                 install: false)
+test('test_container_multihashmap32', testcontainermhm32,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcontainermpm = executable ('test_container_multipeermap',
+                               ['test_container_multipeermap.c'],
+                               dependencies: [libgnunetutil_dep],
+                               include_directories: [incdir, configuration_inc],
+                               build_by_default: false,
+                               install: false)
+test('test_container_multipeermap', testcontainermpm,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcontainerheap = executable ('test_container_heap',
+                                ['test_container_heap.c'],
+                                dependencies: [libgnunetutil_dep],
+                                include_directories: [incdir, configuration_inc],
+                                build_by_default: false,
+                                install: false)
+test('test_container_heap', testcontainerheap,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-container'])
+
+testcrypto_symmetric = executable ('test_crypto_symmetric',
+                                   ['test_crypto_symmetric.c'],
+                                   dependencies: [libgnunetutil_dep],
+                                   include_directories: [incdir, configuration_inc],
+                                   build_by_default: false,
+                                   install: false)
+test('test_crypto_symmetric', testcrypto_symmetric,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_crc = executable ('test_crypto_crc',
+                             ['test_crypto_crc.c'],
+                             dependencies: [libgnunetutil_dep],
+                             include_directories: [incdir, configuration_inc],
+                             build_by_default: false,
+                             install: false)
+test('test_crypto_crc', testcrypto_crc,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_cs = executable ('test_crypto_cs',
+                            ['test_crypto_cs.c'],
+                            dependencies: [sodium_dep, libgnunetutil_dep],
+                            include_directories: [incdir, configuration_inc],
+                            build_by_default: false,
+                            install: false)
+test('test_crypto_cs', testcrypto_cs,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_ecdsa = executable ('test_crypto_ecdsa',
+                               ['test_crypto_ecdsa.c'],
+                               dependencies: [gcrypt_dep, libgnunetutil_dep],
+                               include_directories: [incdir, configuration_inc],
+                               build_by_default: false,
+                               install: false)
+test('test_crypto_ecdsa', testcrypto_ecdsa,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_eddsa = executable ('test_crypto_eddsa',
+                               ['test_crypto_eddsa.c'],
+                               dependencies: [gcrypt_dep, libgnunetutil_dep],
+                               include_directories: [incdir, configuration_inc],
+                               build_by_default: false,
+                               install: false)
+test('test_crypto_eddsa', testcrypto_eddsa,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_ecdh_eddsa = executable ('test_crypto_ecdh_eddsa',
+                                    ['test_crypto_ecdh_eddsa.c'],
+                                    dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                    include_directories: [incdir, configuration_inc],
+                                    build_by_default: false,
+                                    install: false)
+test('test_crypto_ecdh_eddsa', testcrypto_ecdh_eddsa,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_ecdh_ecdsa = executable ('test_crypto_ecdh_ecdsa',
+                                    ['test_crypto_ecdh_ecdsa.c'],
+                                    dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                    include_directories: [incdir, configuration_inc],
+                                    build_by_default: false,
+                                    install: false)
+test('test_crypto_ecdh_ecdsa', testcrypto_ecdh_ecdsa,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_edx25519 = executable ('test_crypto_edx25519',
+                                  ['test_crypto_edx25519.c'],
+                                  dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                  include_directories: [incdir, configuration_inc],
+                                  build_by_default: false,
+                                  install: false)
+test('test_crypto_edx25519', testcrypto_edx25519,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_ecc_dlog = executable ('test_crypto_ecc_dlog',
+                                  ['test_crypto_ecc_dlog.c'],
+                                  dependencies: [gcrypt_dep, sodium_dep, libgnunetutil_dep],
+                                  include_directories: [incdir, configuration_inc],
+                                  build_by_default: false,
+                                  install: false)
+test('test_crypto_ecc_dlog', testcrypto_ecc_dlog,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_elligator = executable ('test_crypto_elligator',
+            ['test_crypto_elligator.c'],
+            dependencies: [gcrypt_dep, libgnunetutil_dep, lgmp_dep, sodium_dep],
+            include_directories: [incdir, configuration_inc],
+            build_by_default: false,
+            install: false)
+test('test_crypto_elligator', testcrypto_elligator,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_hash = executable ('test_crypto_hash',
+                              ['test_crypto_hash.c'],
+                              dependencies: [gcrypt_dep, libgnunetutil_dep],
+                              include_directories: [incdir, configuration_inc],
+                              build_by_default: false,
+                              install: false)
+test('test_crypto_hash', testcrypto_hash,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_hash_context = executable ('test_crypto_hash_context',
+                                      ['test_crypto_hash_context.c'],
+                                      dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                      include_directories: [incdir, configuration_inc],
+                                      build_by_default: false,
+                                      install: false)
+test('test_crypto_hash_context', testcrypto_hash_context,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_hkdf = executable ('test_crypto_hkdf',
+                              ['test_crypto_hkdf.c'],
+                              dependencies: [gcrypt_dep, libgnunetutil_dep],
+                              include_directories: [incdir, configuration_inc],
+                              build_by_default: false,
+                              install: false)
+test('test_crypto_hkdf', testcrypto_hkdf,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_kdf = executable ('test_crypto_kdf',
+                             ['test_crypto_kdf.c'],
+                             dependencies: [gcrypt_dep, libgnunetutil_dep],
+                             include_directories: [incdir, configuration_inc],
+                             build_by_default: false,
+                             install: false)
+test('test_crypto_kdf', testcrypto_kdf,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_paillier = executable ('test_crypto_paillier',
+                                  ['test_crypto_paillier.c'],
+                                  dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                  include_directories: [incdir, configuration_inc],
+                                  build_by_default: false,
+                                  install: false)
+test('test_crypto_paillier', testcrypto_paillier,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_random = executable ('test_crypto_random',
+                                ['test_crypto_random.c'],
+                                dependencies: [gcrypt_dep, libgnunetutil_dep],
+                                include_directories: [incdir, configuration_inc],
+                                build_by_default: false,
+                                install: false)
+test('test_crypto_random', testcrypto_random,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testcrypto_rsa = executable ('test_crypto_rsa',
+                             ['test_crypto_rsa.c'],
+                             dependencies: [gcrypt_dep, libgnunetutil_dep],
+                             include_directories: [incdir, configuration_inc],
+                             build_by_default: false,
+                             install: false)
+test('test_crypto_rsa', testcrypto_rsa,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-crypto'])
+
+testdisk = executable ('test_disk',
+                       ['test_disk.c'],
+                       dependencies: [libgnunetutil_dep],
+                       include_directories: [incdir, configuration_inc],
+                       build_by_default: false,
+                       install: false)
+test('test_disk', testdisk,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testgetopt = executable ('test_getopt',
+                         ['test_getopt.c'],
+                         dependencies: [libgnunetutil_dep],
+                         include_directories: [incdir, configuration_inc],
+                         build_by_default: false,
+                         install: false)
+test('test_getopt', testgetopt,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testhexcoder = executable ('test_hexcoder',
+                           ['test_hexcoder.c'],
+                           dependencies: [libgnunetutil_dep],
+                           include_directories: [incdir, configuration_inc],
+                           build_by_default: false,
+                           install: false)
+test('test_hexcoder', testhexcoder,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testmq = executable ('test_mq',
+                     ['test_mq.c'],
+                     dependencies: [libgnunetutil_dep],
+                     include_directories: [incdir, configuration_inc],
+                     build_by_default: false,
+                     install: false)
+test('test_mq', testmq,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testos_network = executable ('test_os_network',
+                             ['test_os_network.c'],
+                             dependencies: [libgnunetutil_dep],
+                             include_directories: [incdir, configuration_inc],
+                             build_by_default: false,
+                             install: false)
+test('test_os_network', testos_network,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-os'])
+
+testpeer = executable ('test_peer',
+                       ['test_peer.c'],
+                       dependencies: [gcrypt_dep, libgnunetutil_dep],
+                       include_directories: [incdir, configuration_inc],
+                       build_by_default: false,
+                       install: false)
+test('test_peer', testpeer,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testplugin_plug = shared_module ('gnunet_plugin_utiltest',
+                                 ['test_plugin_plug.c'],
+                                 dependencies: [libgnunetutil_dep],
+                                 include_directories: [incdir, configuration_inc],
+                                 build_by_default: false,
+                                 install: false)
+testplugin = executable ('test_plugin',
+                         ['test_plugin.c'],
+                         dependencies: [libgnunetutil_dep],
+                         include_directories: [incdir, configuration_inc],
+                         build_by_default: false,
+                         install: false)
+test('test_plugin', testplugin,
+     depends: [testplugin_plug],
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testprogram = executable ('test_program',
+                          ['test_program.c'],
+                          dependencies: [libgnunetutil_dep],
+                          include_directories: [incdir, configuration_inc],
+                          build_by_default: false,
+                          install: false)
+test('test_program', testprogram,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testregex = executable ('test_regex',
+                        ['test_regex.c'],
+                        dependencies: [libgnunetutil_dep],
+                        include_directories: [incdir, configuration_inc],
+                        build_by_default: false,
+                        install: false)
+test('test_regex', testregex,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+# test_resolver_api.nc
+
+testscheduler = executable ('test_scheduler',
+                            ['test_scheduler.c'],
+                            dependencies: [libgnunetutil_dep],
+                            include_directories: [incdir, configuration_inc],
+                            build_by_default: false,
+                            install: false)
+test('test_scheduler', testscheduler,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-scheduler'])
+
+testscheduler_delay = executable ('test_scheduler_delay',
+                                  ['test_scheduler_delay.c'],
+                                  dependencies: [libgnunetutil_dep],
+                                  include_directories: [incdir, configuration_inc],
+                                  build_by_default: false,
+                                  install: false)
+test('test_scheduler_delay', testscheduler_delay,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-scheduler'])
+
+testscheduler_hogging_cancel = executable ('test_scheduler_hogging_cancel',
+                                           ['test_scheduler_hogging_cancel.c'],
+                                           dependencies: [libgnunetutil_dep],
+                                           include_directories: [incdir, configuration_inc],
+                                           build_by_default: false,
+                                           install: false)
+test('test_scheduler_hogging_cancel', testscheduler_hogging_cancel,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-scheduler'])
+
+testscheduler_hogging_prio = executable ('test_scheduler_hogging_priority',
+                                         ['test_scheduler_hogging_priority.c'],
+                                         dependencies: [libgnunetutil_dep],
+                                         include_directories: [incdir, configuration_inc],
+                                         build_by_default: false,
+                                         install: false)
+test('test_scheduler_hogging_priority', testscheduler_hogging_prio,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-scheduler'])
+
+testservice = executable ('test_service',
+                          ['test_service.c'],
+                          dependencies: [libgnunetutil_dep],
+                          include_directories: [incdir, configuration_inc],
+                          build_by_default: false,
+                          install: false)
+test('test_service', testservice,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+teststrings = executable ('test_strings',
+                          ['test_strings.c'],
+                          dependencies: [libgnunetutil_dep],
+                          include_directories: [incdir, configuration_inc],
+                          build_by_default: false,
+                          install: false)
+test('test_strings', teststrings,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-strings'])
+
+teststrings_todata = executable ('test_strings_to_data',
+                                 ['test_strings_to_data.c'],
+                                 dependencies: [libgnunetutil_dep],
+                                 include_directories: [incdir, configuration_inc],
+                                 build_by_default: false,
+                                 install: false)
+test('test_strings_to_data', teststrings_todata,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-strings'])
+
+testspeedup = executable ('test_speedup',
+                          ['test_speedup.c'],
+                          dependencies: [libgnunetutil_dep],
+                          include_directories: [incdir, configuration_inc],
+                          build_by_default: false,
+                          install: false)
+test('test_speedup', testspeedup,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testtime = executable ('test_time',
+                       ['test_time.c'],
+                       dependencies: [libgnunetutil_dep],
+                       include_directories: [incdir, configuration_inc],
+                       build_by_default: false,
+                       install: false)
+test('test_time', testtime,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testtun = executable ('test_tun',
+                      ['test_tun.c'],
+                      dependencies: [libgnunetutil_dep],
+                      include_directories: [incdir, configuration_inc],
+                      build_by_default: false,
+                      install: false)
+test('test_tun', testtun,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testuri = executable ('test_uri',
+                      ['test_uri.c'],
+                      dependencies: [libgnunetutil_dep],
+                      include_directories: [incdir, configuration_inc],
+                      build_by_default: false,
+                      install: false)
+test('test_uri', testuri,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-misc'])
+
+testos_start_process = executable ('test_os_start_process',
+                                   ['test_os_start_process.c'],
+                                   dependencies: [libgnunetutil_dep],
+                                   include_directories: [incdir, configuration_inc],
+                                   build_by_default: false,
+                                   install: false)
+test('test_os_start_process', testos_start_process,
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-os'])
+
+testcommon_logging_runtime = executable ('test_common_logging_runtime_loglevels',
+                                         ['test_common_logging_runtime_loglevels.c'],
+                                         dependencies: [libgnunetutil_dep],
+                                         include_directories: [incdir, configuration_inc],
+                                         build_by_default: false,
+                                         install: false)
+test('test_common_logging_runtime_loglevels', testcommon_logging_runtime,
+     depends: [logging_dummy],
+     workdir: meson.current_build_dir(),
+     suite: ['util', 'util-common'])
+
+testutil_perf = [
+  'perf_crypto_asymmetric',
+  # 'perf_crypto_cs', FIXME FTBFS
+  'perf_crypto_ecc_dlog',
+  'perf_crypto_hash',
+  'perf_crypto_paillier',
+  'perf_crypto_rsa',
+  'perf_crypto_symmetric',
+  'perf_malloc',
+  'perf_mq',
+  'perf_scheduler',
+]
+
+foreach t : testutil_perf
+
+  test_filename = t + '.sh'
+  testbin = executable(t, [t + '.c'],
+                       dependencies: [libgnunetutil_dep, gcrypt_dep, sodium_dep],
+                       include_directories: [incdir, configuration_inc],
+                       build_by_default: false,
+                       install: false)
+  test(t, testbin, suite: ['util', 'perf'],
+       workdir: meson.current_build_dir())
+endforeach
diff --git a/src/lib/util/mq.c b/src/lib/util/mq.c
new file mode 100644
index 000000000..de0cff0c2
--- /dev/null
+++ b/src/lib/util/mq.c
@@ -0,0 +1,1030 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012-2019 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Florian Dold
+ * @file util/mq.c
+ * @brief general purpose request queue
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-mq", __VA_ARGS__)
+
+
+struct GNUNET_MQ_Envelope
+{
+  /**
+   * Messages are stored in a linked list.
+   * Each queue has its own list of envelopes.
+   */
+  struct GNUNET_MQ_Envelope *next;
+
+  /**
+   * Messages are stored in a linked list
+   * Each queue has its own list of envelopes.
+   */
+  struct GNUNET_MQ_Envelope *prev;
+
+  /**
+   * Actual allocated message header.
+   * The GNUNET_MQ_Envelope header is allocated at
+   * the end of the message.
+   */
+  struct GNUNET_MessageHeader *mh;
+
+  /**
+   * Queue the message is queued in, NULL if message is not queued.
+   */
+  struct GNUNET_MQ_Handle *parent_queue;
+
+  /**
+   * Called after the message was sent irrevocably.
+   */
+  GNUNET_SCHEDULER_TaskCallback sent_cb;
+
+  /**
+   * Closure for @e send_cb
+   */
+  void *sent_cls;
+
+  /**
+   * Flags that were set for this envelope by
+   * #GNUNET_MQ_env_set_options().   Only valid if
+   * @e have_custom_options is set.
+   */
+  enum GNUNET_MQ_PriorityPreferences priority;
+
+  /**
+   * Did the application call #GNUNET_MQ_env_set_options()?
+   */
+  int have_custom_options;
+};
+
+
+/**
+ * Handle to a message queue.
+ */
+struct GNUNET_MQ_Handle
+{
+  /**
+   * Handlers array, or NULL if the queue should not receive messages
+   */
+  struct GNUNET_MQ_MessageHandler *handlers;
+
+  /**
+   * Actual implementation of message sending,
+   * called when a message is added
+   */
+  GNUNET_MQ_SendImpl send_impl;
+
+  /**
+   * Implementation-dependent queue destruction function
+   */
+  GNUNET_MQ_DestroyImpl destroy_impl;
+
+  /**
+   * Implementation-dependent send cancel function
+   */
+  GNUNET_MQ_CancelImpl cancel_impl;
+
+  /**
+   * Implementation-specific state
+   */
+  void *impl_state;
+
+  /**
+   * Callback will be called when an error occurs.
+   */
+  GNUNET_MQ_ErrorHandler error_handler;
+
+  /**
+   * Closure for the error handler.
+   */
+  void *error_handler_cls;
+
+  /**
+   * Task to asynchronously run #impl_send_continue().
+   */
+  struct GNUNET_SCHEDULER_Task *send_task;
+
+  /**
+   * Linked list of messages pending to be sent
+   */
+  struct GNUNET_MQ_Envelope *envelope_head;
+
+  /**
+   * Linked list of messages pending to be sent
+   */
+  struct GNUNET_MQ_Envelope *envelope_tail;
+
+  /**
+   * Message that is currently scheduled to be
+   * sent. Not the head of the message queue, as the implementation
+   * needs to know if sending has been already scheduled or not.
+   */
+  struct GNUNET_MQ_Envelope *current_envelope;
+
+  /**
+   * Map of associations, lazily allocated
+   */
+  struct GNUNET_CONTAINER_MultiHashMap32 *assoc_map;
+
+  /**
+   * Functions to call on queue destruction; kept in a DLL.
+   */
+  struct GNUNET_MQ_DestroyNotificationHandle *dnh_head;
+
+  /**
+   * Functions to call on queue destruction; kept in a DLL.
+   */
+  struct GNUNET_MQ_DestroyNotificationHandle *dnh_tail;
+
+  /**
+   * Flags that were set for this queue by
+   * #GNUNET_MQ_set_options().   Default is 0.
+   */
+  enum GNUNET_MQ_PriorityPreferences priority;
+
+  /**
+   * Next id that should be used for the @e assoc_map,
+   * initialized lazily to a random value together with
+   * @e assoc_map
+   */
+  uint32_t assoc_id;
+
+  /**
+   * Number of entries we have in the envelope-DLL.
+   */
+  unsigned int queue_length;
+
+  /**
+   * True if GNUNET_MQ_impl_send_in_flight() was called.
+   */
+  bool in_flight;
+};
+
+
+void
+GNUNET_MQ_inject_message (struct GNUNET_MQ_Handle *mq,
+                          const struct GNUNET_MessageHeader *mh)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  ret = GNUNET_MQ_handle_message (mq->handlers,
+                                  mh);
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_break_op (0);
+    GNUNET_MQ_inject_error (mq,
+                            GNUNET_MQ_ERROR_MALFORMED);
+    return;
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_MQ_handle_message (const struct GNUNET_MQ_MessageHandler *handlers,
+                          const struct GNUNET_MessageHeader *mh)
+{
+  bool handled = false;
+  uint16_t msize = ntohs (mh->size);
+  uint16_t mtype = ntohs (mh->type);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received message of type %u and size %u\n",
+       mtype,
+       msize);
+  if (NULL == handlers)
+    goto done;
+  for (const struct GNUNET_MQ_MessageHandler *handler = handlers;
+       NULL != handler->cb;
+       handler++)
+  {
+    if (handler->type == mtype)
+    {
+      handled = true;
+      if ( (handler->expected_size > msize) ||
+           ( (handler->expected_size != msize) &&
+             (NULL == handler->mv) ) )
+      {
+        /* Too small, or not an exact size and
+           no 'mv' handler to check rest */
+        LOG (GNUNET_ERROR_TYPE_ERROR,
+             "Received malformed message of type %u\n",
+             (unsigned int) handler->type);
+        return GNUNET_SYSERR;
+      }
+      if ( (NULL == handler->mv) ||
+           (GNUNET_OK ==
+            handler->mv (handler->cls,
+                         mh)) )
+      {
+        /* message well-formed, pass to handler */
+        handler->cb (handler->cls, mh);
+      }
+      else
+      {
+        /* Message rejected by check routine */
+        LOG (GNUNET_ERROR_TYPE_ERROR,
+             "Received malformed message of type %u\n",
+             (unsigned int) handler->type);
+        return GNUNET_SYSERR;
+      }
+      break;
+    }
+  }
+done:
+  if (! handled)
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         "No handler for message of type %u and size %u\n",
+         mtype,
+         msize);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_MQ_inject_error (struct GNUNET_MQ_Handle *mq,
+                        enum GNUNET_MQ_Error error)
+{
+  if (NULL == mq->error_handler)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Got error %d, but no handler installed\n",
+         (int) error);
+    return;
+  }
+  mq->error_handler (mq->error_handler_cls,
+                     error);
+}
+
+
+void
+GNUNET_MQ_discard (struct GNUNET_MQ_Envelope *ev)
+{
+  GNUNET_assert (NULL == ev->parent_queue);
+  GNUNET_free (ev);
+}
+
+
+unsigned int
+GNUNET_MQ_get_length (struct GNUNET_MQ_Handle *mq)
+{
+  if (! mq->in_flight)
+  {
+    return mq->queue_length;
+  }
+  return mq->queue_length - 1;
+}
+
+
+void
+GNUNET_MQ_send (struct GNUNET_MQ_Handle *mq,
+                struct GNUNET_MQ_Envelope *ev)
+{
+  GNUNET_assert (NULL != mq);
+  GNUNET_assert (NULL == ev->parent_queue);
+
+  mq->queue_length++;
+  if (mq->queue_length >= 10000000)
+  {
+    /* This would seem like a bug... */
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "MQ with %u entries extended by message of type %u (FC broken?)\n",
+                (unsigned int) mq->queue_length,
+                (unsigned int) ntohs (ev->mh->type));
+  }
+  ev->parent_queue = mq;
+  /* is the implementation busy? queue it! */
+  if ((NULL != mq->current_envelope) || (NULL != mq->send_task))
+  {
+    GNUNET_CONTAINER_DLL_insert_tail (mq->envelope_head,
+                                      mq->envelope_tail,
+                                      ev);
+    return;
+  }
+  GNUNET_assert (NULL == mq->envelope_head);
+  mq->current_envelope = ev;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sending message of type %u and size %u, queue empty (MQ: %p)\n",
+       ntohs (ev->mh->type),
+       ntohs (ev->mh->size),
+       mq);
+
+  mq->send_impl (mq,
+                 ev->mh,
+                 mq->impl_state);
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_unsent_head (struct GNUNET_MQ_Handle *mq)
+{
+  struct GNUNET_MQ_Envelope *env;
+
+  env = mq->envelope_head;
+  GNUNET_CONTAINER_DLL_remove (mq->envelope_head,
+                               mq->envelope_tail,
+                               env);
+  mq->queue_length--;
+  env->parent_queue = NULL;
+  return env;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_env_copy (struct GNUNET_MQ_Envelope *env)
+{
+  GNUNET_assert (NULL == env->next);
+  GNUNET_assert (NULL == env->parent_queue);
+  GNUNET_assert (NULL == env->sent_cb);
+  GNUNET_assert (GNUNET_NO == env->have_custom_options);
+  return GNUNET_MQ_msg_copy (env->mh);
+}
+
+
+void
+GNUNET_MQ_send_copy (struct GNUNET_MQ_Handle *mq,
+                     const struct GNUNET_MQ_Envelope *ev)
+{
+  struct GNUNET_MQ_Envelope *env;
+  uint16_t msize;
+
+  msize = ntohs (ev->mh->size);
+  env = GNUNET_malloc (sizeof(struct GNUNET_MQ_Envelope) + msize);
+  env->mh = (struct GNUNET_MessageHeader *) &env[1];
+  env->sent_cb = ev->sent_cb;
+  env->sent_cls = ev->sent_cls;
+  GNUNET_memcpy (&env[1], ev->mh, msize);
+  GNUNET_MQ_send (mq, env);
+}
+
+
+/**
+ * Task run to call the send implementation for the next queued
+ * message, if any.  Only useful for implementing message queues,
+ * results in undefined behavior if not used carefully.
+ *
+ * @param cls message queue to send the next message with
+ */
+static void
+impl_send_continue (void *cls)
+{
+  struct GNUNET_MQ_Handle *mq = cls;
+
+  mq->send_task = NULL;
+  /* call is only valid if we're actually currently sending
+   * a message */
+  if (NULL == mq->envelope_head)
+    return;
+  mq->current_envelope = mq->envelope_head;
+  GNUNET_CONTAINER_DLL_remove (mq->envelope_head,
+                               mq->envelope_tail,
+                               mq->current_envelope);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sending message of type %u and size %u from queue (MQ: %p)\n",
+       ntohs (mq->current_envelope->mh->type),
+       ntohs (mq->current_envelope->mh->size),
+       mq);
+
+  mq->send_impl (mq,
+                 mq->current_envelope->mh,
+                 mq->impl_state);
+}
+
+
+void
+GNUNET_MQ_impl_send_continue (struct GNUNET_MQ_Handle *mq)
+{
+  struct GNUNET_MQ_Envelope *current_envelope;
+  GNUNET_SCHEDULER_TaskCallback cb;
+
+  GNUNET_assert (0 < mq->queue_length);
+  mq->queue_length--;
+  mq->in_flight = false;
+  current_envelope = mq->current_envelope;
+  current_envelope->parent_queue = NULL;
+  mq->current_envelope = NULL;
+  GNUNET_assert (NULL == mq->send_task);
+  mq->send_task = GNUNET_SCHEDULER_add_now (&impl_send_continue, mq);
+  if (NULL != (cb = current_envelope->sent_cb))
+  {
+    current_envelope->sent_cb = NULL;
+    cb (current_envelope->sent_cls);
+  }
+  GNUNET_free (current_envelope);
+}
+
+
+void
+GNUNET_MQ_impl_send_in_flight (struct GNUNET_MQ_Handle *mq)
+{
+  struct GNUNET_MQ_Envelope *current_envelope;
+  GNUNET_SCHEDULER_TaskCallback cb;
+
+  mq->in_flight = true;
+  /* call is only valid if we're actually currently sending
+   * a message */
+  current_envelope = mq->current_envelope;
+  GNUNET_assert (NULL != current_envelope);
+  /* can't call cancel from now on anymore */
+  current_envelope->parent_queue = NULL;
+  if (NULL != (cb = current_envelope->sent_cb))
+  {
+    current_envelope->sent_cb = NULL;
+    cb (current_envelope->sent_cls);
+  }
+}
+
+
+struct GNUNET_MQ_Handle *
+GNUNET_MQ_queue_for_callbacks (GNUNET_MQ_SendImpl send,
+                               GNUNET_MQ_DestroyImpl destroy,
+                               GNUNET_MQ_CancelImpl cancel,
+                               void *impl_state,
+                               const struct GNUNET_MQ_MessageHandler *handlers,
+                               GNUNET_MQ_ErrorHandler error_handler,
+                               void *error_handler_cls)
+{
+  struct GNUNET_MQ_Handle *mq;
+
+  mq = GNUNET_new (struct GNUNET_MQ_Handle);
+  mq->send_impl = send;
+  mq->destroy_impl = destroy;
+  mq->cancel_impl = cancel;
+  mq->handlers = GNUNET_MQ_copy_handlers (handlers);
+  mq->error_handler = error_handler;
+  mq->error_handler_cls = error_handler_cls;
+  mq->impl_state = impl_state;
+
+  return mq;
+}
+
+
+void
+GNUNET_MQ_set_handlers_closure (struct GNUNET_MQ_Handle *mq,
+                                void *handlers_cls)
+{
+  if (NULL == mq->handlers)
+    return;
+  for (unsigned int i = 0; NULL != mq->handlers[i].cb; i++)
+    mq->handlers[i].cls = handlers_cls;
+}
+
+
+const struct GNUNET_MessageHeader *
+GNUNET_MQ_impl_current (struct GNUNET_MQ_Handle *mq)
+{
+  GNUNET_assert (NULL != mq->current_envelope);
+  GNUNET_assert (NULL != mq->current_envelope->mh);
+  return mq->current_envelope->mh;
+}
+
+
+void *
+GNUNET_MQ_impl_state (struct GNUNET_MQ_Handle *mq)
+{
+  return mq->impl_state;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_msg_ (struct GNUNET_MessageHeader **mhp,
+                uint16_t size,
+                uint16_t type)
+{
+  struct GNUNET_MQ_Envelope *ev;
+
+  ev = GNUNET_malloc (size + sizeof(struct GNUNET_MQ_Envelope));
+  ev->mh = (struct GNUNET_MessageHeader *) &ev[1];
+  ev->mh->size = htons (size);
+  ev->mh->type = htons (type);
+  if (NULL != mhp)
+    *mhp = ev->mh;
+  return ev;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_msg_copy (const struct GNUNET_MessageHeader *hdr)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  uint16_t size = ntohs (hdr->size);
+
+  mqm = GNUNET_malloc (sizeof(*mqm) + size);
+  mqm->mh = (struct GNUNET_MessageHeader *) &mqm[1];
+  GNUNET_memcpy (mqm->mh,
+                 hdr,
+                 size);
+  return mqm;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_msg_nested_mh_ (struct GNUNET_MessageHeader **mhp,
+                          uint16_t base_size,
+                          uint16_t type,
+                          const struct GNUNET_MessageHeader *nested_mh)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  uint16_t size;
+
+  if (NULL == nested_mh)
+    return GNUNET_MQ_msg_ (mhp,
+                           base_size,
+                           type);
+  size = base_size + ntohs (nested_mh->size);
+  /* check for uint16_t overflow */
+  if (size < base_size)
+    return NULL;
+  mqm = GNUNET_MQ_msg_ (mhp,
+                        size,
+                        type);
+  GNUNET_memcpy ((char *) mqm->mh + base_size,
+                 nested_mh,
+                 ntohs (nested_mh->size));
+  return mqm;
+}
+
+
+uint32_t
+GNUNET_MQ_assoc_add (struct GNUNET_MQ_Handle *mq,
+                     void *assoc_data)
+{
+  uint32_t id;
+
+  if (NULL == mq->assoc_map)
+  {
+    mq->assoc_map = GNUNET_CONTAINER_multihashmap32_create (8);
+    mq->assoc_id = 1;
+  }
+  id = mq->assoc_id++;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap32_put (
+                   mq->assoc_map,
+                   id,
+                   assoc_data,
+                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  return id;
+}
+
+
+/**
+ * Get the data associated with a @a request_id in a queue
+ *
+ * @param mq the message queue with the association
+ * @param request_id the request id we are interested in
+ * @return the associated data
+ */
+void *
+GNUNET_MQ_assoc_get (struct GNUNET_MQ_Handle *mq,
+                     uint32_t request_id)
+{
+  if (NULL == mq->assoc_map)
+    return NULL;
+  return GNUNET_CONTAINER_multihashmap32_get (mq->assoc_map,
+                                              request_id);
+}
+
+
+/**
+ * Remove the association for a @a request_id
+ *
+ * @param mq the message queue with the association
+ * @param request_id the request id we want to remove
+ * @return the associated data
+ */
+void *
+GNUNET_MQ_assoc_remove (struct GNUNET_MQ_Handle *mq,
+                        uint32_t request_id)
+{
+  void *val;
+
+  if (NULL == mq->assoc_map)
+    return NULL;
+  val = GNUNET_CONTAINER_multihashmap32_get (mq->assoc_map,
+                                             request_id);
+  GNUNET_CONTAINER_multihashmap32_remove_all (mq->assoc_map,
+                                              request_id);
+  return val;
+}
+
+
+void
+GNUNET_MQ_notify_sent (struct GNUNET_MQ_Envelope *ev,
+                       GNUNET_SCHEDULER_TaskCallback cb,
+                       void *cb_cls)
+{
+  /* allow setting *OR* clearing callback */
+  GNUNET_assert ((NULL == ev->sent_cb) || (NULL == cb));
+  ev->sent_cb = cb;
+  ev->sent_cls = cb_cls;
+}
+
+
+/**
+ * Handle we return for callbacks registered to be
+ * notified when #GNUNET_MQ_destroy() is called on a queue.
+ */
+struct GNUNET_MQ_DestroyNotificationHandle
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_MQ_DestroyNotificationHandle *prev;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_MQ_DestroyNotificationHandle *next;
+
+  /**
+   * Queue to notify about.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Function to call.
+   */
+  GNUNET_SCHEDULER_TaskCallback cb;
+
+  /**
+   * Closure for @e cb.
+   */
+  void *cb_cls;
+};
+
+
+void
+GNUNET_MQ_destroy (struct GNUNET_MQ_Handle *mq)
+{
+  struct GNUNET_MQ_DestroyNotificationHandle *dnh;
+
+  if (NULL != mq->destroy_impl)
+  {
+    mq->destroy_impl (mq, mq->impl_state);
+  }
+  if (NULL != mq->send_task)
+  {
+    GNUNET_SCHEDULER_cancel (mq->send_task);
+    mq->send_task = NULL;
+  }
+  while (NULL != mq->envelope_head)
+  {
+    struct GNUNET_MQ_Envelope *ev;
+
+    ev = mq->envelope_head;
+    ev->parent_queue = NULL;
+    GNUNET_CONTAINER_DLL_remove (mq->envelope_head, mq->envelope_tail, ev);
+    GNUNET_assert (0 < mq->queue_length);
+    mq->queue_length--;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "MQ destroy drops message of type %u\n",
+         ntohs (ev->mh->type));
+    GNUNET_MQ_discard (ev);
+  }
+  if (NULL != mq->current_envelope)
+  {
+    /* we can only discard envelopes that
+     * are not queued! */
+    mq->current_envelope->parent_queue = NULL;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "MQ destroy drops current message of type %u\n",
+         ntohs (mq->current_envelope->mh->type));
+    GNUNET_MQ_discard (mq->current_envelope);
+    mq->current_envelope = NULL;
+    GNUNET_assert (0 < mq->queue_length);
+    mq->queue_length--;
+  }
+  GNUNET_assert (0 == mq->queue_length);
+  while (NULL != (dnh = mq->dnh_head))
+  {
+    dnh->cb (dnh->cb_cls);
+    GNUNET_MQ_destroy_notify_cancel (dnh);
+  }
+  if (NULL != mq->assoc_map)
+  {
+    GNUNET_CONTAINER_multihashmap32_destroy (mq->assoc_map);
+    mq->assoc_map = NULL;
+  }
+  GNUNET_free (mq->handlers);
+  GNUNET_free (mq);
+}
+
+
+const struct GNUNET_MessageHeader *
+GNUNET_MQ_extract_nested_mh_ (const struct GNUNET_MessageHeader *mh,
+                              uint16_t base_size)
+{
+  uint16_t whole_size;
+  uint16_t nested_size;
+  const struct GNUNET_MessageHeader *nested_msg;
+
+  whole_size = ntohs (mh->size);
+  GNUNET_assert (whole_size >= base_size);
+  nested_size = whole_size - base_size;
+  if (0 == nested_size)
+    return NULL;
+  if (nested_size < sizeof(struct GNUNET_MessageHeader))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  nested_msg = (const struct GNUNET_MessageHeader *) ((char *) mh + base_size);
+  if (ntohs (nested_msg->size) != nested_size)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  return nested_msg;
+}
+
+
+void
+GNUNET_MQ_send_cancel (struct GNUNET_MQ_Envelope *ev)
+{
+  struct GNUNET_MQ_Handle *mq = ev->parent_queue;
+
+  GNUNET_assert (NULL != mq);
+  GNUNET_assert (NULL != mq->cancel_impl);
+  GNUNET_assert (0 < mq->queue_length);
+  mq->queue_length--;
+  if (mq->current_envelope == ev)
+  {
+    /* complex case, we already started with transmitting
+       the message using the callbacks. */
+    GNUNET_assert (! mq->in_flight);
+    mq->cancel_impl (mq,
+                     mq->impl_state);
+    /* continue sending the next message, if any */
+    mq->current_envelope = mq->envelope_head;
+    if (NULL != mq->current_envelope)
+    {
+      GNUNET_CONTAINER_DLL_remove (mq->envelope_head,
+                                   mq->envelope_tail,
+                                   mq->current_envelope);
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "sending canceled message of type %u queue\n",
+           ntohs (ev->mh->type));
+      mq->send_impl (mq,
+                     mq->current_envelope->mh,
+                     mq->impl_state);
+    }
+  }
+  else
+  {
+    /* simple case, message is still waiting in the queue */
+    GNUNET_CONTAINER_DLL_remove (mq->envelope_head,
+                                 mq->envelope_tail,
+                                 ev);
+  }
+  ev->parent_queue = NULL;
+  ev->mh = NULL;
+  /* also frees ev */
+  GNUNET_free (ev);
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_get_current_envelope (struct GNUNET_MQ_Handle *mq)
+{
+  return mq->current_envelope;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_MQ_get_last_envelope (struct GNUNET_MQ_Handle *mq)
+{
+  if (NULL != mq->envelope_tail)
+    return mq->envelope_tail;
+
+  return mq->current_envelope;
+}
+
+
+void
+GNUNET_MQ_env_set_options (struct GNUNET_MQ_Envelope *env,
+                           enum GNUNET_MQ_PriorityPreferences pp)
+{
+  env->priority = pp;
+  env->have_custom_options = GNUNET_YES;
+}
+
+
+enum GNUNET_MQ_PriorityPreferences
+GNUNET_MQ_env_get_options (struct GNUNET_MQ_Envelope *env)
+{
+  struct GNUNET_MQ_Handle *mq = env->parent_queue;
+
+  if (GNUNET_YES == env->have_custom_options)
+    return env->priority;
+  if (NULL == mq)
+    return 0;
+  return mq->priority;
+}
+
+
+enum GNUNET_MQ_PriorityPreferences
+GNUNET_MQ_env_combine_options (enum GNUNET_MQ_PriorityPreferences p1,
+                               enum GNUNET_MQ_PriorityPreferences p2)
+{
+  enum GNUNET_MQ_PriorityPreferences ret;
+
+  ret = GNUNET_MAX (p1 & GNUNET_MQ_PRIORITY_MASK, p2 & GNUNET_MQ_PRIORITY_MASK);
+  ret |= ((p1 & GNUNET_MQ_PREF_UNRELIABLE) & (p2 & GNUNET_MQ_PREF_UNRELIABLE));
+  ret |=
+    ((p1 & GNUNET_MQ_PREF_LOW_LATENCY) | (p2 & GNUNET_MQ_PREF_LOW_LATENCY));
+  ret |=
+    ((p1 & GNUNET_MQ_PREF_CORK_ALLOWED) & (p2 & GNUNET_MQ_PREF_CORK_ALLOWED));
+  ret |= ((p1 & GNUNET_MQ_PREF_GOODPUT) & (p2 & GNUNET_MQ_PREF_GOODPUT));
+  ret |=
+    ((p1 & GNUNET_MQ_PREF_OUT_OF_ORDER) & (p2 & GNUNET_MQ_PREF_OUT_OF_ORDER));
+  return ret;
+}
+
+
+void
+GNUNET_MQ_set_options (struct GNUNET_MQ_Handle *mq,
+                       enum GNUNET_MQ_PriorityPreferences pp)
+{
+  mq->priority = pp;
+}
+
+
+const struct GNUNET_MessageHeader *
+GNUNET_MQ_env_get_msg (const struct GNUNET_MQ_Envelope *env)
+{
+  return env->mh;
+}
+
+
+const struct GNUNET_MQ_Envelope *
+GNUNET_MQ_env_next (const struct GNUNET_MQ_Envelope *env)
+{
+  return env->next;
+}
+
+
+struct GNUNET_MQ_DestroyNotificationHandle *
+GNUNET_MQ_destroy_notify (struct GNUNET_MQ_Handle *mq,
+                          GNUNET_SCHEDULER_TaskCallback cb,
+                          void *cb_cls)
+{
+  struct GNUNET_MQ_DestroyNotificationHandle *dnh;
+
+  dnh = GNUNET_new (struct GNUNET_MQ_DestroyNotificationHandle);
+  dnh->mq = mq;
+  dnh->cb = cb;
+  dnh->cb_cls = cb_cls;
+  GNUNET_CONTAINER_DLL_insert (mq->dnh_head,
+                               mq->dnh_tail,
+                               dnh);
+  return dnh;
+}
+
+
+void
+GNUNET_MQ_destroy_notify_cancel (
+  struct GNUNET_MQ_DestroyNotificationHandle *dnh)
+{
+  struct GNUNET_MQ_Handle *mq = dnh->mq;
+
+  GNUNET_CONTAINER_DLL_remove (mq->dnh_head,
+                               mq->dnh_tail,
+                               dnh);
+  GNUNET_free (dnh);
+}
+
+
+void
+GNUNET_MQ_dll_insert_head (struct GNUNET_MQ_Envelope **env_head,
+                           struct GNUNET_MQ_Envelope **env_tail,
+                           struct GNUNET_MQ_Envelope *env)
+{
+  GNUNET_CONTAINER_DLL_insert (*env_head,
+                               *env_tail,
+                               env);
+}
+
+
+void
+GNUNET_MQ_dll_insert_tail (struct GNUNET_MQ_Envelope **env_head,
+                           struct GNUNET_MQ_Envelope **env_tail,
+                           struct GNUNET_MQ_Envelope *env)
+{
+  GNUNET_CONTAINER_DLL_insert_tail (*env_head,
+                                    *env_tail,
+                                    env);
+}
+
+
+void
+GNUNET_MQ_dll_remove (struct GNUNET_MQ_Envelope **env_head,
+                      struct GNUNET_MQ_Envelope **env_tail,
+                      struct GNUNET_MQ_Envelope *env)
+{
+  GNUNET_CONTAINER_DLL_remove (*env_head,
+                               *env_tail,
+                               env);
+}
+
+
+struct GNUNET_MQ_MessageHandler *
+GNUNET_MQ_copy_handlers (const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct GNUNET_MQ_MessageHandler *copy;
+  unsigned int count;
+
+  if (NULL == handlers)
+    return NULL;
+  count = GNUNET_MQ_count_handlers (handlers);
+  copy = GNUNET_new_array (count + 1,
+                           struct GNUNET_MQ_MessageHandler);
+  GNUNET_memcpy (copy,
+                 handlers,
+                 count * sizeof(struct GNUNET_MQ_MessageHandler));
+  return copy;
+}
+
+
+struct GNUNET_MQ_MessageHandler *
+GNUNET_MQ_copy_handlers2 (const struct GNUNET_MQ_MessageHandler *handlers,
+                          GNUNET_MQ_MessageCallback agpl_handler,
+                          void *agpl_cls)
+{
+  struct GNUNET_MQ_MessageHandler *copy;
+  unsigned int count;
+
+  if (NULL == handlers)
+    return NULL;
+  count = GNUNET_MQ_count_handlers (handlers);
+  copy = GNUNET_new_array (count + 2,
+                           struct GNUNET_MQ_MessageHandler);
+  GNUNET_memcpy (copy,
+                 handlers,
+                 count * sizeof(struct GNUNET_MQ_MessageHandler));
+  copy[count].mv = NULL;
+  copy[count].cb = agpl_handler;
+  copy[count].cls = agpl_cls;
+  copy[count].type = GNUNET_MESSAGE_TYPE_REQUEST_AGPL;
+  copy[count].expected_size = sizeof(struct GNUNET_MessageHeader);
+  return copy;
+}
+
+
+unsigned int
+GNUNET_MQ_count_handlers (const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  unsigned int i;
+
+  if (NULL == handlers)
+    return 0;
+  for (i = 0; NULL != handlers[i].cb; i++)
+    ;
+  return i;
+}
+
+
+const char *
+GNUNET_MQ_preference_to_string (enum GNUNET_MQ_PreferenceKind type)
+{
+  switch (type)
+  {
+  case GNUNET_MQ_PREFERENCE_NONE:
+    return "NONE";
+  case GNUNET_MQ_PREFERENCE_BANDWIDTH:
+    return "BANDWIDTH";
+  case GNUNET_MQ_PREFERENCE_LATENCY:
+    return "LATENCY";
+  case GNUNET_MQ_PREFERENCE_RELIABILITY:
+    return "RELIABILITY";
+  }
+  return NULL;
+}
+
+
+/* end of mq.c */
diff --git a/src/lib/util/mst.c b/src/lib/util/mst.c
new file mode 100644
index 000000000..d8509b7ec
--- /dev/null
+++ b/src/lib/util/mst.c
@@ -0,0 +1,411 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2016, 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/mst.c
+ * @brief convenience functions for handling inbound message buffers
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#if HAVE_UNALIGNED_64_ACCESS
+#define ALIGN_FACTOR 4
+#else
+#define ALIGN_FACTOR 8
+#endif
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-mst", __VA_ARGS__)
+
+
+/**
+ * Handle to a message stream tokenizer.
+ */
+struct GNUNET_MessageStreamTokenizer
+{
+  /**
+   * Function to call on completed messages.
+   */
+  GNUNET_MessageTokenizerCallback cb;
+
+  /**
+   * Closure for @e cb.
+   */
+  void *cb_cls;
+
+  /**
+   * Size of the buffer (starting at @e hdr).
+   */
+  size_t curr_buf;
+
+  /**
+   * How many bytes in buffer have we already processed?
+   */
+  size_t off;
+
+  /**
+   * How many bytes in buffer are valid right now?
+   */
+  size_t pos;
+
+  /**
+   * Beginning of the buffer.  Typed like this to force alignment.
+   */
+  struct GNUNET_MessageHeader *hdr;
+};
+
+
+/**
+ * Create a message stream tokenizer.
+ *
+ * @param cb function to call on completed messages
+ * @param cb_cls closure for @a cb
+ * @return handle to tokenizer
+ */
+struct GNUNET_MessageStreamTokenizer *
+GNUNET_MST_create (GNUNET_MessageTokenizerCallback cb,
+                   void *cb_cls)
+{
+  struct GNUNET_MessageStreamTokenizer *ret;
+
+  ret = GNUNET_new (struct GNUNET_MessageStreamTokenizer);
+  ret->hdr = GNUNET_malloc (GNUNET_MIN_MESSAGE_SIZE);
+  ret->curr_buf = GNUNET_MIN_MESSAGE_SIZE;
+  ret->cb = cb;
+  ret->cb_cls = cb_cls;
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_MST_from_buffer (struct GNUNET_MessageStreamTokenizer *mst,
+                        const char *buf,
+                        size_t size,
+                        int purge,
+                        int one_shot)
+{
+  const struct GNUNET_MessageHeader *hdr;
+  size_t delta;
+  uint16_t want;
+  char *ibuf;
+  int ret;
+  int cbret;
+
+  GNUNET_assert (mst->off <= mst->pos);
+  GNUNET_assert (mst->pos <= mst->curr_buf);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "MST receives %u bytes with %u (%u/%u) bytes already in private buffer\n",
+       (unsigned int) size,
+       (unsigned int) (mst->pos - mst->off),
+       (unsigned int) mst->pos,
+       (unsigned int) mst->off);
+  ret = GNUNET_OK;
+  ibuf = (char *) mst->hdr;
+  while (mst->pos > 0)
+  {
+do_align:
+    GNUNET_assert (mst->pos >= mst->off);
+    if ((mst->curr_buf - mst->off < sizeof(struct GNUNET_MessageHeader)) ||
+        (0 != (mst->off % ALIGN_FACTOR)))
+    {
+      /* need to align or need more space */
+      mst->pos -= mst->off;
+      memmove (ibuf,
+               &ibuf[mst->off],
+               mst->pos);
+      mst->off = 0;
+    }
+    if (mst->pos - mst->off < sizeof(struct GNUNET_MessageHeader))
+    {
+      delta
+        = GNUNET_MIN (sizeof(struct GNUNET_MessageHeader)
+                      - (mst->pos - mst->off),
+                      size);
+      GNUNET_memcpy (&ibuf[mst->pos],
+                     buf,
+                     delta);
+      mst->pos += delta;
+      buf += delta;
+      size -= delta;
+    }
+    if (mst->pos - mst->off < sizeof(struct GNUNET_MessageHeader))
+    {
+      if (purge)
+      {
+        mst->off = 0;
+        mst->pos = 0;
+      }
+      return GNUNET_OK;
+    }
+    hdr = (const struct GNUNET_MessageHeader *) &ibuf[mst->off];
+    want = ntohs (hdr->size);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "We want to read message of size %u\n",
+         want);
+    if (want < sizeof(struct GNUNET_MessageHeader))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    if ((mst->curr_buf - mst->off < want) &&
+        (mst->off > 0))
+    {
+      /* can get more space by moving */
+      mst->pos -= mst->off;
+      memmove (ibuf,
+               &ibuf[mst->off],
+               mst->pos);
+      mst->off = 0;
+    }
+    if (mst->curr_buf < want)
+    {
+      /* need to get more space by growing buffer */
+      GNUNET_assert (0 == mst->off);
+      mst->hdr = GNUNET_realloc (mst->hdr,
+                                 want);
+      ibuf = (char *) mst->hdr;
+      mst->curr_buf = want;
+    }
+    hdr = (const struct GNUNET_MessageHeader *) &ibuf[mst->off];
+    if (mst->pos - mst->off < want)
+    {
+      delta = GNUNET_MIN (want - (mst->pos - mst->off),
+                          size);
+      GNUNET_assert (mst->pos + delta <= mst->curr_buf);
+      GNUNET_memcpy (&ibuf[mst->pos],
+                     buf,
+                     delta);
+      mst->pos += delta;
+      buf += delta;
+      size -= delta;
+    }
+    if (mst->pos - mst->off < want)
+    {
+      if (purge)
+      {
+        mst->off = 0;
+        mst->pos = 0;
+      }
+      return GNUNET_OK;
+    }
+    if (one_shot == GNUNET_SYSERR)
+    {
+      /* cannot call callback again, but return value saying that
+       * we have another full message in the buffer */
+      ret = GNUNET_NO;
+      goto copy;
+    }
+    if (one_shot == GNUNET_YES)
+      one_shot = GNUNET_SYSERR;
+    mst->off += want;
+    if (GNUNET_OK !=
+        (cbret = mst->cb (mst->cb_cls,
+                          hdr)))
+    {
+      if (GNUNET_SYSERR == cbret)
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Failure processing message of type %u and size %u\n",
+                    ntohs (hdr->type),
+                    ntohs (hdr->size));
+      return GNUNET_SYSERR;
+    }
+    if (mst->off == mst->pos)
+    {
+      /* reset to beginning of buffer, it's free right now! */
+      mst->off = 0;
+      mst->pos = 0;
+    }
+  }
+  GNUNET_assert (0 == mst->pos);
+  while (size > 0)
+  {
+    unsigned long offset = (unsigned long) buf;
+    bool need_align = (0 != (offset % ALIGN_FACTOR));
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Server-mst has %u bytes left in inbound buffer\n",
+         (unsigned int) size);
+    if (size < sizeof(struct GNUNET_MessageHeader))
+      break;
+    if (! need_align)
+    {
+      /* can try to do zero-copy and process directly from original buffer */
+      hdr = (const struct GNUNET_MessageHeader *) buf;
+      want = ntohs (hdr->size);
+      if (want < sizeof(struct GNUNET_MessageHeader))
+      {
+        GNUNET_break_op (0);
+        mst->off = 0;
+        return GNUNET_SYSERR;
+      }
+      if (size < want)
+        break;                  /* or not: buffer incomplete, so copy to private buffer... */
+      if (one_shot == GNUNET_SYSERR)
+      {
+        /* cannot call callback again, but return value saying that
+         * we have another full message in the buffer */
+        ret = GNUNET_NO;
+        goto copy;
+      }
+      if (GNUNET_YES == one_shot)
+        one_shot = GNUNET_SYSERR;
+      if (GNUNET_OK !=
+          (cbret = mst->cb (mst->cb_cls,
+                            hdr)))
+      {
+        if (GNUNET_SYSERR == cbret)
+          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                      "Failure processing message of type %u and size %u\n",
+                      ntohs (hdr->type),
+                      ntohs (hdr->size));
+        return GNUNET_SYSERR;
+      }
+      buf += want;
+      size -= want;
+    }
+    else
+    {
+      /* need to copy to private buffer to align;
+       * yes, we go a bit more spaghetti than usual here */
+      goto do_align;
+    }
+  }
+copy:
+  if ((size > 0) && (! purge))
+  {
+    if (size + mst->pos > mst->curr_buf)
+    {
+      mst->hdr = GNUNET_realloc (mst->hdr,
+                                 size + mst->pos);
+      ibuf = (char *) mst->hdr;
+      mst->curr_buf = size + mst->pos;
+    }
+    GNUNET_assert (size + mst->pos <= mst->curr_buf);
+    GNUNET_memcpy (&ibuf[mst->pos],
+                   buf,
+                   size);
+    mst->pos += size;
+  }
+  if (purge)
+  {
+    mst->off = 0;
+    mst->pos = 0;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Server-mst leaves %u (%u/%u) bytes in private buffer\n",
+       (unsigned int) (mst->pos - mst->off),
+       (unsigned int) mst->pos,
+       (unsigned int) mst->off);
+  return ret;
+}
+
+
+/**
+ * Add incoming data to the receive buffer and call the
+ * callback for all complete messages.
+ *
+ * @param mst tokenizer to use
+ * @param buf input data to add
+ * @param size number of bytes in @a buf
+ * @param purge should any excess bytes in the buffer be discarded
+ *       (i.e. for packet-based services like UDP)
+ * @param one_shot only call callback once, keep rest of message in buffer
+ * @return #GNUNET_OK if we are done processing (need more data)
+ *         #GNUNET_NO if one_shot was set and we have another message ready
+ *         #GNUNET_SYSERR if the data stream is corrupt
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_MST_read (struct GNUNET_MessageStreamTokenizer *mst,
+                 struct GNUNET_NETWORK_Handle *sock,
+                 int purge,
+                 int one_shot)
+{
+  ssize_t ret;
+  size_t left;
+  char *buf;
+
+  left = mst->curr_buf - mst->pos;
+  buf = (char *) mst->hdr;
+  ret = GNUNET_NETWORK_socket_recv (sock,
+                                    &buf[mst->pos],
+                                    left);
+  if (-1 == ret)
+  {
+    if ((EAGAIN == errno) ||
+        (EINTR == errno))
+      return GNUNET_OK;
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_INFO,
+                         "recv");
+    return GNUNET_SYSERR;
+  }
+  if (0 == ret)
+  {
+    /* other side closed connection, treat as error */
+    return GNUNET_SYSERR;
+  }
+  mst->pos += ret;
+  return GNUNET_MST_from_buffer (mst,
+                                 NULL,
+                                 0,
+                                 purge,
+                                 one_shot);
+}
+
+
+/**
+ * Obtain the next message from the @a mst, assuming that
+ * there are more unprocessed messages in the internal buffer
+ * of the @a mst.
+ *
+ * @param mst tokenizer to use
+ * @param one_shot only call callback once, keep rest of message in buffer
+ * @return #GNUNET_OK if we are done processing (need more data)
+ *         #GNUNET_NO if one_shot was set and we have another message ready
+ *         #GNUNET_SYSERR if the data stream is corrupt
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_MST_next (struct GNUNET_MessageStreamTokenizer *mst,
+                 int one_shot)
+{
+  return GNUNET_MST_from_buffer (mst,
+                                 NULL,
+                                 0,
+                                 GNUNET_NO,
+                                 one_shot);
+}
+
+
+/**
+ * Destroys a tokenizer.
+ *
+ * @param mst tokenizer to destroy
+ */
+void
+GNUNET_MST_destroy (struct GNUNET_MessageStreamTokenizer *mst)
+{
+  GNUNET_free (mst->hdr);
+  GNUNET_free (mst);
+}
+
+
+/* end of server_mst.c */
diff --git a/src/lib/util/nc.c b/src/lib/util/nc.c
new file mode 100644
index 000000000..2a612917c
--- /dev/null
+++ b/src/lib/util/nc.c
@@ -0,0 +1,228 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/nc.c
+ * @brief convenience functions for transmission of
+ *        messages to multiple clients
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-nc", __VA_ARGS__)
+
+
+/**
+ * Lists of subscribers we manage for notifications.
+ */
+struct SubscriberList
+{
+  /**
+   * This is a doubly linked list.
+   */
+  struct SubscriberList *next;
+
+  /**
+   * This is a doubly linked list.
+   */
+  struct SubscriberList *prev;
+
+  /**
+   * Overall context this subscriber belongs to.
+   */
+  struct GNUNET_NotificationContext *nc;
+
+  /**
+   * Handle where we registered with @e mq to be told about
+   * the MQ's destruction.
+   */
+  struct GNUNET_MQ_DestroyNotificationHandle *mq_nh;
+
+  /**
+   * Message queue for the subscriber.
+   */
+  struct GNUNET_MQ_Handle *mq;
+};
+
+
+/**
+ * The notification context is the key datastructure for a convenience
+ * API used for transmission of notifications to the subscriber until the
+ * subscriber disconnects (or the notification context is destroyed, in
+ * which case we disconnect these subscribers).  Essentially, all
+ * (notification) messages are queued up until the subscriber is able to
+ * read them.
+ */
+struct GNUNET_NotificationContext
+{
+  /**
+   * Head of list of subscribers receiving notifications.
+   */
+  struct SubscriberList *subscribers_head;
+
+  /**
+   * Tail of list of subscribers receiving notifications.
+   */
+  struct SubscriberList *subscribers_tail;
+
+  /**
+   * Maximum number of optional messages to queue per subscriber.
+   */
+  unsigned int queue_length;
+};
+
+
+/**
+ * Subscriber has disconnected, clean up.
+ *
+ * @param cls our `struct SubscriberList *`
+ */
+static void
+handle_mq_destroy (void *cls)
+{
+  struct SubscriberList *pos = cls;
+  struct GNUNET_NotificationContext *nc = pos->nc;
+
+  GNUNET_CONTAINER_DLL_remove (nc->subscribers_head,
+                               nc->subscribers_tail,
+                               pos);
+  GNUNET_free (pos);
+}
+
+
+/**
+ * Create a new notification context.
+ *
+ * @param queue_length maximum number of messages to keep in
+ *        the notification queue; optional messages are dropped
+ *        if the queue gets longer than this number of messages
+ * @return handle to the notification context
+ */
+struct GNUNET_NotificationContext *
+GNUNET_notification_context_create (unsigned int queue_length)
+{
+  struct GNUNET_NotificationContext *nc;
+
+  nc = GNUNET_new (struct GNUNET_NotificationContext);
+  nc->queue_length = queue_length;
+  return nc;
+}
+
+
+/**
+ * Destroy the context, force disconnect for all subscribers.
+ *
+ * @param nc context to destroy.
+ */
+void
+GNUNET_notification_context_destroy (struct GNUNET_NotificationContext *nc)
+{
+  struct SubscriberList *pos;
+
+  while (NULL != (pos = nc->subscribers_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (nc->subscribers_head,
+                                 nc->subscribers_tail,
+                                 pos);
+    GNUNET_MQ_destroy_notify_cancel (pos->mq_nh);
+    GNUNET_free (pos);
+  }
+  GNUNET_free (nc);
+}
+
+
+/**
+ * Add a subscriber to the notification context.
+ *
+ * @param nc context to modify
+ * @param mq message queue add
+ */
+void
+GNUNET_notification_context_add (struct GNUNET_NotificationContext *nc,
+                                 struct GNUNET_MQ_Handle *mq)
+{
+  struct SubscriberList *cl;
+
+  for (cl = nc->subscribers_head; NULL != cl; cl = cl->next)
+    if (cl->mq == mq)
+      return;
+  /* already present */
+  cl = GNUNET_new (struct SubscriberList);
+  GNUNET_CONTAINER_DLL_insert (nc->subscribers_head,
+                               nc->subscribers_tail,
+                               cl);
+  cl->nc = nc;
+  cl->mq = mq;
+  cl->mq_nh = GNUNET_MQ_destroy_notify (cl->mq,
+                                        &handle_mq_destroy,
+                                        cl);
+}
+
+
+/**
+ * Send a message to all subscribers of this context.
+ *
+ * @param nc context to modify
+ * @param msg message to send
+ * @param can_drop can this message be dropped due to queue length limitations
+ */
+void
+GNUNET_notification_context_broadcast (struct GNUNET_NotificationContext *nc,
+                                       const struct GNUNET_MessageHeader *msg,
+                                       int can_drop)
+{
+  struct SubscriberList *pos;
+  struct GNUNET_MQ_Envelope *env;
+
+  for (pos = nc->subscribers_head; NULL != pos; pos = pos->next)
+  {
+    if ((GNUNET_YES == can_drop) &&
+        (GNUNET_MQ_get_length (pos->mq) > nc->queue_length))
+      continue;
+    env = GNUNET_MQ_msg_copy (msg);
+    GNUNET_MQ_send (pos->mq,
+                    env);
+  }
+}
+
+
+/**
+ * Return active number of subscribers in this context.
+ *
+ * @param nc context to query
+ * @return number of current subscribers
+ */
+unsigned int
+GNUNET_notification_context_get_size (struct GNUNET_NotificationContext *nc)
+{
+  unsigned int num;
+  struct SubscriberList *pos;
+
+  num = 0;
+  for (pos = nc->subscribers_head; NULL != pos; pos = pos->next)
+    num++;
+  return num;
+}
+
+
+/* end of nc.c */
diff --git a/src/lib/util/network.c b/src/lib/util/network.c
new file mode 100644
index 000000000..8c74c5626
--- /dev/null
+++ b/src/lib/util/network.c
@@ -0,0 +1,1311 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/network.c
+ * @brief basic, low-level networking interface
+ * @author Nils Durner
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_common.h"
+#include "disk.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-network", __VA_ARGS__)
+#define LOG_STRERROR_FILE(kind, syscall, \
+                          filename) GNUNET_log_from_strerror_file (kind, \
+                                                                   "util-network", \
+                                                                   syscall, \
+                                                                   filename)
+#define LOG_STRERROR(kind, syscall) GNUNET_log_from_strerror (kind, \
+                                                              "util-network", \
+                                                              syscall)
+
+#define DEBUG_NETWORK GNUNET_EXTRA_LOGGING
+
+
+#ifndef INVALID_SOCKET
+#define INVALID_SOCKET -1
+#endif
+
+
+/**
+ * @brief handle to a socket
+ */
+struct GNUNET_NETWORK_Handle
+{
+  int fd;
+
+  /**
+   * Address family / domain.
+   */
+  int af;
+
+  /**
+   * Type of the socket
+   */
+  int type;
+
+  /**
+   * Number of bytes in addr.
+   */
+  socklen_t addrlen;
+
+  /**
+   * Address we were bound to, or NULL.
+   */
+  struct sockaddr *addr;
+};
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_test_pf (int pf)
+{
+  static int cache_v4 = -1;
+  static int cache_v6 = -1;
+  static int cache_un = -1;
+  int s;
+  int ret;
+
+  switch (pf)
+  {
+  case PF_INET:
+    if (-1 != cache_v4)
+      return cache_v4;
+    break;
+
+  case PF_INET6:
+    if (-1 != cache_v6)
+      return cache_v6;
+    break;
+
+#ifdef PF_UNIX
+  case PF_UNIX:
+    if (-1 != cache_un)
+      return cache_un;
+    break;
+#endif
+  }
+  s = socket (pf, SOCK_STREAM, 0);
+  if (-1 == s)
+  {
+    if (EAFNOSUPPORT != errno)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                           "socket");
+      return GNUNET_SYSERR;
+    }
+    ret = GNUNET_NO;
+  }
+  else
+  {
+    GNUNET_break (0 == close (s));
+    ret = GNUNET_OK;
+  }
+  switch (pf)
+  {
+  case PF_INET:
+    cache_v4 = ret;
+    break;
+
+  case PF_INET6:
+    cache_v6 = ret;
+    break;
+
+#ifdef PF_UNIX
+  case PF_UNIX:
+    cache_un = ret;
+    break;
+#endif
+  }
+  return ret;
+}
+
+
+char *
+GNUNET_NETWORK_shorten_unixpath (char *unixpath)
+{
+  struct sockaddr_un dummy;
+  size_t slen;
+  char *end;
+  struct GNUNET_HashCode sh;
+  struct GNUNET_CRYPTO_HashAsciiEncoded ae;
+  size_t upm;
+
+  upm = sizeof(dummy.sun_path);
+  slen = strlen (unixpath);
+  if (slen < upm)
+    return unixpath; /* no shortening required */
+  GNUNET_CRYPTO_hash (unixpath, slen, &sh);
+  while (16 + strlen (unixpath) >= upm)
+  {
+    if (NULL == (end = strrchr (unixpath, '/')))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ (
+                    "Unable to shorten unix path `%s' while keeping name unique\n"),
+                  unixpath);
+      GNUNET_free (unixpath);
+      return NULL;
+    }
+    *end = '\0';
+  }
+  GNUNET_CRYPTO_hash_to_enc (&sh, &ae);
+  ae.encoding[16] = '\0';
+  strcat (unixpath, (char *) ae.encoding);
+  return unixpath;
+}
+
+
+void
+GNUNET_NETWORK_unix_precheck (const struct sockaddr_un *un)
+{
+  int s;
+  int eno;
+  struct stat sbuf;
+  int ret;
+
+  s = socket (AF_UNIX, SOCK_STREAM, 0);
+  if (-1 == s)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "Failed to open AF_UNIX socket");
+    return;
+  }
+  ret = connect (s,
+                 (struct sockaddr *) un,
+                 sizeof(struct sockaddr_un));
+  eno = errno;
+  GNUNET_break (0 == close (s));
+  if (0 == ret)
+    return; /* another process is listening, do not remove! */
+  if (ECONNREFUSED != eno)
+    return; /* some other error, likely "no such file or directory" -- all well */
+  /* should unlink, but sanity checks first */
+  if (0 != stat (un->sun_path,
+                 &sbuf))
+    return; /* failed to 'stat', likely does not exist after all */
+  if (S_IFSOCK != (S_IFMT & sbuf.st_mode))
+    return; /* refuse to unlink anything except sockets */
+  /* finally, really unlink */
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Removing left-over `%s' from previous exeuction\n",
+              un->sun_path);
+  if (0 != unlink (un->sun_path))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "unlink",
+                              un->sun_path);
+}
+
+
+#ifndef FD_COPY
+#define FD_COPY(s, d) do { GNUNET_memcpy ((d), (s), sizeof(fd_set)); } while (0)
+#endif
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_set_blocking (struct GNUNET_NETWORK_Handle *fd,
+                                    int doBlock)
+{
+  int flags = fcntl (fd->fd, F_GETFL);
+
+  if (flags == -1)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "fcntl");
+    return GNUNET_SYSERR;
+  }
+  if (doBlock)
+    flags &= ~O_NONBLOCK;
+
+  else
+    flags |= O_NONBLOCK;
+  if (0 != fcntl (fd->fd,
+                  F_SETFL,
+                  flags))
+
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "fcntl");
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Make a socket non-inheritable to child processes
+ *
+ * @param h the socket to make non-inheritable
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ * @warning Not implemented on Windows
+ */
+static int
+socket_set_inheritable (const struct GNUNET_NETWORK_Handle *h)
+{
+  int i;
+  i = fcntl (h->fd, F_GETFD);
+  if (i < 0)
+    return GNUNET_SYSERR;
+  if (i == (i | FD_CLOEXEC))
+    return GNUNET_OK;
+  i |= FD_CLOEXEC;
+  if (fcntl (h->fd, F_SETFD, i) < 0)
+    return GNUNET_SYSERR;
+
+  return GNUNET_OK;
+}
+
+
+#ifdef DARWIN
+/**
+ * The MSG_NOSIGNAL equivalent on Mac OS X
+ *
+ * @param h the socket to make non-delaying
+ */
+static int
+socket_set_nosigpipe (const struct GNUNET_NETWORK_Handle *h)
+{
+  int abs_value = 1;
+
+  if (0 !=
+      setsockopt (h->fd, SOL_SOCKET, SO_NOSIGPIPE,
+                  (const void *) &abs_value,
+                  sizeof(abs_value)))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+#endif
+
+
+/**
+ * Disable delays when sending data via the socket.
+ * (GNUnet makes sure that messages are as big as
+ * possible already).
+ *
+ * @param h the socket to make non-delaying
+ */
+static void
+socket_set_nodelay (const struct GNUNET_NETWORK_Handle *h)
+{
+  int value = 1;
+
+  if (0 !=
+      setsockopt (h->fd,
+                  IPPROTO_TCP,
+                  TCP_NODELAY,
+                  &value, sizeof(value)))
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "setsockopt");
+}
+
+
+/**
+ * Perform proper canonical initialization for a network handle.
+ * Set it to non-blocking, make it non-inheritable to child
+ * processes, disable SIGPIPE, enable "nodelay" (if non-UNIX
+ * stream socket) and check that it is smaller than FD_SETSIZE.
+ *
+ * @param h socket to initialize
+ * @param af address family of the socket
+ * @param type socket type
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if initialization
+ *         failed and the handle was destroyed
+ */
+static int
+initialize_network_handle (struct GNUNET_NETWORK_Handle *h,
+                           int af,
+                           int type)
+{
+  int eno;
+
+  h->af = af;
+  h->type = type;
+  if (h->fd == INVALID_SOCKET)
+  {
+    eno = errno;
+    GNUNET_free (h);
+    errno = eno;
+    return GNUNET_SYSERR;
+  }
+
+  if (h->fd >= FD_SETSIZE)
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (h));
+    errno = EMFILE;
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_OK != socket_set_inheritable (h))
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "socket_set_inheritable");
+
+  if (GNUNET_SYSERR == GNUNET_NETWORK_socket_set_blocking (h, GNUNET_NO))
+  {
+    eno = errno;
+    GNUNET_break (0);
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (h));
+    errno = eno;
+    return GNUNET_SYSERR;
+  }
+#ifdef DARWIN
+  if (GNUNET_SYSERR == socket_set_nosigpipe (h))
+  {
+    eno = errno;
+    GNUNET_break (0);
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (h));
+    errno = eno;
+    return GNUNET_SYSERR;
+  }
+#endif
+  if ((type == SOCK_STREAM)
+#ifdef AF_UNIX
+      && (af != AF_UNIX)
+#endif
+      )
+    socket_set_nodelay (h);
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_NETWORK_Handle *
+GNUNET_NETWORK_socket_accept (const struct GNUNET_NETWORK_Handle *desc,
+                              struct sockaddr *address,
+                              socklen_t *address_len)
+{
+  struct GNUNET_NETWORK_Handle *ret;
+  int eno;
+
+  ret = GNUNET_new (struct GNUNET_NETWORK_Handle);
+#if DEBUG_NETWORK
+  {
+    struct sockaddr_storage name;
+    socklen_t namelen = sizeof(name);
+
+    int gsn = getsockname (desc->fd,
+                           (struct sockaddr *) &name,
+                           &namelen);
+
+    if (0 == gsn)
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Accepting connection on `%s'\n",
+           GNUNET_a2s ((const struct sockaddr *) &name,
+                       namelen));
+  }
+#endif
+  ret->fd = accept (desc->fd,
+                    address,
+                    address_len);
+  if (-1 == ret->fd)
+  {
+    eno = errno;
+    GNUNET_free (ret);
+    errno = eno;
+    return NULL;
+  }
+  if (GNUNET_OK !=
+      initialize_network_handle (ret,
+                                 (NULL != address) ? address->sa_family :
+                                 desc->af,
+                                 SOCK_STREAM))
+  {
+    return NULL;
+  }
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_bind (struct GNUNET_NETWORK_Handle *desc,
+                            const struct sockaddr *address,
+                            socklen_t address_len)
+{
+  int ret;
+
+#ifdef IPV6_V6ONLY
+#ifdef IPPROTO_IPV6
+  {
+    const int on = 1;
+
+    if (AF_INET6 == desc->af)
+      if (setsockopt (desc->fd,
+                      IPPROTO_IPV6,
+                      IPV6_V6ONLY,
+                      (const void *) &on,
+                      sizeof(on)))
+        LOG_STRERROR (GNUNET_ERROR_TYPE_DEBUG,
+                      "setsockopt");
+  }
+#endif
+#endif
+  if (AF_UNIX == address->sa_family)
+    GNUNET_NETWORK_unix_precheck ((const struct sockaddr_un *) address);
+
+  {
+    const int on = 1;
+
+    if ( (SOCK_STREAM == desc->type) &&
+         (0 != setsockopt (desc->fd,
+                           SOL_SOCKET,
+                           SO_REUSEADDR,
+                           &on, sizeof(on))) )
+      LOG_STRERROR (GNUNET_ERROR_TYPE_DEBUG,
+                    "setsockopt");
+  }
+  {
+    /* set permissions of newly created non-abstract UNIX domain socket to
+       "user-only"; applications can choose to relax this later */
+    mode_t old_mask = 0; /* assigned to make compiler happy */
+    const struct sockaddr_un *un = (const struct sockaddr_un *) address;
+    int not_abstract = 0;
+
+    if ((AF_UNIX == address->sa_family)
+        && ('\0' != un->sun_path[0]))  /* Not an abstract socket */
+      not_abstract = 1;
+    if (not_abstract)
+      old_mask = umask (S_IWGRP | S_IRGRP | S_IXGRP | S_IWOTH | S_IROTH
+                        | S_IXOTH);
+
+    ret = bind (desc->fd,
+                address,
+                address_len);
+
+    if (not_abstract)
+      (void) umask (old_mask);
+  }
+  if (0 != ret)
+    return GNUNET_SYSERR;
+
+  desc->addr = GNUNET_malloc (address_len);
+  GNUNET_memcpy (desc->addr, address, address_len);
+  desc->addrlen = address_len;
+
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_close (struct GNUNET_NETWORK_Handle *desc)
+{
+  int ret;
+
+  ret = close (desc->fd);
+
+  const struct sockaddr_un *un = (const struct sockaddr_un *) desc->addr;
+
+  /* Cleanup the UNIX domain socket and its parent directories in case of non
+     abstract sockets */
+  if ((AF_UNIX == desc->af) &&
+      (NULL != desc->addr) &&
+      ('\0' != un->sun_path[0]))
+  {
+    char *dirname = GNUNET_strndup (un->sun_path,
+                                    sizeof(un->sun_path));
+
+    if (0 != unlink (dirname))
+    {
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING,
+                         "unlink",
+                         dirname);
+    }
+    else
+    {
+      size_t len;
+
+      len = strlen (dirname);
+      while ((len > 0) && (dirname[len] != DIR_SEPARATOR))
+        len--;
+      dirname[len] = '\0';
+      if ((0 != len) && (0 != rmdir (dirname)))
+      {
+        switch (errno)
+        {
+        case EACCES:
+        case ENOTEMPTY:
+        case EPERM:
+          /* these are normal and can just be ignored */
+          break;
+
+        default:
+          GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                                    "rmdir",
+                                    dirname);
+          break;
+        }
+      }
+    }
+    GNUNET_free (dirname);
+  }
+  GNUNET_NETWORK_socket_free_memory_only_ (desc);
+  return (ret == 0) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+void
+GNUNET_NETWORK_socket_free_memory_only_ (struct GNUNET_NETWORK_Handle *desc)
+{
+  GNUNET_free (desc->addr);
+  GNUNET_free (desc);
+}
+
+
+/**
+ * Box a native socket (and check that it is a socket).
+ *
+ * @param fd socket to box
+ * @return NULL on error (including not supported on target platform)
+ */
+struct GNUNET_NETWORK_Handle *
+GNUNET_NETWORK_socket_box_native (int fd)
+{
+  struct GNUNET_NETWORK_Handle *ret;
+
+  if (fcntl (fd, F_GETFD) < 0)
+    return NULL;                /* invalid FD */
+  ret = GNUNET_new (struct GNUNET_NETWORK_Handle);
+  ret->fd = fd;
+  ret->af = AF_UNSPEC;
+  return ret;
+}
+
+
+/**
+ * Connect a socket to some remote address.
+ *
+ * @param desc socket
+ * @param address peer address
+ * @param address_len length of @a address
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_connect (const struct GNUNET_NETWORK_Handle *desc,
+                               const struct sockaddr *address,
+                               socklen_t address_len)
+{
+  int ret;
+
+  ret = connect (desc->fd,
+                 address,
+                 address_len);
+
+  return ret == 0 ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * Get socket options
+ *
+ * @param desc socket
+ * @param level protocol level of the option
+ * @param optname identifier of the option
+ * @param optval options
+ * @param optlen length of @a optval
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_getsockopt (const struct GNUNET_NETWORK_Handle *desc,
+                                  int level,
+                                  int optname,
+                                  void *optval,
+                                  socklen_t *optlen)
+{
+  int ret;
+
+  ret = getsockopt (desc->fd,
+                    level,
+                    optname,
+                    optval, optlen);
+
+  return ret == 0 ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * Listen on a socket
+ *
+ * @param desc socket
+ * @param backlog length of the listen queue
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_listen (const struct GNUNET_NETWORK_Handle *desc,
+                              int backlog)
+{
+  int ret;
+
+  ret = listen (desc->fd,
+                backlog);
+
+  return ret == 0 ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * How much data is available to be read on this descriptor?
+ *
+ * @param desc socket
+ * @returns #GNUNET_SYSERR if no data is available, or on error!
+ */
+ssize_t
+GNUNET_NETWORK_socket_recvfrom_amount (const struct GNUNET_NETWORK_Handle *desc)
+{
+  int error;
+
+  /* How much is there to be read? */
+  int pending;
+
+  error = ioctl (desc->fd,
+                 FIONREAD,
+                 &pending);
+  if (0 == error)
+    return (ssize_t) pending;
+  return GNUNET_SYSERR;
+}
+
+
+ssize_t
+GNUNET_NETWORK_socket_recvfrom (const struct GNUNET_NETWORK_Handle *desc,
+                                void *buffer,
+                                size_t length,
+                                struct sockaddr *src_addr,
+                                socklen_t *addrlen)
+{
+  int flags = 0;
+
+#ifdef MSG_DONTWAIT
+  flags |= MSG_DONTWAIT;
+#endif
+  return recvfrom (desc->fd,
+                   buffer,
+                   length,
+                   flags,
+                   src_addr,
+                   addrlen);
+}
+
+
+/**
+ * Read data from a connected socket (always non-blocking).
+ *
+ * @param desc socket
+ * @param buffer buffer
+ * @param length length of @a buffer
+ * @return number of bytes received, -1 on error
+ */
+ssize_t
+GNUNET_NETWORK_socket_recv (const struct GNUNET_NETWORK_Handle *desc,
+                            void *buffer,
+                            size_t length)
+{
+  int ret;
+  int flags;
+
+  flags = 0;
+
+#ifdef MSG_DONTWAIT
+  flags |= MSG_DONTWAIT;
+#endif
+  ret = recv (desc->fd,
+              buffer,
+              length,
+              flags);
+  return ret;
+}
+
+
+ssize_t
+GNUNET_NETWORK_socket_send (const struct GNUNET_NETWORK_Handle *desc,
+                            const void *buffer,
+                            size_t length)
+{
+  int ret;
+  int flags;
+
+  flags = 0;
+#ifdef MSG_DONTWAIT
+  flags |= MSG_DONTWAIT;
+#endif
+#ifdef MSG_NOSIGNAL
+  flags |= MSG_NOSIGNAL;
+#endif
+  ret = send (desc->fd,
+              buffer,
+              length,
+              flags);
+  return ret;
+}
+
+
+/**
+ * Send data to a particular destination (always non-blocking).
+ * This function only works for UDP sockets.
+ *
+ * @param desc socket
+ * @param message data to send
+ * @param length size of the @a message
+ * @param dest_addr destination address
+ * @param dest_len length of @a address
+ * @return number of bytes sent, #GNUNET_SYSERR on error
+ */
+ssize_t
+GNUNET_NETWORK_socket_sendto (const struct GNUNET_NETWORK_Handle *desc,
+                              const void *message,
+                              size_t length,
+                              const struct sockaddr *dest_addr,
+                              socklen_t dest_len)
+{
+  int flags = 0;
+
+#ifdef MSG_DONTWAIT
+  flags |= MSG_DONTWAIT;
+#endif
+#ifdef MSG_NOSIGNAL
+  flags |= MSG_NOSIGNAL;
+#endif
+  return sendto (desc->fd,
+                 message,
+                 length,
+                 flags,
+                 dest_addr,
+                 dest_len);
+}
+
+
+/**
+ * Set socket option
+ *
+ * @param fd socket
+ * @param level protocol level of the option
+ * @param option_name option identifier
+ * @param option_value value to set
+ * @param option_len size of @a option_value
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+int
+GNUNET_NETWORK_socket_setsockopt (struct GNUNET_NETWORK_Handle *fd,
+                                  int level,
+                                  int option_name,
+                                  const void *option_value,
+                                  socklen_t option_len)
+{
+  return (0 == setsockopt (fd->fd,
+                           level,
+                           option_name,
+                           option_value,
+                           option_len))
+    ? GNUNET_OK
+    : GNUNET_SYSERR;
+}
+
+
+/**
+ * Create a new socket.  Configure it for non-blocking IO and
+ * mark it as non-inheritable to child processes (set the
+ * close-on-exec flag).
+ *
+ * @param domain domain of the socket
+ * @param type socket type
+ * @param protocol network protocol
+ * @return new socket, NULL on error
+ */
+struct GNUNET_NETWORK_Handle *
+GNUNET_NETWORK_socket_create (int domain,
+                              int type,
+                              int protocol)
+{
+  struct GNUNET_NETWORK_Handle *ret;
+  int fd;
+
+  fd = socket (domain, type, protocol);
+  if (-1 == fd)
+    return NULL;
+  ret = GNUNET_new (struct GNUNET_NETWORK_Handle);
+  ret->fd = fd;
+  if (GNUNET_OK !=
+      initialize_network_handle (ret,
+                                 domain,
+                                 type))
+    return NULL;
+  return ret;
+}
+
+
+/**
+ * Shut down socket operations
+ * @param desc socket
+ * @param how type of shutdown
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_shutdown (struct GNUNET_NETWORK_Handle *desc,
+                                int how)
+{
+  int ret;
+
+  ret = shutdown (desc->fd, how);
+
+  return (0 == ret) ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * Disable the "CORK" feature for communication with the given socket,
+ * forcing the OS to immediately flush the buffer on transmission
+ * instead of potentially buffering multiple messages.  Essentially
+ * reduces the OS send buffers to zero.
+ *
+ * @param desc socket
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_NETWORK_socket_disable_corking (struct GNUNET_NETWORK_Handle *desc)
+{
+  int ret = 0;
+
+#ifdef __linux__
+  int value = 0;
+
+  if (0 !=
+      (ret =
+         setsockopt (desc->fd,
+                     SOL_SOCKET,
+                     SO_SNDBUF,
+                     &value,
+                     sizeof(value))))
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "setsockopt");
+  if (0 !=
+      (ret =
+         setsockopt (desc->fd,
+                     SOL_SOCKET,
+                     SO_RCVBUF,
+                     &value,
+                     sizeof(value))))
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "setsockopt");
+#endif
+  return ret == 0 ? GNUNET_OK : GNUNET_SYSERR;
+}
+
+
+/**
+ * Reset FD set
+ *
+ * @param fds fd set
+ */
+void
+GNUNET_NETWORK_fdset_zero (struct GNUNET_NETWORK_FDSet *fds)
+{
+  FD_ZERO (&fds->sds);
+  fds->nsds = 0;
+}
+
+
+/**
+ * Add a socket to the FD set
+ *
+ * @param fds fd set
+ * @param desc socket to add
+ */
+void
+GNUNET_NETWORK_fdset_set (struct GNUNET_NETWORK_FDSet *fds,
+                          const struct GNUNET_NETWORK_Handle *desc)
+{
+  FD_SET (desc->fd,
+          &fds->sds);
+  fds->nsds = GNUNET_MAX (fds->nsds,
+                          desc->fd + 1);
+}
+
+
+/**
+ * Check whether a socket is part of the fd set
+ *
+ * @param fds fd set
+ * @param desc socket
+ * @return 0 if the FD is not set
+ */
+int
+GNUNET_NETWORK_fdset_isset (const struct GNUNET_NETWORK_FDSet *fds,
+                            const struct GNUNET_NETWORK_Handle *desc)
+{
+  return FD_ISSET (desc->fd,
+                   &fds->sds);
+}
+
+
+/**
+ * Add one fd set to another
+ *
+ * @param dst the fd set to add to
+ * @param src the fd set to add from
+ */
+void
+GNUNET_NETWORK_fdset_add (struct GNUNET_NETWORK_FDSet *dst,
+                          const struct GNUNET_NETWORK_FDSet *src)
+{
+  int nfds;
+
+  for (nfds = src->nsds; nfds >= 0; nfds--)
+    if (FD_ISSET (nfds, &src->sds))
+      FD_SET (nfds, &dst->sds);
+  dst->nsds = GNUNET_MAX (dst->nsds,
+                          src->nsds);
+}
+
+
+/**
+ * Copy one fd set to another
+ *
+ * @param to destination
+ * @param from source
+ */
+void
+GNUNET_NETWORK_fdset_copy (struct GNUNET_NETWORK_FDSet *to,
+                           const struct GNUNET_NETWORK_FDSet *from)
+{
+  FD_COPY (&from->sds,
+           &to->sds);
+  to->nsds = from->nsds;
+}
+
+
+/**
+ * Return file descriptor for this network handle
+ *
+ * @param desc wrapper to process
+ * @return POSIX file descriptor
+ */
+int
+GNUNET_NETWORK_get_fd (const struct GNUNET_NETWORK_Handle *desc)
+{
+  return desc->fd;
+}
+
+
+/**
+ * Return sockaddr for this network handle
+ *
+ * @param desc wrapper to process
+ * @return sockaddr
+ */
+struct sockaddr*
+GNUNET_NETWORK_get_addr (const struct GNUNET_NETWORK_Handle *desc)
+{
+  return desc->addr;
+}
+
+
+/**
+ * Return sockaddr length for this network handle
+ *
+ * @param desc wrapper to process
+ * @return socklen_t for sockaddr
+ */
+socklen_t
+GNUNET_NETWORK_get_addrlen (const struct GNUNET_NETWORK_Handle *desc)
+{
+  return desc->addrlen;
+}
+
+
+/**
+ * Copy a native fd set
+ *
+ * @param to destination
+ * @param from native source set
+ * @param nfds the biggest socket number in from + 1
+ */
+void
+GNUNET_NETWORK_fdset_copy_native (struct GNUNET_NETWORK_FDSet *to,
+                                  const fd_set *from,
+                                  int nfds)
+{
+  FD_COPY (from,
+           &to->sds);
+  to->nsds = nfds;
+}
+
+
+/**
+ * Set a native fd in a set
+ *
+ * @param to destination
+ * @param nfd native FD to set
+ */
+void
+GNUNET_NETWORK_fdset_set_native (struct GNUNET_NETWORK_FDSet *to,
+                                 int nfd)
+{
+  GNUNET_assert ((nfd >= 0) && (nfd < FD_SETSIZE));
+  FD_SET (nfd, &to->sds);
+  to->nsds = GNUNET_MAX (nfd + 1,
+                         to->nsds);
+}
+
+
+/**
+ * Test native fd in a set
+ *
+ * @param to set to test, NULL for empty set
+ * @param nfd native FD to test, or -1 for none
+ * @return #GNUNET_YES if FD is set in the set
+ */
+int
+GNUNET_NETWORK_fdset_test_native (const struct GNUNET_NETWORK_FDSet *to,
+                                  int nfd)
+{
+  if ((-1 == nfd) ||
+      (NULL == to))
+    return GNUNET_NO;
+  return FD_ISSET (nfd, &to->sds) ? GNUNET_YES : GNUNET_NO;
+}
+
+
+/**
+ * Add a file handle to the fd set
+ * @param fds fd set
+ * @param h the file handle to add
+ */
+void
+GNUNET_NETWORK_fdset_handle_set (struct GNUNET_NETWORK_FDSet *fds,
+                                 const struct GNUNET_DISK_FileHandle *h)
+{
+  int fd;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_internal_file_handle_ (h,
+                                                    &fd,
+                                                    sizeof(int)));
+  FD_SET (fd,
+          &fds->sds);
+  fds->nsds = GNUNET_MAX (fd + 1,
+                          fds->nsds);
+}
+
+
+/**
+ * Add a file handle to the fd set
+ * @param fds fd set
+ * @param h the file handle to add
+ */
+void
+GNUNET_NETWORK_fdset_handle_set_first (struct GNUNET_NETWORK_FDSet *fds,
+                                       const struct GNUNET_DISK_FileHandle *h)
+{
+  GNUNET_NETWORK_fdset_handle_set (fds, h);
+}
+
+
+/**
+ * Check if a file handle is part of an fd set
+ *
+ * @param fds fd set
+ * @param h file handle
+ * @return #GNUNET_YES if the file handle is part of the set
+ */
+int
+GNUNET_NETWORK_fdset_handle_isset (const struct GNUNET_NETWORK_FDSet *fds,
+                                   const struct GNUNET_DISK_FileHandle *h)
+{
+  return FD_ISSET (h->fd,
+                   &fds->sds);
+}
+
+
+/**
+ * Checks if two fd sets overlap
+ *
+ * @param fds1 first fd set
+ * @param fds2 second fd set
+ * @return #GNUNET_YES if they do overlap, #GNUNET_NO otherwise
+ */
+int
+GNUNET_NETWORK_fdset_overlap (const struct GNUNET_NETWORK_FDSet *fds1,
+                              const struct GNUNET_NETWORK_FDSet *fds2)
+{
+  int nfds;
+
+  nfds = GNUNET_MIN (fds1->nsds,
+                     fds2->nsds);
+  while (nfds > 0)
+  {
+    nfds--;
+    if ((FD_ISSET (nfds,
+                   &fds1->sds)) &&
+        (FD_ISSET (nfds,
+                   &fds2->sds)))
+      return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Creates an fd set
+ *
+ * @return a new fd set
+ */
+struct GNUNET_NETWORK_FDSet *
+GNUNET_NETWORK_fdset_create ()
+{
+  struct GNUNET_NETWORK_FDSet *fds;
+
+  fds = GNUNET_new (struct GNUNET_NETWORK_FDSet);
+  GNUNET_NETWORK_fdset_zero (fds);
+  return fds;
+}
+
+
+/**
+ * Releases the associated memory of an fd set
+ *
+ * @param fds fd set
+ */
+void
+GNUNET_NETWORK_fdset_destroy (struct GNUNET_NETWORK_FDSet *fds)
+{
+  GNUNET_free (fds);
+}
+
+
+/**
+ * Test if the given @a port is available.
+ *
+ * @param ipproto transport protocol to test (e.g. IPPROTO_TCP)
+ * @param port port number to test
+ * @return #GNUNET_OK if the port is available, #GNUNET_NO if not
+ */
+int
+GNUNET_NETWORK_test_port_free (int ipproto,
+                               uint16_t port)
+{
+  struct GNUNET_NETWORK_Handle *socket;
+  int bind_status;
+  int socktype;
+  char open_port_str[6];
+  struct addrinfo hint;
+  struct addrinfo *ret;
+  struct addrinfo *ai;
+
+  GNUNET_snprintf (open_port_str,
+                   sizeof(open_port_str),
+                   "%u",
+                   (unsigned int) port);
+  socktype = (IPPROTO_TCP == ipproto) ? SOCK_STREAM : SOCK_DGRAM;
+  ret = NULL;
+  memset (&hint, 0, sizeof(hint));
+  hint.ai_family = AF_UNSPEC; /* IPv4 and IPv6 */
+  hint.ai_socktype = socktype;
+  hint.ai_protocol = ipproto;
+  hint.ai_addrlen = 0;
+  hint.ai_addr = NULL;
+  hint.ai_canonname = NULL;
+  hint.ai_next = NULL;
+  hint.ai_flags = AI_PASSIVE | AI_NUMERICSERV; /* Wild card address */
+  GNUNET_assert (0 == getaddrinfo (NULL,
+                                   open_port_str,
+                                   &hint,
+                                   &ret));
+  bind_status = GNUNET_NO;
+  for (ai = ret; NULL != ai; ai = ai->ai_next)
+  {
+    socket = GNUNET_NETWORK_socket_create (ai->ai_family,
+                                           ai->ai_socktype,
+                                           ai->ai_protocol);
+    if (NULL == socket)
+      continue;
+    bind_status = GNUNET_NETWORK_socket_bind (socket,
+                                              ai->ai_addr,
+                                              ai->ai_addrlen);
+    GNUNET_NETWORK_socket_close (socket);
+    if (GNUNET_OK != bind_status)
+      break;
+  }
+  freeaddrinfo (ret);
+  return bind_status;
+}
+
+
+/**
+ * Check if sockets or pipes meet certain conditions
+ *
+ * @param rfds set of sockets or pipes to be checked for readability
+ * @param wfds set of sockets or pipes to be checked for writability
+ * @param efds set of sockets or pipes to be checked for exceptions
+ * @param timeout relative value when to return
+ * @return number of selected sockets or pipes, #GNUNET_SYSERR on error
+ */
+int
+GNUNET_NETWORK_socket_select (struct GNUNET_NETWORK_FDSet *rfds,
+                              struct GNUNET_NETWORK_FDSet *wfds,
+                              struct GNUNET_NETWORK_FDSet *efds,
+                              const struct GNUNET_TIME_Relative timeout)
+{
+  int nfds;
+  struct timeval tv;
+
+  if (NULL != rfds)
+    nfds = rfds->nsds;
+  else
+    nfds = 0;
+  if (NULL != wfds)
+    nfds = GNUNET_MAX (nfds,
+                       wfds->nsds);
+  if (NULL != efds)
+    nfds = GNUNET_MAX (nfds,
+                       efds->nsds);
+  if ((0 == nfds) &&
+      (timeout.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us))
+  {
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ (
+           "Fatal internal logic error, process hangs in `%s' (abort with CTRL-C)!\n"),
+         "select");
+  }
+  if (timeout.rel_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us > (unsigned
+                                                                      long long)
+      LONG_MAX)
+  {
+    tv.tv_sec = LONG_MAX;
+    tv.tv_usec = 999999L;
+  }
+  else
+  {
+    tv.tv_sec = (long) (timeout.rel_value_us
+                        / GNUNET_TIME_UNIT_SECONDS.rel_value_us);
+    tv.tv_usec =
+      (timeout.rel_value_us
+       - (tv.tv_sec * GNUNET_TIME_UNIT_SECONDS.rel_value_us));
+  }
+  return select (nfds,
+                 (NULL != rfds) ? &rfds->sds : NULL,
+                 (NULL != wfds) ? &wfds->sds : NULL,
+                 (NULL != efds) ? &efds->sds : NULL,
+                 (timeout.rel_value_us ==
+                  GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us) ? NULL : &tv);
+}
+
+
+/* end of network.c */
diff --git a/src/lib/util/nt.c b/src/lib/util/nt.c
new file mode 100644
index 000000000..24471d9ad
--- /dev/null
+++ b/src/lib/util/nt.c
@@ -0,0 +1,438 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010-2015, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/nt.c
+ * @brief LAN interface scanning to determine IPs in LAN
+ * @author Christian Grothoff
+ * @author Matthias Wachs
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * How frequently do we scan the interfaces for changes to the addresses?
+ */
+#define INTERFACE_PROCESSING_INTERVAL GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MINUTES, 2)
+
+
+const char *
+GNUNET_NT_to_string (enum GNUNET_NetworkType net)
+{
+  switch (net)
+  {
+  case GNUNET_NT_UNSPECIFIED:
+    return "UNSPECIFIED";
+
+  case GNUNET_NT_LOOPBACK:
+    return "LOOPBACK";
+
+  case GNUNET_NT_LAN:
+    return "LAN";
+
+  case GNUNET_NT_WAN:
+    return "WAN";
+
+  case GNUNET_NT_WLAN:
+    return "WLAN";
+
+  case GNUNET_NT_BT:
+    return "BLUETOOTH";
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * We keep a list of our local networks so we can answer
+ * LAN vs. WAN questions.  Note: WLAN is not detected yet.
+ * (maybe we can do that heuristically based on interface
+ * name in the future?).
+ */
+struct NT_Network
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct NT_Network *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct NT_Network *prev;
+
+  /**
+   * Network address.
+   */
+  struct sockaddr *network;
+
+  /**
+   * Netmask to determine what is in the LAN.
+   */
+  struct sockaddr *netmask;
+
+  /**
+   * How long are @e network and @e netmask?
+   */
+  socklen_t length;
+};
+
+
+/**
+ * Handle to the interface scanner.
+ */
+struct GNUNET_NT_InterfaceScanner
+{
+  /**
+   * Head of LAN networks list.
+   */
+  struct NT_Network *net_head;
+
+  /**
+   * Tail of LAN networks list.
+   */
+  struct NT_Network *net_tail;
+
+  /**
+   * Task for periodically refreshing our LAN network list.
+   */
+  struct GNUNET_SCHEDULER_Task *interface_task;
+};
+
+
+/**
+ * Delete all entries from the current network list.
+ *
+ * @param is scanner to clean up
+ */
+static void
+delete_networks (struct GNUNET_NT_InterfaceScanner *is)
+{
+  struct NT_Network *cur;
+
+  while (NULL != (cur = is->net_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (is->net_head,
+                                 is->net_tail,
+                                 cur);
+    GNUNET_free (cur);
+  }
+}
+
+
+/**
+ * Function invoked for each interface found.  Adds the interface's
+ * network addresses to the respective DLL, so we can distinguish
+ * between LAN and WAN.
+ *
+ * @param cls closure with the `struct GNUNET_NT_InterfaceScanner`
+ * @param name name of the interface (can be NULL for unknown)
+ * @param isDefault is this presumably the default interface
+ * @param addr address of this interface (can be NULL for unknown or unassigned)
+ * @param broadcast_addr the broadcast address (can be NULL for unknown or unassigned)
+ * @param netmask the network mask (can be NULL for unknown or unassigned)
+ * @param addrlen length of the address
+ * @return #GNUNET_OK to continue iteration
+ */
+static int
+interface_proc (void *cls,
+                const char *name,
+                int isDefault,
+                const struct sockaddr *addr,
+                const struct sockaddr *broadcast_addr,
+                const struct sockaddr *netmask,
+                socklen_t addrlen)
+{
+  struct GNUNET_NT_InterfaceScanner *is = cls;
+  /* Calculate network */
+  struct NT_Network *net = NULL;
+
+  (void) name;
+  (void) isDefault;
+  (void) broadcast_addr;
+
+  /* Skipping IPv4 loopback addresses since we have special check  */
+  if (addr->sa_family == AF_INET)
+  {
+    const struct sockaddr_in *a4 = (const struct sockaddr_in *) addr;
+
+    if ((a4->sin_addr.s_addr & htonl (0xff000000)) == htonl (0x7f000000))
+      return GNUNET_OK;
+  }
+  /* Skipping IPv6 loopback addresses since we have special check  */
+  if (addr->sa_family == AF_INET6)
+  {
+    const struct sockaddr_in6 *a6 = (const struct sockaddr_in6 *) addr;
+    if (IN6_IS_ADDR_LOOPBACK (&a6->sin6_addr))
+      return GNUNET_OK;
+  }
+
+  if (addr->sa_family == AF_INET)
+  {
+    const struct sockaddr_in *addr4 = (const struct sockaddr_in *) addr;
+    const struct sockaddr_in *netmask4 = (const struct sockaddr_in *) netmask;
+    struct sockaddr_in *tmp;
+    struct sockaddr_in network4;
+
+    net = GNUNET_malloc (sizeof(struct NT_Network) + 2 * sizeof(struct
+                                                                sockaddr_in));
+    tmp = (struct sockaddr_in *) &net[1];
+    net->network = (struct sockaddr *) &tmp[0];
+    net->netmask = (struct sockaddr *) &tmp[1];
+    net->length = addrlen;
+
+    memset (&network4,
+            0,
+            sizeof(network4));
+    network4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    network4.sin_len = sizeof(network4);
+#endif
+    network4.sin_addr.s_addr = (addr4->sin_addr.s_addr
+                                & netmask4->sin_addr.s_addr);
+
+    GNUNET_memcpy (net->netmask,
+                   netmask4,
+                   sizeof(struct sockaddr_in));
+    GNUNET_memcpy (net->network,
+                   &network4,
+                   sizeof(struct sockaddr_in));
+  }
+
+  if (addr->sa_family == AF_INET6)
+  {
+    const struct sockaddr_in6 *addr6 = (const struct sockaddr_in6 *) addr;
+    const struct sockaddr_in6 *netmask6 = (const struct sockaddr_in6 *) netmask;
+    struct sockaddr_in6 *tmp;
+    struct sockaddr_in6 network6;
+
+    net = GNUNET_malloc (sizeof(struct NT_Network) + 2 * sizeof(struct
+                                                                sockaddr_in6));
+    tmp = (struct sockaddr_in6 *) &net[1];
+    net->network = (struct sockaddr *) &tmp[0];
+    net->netmask = (struct sockaddr *) &tmp[1];
+    net->length = addrlen;
+
+    memset (&network6, 0, sizeof(network6));
+    network6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    network6.sin6_len = sizeof(network6);
+#endif
+    unsigned int c = 0;
+    uint32_t *addr_elem = (uint32_t *) &addr6->sin6_addr;
+    uint32_t *mask_elem = (uint32_t *) &netmask6->sin6_addr;
+    uint32_t *net_elem = (uint32_t *) &network6.sin6_addr;
+    for (c = 0; c < 4; c++)
+      net_elem[c] = addr_elem[c] & mask_elem[c];
+
+    GNUNET_memcpy (net->netmask,
+                   netmask6,
+                   sizeof(struct sockaddr_in6));
+    GNUNET_memcpy (net->network,
+                   &network6,
+                   sizeof(struct sockaddr_in6));
+  }
+  if (NULL == net)
+    return GNUNET_OK; /* odd / unsupported address family */
+
+  /* Store in list */
+#if VERBOSE_NT
+  char *netmask = GNUNET_strdup (GNUNET_a2s ((struct sockaddr *) net->netmask,
+                                             addrlen));
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "nt",
+                   "Adding network `%s', netmask `%s'\n",
+                   GNUNET_a2s ((struct sockaddr *) net->network,
+                               addrlen),
+                   netmask);
+  GNUNET_free (netmask);
+#endif
+  GNUNET_CONTAINER_DLL_insert (is->net_head,
+                               is->net_tail,
+                               net);
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Periodically get list of network addresses from our interfaces.
+ *
+ * @param cls closure
+ */
+static void
+get_addresses (void *cls)
+{
+  struct GNUNET_NT_InterfaceScanner *is = cls;
+
+  is->interface_task = NULL;
+  delete_networks (is);
+  GNUNET_OS_network_interfaces_list (&interface_proc,
+                                     is);
+  is->interface_task = GNUNET_SCHEDULER_add_delayed (
+    INTERFACE_PROCESSING_INTERVAL,
+    &get_addresses,
+    is);
+}
+
+
+/**
+ * Returns where the address is located: LAN or WAN or ...
+ *
+ * @param is the interface scanner handle
+ * @param addr address
+ * @param addrlen address length
+ * @return type of the network the address belongs to
+ */
+enum GNUNET_NetworkType
+GNUNET_NT_scanner_get_type (struct GNUNET_NT_InterfaceScanner *is,
+                            const struct sockaddr *addr,
+                            socklen_t addrlen)
+{
+  struct NT_Network *cur = is->net_head;
+  enum GNUNET_NetworkType type = GNUNET_NT_UNSPECIFIED;
+
+  switch (addr->sa_family)
+  {
+  case AF_UNIX:
+    type = GNUNET_NT_LOOPBACK;
+    break;
+
+  case AF_INET:
+    {
+      const struct sockaddr_in *a4 = (const struct sockaddr_in *) addr;
+
+      if ((a4->sin_addr.s_addr & htonl (0xff000000)) == htonl (0x7f000000))
+        type = GNUNET_NT_LOOPBACK;
+      break;
+    }
+
+  case AF_INET6:
+    {
+      const struct sockaddr_in6 *a6 = (const struct sockaddr_in6 *) addr;
+
+      if (IN6_IS_ADDR_LOOPBACK (&a6->sin6_addr))
+        type = GNUNET_NT_LOOPBACK;
+      break;
+    }
+
+  default:
+    GNUNET_break (0);
+    break;
+  }
+
+  /* Check local networks */
+  while ((NULL != cur) && (GNUNET_NT_UNSPECIFIED == type))
+  {
+    if (addrlen != cur->length)
+    {
+      cur = cur->next;
+      continue;
+    }
+    if (addr->sa_family == AF_INET)
+    {
+      const struct sockaddr_in *a4 = (const struct sockaddr_in *) addr;
+      const struct sockaddr_in *net4 = (const struct
+                                        sockaddr_in *) cur->network;
+      const struct sockaddr_in *mask4 = (const struct
+                                         sockaddr_in *) cur->netmask;
+
+      if (((a4->sin_addr.s_addr & mask4->sin_addr.s_addr)) ==
+          net4->sin_addr.s_addr)
+        type = GNUNET_NT_LAN;
+    }
+    if (addr->sa_family == AF_INET6)
+    {
+      const struct sockaddr_in6 *a6 = (const struct sockaddr_in6 *) addr;
+      const struct sockaddr_in6 *net6 = (const struct
+                                         sockaddr_in6 *) cur->network;
+      const struct sockaddr_in6 *mask6 = (const struct
+                                          sockaddr_in6 *) cur->netmask;
+
+      int res = GNUNET_YES;
+      int c = 0;
+      uint32_t *addr_elem = (uint32_t *) &a6->sin6_addr;
+      uint32_t *mask_elem = (uint32_t *) &mask6->sin6_addr;
+      uint32_t *net_elem = (uint32_t *) &net6->sin6_addr;
+      for (c = 0; c < 4; c++)
+        if ((addr_elem[c] & mask_elem[c]) != net_elem[c])
+          res = GNUNET_NO;
+
+      if (res == GNUNET_YES)
+        type = GNUNET_NT_LAN;
+    }
+    cur = cur->next;
+  }
+
+  /* no local network found for this address, default: WAN */
+  if (type == GNUNET_NT_UNSPECIFIED)
+    type = GNUNET_NT_WAN;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "nt-scanner-api",
+                   "`%s' is in network `%s'\n",
+                   GNUNET_a2s (addr,
+                               addrlen),
+                   GNUNET_NT_to_string (type));
+  return type;
+}
+
+
+/**
+ * Initialize the interface scanner.
+ *
+ * @return interface scanner
+ */
+struct GNUNET_NT_InterfaceScanner *
+GNUNET_NT_scanner_init ()
+{
+  struct GNUNET_NT_InterfaceScanner *is;
+
+  is = GNUNET_new (struct GNUNET_NT_InterfaceScanner);
+  GNUNET_OS_network_interfaces_list (&interface_proc,
+                                     is);
+  is->interface_task = GNUNET_SCHEDULER_add_delayed (
+    INTERFACE_PROCESSING_INTERVAL,
+    &get_addresses,
+    is);
+  return is;
+}
+
+
+/**
+ * Client is done with the interface scanner, release resources.
+ *
+ * @param is handle to release
+ */
+void
+GNUNET_NT_scanner_done (struct GNUNET_NT_InterfaceScanner *is)
+{
+  if (NULL != is->interface_task)
+  {
+    GNUNET_SCHEDULER_cancel (is->interface_task);
+    is->interface_task = NULL;
+  }
+  delete_networks (is);
+  GNUNET_free (is);
+}
+
+
+/* end of nt.c */
diff --git a/src/lib/util/op.c b/src/lib/util/op.c
new file mode 100644
index 000000000..a8fc3de4a
--- /dev/null
+++ b/src/lib/util/op.c
@@ -0,0 +1,335 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file
+ * Asynchronous operations; register callbacks for operations and call them when a response arrives.
+ *
+ * @author Gabor X Toth
+ */
+
+#include "platform.h"
+#include <inttypes.h>
+
+
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-op", __VA_ARGS__)
+
+struct OperationListItem
+{
+  struct OperationListItem *prev;
+  struct OperationListItem *next;
+
+  /**
+   * Operation ID.
+   */
+  uint64_t op_id;
+
+  /**
+   * Continuation to invoke with the result of an operation.
+   */
+  GNUNET_ResultCallback result_cb;
+
+  /**
+   * Closure for @a result_cb.
+   */
+  void *cls;
+
+  /**
+   * User context.
+   */
+  void *ctx;
+};
+
+
+/**
+ * Operations handle.
+ */
+
+struct GNUNET_OP_Handle
+{
+  /**
+   * First operation in the linked list.
+   */
+  struct OperationListItem *op_head;
+
+  /**
+   * Last operation in the linked list.
+   */
+  struct OperationListItem *op_tail;
+
+  /**
+   * Last operation ID used.
+   */
+  uint64_t last_op_id;
+};
+
+
+/**
+ * Create new operations handle.
+ */
+struct GNUNET_OP_Handle *
+GNUNET_OP_create ()
+{
+  return GNUNET_new (struct GNUNET_OP_Handle);
+}
+
+
+/**
+ * Destroy operations handle.
+ */
+void
+GNUNET_OP_destroy (struct GNUNET_OP_Handle *h)
+{
+  GNUNET_free (h);
+}
+
+
+/**
+ * Get a unique operation ID to distinguish between asynchronous requests.
+ *
+ * @param h
+ *        Operations handle.
+ *
+ * @return Operation ID to use.
+ */
+uint64_t
+GNUNET_OP_get_next_id (struct GNUNET_OP_Handle *h)
+{
+  return ++h->last_op_id;
+}
+
+
+/**
+ * Find operation by ID.
+ *
+ * @param h
+ *        Operations handle.
+ * @param op_id
+ *        Operation ID to look up.
+ *
+ * @return Operation, or NULL if not found.
+ */
+static struct OperationListItem *
+op_find (struct GNUNET_OP_Handle *h,
+         uint64_t op_id)
+{
+  struct OperationListItem *op;
+
+  for (op = h->op_head; NULL != op; op = op->next)
+    if (op->op_id == op_id)
+      return op;
+  return NULL;
+}
+
+
+/**
+ * Find operation by ID.
+ *
+ * @param h
+ *        Operations handle.
+ * @param op_id
+ *        Operation ID to look up.
+ * @param[out] result_cb
+ *        If an operation was found, its result callback is returned here.
+ * @param[out] cls
+ *        If an operation was found, its closure is returned here.
+ * @param[out] ctx
+ *        If an operation was found, its user context is returned here.
+ *
+ * @return #GNUNET_YES if an operation was found,
+ *         #GNUNET_NO  if not found.
+ */
+int
+GNUNET_OP_get (struct GNUNET_OP_Handle *h,
+               uint64_t op_id,
+               GNUNET_ResultCallback *result_cb,
+               void **cls,
+               void **ctx)
+{
+  struct OperationListItem *op = op_find (h, op_id);
+
+  if (NULL != op)
+  {
+    if (NULL != result_cb)
+      *result_cb = op->result_cb;
+    if (NULL != cls)
+      *cls = op->cls;
+    if (NULL != ctx)
+      *ctx = op->ctx;
+    return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Add a new operation.
+ *
+ * @param h
+ *        Operations handle.
+ * @param result_cb
+ *        Function to call with the result of the operation.
+ * @param cls
+ *        Closure for @a result_cb.
+ * @param ctx
+ *        User context.
+ *
+ * @return ID of the new operation.
+ */
+uint64_t
+GNUNET_OP_add (struct GNUNET_OP_Handle *h,
+               GNUNET_ResultCallback result_cb,
+               void *cls,
+               void *ctx)
+{
+  struct OperationListItem *op;
+
+  op = GNUNET_new (struct OperationListItem);
+  op->op_id = GNUNET_OP_get_next_id (h);
+  op->result_cb = result_cb;
+  op->cls = cls;
+  op->ctx = ctx;
+  GNUNET_CONTAINER_DLL_insert_tail (h->op_head,
+                                    h->op_tail,
+                                    op);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "%p Added operation #%" PRIu64 "\n",
+       h, op->op_id);
+  return op->op_id;
+}
+
+
+/**
+ * Remove an operation, and call its result callback (unless it was cancelled).
+ *
+ *
+ * @param h
+ *        Operations handle.
+ * @param op_id
+ *        Operation ID.
+ * @param result_code
+ *        Result of the operation.
+ * @param data
+ *        Data result of the operation.
+ * @param data_size
+ *        Size of @a data.
+ * @param[out] ctx
+ *        User context.
+ * @param cancel
+ *        Is the operation cancelled?
+ *        #GNUNET_NO  Not cancelled, result callback is called.
+ *        #GNUNET_YES Cancelled, result callback is not called.
+ *
+ * @return #GNUNET_YES if the operation was found and removed,
+ *         #GNUNET_NO  if the operation was not found.
+ */
+static int
+op_result (struct GNUNET_OP_Handle *h,
+           uint64_t op_id,
+           int64_t result_code,
+           const void *data,
+           uint16_t data_size,
+           void **ctx,
+           uint8_t cancel)
+{
+  if (0 == op_id)
+    return GNUNET_NO;
+
+  struct OperationListItem *op = op_find (h, op_id);
+  if (NULL == op)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Could not find operation #%" PRIu64 "\n", op_id);
+    return GNUNET_NO;
+  }
+
+  if (NULL != ctx)
+    *ctx = op->ctx;
+
+  GNUNET_CONTAINER_DLL_remove (h->op_head,
+                               h->op_tail,
+                               op);
+
+  if ((GNUNET_YES != cancel) &&
+      (NULL != op->result_cb))
+    op->result_cb (op->cls,
+                   result_code, data,
+                   data_size);
+  GNUNET_free (op);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Call the result callback of an operation and remove it.
+ *
+ * @param h
+ *        Operations handle.
+ * @param op_id
+ *        Operation ID.
+ * @param result_code
+ *        Result of the operation.
+ * @param data
+ *        Data result of the operation.
+ * @param data_size
+ *        Size of @a data.
+ * @param[out] ctx
+ *        User context.
+ *
+ * @return #GNUNET_YES if the operation was found and removed,
+ *         #GNUNET_NO  if the operation was not found.
+ */
+int
+GNUNET_OP_result (struct GNUNET_OP_Handle *h,
+                  uint64_t op_id,
+                  int64_t result_code,
+                  const void *data,
+                  uint16_t data_size,
+                  void **ctx)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "%p Received result for operation #%" PRIu64 ": %" PRId64 " (size: %u)\n",
+       h, op_id, result_code, data_size);
+  return op_result (h, op_id, result_code, data, data_size, ctx, GNUNET_NO);
+}
+
+
+/**
+ * Remove / cancel an operation.
+ *
+ * @param h
+ *        Operations handle.
+ * @param op_id
+ *        Operation ID.
+ *
+ * @return #GNUNET_YES if the operation was found and removed,
+ *         #GNUNET_NO  if the operation was not found.
+ */
+int
+GNUNET_OP_remove (struct GNUNET_OP_Handle *h,
+                  uint64_t op_id)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "%p Cancelling operation #%" PRIu64  "\n",
+       h, op_id);
+  return op_result (h, op_id, 0, NULL, 0, NULL, GNUNET_YES);
+}
diff --git a/src/lib/util/os_installation.c b/src/lib/util/os_installation.c
new file mode 100644
index 000000000..ff04a8a7f
--- /dev/null
+++ b/src/lib/util/os_installation.c
@@ -0,0 +1,829 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2006-2018, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file src/util/os_installation.c
+ * @brief get paths used by the program
+ * @author Milan
+ * @author Christian Fuchs
+ * @author Christian Grothoff
+ * @author Matthias Wachs
+ * @author Heikki Lindholm
+ * @author LRN
+ */
+#include "platform.h"
+#include <sys/stat.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <unistr.h> /* for u16_to_u8 */
+
+
+#include "gnunet_util_lib.h"
+#if DARWIN
+#include <mach-o/ldsyms.h>
+#include <mach-o/dyld.h>
+#endif
+
+
+#define LOG(kind, ...) \
+  GNUNET_log_from (kind, "util-os-installation", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename)       \
+  GNUNET_log_from_strerror_file (kind,                   \
+                                 "util-os-installation", \
+                                 syscall,                \
+                                 filename)
+
+
+/**
+ * Default project data used for installation path detection
+ * for GNUnet (core).
+ */
+static const struct GNUNET_OS_ProjectData default_pd = {
+  .libname = "libgnunetutil",
+  .project_dirname = "gnunet",
+  .binary_name = "gnunet-arm",
+  .version = PACKAGE_VERSION " " VCS_VERSION,
+  .env_varname = "GNUNET_PREFIX",
+  .base_config_varname = "GNUNET_BASE_CONFIG",
+  .bug_email = "gnunet-developers@gnu.org",
+  .homepage = "http://www.gnu.org/s/gnunet/",
+  .config_file = "gnunet.conf",
+  .user_config_file = "~/.config/gnunet.conf",
+  .is_gnu = 1,
+  .gettext_domain = "gnunet",
+  .gettext_path = NULL,
+  .agpl_url = GNUNET_AGPL_URL,
+};
+
+/**
+ * Which project data do we currently use for installation
+ * path detection? Never NULL.
+ */
+static const struct GNUNET_OS_ProjectData *current_pd = &default_pd;
+
+/**
+ * PD for which gettext has been initialized last.
+ * Note that the gettext initialization done within
+ * GNUNET_PROGRAM_run2 is for the specific application.
+ */
+static const struct GNUNET_OS_ProjectData *gettextinit;
+
+
+/**
+ * Return default project data used by 'libgnunetutil' for GNUnet.
+ */
+const struct GNUNET_OS_ProjectData *
+GNUNET_OS_project_data_default (void)
+{
+  return &default_pd;
+}
+
+
+/**
+ * @return current project data.
+ */
+const struct GNUNET_OS_ProjectData *
+GNUNET_OS_project_data_get ()
+{
+  if (current_pd != gettextinit)
+  {
+    char *path = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LOCALEDIR);
+
+    if (NULL != path)
+      bindtextdomain (PACKAGE,
+                      path);
+    GNUNET_free (path);
+    gettextinit = current_pd;
+  }
+  return current_pd;
+}
+
+
+void
+GNUNET_OS_init (const struct GNUNET_OS_ProjectData *pd)
+{
+  GNUNET_assert (NULL != pd);
+  current_pd = pd;
+  if (pd != gettextinit)
+  {
+    char *path = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LOCALEDIR);
+
+    if (NULL != path)
+      bindtextdomain (PACKAGE,
+                      path);
+    GNUNET_free (path);
+    gettextinit = pd;
+  }
+}
+
+
+#ifdef __linux__
+/**
+ * Try to determine path by reading /proc/PID/exe
+ *
+ * @return NULL on error
+ */
+static char *
+get_path_from_proc_maps (void)
+{
+  char fn[64];
+  char line[1024];
+  char dir[1024];
+  FILE *f;
+  char *lgu;
+
+  if (NULL == current_pd->libname)
+    return NULL;
+  GNUNET_snprintf (fn,
+                   sizeof(fn),
+                   "/proc/%u/maps",
+                   getpid ());
+  if (NULL == (f = fopen (fn, "r")))
+    return NULL;
+  while (NULL != fgets (line, sizeof(line), f))
+  {
+    if ((1 == sscanf (line,
+                      "%*p-%*p %*c%*c%*c%*c %*x %*x:%*x %*u%*[ ]%1023s",
+                      dir)) &&
+        (NULL != (lgu = strstr (dir,
+                                current_pd->libname))))
+    {
+      lgu[0] = '\0';
+      fclose (f);
+      return GNUNET_strdup (dir);
+    }
+  }
+  fclose (f);
+  return NULL;
+}
+
+
+/**
+ * Try to determine path by reading /proc/PID/exe
+ *
+ * @return NULL on error
+ */
+static char *
+get_path_from_proc_exe (void)
+{
+  char fn[64];
+  char lnk[1024];
+  ssize_t size;
+  char *lep;
+
+  GNUNET_snprintf (fn, sizeof(fn), "/proc/%u/exe", getpid ());
+  size = readlink (fn, lnk, sizeof(lnk) - 1);
+  if (size <= 0)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "readlink", fn);
+    return NULL;
+  }
+  GNUNET_assert (((size_t) size) < sizeof(lnk));
+  lnk[size] = '\0';
+  while ((lnk[size] != '/') && (size > 0))
+    size--;
+  GNUNET_asprintf (&lep, "/%s/libexec/", current_pd->project_dirname);
+  /* test for being in lib/gnunet/libexec/ or lib/MULTIARCH/gnunet/libexec */
+  if ((((size_t) size) > strlen (lep)) &&
+      (0 == strcmp (lep, &lnk[size - strlen (lep)])))
+    size -= strlen (lep) - 1;
+  GNUNET_free (lep);
+  if ((size < 4) || (lnk[size - 4] != '/'))
+  {
+    /* not installed in "/bin/" -- binary path probably useless */
+    return NULL;
+  }
+  lnk[size] = '\0';
+  return GNUNET_strdup (lnk);
+}
+
+
+#endif
+
+
+#if DARWIN
+/**
+ * Signature of the '_NSGetExecutablePath" function.
+ *
+ * @param buf where to write the path
+ * @param number of bytes available in @a buf
+ * @return 0 on success, otherwise desired number of bytes is stored in 'bufsize'
+ */
+typedef int (*MyNSGetExecutablePathProto) (char *buf, size_t *bufsize);
+
+
+/**
+ * Try to obtain the path of our executable using '_NSGetExecutablePath'.
+ *
+ * @return NULL on error
+ */
+static char *
+get_path_from_NSGetExecutablePath (void)
+{
+  static char zero = '\0';
+  char *path;
+  size_t len;
+  MyNSGetExecutablePathProto func;
+
+  path = NULL;
+  if (NULL ==
+      (func = (MyNSGetExecutablePathProto) dlsym (RTLD_DEFAULT,
+                                                  "_NSGetExecutablePath")))
+    return NULL;
+  path = &zero;
+  len = 0;
+  /* get the path len, including the trailing \0 */
+  (void) func (path, &len);
+  if (0 == len)
+    return NULL;
+  path = GNUNET_malloc (len);
+  if (0 != func (path, &len))
+  {
+    GNUNET_free (path);
+    return NULL;
+  }
+  len = strlen (path);
+  while ((path[len] != '/') && (len > 0))
+    len--;
+  path[len] = '\0';
+  return path;
+}
+
+
+/**
+ * Try to obtain the path of our executable using '_dyld_image' API.
+ *
+ * @return NULL on error
+ */
+static char *
+get_path_from_dyld_image (void)
+{
+  const char *path;
+  char *p;
+  char *s;
+  unsigned int i;
+  int c;
+
+  c = _dyld_image_count ();
+  for (i = 0; i < c; i++)
+  {
+    if (((const void *) _dyld_get_image_header (i)) !=
+        ((const void *) &_mh_dylib_header))
+      continue;
+    path = _dyld_get_image_name (i);
+    if ((NULL == path) || (0 == strlen (path)))
+      continue;
+    p = GNUNET_strdup (path);
+    s = p + strlen (p);
+    while ((s > p) && ('/' != *s))
+      s--;
+    s++;
+    *s = '\0';
+    return p;
+  }
+  return NULL;
+}
+
+
+#endif
+
+
+/**
+ * Return the actual path to a file found in the current
+ * PATH environment variable.
+ *
+ * @param binary the name of the file to find
+ * @return path to binary, NULL if not found
+ */
+static char *
+get_path_from_PATH (const char *binary)
+{
+  char *path;
+  char *pos;
+  char *end;
+  char *buf;
+  const char *p;
+
+  if (NULL == (p = getenv ("PATH")))
+    return NULL;
+
+  path = GNUNET_strdup (p);  /* because we write on it */
+
+  buf = GNUNET_malloc (strlen (path) + strlen (binary) + 1 + 1);
+  pos = path;
+  while (NULL != (end = strchr (pos, PATH_SEPARATOR)))
+  {
+    *end = '\0';
+    sprintf (buf, "%s/%s", pos, binary);
+    if (GNUNET_DISK_file_test (buf) == GNUNET_YES)
+    {
+      pos = GNUNET_strdup (pos);
+      GNUNET_free (buf);
+      GNUNET_free (path);
+      return pos;
+    }
+    pos = end + 1;
+  }
+  sprintf (buf, "%s/%s", pos, binary);
+  if (GNUNET_YES == GNUNET_DISK_file_test (buf))
+  {
+    pos = GNUNET_strdup (pos);
+    GNUNET_free (buf);
+    GNUNET_free (path);
+    return pos;
+  }
+  GNUNET_free (buf);
+  GNUNET_free (path);
+  return NULL;
+}
+
+
+/**
+ * Try to obtain the installation path using the "GNUNET_PREFIX" environment
+ * variable.
+ *
+ * @return NULL on error (environment variable not set)
+ */
+static char *
+get_path_from_GNUNET_PREFIX (void)
+{
+  const char *p;
+
+  if ((NULL != current_pd->env_varname) &&
+      (NULL != (p = getenv (current_pd->env_varname))))
+    return GNUNET_strdup (p);
+  if ((NULL != current_pd->env_varname_alt) &&
+      (NULL != (p = getenv (current_pd->env_varname_alt))))
+    return GNUNET_strdup (p);
+  return NULL;
+}
+
+
+/**
+ * @brief get the path to GNUnet bin/ or lib/, preferring the lib/ path
+ * @author Milan
+ *
+ * @return a pointer to the executable path, or NULL on error
+ */
+static char *
+os_get_gnunet_path (void)
+{
+  char *ret;
+
+  if (NULL != (ret = get_path_from_GNUNET_PREFIX ()))
+    return ret;
+#ifdef __linux__
+  if (NULL != (ret = get_path_from_proc_maps ()))
+    return ret;
+  /* try path *first*, before /proc/exe, as /proc/exe can be wrong */
+  if ((NULL != current_pd->binary_name) &&
+      (NULL != (ret = get_path_from_PATH (current_pd->binary_name))))
+    return ret;
+  if (NULL != (ret = get_path_from_proc_exe ()))
+    return ret;
+#endif
+#if DARWIN
+  if (NULL != (ret = get_path_from_dyld_image ()))
+    return ret;
+  if (NULL != (ret = get_path_from_NSGetExecutablePath ()))
+    return ret;
+#endif
+  if ((NULL != current_pd->binary_name) &&
+      (NULL != (ret = get_path_from_PATH (current_pd->binary_name))))
+    return ret;
+  /* other attempts here */
+  LOG (GNUNET_ERROR_TYPE_ERROR,
+       _ (
+         "Could not determine installation path for %s.  Set `%s' environment variable.\n"),
+       current_pd->project_dirname,
+       current_pd->env_varname);
+  return NULL;
+}
+
+
+/**
+ * @brief get the path to current app's bin/
+ * @return a pointer to the executable path, or NULL on error
+ */
+static char *
+os_get_exec_path ()
+{
+  char *ret = NULL;
+
+#ifdef __linux__
+  if (NULL != (ret = get_path_from_proc_exe ()))
+    return ret;
+#endif
+#if DARWIN
+  if (NULL != (ret = get_path_from_NSGetExecutablePath ()))
+    return ret;
+#endif
+  /* other attempts here */
+  return ret;
+}
+
+
+/**
+ * @brief get the path to a specific GNUnet installation directory or,
+ * with #GNUNET_OS_IPK_SELF_PREFIX, the current running apps installation directory
+ * @return a pointer to the dir path (to be freed by the caller)
+ */
+char *
+GNUNET_OS_installation_get_path (enum GNUNET_OS_InstallationPathKind dirkind)
+{
+  size_t n;
+  char *dirname;
+  char *execpath = NULL;
+  char *tmp;
+  char *multiarch;
+  char *libdir;
+  int isbasedir;
+
+  /* if wanted, try to get the current app's bin/ */
+  if (dirkind == GNUNET_OS_IPK_SELF_PREFIX)
+    execpath = os_get_exec_path ();
+
+  /* try to get GNUnet's bin/ or lib/, or if previous was unsuccessful some
+   * guess for the current app */
+  if (NULL == execpath)
+    execpath = os_get_gnunet_path ();
+  if (NULL == execpath)
+    return NULL;
+
+  n = strlen (execpath);
+  if (0 == n)
+  {
+    /* should never happen, but better safe than sorry */
+    GNUNET_free (execpath);
+    return NULL;
+  }
+  /* remove filename itself */
+  while ((n > 1) && (DIR_SEPARATOR == execpath[n - 1]))
+    execpath[--n] = '\0';
+
+  isbasedir = 1;
+  if ((n > 6) && ((0 == strcasecmp (&execpath[n - 6], "/lib32")) ||
+                  (0 == strcasecmp (&execpath[n - 6], "/lib64"))))
+  {
+    if ((GNUNET_OS_IPK_LIBDIR != dirkind) &&
+        (GNUNET_OS_IPK_LIBEXECDIR != dirkind))
+    {
+      /* strip '/lib32' or '/lib64' */
+      execpath[n - 6] = '\0';
+      n -= 6;
+    }
+    else
+      isbasedir = 0;
+  }
+  else if ((n > 4) && ((0 == strcasecmp (&execpath[n - 4], "/bin")) ||
+                       (0 == strcasecmp (&execpath[n - 4], "/lib"))))
+  {
+    /* strip '/bin' or '/lib' */
+    execpath[n - 4] = '\0';
+    n -= 4;
+  }
+  multiarch = NULL;
+  if (NULL != (libdir = strstr (execpath, "/lib/")))
+  {
+    /* test for multi-arch path of the form "PREFIX/lib/MULTIARCH/";
+       here we need to re-add 'multiarch' to lib and libexec paths later! */
+    multiarch = &libdir[5];
+    if (NULL == strchr (multiarch, '/'))
+      libdir[0] =
+        '\0';   /* Debian multiarch format, cut of from 'execpath' but preserve in multicarch */
+    else
+      multiarch =
+        NULL;   /* maybe not, multiarch still has a '/', which is not OK */
+  }
+  /* in case this was a directory named foo-bin, remove "foo-" */
+  while ((n > 1) && (execpath[n - 1] == DIR_SEPARATOR))
+    execpath[--n] = '\0';
+  switch (dirkind)
+  {
+  case GNUNET_OS_IPK_PREFIX:
+  case GNUNET_OS_IPK_SELF_PREFIX:
+    dirname = GNUNET_strdup (DIR_SEPARATOR_STR);
+    break;
+
+  case GNUNET_OS_IPK_BINDIR:
+    dirname = GNUNET_strdup (DIR_SEPARATOR_STR "bin" DIR_SEPARATOR_STR);
+    break;
+
+  case GNUNET_OS_IPK_LIBDIR:
+    if (isbasedir)
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s%s%s%s%s%s%s",
+                       execpath,
+                       DIR_SEPARATOR_STR "lib",
+                       (NULL != multiarch) ? DIR_SEPARATOR_STR : "",
+                       (NULL != multiarch) ? multiarch : "",
+                       DIR_SEPARATOR_STR,
+                       current_pd->project_dirname,
+                       DIR_SEPARATOR_STR);
+      if (GNUNET_YES == GNUNET_DISK_directory_test (tmp, GNUNET_YES))
+      {
+        GNUNET_free (execpath);
+        return tmp;
+      }
+      GNUNET_free (tmp);
+      tmp = NULL;
+      dirname = NULL;
+      if (4 == sizeof(void *))
+      {
+        GNUNET_asprintf (&dirname,
+                         DIR_SEPARATOR_STR "lib32" DIR_SEPARATOR_STR
+                         "%s" DIR_SEPARATOR_STR,
+                         current_pd->project_dirname);
+        GNUNET_asprintf (&tmp, "%s%s", execpath, dirname);
+      }
+      if (8 == sizeof(void *))
+      {
+        GNUNET_asprintf (&dirname,
+                         DIR_SEPARATOR_STR "lib64" DIR_SEPARATOR_STR
+                         "%s" DIR_SEPARATOR_STR,
+                         current_pd->project_dirname);
+        GNUNET_asprintf (&tmp, "%s%s", execpath, dirname);
+      }
+
+      if ((NULL != tmp) &&
+          (GNUNET_YES == GNUNET_DISK_directory_test (tmp, GNUNET_YES)))
+      {
+        GNUNET_free (execpath);
+        GNUNET_free (dirname);
+        return tmp;
+      }
+      GNUNET_free (tmp);
+      GNUNET_free (dirname);
+    }
+    GNUNET_asprintf (&dirname,
+                     DIR_SEPARATOR_STR "%s" DIR_SEPARATOR_STR,
+                     current_pd->project_dirname);
+    break;
+
+  case GNUNET_OS_IPK_DATADIR:
+    GNUNET_asprintf (&dirname,
+                     DIR_SEPARATOR_STR "share" DIR_SEPARATOR_STR
+                     "%s" DIR_SEPARATOR_STR,
+                     current_pd->project_dirname);
+    break;
+
+  case GNUNET_OS_IPK_LOCALEDIR:
+    dirname = GNUNET_strdup (DIR_SEPARATOR_STR "share" DIR_SEPARATOR_STR
+                             "locale" DIR_SEPARATOR_STR);
+    break;
+
+  case GNUNET_OS_IPK_ICONDIR:
+    dirname = GNUNET_strdup (DIR_SEPARATOR_STR "share" DIR_SEPARATOR_STR
+                             "icons" DIR_SEPARATOR_STR);
+    break;
+
+  case GNUNET_OS_IPK_DOCDIR:
+    GNUNET_asprintf (&dirname,
+                     DIR_SEPARATOR_STR "share" DIR_SEPARATOR_STR
+                     "doc" DIR_SEPARATOR_STR
+                     "%s" DIR_SEPARATOR_STR,
+                     current_pd->project_dirname);
+    break;
+
+  case GNUNET_OS_IPK_LIBEXECDIR:
+    if (isbasedir)
+    {
+      GNUNET_asprintf (&dirname,
+                       DIR_SEPARATOR_STR "%s" DIR_SEPARATOR_STR
+                       "libexec" DIR_SEPARATOR_STR,
+                       current_pd->project_dirname);
+      GNUNET_asprintf (&tmp,
+                       "%s%s%s%s",
+                       execpath,
+                       DIR_SEPARATOR_STR "lib" DIR_SEPARATOR_STR,
+                       (NULL != multiarch) ? multiarch : "",
+                       dirname);
+      GNUNET_free (dirname);
+      if (GNUNET_YES == GNUNET_DISK_directory_test (tmp, GNUNET_YES))
+      {
+        GNUNET_free (execpath);
+        return tmp;
+      }
+      GNUNET_free (tmp);
+      tmp = NULL;
+      dirname = NULL;
+      if (4 == sizeof(void *))
+      {
+        GNUNET_asprintf (&dirname,
+                         DIR_SEPARATOR_STR "lib32" DIR_SEPARATOR_STR
+                         "%s" DIR_SEPARATOR_STR
+                         "libexec" DIR_SEPARATOR_STR,
+                         current_pd->project_dirname);
+        GNUNET_asprintf (&tmp, "%s%s", execpath, dirname);
+      }
+      if (8 == sizeof(void *))
+      {
+        GNUNET_asprintf (&dirname,
+                         DIR_SEPARATOR_STR "lib64" DIR_SEPARATOR_STR
+                         "%s" DIR_SEPARATOR_STR
+                         "libexec" DIR_SEPARATOR_STR,
+                         current_pd->project_dirname);
+        GNUNET_asprintf (&tmp, "%s%s", execpath, dirname);
+      }
+      if ((NULL != tmp) &&
+          (GNUNET_YES == GNUNET_DISK_directory_test (tmp, GNUNET_YES)))
+      {
+        GNUNET_free (execpath);
+        GNUNET_free (dirname);
+        return tmp;
+      }
+      GNUNET_free (tmp);
+      GNUNET_free (dirname);
+    }
+    GNUNET_asprintf (&dirname,
+                     DIR_SEPARATOR_STR "%s" DIR_SEPARATOR_STR
+                     "libexec" DIR_SEPARATOR_STR,
+                     current_pd->project_dirname);
+    break;
+
+  default:
+    GNUNET_free (execpath);
+    return NULL;
+  }
+  GNUNET_asprintf (&tmp, "%s%s", execpath, dirname);
+  GNUNET_free (dirname);
+  GNUNET_free (execpath);
+  return tmp;
+}
+
+
+/**
+ * Given the name of a gnunet-helper, gnunet-service or gnunet-daemon
+ * binary, try to prefix it with the libexec/-directory to get the
+ * full path.
+ *
+ * @param progname name of the binary
+ * @return full path to the binary, if possible, otherwise copy of 'progname'
+ */
+char *
+GNUNET_OS_get_libexec_binary_path (const char *progname)
+{
+  static char *cache;
+  char *libexecdir;
+  char *binary;
+
+  if ((DIR_SEPARATOR == progname[0]) ||
+      (GNUNET_YES ==
+       GNUNET_STRINGS_path_is_absolute (progname, GNUNET_NO, NULL, NULL)))
+    return GNUNET_strdup (progname);
+  if (NULL != cache)
+    libexecdir = cache;
+  else
+    libexecdir = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LIBEXECDIR);
+  if (NULL == libexecdir)
+    return GNUNET_strdup (progname);
+  GNUNET_asprintf (&binary, "%s%s", libexecdir, progname);
+  cache = libexecdir;
+  return binary;
+}
+
+
+/**
+ * Given the name of a helper, service or daemon binary construct the full
+ * path to the binary using the SUID_BINARY_PATH in the PATHS section of the
+ * configuration. If that option is not present, fall back to
+ * GNUNET_OS_get_libexec_binary_path. If @a progname is an absolute path, a
+ * copy of this path is returned.
+ *
+ * @param cfg configuration to inspect
+ * @param progname name of the binary
+ * @return full path to the binary, if possible, a copy of @a progname
+ *         otherwise
+ */
+char *
+GNUNET_OS_get_suid_binary_path (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                                const char *progname)
+{
+  static char *cache;
+  char *binary = NULL;
+  char *path = NULL;
+  size_t path_len;
+
+  if (GNUNET_YES ==
+      GNUNET_STRINGS_path_is_absolute (progname, GNUNET_NO, NULL, NULL))
+  {
+    return GNUNET_strdup (progname);
+  }
+  if (NULL != cache)
+    path = cache;
+  else
+    GNUNET_CONFIGURATION_get_value_string (cfg,
+                                           "PATHS",
+                                           "SUID_BINARY_PATH",
+                                           &path);
+  if ((NULL == path) || (0 == strlen (path)))
+  {
+    if (NULL != path)
+      GNUNET_free (path);
+    cache = NULL;
+    return GNUNET_OS_get_libexec_binary_path (progname);
+  }
+  path_len = strlen (path);
+  GNUNET_asprintf (&binary,
+                   "%s%s%s",
+                   path,
+                   (path[path_len - 1] == DIR_SEPARATOR) ? ""
+                   : DIR_SEPARATOR_STR,
+                   progname);
+  cache = path;
+  return binary;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_OS_check_helper_binary (const char *binary,
+                               bool check_suid,
+                               const char *params)
+{
+  struct stat statbuf;
+  char *p;
+  char *pf;
+
+  if ((GNUNET_YES ==
+       GNUNET_STRINGS_path_is_absolute (binary, GNUNET_NO, NULL, NULL)) ||
+      (0 == strncmp (binary, "./", 2)))
+  {
+    p = GNUNET_strdup (binary);
+  }
+  else
+  {
+    p = get_path_from_PATH (binary);
+    if (NULL != p)
+    {
+      GNUNET_asprintf (&pf, "%s/%s", p, binary);
+      GNUNET_free (p);
+      p = pf;
+    }
+  }
+
+  if (NULL == p)
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         _ ("Could not find binary `%s' in PATH!\n"),
+         binary);
+    return GNUNET_SYSERR;
+  }
+  if (0 != access (p, X_OK))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "access", p);
+    GNUNET_free (p);
+    return GNUNET_SYSERR;
+  }
+
+  if (0 == getuid ())
+  {
+    /* as we run as root, we don't insist on SUID */
+    GNUNET_free (p);
+    return GNUNET_YES;
+  }
+
+  if (0 != stat (p, &statbuf))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", p);
+    GNUNET_free (p);
+    return GNUNET_SYSERR;
+  }
+  if (check_suid)
+  {
+    (void) params;
+    if ((0 != (statbuf.st_mode & S_ISUID)) && (0 == statbuf.st_uid))
+    {
+      GNUNET_free (p);
+      return GNUNET_YES;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                _ ("Binary `%s' exists, but is not SUID\n"),
+                p);
+    /* binary exists, but not SUID */
+  }
+  GNUNET_free (p);
+  return GNUNET_NO;
+}
+
+
+/* end of os_installation.c */
diff --git a/src/lib/util/os_network.c b/src/lib/util/os_network.c
new file mode 100644
index 000000000..ac9fa691f
--- /dev/null
+++ b/src/lib/util/os_network.c
@@ -0,0 +1,444 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2004, 2005, 2006, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/os_network.c
+ * @brief function to determine available network interfaces
+ * @author Nils Durner
+ * @author Heikki Lindholm
+ * @author Jake Dust
+ * @author LRN
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-os-network", __VA_ARGS__)
+#define LOG_STRERROR_FILE(kind, syscall, \
+                          filename) GNUNET_log_from_strerror_file (kind, \
+                                                                   "util-os-network", \
+                                                                   syscall, \
+                                                                   filename)
+
+
+#if ! (HAVE_GETIFADDRS && HAVE_FREEIFADDRS)
+/**
+ * Try to enumerate all network interfaces using 'ifconfig'.
+ *
+ * @param proc the callback function
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if it worked
+ */
+static int
+try_ifconfig (GNUNET_OS_NetworkInterfaceProcessor proc,
+              void *proc_cls)
+{
+  int i;
+  char line[1024];
+  char *replace;
+  const char *start;
+  char ifc[12];
+  char addrstr[128];
+  char bcstr[128];
+  char netmaskstr[128];
+  FILE *f;
+  int have_ifc;
+  struct sockaddr_in a4;
+  struct sockaddr_in6 a6;
+  struct in_addr v4;
+  struct in6_addr v6;
+  struct sockaddr_in bcaddr;
+  struct sockaddr_in netmask;
+  struct sockaddr_in6 netmask6;
+  struct sockaddr *pass_bcaddr;
+  struct sockaddr *pass_netmask;
+  int prefixlen;
+  static char *pcall;
+
+  if (NULL == pcall)
+  {
+    const char *sbin_ifconfig;
+
+#ifdef IFCONFIG
+    if (0 == access (IFCONFIG, X_OK))
+      sbin_ifconfig = IFCONFIG;
+    else
+#endif
+    if (0 == access ("/sbin/ifconfig", X_OK))
+      sbin_ifconfig = "/sbin/ifconfig";
+    else if (0 == access ("/usr/sbin/ifconfig", X_OK))
+      sbin_ifconfig = "/usr/sbin/ifconfig";
+    else
+      sbin_ifconfig = "ifconfig";
+    GNUNET_asprintf (&pcall,
+                     "%s -a 2> /dev/null",
+                     sbin_ifconfig);
+  }
+  f = popen (pcall, "r");
+  if (NULL == f)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                       "popen",
+                       "ifconfig");
+
+    return GNUNET_SYSERR;
+  }
+
+  have_ifc = GNUNET_NO;
+  ifc[11] = '\0';
+  while (NULL != fgets (line, sizeof(line), f))
+  {
+    if (strlen (line) == 0)
+    {
+      have_ifc = GNUNET_NO;
+      continue;
+    }
+    if (! isspace (line[0]))
+    {
+      have_ifc = (1 == sscanf (line, "%11s", ifc)) ? GNUNET_YES : GNUNET_NO;
+      /* would end with ':' on OSX, fix it! */
+      if (ifc[strlen (ifc) - 1] == ':')
+        ifc[strlen (ifc) - 1] = '\0';
+      continue;
+    }
+    if (! have_ifc)
+      continue;                 /* strange input, hope for the best */
+
+    /* make parsing of ipv6 addresses easier */
+    for (replace = line; *replace != '\0'; replace++)
+    {
+      if (*replace == '/')
+        *replace = ' ';
+    }
+    prefixlen = -1;
+
+    start = line;
+    while (('\0' != *start) && (isspace (*start)))
+      start++;
+
+    /* Zero-out stack allocated values */
+    memset (addrstr, 0, 128);
+    memset (netmaskstr, 0, 128);
+    memset (bcstr, 0, 128);
+    prefixlen = 0;
+
+    if (   /* Linux */
+      (3 == sscanf (start, "inet addr:%127s Bcast:%127s Mask:%127s", addrstr,
+                    bcstr, netmaskstr)) ||
+      (2 == sscanf (start, "inet addr:%127s Mask:%127s", addrstr,
+                    netmaskstr)) ||
+      (2 == sscanf (start, "inet6 addr:%127s %d", addrstr, &prefixlen)) ||
+      /* Solaris, OS X */
+      (1 == sscanf (start, "inet %127s", addrstr)) ||
+      (1 == sscanf (start, "inet6 %127s", addrstr)))
+    {
+      /* IPv4 */
+      if (1 == inet_pton (AF_INET, addrstr, &v4))
+      {
+        memset (&a4, 0, sizeof(a4));
+        a4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+        a4.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+        a4.sin_addr = v4;
+
+        pass_bcaddr = NULL;
+        pass_netmask = NULL;
+        if (1 == inet_pton (AF_INET, bcstr, &v4))
+        {
+          memset (&bcaddr, 0, sizeof(bcaddr));
+          bcaddr.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+          bcaddr.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+          bcaddr.sin_addr = v4;
+          pass_bcaddr = (struct sockaddr *) &bcaddr;
+        }
+        if (1 == inet_pton (AF_INET, netmaskstr, &v4))
+        {
+          memset (&netmask, 0, sizeof(netmask));
+          netmask.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+          netmask.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+          netmask.sin_addr = v4;
+          pass_netmask = (struct sockaddr *) &netmask;
+        }
+
+
+        if (GNUNET_OK !=
+            proc (proc_cls, ifc,(0 == strcmp (ifc, GNUNET_DEFAULT_INTERFACE)),
+                  (const struct sockaddr *) &a4,
+                  pass_bcaddr, pass_netmask, sizeof(a4)))
+          break;
+        continue;
+      }
+      /* IPv6 */
+      if (1 == inet_pton (AF_INET6, addrstr, &v6))
+      {
+        memset (&a6, 0, sizeof(a6));
+        a6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+        a6.sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+        a6.sin6_addr = v6;
+
+        pass_netmask = NULL;
+        if (prefixlen != -1)
+        {
+          memset (v6.s6_addr, 0, sizeof(v6.s6_addr));
+          for (i = 0; i < prefixlen; i++)
+          {
+            v6.s6_addr[i >> 3] |= 1 << (i & 7);
+          }
+          memset (&netmask6, 0, sizeof(netmask6));
+          netmask6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+          netmask6.sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+          netmask6.sin6_addr = v6;
+
+          pass_netmask = (struct sockaddr *) &netmask6;
+        }
+
+        if (GNUNET_OK !=
+            proc (proc_cls, ifc,(0 == strcmp (ifc, GNUNET_DEFAULT_INTERFACE)),
+                  (const struct sockaddr *) &a6,
+                  NULL, pass_netmask, sizeof(a6)))
+          break;
+        continue;
+      }
+    }
+  }
+  pclose (f);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Try to enumerate all network interfaces using 'ip'.
+ *
+ * @param proc the callback function
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if it worked
+ */
+static int
+try_ip (GNUNET_OS_NetworkInterfaceProcessor proc,
+        void *proc_cls)
+{
+  char line[1024];
+  char *replace;
+  char ifname[64];
+  char afstr[6];
+  char addrstr[128];
+  FILE *f;
+  struct sockaddr_in a4;
+  struct sockaddr_in6 a6;
+  struct in_addr v4;
+  struct in6_addr v6;
+  struct sockaddr_in netmask;
+  struct sockaddr_in6 netmask6;
+  unsigned int i;
+  unsigned int prefixlen;
+  static char *pcall;
+
+  if (NULL == pcall)
+  {
+    const char *sbin_ip;
+
+#ifdef PATH_TO_IP
+    if (0 == access (PATH_TO_IP, X_OK))
+      sbin_ip = PATH_TO_IP;
+    else
+#endif
+    if (0 == access ("/sbin/ip", X_OK))
+      sbin_ip = "/sbin/ip";
+    else if (0 == access ("/usr/sbin/ip", X_OK))
+      sbin_ip = "/usr/sbin/ip";
+    else
+      sbin_ip = "if";
+    GNUNET_asprintf (&pcall,
+                     "%s -o add 2> /dev/null",
+                     sbin_ip);
+  }
+  f = popen (pcall, "r");
+  if (! f)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                       "popen",
+                       "ip");
+    return GNUNET_SYSERR;
+  }
+
+  while (NULL != fgets (line, sizeof(line), f))
+  {
+    /* make parsing easier */
+    for (replace = line; *replace != '\0'; replace++)
+    {
+      if (*replace == '/')
+        *replace = ' ';
+    }
+    /* Zero-out stack allocated values */
+    memset (ifname, 0, 64);
+    memset (afstr, 0, 6);
+    memset (addrstr, 0, 128);
+    if (4 != sscanf (line,
+                     "%*u: %63s %5s %127s %6u",
+                     ifname,
+                     afstr,
+                     addrstr,
+                     &prefixlen))
+      continue;
+    /* IPv4 */
+    if ((0 == strcasecmp ("inet",
+                          afstr)) &&
+        (1 == inet_pton (AF_INET,
+                         addrstr,
+                         &v4)))
+    {
+      memset (&a4, 0, sizeof(a4));
+      a4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      a4.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+      a4.sin_addr = v4;
+
+      memset (&v4.s_addr, 0, sizeof(v4.s_addr));
+      for (i = 0; i < prefixlen; i++)
+        v4.s_addr |= 1 << (i & 7);
+      memset (&netmask, 0, sizeof(netmask));
+      netmask.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      netmask.sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+      netmask.sin_addr = v4;
+
+      if (GNUNET_OK !=
+          proc (proc_cls,
+                ifname,
+                (0 == strcmp (ifname,
+                              GNUNET_DEFAULT_INTERFACE)),
+                (const struct sockaddr *) &a4,
+                NULL,
+                (const struct sockaddr *) &netmask,
+                sizeof(a4)))
+        break;
+    }
+    /* IPv6 */
+    if ((0 == strcasecmp ("inet6",
+                          afstr)) &&
+        (1 == inet_pton (AF_INET6,
+                         addrstr,
+                         &v6)))
+    {
+      memset (&a6, 0, sizeof(a6));
+      a6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      a6.sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+      a6.sin6_addr = v6;
+
+      memset (v6.s6_addr, 0, sizeof(v6.s6_addr));
+      for (i = 0; i < prefixlen; i++)
+        v6.s6_addr[i >> 3] |= 1 << (i & 7);
+      memset (&netmask6, 0, sizeof(netmask6));
+      netmask6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      netmask6.sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+      netmask6.sin6_addr = v6;
+
+      if (GNUNET_OK !=
+          proc (proc_cls,
+                ifname,
+                (0 == strcmp (ifname,
+                              GNUNET_DEFAULT_INTERFACE)),
+                (const struct sockaddr *) &a6,
+                NULL,
+                (const struct sockaddr *) &netmask6,
+                sizeof(a6)))
+        break;
+    }
+  }
+  pclose (f);
+  return GNUNET_OK;
+}
+
+
+#endif
+
+
+/**
+ * @brief Enumerate all network interfaces
+ *
+ * @param proc the callback function
+ * @param proc_cls closure for @a proc
+ */
+void
+GNUNET_OS_network_interfaces_list (GNUNET_OS_NetworkInterfaceProcessor proc,
+                                   void *proc_cls)
+{
+#if HAVE_GETIFADDRS && HAVE_FREEIFADDRS
+  struct ifaddrs *ifa_first;
+  struct ifaddrs *ifa_ptr;
+  socklen_t alen;
+
+  if (getifaddrs (&ifa_first) == 0)
+  {
+    for (ifa_ptr = ifa_first; ifa_ptr != NULL; ifa_ptr = ifa_ptr->ifa_next)
+    {
+      if ((ifa_ptr->ifa_name != NULL) && (ifa_ptr->ifa_addr != NULL) &&
+          ( (ifa_ptr->ifa_flags & IFF_UP) != 0) )
+      {
+        if ((ifa_ptr->ifa_addr->sa_family != AF_INET) &&
+            (ifa_ptr->ifa_addr->sa_family != AF_INET6))
+          continue;
+        if (ifa_ptr->ifa_addr->sa_family == AF_INET)
+          alen = sizeof(struct sockaddr_in);
+        else
+          alen = sizeof(struct sockaddr_in6);
+        if (GNUNET_OK !=
+            proc (proc_cls, ifa_ptr->ifa_name,
+                  (0 == strcmp (ifa_ptr->ifa_name, GNUNET_DEFAULT_INTERFACE)),
+                  ifa_ptr->ifa_addr, ifa_ptr->ifa_broadaddr,
+                  ifa_ptr->ifa_netmask, alen))
+          break;
+      }
+    }
+    freeifaddrs (ifa_first);
+  }
+#else
+  if (GNUNET_OK ==
+      try_ip (proc,
+              proc_cls))
+    return;
+  if (GNUNET_OK ==
+      try_ifconfig (proc,
+                    proc_cls))
+    return;
+  LOG (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+       "Failed to enumerate network interfaces\n");
+#endif
+}
+
+
+/* end of os_network.c */
diff --git a/src/lib/util/os_priority.c b/src/lib/util/os_priority.c
new file mode 100644
index 000000000..63d18dbe4
--- /dev/null
+++ b/src/lib/util/os_priority.c
@@ -0,0 +1,1063 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2002, 2003, 2004, 2005, 2006, 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/os_priority.c
+ * @brief Methods to set process priority
+ * @author Nils Durner
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "disk.h"
+#include <unistr.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-os-priority", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-os-priority", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+  GNUNET_log_from_strerror_file (kind, "util-os-priority", syscall, filename)
+
+#define GNUNET_OS_CONTROL_PIPE "GNUNET_OS_CONTROL_PIPE"
+
+
+struct GNUNET_OS_Process
+{
+  /**
+   * PID of the process.
+   */
+  pid_t pid;
+
+  /**
+   * Pipe we use to signal the process.
+   * NULL if unused, or if process was deemed uncontrollable.
+   */
+  struct GNUNET_DISK_FileHandle *control_pipe;
+};
+
+
+/**
+ * Handle for 'this' process.
+ */
+static struct GNUNET_OS_Process current_process;
+
+/**
+ * Handle for the #parent_control_handler() Task.
+ */
+static struct GNUNET_SCHEDULER_Task *pch;
+
+/**
+ * Handle for the #shutdown_pch() Task.
+ */
+static struct GNUNET_SCHEDULER_Task *spch;
+
+
+/**
+ * This handler is called on shutdown to remove the #pch.
+ *
+ * @param cls the `struct GNUNET_DISK_FileHandle` of the control pipe
+ */
+static void
+shutdown_pch (void *cls)
+{
+  struct GNUNET_DISK_FileHandle *control_pipe = cls;
+
+  GNUNET_SCHEDULER_cancel (pch);
+  pch = NULL;
+  GNUNET_DISK_file_close (control_pipe);
+  control_pipe = NULL;
+}
+
+
+/**
+ * This handler is called when there are control data to be read on the pipe
+ *
+ * @param cls the `struct GNUNET_DISK_FileHandle` of the control pipe
+ */
+static void
+parent_control_handler (void *cls)
+{
+  struct GNUNET_DISK_FileHandle *control_pipe = cls;
+  char sig;
+  char *pipe_fd;
+  ssize_t ret;
+
+  pch = NULL;
+  ret = GNUNET_DISK_file_read (control_pipe, &sig, sizeof(sig));
+  if (sizeof(sig) != ret)
+  {
+    if (-1 == ret)
+      LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "GNUNET_DISK_file_read");
+    LOG (GNUNET_ERROR_TYPE_DEBUG, "Closing control pipe\n");
+    GNUNET_DISK_file_close (control_pipe);
+    control_pipe = NULL;
+    GNUNET_SCHEDULER_cancel (spch);
+    spch = NULL;
+    return;
+  }
+  pipe_fd = getenv (GNUNET_OS_CONTROL_PIPE);
+  GNUNET_assert ((NULL == pipe_fd) || (strlen (pipe_fd) <= 0));
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got control code %d from parent via pipe %s\n",
+       sig,
+       pipe_fd);
+  pch = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                        control_pipe,
+                                        &parent_control_handler,
+                                        control_pipe);
+  GNUNET_SIGNAL_raise ((int) sig);
+}
+
+
+void
+GNUNET_OS_install_parent_control_handler (void *cls)
+{
+  const char *env_buf;
+  char *env_buf_end;
+  struct GNUNET_DISK_FileHandle *control_pipe;
+  uint64_t pipe_fd;
+
+  (void) cls;
+  if (NULL != pch)
+  {
+    /* already done, we've been called twice... */
+    GNUNET_break (0);
+    return;
+  }
+  env_buf = getenv (GNUNET_OS_CONTROL_PIPE);
+  if ((NULL == env_buf) || (strlen (env_buf) <= 0))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Not installing a handler because $%s is empty\n",
+         GNUNET_OS_CONTROL_PIPE);
+    putenv (GNUNET_OS_CONTROL_PIPE "=");
+    return;
+  }
+  errno = 0;
+  pipe_fd = strtoull (env_buf, &env_buf_end, 16);
+  if ((0 != errno) || (env_buf == env_buf_end))
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "strtoull", env_buf);
+    putenv (GNUNET_OS_CONTROL_PIPE "=");
+    return;
+  }
+  if (pipe_fd >= FD_SETSIZE)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "GNUNET_OS_CONTROL_PIPE `%s' contains garbage?\n",
+         env_buf);
+    putenv (GNUNET_OS_CONTROL_PIPE "=");
+    return;
+  }
+
+  control_pipe = GNUNET_DISK_get_handle_from_int_fd ((int) pipe_fd);
+
+  if (NULL == control_pipe)
+  {
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "open", env_buf);
+    putenv (GNUNET_OS_CONTROL_PIPE "=");
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Adding parent control handler pipe `%s' to the scheduler\n",
+       env_buf);
+  pch = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                        control_pipe,
+                                        &parent_control_handler,
+                                        control_pipe);
+  spch = GNUNET_SCHEDULER_add_shutdown (&shutdown_pch, control_pipe);
+  putenv (GNUNET_OS_CONTROL_PIPE "=");
+}
+
+
+/**
+ * Get process structure for current process
+ *
+ * The pointer it returns points to static memory location and must
+ * not be deallocated/closed.
+ *
+ * @return pointer to the process sturcutre for this process
+ */
+struct GNUNET_OS_Process *
+GNUNET_OS_process_current ()
+{
+  current_process.pid = 0;
+  return &current_process;
+}
+
+
+int
+GNUNET_OS_process_kill (struct GNUNET_OS_Process *proc,
+                        int sig)
+{
+  int ret;
+  char csig;
+
+  csig = (char) sig;
+  if (NULL != proc->control_pipe)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Sending signal %d to pid: %u via pipe\n",
+         sig,
+         proc->pid);
+    ret = GNUNET_DISK_file_write (proc->control_pipe, &csig, sizeof(csig));
+    if (sizeof(csig) == ret)
+      return 0;
+  }
+  /* pipe failed or non-existent, try other methods */
+  switch (sig)
+  {
+  case SIGHUP:
+  case SIGINT:
+  case SIGKILL:
+  case SIGTERM:
+#if (SIGTERM != GNUNET_TERM_SIG)
+  case GNUNET_TERM_SIG:
+#endif
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Sending signal %d to pid: %u via system call\n",
+         sig,
+         proc->pid);
+    return kill (proc->pid, sig);
+  default:
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Sending signal %d to pid: %u via system call\n",
+         sig,
+         proc->pid);
+    return kill (proc->pid, sig);
+  }
+}
+
+
+pid_t
+GNUNET_OS_process_get_pid (struct GNUNET_OS_Process *proc)
+{
+  return proc->pid;
+}
+
+
+void
+GNUNET_OS_process_destroy (struct GNUNET_OS_Process *proc)
+{
+  if (NULL != proc->control_pipe)
+    GNUNET_DISK_file_close (proc->control_pipe);
+
+  GNUNET_free (proc);
+}
+
+
+/**
+ * Open '/dev/null' and make the result the given
+ * file descriptor.
+ *
+ * @param target_fd desired FD to point to /dev/null
+ * @param flags open flags (O_RDONLY, O_WRONLY)
+ */
+static void
+open_dev_null (int target_fd,
+               int flags)
+{
+  int fd;
+
+  fd = open ("/dev/null", flags);
+  if (-1 == fd)
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "open", "/dev/null");
+    return;
+  }
+  if (fd == target_fd)
+    return;
+  if (-1 == dup2 (fd, target_fd))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "dup2");
+    GNUNET_break (0 == close (fd));
+    return;
+  }
+  GNUNET_break (0 == close (fd));
+}
+
+
+/**
+ * Start a process.
+ *
+ * @param std_inheritance a set of GNUNET_OS_INHERIT_STD_* flags controlling which
+ *        std handles of the parent are inherited by the child.
+ *        pipe_stdin and pipe_stdout take priority over std_inheritance
+ *        (when they are non-NULL).
+ * @param pipe_stdin pipe to use to send input to child process (or NULL)
+ * @param pipe_stdout pipe to use to get output from child process (or NULL)
+ * @param pipe_stderr pipe to use for stderr for child process (or NULL)
+ * @param lsocks array of listen sockets to dup systemd-style (or NULL);
+ *         must be NULL on platforms where dup is not supported
+ * @param filename name of the binary
+ * @param argv NULL-terminated list of arguments to the process
+ * @return process ID of the new process, -1 on error
+ */
+static struct GNUNET_OS_Process *
+start_process (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+               struct GNUNET_DISK_PipeHandle *pipe_stdin,
+               struct GNUNET_DISK_PipeHandle *pipe_stdout,
+               struct GNUNET_DISK_PipeHandle *pipe_stderr,
+               const int *lsocks,
+               const char *filename,
+               char *const argv[])
+{
+  pid_t ret;
+  char fds[16];
+  struct GNUNET_OS_Process *gnunet_proc;
+  struct GNUNET_DISK_FileHandle *childpipe_read;
+  struct GNUNET_DISK_FileHandle *childpipe_write;
+  int childpipe_read_fd;
+  int i;
+  int j;
+  int k;
+  int tgt;
+  int flags;
+  int *lscp;
+  unsigned int ls;
+  int fd_stdout_write;
+  int fd_stdout_read;
+  int fd_stderr_write;
+  int fd_stderr_read;
+  int fd_stdin_read;
+  int fd_stdin_write;
+
+  if (GNUNET_SYSERR ==
+      GNUNET_OS_check_helper_binary (filename, GNUNET_NO, NULL))
+    return NULL; /* not executable */
+  if (0 != (std_inheritance & GNUNET_OS_USE_PIPE_CONTROL))
+  {
+    struct GNUNET_DISK_PipeHandle *childpipe;
+    int dup_childpipe_read_fd = -1;
+
+    childpipe = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+    if (NULL == childpipe)
+      return NULL;
+    childpipe_read =
+      GNUNET_DISK_pipe_detach_end (childpipe, GNUNET_DISK_PIPE_END_READ);
+    childpipe_write =
+      GNUNET_DISK_pipe_detach_end (childpipe, GNUNET_DISK_PIPE_END_WRITE);
+    GNUNET_DISK_pipe_close (childpipe);
+    if ((NULL == childpipe_read) || (NULL == childpipe_write) ||
+        (GNUNET_OK != GNUNET_DISK_internal_file_handle_ (childpipe_read,
+                                                         &childpipe_read_fd,
+                                                         sizeof(int))) ||
+        (-1 == (dup_childpipe_read_fd = dup (childpipe_read_fd))))
+    {
+      if (NULL != childpipe_read)
+        GNUNET_DISK_file_close (childpipe_read);
+      if (NULL != childpipe_write)
+        GNUNET_DISK_file_close (childpipe_write);
+      if (0 <= dup_childpipe_read_fd)
+        GNUNET_break (0 == close (dup_childpipe_read_fd));
+      return NULL;
+    }
+    childpipe_read_fd = dup_childpipe_read_fd;
+    GNUNET_DISK_file_close (childpipe_read);
+  }
+  else
+  {
+    childpipe_write = NULL;
+    childpipe_read_fd = -1;
+  }
+  if (NULL != pipe_stdin)
+  {
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stdin, GNUNET_DISK_PIPE_END_READ),
+        &fd_stdin_read,
+        sizeof(int)));
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stdin, GNUNET_DISK_PIPE_END_WRITE),
+        &fd_stdin_write,
+        sizeof(int)));
+  }
+  if (NULL != pipe_stdout)
+  {
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stdout, GNUNET_DISK_PIPE_END_WRITE),
+        &fd_stdout_write,
+        sizeof(int)));
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stdout, GNUNET_DISK_PIPE_END_READ),
+        &fd_stdout_read,
+        sizeof(int)));
+  }
+  if (NULL != pipe_stderr)
+  {
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stderr, GNUNET_DISK_PIPE_END_READ),
+        &fd_stderr_read,
+        sizeof(int)));
+    GNUNET_assert (
+      GNUNET_OK ==
+      GNUNET_DISK_internal_file_handle_ (
+        GNUNET_DISK_pipe_handle (pipe_stderr, GNUNET_DISK_PIPE_END_WRITE),
+        &fd_stderr_write,
+        sizeof(int)));
+  }
+  lscp = NULL;
+  ls = 0;
+  if (NULL != lsocks)
+  {
+    i = 0;
+    while (-1 != (k = lsocks[i++]))
+      GNUNET_array_append (lscp, ls, k);
+    GNUNET_array_append (lscp, ls, -1);
+  }
+#if DARWIN
+  /* see https://web.archive.org/web/20150924082249/gnunet.org/vfork */
+  #pragma GCC diagnostic push
+  #pragma GCC diagnostic ignored "-Wdeprecated"
+  #pragma clang diagnostic push
+  #pragma clang diagnostic ignored "-Wdeprecated"
+  ret = vfork ();
+  #pragma clang diagnostic pop
+  #pragma GCC diagnostic pop
+#else
+  ret = fork ();
+#endif
+  if (-1 == ret)
+  {
+    int eno = errno;
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "fork");
+    GNUNET_array_grow (lscp, ls, 0);
+    if (NULL != childpipe_write)
+      GNUNET_DISK_file_close (childpipe_write);
+    if (0 <= childpipe_read_fd)
+      GNUNET_break (0 == close (childpipe_read_fd));
+    errno = eno;
+    return NULL;
+  }
+  if (0 != ret)
+  {
+    unsetenv (GNUNET_OS_CONTROL_PIPE);
+    gnunet_proc = GNUNET_new (struct GNUNET_OS_Process);
+    gnunet_proc->pid = ret;
+    gnunet_proc->control_pipe = childpipe_write;
+    if (0 != (std_inheritance & GNUNET_OS_USE_PIPE_CONTROL))
+    {
+      GNUNET_break (0 == close (childpipe_read_fd));
+    }
+    GNUNET_array_grow (lscp, ls, 0);
+    return gnunet_proc;
+  }
+  if (0 <= childpipe_read_fd)
+  {
+    char fdbuf[100];
+#ifndef DARWIN
+    /* due to vfork, we must NOT free memory on DARWIN! */
+    GNUNET_DISK_file_close (childpipe_write);
+#endif
+    snprintf (fdbuf, 100, "%x", childpipe_read_fd);
+    setenv (GNUNET_OS_CONTROL_PIPE, fdbuf, 1);
+  }
+  else
+    unsetenv (GNUNET_OS_CONTROL_PIPE);
+  if (NULL != pipe_stdin)
+  {
+    GNUNET_break (0 == close (fd_stdin_write));
+    if (-1 == dup2 (fd_stdin_read, 0))
+      LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "dup2");
+    GNUNET_break (0 == close (fd_stdin_read));
+  }
+  else if (0 == (std_inheritance & GNUNET_OS_INHERIT_STD_IN))
+  {
+    GNUNET_break (0 == close (0));
+    open_dev_null (0, O_RDONLY);
+  }
+  if (NULL != pipe_stdout)
+  {
+    GNUNET_break (0 == close (fd_stdout_read));
+    if (-1 == dup2 (fd_stdout_write, 1))
+      LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "dup2");
+    GNUNET_break (0 == close (fd_stdout_write));
+  }
+  else if (0 == (std_inheritance & GNUNET_OS_INHERIT_STD_OUT))
+  {
+    GNUNET_break (0 == close (1));
+    open_dev_null (1, O_WRONLY);
+  }
+  if (NULL != pipe_stderr)
+  {
+    GNUNET_break (0 == close (fd_stderr_read));
+    if (-1 == dup2 (fd_stderr_write, 2))
+      LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "dup2");
+    GNUNET_break (0 == close (fd_stderr_write));
+  }
+  else if (0 == (std_inheritance & GNUNET_OS_INHERIT_STD_ERR))
+  {
+    GNUNET_break (0 == close (2));
+    open_dev_null (2, O_WRONLY);
+  }
+  if (NULL != lscp)
+  {
+    /* read systemd documentation... */
+    i = 0;
+    tgt = 3;
+    while (-1 != lscp[i])
+    {
+      j = i + 1;
+      while (-1 != lscp[j])
+      {
+        if (lscp[j] == tgt)
+        {
+          /* dup away */
+          k = dup (lscp[j]);
+          GNUNET_assert (-1 != k);
+          GNUNET_assert (0 == close (lscp[j]));
+          lscp[j] = k;
+          break;
+        }
+        j++;
+      }
+      if (lscp[i] != tgt)
+      {
+        /* Bury any existing FD, no matter what; they should all be closed
+         * on exec anyway and the important ones have been dup'ed away */
+        GNUNET_break (0 == close (tgt));
+        GNUNET_assert (-1 != dup2 (lscp[i], tgt));
+      }
+      /* unset close-on-exec flag */
+      flags = fcntl (tgt, F_GETFD);
+      GNUNET_assert (flags >= 0);
+      flags &= ~FD_CLOEXEC;
+      fflush (stderr);
+      (void) fcntl (tgt, F_SETFD, flags);
+      tgt++;
+      i++;
+    }
+    GNUNET_snprintf (fds, sizeof(fds), "%u", i);
+    setenv ("LISTEN_FDS", fds, 1);
+  }
+#ifndef DARWIN
+  /* due to vfork, we must NOT free memory on DARWIN! */
+  GNUNET_array_grow (lscp, ls, 0);
+#endif
+  execvp (filename, argv);
+  LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "execvp", filename);
+  _exit (1);
+}
+
+
+struct GNUNET_OS_Process *
+GNUNET_OS_start_process_vap (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                             struct GNUNET_DISK_PipeHandle *pipe_stdin,
+                             struct GNUNET_DISK_PipeHandle *pipe_stdout,
+                             struct GNUNET_DISK_PipeHandle *pipe_stderr,
+                             const char *filename,
+                             char *const argv[])
+{
+  return start_process (std_inheritance,
+                        pipe_stdin,
+                        pipe_stdout,
+                        pipe_stderr,
+                        NULL,
+                        filename,
+                        argv);
+}
+
+
+struct GNUNET_OS_Process *
+GNUNET_OS_start_process_va (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                            struct GNUNET_DISK_PipeHandle *pipe_stdin,
+                            struct GNUNET_DISK_PipeHandle *pipe_stdout,
+                            struct GNUNET_DISK_PipeHandle *pipe_stderr,
+                            const char *filename,
+                            va_list va)
+{
+  struct GNUNET_OS_Process *ret;
+  va_list ap;
+  char **argv;
+  int argc;
+
+  argc = 0;
+  va_copy (ap, va);
+  while (NULL != va_arg (ap, char *))
+    argc++;
+  va_end (ap);
+  argv = GNUNET_malloc (sizeof(char *) * (argc + 1));
+  argc = 0;
+  va_copy (ap, va);
+  while (NULL != (argv[argc] = va_arg (ap, char *)))
+    argc++;
+  va_end (ap);
+  ret = GNUNET_OS_start_process_vap (std_inheritance,
+                                     pipe_stdin,
+                                     pipe_stdout,
+                                     pipe_stderr,
+                                     filename,
+                                     argv);
+  GNUNET_free (argv);
+  return ret;
+}
+
+
+struct GNUNET_OS_Process *
+GNUNET_OS_start_process (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                         struct GNUNET_DISK_PipeHandle *pipe_stdin,
+                         struct GNUNET_DISK_PipeHandle *pipe_stdout,
+                         struct GNUNET_DISK_PipeHandle *pipe_stderr,
+                         const char *filename,
+                         ...)
+{
+  struct GNUNET_OS_Process *ret;
+  va_list ap;
+
+  va_start (ap, filename);
+  ret = GNUNET_OS_start_process_va (std_inheritance,
+                                    pipe_stdin,
+                                    pipe_stdout,
+                                    pipe_stderr,
+                                    filename,
+                                    ap);
+  va_end (ap);
+  return ret;
+}
+
+
+struct GNUNET_OS_Process *
+GNUNET_OS_start_process_v (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                           const int *lsocks,
+                           const char *filename,
+                           char *const argv[])
+{
+  return start_process (std_inheritance,
+                        NULL,
+                        NULL,
+                        NULL,
+                        lsocks,
+                        filename,
+                        argv);
+}
+
+
+struct GNUNET_OS_Process *
+GNUNET_OS_start_process_s (enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                           const int *lsocks,
+                           const char *filename,
+                           ...)
+{
+  va_list ap;
+  char **argv;
+  unsigned int argv_size;
+  const char *arg;
+  const char *rpos;
+  char *pos;
+  char *cp;
+  const char *last;
+  struct GNUNET_OS_Process *proc;
+  char *binary_path;
+  int quote_on;
+  unsigned int i;
+  size_t len;
+
+  argv_size = 1;
+  va_start (ap, filename);
+  arg = filename;
+  last = NULL;
+  do
+  {
+    rpos = arg;
+    quote_on = 0;
+    while ('\0' != *rpos)
+    {
+      if ('"' == *rpos)
+      {
+        if (1 == quote_on)
+          quote_on = 0;
+        else
+          quote_on = 1;
+      }
+      if ((' ' == *rpos) && (0 == quote_on))
+      {
+        if (NULL != last)
+          argv_size++;
+        last = NULL;
+        rpos++;
+        while (' ' == *rpos)
+          rpos++;
+      }
+      if ((NULL == last) && ('\0' != *rpos))     // FIXME: == or !=?
+        last = rpos;
+      if ('\0' != *rpos)
+        rpos++;
+    }
+    if (NULL != last)
+      argv_size++;
+  }
+  while (NULL != (arg = (va_arg (ap, const char *))));
+  va_end (ap);
+
+  argv = GNUNET_malloc (argv_size * sizeof(char *));
+  argv_size = 0;
+  va_start (ap, filename);
+  arg = filename;
+  last = NULL;
+  do
+  {
+    cp = GNUNET_strdup (arg);
+    quote_on = 0;
+    pos = cp;
+    while ('\0' != *pos)
+    {
+      if ('"' == *pos)
+      {
+        if (1 == quote_on)
+          quote_on = 0;
+        else
+          quote_on = 1;
+      }
+      if ((' ' == *pos) && (0 == quote_on))
+      {
+        *pos = '\0';
+        if (NULL != last)
+          argv[argv_size++] = GNUNET_strdup (last);
+        last = NULL;
+        pos++;
+        while (' ' == *pos)
+          pos++;
+      }
+      if ((NULL == last) && ('\0' != *pos))     // FIXME: == or !=?
+        last = pos;
+      if ('\0' != *pos)
+        pos++;
+    }
+    if (NULL != last)
+      argv[argv_size++] = GNUNET_strdup (last);
+    last = NULL;
+    GNUNET_free (cp);
+  }
+  while (NULL != (arg = (va_arg (ap, const char *))));
+  va_end (ap);
+  argv[argv_size] = NULL;
+
+  for (i = 0; i < argv_size; i++)
+  {
+    len = strlen (argv[i]);
+    if ((argv[i][0] == '"') && (argv[i][len - 1] == '"'))
+    {
+      memmove (&argv[i][0], &argv[i][1], len - 2);
+      argv[i][len - 2] = '\0';
+    }
+  }
+  binary_path = argv[0];
+  proc = GNUNET_OS_start_process_v (std_inheritance,
+                                    lsocks,
+                                    binary_path,
+                                    argv);
+  while (argv_size > 0)
+    GNUNET_free_nz (argv[--argv_size]);
+  GNUNET_free (argv);
+  return proc;
+}
+
+
+/**
+ * Retrieve the status of a process, waiting on it if dead.
+ * Nonblocking version.
+ *
+ * @param proc process ID
+ * @param type status type
+ * @param code return code/signal number
+ * @param options WNOHANG if non-blocking is desired
+ * @return #GNUNET_OK on success, #GNUNET_NO if the process is still running, #GNUNET_SYSERR otherwise
+ */
+static enum GNUNET_GenericReturnValue
+process_status (struct GNUNET_OS_Process *proc,
+                enum GNUNET_OS_ProcessStatusType *type,
+                unsigned long *code,
+                int options)
+{
+  int status;
+  int ret;
+
+  GNUNET_assert (0 != proc);
+  ret = waitpid (proc->pid,
+                 &status,
+                 options);
+  if (ret < 0)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "waitpid");
+    return GNUNET_SYSERR;
+  }
+  if (0 == ret)
+  {
+    *type = GNUNET_OS_PROCESS_RUNNING;
+    *code = 0;
+    return GNUNET_NO;
+  }
+  if (proc->pid != ret)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "waitpid");
+    return GNUNET_SYSERR;
+  }
+  if (WIFEXITED (status))
+  {
+    *type = GNUNET_OS_PROCESS_EXITED;
+    *code = WEXITSTATUS (status);
+  }
+  else if (WIFSIGNALED (status))
+  {
+    *type = GNUNET_OS_PROCESS_SIGNALED;
+    *code = WTERMSIG (status);
+  }
+  else if (WIFSTOPPED (status))
+  {
+    *type = GNUNET_OS_PROCESS_SIGNALED;
+    *code = WSTOPSIG (status);
+  }
+#ifdef WIFCONTINUED
+  else if (WIFCONTINUED (status))
+  {
+    *type = GNUNET_OS_PROCESS_RUNNING;
+    *code = 0;
+  }
+#endif
+  else
+  {
+    *type = GNUNET_OS_PROCESS_UNKNOWN;
+    *code = 0;
+  }
+
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_OS_process_status (struct GNUNET_OS_Process *proc,
+                          enum GNUNET_OS_ProcessStatusType *type,
+                          unsigned long *code)
+{
+  return process_status (proc, type, code, WNOHANG);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_OS_process_wait_status (struct GNUNET_OS_Process *proc,
+                               enum GNUNET_OS_ProcessStatusType *type,
+                               unsigned long *code)
+{
+  return process_status (proc, type, code, 0);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_OS_process_wait (struct GNUNET_OS_Process *proc)
+{
+  pid_t pid = proc->pid;
+  pid_t ret;
+
+  while ((pid != (ret = waitpid (pid, NULL, 0))) && (EINTR == errno))
+    ;
+  if (pid != ret)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                  "waitpid");
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle to a command.
+ */
+struct GNUNET_OS_CommandHandle
+{
+  /**
+   * Process handle.
+   */
+  struct GNUNET_OS_Process *eip;
+
+  /**
+   * Handle to the output pipe.
+   */
+  struct GNUNET_DISK_PipeHandle *opipe;
+
+  /**
+   * Read-end of output pipe.
+   */
+  const struct GNUNET_DISK_FileHandle *r;
+
+  /**
+   * Function to call on each line of output.
+   */
+  GNUNET_OS_LineProcessor proc;
+
+  /**
+   * Closure for @e proc.
+   */
+  void *proc_cls;
+
+  /**
+   * Buffer for the output.
+   */
+  char buf[1024];
+
+  /**
+   * Task reading from pipe.
+   */
+  struct GNUNET_SCHEDULER_Task *rtask;
+
+  /**
+   * When to time out.
+   */
+  struct GNUNET_TIME_Absolute timeout;
+
+  /**
+   * Current read offset in buf.
+   */
+  size_t off;
+};
+
+
+void
+GNUNET_OS_command_stop (struct GNUNET_OS_CommandHandle *cmd)
+{
+  if (NULL != cmd->proc)
+  {
+    GNUNET_assert (NULL != cmd->rtask);
+    GNUNET_SCHEDULER_cancel (cmd->rtask);
+  }
+  (void) GNUNET_OS_process_kill (cmd->eip, SIGKILL);
+  GNUNET_break (GNUNET_OK == GNUNET_OS_process_wait (cmd->eip));
+  GNUNET_OS_process_destroy (cmd->eip);
+  GNUNET_DISK_pipe_close (cmd->opipe);
+  GNUNET_free (cmd);
+}
+
+
+/**
+ * Read from the process and call the line processor.
+ *
+ * @param cls the `struct GNUNET_OS_CommandHandle *`
+ */
+static void
+cmd_read (void *cls)
+{
+  struct GNUNET_OS_CommandHandle *cmd = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+  GNUNET_OS_LineProcessor proc;
+  char *end;
+  ssize_t ret;
+
+  cmd->rtask = NULL;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  if (GNUNET_YES != GNUNET_NETWORK_fdset_handle_isset (tc->read_ready, cmd->r))
+  {
+    /* timeout */
+    proc = cmd->proc;
+    cmd->proc = NULL;
+    proc (cmd->proc_cls, NULL);
+    return;
+  }
+  ret = GNUNET_DISK_file_read (cmd->r,
+                               &cmd->buf[cmd->off],
+                               sizeof(cmd->buf) - cmd->off);
+  if (ret <= 0)
+  {
+    if ((cmd->off > 0) && (cmd->off < sizeof(cmd->buf)))
+    {
+      cmd->buf[cmd->off] = '\0';
+      cmd->proc (cmd->proc_cls, cmd->buf);
+    }
+    proc = cmd->proc;
+    cmd->proc = NULL;
+    proc (cmd->proc_cls, NULL);
+    return;
+  }
+  end = memchr (&cmd->buf[cmd->off], '\n', ret);
+  cmd->off += ret;
+  while (NULL != end)
+  {
+    *end = '\0';
+    cmd->proc (cmd->proc_cls, cmd->buf);
+    memmove (cmd->buf, end + 1, cmd->off - (end + 1 - cmd->buf));
+    cmd->off -= (end + 1 - cmd->buf);
+    end = memchr (cmd->buf, '\n', cmd->off);
+  }
+  cmd->rtask =
+    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_absolute_get_remaining (
+                                      cmd->timeout),
+                                    cmd->r,
+                                    &cmd_read,
+                                    cmd);
+}
+
+
+struct GNUNET_OS_CommandHandle *
+GNUNET_OS_command_run (GNUNET_OS_LineProcessor proc,
+                       void *proc_cls,
+                       struct GNUNET_TIME_Relative timeout,
+                       const char *binary,
+                       ...)
+{
+  struct GNUNET_OS_CommandHandle *cmd;
+  struct GNUNET_OS_Process *eip;
+  struct GNUNET_DISK_PipeHandle *opipe;
+  va_list ap;
+
+  opipe = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  if (NULL == opipe)
+    return NULL;
+  va_start (ap, binary);
+  /* redirect stdout, don't inherit stderr/stdin */
+  eip =
+    GNUNET_OS_start_process_va (GNUNET_OS_INHERIT_STD_NONE,
+                                NULL,
+                                opipe,
+                                NULL,
+                                binary,
+                                ap);
+  va_end (ap);
+  if (NULL == eip)
+  {
+    GNUNET_DISK_pipe_close (opipe);
+    return NULL;
+  }
+  GNUNET_DISK_pipe_close_end (opipe, GNUNET_DISK_PIPE_END_WRITE);
+  cmd = GNUNET_new (struct GNUNET_OS_CommandHandle);
+  cmd->timeout = GNUNET_TIME_relative_to_absolute (timeout);
+  cmd->eip = eip;
+  cmd->opipe = opipe;
+  cmd->proc = proc;
+  cmd->proc_cls = proc_cls;
+  cmd->r = GNUNET_DISK_pipe_handle (opipe, GNUNET_DISK_PIPE_END_READ);
+  cmd->rtask = GNUNET_SCHEDULER_add_read_file (timeout, cmd->r, &cmd_read, cmd);
+  return cmd;
+}
+
+
+/* end of os_priority.c */
diff --git a/src/lib/util/peer.c b/src/lib/util/peer.c
new file mode 100644
index 000000000..e5c15b098
--- /dev/null
+++ b/src/lib/util/peer.c
@@ -0,0 +1,242 @@
+/*
+      This file is part of GNUnet
+     Copyright (C) 2006, 2008, 2009 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/peer.c
+ * @brief peer-ID table that assigns integer IDs to peer-IDs to save memory
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-peer", __VA_ARGS__)
+
+
+struct PeerEntry
+{
+  /**
+   * The identifier itself
+   */
+  struct GNUNET_PeerIdentity id;
+
+  /**
+   * Short version of the identifier; if the RC==0, then index of next
+   * free slot in table, otherwise equal to this slot in the table.
+   */
+  GNUNET_PEER_Id pid;
+
+  /**
+   * Reference counter, 0 if this slot is not used.
+   */
+  unsigned int rc;
+};
+
+
+/**
+ * Table with our interned peer IDs.
+ */
+static struct PeerEntry **table;
+
+/**
+ * Peermap of PeerIdentities to "struct PeerEntry"
+ * (for fast lookup).  NULL until the library
+ * is actually being used.
+ */
+static struct GNUNET_CONTAINER_MultiPeerMap *map;
+
+/**
+ * Size of the "table".
+ */
+static unsigned int size;
+
+/**
+ * Index of the beginning of the free list in the table; set to "size"
+ * if no slots are free in the table.
+ */
+static unsigned int free_list_start;
+
+
+/**
+ * Search for a peer identity. The reference counter is not changed.
+ *
+ * @param pid identity to find
+ * @return the interned identity or 0.
+ */
+GNUNET_PEER_Id
+GNUNET_PEER_search (const struct GNUNET_PeerIdentity *pid)
+{
+  struct PeerEntry *e;
+
+  if (NULL == pid)
+    return 0;
+  if (NULL == map)
+    return 0;
+  e = GNUNET_CONTAINER_multipeermap_get (map, pid);
+  if (NULL == e)
+    return 0;
+  GNUNET_assert (e->rc > 0);
+  return e->pid;
+}
+
+
+/**
+ * Intern an peer identity.  If the identity is already known, its
+ * reference counter will be increased by one.
+ *
+ * @param pid identity to intern
+ * @return the interned identity.
+ */
+GNUNET_PEER_Id
+GNUNET_PEER_intern (const struct GNUNET_PeerIdentity *pid)
+{
+  GNUNET_PEER_Id ret;
+  struct PeerEntry *e;
+
+  if (NULL == pid)
+    return 0;
+  if (NULL == map)
+    map = GNUNET_CONTAINER_multipeermap_create (32, GNUNET_YES);
+  e = GNUNET_CONTAINER_multipeermap_get (map, pid);
+  if (NULL != e)
+  {
+    GNUNET_assert (e->rc > 0);
+    e->rc++;
+    return e->pid;
+  }
+  ret = free_list_start;
+  if (ret == size)
+  {
+    GNUNET_array_grow (table, size, size + 16);
+    for (unsigned int i = ret; i < size; i++)
+    {
+      table[i] = GNUNET_new (struct PeerEntry);
+      table[i]->pid = i + 1;
+    }
+  }
+  if (0 == ret)
+  {
+    memset (&table[0]->id, 0, sizeof(struct GNUNET_PeerIdentity));
+    table[0]->pid = 0;
+    table[0]->rc = 1;
+    ret = 1;
+  }
+  GNUNET_assert (ret < size);
+  GNUNET_assert (0 == table[ret]->rc);
+  free_list_start = table[ret]->pid;
+  table[ret]->id = *pid;
+  table[ret]->rc = 1;
+  table[ret]->pid = ret;
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_CONTAINER_multipeermap_put (map,
+                                                   &table[ret]->id,
+                                                   table[ret],
+                                                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  return ret;
+}
+
+
+void
+GNUNET_PEER_decrement_rcs (const GNUNET_PEER_Id *ids, unsigned int count)
+{
+  int i;
+  GNUNET_PEER_Id id;
+
+  if (0 == count)
+    return;
+  for (i = count - 1; i >= 0; i--)
+  {
+    id = ids[i];
+    if (0 == id)
+      continue;
+    GNUNET_assert (id < size);
+    GNUNET_assert (table[id]->rc > 0);
+    table[id]->rc--;
+    if (0 == table[id]->rc)
+    {
+      GNUNET_break (GNUNET_OK ==
+                    GNUNET_CONTAINER_multipeermap_remove (map,
+                                                          &table[id]->id,
+                                                          table[id]));
+      table[id]->pid = free_list_start;
+      free_list_start = id;
+    }
+  }
+}
+
+
+/**
+ * Change the reference counter of an interned PID.
+ *
+ * @param id identity to change the RC of
+ * @param delta how much to change the RC
+ */
+void
+GNUNET_PEER_change_rc (GNUNET_PEER_Id id, int delta)
+{
+  if (0 == id)
+    return;
+  GNUNET_assert (id < size);
+  GNUNET_assert (table[id]->rc > 0);
+  GNUNET_assert ((delta >= 0) ||
+                 (table[id]->rc >= (unsigned int) (-delta)));
+  table[id]->rc += delta;
+  if (0 == table[id]->rc)
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONTAINER_multipeermap_remove (map,
+                                                        &table[id]->id,
+                                                        table[id]));
+    table[id]->pid = free_list_start;
+    free_list_start = id;
+  }
+}
+
+
+/**
+ * Convert an interned PID to a normal peer identity.
+ *
+ * @param id interned PID to convert
+ * @param pid where to write the normal peer identity
+ */
+void
+GNUNET_PEER_resolve (GNUNET_PEER_Id id, struct GNUNET_PeerIdentity *pid)
+{
+  if (0 == id)
+  {
+    memset (pid, 0, sizeof(struct GNUNET_PeerIdentity));
+    return;
+  }
+  GNUNET_assert (id < size);
+  GNUNET_assert (table[id]->rc > 0);
+  *pid = table[id]->id;
+}
+
+
+const struct GNUNET_PeerIdentity *
+GNUNET_PEER_resolve2 (GNUNET_PEER_Id id)
+{
+  GNUNET_assert (id < size);
+  GNUNET_assert (table[id]->rc > 0);
+  return &table[id]->id;
+}
+
+
+/* end of peer.c */
diff --git a/src/lib/util/perf_crypto_asymmetric.c b/src/lib/util/perf_crypto_asymmetric.c
new file mode 100644
index 000000000..c033a02ca
--- /dev/null
+++ b/src/lib/util/perf_crypto_asymmetric.c
@@ -0,0 +1,133 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Bart Polot
+ * @file util/perf_crypto_asymmetric.c
+ * @brief measure performance of public key functions
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+static struct GNUNET_TIME_Absolute start;
+
+#define l 500
+
+struct TestSig
+{
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_HashCode h;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+};
+
+
+static void
+log_duration (const char *cryptosystem,
+              const char *description)
+{
+  struct GNUNET_TIME_Relative t;
+  char s[64];
+
+  sprintf (s, "%6s %15s", cryptosystem, description);
+  t = GNUNET_TIME_absolute_get_duration (start);
+  t = GNUNET_TIME_relative_divide (t, l);
+  fprintf (stdout,
+           "%s: %10s\n",
+           s,
+           GNUNET_STRINGS_relative_time_to_string (t,
+                                                   GNUNET_NO));
+  GAUGER ("UTIL", s, t.rel_value_us, "us");
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int i;
+  struct GNUNET_CRYPTO_EcdhePrivateKey ecdhe[l];
+  struct GNUNET_CRYPTO_EcdhePublicKey dhpub[l];
+  struct GNUNET_CRYPTO_EddsaPrivateKey eddsa[l];
+  struct GNUNET_CRYPTO_EddsaPublicKey dspub[l];
+  struct TestSig sig[l];
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+  {
+    sig[i].purp.purpose = 0;
+    sig[i].purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                              + sizeof(struct GNUNET_HashCode));
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                                &sig[i].h,
+                                sizeof(sig[i].h));
+  }
+  log_duration ("", "Init");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_CRYPTO_eddsa_key_create (&eddsa[i]);
+  log_duration ("EdDSA", "create key");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_CRYPTO_eddsa_key_get_public (&eddsa[i], &dspub[i]);
+  log_duration ("EdDSA", "get public");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_eddsa_sign_ (&eddsa[i],
+                                              &sig[i].purp,
+                                              &sig[i].sig));
+  log_duration ("EdDSA", "sign HashCode");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_eddsa_verify_ (0,
+                                                &sig[i].purp,
+                                                &sig[i].sig,
+                                                &dspub[i]));
+  log_duration ("EdDSA", "verify HashCode");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_CRYPTO_ecdhe_key_create (&ecdhe[i]);
+  log_duration ("ECDH", "create key");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l; i++)
+    GNUNET_CRYPTO_ecdhe_key_get_public (&ecdhe[i], &dhpub[i]);
+  log_duration ("ECDH", "get public");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < l - 1; i += 2)
+  {
+    GNUNET_CRYPTO_ecc_ecdh (&ecdhe[i], &dhpub[i + 1], &sig[i].h);
+    GNUNET_CRYPTO_ecc_ecdh (&ecdhe[i + 1], &dhpub[i], &sig[i + 1].h);
+  }
+  log_duration ("ECDH", "do DH");
+
+  return 0;
+}
+
+
+/* end of perf_crypto_asymmetric.c */
diff --git a/src/lib/util/perf_crypto_cs.c b/src/lib/util/perf_crypto_cs.c
new file mode 100644
index 000000000..43f32aae0
--- /dev/null
+++ b/src/lib/util/perf_crypto_cs.c
@@ -0,0 +1,184 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Lucien Heuzeveldt <lucienclaude.heuzeveldt@students.bfh.ch>
+ * @author Gian Demarmels <gian@demarmels.org>
+ * @file util/perf_crypto_cs.c
+ * @brief measure performance of Clause Blind Schnorr Signatures
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+#define ITER 10
+
+/**
+ * Evaluate Clause Blind Schnorr Signature performance.
+ *
+ */
+static void
+eval ()
+{
+  struct GNUNET_TIME_Absolute start;
+  unsigned int i;
+
+  struct GNUNET_CRYPTO_CsPrivateKey priv;
+  struct GNUNET_CRYPTO_CsPublicKey pub;
+
+  struct GNUNET_CRYPTO_CsRSecret r_priv[2];
+  struct GNUNET_CRYPTO_CsRPublic r_pub[2];
+
+  char message[] = "test message";
+  size_t message_len = strlen ("test message");
+
+  // derive a test nonce
+  struct GNUNET_CRYPTO_CsNonce nonce;
+  GNUNET_assert (GNUNET_YES == GNUNET_CRYPTO_hkdf (nonce.nonce,
+                                                   sizeof(nonce.nonce),
+                                                   GCRY_MD_SHA512,
+                                                   GCRY_MD_SHA256,
+                                                   "nonce",
+                                                   strlen ("nonce"),
+                                                   "nonce_secret",
+                                                   strlen ("nonce_secret"),
+                                                   NULL,
+                                                   0));
+
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2];
+  struct GNUNET_CRYPTO_CsC blinded_cs[2];
+  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2];
+  struct GNUNET_CRYPTO_CsBlindS blinded_s;
+  struct GNUNET_CRYPTO_CsS signature_scalar;
+  struct GNUNET_CRYPTO_CsSignature sig;
+
+  // BENCHMARK keygen
+  start = GNUNET_TIME_absolute_get ();
+
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_private_key_generate (&priv);
+    GNUNET_CRYPTO_cs_private_key_get_public (&priv, &pub);
+  }
+  printf ("10x key generation took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+
+  // BENCHMARK r derive and calc R pub
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_r_derive (&nonce, &priv, r_priv);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[0], &r_pub[0]);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[1], &r_pub[1]);
+  }
+  printf ("10x r0, r1 derive and R1,R2 calculation took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+
+  // BENCHMARK derive blinding secrets
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_blinding_secrets_derive (&nonce,
+                                              bs);
+  }
+  printf ("10x derive blinding secrets took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+
+  // BENCHMARK calculating C
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_calc_blinded_c (bs,
+                                     r_pub,
+                                     &pub,
+                                     message,
+                                     message_len,
+                                     blinded_cs,
+                                     blinded_r_pub);
+  }
+  printf ("10x calculating the blinded c took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+
+  // BENCHMARK sign derive
+  unsigned int b;
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    b = GNUNET_CRYPTO_cs_sign_derive (&priv,
+                                      r_priv,
+                                      blinded_cs,
+                                      &nonce,
+                                      &blinded_s);
+  }
+  printf ("10x signing blinded c took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+
+  // BENCHMARK unblind signature
+  start = GNUNET_TIME_absolute_get ();
+
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_unblind (&blinded_s, &bs[b], &signature_scalar);
+    sig.r_point = blinded_r_pub[b];
+    sig.s_scalar = signature_scalar;
+  }
+  printf ("10x unblinding s took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+  // BENCHMARK verify signature
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_verify (&sig,
+                             &pub,
+                             message,
+                             message_len);
+  }
+  printf ("10x verifying signatures took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+}
+
+int
+main (int argc, char *argv[])
+{
+  eval ();
+  return 0;
+}
diff --git a/src/lib/util/perf_crypto_ecc_dlog.c b/src/lib/util/perf_crypto_ecc_dlog.c
new file mode 100644
index 000000000..698a3aafa
--- /dev/null
+++ b/src/lib/util/perf_crypto_ecc_dlog.c
@@ -0,0 +1,184 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/perf_crypto_ecc_dlog.c
+ * @brief benchmark for ECC DLOG calculation
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+#include <gauger.h>
+
+
+/**
+ * Name of the curve we are using.  Note that we have hard-coded
+ * structs that use 256 bits, so using a bigger curve will require
+ * changes that break stuff badly.  The name of the curve given here
+ * must be agreed by all peers and be supported by libgcrypt.
+ */
+#define CURVE "Ed25519"
+
+/**
+ * Maximum value we benchmark dlog for.
+ */
+#define MAX_FACT (1024 * 1024)
+
+/**
+ * Maximum memory to use, sqrt(MAX_FACT) is a good choice.
+ */
+#define MAX_MEM 1024
+
+/**
+ * How many values do we test?
+ */
+#define TEST_ITER 10
+
+
+/**
+ * Do some DLOG operations for testing.
+ *
+ * @param edc context for ECC operations
+ * @param do_dlog true if we want to actually do the bencharked operation
+ */
+static void
+test_dlog (struct GNUNET_CRYPTO_EccDlogContext *edc,
+           bool do_dlog)
+{
+  for (unsigned int i = 0; i < TEST_ITER; i++)
+  {
+    struct GNUNET_CRYPTO_EccScalar fact;
+    struct GNUNET_CRYPTO_EccScalar n;
+    struct GNUNET_CRYPTO_EccPoint q;
+    int x;
+
+    fprintf (stderr, ".");
+    x = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  MAX_FACT);
+    memset (&n,
+            0,
+            sizeof (n));
+    for (unsigned int j = 0; j < x; j++)
+      sodium_increment (n.v,
+                        sizeof (n.v));
+    if (0 == GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                       2))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Trying negative %d\n",
+                  -x);
+      crypto_core_ed25519_scalar_negate (fact.v,
+                                         n.v);
+      x = -x;
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Trying positive %d\n",
+                  x);
+      fact = n;
+    }
+    if (0 == x)
+    {
+      /* libsodium does not like to multiply with zero; make sure
+         'q' is a valid point (g) first, then use q = q - q to get
+         the product with zero */
+      sodium_increment (fact.v,
+                        sizeof (fact.v));
+      GNUNET_assert (0 ==
+                     crypto_scalarmult_ed25519_base_noclamp (q.v,
+                                                             fact.v));
+      GNUNET_assert (
+        0 ==
+        crypto_core_ed25519_sub (q.v,
+                                 q.v,
+                                 q.v));
+    }
+    else
+      GNUNET_assert (0 ==
+                     crypto_scalarmult_ed25519_base_noclamp (q.v,
+                                                             fact.v));
+    if (do_dlog)
+    {
+      int iret;
+
+      if (x !=
+          (iret = GNUNET_CRYPTO_ecc_dlog (edc,
+                                          &q)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "DLOG failed for value %d (got: %d)\n",
+                    x,
+                    iret);
+        GNUNET_assert (0);
+      }
+    }
+  }
+  fprintf (stderr,
+           "\n");
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_CRYPTO_EccDlogContext *edc;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Relative delta;
+
+  GNUNET_log_setup ("perf-crypto-ecc-dlog",
+                    "WARNING",
+                    NULL);
+  start = GNUNET_TIME_absolute_get ();
+  edc = GNUNET_CRYPTO_ecc_dlog_prepare (MAX_FACT,
+                                        MAX_MEM);
+  printf ("DLOG precomputation 1M/1K took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "ECC DLOG initialization",
+          GNUNET_TIME_absolute_get_duration
+            (start).rel_value_us / 1000LL, "ms/op");
+  start = GNUNET_TIME_absolute_get ();
+  /* first do a baseline run without the DLOG */
+  test_dlog (edc, false);
+  delta = GNUNET_TIME_absolute_get_duration (start);
+  start = GNUNET_TIME_absolute_get ();
+  test_dlog (edc, true);
+  delta = GNUNET_TIME_relative_subtract (GNUNET_TIME_absolute_get_duration (
+                                           start),
+                                         delta);
+  printf ("%u DLOG calculations took %s\n",
+          TEST_ITER,
+          GNUNET_STRINGS_relative_time_to_string (delta,
+                                                  GNUNET_YES));
+  GAUGER ("UTIL",
+          "ECC DLOG operations",
+          delta.rel_value_us / 1000LL / TEST_ITER,
+          "ms/op");
+
+  GNUNET_CRYPTO_ecc_dlog_release (edc);
+  return 0;
+}
+
+
+/* end of perf_crypto_ecc_dlog.c */
diff --git a/src/lib/util/perf_crypto_hash.c b/src/lib/util/perf_crypto_hash.c
new file mode 100644
index 000000000..4e37ef758
--- /dev/null
+++ b/src/lib/util/perf_crypto_hash.c
@@ -0,0 +1,115 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002, 2003, 2004, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/perf_crypto_hash.c
+ * @brief measure performance of hash function
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+#include <gcrypt.h>
+
+
+static void
+perfHash ()
+{
+  struct GNUNET_HashCode hc;
+  unsigned int i;
+  char buf[64 * 1024];
+
+  memset (buf, 1, sizeof(buf));
+  for (i = 0; i < 1024; i++)
+    GNUNET_CRYPTO_hash (buf, sizeof(buf), &hc);
+}
+
+
+static void
+perfHashSmall ()
+{
+  struct GNUNET_HashCode hc;
+  unsigned int i;
+  char buf[64];
+
+  memset (buf, 1, sizeof(buf));
+  for (i = 0; i < 1024; i++)
+    GNUNET_CRYPTO_hash (buf, sizeof(buf), &hc);
+}
+
+
+static void
+perfHKDF ()
+{
+  unsigned int i;
+  char res[128];
+  char buf[128];
+  char skm[64];
+
+  memset (buf, 1, sizeof(buf));
+  memset (skm, 2, sizeof(skm));
+  for (i = 0; i < 1024; i++)
+    GNUNET_CRYPTO_hkdf (res, sizeof(res),
+                        GCRY_MD_SHA512, GCRY_MD_SHA256,
+                        buf, sizeof(buf),
+                        skm, sizeof(skm),
+                        "test", (size_t) 4,
+                        NULL, 0);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute start;
+
+  start = GNUNET_TIME_absolute_get ();
+  perfHashSmall ();
+  printf ("1024x 64-byte Hash perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+
+  start = GNUNET_TIME_absolute_get ();
+  perfHash ();
+  printf ("1024x 64k Hash perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Cryptographic hashing",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "kb/ms");
+  start = GNUNET_TIME_absolute_get ();
+  perfHKDF ();
+  printf ("HKDF perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Cryptographic HKDF",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "kb/ms");
+  return 0;
+}
+
+
+/* end of perf_crypto_hash.c */
diff --git a/src/lib/util/perf_crypto_paillier.c b/src/lib/util/perf_crypto_paillier.c
new file mode 100644
index 000000000..53c717a66
--- /dev/null
+++ b/src/lib/util/perf_crypto_paillier.c
@@ -0,0 +1,96 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/perf_crypto_paillier.c
+ * @brief measure performance of Paillier encryption
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_CRYPTO_PaillierPublicKey public_key;
+  struct GNUNET_CRYPTO_PaillierPrivateKey private_key;
+  struct GNUNET_CRYPTO_PaillierCiphertext c1;
+  gcry_mpi_t m1;
+  unsigned int i;
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+    GNUNET_CRYPTO_paillier_create (&public_key,
+                                   &private_key);
+  printf ("10x key generation took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Paillier key generation",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "keys/ms");
+
+  m1 = gcry_mpi_new (0);
+  m1 = gcry_mpi_set_ui (m1, 1);
+  /* m1 = m1 * 2 ^ (GCPB - 3) */
+  gcry_mpi_mul_2exp (m1,
+                     m1,
+                     GNUNET_CRYPTO_PAILLIER_BITS - 3);
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+    GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                    m1,
+                                    2,
+                                    &c1);
+  printf ("10x encryption took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Paillier encryption",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+    GNUNET_CRYPTO_paillier_decrypt (&private_key,
+                                    &public_key,
+                                    &c1,
+                                    m1);
+  printf ("10x decryption took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Paillier decryption",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+
+
+  return 0;
+}
+
+
+/* end of perf_crypto_paillier.c */
diff --git a/src/lib/util/perf_crypto_rsa.c b/src/lib/util/perf_crypto_rsa.c
new file mode 100644
index 000000000..721973b1a
--- /dev/null
+++ b/src/lib/util/perf_crypto_rsa.c
@@ -0,0 +1,211 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/perf_crypto_rsa.c
+ * @brief measure performance of RSA signing
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+
+/**
+ * Evaluate RSA performance.
+ *
+ * @param len keylength to evaluate with
+ */
+static void
+eval (unsigned int len)
+{
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  struct GNUNET_CRYPTO_RsaSignature *rsig;
+  struct GNUNET_CRYPTO_RsaPublicKey *public_key;
+  struct GNUNET_CRYPTO_RsaPrivateKey *private_key;
+  struct GNUNET_CRYPTO_RsaBlindingKeySecret bsec[10];
+  unsigned int i;
+  char sbuf[128];
+  struct GNUNET_HashCode hc;
+  struct GNUNET_CRYPTO_RsaBlindedMessage bm;
+
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+  {
+    private_key = GNUNET_CRYPTO_rsa_private_key_create (len);
+    GNUNET_CRYPTO_rsa_private_key_free (private_key);
+  }
+  printf ("10x %u-key generation took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GNUNET_snprintf (sbuf,
+                   sizeof(sbuf),
+                   "RSA %u-key generation",
+                   len);
+  GAUGER ("UTIL", sbuf,
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "keys/ms");
+  private_key = GNUNET_CRYPTO_rsa_private_key_create (len);
+  public_key = GNUNET_CRYPTO_rsa_private_key_get_public (private_key);
+  for (i = 0; i < 10; i++)
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                                &bsec[i], sizeof(bsec[0]));
+  /*
+     start = GNUNET_TIME_absolute_get ();
+     for (i=0;i<10;i++)
+     rsa_blinding_key_derive(public_key, &bsec[i]);
+     printf ("10x %u-blinding key generation took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (start),
+                                                  GNUNET_YES));
+     GNUNET_snprintf (sbuf,
+                   sizeof (sbuf),
+                   "RSA %u-blinding key generation",
+                   len);
+     GAUGER ("UTIL", sbuf,
+          64 * 1024 / (1 +
+                       GNUNET_TIME_absolute_get_duration
+                       (start).rel_value_us / 1000LL), "keys/ms");
+   */
+  start = GNUNET_TIME_absolute_get ();
+  GNUNET_CRYPTO_hash ("test", 4, &hc);
+  for (i = 0; i < 10; i++)
+  {
+    GNUNET_CRYPTO_rsa_blind (&hc,
+                             sizeof (hc),
+                             &bsec[i],
+                             public_key,
+                             &bm);
+    GNUNET_CRYPTO_rsa_blinded_message_free (&bm);
+  }
+  printf ("10x %u-blinding took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            true));
+  GNUNET_snprintf (sbuf,
+                   sizeof(sbuf),
+                   "RSA %u-blinding",
+                   len);
+  GAUGER ("UTIL",
+          sbuf,
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+  GNUNET_CRYPTO_rsa_blind (&hc,
+                           sizeof (hc),
+                           &bsec[0],
+                           public_key,
+                           &bm);
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+  {
+    sig = GNUNET_CRYPTO_rsa_sign_blinded (private_key,
+                                          &bm);
+    GNUNET_CRYPTO_rsa_signature_free (sig);
+  }
+  printf ("10x %u-signing took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GNUNET_snprintf (sbuf,
+                   sizeof(sbuf),
+                   "RSA %u-signing",
+                   len);
+  GAUGER ("UTIL",
+          sbuf,
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+  sig = GNUNET_CRYPTO_rsa_sign_blinded (private_key,
+                                        &bm);
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+  {
+    rsig = GNUNET_CRYPTO_rsa_unblind (sig,
+                                      &bsec[0],
+                                      public_key);
+    GNUNET_CRYPTO_rsa_signature_free (rsig);
+  }
+  printf ("10x %u-unblinding took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            true));
+  GNUNET_snprintf (sbuf,
+                   sizeof(sbuf),
+                   "RSA %u-unblinding",
+                   len);
+  GAUGER ("UTIL",
+          sbuf,
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+  rsig = GNUNET_CRYPTO_rsa_unblind (sig,
+                                    &bsec[0],
+                                    public_key);
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < 10; i++)
+  {
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_rsa_verify (&hc,
+                                             sizeof (hc),
+                                             rsig,
+                                             public_key));
+  }
+  printf ("10x %u-verifying took %s\n",
+          len,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GNUNET_snprintf (sbuf,
+                   sizeof(sbuf),
+                   "RSA %u-verification",
+                   len);
+  GAUGER ("UTIL",
+          sbuf,
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "ops/ms");
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+  GNUNET_CRYPTO_rsa_public_key_free (public_key);
+  GNUNET_CRYPTO_rsa_private_key_free (private_key);
+  GNUNET_CRYPTO_rsa_blinded_message_free (&bm);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  eval (1024);
+  eval (2048);
+  eval (3072);
+  eval (4096); 
+  return 0;
+}
+
+
+/* end of perf_crypto_rsa.c */
diff --git a/src/lib/util/perf_crypto_symmetric.c b/src/lib/util/perf_crypto_symmetric.c
new file mode 100644
index 000000000..9be452015
--- /dev/null
+++ b/src/lib/util/perf_crypto_symmetric.c
@@ -0,0 +1,78 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002, 2003, 2004, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/perf_crypto_symmetric.c
+ * @brief measure performance of encryption function
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+
+static void
+perfEncrypt ()
+{
+  unsigned int i;
+  char buf[64 * 1024];
+  char rbuf[64 * 1024];
+  struct GNUNET_CRYPTO_SymmetricSessionKey sk;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+
+  GNUNET_CRYPTO_symmetric_create_session_key (&sk);
+
+  memset (buf, 1, sizeof(buf));
+  for (i = 0; i < 1024; i++)
+  {
+    memset (&iv, (int8_t) i, sizeof(iv));
+    GNUNET_CRYPTO_symmetric_encrypt (buf, sizeof(buf),
+                                     &sk, &iv,
+                                     rbuf);
+    GNUNET_CRYPTO_symmetric_decrypt (rbuf, sizeof(buf),
+                                     &sk, &iv,
+                                     buf);
+  }
+  memset (rbuf, 1, sizeof(rbuf));
+  GNUNET_assert (0 == memcmp (rbuf, buf, sizeof(buf)));
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute start;
+
+  start = GNUNET_TIME_absolute_get ();
+  perfEncrypt ();
+  printf ("Encrypt perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Symmetric encryption",
+          64 * 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "kb/ms");
+  return 0;
+}
+
+
+/* end of perf_crypto_aes.c */
diff --git a/src/lib/util/perf_malloc.c b/src/lib/util/perf_malloc.c
new file mode 100644
index 000000000..48a4a2ae7
--- /dev/null
+++ b/src/lib/util/perf_malloc.c
@@ -0,0 +1,98 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/perf_malloc.c
+ * @brief measure performance of allocation functions
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+static uint64_t
+perf_malloc ()
+{
+  uint64_t ret;
+
+  ret = 0;
+  for (size_t i = 1; i < 1024 * 1024; i += 1024)
+  {
+    ret += i;
+    GNUNET_free_nz (GNUNET_malloc (i));
+  }
+  return ret;
+}
+
+
+static uint64_t
+perf_realloc ()
+{
+  uint64_t ret;
+
+  ret = 0;
+  for (size_t i = 10; i < 1024 * 1024 / 5; i += 1024)
+  {
+    char *ptr;
+
+    ret += i;
+    ptr = GNUNET_malloc (i);
+    memset (ptr, 1, i);
+    ptr = GNUNET_realloc (ptr, i + 5);
+    for (size_t j = 0; j<i; j++)
+      GNUNET_assert (1 == ptr[j]);
+    memset (ptr, 6, i + 5);
+    ptr = GNUNET_realloc (ptr, i - 5);
+    for (size_t j = 0; j<i - 5; j++)
+      GNUNET_assert (6 == ptr[j]);
+    GNUNET_free (ptr);
+  }
+  return ret;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute start;
+  uint64_t kb;
+
+  start = GNUNET_TIME_absolute_get ();
+  kb = perf_malloc ();
+  printf ("Malloc perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Allocation",
+          kb / 1024 / (1
+                       + GNUNET_TIME_absolute_get_duration
+                         (start).rel_value_us / 1000LL), "kb/ms");
+  start = GNUNET_TIME_absolute_get ();
+  kb = perf_realloc ();
+  printf ("Realloc perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return 0;
+}
+
+
+/* end of perf_malloc.c */
diff --git a/src/lib/util/perf_mq.c b/src/lib/util/perf_mq.c
new file mode 100644
index 000000000..5c956e4e9
--- /dev/null
+++ b/src/lib/util/perf_mq.c
@@ -0,0 +1,301 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2018, 2020 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/perf_mq.c
+ * @brief benchmark for mq
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+#define NUM_TRANSMISSIONS 1000000
+
+/**
+ * How long does the receiver take per message?
+ */
+#define RECEIVER_THROTTLE GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MILLISECONDS, 1)
+
+static unsigned int received_cnt;
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+struct MyMessage
+{
+  struct GNUNET_MessageHeader header;
+  uint32_t x GNUNET_PACKED;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+static int global_ret;
+
+static struct GNUNET_SCHEDULER_Task *task;
+
+static struct GNUNET_MQ_Handle *cmq;
+
+
+static void
+do_shutdown (void *cls)
+{
+  (void) cls;
+  if (NULL != task)
+  {
+    GNUNET_SCHEDULER_cancel (task);
+    task = NULL;
+  }
+  if (NULL != cmq)
+  {
+    GNUNET_MQ_destroy (cmq);
+    cmq = NULL;
+  }
+}
+
+
+/**
+ * Generic error handler, called with the appropriate
+ * error code and the same closure specified at the creation of
+ * the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure
+ * @param error error code
+ */
+static void
+error_cb (void *cls,
+          enum GNUNET_MQ_Error error)
+{
+  GNUNET_break (0);
+  global_ret = 3;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+handle_dummy (void *cls,
+              const struct MyMessage *msg)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+
+  GNUNET_SERVICE_client_continue (c);
+  if (received_cnt != ntohl (msg->x))
+  {
+    GNUNET_break (0);
+    global_ret = 4;
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  received_cnt++;
+}
+
+
+static void
+handle_dummy2 (void *cls,
+               const struct MyMessage *msg)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+
+  GNUNET_SERVICE_client_continue (c);
+  if (NUM_TRANSMISSIONS != received_cnt)
+  {
+    GNUNET_break (0);
+    global_ret = 5;
+  }
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+do_send (void *cls);
+
+
+/**
+ * Function called whenever MQ has sent a message.
+ */
+static void
+notify_sent_cb (void *cls)
+{
+  static unsigned int seen;
+  unsigned int *cnt = cls;
+
+  if (seen != *cnt)
+  {
+    GNUNET_break (0);
+    global_ret = 6;
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  seen++;
+  GNUNET_free (cnt);
+  task = GNUNET_SCHEDULER_add_now (&do_send,
+                                   NULL);
+}
+
+
+static void
+do_send (void *cls)
+{
+  static unsigned int i = 0;
+  unsigned int *cnt;
+  struct GNUNET_MQ_Envelope *env;
+  struct MyMessage *m;
+
+  task = NULL;
+  if (NUM_TRANSMISSIONS == i)
+  {
+    env = GNUNET_MQ_msg (m,
+                         GNUNET_MESSAGE_TYPE_DUMMY2);
+    GNUNET_MQ_send (cmq,
+                    env);
+    return;
+  }
+  cnt = GNUNET_new (unsigned int);
+  *cnt = i;
+  env = GNUNET_MQ_msg (m,
+                       GNUNET_MESSAGE_TYPE_DUMMY);
+  GNUNET_MQ_notify_sent (env,
+                         &notify_sent_cb,
+                         cnt);
+  m->x = htonl (i);
+  GNUNET_MQ_send (cmq,
+                  env);
+  i++;
+}
+
+
+/**
+ * Start running the actual test.
+ *
+ * @param cls closure passed to #GNUNET_SERVICE_MAIN
+ * @param cfg configuration to use for this service
+ * @param sh handle to the newly create service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_SERVICE_Handle *sh)
+{
+  struct GNUNET_MQ_MessageHandler ch[] = {
+    GNUNET_MQ_handler_end ()
+  };
+
+  (void) cls;
+  (void) sh;
+  cmq = GNUNET_CLIENT_connect (cfg,
+                               "test_client",
+                               ch,
+                               &error_cb,
+                               NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  task = GNUNET_SCHEDULER_add_now (&do_send,
+                                   NULL);
+}
+
+
+/**
+ * Callback to be called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return the client-specific (`internal') closure
+ */
+static void *
+connect_cb (void *cls,
+            struct GNUNET_SERVICE_Client *c,
+            struct GNUNET_MQ_Handle *mq)
+{
+  (void) cls;
+  (void) mq;
+  return c;
+}
+
+
+/**
+ * Callback to be called when a client disconnected from the service
+ *
+ * @param cls closure for the service
+ * @param c the client that disconnected
+ * @param internal_cls the client-specific (`internal') closure
+ */
+static void
+disconnect_cb (void *cls,
+               struct GNUNET_SERVICE_Client *c,
+               void *internal_cls)
+{
+  (void) cls;
+  (void) c;
+  (void) internal_cls;
+}
+
+
+int
+main (int argc, char **argv)
+{
+  struct GNUNET_TIME_Absolute start;
+  char *test_argv[] = {
+    (char *) "test_client",
+    "-c",
+    "test_client_data.conf",
+    NULL
+  };
+  struct GNUNET_MQ_MessageHandler mh[] = {
+    GNUNET_MQ_hd_fixed_size (dummy,
+                             GNUNET_MESSAGE_TYPE_DUMMY,
+                             struct MyMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (dummy2,
+                             GNUNET_MESSAGE_TYPE_DUMMY2,
+                             struct MyMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  (void) argc;
+  (void) argv;
+  GNUNET_log_setup ("perf-mq",
+                    "INFO",
+                    NULL);
+  start = GNUNET_TIME_absolute_get ();
+  if (0 !=
+      GNUNET_SERVICE_run_ (3,
+                           test_argv,
+                           "test_client",
+                           GNUNET_SERVICE_OPTION_NONE,
+                           &run,
+                           &connect_cb,
+                           &disconnect_cb,
+                           NULL,
+                           mh))
+    return 1;
+  printf ("Scheduler perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Scheduler",
+          received_cnt / 1024 / (1
+                                 + GNUNET_TIME_absolute_get_duration
+                                   (start).rel_value_us / 1000LL), "kmsg/ms");
+  return global_ret;
+}
diff --git a/src/lib/util/perf_scheduler.c b/src/lib/util/perf_scheduler.c
new file mode 100644
index 000000000..af084e04a
--- /dev/null
+++ b/src/lib/util/perf_scheduler.c
@@ -0,0 +1,104 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2020 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Christian Grothoff
+ * @file util/perf_scheduler.c
+ * @brief measure performance of scheduler functions
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gauger.h>
+
+#define RUNS (1024 * 1024)
+
+static struct GNUNET_SCHEDULER_Task *task;
+
+
+static void
+run (void *cls)
+{
+  uint64_t *count = cls;
+
+  task = NULL;
+  (*count)++;
+  if (*count >= RUNS)
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  task = GNUNET_SCHEDULER_add_now (&run,
+                                   count);
+}
+
+
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != task)
+    GNUNET_SCHEDULER_cancel (task);
+}
+
+
+static void
+first (void *cls)
+{
+  uint64_t *count = cls;
+
+  (*count)++;
+  task = GNUNET_SCHEDULER_add_now (&run,
+                                   count);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+}
+
+
+static uint64_t
+perf_scheduler ()
+{
+  uint64_t count = 0;
+
+  GNUNET_SCHEDULER_run (&first,
+                        &count);
+  return count;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute start;
+  uint64_t tasks;
+
+  start = GNUNET_TIME_absolute_get ();
+  tasks = perf_scheduler ();
+  printf ("Scheduler perf took %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  GAUGER ("UTIL", "Scheduler",
+          tasks / 1024 / (1
+                          + GNUNET_TIME_absolute_get_duration
+                            (start).rel_value_us / 1000LL), "tasks/ms");
+  return 0;
+}
+
+
+/* end of perf_scheduler.c */
diff --git a/src/lib/util/plugin.c b/src/lib/util/plugin.c
new file mode 100644
index 000000000..62c2a1df0
--- /dev/null
+++ b/src/lib/util/plugin.c
@@ -0,0 +1,403 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2002-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/plugin.c
+ * @brief Methods to access plugins
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include <ltdl.h>
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-plugin", __VA_ARGS__)
+
+/**
+ * Linked list of active plugins.
+ */
+struct PluginList
+{
+  /**
+   * This is a linked list.
+   */
+  struct PluginList *next;
+
+  /**
+   * Name of the library.
+   */
+  char *name;
+
+  /**
+   * System handle.
+   */
+  void *handle;
+};
+
+
+/**
+ * Have we been initialized?
+ */
+static int initialized;
+
+/**
+ * Libtool search path before we started.
+ */
+static char *old_dlsearchpath;
+
+/**
+ * List of plugins we have loaded.
+ */
+static struct PluginList *plugins;
+
+
+/**
+ * Setup libtool paths.
+ */
+static void
+plugin_init (void)
+{
+  int err;
+  const char *opath;
+  char *path;
+  char *cpath;
+
+  err = lt_dlinit ();
+  if (err > 0)
+  {
+    fprintf (stderr,
+             _ ("Initialization of plugin mechanism failed: %s!\n"),
+             lt_dlerror ());
+    return;
+  }
+  opath = lt_dlgetsearchpath ();
+  if (NULL != opath)
+    old_dlsearchpath = GNUNET_strdup (opath);
+  path = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LIBDIR);
+  if (NULL != path)
+  {
+    if (NULL != opath)
+    {
+      GNUNET_asprintf (&cpath,
+                       "%s:%s",
+                       opath,
+                       path);
+      lt_dlsetsearchpath (cpath);
+      GNUNET_free (path);
+      GNUNET_free (cpath);
+    }
+    else
+    {
+      lt_dlsetsearchpath (path);
+      GNUNET_free (path);
+    }
+  }
+}
+
+
+/**
+ * Shutdown libtool.
+ */
+static void
+plugin_fini (void)
+{
+  lt_dlsetsearchpath (old_dlsearchpath);
+  if (NULL != old_dlsearchpath)
+  {
+    GNUNET_free (old_dlsearchpath);
+    old_dlsearchpath = NULL;
+  }
+  if (NULL == getenv ("VALGRINDING_PLUGINS"))
+    lt_dlexit ();
+}
+
+
+/**
+ * Lookup a function in the plugin.
+ *
+ * @param plug the plugin to check
+ * @param name name of the symbol to look for
+ * @return NULL if the symbol was not found
+ */
+static GNUNET_PLUGIN_Callback
+resolve_function (struct PluginList *plug,
+                  const char *name)
+{
+  char *initName;
+  void *mptr;
+
+  GNUNET_asprintf (&initName,
+                   "_%s_%s",
+                   plug->name,
+                   name);
+  mptr = lt_dlsym (plug->handle,
+                   &initName[1]);
+  if (NULL == mptr)
+    mptr = lt_dlsym (plug->handle,
+                     initName);
+  if (NULL == mptr)
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("`%s' failed to resolve method '%s' with error: %s\n"),
+         "lt_dlsym",
+         &initName[1],
+         lt_dlerror ());
+  GNUNET_free (initName);
+  return mptr;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PLUGIN_test (const char *library_name)
+{
+  void *libhandle;
+  GNUNET_PLUGIN_Callback init;
+  struct PluginList plug;
+
+  if (! initialized)
+  {
+    initialized = GNUNET_YES;
+    plugin_init ();
+  }
+  libhandle = lt_dlopenext (library_name);
+  if (NULL == libhandle)
+    return GNUNET_NO;
+  plug.handle = libhandle;
+  plug.name = (char *) library_name;
+  init = resolve_function (&plug,
+                           "init");
+  if (NULL == init)
+  {
+    GNUNET_break (0);
+    lt_dlclose (libhandle);
+    return GNUNET_NO;
+  }
+  lt_dlclose (libhandle);
+  return GNUNET_YES;
+}
+
+
+void *
+GNUNET_PLUGIN_load (const char *library_name,
+                    void *arg)
+{
+  void *libhandle;
+  struct PluginList *plug;
+  GNUNET_PLUGIN_Callback init;
+  void *ret;
+
+  if (! initialized)
+  {
+    initialized = GNUNET_YES;
+    plugin_init ();
+  }
+  libhandle = lt_dlopenext (library_name);
+  if (NULL == libhandle)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("`%s' failed for library `%s' with error: %s\n"),
+         "lt_dlopenext",
+         library_name,
+         lt_dlerror ());
+    return NULL;
+  }
+  plug = GNUNET_new (struct PluginList);
+  plug->handle = libhandle;
+  plug->name = GNUNET_strdup (library_name);
+  plug->next = plugins;
+  plugins = plug;
+  init = resolve_function (plug,
+                           "init");
+  if ( (NULL == init) ||
+       (NULL == (ret = init (arg))) )
+  {
+    lt_dlclose (libhandle);
+    GNUNET_free (plug->name);
+    plugins = plug->next;
+    GNUNET_free (plug);
+    return NULL;
+  }
+  return ret;
+}
+
+
+void *
+GNUNET_PLUGIN_unload (const char *library_name,
+                      void *arg)
+{
+  struct PluginList *pos;
+  struct PluginList *prev;
+  GNUNET_PLUGIN_Callback done;
+  void *ret;
+
+  prev = NULL;
+  pos = plugins;
+  while ( (NULL != pos) &&
+          (0 != strcmp (pos->name,
+                        library_name)) )
+  {
+    prev = pos;
+    pos = pos->next;
+  }
+  if (NULL == pos)
+    return NULL;
+
+  done = resolve_function (pos,
+                           "done");
+  ret = NULL;
+  if (NULL == prev)
+    plugins = pos->next;
+  else
+    prev->next = pos->next;
+  if (NULL != done)
+    ret = done (arg);
+  if (NULL == getenv ("VALGRINDING_PLUGINS"))
+    lt_dlclose (pos->handle);
+  GNUNET_free (pos->name);
+  GNUNET_free (pos);
+  if (NULL == plugins)
+  {
+    plugin_fini ();
+    initialized = GNUNET_NO;
+  }
+  return ret;
+}
+
+
+/**
+ * Closure for #find_libraries().
+ */
+struct LoadAllContext
+{
+  /**
+   * Prefix the plugin names we find have to match.
+   */
+  const char *basename;
+
+  /**
+   * Argument to give to 'init' when loading the plugin.
+   */
+  void *arg;
+
+  /**
+   * Function to call for each plugin.
+   */
+  GNUNET_PLUGIN_LoaderCallback cb;
+
+  /**
+   * Closure for @e cb
+   */
+  void *cb_cls;
+};
+
+
+/**
+ * Function called on each plugin in the directory.  Loads
+ * the plugins that match the given basename.
+ *
+ * @param cls the `struct LoadAllContext` describing which
+ *            plugins to load and what to do with them
+ * @param filename name of a plugin library to check
+ * @return #GNUNET_OK (continue loading)
+ */
+static int
+find_libraries (void *cls,
+                const char *filename)
+{
+  struct LoadAllContext *lac = cls;
+  const char *slashpos;
+  const char *libname;
+  char *basename;
+  char *dot;
+  void *lib_ret;
+  size_t n;
+
+  libname = filename;
+  while (NULL != (slashpos = strstr (libname,
+                                     DIR_SEPARATOR_STR)))
+    libname = slashpos + 1;
+  n = strlen (libname);
+  if (0 != strncmp (lac->basename,
+                    libname,
+                    strlen (lac->basename)))
+    return GNUNET_OK; /* wrong name */
+  if ( (n > 3) &&
+       (0 == strcmp (&libname[n - 3], ".la")) )
+    return GNUNET_OK; /* .la file */
+  basename = GNUNET_strdup (libname);
+  if (NULL != (dot = strstr (basename, ".")))
+    *dot = '\0';
+  lib_ret = GNUNET_PLUGIN_load (basename,
+                                lac->arg);
+  if (NULL != lib_ret)
+    lac->cb (lac->cb_cls,
+             basename,
+             lib_ret);
+  GNUNET_free (basename);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_PLUGIN_load_all (const char *basename,
+                        void *arg,
+                        GNUNET_PLUGIN_LoaderCallback cb,
+                        void *cb_cls)
+{
+  struct LoadAllContext lac;
+  char *path;
+
+  path = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LIBDIR);
+  if (NULL == path)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Could not determine plugin installation path.\n"));
+    return;
+  }
+  lac.basename = basename;
+  lac.arg = arg;
+  lac.cb = cb;
+  lac.cb_cls = cb_cls;
+  GNUNET_DISK_directory_scan (path,
+                              &find_libraries,
+                              &lac);
+  GNUNET_free (path);
+}
+
+
+void
+GNUNET_PLUGIN_load_all_in_context (const struct GNUNET_OS_ProjectData *ctx,
+                                   const char *basename,
+                                   void *arg,
+                                   GNUNET_PLUGIN_LoaderCallback cb,
+                                   void *cb_cls)
+{
+  const struct GNUNET_OS_ProjectData *cpd = GNUNET_OS_project_data_get ();
+
+  GNUNET_OS_init (ctx);
+  GNUNET_PLUGIN_load_all (basename,
+                          arg,
+                          cb,
+                          cb_cls);
+  GNUNET_OS_init (cpd);
+}
+
+
+/* end of plugin.c */
diff --git a/src/lib/util/proc_compat.c b/src/lib/util/proc_compat.c
new file mode 100644
index 000000000..0423a0d5c
--- /dev/null
+++ b/src/lib/util/proc_compat.c
@@ -0,0 +1,50 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2005 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+
+/**
+ * @author Martin Schanzenbach
+ *
+ * @file util/proc_compat.c
+ * Definitions for macOS and Win32
+ */
+
+#include "platform.h"
+
+/**
+ * memrchr as defined in glibc
+ *
+ * @param s pointer to memory
+ * @param c character to search for
+ * @param n search character limit
+ */
+void*
+GN_memrchr_ (const void *s,
+             int c,
+             size_t n)
+{
+  const unsigned char *ucs = s;
+  ssize_t i;
+
+  for (i = n - 1; i >= 0; i--)
+    if (c == (int) ucs[i])
+      return (void *) &ucs[i];
+  return NULL;
+}
diff --git a/src/lib/util/program.c b/src/lib/util/program.c
new file mode 100644
index 000000000..2801b7650
--- /dev/null
+++ b/src/lib/util/program.c
@@ -0,0 +1,454 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPROSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/program.c
+ * @brief standard code for GNUnet startup and shutdown
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_resolver_service.h"
+#include "gnunet_constants.h"
+#include "speedup.h"
+#include <gcrypt.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-program", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+        GNUNET_log_from_strerror_file (kind, "util-program", syscall, filename)
+
+/**
+ * Context for the command.
+ */
+struct CommandContext
+{
+  /**
+   * Argv argument.
+   */
+  char *const *args;
+
+  /**
+   * Name of the configuration file used, can be NULL!
+   */
+  char *cfgfile;
+
+  /**
+   * Main function to run.
+   */
+  GNUNET_PROGRAM_Main task;
+
+  /**
+   * Closure for @e task.
+   */
+  void *task_cls;
+
+  /**
+   * Configuration to use.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+
+/**
+ * task run when the scheduler shuts down
+ */
+static void
+shutdown_task (void *cls)
+{
+  (void) cls;
+  GNUNET_SPEEDUP_stop_ ();
+}
+
+
+/**
+ * Initial task called by the scheduler for each
+ * program.  Runs the program-specific main task.
+ */
+static void
+program_main (void *cls)
+{
+  struct CommandContext *cc = cls;
+
+  GNUNET_SPEEDUP_start_ (cc->cfg);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
+  GNUNET_RESOLVER_connect (cc->cfg);
+  cc->task (cc->task_cls,
+            cc->args,
+            cc->cfgfile,
+            cc->cfg);
+}
+
+
+/**
+ * Compare function for 'qsort' to sort command-line arguments by the
+ * short option.
+ *
+ * @param a1 first command line option
+ * @param a2 second command line option
+ */
+static int
+cmd_sorter (const void *a1,
+            const void *a2)
+{
+  const struct GNUNET_GETOPT_CommandLineOption *c1 = a1;
+  const struct GNUNET_GETOPT_CommandLineOption *c2 = a2;
+
+  if (toupper ((unsigned char) c1->shortName) >
+      toupper ((unsigned char) c2->shortName))
+    return 1;
+  if (toupper ((unsigned char) c1->shortName) <
+      toupper ((unsigned char) c2->shortName))
+    return -1;
+  if (c1->shortName > c2->shortName)
+    return 1;
+  if (c1->shortName < c2->shortName)
+    return -1;
+  return 0;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PROGRAM_run2 (int argc,
+                     char *const *argv,
+                     const char *binaryName,
+                     const char *binaryHelp,
+                     const struct GNUNET_GETOPT_CommandLineOption *options,
+                     GNUNET_PROGRAM_Main task,
+                     void *task_cls,
+                     int run_without_scheduler)
+{
+  struct CommandContext cc;
+
+#if ENABLE_NLS
+  char *path;
+#endif
+  char *loglev;
+  char *logfile;
+  char *cfg_fn;
+  enum GNUNET_GenericReturnValue ret;
+  int iret;
+  unsigned int cnt;
+  unsigned long long skew_offset;
+  unsigned long long skew_variance;
+  long long clock_offset;
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  const struct GNUNET_GETOPT_CommandLineOption defoptions[] = {
+    GNUNET_GETOPT_option_cfgfile (&cc.cfgfile),
+    GNUNET_GETOPT_option_help (binaryHelp),
+    GNUNET_GETOPT_option_loglevel (&loglev),
+    GNUNET_GETOPT_option_logfile (&logfile),
+    GNUNET_GETOPT_option_version (pd->version)
+  };
+  unsigned int deflen = sizeof(defoptions) / sizeof(defoptions[0]);
+  struct GNUNET_GETOPT_CommandLineOption *allopts;
+  const char *gargs;
+  char *lpfx;
+  char *spc;
+
+  logfile = NULL;
+  gargs = getenv ("GNUNET_ARGS");
+  if (NULL != gargs)
+  {
+    char **gargv;
+    unsigned int gargc;
+    char *cargs;
+
+    gargv = NULL;
+    gargc = 0;
+    for (int i = 0; i < argc; i++)
+      GNUNET_array_append (gargv,
+                           gargc,
+                           GNUNET_strdup (argv[i]));
+    cargs = GNUNET_strdup (gargs);
+    for (char *tok = strtok (cargs, " ");
+         NULL != tok;
+         tok = strtok (NULL, " "))
+      GNUNET_array_append (gargv, gargc, GNUNET_strdup (tok));
+    GNUNET_free (cargs);
+    GNUNET_array_append (gargv, gargc, NULL);
+    argv = (char *const *) gargv;
+    argc = gargc - 1;
+  }
+  memset (&cc, 0, sizeof(cc));
+  loglev = NULL;
+  cc.task = task;
+  cc.task_cls = task_cls;
+  cc.cfg = cfg = GNUNET_CONFIGURATION_create ();
+  /* prepare */
+#if ENABLE_NLS
+  if (NULL != pd->gettext_domain)
+  {
+    setlocale (LC_ALL, "");
+    path = (NULL == pd->gettext_path)
+           ? GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LOCALEDIR)
+           : GNUNET_strdup (pd->gettext_path);
+    if (NULL != path)
+    {
+      bindtextdomain (pd->gettext_domain, path);
+      GNUNET_free (path);
+    }
+    textdomain (pd->gettext_domain);
+  }
+#endif
+  cnt = 0;
+  while (NULL != options[cnt].name)
+    cnt++;
+  allopts = GNUNET_new_array (cnt + deflen + 1,
+                              struct GNUNET_GETOPT_CommandLineOption);
+  GNUNET_memcpy (allopts,
+                 options,
+                 cnt * sizeof(struct GNUNET_GETOPT_CommandLineOption));
+  {
+    unsigned int xtra = 0;
+
+    for (unsigned int i = 0;
+         i<sizeof (defoptions) / sizeof(struct GNUNET_GETOPT_CommandLineOption);
+         i++)
+    {
+      bool found = false;
+
+      for (unsigned int j = 0; j<cnt; j++)
+      {
+        found |= ( (options[j].shortName == defoptions[i].shortName) &&
+                   (0 != options[j].shortName) );
+        found |= ( (NULL != options[j].name) &&
+                   (NULL != defoptions[i].name) &&
+                   (0 == strcmp (options[j].name,
+                                 defoptions[i].name)) );
+        if (found)
+          break;
+      }
+      if (found)
+        continue;
+      GNUNET_memcpy (&allopts[cnt + xtra],
+                     &defoptions[i],
+                     sizeof (struct GNUNET_GETOPT_CommandLineOption));
+      xtra++;
+    }
+    cnt += xtra;
+  }
+  qsort (allopts,
+         cnt,
+         sizeof(struct GNUNET_GETOPT_CommandLineOption),
+         &cmd_sorter);
+  loglev = NULL;
+  if ((NULL != pd->config_file) && (NULL != pd->user_config_file))
+    cfg_fn = GNUNET_CONFIGURATION_default_filename ();
+  else
+    cfg_fn = NULL;
+  lpfx = GNUNET_strdup (binaryName);
+  if (NULL != (spc = strstr (lpfx, " ")))
+    *spc = '\0';
+  iret = GNUNET_GETOPT_run (binaryName,
+                            allopts,
+                            (unsigned int) argc,
+                            argv);
+  if ((GNUNET_OK > iret) ||
+      (GNUNET_OK != GNUNET_log_setup (lpfx,
+                                      loglev,
+                                      logfile)))
+  {
+    GNUNET_free (allopts);
+    GNUNET_free (lpfx);
+    ret = (enum GNUNET_GenericReturnValue) iret;
+    goto cleanup;
+  }
+  if (NULL != cc.cfgfile)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Loading configuration from entry point specified as option (%s)\n",
+                cc.cfgfile);
+    if (GNUNET_YES !=
+        GNUNET_DISK_file_test (cc.cfgfile))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Unreadable configuration file `%s', exiting ...\n"),
+                  cc.cfgfile);
+      ret = GNUNET_SYSERR;
+      GNUNET_free (allopts);
+      GNUNET_free (lpfx);
+      goto cleanup;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CONFIGURATION_load (cfg,
+                                   cc.cfgfile))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Malformed configuration file `%s', exiting ...\n"),
+                  cc.cfgfile);
+      ret = GNUNET_SYSERR;
+      GNUNET_free (allopts);
+      GNUNET_free (lpfx);
+      goto cleanup;
+    }
+  }
+  else
+  {
+    if ( (NULL != cfg_fn) &&
+         (GNUNET_YES !=
+          GNUNET_DISK_file_test (cfg_fn)) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Unreadable configuration file `%s'. Exiting ...\n"),
+                  cfg_fn);
+      ret = GNUNET_SYSERR;
+      GNUNET_free (allopts);
+      GNUNET_free (lpfx);
+      goto cleanup;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Loading configuration from entry point `%s'\n",
+                cc.cfgfile);
+    if (GNUNET_SYSERR ==
+        GNUNET_CONFIGURATION_load (cfg,
+                                   cfg_fn))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Malformed configuration. Exiting ...\n"));
+      ret = GNUNET_SYSERR;
+      GNUNET_free (allopts);
+      GNUNET_free (lpfx);
+      goto cleanup;
+    }
+  }
+  GNUNET_free (allopts);
+  GNUNET_free (lpfx);
+  if ((GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_number (cc.cfg,
+                                              "testing",
+                                              "skew_offset",
+                                              &skew_offset)) &&
+      (GNUNET_OK ==
+       GNUNET_CONFIGURATION_get_value_number (cc.cfg,
+                                              "testing",
+                                              "skew_variance",
+                                              &skew_variance)))
+  {
+    clock_offset = skew_offset - skew_variance;
+    GNUNET_TIME_set_offset (clock_offset);
+  }
+  /* ARM needs to know which configuration file to use when starting
+     services.  If we got a command-line option *and* if nothing is
+     specified in the configuration, remember the command-line option
+     in "cfg".  This is typically really only having an effect if we
+     are running code in src/arm/, as obviously the rest of the code
+     has little business with ARM-specific options. */
+  if (GNUNET_YES !=
+      GNUNET_CONFIGURATION_have_value (cfg,
+                                       "arm",
+                                       "CONFIG"))
+  {
+    if (NULL != cc.cfgfile)
+      GNUNET_CONFIGURATION_set_value_string (cfg,
+                                             "arm",
+                                             "CONFIG",
+                                             cc.cfgfile);
+    else if (NULL != cfg_fn)
+      GNUNET_CONFIGURATION_set_value_string (cfg,
+                                             "arm",
+                                             "CONFIG",
+                                             cfg_fn);
+  }
+
+  /* run */
+  cc.args = &argv[iret];
+  if ((NULL == cc.cfgfile) && (NULL != cfg_fn))
+    cc.cfgfile = GNUNET_strdup (cfg_fn);
+  if (GNUNET_NO == run_without_scheduler)
+  {
+    GNUNET_SCHEDULER_run (&program_main, &cc);
+  }
+  else
+  {
+    GNUNET_RESOLVER_connect (cc.cfg);
+    cc.task (cc.task_cls, cc.args, cc.cfgfile, cc.cfg);
+  }
+  ret = GNUNET_OK;
+cleanup:
+  GNUNET_CONFIGURATION_destroy (cfg);
+  GNUNET_free (cc.cfgfile);
+  GNUNET_free (cfg_fn);
+  GNUNET_free (loglev);
+  GNUNET_free (logfile);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_PROGRAM_run (int argc,
+                    char *const *argv,
+                    const char *binaryName,
+                    const char *binaryHelp,
+                    const struct GNUNET_GETOPT_CommandLineOption *options,
+                    GNUNET_PROGRAM_Main task,
+                    void *task_cls)
+{
+  return GNUNET_PROGRAM_run2 (argc,
+                              argv,
+                              binaryName,
+                              binaryHelp,
+                              options,
+                              task,
+                              task_cls,
+                              GNUNET_NO);
+}
+
+
+/* A list of daemons to be launched when GNUNET_main()
+ * is called
+ */
+struct DaemonHandleList
+{
+  /* DLL */
+  struct DaemonHandleList *prev;
+
+  /* DLL */
+  struct DaemonHandleList *next;
+
+  /* Program to launch */
+  GNUNET_PROGRAM_Main d;
+};
+
+/* The daemon list */
+static struct DaemonHandleList *hll_head = NULL;
+
+/* The daemon list */
+static struct DaemonHandleList *hll_tail = NULL;
+
+enum GNUNET_GenericReturnValue
+GNUNET_DAEMON_register (const char *daemon_name,
+                        const char *daemon_help,
+                        GNUNET_PROGRAM_Main task)
+{
+  struct DaemonHandleList *hle;
+
+  hle = GNUNET_new (struct DaemonHandleList);
+  hle->d = task;
+  GNUNET_CONTAINER_DLL_insert (hll_head, hll_tail, hle);
+  return GNUNET_OK;
+}
+
+
+/* end of program.c */
diff --git a/src/lib/util/regex.c b/src/lib/util/regex.c
new file mode 100644
index 000000000..282d3aa99
--- /dev/null
+++ b/src/lib/util/regex.c
@@ -0,0 +1,804 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file src/tun/regex.c
+ * @brief functions to convert IP networks to regexes
+ * @author Maximilian Szengel
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * 'wildcard', matches all possible values (for HEX encoding).
+ */
+#define DOT "(0|1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"
+
+
+void
+GNUNET_TUN_ipv4toregexsearch (const struct in_addr *ip,
+                              uint16_t port,
+                              char *rxstr)
+{
+  GNUNET_snprintf (rxstr,
+                   GNUNET_TUN_IPV4_REGEXLEN,
+                   "4-%04X-%08X",
+                   (unsigned int) port,
+                   ntohl (ip->s_addr));
+}
+
+
+void
+GNUNET_TUN_ipv6toregexsearch (const struct in6_addr *ipv6,
+                              uint16_t port,
+                              char *rxstr)
+{
+  const uint32_t *addr;
+
+  addr = (const uint32_t *) ipv6;
+  GNUNET_snprintf (rxstr,
+                   GNUNET_TUN_IPV6_REGEXLEN,
+                   "6-%04X-%08X%08X%08X%08X",
+                   (unsigned int) port,
+                   ntohl (addr[0]),
+                   ntohl (addr[1]),
+                   ntohl (addr[2]),
+                   ntohl (addr[3]));
+}
+
+
+/**
+ * Convert the given 4-bit (!) number to a regex.
+ *
+ * @param value the value, only the lowest 4 bits will be looked at
+ * @param mask which bits in value are wildcards (any value)?
+ */
+static char *
+nibble_to_regex (uint8_t value,
+                 uint8_t mask)
+{
+  char *ret;
+
+  value &= mask;
+  switch (mask)
+  {
+  case 0:
+    return GNUNET_strdup (DOT);
+
+  case 8:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X|%X|%X|%X|%X|%X|%X)",
+                     value,
+                     value + 1,
+                     value + 2,
+                     value + 3,
+                     value + 4,
+                     value + 5,
+                     value + 6,
+                     value + 7);
+    return ret;
+
+  case 12:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X|%X|%X)",
+                     value,
+                     value + 1,
+                     value + 2,
+                     value + 3);
+    return ret;
+
+  case 14:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X)",
+                     value,
+                     value + 1);
+    return ret;
+
+  case 15:
+    GNUNET_asprintf (&ret,
+                     "%X",
+                     value);
+    return ret;
+
+  default:
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Bad mask: %d\n"),
+                mask);
+    GNUNET_break (0);
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert the given 16-bit number to a regex.
+ *
+ * @param value the value
+ * @param mask which bits in value are wildcards (any value)?
+ */
+static char *
+num_to_regex (uint16_t value,
+              uint16_t mask)
+{
+  const uint8_t *v = (const uint8_t *) &value;
+  const uint8_t *m = (const uint8_t *) &mask;
+  char *a;
+  char *b;
+  char *c;
+  char *d;
+  char *ret;
+
+  a = nibble_to_regex (v[0] >> 4, m[0] >> 4);
+  b = nibble_to_regex (v[0] & 15, m[0] & 15);
+  c = nibble_to_regex (v[1] >> 4, m[1] >> 4);
+  d = nibble_to_regex (v[1] & 15, m[1] & 15);
+  ret = NULL;
+  if ((NULL != a) &&
+      (NULL != b) &&
+      (NULL != c) &&
+      (NULL != d))
+    GNUNET_asprintf (&ret,
+                     "%s%s%s%s",
+                     a, b, c, d);
+  GNUNET_free (a);
+  GNUNET_free (b);
+  GNUNET_free (c);
+  GNUNET_free (d);
+  return ret;
+}
+
+
+/**
+ * Do we need to put parents around the given argument?
+ *
+ * @param arg part of a regular expression
+ * @return #GNUNET_YES if we should parens,
+ *         #GNUNET_NO if not
+ */
+static int
+needs_parens (const char *arg)
+{
+  size_t off;
+  size_t len;
+  unsigned int op;
+
+  op = 0;
+  len = strlen (arg);
+  for (off = 0; off < len; off++)
+  {
+    switch (arg[off])
+    {
+    case '(':
+      op++;
+      break;
+
+    case ')':
+      GNUNET_assert (op > 0);
+      op--;
+      break;
+
+    case '|':
+      if (0 == op)
+        return GNUNET_YES;
+      break;
+
+    default:
+      break;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Compute port policy for the given range of
+ * port numbers.
+ *
+ * @param start starting offset
+ * @param end end offset
+ * @param step increment level (power of 16)
+ * @param pp port policy to convert
+ * @return corresponding regex
+ */
+static char *
+compute_policy (unsigned int start,
+                unsigned int end,
+                unsigned int step,
+                const struct GNUNET_STRINGS_PortPolicy *pp)
+{
+  unsigned int i;
+  char before[36]; /* 16 * 2 + 3 dots + 0-terminator */
+  char middlel[33]; /* 16 * 2 + 0-terminator */
+  char middleh[33]; /* 16 * 2 + 0-terminator */
+  char after[36]; /* 16 * 2 + 3 dots + 0-terminator */
+  char beforep[36 + 2]; /* 16 * 2 + 3 dots + 0-terminator + ()*/
+  char middlehp[33 + 2]; /* 16 * 2 + 0-terminator + () */
+  char middlelp[33 + 2]; /* 16 * 2 + 0-terminator + () */
+  char afterp[36 + 2]; /* 16 * 2 + 3 dots + 0-terminator + () */
+  char dots[5 * strlen (DOT)];
+  char buf[3];
+  char *middle;
+  char *ret;
+  unsigned int xstep;
+  char *recl;
+  char *rech;
+  char *reclp;
+  char *rechp;
+  unsigned int start_port;
+  unsigned int end_port;
+
+  GNUNET_assert (GNUNET_YES == pp->negate_portrange);
+  start_port = pp->start_port;
+  if (1 == start_port)
+    start_port = 0;
+  end_port = pp->end_port;
+  GNUNET_assert ((end - start) / step <= 0xF);
+  before[0] = '\0';
+  middlel[0] = '\0';
+  middleh[0] = '\0';
+  after[0] = '\0';
+  for (i = start; i <= end; i += step)
+  {
+    GNUNET_snprintf (buf,
+                     sizeof(buf),
+                     "%X|",
+                     (i - start) / step);
+    if (i / step < start_port / step)
+      strcat (before, buf);
+    else if (i / step > end_port / step)
+      strcat (after, buf);
+    else if (i / step == start_port / step)
+      strcat (middlel, buf);
+    else if (i / step == end_port / step)
+      strcat (middleh, buf);
+  }
+  if (strlen (before) > 0)
+    before[strlen (before) - 1] = '\0';
+  if (strlen (middlel) > 0)
+    middlel[strlen (middlel) - 1] = '\0';
+  if (strlen (middleh) > 0)
+    middleh[strlen (middleh) - 1] = '\0';
+  if (strlen (after) > 0)
+    after[strlen (after) - 1] = '\0';
+  if (needs_parens (before))
+    GNUNET_snprintf (beforep,
+                     sizeof(beforep),
+                     "(%s)",
+                     before);
+  else
+    strcpy (beforep, before);
+  if (needs_parens (middlel))
+    GNUNET_snprintf (middlelp,
+                     sizeof(middlelp),
+                     "(%s)",
+                     middlel);
+  else
+    strcpy (middlelp, middlel);
+  if (needs_parens (middleh))
+    GNUNET_snprintf (middlehp,
+                     sizeof(middlehp),
+                     "(%s)",
+                     middleh);
+  else
+    strcpy (middlehp, middleh);
+  if (needs_parens (after))
+    GNUNET_snprintf (afterp,
+                     sizeof(afterp),
+                     "(%s)",
+                     after);
+  else
+    strcpy (afterp, after);
+  dots[0] = '\0';
+  for (xstep = step / 16; xstep > 0; xstep /= 16)
+    strcat (dots, DOT);
+  if (step >= 16)
+  {
+    if (strlen (middlel) > 0)
+      recl = compute_policy ((start_port / step) * step,
+                             (start_port / step) * step + step - 1,
+                             step / 16,
+                             pp);
+    else
+      recl = GNUNET_strdup ("");
+    if (strlen (middleh) > 0)
+      rech = compute_policy ((end_port / step) * step,
+                             (end_port / step) * step + step - 1,
+                             step / 16,
+                             pp);
+    else
+      rech = GNUNET_strdup ("");
+  }
+  else
+  {
+    recl = GNUNET_strdup ("");
+    rech = GNUNET_strdup ("");
+    middlel[0] = '\0';
+    middlelp[0] = '\0';
+    middleh[0] = '\0';
+    middlehp[0] = '\0';
+  }
+  if (needs_parens (recl))
+    GNUNET_asprintf (&reclp,
+                     "(%s)",
+                     recl);
+  else
+    reclp = GNUNET_strdup (recl);
+  if (needs_parens (rech))
+    GNUNET_asprintf (&rechp,
+                     "(%s)",
+                     rech);
+  else
+    rechp = GNUNET_strdup (rech);
+
+  if ((strlen (middleh) > 0) &&
+      (strlen (rech) > 0) &&
+      (strlen (middlel) > 0) &&
+      (strlen (recl) > 0))
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s|%s%s",
+                     middlel,
+                     reclp,
+                     middleh,
+                     rechp);
+  }
+  else if ((strlen (middleh) > 0) &&
+           (strlen (rech) > 0))
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s",
+                     middleh,
+                     rechp);
+  }
+  else if ((strlen (middlel) > 0) &&
+           (strlen (recl) > 0))
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s",
+                     middlel,
+                     reclp);
+  }
+  else
+  {
+    middle = GNUNET_strdup ("");
+  }
+  if ((strlen (before) > 0) &&
+      (strlen (after) > 0))
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s%s|%s|%s%s)",
+                         beforep, dots,
+                         middle,
+                         afterp, dots);
+      else
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)%s",
+                         beforep,
+                         afterp,
+                         dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s|%s)",
+                         before,
+                         middle,
+                         after);
+      else if (1 == step)
+        GNUNET_asprintf (&ret,
+                         "%s|%s",
+                         before,
+                         after);
+      else
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)",
+                         before,
+                         after);
+    }
+  }
+  else if (strlen (before) > 0)
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s%s|%s)",
+                         beforep, dots,
+                         middle);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s%s",
+                         beforep, dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)",
+                         before,
+                         middle);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s",
+                         before);
+    }
+  }
+  else if (strlen (after) > 0)
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s%s)",
+                         middle,
+                         afterp, dots);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s%s",
+                         afterp, dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "%s|%s",
+                         middle,
+                         after);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s",
+                         after);
+    }
+  }
+  else if (strlen (middle) > 0)
+  {
+    GNUNET_asprintf (&ret,
+                     "%s",
+                     middle);
+  }
+  else
+  {
+    ret = GNUNET_strdup ("");
+  }
+  GNUNET_free (middle);
+  GNUNET_free (reclp);
+  GNUNET_free (rechp);
+  GNUNET_free (recl);
+  GNUNET_free (rech);
+  return ret;
+}
+
+
+/**
+ * Convert a port policy to a regular expression.  Note: this is a
+ * very simplistic implementation, we might want to consider doing
+ * something more sophisiticated (resulting in smaller regular
+ * expressions) at a later time.
+ *
+ * @param pp port policy to convert
+ * @return NULL on error
+ */
+static char *
+port_to_regex (const struct GNUNET_STRINGS_PortPolicy *pp)
+{
+  char *reg;
+  char *ret;
+  char *pos;
+  unsigned int i;
+  unsigned int cnt;
+
+  if ((0 == pp->start_port) ||
+      ((1 == pp->start_port) &&
+       (0xFFFF == pp->end_port) &&
+       (GNUNET_NO == pp->negate_portrange)))
+    return GNUNET_strdup (DOT DOT DOT DOT);
+  if ((pp->start_port == pp->end_port) &&
+      (GNUNET_NO == pp->negate_portrange))
+  {
+    GNUNET_asprintf (&ret,
+                     "%04X",
+                     pp->start_port);
+    return ret;
+  }
+  if (pp->end_port < pp->start_port)
+    return NULL;
+
+  if (GNUNET_YES == pp->negate_portrange)
+  {
+    ret = compute_policy (0, 0xFFFF, 0x1000, pp);
+  }
+  else
+  {
+    cnt = pp->end_port - pp->start_port + 1;
+    reg = GNUNET_malloc (cnt * 5 + 1);
+    pos = reg;
+    for (i = 1; i <= 0xFFFF; i++)
+    {
+      if ((i >= pp->start_port) && (i <= pp->end_port))
+      {
+        if (pos == reg)
+        {
+          GNUNET_snprintf (pos,
+                           5,
+                           "%04X",
+                           i);
+        }
+        else
+        {
+          GNUNET_snprintf (pos,
+                           6,
+                           "|%04X",
+                           i);
+        }
+        pos += strlen (pos);
+      }
+    }
+    GNUNET_asprintf (&ret,
+                     "(%s)",
+                     reg);
+    GNUNET_free (reg);
+  }
+  return ret;
+}
+
+
+/**
+ * Convert an address (IPv4 or IPv6) to a regex.
+ *
+ * @param addr address
+ * @param mask network mask
+ * @param len number of bytes in @a addr and @a mask
+ * @return NULL on error, otherwise regex for the address
+ */
+static char *
+address_to_regex (const void *addr,
+                  const void *mask,
+                  size_t len)
+{
+  const uint16_t *a = addr;
+  const uint16_t *m = mask;
+  char *ret;
+  char *tmp;
+  char *reg;
+  unsigned int i;
+
+  ret = NULL;
+  GNUNET_assert (1 != (len % 2));
+  for (i = 0; i < len / 2; i++)
+  {
+    reg = num_to_regex (a[i], m[i]);
+    if (NULL == reg)
+    {
+      GNUNET_free (ret);
+      return NULL;
+    }
+    if (NULL == ret)
+    {
+      ret = reg;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s%s",
+                       ret, reg);
+      GNUNET_free (ret);
+      GNUNET_free (reg);
+      ret = tmp;
+    }
+  }
+  return ret;
+}
+
+
+/**
+ * Convert a single line of an IPv4 policy to a regular expression.
+ *
+ * @param v4 line to convert
+ * @return NULL on error
+ */
+static char *
+ipv4_to_regex (const struct GNUNET_STRINGS_IPv4NetworkPolicy *v4)
+{
+  char *reg;
+  char *pp;
+  char *ret;
+
+  reg = address_to_regex (&v4->network,
+                          &v4->netmask,
+                          sizeof(struct in_addr));
+  if (NULL == reg)
+    return NULL;
+  pp = port_to_regex (&v4->pp);
+  if (NULL == pp)
+  {
+    GNUNET_free (reg);
+    return NULL;
+  }
+  GNUNET_asprintf (&ret,
+                   "4-%s-%s",
+                   pp, reg);
+  GNUNET_free (pp);
+  GNUNET_free (reg);
+  return ret;
+}
+
+
+/**
+ * Convert a single line of an IPv4 policy to a regular expression.
+ *
+ * @param v6 line to convert
+ * @return NULL on error
+ */
+static char *
+ipv6_to_regex (const struct GNUNET_STRINGS_IPv6NetworkPolicy *v6)
+{
+  char *reg;
+  char *pp;
+  char *ret;
+
+  reg = address_to_regex (&v6->network,
+                          &v6->netmask,
+                          sizeof(struct in6_addr));
+  if (NULL == reg)
+    return NULL;
+  pp = port_to_regex (&v6->pp);
+  if (NULL == pp)
+  {
+    GNUNET_free (reg);
+    return NULL;
+  }
+  GNUNET_asprintf (&ret,
+                   "6-%s-%s",
+                   pp, reg);
+  GNUNET_free (pp);
+  GNUNET_free (reg);
+  return ret;
+}
+
+
+char *
+GNUNET_TUN_ipv4policy2regex (const char *policy)
+{
+  struct GNUNET_STRINGS_IPv4NetworkPolicy *np;
+  char *reg;
+  char *tmp;
+  char *line;
+  unsigned int i;
+
+  np = GNUNET_STRINGS_parse_ipv4_policy (policy);
+  if (NULL == np)
+    return NULL;
+  reg = NULL;
+  for (i = 0; (0 == i) || (0 != np[i].network.s_addr); i++)
+  {
+    line = ipv4_to_regex (&np[i]);
+    if (NULL == line)
+    {
+      GNUNET_free (reg);
+      GNUNET_free (np);
+      return NULL;
+    }
+    if (NULL == reg)
+    {
+      reg = line;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s|(%s)",
+                       reg, line);
+      GNUNET_free (reg);
+      GNUNET_free (line);
+      reg = tmp;
+    }
+    if (0 == np[i].network.s_addr)
+      break;
+  }
+  GNUNET_free (np);
+  return reg;
+}
+
+
+char *
+GNUNET_TUN_ipv6policy2regex (const char *policy)
+{
+  struct in6_addr zero;
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *np;
+  char *reg;
+  char *tmp;
+  char *line;
+  unsigned int i;
+
+  np = GNUNET_STRINGS_parse_ipv6_policy (policy);
+  if (NULL == np)
+    return NULL;
+  reg = NULL;
+  memset (&zero, 0, sizeof(struct in6_addr));
+  for (i = 0; (0 == i) || (0 != memcmp (&zero, &np[i].network, sizeof(struct
+                                                                      in6_addr)));
+       i++)
+  {
+    line = ipv6_to_regex (&np[i]);
+    if (NULL == line)
+    {
+      GNUNET_free (reg);
+      GNUNET_free (np);
+      return NULL;
+    }
+    if (NULL == reg)
+    {
+      reg = line;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s|(%s)",
+                       reg, line);
+      GNUNET_free (reg);
+      GNUNET_free (line);
+      reg = tmp;
+    }
+    if (0 == memcmp (&zero, &np[i].network, sizeof(struct in6_addr)))
+      break;
+  }
+  GNUNET_free (np);
+  return reg;
+}
+
+
+void
+GNUNET_TUN_service_name_to_hash (const char *service_name,
+                                 struct GNUNET_HashCode *hc)
+{
+  GNUNET_CRYPTO_hash (service_name,
+                      strlen (service_name),
+                      hc);
+}
+
+
+/**
+ * Compute the CADET port given a service descriptor
+ * (returned from #GNUNET_TUN_service_name_to_hash) and
+ * a TCP/UDP port @a ip_port.
+ *
+ * @param desc service shared secret
+ * @param ip_port TCP/UDP port, use 0 for ICMP
+ * @param[out] cadet_port CADET port to use
+ */
+void
+GNUNET_TUN_compute_service_cadet_port (const struct GNUNET_HashCode *desc,
+                                       uint16_t ip_port,
+                                       struct GNUNET_HashCode *cadet_port)
+{
+  uint16_t be_port = htons (ip_port);
+
+  *cadet_port = *desc;
+  GNUNET_memcpy (cadet_port,
+                 &be_port,
+                 sizeof(uint16_t));
+}
+
+
+/* end of regex.c */
diff --git a/src/lib/util/resolver.conf b/src/lib/util/resolver.conf
new file mode 100644
index 000000000..aae876952
--- /dev/null
+++ b/src/lib/util/resolver.conf
@@ -0,0 +1,20 @@
+[resolver]
+START_ON_DEMAND = YES
+#PORT = 2089
+HOSTNAME = localhost
+BINARY = gnunet-service-resolver
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-resolver.sock
+UNIX_MATCH_UID = NO
+UNIX_MATCH_GID = NO
+# DISABLE_SOCKET_FORWARDING = NO
+# USERNAME = 
+# MAXBUF =
+# TIMEOUT =
+# DISABLEV6 =
+# BINDTO =
+# REJECT_FROM =
+# REJECT_FROM6 =
+# PREFIX =
+
diff --git a/src/lib/util/resolver.h b/src/lib/util/resolver.h
new file mode 100644
index 000000000..e487f6e6f
--- /dev/null
+++ b/src/lib/util/resolver.h
@@ -0,0 +1,93 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/resolver.h
+ */
+#ifndef RESOLVER_H
+#define RESOLVER_H
+
+#include "gnunet_common.h"
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Request for the resolver.  Followed by either the "struct sockaddr"
+ * or the 0-terminated hostname.
+ *
+ * The response will be one or more messages of type
+ * RESOLVER_RESPONSE, each with the message header immediately
+ * followed by the requested data (0-terminated hostname or struct
+ * in[6]_addr, depending on direction).  The last RESOLVER_RESPONSE
+ * will just be a header without any data (used to indicate the end of
+ * the list).
+ */
+struct GNUNET_RESOLVER_GetMessage
+{
+  /**
+   * Type:  #GNUNET_MESSAGE_TYPE_RESOLVER_REQUEST
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * GNUNET_YES to get hostname from IP,
+   * GNUNET_NO to get IP from hostname.
+   */
+  int32_t direction GNUNET_PACKED;
+
+  /**
+   * Address family to use (AF_INET, AF_INET6 or AF_UNSPEC).
+   */
+  int32_t af GNUNET_PACKED;
+
+  /**
+   * identifies the request and is contained in the response message. The
+   * client has to match response to request by this identifier.
+   */
+  uint32_t client_id GNUNET_PACKED;
+
+  /* followed by 0-terminated string for A/AAAA-lookup or
+     by 'struct in_addr' / 'struct in6_addr' for reverse lookup */
+};
+
+
+struct GNUNET_RESOLVER_ResponseMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * identifies the request this message responds to. The client
+   * has to match response to request by this identifier.
+   */
+  uint32_t client_id GNUNET_PACKED;
+
+  /* followed by 0-terminated string for response to a reverse lookup
+   * or by 'struct in_addr' / 'struct in6_addr' for response to
+   * A/AAAA-lookup
+   */
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/lib/util/resolver_api.c b/src/lib/util/resolver_api.c
new file mode 100644
index 000000000..130363c77
--- /dev/null
+++ b/src/lib/util/resolver_api.c
@@ -0,0 +1,1295 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/resolver_api.c
+ * @brief resolver for writing a tool
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_resolver_service.h"
+#include "resolver.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-resolver-api", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) GNUNET_log_from_strerror (kind, \
+                                                              "util-resolver-api", \
+                                                              syscall)
+
+/**
+ * Maximum supported length for a hostname
+ */
+#define MAX_HOSTNAME 1024
+
+
+/**
+ * Possible hostnames for "loopback".
+ */
+static const char *loopback[] = {
+  "localhost",
+  "ip6-localnet",
+  NULL
+};
+
+
+/**
+ * Configuration.
+ */
+static const struct GNUNET_CONFIGURATION_Handle *resolver_cfg;
+
+/**
+ * Our connection to the resolver service, created on-demand, but then
+ * persists until error or shutdown.
+ */
+static struct GNUNET_MQ_Handle *mq;
+
+/**
+ * Head of DLL of requests.
+ */
+static struct GNUNET_RESOLVER_RequestHandle *req_head;
+
+/**
+ * Tail of DLL of requests.
+ */
+static struct GNUNET_RESOLVER_RequestHandle *req_tail;
+
+/**
+ * ID of the last request we sent to the service
+ */
+static uint32_t last_request_id;
+
+/**
+ * How long should we wait to reconnect?
+ */
+static struct GNUNET_TIME_Relative backoff;
+
+/**
+ * Task for reconnecting.
+ */
+static struct GNUNET_SCHEDULER_Task *r_task;
+
+/**
+ * Task ID of shutdown task; only present while we have a
+ * connection to the resolver service.
+ */
+static struct GNUNET_SCHEDULER_Task *s_task;
+
+
+/**
+ * Handle to a request given to the resolver.  Can be used to cancel
+ * the request prior to the timeout or successful execution.  Also
+ * used to track our internal state for the request.
+ */
+struct GNUNET_RESOLVER_RequestHandle
+{
+  /**
+   * Next entry in DLL of requests.
+   */
+  struct GNUNET_RESOLVER_RequestHandle *next;
+
+  /**
+   * Previous entry in DLL of requests.
+   */
+  struct GNUNET_RESOLVER_RequestHandle *prev;
+
+  /**
+   * Callback if this is an name resolution request,
+   * otherwise NULL.
+   */
+  GNUNET_RESOLVER_AddressCallback addr_callback;
+
+  /**
+   * Callback if this is a reverse lookup request,
+   * otherwise NULL.
+   */
+  GNUNET_RESOLVER_HostnameCallback name_callback;
+
+  /**
+   * Closure for the callbacks.
+   */
+  void *cls;
+
+  /**
+   * When should this request time out?
+   */
+  struct GNUNET_TIME_Absolute timeout;
+
+  /**
+   * Task handle for making reply callbacks in numeric lookups
+   * asynchronous, and for timeout handling.
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+
+  /**
+   * Desired address family.
+   */
+  int af;
+
+  /**
+   * Identifies the request. The response will contain this id.
+   */
+  uint32_t id;
+
+  /**
+   * Has this request been transmitted to the service?
+   * #GNUNET_YES if transmitted
+   * #GNUNET_NO if not transmitted
+   * #GNUNET_SYSERR when request was canceled
+   */
+  int was_transmitted;
+
+  /**
+   * Did we add this request to the queue?
+   */
+  int was_queued;
+
+  /**
+   * Desired direction (IP to name or name to IP)
+   */
+  int direction;
+
+  /**
+   * #GNUNET_YES if a response was received
+   */
+  int received_response;
+
+  /**
+   * Length of the data that follows this struct.
+   */
+  size_t data_len;
+};
+
+
+/**
+ * Check that the resolver service runs on localhost
+ * (or equivalent).
+ *
+ * @return #GNUNET_OK if the resolver is properly configured,
+ *         #GNUNET_SYSERR otherwise.
+ */
+static int
+check_config ()
+{
+  char *hostname;
+  struct sockaddr_in v4;
+  struct sockaddr_in6 v6;
+
+  if (GNUNET_OK ==
+      GNUNET_CONFIGURATION_have_value (resolver_cfg,
+                                       "resolver",
+                                       "UNIXPATH"))
+    return GNUNET_OK;
+  memset (&v4, 0, sizeof(v4));
+  v4.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
+  v4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v4.sin_len = sizeof(v4);
+#endif
+  memset (&v6, 0, sizeof(v6));
+  v6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v6.sin6_len = sizeof(v6);
+#endif
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (resolver_cfg,
+                                             "resolver",
+                                             "HOSTNAME",
+                                             &hostname))
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         _ (
+           "Missing `%s' for `%s' in configuration, DNS resolution will be unavailable.\n"),
+         "HOSTNAME",
+         "resolver");
+    return GNUNET_SYSERR;
+  }
+  if ((1 == inet_pton (AF_INET, hostname, &v4)) ||
+      (1 == inet_pton (AF_INET6, hostname, &v6)))
+  {
+    GNUNET_free (hostname);
+    return GNUNET_OK;
+  }
+  for (unsigned int i = 0;
+       NULL != loopback[i];
+       i++)
+    if (0 == strcasecmp (loopback[i],
+                         hostname))
+    {
+      GNUNET_free (hostname);
+      return GNUNET_OK;
+    }
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       _ (
+         "Missing `%s' or numeric IP address for `%s' of `%s' in configuration, DNS resolution will be unavailable.\n"),
+       "localhost",
+       "HOSTNAME",
+       "resolver");
+  GNUNET_free (hostname);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Create the connection to the resolver service.
+ *
+ * @param cfg configuration to use
+ */
+void
+GNUNET_RESOLVER_connect (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  GNUNET_assert (NULL != cfg);
+  backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+  resolver_cfg = cfg;
+}
+
+
+/**
+ * Destroy the connection to the resolver service.
+ */
+void
+GNUNET_RESOLVER_disconnect ()
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh;
+
+  while (NULL != (rh = req_head))
+  {
+    GNUNET_assert (GNUNET_SYSERR == rh->was_transmitted);
+    GNUNET_CONTAINER_DLL_remove (req_head,
+                                 req_tail,
+                                 rh);
+    GNUNET_free (rh);
+  }
+  if (NULL != mq)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Disconnecting from DNS service\n");
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+  }
+  if (NULL != r_task)
+  {
+    GNUNET_SCHEDULER_cancel (r_task);
+    r_task = NULL;
+  }
+  if (NULL != s_task)
+  {
+    GNUNET_SCHEDULER_cancel (s_task);
+    s_task = NULL;
+  }
+}
+
+
+/**
+ * Task executed on system shutdown.
+ */
+static void
+shutdown_task (void *cls)
+{
+  (void) cls;
+  s_task = NULL;
+  GNUNET_RESOLVER_disconnect ();
+  backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+}
+
+
+/**
+ * Consider disconnecting if we have no further requests pending.
+ */
+static void
+check_disconnect ()
+{
+  for (struct GNUNET_RESOLVER_RequestHandle *rh = req_head;
+       NULL != rh;
+       rh = rh->next)
+    if (GNUNET_SYSERR != rh->was_transmitted)
+      return;
+  if (NULL != r_task)
+  {
+    GNUNET_SCHEDULER_cancel (r_task);
+    r_task = NULL;
+  }
+  if (NULL != s_task)
+    return;
+  s_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
+                                         &shutdown_task,
+                                         NULL);
+}
+
+
+/**
+ * Convert IP address to string without DNS resolution.
+ *
+ * @param af address family
+ * @param ip the address
+ * @param ip_len number of bytes in @a ip
+ * @return address as a string, NULL on error
+ */
+static char *
+no_resolve (int af,
+            const void *ip,
+            socklen_t ip_len)
+{
+  char buf[INET6_ADDRSTRLEN];
+
+  switch (af)
+  {
+  case AF_INET:
+    if (ip_len != sizeof(struct in_addr))
+      return NULL;
+    if (NULL ==
+        inet_ntop (AF_INET,
+                   ip,
+                   buf,
+                   sizeof(buf)))
+    {
+      LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                    "inet_ntop");
+      return NULL;
+    }
+    break;
+
+  case AF_INET6:
+    if (ip_len != sizeof(struct in6_addr))
+      return NULL;
+    if (NULL ==
+        inet_ntop (AF_INET6,
+                   ip,
+                   buf,
+                   sizeof(buf)))
+    {
+      LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                    "inet_ntop");
+      return NULL;
+    }
+    break;
+
+  default:
+    GNUNET_break (0);
+    return NULL;
+  }
+  return GNUNET_strdup (buf);
+}
+
+
+/**
+ * Adjust exponential back-off and reconnect to the service.
+ */
+static void
+reconnect (void);
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls NULL
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  (void) cls;
+  GNUNET_MQ_destroy (mq);
+  mq = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "MQ error %d, reconnecting\n",
+       error);
+  reconnect ();
+}
+
+
+/**
+ * Process pending requests to the resolver.
+ */
+static void
+process_requests ()
+{
+  struct GNUNET_RESOLVER_GetMessage *msg;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_RESOLVER_RequestHandle *rh = req_head;
+
+  if (NULL == mq)
+  {
+    reconnect ();
+    return;
+  }
+  if (NULL == rh)
+  {
+    /* nothing to do, release socket really soon if there is nothing
+     * else happening... */
+    if (NULL == s_task)
+      s_task =
+        GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
+                                      &shutdown_task,
+                                      NULL);
+    return;
+  }
+  if (GNUNET_NO != rh->was_transmitted)
+    return;                     /* waiting for reply */
+  env = GNUNET_MQ_msg_extra (msg,
+                             rh->data_len,
+                             GNUNET_MESSAGE_TYPE_RESOLVER_REQUEST);
+  msg->direction = htonl (rh->direction);
+  msg->af = htonl (rh->af);
+  msg->client_id = rh->id;
+  GNUNET_memcpy (&msg[1],
+                 &rh[1],
+                 rh->data_len);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Transmitting DNS resolution request (ID %u) to DNS service\n",
+       rh->id);
+  GNUNET_MQ_send (mq,
+                  env);
+  rh->was_transmitted = GNUNET_YES;
+}
+
+
+/**
+ * Check validity of response with a hostname for a DNS lookup.
+ *
+ * @param cls NULL
+ * @param msg message with the hostname
+ */
+static int
+check_response (void *cls,
+                const struct GNUNET_RESOLVER_ResponseMessage *msg)
+{
+  (void) cls;
+  (void) msg;
+
+  /* implemented in #handle_response() for now */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Check validity of response with a hostname for a DNS lookup.
+ * NOTE: right now rather messy, might want to use different
+ * message types for different response formats in the future.
+ *
+ * @param cls NULL
+ * @param msg message with the response
+ */
+static void
+handle_response (void *cls,
+                 const struct GNUNET_RESOLVER_ResponseMessage *msg)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh = req_head;
+  uint16_t size;
+  char *nret;
+  uint32_t client_request_id = msg->client_id;
+
+  for (; rh != NULL; rh = rh->next)
+  {
+    if (rh->id == client_request_id)
+      break;
+  }
+
+  (void) cls;
+  if (NULL == rh)
+  {
+    /* Resolver service sent extra replies to query (after terminator)? Bad! */
+    GNUNET_break (0);
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+    reconnect ();
+    return;
+  }
+  size = ntohs (msg->header.size);
+  if (size == sizeof(struct GNUNET_RESOLVER_ResponseMessage))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Received empty response from DNS service\n");
+    /* message contains not data, just header; end of replies */
+    /* check if request was canceled */
+    if (GNUNET_SYSERR != rh->was_transmitted)
+    {
+      /* no reverse lookup was successful, return IP as string */
+      if (NULL != rh->name_callback)
+      {
+        if (GNUNET_NO == rh->received_response)
+        {
+          nret = no_resolve (rh->af,
+                             &rh[1],
+                             rh->data_len);
+          rh->name_callback (rh->cls, nret);
+          GNUNET_free (nret);
+        }
+        /* finally, make termination call */
+        if (GNUNET_SYSERR != rh->was_transmitted)
+          rh->name_callback (rh->cls,
+                             NULL);
+      }
+      if ((NULL != rh->addr_callback) &&
+          (GNUNET_SYSERR != rh->was_transmitted))
+        rh->addr_callback (rh->cls,
+                           NULL,
+                           0);
+    }
+    rh->was_transmitted = GNUNET_NO;
+    GNUNET_RESOLVER_request_cancel (rh);
+    process_requests ();
+    return;
+  }
+  /* return reverse lookup results to caller */
+  if (NULL != rh->name_callback)
+  {
+    const char *hostname;
+
+    hostname = (const char *) &msg[1];
+    if (hostname[size - sizeof(struct GNUNET_RESOLVER_ResponseMessage) - 1] !=
+        '\0')
+    {
+      GNUNET_break (0);
+      if (GNUNET_SYSERR != rh->was_transmitted)
+        rh->name_callback (rh->cls,
+                           NULL);
+      rh->was_transmitted = GNUNET_NO;
+      GNUNET_RESOLVER_request_cancel (rh);
+      GNUNET_MQ_destroy (mq);
+      mq = NULL;
+      reconnect ();
+      return;
+    }
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Resolver returns `%s' for IP `%s'.\n",
+         hostname,
+         GNUNET_a2s ((const void *) &rh[1],
+                     rh->data_len));
+    if (rh->was_transmitted != GNUNET_SYSERR)
+      rh->name_callback (rh->cls,
+                         hostname);
+    rh->received_response = GNUNET_YES;
+  }
+  /* return lookup results to caller */
+  if (NULL != rh->addr_callback)
+  {
+    struct sockaddr_in v4;
+    struct sockaddr_in6 v6;
+    const struct sockaddr *sa;
+    socklen_t salen;
+    const void *ip;
+    size_t ip_len;
+
+    ip = &msg[1];
+    ip_len = size - sizeof(struct GNUNET_RESOLVER_ResponseMessage);
+    if (ip_len == sizeof(struct in_addr))
+    {
+      memset (&v4, 0, sizeof(v4));
+      v4.sin_family = AF_INET;
+      v4.sin_addr = *(struct in_addr*) ip;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      v4.sin_len = sizeof(v4);
+#endif
+      salen = sizeof(v4);
+      sa = (const struct sockaddr *) &v4;
+    }
+    else if (ip_len == sizeof(struct in6_addr))
+    {
+      memset (&v6, 0, sizeof(v6));
+      v6.sin6_family = AF_INET6;
+      v6.sin6_addr = *(struct in6_addr*) ip;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      v6.sin6_len = sizeof(v6);
+#endif
+      salen = sizeof(v6);
+      sa = (const struct sockaddr *) &v6;
+    }
+    else
+    {
+      GNUNET_break (0);
+      if (GNUNET_SYSERR != rh->was_transmitted)
+        rh->addr_callback (rh->cls,
+                           NULL,
+                           0);
+      rh->was_transmitted = GNUNET_NO;
+      GNUNET_RESOLVER_request_cancel (rh);
+      GNUNET_MQ_destroy (mq);
+      mq = NULL;
+      reconnect ();
+      return;
+    }
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Received IP from DNS service\n");
+    if (GNUNET_SYSERR != rh->was_transmitted)
+      rh->addr_callback (rh->cls,
+                         sa,
+                         salen);
+  }
+}
+
+
+/**
+ * We've been asked to lookup the address for a hostname and were
+ * given a valid numeric string.  Perform the callbacks for the
+ * numeric addresses.
+ *
+ * @param cls `struct GNUNET_RESOLVER_RequestHandle` for the request
+ */
+static void
+numeric_resolution (void *cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh = cls;
+  struct sockaddr_in v4;
+  struct sockaddr_in6 v6;
+  const char *hostname;
+
+  rh->task = NULL;
+  memset (&v4, 0, sizeof(v4));
+  v4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v4.sin_len = sizeof(v4);
+#endif
+  memset (&v6, 0, sizeof(v6));
+  v6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v6.sin6_len = sizeof(v6);
+#endif
+  hostname = (const char *) &rh[1];
+  if (((rh->af == AF_UNSPEC) ||
+       (rh->af == AF_INET)) &&
+      (1 == inet_pton (AF_INET,
+                       hostname,
+                       &v4.sin_addr)))
+  {
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v4,
+                       sizeof(v4));
+    if ((rh->af == AF_UNSPEC) &&
+        (GNUNET_SYSERR != rh->was_transmitted) &&
+        (1 == inet_pton (AF_INET6,
+                         hostname,
+                         &v6.sin6_addr)))
+    {
+      /* this can happen on some systems IF "hostname" is "localhost" */
+      rh->addr_callback (rh->cls,
+                         (const struct sockaddr *) &v6,
+                         sizeof(v6));
+    }
+    if (GNUNET_SYSERR != rh->was_transmitted)
+      rh->addr_callback (rh->cls,
+                         NULL,
+                         0);
+    GNUNET_free (rh);
+    return;
+  }
+  if (((rh->af == AF_UNSPEC) ||
+       (rh->af == AF_INET6)) &&
+      (1 == inet_pton (AF_INET6,
+                       hostname,
+                       &v6.sin6_addr)))
+  {
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v6,
+                       sizeof(v6));
+    if (GNUNET_SYSERR != rh->was_transmitted)
+      rh->addr_callback (rh->cls,
+                         NULL,
+                         0);
+    GNUNET_free (rh);
+    return;
+  }
+  /* why are we here? this task should not have been scheduled! */
+  GNUNET_assert (0);
+  GNUNET_free (rh);
+}
+
+
+/**
+ * We've been asked to lookup the address for a hostname and were
+ * given a variant of "loopback".  Perform the callbacks for the
+ * respective loopback numeric addresses.
+ *
+ * @param cls `struct GNUNET_RESOLVER_RequestHandle` for the request
+ */
+static void
+loopback_resolution (void *cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh = cls;
+  struct sockaddr_in v4;
+  struct sockaddr_in6 v6;
+
+  rh->task = NULL;
+  memset (&v4, 0, sizeof(v4));
+  v4.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
+  v4.sin_family = AF_INET;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v4.sin_len = sizeof(v4);
+#endif
+  memset (&v6, 0, sizeof(v6));
+  v6.sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  v6.sin6_len = sizeof(v6);
+#endif
+  v6.sin6_addr = in6addr_loopback;
+  switch (rh->af)
+  {
+  case AF_INET:
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v4,
+                       sizeof(v4));
+    break;
+
+  case AF_INET6:
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v6,
+                       sizeof(v6));
+    break;
+
+  case AF_UNSPEC:
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v6,
+                       sizeof(v6));
+    rh->addr_callback (rh->cls,
+                       (const struct sockaddr *) &v4,
+                       sizeof(v4));
+
+    break;
+
+  default:
+    GNUNET_break (0);
+    break;
+  }
+  if (GNUNET_SYSERR != rh->was_transmitted)
+    rh->addr_callback (rh->cls,
+                       NULL,
+                       0);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Finished resolving hostname `%s'.\n",
+       (const char *) &rh[1]);
+  GNUNET_free (rh);
+}
+
+
+/**
+ * Now try to reconnect to the resolver service.
+ *
+ * @param cls NULL
+ */
+static void
+reconnect_task (void *cls)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (response,
+                           GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE,
+                           struct GNUNET_RESOLVER_ResponseMessage,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  (void) cls;
+  r_task = NULL;
+  if (NULL == req_head)
+    return;                     /* no work pending */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Trying to connect to DNS service\n");
+  mq = GNUNET_CLIENT_connect (resolver_cfg,
+                              "resolver",
+                              handlers,
+                              &mq_error_handler,
+                              NULL);
+  if (NULL == mq)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Failed to connect, will try again later\n");
+    reconnect ();
+    return;
+  }
+  process_requests ();
+}
+
+
+/**
+ * Adjust exponential back-off and reconnect to the service.
+ */
+static void
+reconnect ()
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh;
+
+  if (NULL != r_task)
+    return;
+  GNUNET_assert (NULL == mq);
+  if (NULL != (rh = req_head))
+  {
+    switch (rh->was_transmitted)
+    {
+    case GNUNET_NO:
+      /* nothing more to do */
+      break;
+
+    case GNUNET_YES:
+      /* disconnected, transmit again! */
+      rh->was_transmitted = GNUNET_NO;
+      break;
+
+    case GNUNET_SYSERR:
+      /* request was cancelled, remove entirely */
+      GNUNET_CONTAINER_DLL_remove (req_head,
+                                   req_tail,
+                                   rh);
+      GNUNET_free (rh);
+      check_disconnect ();
+      break;
+
+    default:
+      GNUNET_assert (0);
+      break;
+    }
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Will try to connect to DNS service in %s\n",
+       GNUNET_STRINGS_relative_time_to_string (backoff,
+                                               GNUNET_YES));
+  GNUNET_assert (NULL != resolver_cfg);
+  r_task = GNUNET_SCHEDULER_add_delayed (backoff,
+                                         &reconnect_task,
+                                         NULL);
+  backoff = GNUNET_TIME_STD_BACKOFF (backoff);
+}
+
+
+/**
+ * A DNS resolution timed out. Notify the application.
+ *
+ * @param cls the `struct GNUNET_RESOLVER_RequestHandle *`
+ */
+static void
+handle_lookup_timeout (void *cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh = cls;
+
+  rh->task = NULL;
+  if (GNUNET_NO == rh->direction)
+  {
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         _ ("Timeout trying to resolve hostname `%s'.\n"),
+         (const char *) &rh[1]);
+    if (NULL != rh->addr_callback)
+      rh->addr_callback (rh->cls,
+                         NULL,
+                         0);
+  }
+  else
+  {
+#if ! defined(GNUNET_CULL_LOGGING)
+    char buf[INET6_ADDRSTRLEN];
+
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         _ ("Timeout trying to resolve IP address `%s'.\n"),
+         inet_ntop (rh->af,
+                    (const void *) &rh[1],
+                    buf,
+                    sizeof(buf)));
+#endif
+    if (GNUNET_NO == rh->received_response)
+    {
+      char *nret;
+
+      nret = no_resolve (rh->af,
+                         &rh[1],
+                         rh->data_len);
+      if (NULL != rh->name_callback)
+        rh->name_callback (rh->cls, nret);
+      GNUNET_free (nret);
+    }
+    /* finally, make termination call */
+    if (NULL != rh->name_callback)
+      rh->name_callback (rh->cls,
+                         NULL);
+  }
+  rh->was_transmitted = GNUNET_NO;
+  GNUNET_RESOLVER_request_cancel (rh);
+  process_requests ();
+}
+
+
+/**
+ * Convert a string to one or more IP addresses.
+ *
+ * @param hostname the hostname to resolve
+ * @param af AF_INET or AF_INET6; use AF_UNSPEC for "any"
+ * @param callback function to call with addresses
+ * @param callback_cls closure for @a callback
+ * @param timeout how long to try resolving
+ * @return handle that can be used to cancel the request, NULL on error
+ */
+struct GNUNET_RESOLVER_RequestHandle *
+GNUNET_RESOLVER_ip_get (const char *hostname,
+                        int af,
+                        struct GNUNET_TIME_Relative timeout,
+                        GNUNET_RESOLVER_AddressCallback callback,
+                        void *callback_cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh;
+  size_t slen;
+  struct in_addr v4;
+  struct in6_addr v6;
+
+  slen = strlen (hostname) + 1;
+  if (slen + sizeof(struct GNUNET_RESOLVER_GetMessage) >=
+      GNUNET_MAX_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Trying to resolve hostname `%s'.\n",
+       hostname);
+  rh = GNUNET_malloc (sizeof(struct GNUNET_RESOLVER_RequestHandle) + slen);
+  rh->af = af;
+  rh->id = ++last_request_id;
+  rh->addr_callback = callback;
+  rh->cls = callback_cls;
+  GNUNET_memcpy (&rh[1],
+                 hostname,
+                 slen);
+  rh->data_len = slen;
+  rh->timeout = GNUNET_TIME_relative_to_absolute (timeout);
+  rh->direction = GNUNET_NO;
+  /* first, check if this is a numeric address */
+  if (((1 == inet_pton (AF_INET,
+                        hostname,
+                        &v4)) &&
+       ((af == AF_INET) ||
+        (af == AF_UNSPEC))) ||
+      ((1 == inet_pton (AF_INET6,
+                        hostname,
+                        &v6)) &&
+       ((af == AF_INET6) ||
+        (af == AF_UNSPEC))))
+  {
+    rh->task = GNUNET_SCHEDULER_add_now (&numeric_resolution,
+                                         rh);
+    return rh;
+  }
+  /* then, check if this is a loopback address */
+  for (unsigned int i = 0;
+       NULL != loopback[i];
+       i++)
+    if (0 == strcasecmp (loopback[i],
+                         hostname))
+    {
+      rh->task = GNUNET_SCHEDULER_add_now (&loopback_resolution,
+                                           rh);
+      return rh;
+    }
+  if (GNUNET_OK != check_config ())
+  {
+    GNUNET_free (rh);
+    return NULL;
+  }
+  rh->task = GNUNET_SCHEDULER_add_delayed (timeout,
+                                           &handle_lookup_timeout,
+                                           rh);
+  GNUNET_CONTAINER_DLL_insert_tail (req_head,
+                                    req_tail,
+                                    rh);
+  rh->was_queued = GNUNET_YES;
+  if (NULL != s_task)
+  {
+    GNUNET_SCHEDULER_cancel (s_task);
+    s_task = NULL;
+  }
+  process_requests ();
+  return rh;
+}
+
+
+/**
+ * We've been asked to convert an address to a string without
+ * a reverse lookup, either because the client asked for it
+ * or because the DNS lookup hit a timeout.  Do the numeric
+ * conversion and invoke the callback.
+ *
+ * @param cls `struct GNUNET_RESOLVER_RequestHandle` for the request
+ */
+static void
+numeric_reverse (void *cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh = cls;
+  char *result;
+
+  rh->task = NULL;
+  result = no_resolve (rh->af,
+                       &rh[1],
+                       rh->data_len);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Resolver returns `%s'.\n",
+       result);
+  if (NULL != result)
+  {
+    rh->name_callback (rh->cls,
+                       result);
+    GNUNET_free (result);
+  }
+  rh->name_callback (rh->cls,
+                     NULL);
+  if (NULL != rh->task)
+  {
+    GNUNET_SCHEDULER_cancel (rh->task);
+    rh->task = NULL;
+  }
+  GNUNET_free (rh);
+}
+
+
+/**
+ * Get an IP address as a string.
+ *
+ * @param sa host address
+ * @param salen length of host address in @a sa
+ * @param do_resolve use #GNUNET_NO to return numeric hostname
+ * @param timeout how long to try resolving
+ * @param callback function to call with hostnames
+ *        last callback is NULL when finished
+ * @param cls closure for @a callback
+ * @return handle that can be used to cancel the request
+ */
+struct GNUNET_RESOLVER_RequestHandle *
+GNUNET_RESOLVER_hostname_get (const struct sockaddr *sa,
+                              socklen_t salen,
+                              int do_resolve,
+                              struct GNUNET_TIME_Relative timeout,
+                              GNUNET_RESOLVER_HostnameCallback callback,
+                              void *cls)
+{
+  struct GNUNET_RESOLVER_RequestHandle *rh;
+  size_t ip_len;
+  const void *ip;
+
+  if (GNUNET_OK != check_config ())
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Resolver not configured correctly.\n"));
+    return NULL;
+  }
+
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (salen == sizeof(struct sockaddr_in));
+    ip_len = sizeof(struct in_addr);
+    ip = &((const struct sockaddr_in*) sa)->sin_addr;
+    break;
+
+  case AF_INET6:
+    GNUNET_assert (salen == sizeof(struct sockaddr_in6));
+    ip_len = sizeof(struct in6_addr);
+    ip = &((const struct sockaddr_in6*) sa)->sin6_addr;
+    break;
+
+  default:
+    GNUNET_break (0);
+    return NULL;
+  }
+  rh = GNUNET_malloc (sizeof(struct GNUNET_RESOLVER_RequestHandle) + salen);
+  rh->name_callback = callback;
+  rh->cls = cls;
+  rh->af = sa->sa_family;
+  rh->id = ++last_request_id;
+  rh->timeout = GNUNET_TIME_relative_to_absolute (timeout);
+  GNUNET_memcpy (&rh[1],
+                 ip,
+                 ip_len);
+  rh->data_len = ip_len;
+  rh->direction = GNUNET_YES;
+  rh->received_response = GNUNET_NO;
+  if (GNUNET_NO == do_resolve)
+  {
+    rh->task = GNUNET_SCHEDULER_add_now (&numeric_reverse,
+                                         rh);
+    return rh;
+  }
+  rh->task = GNUNET_SCHEDULER_add_delayed (timeout,
+                                           &handle_lookup_timeout,
+                                           rh);
+  GNUNET_CONTAINER_DLL_insert_tail (req_head,
+                                    req_tail,
+                                    rh);
+  rh->was_queued = GNUNET_YES;
+  if (NULL != s_task)
+  {
+    GNUNET_SCHEDULER_cancel (s_task);
+    s_task = NULL;
+  }
+  process_requests ();
+  return rh;
+}
+
+
+/**
+ * Get local fully qualified af name
+ *
+ * @return fqdn
+ */
+char *
+GNUNET_RESOLVER_local_fqdn_get ()
+{
+  char hostname[GNUNET_OS_get_hostname_max_length () + 1];
+
+  if (0 != gethostname (hostname,
+                        sizeof(hostname) - 1))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "gethostname");
+    return NULL;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Resolving our FQDN `%s'\n",
+       hostname);
+#if HAVE_GETADDRINFO
+  {
+    struct addrinfo *ai;
+    int ret;
+    char *rval;
+
+    if (0 != (ret = getaddrinfo (hostname,
+                                 NULL,
+                                 NULL,
+                                 &ai)))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Could not resolve our FQDN: %s\n"),
+           gai_strerror (ret));
+      return NULL;
+    }
+    if (NULL != ai->ai_canonname)
+      rval = GNUNET_strdup (ai->ai_canonname);
+    else
+      rval = GNUNET_strdup (hostname);
+    freeaddrinfo (ai);
+    return rval;
+  }
+#elif HAVE_GETHOSTBYNAME2
+  {
+    struct hostent *host;
+
+    host = gethostbyname2 (hostname,
+                           AF_INET);
+    if (NULL == host)
+      host = gethostbyname2 (hostname,
+                             AF_INET6);
+    if (NULL == host)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Could not resolve our FQDN: %s\n"),
+           hstrerror (h_errno));
+      return NULL;
+    }
+    return GNUNET_strdup (host->h_name);
+  }
+#elif HAVE_GETHOSTBYNAME
+  {
+    struct hostent *host;
+
+    host = gethostbyname (hostname);
+    if (NULL == host)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Could not resolve our FQDN: %s\n"),
+           hstrerror (h_errno));
+      return NULL;
+    }
+    return GNUNET_strdup (host->h_name);
+  }
+#else
+  /* fallback: just hope name is already FQDN */
+  return GNUNET_strdup (hostname);
+#endif
+}
+
+
+/**
+ * Looking our own hostname.
+ *
+ * @param af AF_INET or AF_INET6; use AF_UNSPEC for "any"
+ * @param timeout how long to try resolving
+ * @param callback function to call with addresses
+ * @param cls closure for @a callback
+ * @return handle that can be used to cancel the request, NULL on error
+ */
+struct GNUNET_RESOLVER_RequestHandle *
+GNUNET_RESOLVER_hostname_resolve (int af,
+                                  struct GNUNET_TIME_Relative timeout,
+                                  GNUNET_RESOLVER_AddressCallback callback,
+                                  void *cls)
+{
+  char hostname[GNUNET_OS_get_hostname_max_length () + 1];
+
+  if (0 != gethostname (hostname, sizeof(hostname) - 1))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "gethostname");
+    return NULL;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Resolving our hostname `%s'\n",
+       hostname);
+  return GNUNET_RESOLVER_ip_get (hostname,
+                                 af,
+                                 timeout,
+                                 callback,
+                                 cls);
+}
+
+
+/**
+ * Cancel a request that is still pending with the resolver.
+ * Note that a client MUST NOT cancel a request that has
+ * been completed (i.e, the callback has been called to
+ * signal timeout or the final result).
+ *
+ * @param rh handle of request to cancel
+ */
+void
+GNUNET_RESOLVER_request_cancel (struct GNUNET_RESOLVER_RequestHandle *rh)
+{
+  if (GNUNET_NO == rh->direction)
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Asked to cancel request to resolve hostname `%s'.\n",
+         (const char *) &rh[1]);
+  if (NULL != rh->task)
+  {
+    GNUNET_SCHEDULER_cancel (rh->task);
+    rh->task = NULL;
+  }
+  if (GNUNET_NO == rh->was_transmitted)
+  {
+    if (GNUNET_YES == rh->was_queued)
+      GNUNET_CONTAINER_DLL_remove (req_head,
+                                   req_tail,
+                                   rh);
+    GNUNET_free (rh);
+    check_disconnect ();
+    return;
+  }
+  GNUNET_assert (GNUNET_YES == rh->was_transmitted);
+  rh->was_transmitted = GNUNET_SYSERR;  /* mark as cancelled */
+  check_disconnect ();
+}
+
+
+/* end of resolver_api.c */
diff --git a/src/lib/util/scheduler.c b/src/lib/util/scheduler.c
new file mode 100644
index 000000000..038d2f6ac
--- /dev/null
+++ b/src/lib/util/scheduler.c
@@ -0,0 +1,2583 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2009-2017, 2022 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/scheduler.c
+ * @brief schedule computations using continuation passing style
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "disk.h"
+// DEBUG
+#include <inttypes.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-scheduler", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) GNUNET_log_from_strerror (kind, \
+                                                              "util-scheduler", \
+                                                              syscall)
+
+
+#if HAVE_EXECINFO_H
+#include "execinfo.h"
+
+/**
+ * Use lsof to generate file descriptor reports on select error?
+ * (turn off for stable releases).
+ */
+#define USE_LSOF GNUNET_NO
+
+/**
+ * Obtain trace information for all scheduler calls that schedule tasks.
+ */
+#define EXECINFO GNUNET_NO
+
+/**
+ * Check each file descriptor before adding
+ */
+#define DEBUG_FDS GNUNET_NO
+
+/**
+ * Depth of the traces collected via EXECINFO.
+ */
+#define MAX_TRACE_DEPTH 50
+#endif
+
+/**
+ * Should we figure out which tasks are delayed for a while
+ * before they are run? (Consider using in combination with EXECINFO).
+ */
+#define PROFILE_DELAYS GNUNET_NO
+
+/**
+ * Task that were in the queue for longer than this are reported if
+ * PROFILE_DELAYS is active.
+ */
+#define DELAY_THRESHOLD GNUNET_TIME_UNIT_SECONDS
+
+
+/**
+ * Argument to be passed from the driver to
+ * #GNUNET_SCHEDULER_do_work().  Contains the
+ * scheduler's internal state.
+ */
+struct GNUNET_SCHEDULER_Handle
+{
+  /**
+   * Passed here to avoid constantly allocating/deallocating
+   * this element, but generally we want to get rid of this.
+   * @deprecated
+   */
+  struct GNUNET_NETWORK_FDSet *rs;
+
+  /**
+   * Passed here to avoid constantly allocating/deallocating
+   * this element, but generally we want to get rid of this.
+   * @deprecated
+   */
+  struct GNUNET_NETWORK_FDSet *ws;
+
+  /**
+   * context of the SIGINT handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_int;
+
+  /**
+   * context of the SIGTERM handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_term;
+
+#if (SIGTERM != GNUNET_TERM_SIG)
+  /**
+   * context of the TERM_SIG handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_gterm;
+#endif
+
+  /**
+   * context of the SIGQUIT handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_quit;
+
+  /**
+   * context of the SIGHUP handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_hup;
+
+  /**
+   * context of the SIGPIPE handler
+   */
+  struct GNUNET_SIGNAL_Context *shc_pipe;
+};
+
+
+/**
+ * Entry in list of pending tasks.
+ */
+struct GNUNET_SCHEDULER_Task
+{
+  /**
+   * This is a linked list.
+   */
+  struct GNUNET_SCHEDULER_Task *next;
+
+  /**
+   * This is a linked list.
+   */
+  struct GNUNET_SCHEDULER_Task *prev;
+
+  /**
+   * Function to run when ready.
+   */
+  GNUNET_SCHEDULER_TaskCallback callback;
+
+  /**
+   * Closure for the @e callback.
+   */
+  void *callback_cls;
+
+  /**
+   * Information about which FDs are ready for this task (and why).
+   */
+  struct GNUNET_SCHEDULER_FdInfo *fds;
+
+  /**
+   * Storage location used for @e fds if we want to avoid
+   * a separate malloc() call in the common case that this
+   * task is only about a single FD.
+   */
+  struct GNUNET_SCHEDULER_FdInfo fdx;
+
+  /**
+   * Size of the @e fds array.
+   */
+  unsigned int fds_len;
+
+  /**
+   * Do we own the network and file handles referenced by the FdInfo
+   * structs in the fds array. This will only be GNUNET_YES if the
+   * task was created by the #GNUNET_SCHEDULER_add_select function.
+   */
+  int own_handles;
+
+  /**
+   * Absolute timeout value for the task, or
+   * #GNUNET_TIME_UNIT_FOREVER_ABS for "no timeout".
+   */
+  struct GNUNET_TIME_Absolute timeout;
+
+#if PROFILE_DELAYS
+  /**
+   * When was the task scheduled?
+   */
+  struct GNUNET_TIME_Absolute start_time;
+#endif
+
+  /**
+   * Why is the task ready?  Set after task is added to ready queue.
+   * Initially set to zero.  All reasons that have already been
+   * satisfied (e.g. read or write ready) will be set over time.
+   */
+  enum GNUNET_SCHEDULER_Reason reason;
+
+  /**
+   * Task priority.
+   */
+  enum GNUNET_SCHEDULER_Priority priority;
+
+  /**
+   * Set if we only wait for reading from a single FD, otherwise -1.
+   */
+  int read_fd;
+
+  /**
+   * Set if we only wait for writing to a single FD, otherwise -1.
+   */
+  int write_fd;
+
+  /**
+   * Should the existence of this task in the queue be counted as
+   * reason to not shutdown the scheduler?
+   */
+  int lifeness;
+
+  /**
+   * Is this task run on shutdown?
+   */
+  int on_shutdown;
+
+  /**
+   * Is this task in the ready list?
+   */
+  int in_ready_list;
+
+#if EXECINFO
+  /**
+   * Array of strings which make up a backtrace from the point when this
+   * task was scheduled (essentially, who scheduled the task?)
+   */
+  char **backtrace_strings;
+
+  /**
+   * Size of the backtrace_strings array
+   */
+  int num_backtrace_strings;
+#endif
+
+  /**
+   * Asynchronous scope of the task that scheduled this scope,
+   */
+  struct GNUNET_AsyncScopeSave scope;
+};
+
+/**
+ * Placed at the end of a ready queue to indicate where a scheduler run pass
+ * ends. The next, prev, in_ready_list and priority fields are the only ones
+ * that should be used.
+ */
+static struct GNUNET_SCHEDULER_Task pass_end_marker;
+
+
+/**
+ * A struct representing an event the select driver is waiting for
+ */
+struct Scheduled
+{
+  struct Scheduled *prev;
+
+  struct Scheduled *next;
+
+  /**
+   * the task, the event is related to
+   */
+  struct GNUNET_SCHEDULER_Task *task;
+
+  /**
+   * information about the network socket / file descriptor where
+   * the event is expected to occur
+   */
+  struct GNUNET_SCHEDULER_FdInfo *fdi;
+
+  /**
+   * the event types (multiple event types can be ORed) the select
+   * driver is expected to wait for
+   */
+  enum GNUNET_SCHEDULER_EventType et;
+};
+
+
+/**
+ * Driver context used by GNUNET_SCHEDULER_run
+ */
+struct DriverContext
+{
+  /**
+   * the head of a DLL containing information about the events the
+   * select driver is waiting for
+   */
+  struct Scheduled *scheduled_head;
+
+  /**
+   * the tail of a DLL containing information about the events the
+   * select driver is waiting for
+   */
+  struct Scheduled *scheduled_tail;
+
+  /**
+   * the time when the select driver will wake up again (after
+   * calling select)
+   */
+  struct GNUNET_TIME_Absolute timeout;
+};
+
+
+/**
+ * The driver used for the event loop. Will be handed over to
+ * the scheduler in #GNUNET_SCHEDULER_do_work(), persisted
+ * there in this variable for later use in functions like
+ * #GNUNET_SCHEDULER_add_select(), #add_without_sets() and
+ * #GNUNET_SCHEDULER_cancel().
+ */
+static const struct GNUNET_SCHEDULER_Driver *scheduler_driver;
+
+/**
+ * Head of list of tasks waiting for an event.
+ */
+static struct GNUNET_SCHEDULER_Task *pending_head;
+
+/**
+ * Tail of list of tasks waiting for an event.
+ */
+static struct GNUNET_SCHEDULER_Task *pending_tail;
+
+/**
+ * Head of list of tasks waiting for shutdown.
+ */
+static struct GNUNET_SCHEDULER_Task *shutdown_head;
+
+/**
+ * Tail of list of tasks waiting for shutdown.
+ */
+static struct GNUNET_SCHEDULER_Task *shutdown_tail;
+
+/**
+ * List of tasks waiting ONLY for a timeout event.
+ * Sorted by timeout (earliest first).  Used so that
+ * we do not traverse the list of these tasks when
+ * building select sets (we just look at the head
+ * to determine the respective timeout ONCE).
+ */
+static struct GNUNET_SCHEDULER_Task *pending_timeout_head;
+
+/**
+ * List of tasks waiting ONLY for a timeout event.
+ * Sorted by timeout (earliest first).  Used so that
+ * we do not traverse the list of these tasks when
+ * building select sets (we just look at the head
+ * to determine the respective timeout ONCE).
+ */
+static struct GNUNET_SCHEDULER_Task *pending_timeout_tail;
+
+/**
+ * Last inserted task waiting ONLY for a timeout event.
+ * Used to (heuristically) speed up insertion.
+ */
+static struct GNUNET_SCHEDULER_Task *pending_timeout_last;
+
+/**
+ * ID of the task that is running right now.
+ */
+static struct GNUNET_SCHEDULER_Task *active_task;
+
+/**
+ * Head of list of tasks ready to run right now, grouped by importance.
+ */
+static struct
+GNUNET_SCHEDULER_Task *ready_head[GNUNET_SCHEDULER_PRIORITY_COUNT];
+
+/**
+ * Tail of list of tasks ready to run right now, grouped by importance.
+ */
+static struct
+GNUNET_SCHEDULER_Task *ready_tail[GNUNET_SCHEDULER_PRIORITY_COUNT];
+
+/**
+ * Task for installing parent control handlers (it might happen that the
+ * scheduler is shutdown before this task is executed, so
+ * GNUNET_SCHEDULER_shutdown must cancel it in that case)
+ */
+static struct GNUNET_SCHEDULER_Task *install_parent_control_task;
+
+/**
+ * Task for reading from a pipe that signal handlers will use to initiate
+ * shutdown
+ */
+static struct GNUNET_SCHEDULER_Task *shutdown_pipe_task;
+
+/**
+ * Number of tasks on the ready list.
+ */
+static unsigned int ready_count;
+
+/**
+ * Priority of the task running right now.  Only
+ * valid while a task is running.
+ */
+static enum GNUNET_SCHEDULER_Priority current_priority;
+
+/**
+ * Priority of the highest task added in the current select
+ * iteration.
+ */
+static enum GNUNET_SCHEDULER_Priority max_priority_added;
+
+/**
+ * Value of the 'lifeness' flag for the current task.
+ */
+static int current_lifeness;
+
+/**
+ * Priority used currently in #GNUNET_SCHEDULER_do_work().
+ */
+static enum GNUNET_SCHEDULER_Priority work_priority;
+
+/**
+ * Function to use as a select() in the scheduler.
+ * If NULL, we use GNUNET_NETWORK_socket_select().
+ */
+static GNUNET_SCHEDULER_select scheduler_select;
+
+/**
+ * Task context of the current task.
+ */
+static struct GNUNET_SCHEDULER_TaskContext tc;
+
+/**
+ * Closure for #scheduler_select.
+ */
+static void *scheduler_select_cls;
+
+
+/**
+ * Sets the select function to use in the scheduler (scheduler_select).
+ *
+ * @param new_select new select function to use
+ * @param new_select_cls closure for @a new_select
+ * @return previously used select function, NULL for default
+ */
+void
+GNUNET_SCHEDULER_set_select (GNUNET_SCHEDULER_select new_select,
+                             void *new_select_cls)
+{
+  scheduler_select = new_select;
+  scheduler_select_cls = new_select_cls;
+}
+
+
+/**
+ * Check that the given priority is legal (and return it).
+ *
+ * @param p priority value to check
+ * @return p on success, 0 on error
+ */
+static enum GNUNET_SCHEDULER_Priority
+check_priority (enum GNUNET_SCHEDULER_Priority p)
+{
+  if ((p >= 0) && (p < GNUNET_SCHEDULER_PRIORITY_COUNT))
+    return p;
+  GNUNET_assert (0);
+  return 0;                     /* make compiler happy */
+}
+
+
+/**
+ * chooses the nearest timeout from all pending tasks, to be used
+ * to tell the driver the next wakeup time (using its set_wakeup
+ * callback)
+ */
+struct GNUNET_TIME_Absolute
+get_timeout ()
+{
+  struct GNUNET_SCHEDULER_Task *pos;
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute timeout;
+
+  pos = pending_timeout_head;
+  now = GNUNET_TIME_absolute_get ();
+  timeout = GNUNET_TIME_UNIT_FOREVER_ABS;
+  if (NULL != pos)
+  {
+    if (0 != pos->reason)
+    {
+      return now;
+    }
+    else
+    {
+      timeout = pos->timeout;
+    }
+  }
+  for (pos = pending_head; NULL != pos; pos = pos->next)
+  {
+    if (0 != pos->reason)
+    {
+      return now;
+    }
+    else if ((pos->timeout.abs_value_us !=
+              GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us) &&
+             (timeout.abs_value_us > pos->timeout.abs_value_us))
+    {
+      timeout = pos->timeout;
+    }
+  }
+  return timeout;
+}
+
+
+static void
+remove_pass_end_marker ()
+{
+  if (pass_end_marker.in_ready_list)
+  {
+    GNUNET_CONTAINER_DLL_remove (ready_head[pass_end_marker.priority],
+                                 ready_tail[pass_end_marker.priority],
+                                 &pass_end_marker);
+    pass_end_marker.in_ready_list = GNUNET_NO;
+  }
+}
+
+
+static void
+set_work_priority (enum GNUNET_SCHEDULER_Priority p)
+{
+  remove_pass_end_marker ();
+  GNUNET_CONTAINER_DLL_insert_tail (ready_head[p],
+                                    ready_tail[p],
+                                    &pass_end_marker);
+  pass_end_marker.priority = p;
+  pass_end_marker.in_ready_list = GNUNET_YES;
+  work_priority = p;
+}
+
+
+/**
+ * Put a task that is ready for execution into the ready queue.
+ *
+ * @param task task ready for execution
+ */
+static void
+queue_ready_task (struct GNUNET_SCHEDULER_Task *task)
+{
+  enum GNUNET_SCHEDULER_Priority p = check_priority (task->priority);
+
+  GNUNET_CONTAINER_DLL_insert_tail (ready_head[p],
+                                    ready_tail[p],
+                                    task);
+  if (p > work_priority)
+    set_work_priority (p);
+  task->in_ready_list = GNUNET_YES;
+  ready_count++;
+}
+
+
+/**
+ * Request the shutdown of a scheduler.  Marks all tasks
+ * awaiting shutdown as ready. Note that tasks
+ * scheduled with #GNUNET_SCHEDULER_add_shutdown() AFTER this call
+ * will be delayed until the next shutdown signal.
+ */
+void
+GNUNET_SCHEDULER_shutdown ()
+{
+  struct GNUNET_SCHEDULER_Task *pos;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "GNUNET_SCHEDULER_shutdown\n");
+  if (NULL != install_parent_control_task)
+  {
+    GNUNET_SCHEDULER_cancel (install_parent_control_task);
+    install_parent_control_task = NULL;
+  }
+  if (NULL != shutdown_pipe_task)
+  {
+    GNUNET_SCHEDULER_cancel (shutdown_pipe_task);
+    shutdown_pipe_task = NULL;
+  }
+  while (NULL != (pos = shutdown_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (shutdown_head,
+                                 shutdown_tail,
+                                 pos);
+    pos->reason |= GNUNET_SCHEDULER_REASON_SHUTDOWN;
+    queue_ready_task (pos);
+  }
+}
+
+
+/**
+ * Output stack trace of task @a t.
+ *
+ * @param t task to dump stack trace of
+ */
+static void
+dump_backtrace (struct GNUNET_SCHEDULER_Task *t)
+{
+#if EXECINFO
+  for (unsigned int i = 0; i < t->num_backtrace_strings; i++)
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Task %p trace %u: %s\n",
+         t,
+         i,
+         t->backtrace_strings[i]);
+#else
+  (void) t;
+#endif
+}
+
+
+/**
+ * Destroy a task (release associated resources)
+ *
+ * @param t task to destroy
+ */
+static void
+destroy_task (struct GNUNET_SCHEDULER_Task *t)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "destroying task %p\n",
+       t);
+
+  if (GNUNET_YES == t->own_handles)
+  {
+    for (unsigned int i = 0; i != t->fds_len; ++i)
+    {
+      const struct GNUNET_NETWORK_Handle *fd = t->fds[i].fd;
+      const struct GNUNET_DISK_FileHandle *fh = t->fds[i].fh;
+      if (fd)
+      {
+        GNUNET_NETWORK_socket_free_memory_only_ (
+          (struct GNUNET_NETWORK_Handle *) fd);
+      }
+      if (fh)
+      {
+        // FIXME: on WIN32 this is not enough! A function
+        // GNUNET_DISK_file_free_memory_only would be nice
+        GNUNET_free_nz ((void *) fh);
+      }
+    }
+  }
+  if (t->fds_len > 1)
+  {
+    GNUNET_array_grow (t->fds, t->fds_len, 0);
+  }
+#if EXECINFO
+  GNUNET_free (t->backtrace_strings);
+#endif
+  GNUNET_free (t);
+}
+
+
+/**
+ * Pipe used to communicate shutdown via signal.
+ */
+static struct GNUNET_DISK_PipeHandle *shutdown_pipe_handle;
+
+/**
+ * Process ID of this process at the time we installed the various
+ * signal handlers.
+ */
+static pid_t my_pid;
+
+/**
+ * Signal handler called for SIGPIPE.
+ */
+static void
+sighandler_pipe ()
+{
+  return;
+}
+
+
+/**
+ * Signal handler called for signals that should cause us to shutdown.
+ */
+static void
+sighandler_shutdown (void)
+{
+  static char c;
+  int old_errno = errno;        /* backup errno */
+
+  if (getpid () != my_pid)
+    _exit (1);                   /* we have fork'ed since the signal handler was created,
+                                  * ignore the signal, see https://gnunet.org/vfork discussion */
+  GNUNET_DISK_file_write (GNUNET_DISK_pipe_handle (
+                            shutdown_pipe_handle,
+                            GNUNET_DISK_PIPE_END_WRITE),
+                          &c, sizeof(c));
+  errno = old_errno;
+}
+
+
+static void
+shutdown_if_no_lifeness (void)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+
+  if (ready_count > 0)
+    return;
+  for (t = pending_head; NULL != t; t = t->next)
+    if (GNUNET_YES == t->lifeness)
+      return;
+  for (t = shutdown_head; NULL != t; t = t->next)
+    if (GNUNET_YES == t->lifeness)
+      return;
+  for (t = pending_timeout_head; NULL != t; t = t->next)
+    if (GNUNET_YES == t->lifeness)
+      return;
+  /* No lifeness! */
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static enum GNUNET_GenericReturnValue
+select_loop (struct GNUNET_SCHEDULER_Handle *sh,
+             struct DriverContext *context);
+
+
+void
+GNUNET_SCHEDULER_run (GNUNET_SCHEDULER_TaskCallback task,
+                      void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Handle *sh;
+  struct GNUNET_SCHEDULER_Driver *driver;
+  struct DriverContext context = {
+    .scheduled_head = NULL,
+    .scheduled_tail = NULL,
+    .timeout = GNUNET_TIME_absolute_get ()
+  };
+
+  driver = GNUNET_SCHEDULER_driver_select ();
+  driver->cls = &context;
+  sh = GNUNET_SCHEDULER_driver_init (driver);
+  GNUNET_SCHEDULER_add_with_reason_and_priority (task,
+                                                 task_cls,
+                                                 GNUNET_SCHEDULER_REASON_STARTUP,
+                                                 GNUNET_SCHEDULER_PRIORITY_DEFAULT);
+  GNUNET_break (GNUNET_OK ==
+                select_loop (sh,
+                             &context));
+  GNUNET_SCHEDULER_driver_done (sh);
+  GNUNET_free (driver);
+}
+
+
+/**
+ * Obtain the task context, giving the reason why the current task was
+ * started.
+ *
+ * @return current tasks' scheduler context
+ */
+const struct GNUNET_SCHEDULER_TaskContext *
+GNUNET_SCHEDULER_get_task_context ()
+{
+  GNUNET_assert (NULL != active_task);
+  return &tc;
+}
+
+
+/**
+ * Get information about the current load of this scheduler.  Use this
+ * function to determine if an elective task should be added or simply
+ * dropped (if the decision should be made based on the number of
+ * tasks ready to run).
+ *
+ * @param p priority level to look at
+ * @return number of tasks pending right now
+ */
+unsigned int
+GNUNET_SCHEDULER_get_load (enum GNUNET_SCHEDULER_Priority p)
+{
+  unsigned int ret;
+
+  GNUNET_assert (NULL != active_task);
+  if (p == GNUNET_SCHEDULER_PRIORITY_COUNT)
+    return ready_count;
+  if (p == GNUNET_SCHEDULER_PRIORITY_KEEP)
+    p = current_priority;
+  ret = 0;
+  for (struct GNUNET_SCHEDULER_Task *pos = ready_head[check_priority (p)];
+       NULL != pos;
+       pos = pos->next)
+    ret++;
+  if (pass_end_marker.in_ready_list && pass_end_marker.priority == p)
+    // Don't count the dummy marker
+    ret--;
+  return ret;
+}
+
+
+void
+init_fd_info (struct GNUNET_SCHEDULER_Task *t,
+              const struct GNUNET_NETWORK_Handle *const *read_nh,
+              unsigned int read_nh_len,
+              const struct GNUNET_NETWORK_Handle *const *write_nh,
+              unsigned int write_nh_len,
+              const struct GNUNET_DISK_FileHandle *const *read_fh,
+              unsigned int read_fh_len,
+              const struct GNUNET_DISK_FileHandle *const *write_fh,
+              unsigned int write_fh_len)
+{
+  // FIXME: if we have exactly two network handles / exactly two file handles
+  // and they are equal, we can make one FdInfo with both
+  // GNUNET_SCHEDULER_ET_IN and GNUNET_SCHEDULER_ET_OUT set.
+  struct GNUNET_SCHEDULER_FdInfo *fdi;
+
+  t->fds_len = read_nh_len + write_nh_len + read_fh_len + write_fh_len;
+  if (1 == t->fds_len)
+  {
+    fdi = &t->fdx;
+    t->fds = fdi;
+    if (1 == read_nh_len)
+    {
+      GNUNET_assert (NULL != read_nh);
+      GNUNET_assert (NULL != *read_nh);
+      fdi->fd = *read_nh;
+      fdi->et = GNUNET_SCHEDULER_ET_IN;
+      fdi->sock = GNUNET_NETWORK_get_fd (*read_nh);
+      t->read_fd = fdi->sock;
+      t->write_fd = -1;
+    }
+    else if (1 == write_nh_len)
+    {
+      GNUNET_assert (NULL != write_nh);
+      GNUNET_assert (NULL != *write_nh);
+      fdi->fd = *write_nh;
+      fdi->et = GNUNET_SCHEDULER_ET_OUT;
+      fdi->sock = GNUNET_NETWORK_get_fd (*write_nh);
+      t->read_fd = -1;
+      t->write_fd = fdi->sock;
+    }
+    else if (1 == read_fh_len)
+    {
+      GNUNET_assert (NULL != read_fh);
+      GNUNET_assert (NULL != *read_fh);
+      fdi->fh = *read_fh;
+      fdi->et = GNUNET_SCHEDULER_ET_IN;
+      fdi->sock = (*read_fh)->fd;     // FIXME: does not work under WIN32
+      t->read_fd = fdi->sock;
+      t->write_fd = -1;
+    }
+    else
+    {
+      GNUNET_assert (NULL != write_fh);
+      GNUNET_assert (NULL != *write_fh);
+      fdi->fh = *write_fh;
+      fdi->et = GNUNET_SCHEDULER_ET_OUT;
+      fdi->sock = (*write_fh)->fd;     // FIXME: does not work under WIN32
+      t->read_fd = -1;
+      t->write_fd = fdi->sock;
+    }
+  }
+  else
+  {
+    fdi = GNUNET_new_array (t->fds_len, struct GNUNET_SCHEDULER_FdInfo);
+    t->fds = fdi;
+    t->read_fd = -1;
+    t->write_fd = -1;
+    unsigned int i;
+    for (i = 0; i != read_nh_len; ++i)
+    {
+      fdi->fd = read_nh[i];
+      GNUNET_assert (NULL != fdi->fd);
+      fdi->et = GNUNET_SCHEDULER_ET_IN;
+      fdi->sock = GNUNET_NETWORK_get_fd (read_nh[i]);
+      ++fdi;
+    }
+    for (i = 0; i != write_nh_len; ++i)
+    {
+      fdi->fd = write_nh[i];
+      GNUNET_assert (NULL != fdi->fd);
+      fdi->et = GNUNET_SCHEDULER_ET_OUT;
+      fdi->sock = GNUNET_NETWORK_get_fd (write_nh[i]);
+      ++fdi;
+    }
+    for (i = 0; i != read_fh_len; ++i)
+    {
+      fdi->fh = read_fh[i];
+      GNUNET_assert (NULL != fdi->fh);
+      fdi->et = GNUNET_SCHEDULER_ET_IN;
+      fdi->sock = (read_fh[i])->fd;     // FIXME: does not work under WIN32
+      ++fdi;
+    }
+    for (i = 0; i != write_fh_len; ++i)
+    {
+      fdi->fh = write_fh[i];
+      GNUNET_assert (NULL != fdi->fh);
+      fdi->et = GNUNET_SCHEDULER_ET_OUT;
+      fdi->sock = (write_fh[i])->fd;     // FIXME: does not work under WIN32
+      ++fdi;
+    }
+  }
+}
+
+
+/**
+ * calls the given function @a func on each FdInfo related to @a t.
+ * Optionally updates the event type field in each FdInfo after calling
+ * @a func.
+ *
+ * @param t the task
+ * @param driver_func the function to call with each FdInfo contained in
+ *                    in @a t
+ * @param if_not_ready only call @a driver_func on FdInfos that are not
+ *                     ready
+ * @param et the event type to be set in each FdInfo after calling
+ *           @a driver_func on it, or -1 if no updating not desired.
+ */
+static void
+driver_add_multiple (struct GNUNET_SCHEDULER_Task *t)
+{
+  struct GNUNET_SCHEDULER_FdInfo *fdi;
+  int success = GNUNET_YES;
+
+  for (unsigned int i = 0; i != t->fds_len; ++i)
+  {
+    fdi = &t->fds[i];
+    success = scheduler_driver->add (scheduler_driver->cls,
+                                     t,
+                                     fdi) && success;
+    fdi->et = GNUNET_SCHEDULER_ET_NONE;
+  }
+  if (GNUNET_YES != success)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "driver could not add task\n");
+  }
+}
+
+
+static void
+install_parent_control_handler (void *cls)
+{
+  (void) cls;
+  install_parent_control_task = NULL;
+  GNUNET_OS_install_parent_control_handler (NULL);
+}
+
+
+static void
+shutdown_pipe_cb (void *cls)
+{
+  char c;
+  const struct GNUNET_DISK_FileHandle *pr;
+
+  (void) cls;
+  shutdown_pipe_task = NULL;
+  pr = GNUNET_DISK_pipe_handle (shutdown_pipe_handle,
+                                GNUNET_DISK_PIPE_END_READ);
+  GNUNET_assert (! GNUNET_DISK_handle_invalid (pr));
+  /* consume the signal */
+  GNUNET_DISK_file_read (pr, &c, sizeof(c));
+  /* mark all active tasks as ready due to shutdown */
+  GNUNET_SCHEDULER_shutdown ();
+  shutdown_pipe_task =
+    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                    pr,
+                                    &shutdown_pipe_cb,
+                                    NULL);
+}
+
+
+/**
+ * Cancel the task with the specified identifier.
+ * The task must not yet have run. Only allowed to be called as long as the
+ * scheduler is running, that is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param task id of the task to cancel
+ * @return original closure of the task
+ */
+void *
+GNUNET_SCHEDULER_cancel (struct GNUNET_SCHEDULER_Task *task)
+{
+  enum GNUNET_SCHEDULER_Priority p;
+  int is_fd_task;
+  void *ret;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "canceling task %p\n",
+       task);
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  is_fd_task = (NULL != task->fds);
+  if (is_fd_task)
+  {
+    int del_result = scheduler_driver->del (scheduler_driver->cls, task);
+    if (GNUNET_OK != del_result)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "driver could not delete task\n");
+      GNUNET_assert (0);
+    }
+  }
+  if (! task->in_ready_list)
+  {
+    if (is_fd_task)
+    {
+      GNUNET_CONTAINER_DLL_remove (pending_head,
+                                   pending_tail,
+                                   task);
+    }
+    else if (GNUNET_YES == task->on_shutdown)
+    {
+      GNUNET_CONTAINER_DLL_remove (shutdown_head,
+                                   shutdown_tail,
+                                   task);
+    }
+    else
+    {
+      GNUNET_CONTAINER_DLL_remove (pending_timeout_head,
+                                   pending_timeout_tail,
+                                   task);
+      if (pending_timeout_last == task)
+        pending_timeout_last = NULL;
+    }
+  }
+  else
+  {
+    p = check_priority (task->priority);
+    GNUNET_CONTAINER_DLL_remove (ready_head[p],
+                                 ready_tail[p],
+                                 task);
+    ready_count--;
+  }
+  ret = task->callback_cls;
+  destroy_task (task);
+  return ret;
+}
+
+
+/**
+ * Initialize backtrace data for task @a t
+ *
+ * @param t task to initialize
+ */
+static void
+init_backtrace (struct GNUNET_SCHEDULER_Task *t)
+{
+#if EXECINFO
+  void *backtrace_array[MAX_TRACE_DEPTH];
+
+  t->num_backtrace_strings
+    = backtrace (backtrace_array, MAX_TRACE_DEPTH);
+  t->backtrace_strings =
+    backtrace_symbols (backtrace_array,
+                       t->num_backtrace_strings);
+  dump_backtrace (t);
+#else
+  (void) t;
+#endif
+}
+
+
+/**
+ * Continue the current execution with the given function.  This is
+ * similar to the other "add" functions except that there is no delay
+ * and the reason code can be specified.
+ *
+ * @param task main function of the task
+ * @param task_cls closure for @a task
+ * @param reason reason for task invocation
+ * @param priority priority to use for the task
+ */
+void
+GNUNET_SCHEDULER_add_with_reason_and_priority (GNUNET_SCHEDULER_TaskCallback
+                                               task,
+                                               void *task_cls,
+                                               enum GNUNET_SCHEDULER_Reason
+                                               reason,
+                                               enum GNUNET_SCHEDULER_Priority
+                                               priority)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (NULL != task);
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  t->read_fd = -1;
+  t->write_fd = -1;
+  t->callback = task;
+  t->callback_cls = task_cls;
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->reason = reason;
+  t->priority = check_priority (priority);
+  t->lifeness = current_lifeness;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Adding continuation task %p\n",
+       t);
+  init_backtrace (t);
+  queue_ready_task (t);
+}
+
+
+/**
+ * Schedule a new task to be run at the specified time.  The task
+ * will be scheduled for execution at time @a at.
+ *
+ * @param at time when the operation should run
+ * @param priority priority to use for the task
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_at_with_priority (struct GNUNET_TIME_Absolute at,
+                                       enum GNUNET_SCHEDULER_Priority priority,
+                                       GNUNET_SCHEDULER_TaskCallback task,
+                                       void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+  struct GNUNET_SCHEDULER_Task *pos;
+  struct GNUNET_SCHEDULER_Task *prev;
+  struct GNUNET_TIME_Relative left;
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (NULL != task);
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  GNUNET_async_scope_get (&t->scope);
+  t->callback = task;
+  t->callback_cls = task_cls;
+  t->read_fd = -1;
+  t->write_fd = -1;
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->timeout = at;
+  t->priority = check_priority (priority);
+  t->lifeness = current_lifeness;
+  init_backtrace (t);
+
+  left = GNUNET_TIME_absolute_get_remaining (at);
+  if (0 == left.rel_value_us)
+  {
+    queue_ready_task (t);
+    if (priority > work_priority)
+      work_priority = priority;
+    return t;
+  }
+
+  /* try tail first (optimization in case we are
+   * appending to a long list of tasks with timeouts) */
+  if ((NULL == pending_timeout_head) ||
+      (at.abs_value_us < pending_timeout_head->timeout.abs_value_us))
+  {
+    GNUNET_CONTAINER_DLL_insert (pending_timeout_head,
+                                 pending_timeout_tail,
+                                 t);
+  }
+  else
+  {
+    /* first move from heuristic start backwards to before start time */
+    prev = pending_timeout_last;
+    while ((NULL != prev) &&
+           (prev->timeout.abs_value_us > t->timeout.abs_value_us))
+      prev = prev->prev;
+    /* now, move from heuristic start (or head of list) forward to insertion point */
+    if (NULL == prev)
+      pos = pending_timeout_head;
+    else
+      pos = prev->next;
+    while ((NULL != pos) && (pos->timeout.abs_value_us <=
+                             t->timeout.abs_value_us))
+    {
+      prev = pos;
+      pos = pos->next;
+    }
+    GNUNET_CONTAINER_DLL_insert_after (pending_timeout_head,
+                                       pending_timeout_tail,
+                                       prev,
+                                       t);
+  }
+  /* finally, update heuristic insertion point to last insertion... */
+  pending_timeout_last = t;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Adding task %p\n",
+       t);
+  return t;
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay.  The task
+ * will be scheduled for execution once the delay has expired.
+ *
+ * @param delay when should this operation time out?
+ * @param priority priority to use for the task
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_delayed_with_priority (struct GNUNET_TIME_Relative delay,
+                                            enum GNUNET_SCHEDULER_Priority
+                                            priority,
+                                            GNUNET_SCHEDULER_TaskCallback task,
+                                            void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_at_with_priority (
+    GNUNET_TIME_relative_to_absolute (delay),
+    priority,
+    task,
+    task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified priority.
+ *
+ * @param prio how important is the new task?
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_with_priority (enum GNUNET_SCHEDULER_Priority prio,
+                                    GNUNET_SCHEDULER_TaskCallback task,
+                                    void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_delayed_with_priority (GNUNET_TIME_UNIT_ZERO,
+                                                     prio,
+                                                     task,
+                                                     task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run at the specified time.  The task
+ * will be scheduled for execution once specified time has been
+ * reached. It will be run with the DEFAULT priority.
+ *
+ * @param at time at which this operation should run
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_at (struct GNUNET_TIME_Absolute at,
+                         GNUNET_SCHEDULER_TaskCallback task,
+                         void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_at_with_priority (at,
+                                                GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                                task,
+                                                task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay.  The task
+ * will be scheduled for execution once the delay has expired. It
+ * will be run with the DEFAULT priority.
+ *
+ * @param delay when should this operation time out?
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_delayed (struct GNUNET_TIME_Relative delay,
+                              GNUNET_SCHEDULER_TaskCallback task,
+                              void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_delayed_with_priority (delay,
+                                                     GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                                     task,
+                                                     task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run as soon as possible.  Note that this
+ * does not guarantee that this will be the next task that is being
+ * run, as other tasks with higher priority (or that are already ready
+ * to run) might get to run first.  Just as with delays, clients must
+ * not rely on any particular order of execution between tasks
+ * scheduled concurrently.
+ *
+ * The task will be run with the DEFAULT priority.
+ *
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_now (GNUNET_SCHEDULER_TaskCallback task,
+                          void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  GNUNET_async_scope_get (&t->scope);
+  t->callback = task;
+  t->callback_cls = task_cls;
+  t->read_fd = -1;
+  t->write_fd = -1;
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->timeout = GNUNET_TIME_UNIT_ZERO_ABS;
+  t->priority = current_priority;
+  t->on_shutdown = GNUNET_YES;
+  t->lifeness = current_lifeness;
+  queue_ready_task (t);
+  init_backtrace (t);
+  return t;
+}
+
+
+/**
+ * Schedule a new task to be run on shutdown, that is when a CTRL-C
+ * signal is received, or when #GNUNET_SCHEDULER_shutdown() is being
+ * invoked.
+ *
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_shutdown (GNUNET_SCHEDULER_TaskCallback task,
+                               void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (NULL != task);
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  GNUNET_async_scope_get (&t->scope);
+  t->callback = task;
+  t->callback_cls = task_cls;
+  t->read_fd = -1;
+  t->write_fd = -1;
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->timeout = GNUNET_TIME_UNIT_FOREVER_ABS;
+  t->priority = GNUNET_SCHEDULER_PRIORITY_SHUTDOWN;
+  t->on_shutdown = GNUNET_YES;
+  t->lifeness = GNUNET_NO;
+  GNUNET_CONTAINER_DLL_insert (shutdown_head,
+                               shutdown_tail,
+                               t);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Adding shutdown task %p\n",
+       t);
+  init_backtrace (t);
+  return t;
+}
+
+
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_now_with_lifeness (int lifeness,
+                                        GNUNET_SCHEDULER_TaskCallback task,
+                                        void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *ret;
+
+  ret = GNUNET_SCHEDULER_add_now (task, task_cls);
+  ret->lifeness = lifeness;
+  return ret;
+}
+
+
+#if DEBUG_FDS
+/**
+ * check a raw file descriptor and abort if it is bad (for debugging purposes)
+ *
+ * @param t the task related to the file descriptor
+ * @param raw_fd the raw file descriptor to check
+ */
+void
+check_fd (struct GNUNET_SCHEDULER_Task *t, int raw_fd)
+{
+  if (-1 != raw_fd)
+  {
+    int flags = fcntl (raw_fd, F_GETFD);
+
+    if ((flags == -1) && (errno == EBADF))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "Got invalid file descriptor %d!\n",
+           raw_fd);
+      init_backtrace (t);
+      GNUNET_assert (0);
+    }
+  }
+}
+
+
+#endif
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when any of
+ * the specified file descriptor sets is ready.  The delay can be used
+ * as a timeout on the socket(s) being ready.  The task will be
+ * scheduled for execution once either the delay has expired or any of
+ * the socket operations is ready.  This is the most general
+ * function of the "add" family.  Note that the "prerequisite_task"
+ * must be satisfied in addition to any of the other conditions.  In
+ * other words, the task will be started when
+ * <code>
+ * (prerequisite-run)
+ * && (delay-ready
+ *     || any-rs-ready
+ *     || any-ws-ready)
+ * </code>
+ *
+ * @param delay how long should we wait?
+ * @param priority priority to use
+ * @param rfd file descriptor we want to read (can be -1)
+ * @param wfd file descriptors we want to write (can be -1)
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+static struct GNUNET_SCHEDULER_Task *
+add_without_sets (struct GNUNET_TIME_Relative delay,
+                  enum GNUNET_SCHEDULER_Priority priority,
+                  const struct GNUNET_NETWORK_Handle *read_nh,
+                  const struct GNUNET_NETWORK_Handle *write_nh,
+                  const struct GNUNET_DISK_FileHandle *read_fh,
+                  const struct GNUNET_DISK_FileHandle *write_fh,
+                  GNUNET_SCHEDULER_TaskCallback task,
+                  void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (NULL != task);
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  GNUNET_async_scope_get (&t->scope);
+  init_fd_info (t,
+                &read_nh,
+                read_nh ? 1 : 0,
+                &write_nh,
+                write_nh ? 1 : 0,
+                &read_fh,
+                read_fh ? 1 : 0,
+                &write_fh,
+                write_fh ? 1 : 0);
+  t->callback = task;
+  t->callback_cls = task_cls;
+#if DEBUG_FDS
+  check_fd (t, NULL != read_nh ? GNUNET_NETWORK_get_fd (read_nh) : -1);
+  check_fd (t, NULL != write_nh ? GNUNET_NETWORK_get_fd (write_nh) : -1);
+  check_fd (t, NULL != read_fh ? read_fh->fd : -1);
+  check_fd (t, NULL != write_fh ? write_fh->fd : -1);
+#endif
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->timeout = GNUNET_TIME_relative_to_absolute (delay);
+  t->priority = check_priority ((priority == GNUNET_SCHEDULER_PRIORITY_KEEP) ?
+                                current_priority : priority);
+  t->lifeness = current_lifeness;
+  GNUNET_CONTAINER_DLL_insert (pending_head,
+                               pending_tail,
+                               t);
+  driver_add_multiple (t);
+  max_priority_added = GNUNET_MAX (max_priority_added,
+                                   t->priority);
+  init_backtrace (t);
+  return t;
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready for reading.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready.  It will be run with the DEFAULT priority.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param rfd read file-descriptor
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_read_net (struct GNUNET_TIME_Relative delay,
+                               struct GNUNET_NETWORK_Handle *rfd,
+                               GNUNET_SCHEDULER_TaskCallback task,
+                               void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_read_net_with_priority (delay,
+                                                      GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                                      rfd, task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified priority and to be
+ * run after the specified delay or when the specified file descriptor
+ * is ready for reading.  The delay can be used as a timeout on the
+ * socket being ready.  The task will be scheduled for execution once
+ * either the delay has expired or the socket operation is ready.  It
+ * will be run with the DEFAULT priority.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param priority priority to use for the task
+ * @param rfd read file-descriptor
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_read_net_with_priority (struct GNUNET_TIME_Relative delay,
+                                             enum GNUNET_SCHEDULER_Priority
+                                             priority,
+                                             struct GNUNET_NETWORK_Handle *rfd,
+                                             GNUNET_SCHEDULER_TaskCallback task,
+                                             void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_net_with_priority (delay, priority,
+                                                 rfd,
+                                                 GNUNET_YES,
+                                                 GNUNET_NO,
+                                                 task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready for writing.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready.  It will be run with the priority of
+ * the calling task.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param wfd write file-descriptor
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_write_net (struct GNUNET_TIME_Relative delay,
+                                struct GNUNET_NETWORK_Handle *wfd,
+                                GNUNET_SCHEDULER_TaskCallback task,
+                                void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_net_with_priority (delay,
+                                                 GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                                 wfd,
+                                                 GNUNET_NO, GNUNET_YES,
+                                                 task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param priority priority of the task
+ * @param fd file-descriptor
+ * @param on_read whether to poll the file-descriptor for readability
+ * @param on_write whether to poll the file-descriptor for writability
+ * @param task main function of the task
+ * @param task_cls closure of task
+ * @return unique task identifier for the job
+ *         only valid until "task" is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_net_with_priority (struct GNUNET_TIME_Relative delay,
+                                        enum GNUNET_SCHEDULER_Priority priority,
+                                        struct GNUNET_NETWORK_Handle *fd,
+                                        int on_read,
+                                        int on_write,
+                                        GNUNET_SCHEDULER_TaskCallback task,
+                                        void *task_cls)
+{
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (on_read || on_write);
+  GNUNET_assert (GNUNET_NETWORK_get_fd (fd) >= 0);
+  return add_without_sets (delay, priority,
+                           on_read  ? fd : NULL,
+                           on_write ? fd : NULL,
+                           NULL,
+                           NULL,
+                           task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready for reading.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready. It will be run with the DEFAULT priority.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param rfd read file-descriptor
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_read_file (struct GNUNET_TIME_Relative delay,
+                                const struct GNUNET_DISK_FileHandle *rfd,
+                                GNUNET_SCHEDULER_TaskCallback task,
+                                void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_file_with_priority (
+    delay, GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+    rfd, GNUNET_YES, GNUNET_NO,
+    task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready for writing.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready. It will be run with the DEFAULT priority.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param wfd write file-descriptor
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_write_file (struct GNUNET_TIME_Relative delay,
+                                 const struct GNUNET_DISK_FileHandle *wfd,
+                                 GNUNET_SCHEDULER_TaskCallback task,
+                                 void *task_cls)
+{
+  return GNUNET_SCHEDULER_add_file_with_priority (
+    delay, GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+    wfd, GNUNET_NO, GNUNET_YES,
+    task, task_cls);
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when the
+ * specified file descriptor is ready.  The delay can be
+ * used as a timeout on the socket being ready.  The task will be
+ * scheduled for execution once either the delay has expired or the
+ * socket operation is ready.
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param delay when should this operation time out?
+ * @param priority priority of the task
+ * @param fd file-descriptor
+ * @param on_read whether to poll the file-descriptor for readability
+ * @param on_write whether to poll the file-descriptor for writability
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_file_with_priority (struct GNUNET_TIME_Relative delay,
+                                         enum GNUNET_SCHEDULER_Priority
+                                         priority,
+                                         const struct
+                                         GNUNET_DISK_FileHandle *fd,
+                                         int on_read, int on_write,
+                                         GNUNET_SCHEDULER_TaskCallback task,
+                                         void *task_cls)
+{
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (on_read || on_write);
+  GNUNET_assert (fd->fd >= 0);
+  return add_without_sets (delay, priority,
+                           NULL,
+                           NULL,
+                           on_read ? fd : NULL,
+                           on_write ? fd : NULL,
+                           task, task_cls);
+}
+
+
+void
+extract_handles (const struct GNUNET_NETWORK_FDSet *fdset,
+                 const struct GNUNET_NETWORK_Handle ***ntarget,
+                 unsigned int *extracted_nhandles,
+                 const struct GNUNET_DISK_FileHandle ***ftarget,
+                 unsigned int *extracted_fhandles)
+{
+  // FIXME: this implementation only works for unix, for WIN32 the file handles
+  // in fdset must be handled separately
+  const struct GNUNET_NETWORK_Handle **nhandles;
+  const struct GNUNET_DISK_FileHandle **fhandles;
+  unsigned int nhandles_len;
+  unsigned int fhandles_len;
+
+  nhandles = NULL;
+  fhandles = NULL;
+  nhandles_len = 0;
+  fhandles_len = 0;
+  for (int sock = 0; sock != fdset->nsds; ++sock)
+  {
+    if (GNUNET_YES == GNUNET_NETWORK_fdset_test_native (fdset, sock))
+    {
+      struct GNUNET_NETWORK_Handle *nhandle;
+      struct GNUNET_DISK_FileHandle *fhandle;
+
+      nhandle = GNUNET_NETWORK_socket_box_native (sock);
+      if (NULL != nhandle)
+      {
+        GNUNET_array_append (nhandles, nhandles_len, nhandle);
+      }
+      else
+      {
+        fhandle = GNUNET_DISK_get_handle_from_int_fd (sock);
+        if (NULL != fhandle)
+        {
+          GNUNET_array_append (fhandles, fhandles_len, fhandle);
+        }
+        else
+        {
+          GNUNET_assert (0);
+        }
+      }
+    }
+  }
+  *ntarget = nhandles_len > 0 ? nhandles : NULL;
+  *ftarget = fhandles_len > 0 ? fhandles : NULL;
+  *extracted_nhandles = nhandles_len;
+  *extracted_fhandles = fhandles_len;
+}
+
+
+/**
+ * Schedule a new task to be run with a specified delay or when any of
+ * the specified file descriptor sets is ready.  The delay can be used
+ * as a timeout on the socket(s) being ready.  The task will be
+ * scheduled for execution once either the delay has expired or any of
+ * the socket operations is ready.  This is the most general
+ * function of the "add" family.  Note that the "prerequisite_task"
+ * must be satisfied in addition to any of the other conditions.  In
+ * other words, the task will be started when
+ * <code>
+ * (prerequisite-run)
+ * && (delay-ready
+ *     || any-rs-ready
+ *     || any-ws-ready) )
+ * </code>
+ * Only allowed to be called as long as the scheduler is running, that
+ * is one of the following conditions is met:
+ *
+ * - #GNUNET_SCHEDULER_run has been called and has not returned yet
+ * - #GNUNET_SCHEDULER_driver_init has been run and
+ *   #GNUNET_SCHEDULER_driver_done has not been called yet
+ *
+ * @param prio how important is this task?
+ * @param delay how long should we wait?
+ * @param rs set of file descriptors we want to read (can be NULL)
+ * @param ws set of file descriptors we want to write (can be NULL)
+ * @param task main function of the task
+ * @param task_cls closure of @a task
+ * @return unique task identifier for the job
+ *         only valid until @a task is started!
+ */
+struct GNUNET_SCHEDULER_Task *
+GNUNET_SCHEDULER_add_select (enum GNUNET_SCHEDULER_Priority prio,
+                             struct GNUNET_TIME_Relative delay,
+                             const struct GNUNET_NETWORK_FDSet *rs,
+                             const struct GNUNET_NETWORK_FDSet *ws,
+                             GNUNET_SCHEDULER_TaskCallback task,
+                             void *task_cls)
+{
+  struct GNUNET_SCHEDULER_Task *t;
+  const struct GNUNET_NETWORK_Handle **read_nhandles = NULL;
+  const struct GNUNET_NETWORK_Handle **write_nhandles = NULL;
+  const struct GNUNET_DISK_FileHandle **read_fhandles = NULL;
+  const struct GNUNET_DISK_FileHandle **write_fhandles = NULL;
+  unsigned int read_nhandles_len = 0;
+  unsigned int write_nhandles_len = 0;
+  unsigned int read_fhandles_len = 0;
+  unsigned int write_fhandles_len = 0;
+
+  /* scheduler must be running */
+  GNUNET_assert (NULL != scheduler_driver);
+  GNUNET_assert (NULL != task);
+  int no_rs = (NULL == rs);
+  int no_ws = (NULL == ws);
+  int empty_rs = (NULL != rs) && (0 == rs->nsds);
+  int empty_ws = (NULL != ws) && (0 == ws->nsds);
+  int no_fds = (no_rs && no_ws) ||
+               (empty_rs && empty_ws) ||
+               (no_rs && empty_ws) ||
+               (no_ws && empty_rs);
+  if (! no_fds)
+  {
+    if (NULL != rs)
+    {
+      extract_handles (rs,
+                       &read_nhandles,
+                       &read_nhandles_len,
+                       &read_fhandles,
+                       &read_fhandles_len);
+    }
+    if (NULL != ws)
+    {
+      extract_handles (ws,
+                       &write_nhandles,
+                       &write_nhandles_len,
+                       &write_fhandles,
+                       &write_fhandles_len);
+    }
+  }
+  /**
+   * here we consider the case that a GNUNET_NETWORK_FDSet might be empty
+   * although its maximum FD number (nsds) is greater than 0. We handle
+   * this case gracefully because some libraries such as libmicrohttpd
+   * only provide a hint what the maximum FD number in an FD set might be
+   * and not the exact FD number (see e.g. gnunet-rest-service.c)
+   */int no_fds_extracted = (0 == read_nhandles_len) &&
+                         (0 == read_fhandles_len) &&
+                         (0 == write_nhandles_len) &&
+                         (0 == write_fhandles_len);
+  if (no_fds || no_fds_extracted)
+    return GNUNET_SCHEDULER_add_delayed_with_priority (delay,
+                                                       prio,
+                                                       task,
+                                                       task_cls);
+  t = GNUNET_new (struct GNUNET_SCHEDULER_Task);
+  GNUNET_async_scope_get (&t->scope);
+  init_fd_info (t,
+                read_nhandles,
+                read_nhandles_len,
+                write_nhandles,
+                write_nhandles_len,
+                read_fhandles,
+                read_fhandles_len,
+                write_fhandles,
+                write_fhandles_len);
+  t->callback = task;
+  t->callback_cls = task_cls;
+  t->own_handles = GNUNET_YES;
+  /* free the arrays of pointers to network / file handles, the actual
+   * handles will be freed in destroy_task */
+  GNUNET_array_grow (read_nhandles, read_nhandles_len, 0);
+  GNUNET_array_grow (write_nhandles, write_nhandles_len, 0);
+  GNUNET_array_grow (read_fhandles, read_fhandles_len, 0);
+  GNUNET_array_grow (write_fhandles, write_fhandles_len, 0);
+#if PROFILE_DELAYS
+  t->start_time = GNUNET_TIME_absolute_get ();
+#endif
+  t->timeout = GNUNET_TIME_relative_to_absolute (delay);
+  t->priority =
+    check_priority ((prio ==
+                     GNUNET_SCHEDULER_PRIORITY_KEEP) ? current_priority :
+                    prio);
+  t->lifeness = current_lifeness;
+  GNUNET_CONTAINER_DLL_insert (pending_head,
+                               pending_tail,
+                               t);
+  driver_add_multiple (t);
+  max_priority_added = GNUNET_MAX (max_priority_added,
+                                   t->priority);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Adding task %p\n",
+       t);
+  init_backtrace (t);
+  return t;
+}
+
+
+/**
+ * Function used by event-loop implementations to signal the scheduler
+ * that a particular @a task is ready due to an event specified in the
+ * et field of @a fdi.
+ *
+ * This function will then queue the task to notify the application
+ * that the task is ready (with the respective priority).
+ *
+ * @param task the task that is ready
+ * @param fdi information about the related FD
+ */
+void
+GNUNET_SCHEDULER_task_ready (struct GNUNET_SCHEDULER_Task *task,
+                             struct GNUNET_SCHEDULER_FdInfo *fdi)
+{
+  enum GNUNET_SCHEDULER_Reason reason;
+
+  reason = task->reason;
+  if ((0 == (reason & GNUNET_SCHEDULER_REASON_READ_READY)) &&
+      (0 != (GNUNET_SCHEDULER_ET_IN & fdi->et)))
+    reason |= GNUNET_SCHEDULER_REASON_READ_READY;
+  if ((0 == (reason & GNUNET_SCHEDULER_REASON_WRITE_READY)) &&
+      (0 != (GNUNET_SCHEDULER_ET_OUT & fdi->et)))
+    reason |= GNUNET_SCHEDULER_REASON_WRITE_READY;
+  reason |= GNUNET_SCHEDULER_REASON_PREREQ_DONE;
+  task->reason = reason;
+  if (GNUNET_NO == task->in_ready_list)
+  {
+    GNUNET_CONTAINER_DLL_remove (pending_head,
+                                 pending_tail,
+                                 task);
+    queue_ready_task (task);
+  }
+}
+
+
+/**
+ * Function called by external event loop implementations to tell the
+ * scheduler to run some of the tasks that are ready. Must be called
+ * only after #GNUNET_SCHEDULER_driver_init has been called and before
+ * #GNUNET_SCHEDULER_driver_done is called.
+ * This function may return even though there are tasks left to run
+ * just to give other tasks a chance as well.  If we return #GNUNET_YES,
+ * the event loop implementation should call this function again as
+ * soon as possible, while if we return #GNUNET_NO it must block until
+ * either the operating system has more work (the scheduler has no more
+ * work to do right now) or the timeout set by the scheduler (using the
+ * set_wakeup callback) is reached.
+ *
+ * @param sh scheduler handle that was returned by
+ *        #GNUNET_SCHEDULER_driver_init
+ * @return #GNUNET_YES if there are more tasks that are ready,
+ *         and thus we would like to run more (yield to avoid
+ *         blocking other activities for too long) #GNUNET_NO
+ *         if we are done running tasks (yield to block)
+ */
+int
+GNUNET_SCHEDULER_do_work (struct GNUNET_SCHEDULER_Handle *sh)
+{
+  struct GNUNET_SCHEDULER_Task *pos;
+  struct GNUNET_TIME_Absolute now;
+
+  /* check for tasks that reached the timeout! */
+  now = GNUNET_TIME_absolute_get ();
+  pos = pending_timeout_head;
+  while (NULL != pos)
+  {
+    struct GNUNET_SCHEDULER_Task *next = pos->next;
+    if (now.abs_value_us >= pos->timeout.abs_value_us)
+      pos->reason |= GNUNET_SCHEDULER_REASON_TIMEOUT;
+    if (0 == pos->reason)
+      break;
+    GNUNET_CONTAINER_DLL_remove (pending_timeout_head,
+                                 pending_timeout_tail,
+                                 pos);
+    if (pending_timeout_last == pos)
+      pending_timeout_last = NULL;
+    queue_ready_task (pos);
+    pos = next;
+  }
+  pos = pending_head;
+  while (NULL != pos)
+  {
+    struct GNUNET_SCHEDULER_Task *next = pos->next;
+    if (now.abs_value_us >= pos->timeout.abs_value_us)
+    {
+      pos->reason |= GNUNET_SCHEDULER_REASON_TIMEOUT;
+      GNUNET_CONTAINER_DLL_remove (pending_head,
+                                   pending_tail,
+                                   pos);
+      queue_ready_task (pos);
+    }
+    pos = next;
+  }
+
+  if (0 == ready_count)
+  {
+    struct GNUNET_TIME_Absolute timeout = get_timeout ();
+
+    if (timeout.abs_value_us > now.abs_value_us)
+    {
+      /**
+       * The event loop called this function before the current timeout was
+       * reached (and no FD tasks are ready). This is acceptable if
+       *
+       * - the system time was changed while the driver was waiting for
+       *   the timeout
+       * - an external event loop called GNUnet API functions outside of
+       *   the callbacks called in GNUNET_SCHEDULER_do_work and thus
+       *   wasn't notified about the new timeout
+       *
+       * It might also mean we are busy-waiting because of a programming
+       * error in the external event loop.
+       */
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "GNUNET_SCHEDULER_do_work did not find any ready "
+           "tasks and timeout has not been reached yet.\n");
+    }
+    else
+    {
+      /**
+       * the current timeout was reached but no ready tasks were found,
+       * internal scheduler error!
+       */
+      GNUNET_assert (0);
+    }
+  }
+  else
+  {
+    /* find out which task priority level we are going to
+       process this time */
+    max_priority_added = GNUNET_SCHEDULER_PRIORITY_KEEP;
+    GNUNET_assert (NULL == ready_head[GNUNET_SCHEDULER_PRIORITY_KEEP]);
+    /* yes, p>0 is correct, 0 is "KEEP" which should
+     * always be an empty queue (see assertion)! */
+    for (work_priority = GNUNET_SCHEDULER_PRIORITY_COUNT - 1;
+         work_priority > 0;
+         work_priority--)
+    {
+      pos = ready_head[work_priority];
+      if (NULL != pos)
+        break;
+    }
+    GNUNET_assert (NULL != pos);        /* ready_count wrong? */
+
+    /* process all *existing* tasks at this priority
+       level, then yield */
+    set_work_priority (work_priority);
+    while (NULL != (pos = ready_head[work_priority])
+           && pos != &pass_end_marker)
+    {
+      GNUNET_CONTAINER_DLL_remove (ready_head[work_priority],
+                                   ready_tail[work_priority],
+                                   pos);
+      ready_count--;
+      current_priority = pos->priority;
+      current_lifeness = pos->lifeness;
+      active_task = pos;
+#if PROFILE_DELAYS
+      if (GNUNET_TIME_absolute_get_duration (pos->start_time).rel_value_us >
+          DELAY_THRESHOLD.rel_value_us)
+      {
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "Task %p took %s to be scheduled\n",
+             pos,
+             GNUNET_STRINGS_relative_time_to_string (
+               GNUNET_TIME_absolute_get_duration (pos->start_time),
+               GNUNET_YES));
+      }
+#endif
+      tc.reason = pos->reason;
+      GNUNET_NETWORK_fdset_zero (sh->rs);
+      GNUNET_NETWORK_fdset_zero (sh->ws);
+      // FIXME: do we have to remove FdInfos from fds if they are not ready?
+      tc.fds_len = pos->fds_len;
+      tc.fds = pos->fds;
+      for (unsigned int i = 0; i != pos->fds_len; ++i)
+      {
+        struct GNUNET_SCHEDULER_FdInfo *fdi = &pos->fds[i];
+        if (0 != (GNUNET_SCHEDULER_ET_IN & fdi->et))
+        {
+          GNUNET_NETWORK_fdset_set_native (sh->rs,
+                                           fdi->sock);
+        }
+        if (0 != (GNUNET_SCHEDULER_ET_OUT & fdi->et))
+        {
+          GNUNET_NETWORK_fdset_set_native (sh->ws,
+                                           fdi->sock);
+        }
+      }
+      tc.read_ready = sh->rs;
+      tc.write_ready = sh->ws;
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Running task %p\n",
+           pos);
+      GNUNET_assert (NULL != pos->callback);
+      {
+        struct GNUNET_AsyncScopeSave old_scope;
+        if (pos->scope.have_scope)
+          GNUNET_async_scope_enter (&pos->scope.scope_id, &old_scope);
+        else
+          GNUNET_async_scope_get (&old_scope);
+        pos->callback (pos->callback_cls);
+        GNUNET_async_scope_restore (&old_scope);
+      }
+      if (NULL != pos->fds)
+      {
+        int del_result = scheduler_driver->del (scheduler_driver->cls,
+                                                pos);
+        if (GNUNET_OK != del_result)
+        {
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "driver could not delete task %p\n", pos);
+          GNUNET_assert (0);
+        }
+      }
+      active_task = NULL;
+      dump_backtrace (pos);
+      destroy_task (pos);
+    }
+    remove_pass_end_marker ();
+  }
+  shutdown_if_no_lifeness ();
+  if (0 == ready_count)
+  {
+    scheduler_driver->set_wakeup (scheduler_driver->cls,
+                                  get_timeout ());
+    return GNUNET_NO;
+  }
+  scheduler_driver->set_wakeup (scheduler_driver->cls,
+                                GNUNET_TIME_absolute_get ());
+  return GNUNET_YES;
+}
+
+
+/**
+ * Function called by external event loop implementations to initialize
+ * the scheduler. An external implementation has to provide @a driver
+ * which contains callbacks for the scheduler (see definition of struct
+ * #GNUNET_SCHEDULER_Driver). The callbacks are used to instruct the
+ * external implementation to watch for events. If it detects any of
+ * those events it is expected to call #GNUNET_SCHEDULER_do_work to let
+ * the scheduler handle it. If an event is related to a specific task
+ * (e.g. the scheduler gave instructions to watch a file descriptor),
+ * the external implementation is expected to mark that task ready
+ * before by calling #GNUNET_SCHEDULER_task_ready.
+
+ * This function has to be called before any tasks are scheduled and
+ * before GNUNET_SCHEDULER_do_work is called for the first time. It
+ * allocates resources that have to be freed again by calling
+ * #GNUNET_SCHEDULER_driver_done.
+ *
+ * This function installs the same signal handlers as
+ * #GNUNET_SCHEDULER_run. This means SIGTERM (and other similar signals)
+ * will induce a call to #GNUNET_SCHEDULER_shutdown during the next
+ * call to #GNUNET_SCHEDULER_do_work. As a result, SIGTERM causes all
+ * active tasks to be scheduled with reason
+ * #GNUNET_SCHEDULER_REASON_SHUTDOWN. (However, tasks added afterwards
+ * will execute normally!). Note that any particular signal will only
+ * shut down one scheduler; applications should always only create a
+ * single scheduler.
+ *
+ * @param driver to use for the event loop
+ * @return handle to be passed to #GNUNET_SCHEDULER_do_work and
+ *         #GNUNET_SCHEDULER_driver_done
+ */
+struct GNUNET_SCHEDULER_Handle *
+GNUNET_SCHEDULER_driver_init (const struct GNUNET_SCHEDULER_Driver *driver)
+{
+  struct GNUNET_SCHEDULER_Handle *sh;
+  const struct GNUNET_DISK_FileHandle *pr;
+
+  /* scheduler must not be running */
+  GNUNET_assert (NULL == scheduler_driver);
+  GNUNET_assert (NULL == shutdown_pipe_handle);
+  /* general set-up */
+  sh = GNUNET_new (struct GNUNET_SCHEDULER_Handle);
+  shutdown_pipe_handle = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+  GNUNET_assert (NULL != shutdown_pipe_handle);
+  pr = GNUNET_DISK_pipe_handle (shutdown_pipe_handle,
+                                GNUNET_DISK_PIPE_END_READ);
+  my_pid = getpid ();
+  scheduler_driver = driver;
+
+  /* install signal handlers */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Registering signal handlers\n");
+  sh->shc_int = GNUNET_SIGNAL_handler_install (SIGINT,
+                                               &sighandler_shutdown);
+  sh->shc_term = GNUNET_SIGNAL_handler_install (SIGTERM,
+                                                &sighandler_shutdown);
+#if (SIGTERM != GNUNET_TERM_SIG)
+  sh->shc_gterm = GNUNET_SIGNAL_handler_install (GNUNET_TERM_SIG,
+                                                 &sighandler_shutdown);
+#endif
+  sh->shc_pipe = GNUNET_SIGNAL_handler_install (SIGPIPE,
+                                                &sighandler_pipe);
+  sh->shc_quit = GNUNET_SIGNAL_handler_install (SIGQUIT,
+                                                &sighandler_shutdown);
+  sh->shc_hup = GNUNET_SIGNAL_handler_install (SIGHUP,
+                                               &sighandler_shutdown);
+
+  /* Setup initial tasks */
+  current_priority = GNUNET_SCHEDULER_PRIORITY_DEFAULT;
+  current_lifeness = GNUNET_NO;
+  /* ensure this task runs first, by using a priority level reserved for
+     the scheduler (not really shutdown, but start-up ;-) */
+  install_parent_control_task =
+    GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_SHUTDOWN,
+                                        &install_parent_control_handler,
+                                        NULL);
+  shutdown_pipe_task =
+    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                    pr,
+                                    &shutdown_pipe_cb,
+                                    NULL);
+  current_lifeness = GNUNET_YES;
+  scheduler_driver->set_wakeup (scheduler_driver->cls,
+                                get_timeout ());
+  /* begin main event loop */
+  sh->rs = GNUNET_NETWORK_fdset_create ();
+  sh->ws = GNUNET_NETWORK_fdset_create ();
+  GNUNET_NETWORK_fdset_handle_set (sh->rs, pr);
+  return sh;
+}
+
+
+/**
+ * Counter-part of #GNUNET_SCHEDULER_driver_init. Has to be called
+ * by external event loop implementations after the scheduler has
+ * shut down. This is the case if both of the following conditions
+ * are met:
+ *
+ * - all tasks the scheduler has added through the driver's add
+ *   callback have been removed again through the driver's del
+ *   callback
+ * - the timeout the scheduler has set through the driver's
+ *   add_wakeup callback is FOREVER
+ *
+ * @param sh the handle returned by #GNUNET_SCHEDULER_driver_init
+ */
+void
+GNUNET_SCHEDULER_driver_done (struct GNUNET_SCHEDULER_Handle *sh)
+{
+  GNUNET_break (NULL == pending_head);
+  GNUNET_break (NULL == pending_timeout_head);
+  GNUNET_break (NULL == shutdown_head);
+  for (int i = 0; i != GNUNET_SCHEDULER_PRIORITY_COUNT; ++i)
+  {
+    GNUNET_break (NULL == ready_head[i]);
+  }
+  GNUNET_NETWORK_fdset_destroy (sh->rs);
+  GNUNET_NETWORK_fdset_destroy (sh->ws);
+
+  /* uninstall signal handlers */
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_int);
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_term);
+#if (SIGTERM != GNUNET_TERM_SIG)
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_gterm);
+#endif
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_pipe);
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_quit);
+  GNUNET_SIGNAL_handler_uninstall (sh->shc_hup);
+  GNUNET_DISK_pipe_close (shutdown_pipe_handle);
+  shutdown_pipe_handle = NULL;
+  scheduler_driver = NULL;
+  GNUNET_free (sh);
+}
+
+
+static enum GNUNET_GenericReturnValue
+select_loop (struct GNUNET_SCHEDULER_Handle *sh,
+             struct DriverContext *context)
+{
+  struct GNUNET_NETWORK_FDSet *rs;
+  struct GNUNET_NETWORK_FDSet *ws;
+  int select_result;
+
+  GNUNET_assert (NULL != context);
+  rs = GNUNET_NETWORK_fdset_create ();
+  ws = GNUNET_NETWORK_fdset_create ();
+  while ((NULL != context->scheduled_head) ||
+         (GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us !=
+          context->timeout.abs_value_us))
+  {
+    struct GNUNET_TIME_Relative time_remaining;
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "select timeout = %s\n",
+         GNUNET_STRINGS_absolute_time_to_string (context->timeout));
+
+    GNUNET_NETWORK_fdset_zero (rs);
+    GNUNET_NETWORK_fdset_zero (ws);
+
+    for (struct Scheduled *pos = context->scheduled_head;
+         NULL != pos;
+         pos = pos->next)
+    {
+      if (0 != (GNUNET_SCHEDULER_ET_IN & pos->et))
+      {
+        GNUNET_NETWORK_fdset_set_native (rs, pos->fdi->sock);
+      }
+      if (0 != (GNUNET_SCHEDULER_ET_OUT & pos->et))
+      {
+        GNUNET_NETWORK_fdset_set_native (ws, pos->fdi->sock);
+      }
+    }
+    time_remaining = GNUNET_TIME_absolute_get_remaining (context->timeout);
+    if (0 < ready_count)
+      time_remaining = GNUNET_TIME_UNIT_ZERO;
+    if (NULL == scheduler_select)
+    {
+      select_result = GNUNET_NETWORK_socket_select (rs,
+                                                    ws,
+                                                    NULL,
+                                                    time_remaining);
+    }
+    else
+    {
+      select_result = scheduler_select (scheduler_select_cls,
+                                        rs,
+                                        ws,
+                                        NULL,
+                                        time_remaining);
+    }
+    if (select_result == GNUNET_SYSERR)
+    {
+      if (errno == EINTR)
+        continue;
+
+      LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                    "select");
+#if USE_LSOF
+      char lsof[512];
+
+      snprintf (lsof,
+                sizeof(lsof),
+                "lsof -p %d",
+                getpid ());
+      (void) close (1);
+      (void) dup2 (2, 1);
+      if (0 != system (lsof))
+        LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                      "system");
+#endif
+#if DEBUG_FDS
+      for (struct Scheduled *s = context->scheduled_head;
+           NULL != s;
+           s = s->next)
+      {
+        int flags = fcntl (s->fdi->sock,
+                           F_GETFD);
+
+        if ((flags == -1) &&
+            (EBADF == errno))
+        {
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "Got invalid file descriptor %d!\n",
+               s->fdi->sock);
+#if EXECINFO
+          dump_backtrace (s->task);
+#endif
+        }
+      }
+#endif
+      GNUNET_assert (0);
+      GNUNET_NETWORK_fdset_destroy (rs);
+      GNUNET_NETWORK_fdset_destroy (ws);
+      return GNUNET_SYSERR;
+    }
+    if (select_result > 0)
+    {
+      for (struct Scheduled *pos = context->scheduled_head;
+           NULL != pos;
+           pos = pos->next)
+      {
+        int is_ready = GNUNET_NO;
+
+        if ((0 != (GNUNET_SCHEDULER_ET_IN & pos->et)) &&
+            (GNUNET_YES ==
+             GNUNET_NETWORK_fdset_test_native (rs,
+                                               pos->fdi->sock)) )
+        {
+          pos->fdi->et |= GNUNET_SCHEDULER_ET_IN;
+          is_ready = GNUNET_YES;
+        }
+        if ((0 != (GNUNET_SCHEDULER_ET_OUT & pos->et)) &&
+            (GNUNET_YES ==
+             GNUNET_NETWORK_fdset_test_native (ws,
+                                               pos->fdi->sock)) )
+        {
+          pos->fdi->et |= GNUNET_SCHEDULER_ET_OUT;
+          is_ready = GNUNET_YES;
+        }
+        if (GNUNET_YES == is_ready)
+        {
+          GNUNET_SCHEDULER_task_ready (pos->task,
+                                       pos->fdi);
+        }
+      }
+    }
+    if (GNUNET_YES == GNUNET_SCHEDULER_do_work (sh))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "scheduler has more tasks ready!\n");
+    }
+  }
+  GNUNET_NETWORK_fdset_destroy (rs);
+  GNUNET_NETWORK_fdset_destroy (ws);
+
+  if ( (NULL == context->scheduled_head) &&
+       (NULL != pending_timeout_head) &&
+       (GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us ==
+        context->timeout.abs_value_us) )
+  {
+    /* Only remaining task has timeout of 'forever'.
+       We exit here more as sanity measure, as just
+       waiting forever isn't exactly useful. Still,
+       this is indicative of a bug in the client code. */
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+static int
+select_add (void *cls,
+            struct GNUNET_SCHEDULER_Task *task,
+            struct GNUNET_SCHEDULER_FdInfo *fdi)
+{
+  struct DriverContext *context = cls;
+
+  GNUNET_assert (NULL != context);
+  GNUNET_assert (NULL != task);
+  GNUNET_assert (NULL != fdi);
+  GNUNET_assert (0 != (GNUNET_SCHEDULER_ET_IN & fdi->et) ||
+                 0 != (GNUNET_SCHEDULER_ET_OUT & fdi->et));
+
+  if (! ((NULL != fdi->fd) ^ (NULL != fdi->fh)) || (fdi->sock < 0))
+  {
+    /* exactly one out of {fd, hf} must be != NULL and the OS handle must be valid */
+    return GNUNET_SYSERR;
+  }
+
+  struct Scheduled *scheduled = GNUNET_new (struct Scheduled);
+  scheduled->task = task;
+  scheduled->fdi = fdi;
+  scheduled->et = fdi->et;
+
+  GNUNET_CONTAINER_DLL_insert (context->scheduled_head,
+                               context->scheduled_tail,
+                               scheduled);
+  return GNUNET_OK;
+}
+
+
+static int
+select_del (void *cls,
+            struct GNUNET_SCHEDULER_Task *task)
+{
+  struct DriverContext *context;
+  struct Scheduled *pos;
+  int ret;
+
+  GNUNET_assert (NULL != cls);
+
+  context = cls;
+  ret = GNUNET_SYSERR;
+  pos = context->scheduled_head;
+  while (NULL != pos)
+  {
+    struct Scheduled *next = pos->next;
+    if (pos->task == task)
+    {
+      GNUNET_CONTAINER_DLL_remove (context->scheduled_head,
+                                   context->scheduled_tail,
+                                   pos);
+      GNUNET_free (pos);
+      ret = GNUNET_OK;
+    }
+    pos = next;
+  }
+  return ret;
+}
+
+
+static void
+select_set_wakeup (void *cls,
+                   struct GNUNET_TIME_Absolute dt)
+{
+  struct DriverContext *context = cls;
+
+  GNUNET_assert (NULL != context);
+  context->timeout = dt;
+}
+
+
+/**
+ * Obtain the driver for using select() as the event loop.
+ *
+ * @return NULL on error
+ */
+struct GNUNET_SCHEDULER_Driver *
+GNUNET_SCHEDULER_driver_select ()
+{
+  struct GNUNET_SCHEDULER_Driver *select_driver;
+
+  select_driver = GNUNET_new (struct GNUNET_SCHEDULER_Driver);
+
+  select_driver->add = &select_add;
+  select_driver->del = &select_del;
+  select_driver->set_wakeup = &select_set_wakeup;
+
+  return select_driver;
+}
+
+
+/**
+ * Change the async scope for the currently executing task and (transitively)
+ * for all tasks scheduled by the current task after calling this function.
+ * Nested tasks can begin their own nested async scope.
+ *
+ * Once the current task is finished, the async scope ID is reset to
+ * its previous value.
+ *
+ * Must only be called from a running task.
+ *
+ * @param aid the asynchronous scope id to enter
+ */
+void
+GNUNET_SCHEDULER_begin_async_scope (struct GNUNET_AsyncScopeId *aid)
+{
+  struct GNUNET_AsyncScopeSave dummy_old_scope;
+
+  GNUNET_assert (NULL != active_task);
+  /* Since we're in a task, the context will be automatically
+     restored by the scheduler. */
+  GNUNET_async_scope_enter (aid, &dummy_old_scope);
+}
+
+
+/* end of scheduler.c */
diff --git a/src/lib/util/service.c b/src/lib/util/service.c
new file mode 100644
index 000000000..363210c61
--- /dev/null
+++ b/src/lib/util/service.c
@@ -0,0 +1,2572 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/service.c
+ * @brief functions related to starting services (redesign)
+ * @author Christian Grothoff
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_constants.h"
+#include "gnunet_resolver_service.h"
+#include "speedup.h"
+
+#if HAVE_MALLINFO2
+#include <malloc.h>
+#include "gauger.h"
+#endif
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-service", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+        GNUNET_log_from_strerror (kind, "util-service", syscall)
+
+#define LOG_STRERROR_FILE(kind, syscall, filename) \
+        GNUNET_log_from_strerror_file (kind, "util-service", syscall, filename)
+
+
+/**
+ * Information the service tracks per listen operation.
+ */
+struct ServiceListenContext
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct ServiceListenContext *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct ServiceListenContext *prev;
+
+  /**
+   * Service this listen context belongs to.
+   */
+  struct GNUNET_SERVICE_Handle *sh;
+
+  /**
+   * Socket we are listening on.
+   */
+  struct GNUNET_NETWORK_Handle *listen_socket;
+
+  /**
+   * Task scheduled to do the listening.
+   */
+  struct GNUNET_SCHEDULER_Task *listen_task;
+};
+
+
+/**
+ * Reasons why we might be suspended.
+ */
+enum SuspendReason
+{
+  /**
+   * We are running normally.
+   */
+  SUSPEND_STATE_NONE = 0,
+
+  /**
+   * Application requested it.
+   */
+  SUSPEND_STATE_APP = 1,
+
+  /**
+   * OS ran out of file descriptors.
+   */
+  SUSPEND_STATE_EMFILE = 2,
+
+  /**
+   * Both reasons, APP and EMFILE apply.
+   */
+  SUSPEND_STATE_APP_AND_EMFILE = 3,
+
+  /**
+   * Suspension because service was permanently shutdown.
+   */
+  SUSPEND_STATE_SHUTDOWN = 4
+};
+
+
+/**
+ * Handle to a service.
+ */
+struct GNUNET_SERVICE_Handle
+{
+  /**
+   * Our configuration.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Name of our service.
+   */
+  const char *service_name;
+
+  /**
+   * Main service-specific task to run.
+   */
+  GNUNET_SERVICE_InitCallback service_init_cb;
+
+  /**
+   * Function to call when clients connect.
+   */
+  GNUNET_SERVICE_ConnectHandler connect_cb;
+
+  /**
+   * Function to call when clients disconnect / are disconnected.
+   */
+  GNUNET_SERVICE_DisconnectHandler disconnect_cb;
+
+  /**
+   * Closure for @e service_init_cb, @e connect_cb, @e disconnect_cb.
+   */
+  void *cb_cls;
+
+  /**
+   * DLL of listen sockets used to accept new connections.
+   */
+  struct ServiceListenContext *slc_head;
+
+  /**
+   * DLL of listen sockets used to accept new connections.
+   */
+  struct ServiceListenContext *slc_tail;
+
+  /**
+   * Our clients, kept in a DLL.
+   */
+  struct GNUNET_SERVICE_Client *clients_head;
+
+  /**
+   * Our clients, kept in a DLL.
+   */
+  struct GNUNET_SERVICE_Client *clients_tail;
+
+  /**
+   * Message handlers to use for all clients.
+   */
+  struct GNUNET_MQ_MessageHandler *handlers;
+
+  /**
+   * Closure for @e task.
+   */
+  void *task_cls;
+
+
+  /**
+   * IPv4 addresses that are not allowed to connect.
+   */
+  struct GNUNET_STRINGS_IPv4NetworkPolicy *v4_denied;
+
+  /**
+   * IPv6 addresses that are not allowed to connect.
+   */
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *v6_denied;
+
+  /**
+   * IPv4 addresses that are allowed to connect (if not
+   * set, all are allowed).
+   */
+  struct GNUNET_STRINGS_IPv4NetworkPolicy *v4_allowed;
+
+  /**
+   * IPv6 addresses that are allowed to connect (if not
+   * set, all are allowed).
+   */
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *v6_allowed;
+
+  /**
+   * Do we require a matching UID for UNIX domain socket connections?
+   * #GNUNET_NO means that the UID does not have to match (however,
+   * @e match_gid may still impose other access control checks).
+   */
+  int match_uid;
+
+  /**
+   * Do we require a matching GID for UNIX domain socket connections?
+   * Ignored if @e match_uid is #GNUNET_YES.  Note that this is about
+   * checking that the client's UID is in our group OR that the
+   * client's GID is our GID.  If both "match_gid" and @e match_uid are
+   * #GNUNET_NO, all users on the local system have access.
+   */
+  int match_gid;
+
+  /**
+   * Are we suspended, and if so, why?
+   */
+  enum SuspendReason suspend_state;
+
+  /**
+   * Our options.
+   */
+  enum GNUNET_SERVICE_Options options;
+
+  /**
+   * If we are daemonizing, this FD is set to the
+   * pipe to the parent.  Send '.' if we started
+   * ok, '!' if not.  -1 if we are not daemonizing.
+   */
+  int ready_confirm_fd;
+
+  /**
+   * If true, consider unknown message types an error where the
+   * client is disconnected.
+   */
+  bool require_found;
+};
+
+
+/**
+ * Handle to a client that is connected to a service.
+ */
+struct GNUNET_SERVICE_Client
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_SERVICE_Client *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_SERVICE_Client *prev;
+
+  /**
+   * Service that this client belongs to.
+   */
+  struct GNUNET_SERVICE_Handle *sh;
+
+  /**
+   * Socket of this client.
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * Message queue for the client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Tokenizer we use for processing incoming data.
+   */
+  struct GNUNET_MessageStreamTokenizer *mst;
+
+  /**
+   * Task that warns about missing calls to
+   * #GNUNET_SERVICE_client_continue().
+   */
+  struct GNUNET_SCHEDULER_Task *warn_task;
+
+  /**
+   * Task run to finish dropping the client after the stack has
+   * properly unwound.
+   */
+  struct GNUNET_SCHEDULER_Task *drop_task;
+
+  /**
+   * Task that receives data from the client to
+   * pass it to the handlers.
+   */
+  struct GNUNET_SCHEDULER_Task *recv_task;
+
+  /**
+   * Task that transmit data to the client.
+   */
+  struct GNUNET_SCHEDULER_Task *send_task;
+
+  /**
+   * Pointer to the message to be transmitted by @e send_task.
+   */
+  const struct GNUNET_MessageHeader *msg;
+
+  /**
+   * User context value, value returned from
+   * the connect callback.
+   */
+  void *user_context;
+
+  /**
+   * Time when we last gave a message from this client
+   * to the application.
+   */
+  struct GNUNET_TIME_Absolute warn_start;
+
+  /**
+   * Current position in @e msg at which we are transmitting.
+   */
+  size_t msg_pos;
+
+  /**
+   * Persist the file handle for this client no matter what happens,
+   * force the OS to close once the process actually dies.  Should only
+   * be used in special cases!
+   */
+  bool persist;
+
+  /**
+   * Is this client a 'monitor' client that should not be counted
+   * when deciding on destroying the server during soft shutdown?
+   * (see also #GNUNET_SERVICE_start)
+   */
+  bool is_monitor;
+
+  /**
+   * Are we waiting for the application to call #GNUNET_SERVICE_client_continue()?
+   */
+  bool needs_continue;
+
+  /**
+   * Type of last message processed (for warn_no_receive_done).
+   */
+  uint16_t warn_type;
+};
+
+
+/**
+ * Check if any of the clients we have left are unrelated to
+ * monitoring.
+ *
+ * @param sh service to check clients for
+ * @return true if we have non-monitoring clients left
+ */
+static enum GNUNET_GenericReturnValue
+have_non_monitor_clients (struct GNUNET_SERVICE_Handle *sh)
+{
+  for (struct GNUNET_SERVICE_Client *client = sh->clients_head;
+       NULL != client;
+       client = client->next)
+  {
+    if (NULL != client->drop_task)
+      continue;
+    if (client->is_monitor)
+      continue;
+    return true;
+  }
+  return false;
+}
+
+
+/**
+ * Suspend accepting connections from the listen socket temporarily.
+ * Resume activity using #do_resume.
+ *
+ * @param sh service to stop accepting connections.
+ * @param sr reason for suspending accepting connections
+ */
+static void
+do_suspend (struct GNUNET_SERVICE_Handle *sh,
+            enum SuspendReason sr)
+{
+  GNUNET_assert (0 == (sh->suspend_state & sr));
+  sh->suspend_state |= sr;
+  for (struct ServiceListenContext *slc = sh->slc_head;
+       NULL != slc;
+       slc = slc->next)
+  {
+    if (NULL != slc->listen_task)
+    {
+      GNUNET_SCHEDULER_cancel (slc->listen_task);
+      slc->listen_task = NULL;
+    }
+  }
+}
+
+
+/**
+ * Shutdown task triggered when a service should be terminated.
+ * This considers active clients and the service options to see
+ * how this specific service is to be terminated, and depending
+ * on this proceeds with the shutdown logic.
+ *
+ * @param cls our `struct GNUNET_SERVICE_Handle`
+ */
+static void
+service_shutdown (void *cls)
+{
+  struct GNUNET_SERVICE_Handle *sh = cls;
+
+  switch (sh->options & GNUNET_SERVICE_OPTION_SHUTDOWN_BITMASK)
+  {
+  case GNUNET_SERVICE_OPTION_NONE:
+    GNUNET_SERVICE_shutdown (sh);
+    break;
+  case GNUNET_SERVICE_OPTION_MANUAL_SHUTDOWN:
+    /* This task should never be run if we are using
+       the manual shutdown. */
+    GNUNET_assert (0);
+    break;
+  case GNUNET_SERVICE_OPTION_SOFT_SHUTDOWN:
+    if (0 == (sh->suspend_state & SUSPEND_STATE_SHUTDOWN))
+      do_suspend (sh, SUSPEND_STATE_SHUTDOWN);
+    if (! have_non_monitor_clients (sh))
+      GNUNET_SERVICE_shutdown (sh);
+    break;
+  }
+}
+
+
+/**
+ * Check if the given IP address is in the list of IP addresses.
+ *
+ * @param list a list of networks
+ * @param add the IP to check (in network byte order)
+ * @return false if the IP is not in the list, true if it it is
+ */
+static bool
+check_ipv4_listed (const struct GNUNET_STRINGS_IPv4NetworkPolicy *list,
+                   const struct in_addr *add)
+{
+  for (unsigned int i = 0;
+       0 != list[i].network.s_addr;
+       i++)
+  {
+    if ( (add->s_addr & list[i].netmask.s_addr) ==
+         (list[i].network.s_addr & list[i].netmask.s_addr) )
+      return true;
+  }
+  return false;
+}
+
+
+/**
+ * Check if the given IP address is in the list of IP addresses.
+ *
+ * @param list a list of networks
+ * @param ip the IP to check (in network byte order)
+ * @return false if the IP is not in the list, true if it it is
+ */
+static bool
+check_ipv6_listed (const struct GNUNET_STRINGS_IPv6NetworkPolicy *list,
+                   const struct in6_addr *ip)
+{
+  for (unsigned int i = 0;
+       ! GNUNET_is_zero (&list[i].network);
+       i++)
+  {
+    bool match = true;
+    
+    for (unsigned int j = 0; j < sizeof(struct in6_addr) / sizeof(int); j++)
+      if (((((int *) ip)[j] & ((int *) &list[i].netmask)[j])) !=
+          (((int *) &list[i].network)[j] & ((int *) &list[i].netmask)[j]))
+      {
+        match = false;
+        break;
+      }
+    if (match)
+      return true;
+  }
+  return false;
+}
+
+
+/**
+ * Task run when we are ready to transmit data to the
+ * client.
+ *
+ * @param cls the `struct GNUNET_SERVICE_Client *` to send to
+ */
+static void
+do_send (void *cls)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  ssize_t ret;
+  size_t left;
+  const char *buf;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "service: sending message with type %u\n",
+       ntohs (client->msg->type));
+  client->send_task = NULL;
+  buf = (const char *) client->msg;
+  left = ntohs (client->msg->size) - client->msg_pos;
+  ret = GNUNET_NETWORK_socket_send (client->sock,
+                                    &buf[client->msg_pos],
+                                    left);
+  GNUNET_assert (ret <= (ssize_t) left);
+  if (0 == ret)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG, "no data send");
+    GNUNET_MQ_inject_error (client->mq, GNUNET_MQ_ERROR_WRITE);
+    return;
+  }
+  if (-1 == ret)
+  {
+    if ((EAGAIN == errno) || (EINTR == errno))
+    {
+      /* ignore */
+      ret = 0;
+    }
+    else
+    {
+      if (EPIPE != errno)
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "send");
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "socket send returned with error code %i",
+           errno);
+      GNUNET_MQ_inject_error (client->mq, GNUNET_MQ_ERROR_WRITE);
+      return;
+    }
+  }
+  if (0 == client->msg_pos)
+  {
+    GNUNET_MQ_impl_send_in_flight (client->mq);
+  }
+  client->msg_pos += ret;
+  if (left > (size_t) ret)
+  {
+    GNUNET_assert (NULL == client->drop_task);
+    client->send_task =
+      GNUNET_SCHEDULER_add_write_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                      client->sock,
+                                      &do_send,
+                                      client);
+    return;
+  }
+  GNUNET_MQ_impl_send_continue (client->mq);
+}
+
+
+/**
+ * Signature of functions implementing the sending functionality of a
+ * message queue.
+ *
+ * @param mq the message queue
+ * @param msg the message to send
+ * @param impl_state our `struct GNUNET_SERVICE_Client *`
+ */
+static void
+service_mq_send (struct GNUNET_MQ_Handle *mq,
+                 const struct GNUNET_MessageHeader *msg,
+                 void *impl_state)
+{
+  struct GNUNET_SERVICE_Client *client = impl_state;
+
+  (void) mq;
+  if (NULL != client->drop_task)
+    return; /* we're going down right now, do not try to send */
+  GNUNET_assert (NULL == client->send_task);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sending message of type %u and size %u to client\n",
+       ntohs (msg->type),
+       ntohs (msg->size));
+  client->msg = msg;
+  client->msg_pos = 0;
+  client->send_task = GNUNET_SCHEDULER_add_now (&do_send,
+                                                client);
+}
+
+
+/**
+ * Implementation function that cancels the currently sent message.
+ *
+ * @param mq message queue
+ * @param impl_state state specific to the implementation
+ */
+static void
+service_mq_cancel (struct GNUNET_MQ_Handle *mq,
+                   void *impl_state)
+{
+  struct GNUNET_SERVICE_Client *client = impl_state;
+
+  (void) mq;
+  GNUNET_assert (0 == client->msg_pos);
+  client->msg = NULL;
+  GNUNET_SCHEDULER_cancel (client->send_task);
+  client->send_task = NULL;
+}
+
+
+/**
+ * Generic error handler, called with the appropriate
+ * error code and the same closure specified at the creation of
+ * the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with our `struct GNUNET_SERVICE_Client`
+ * @param error error code
+ */
+static void
+service_mq_error_handler (void *cls,
+                          enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct GNUNET_SERVICE_Handle *sh = client->sh;
+
+  if ( (GNUNET_MQ_ERROR_NO_MATCH == error) &&
+       (! sh->require_found) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "No handler for message of type %u found\n",
+                (unsigned int) client->warn_type);
+    GNUNET_SERVICE_client_continue (client);
+    return;   /* ignore error */
+  }
+  GNUNET_SERVICE_client_drop (client);
+}
+
+
+/**
+ * Task run to warn about missing calls to #GNUNET_SERVICE_client_continue().
+ *
+ * @param cls our `struct GNUNET_SERVICE_Client *` to process more requests from
+ */
+static void
+warn_no_client_continue (void *cls)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  GNUNET_break (
+    0 !=
+    client->warn_type); /* type should never be 0 here, as we don't use 0 */
+  client->warn_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MINUTES,
+                                                    &warn_no_client_continue,
+                                                    client);
+  LOG (
+    GNUNET_ERROR_TYPE_WARNING,
+    _ (
+      "Processing code for message of type %u did not call `GNUNET_SERVICE_client_continue' after %s\n"),
+    (unsigned int) client->warn_type,
+    GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_duration (
+                                              client->warn_start),
+                                            GNUNET_YES));
+}
+
+
+/**
+ * Functions with this signature are called whenever a
+ * complete message is received by the tokenizer for a client.
+ *
+ * Do not call #GNUNET_MST_destroy() from within
+ * the scope of this callback.
+ *
+ * @param cls closure with the `struct GNUNET_SERVICE_Client *`
+ * @param message the actual message
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the client was dropped
+ */
+static int
+service_client_mst_cb (void *cls,
+                       const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received message of type %u and size %u from client\n",
+       ntohs (message->type),
+       ntohs (message->size));
+  GNUNET_assert (! client->needs_continue);
+  client->needs_continue = true;
+  client->warn_type = ntohs (message->type);
+  client->warn_start = GNUNET_TIME_absolute_get ();
+  GNUNET_assert (NULL == client->warn_task);
+  client->warn_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MINUTES,
+                                                    &warn_no_client_continue,
+                                                    client);
+  GNUNET_MQ_inject_message (client->mq, message);
+  if (NULL != client->drop_task)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * A client sent us data. Receive and process it.  If we are done,
+ * reschedule this task.
+ *
+ * @param cls the `struct GNUNET_SERVICE_Client` that sent us data.
+ */
+static void
+service_client_recv (void *cls)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  enum GNUNET_GenericReturnValue ret;
+
+  client->recv_task = NULL;
+  ret = GNUNET_MST_read (client->mst,
+                         client->sock,
+                         GNUNET_NO,
+                         GNUNET_YES);
+  if (GNUNET_SYSERR == ret)
+  {
+    /* client closed connection (or IO error) */
+    if (NULL == client->drop_task)
+    {
+      GNUNET_assert (! client->needs_continue);
+      GNUNET_SERVICE_client_drop (client);
+    }
+    return;
+  }
+  if (GNUNET_NO == ret)
+    return; /* more messages in buffer, wait for application
+               to be done processing */
+  GNUNET_assert (GNUNET_OK == ret);
+  if (client->needs_continue)
+    return;
+  if (NULL != client->recv_task)
+    return;
+  /* MST needs more data, re-schedule read job */
+  client->recv_task =
+    GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                   client->sock,
+                                   &service_client_recv,
+                                   client);
+}
+
+
+/**
+ * We have successfully accepted a connection from a client.  Now
+ * setup the client (with the scheduler) and tell the application.
+ *
+ * @param sh service that accepted the client
+ * @param csock socket associated with the client
+ */
+static void
+start_client (struct GNUNET_SERVICE_Handle *sh,
+              struct GNUNET_NETWORK_Handle *csock)
+{
+  struct GNUNET_SERVICE_Client *client;
+
+  client = GNUNET_new (struct GNUNET_SERVICE_Client);
+  GNUNET_CONTAINER_DLL_insert (sh->clients_head,
+                               sh->clients_tail,
+                               client);
+  client->sh = sh;
+  client->sock = csock;
+  client->mq = GNUNET_MQ_queue_for_callbacks (&service_mq_send,
+                                              NULL,
+                                              &service_mq_cancel,
+                                              client,
+                                              sh->handlers,
+                                              &service_mq_error_handler,
+                                              client);
+  client->mst = GNUNET_MST_create (&service_client_mst_cb, client);
+  if (NULL != sh->connect_cb)
+    client->user_context = sh->connect_cb (sh->cb_cls, client, client->mq);
+  GNUNET_MQ_set_handlers_closure (client->mq, client->user_context);
+  client->recv_task =
+    GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                   client->sock,
+                                   &service_client_recv,
+                                   client);
+}
+
+
+/**
+ * We have a client. Accept the incoming socket(s) (and reschedule
+ * the listen task).
+ *
+ * @param cls the `struct ServiceListenContext` of the ready listen socket
+ */
+static void
+accept_client (void *cls)
+{
+  struct ServiceListenContext *slc = cls;
+  struct GNUNET_SERVICE_Handle *sh = slc->sh;
+
+  slc->listen_task = NULL;
+  while (1)
+  {
+    struct GNUNET_NETWORK_Handle *sock;
+    const struct sockaddr_in *v4;
+    const struct sockaddr_in6 *v6;
+    struct sockaddr_storage sa;
+    socklen_t addrlen;
+    int ok;
+
+    addrlen = sizeof(sa);
+    sock = GNUNET_NETWORK_socket_accept (slc->listen_socket,
+                                         (struct sockaddr *) &sa,
+                                         &addrlen);
+    if (NULL == sock)
+    {
+      if (EMFILE == errno)
+        do_suspend (sh, SUSPEND_STATE_EMFILE);
+      else if (EAGAIN != errno)
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                             "accept");
+      break;
+    }
+    switch (sa.ss_family)
+    {
+    case AF_INET:
+      GNUNET_assert (addrlen == sizeof(struct sockaddr_in));
+      v4 = (const struct sockaddr_in *) &sa;
+      ok = (((NULL == sh->v4_allowed) ||
+             (check_ipv4_listed (sh->v4_allowed,
+                                 &v4->sin_addr))) &&
+            ((NULL == sh->v4_denied) ||
+             (! check_ipv4_listed (sh->v4_denied,
+                                   &v4->sin_addr))));
+      break;
+
+    case AF_INET6:
+      GNUNET_assert (addrlen == sizeof(struct sockaddr_in6));
+      v6 = (const struct sockaddr_in6 *) &sa;
+      ok = (((NULL == sh->v6_allowed) ||
+             (check_ipv6_listed (sh->v6_allowed,
+                                 &v6->sin6_addr))) &&
+            ((NULL == sh->v6_denied) ||
+             (! check_ipv6_listed (sh->v6_denied,
+                                   &v6->sin6_addr))));
+      break;
+
+    case AF_UNIX:
+      ok = GNUNET_OK;     /* controlled using file-system ACL now */
+      break;
+
+    default:
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("Unknown address family %d\n"),
+           sa.ss_family);
+      return;
+    }
+    if (! ok)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Service rejected incoming connection from %s due to policy.\n",
+           GNUNET_a2s ((const struct sockaddr *) &sa, addrlen));
+      GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (sock));
+      continue;
+    }
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Service accepted incoming connection from %s.\n",
+         GNUNET_a2s ((const struct sockaddr *) &sa, addrlen));
+    start_client (slc->sh,
+                  sock);
+  }
+  if (0 != sh->suspend_state)
+    return;
+  slc->listen_task =
+    GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                   slc->listen_socket,
+                                   &accept_client,
+                                   slc);
+}
+
+
+/**
+ * Resume accepting connections from the listen socket.
+ *
+ * @param sh service to resume accepting connections.
+ * @param sr reason that is no longer causing the suspension,
+ *           or #SUSPEND_STATE_NONE on first startup
+ */
+static void
+do_resume (struct GNUNET_SERVICE_Handle *sh,
+           enum SuspendReason sr)
+{
+  GNUNET_assert ((SUSPEND_STATE_NONE == sr) || (0 != (sh->suspend_state & sr)));
+  sh->suspend_state -= sr;
+  if (SUSPEND_STATE_NONE != sh->suspend_state)
+    return;
+  for (struct ServiceListenContext *slc = sh->slc_head;
+       NULL != slc;
+       slc = slc->next)
+  {
+    GNUNET_assert (NULL == slc->listen_task);
+    slc->listen_task =
+      GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                     slc->listen_socket,
+                                     &accept_client,
+                                     slc);
+  }
+}
+
+
+/**
+ * First task run by any service.  Initializes our shutdown task,
+ * starts the listening operation on our listen sockets and launches
+ * the custom logic of the application service.
+ *
+ * @param cls our `struct GNUNET_SERVICE_Handle`
+ */
+static void
+service_main (void *cls)
+{
+  struct GNUNET_SERVICE_Handle *sh = cls;
+
+  if (GNUNET_SERVICE_OPTION_MANUAL_SHUTDOWN !=
+      (sh->options & GNUNET_SERVICE_OPTION_SHUTDOWN_BITMASK))
+    GNUNET_SCHEDULER_add_shutdown (&service_shutdown, sh);
+  do_resume (sh, SUSPEND_STATE_NONE);
+
+  if (-1 != sh->ready_confirm_fd)
+  {
+    GNUNET_break (1 == write (sh->ready_confirm_fd, ".", 1));
+    GNUNET_break (0 == close (sh->ready_confirm_fd));
+    sh->ready_confirm_fd = -1;
+  }
+
+  if (NULL != sh->service_init_cb)
+    sh->service_init_cb (sh->cb_cls, sh->cfg, sh);
+}
+
+
+/**
+ * Parse an IPv4 access control list.
+ *
+ * @param ret location where to write the ACL (set)
+ * @param sh service context to use to get the configuration
+ * @param option name of the ACL option to parse
+ * @return #GNUNET_SYSERR on parse error, #GNUNET_OK on success (including
+ *         no ACL configured)
+ */
+static enum GNUNET_GenericReturnValue
+process_acl4 (struct GNUNET_STRINGS_IPv4NetworkPolicy **ret,
+              struct GNUNET_SERVICE_Handle *sh,
+              const char *option)
+{
+  char *opt;
+
+  if (! GNUNET_CONFIGURATION_have_value (sh->cfg, sh->service_name, option))
+  {
+    *ret = NULL;
+    return GNUNET_OK;
+  }
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_CONFIGURATION_get_value_string (sh->cfg,
+                                                       sh->service_name,
+                                                       option,
+                                                       &opt));
+  if (NULL == (*ret = GNUNET_STRINGS_parse_ipv4_policy (opt)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Could not parse IPv4 network specification `%s' for `%s:%s'\n"),
+         opt,
+         sh->service_name,
+         option);
+    GNUNET_free (opt);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (opt);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse an IPv6 access control list.
+ *
+ * @param ret location where to write the ACL (set)
+ * @param sh service context to use to get the configuration
+ * @param option name of the ACL option to parse
+ * @return #GNUNET_SYSERR on parse error, #GNUNET_OK on success (including
+ *         no ACL configured)
+ */
+static enum GNUNET_GenericReturnValue
+process_acl6 (struct GNUNET_STRINGS_IPv6NetworkPolicy **ret,
+              struct GNUNET_SERVICE_Handle *sh,
+              const char *option)
+{
+  char *opt;
+
+  if (! GNUNET_CONFIGURATION_have_value (sh->cfg, sh->service_name, option))
+  {
+    *ret = NULL;
+    return GNUNET_OK;
+  }
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_CONFIGURATION_get_value_string (sh->cfg,
+                                                       sh->service_name,
+                                                       option,
+                                                       &opt));
+  if (NULL == (*ret = GNUNET_STRINGS_parse_ipv6_policy (opt)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Could not parse IPv6 network specification `%s' for `%s:%s'\n"),
+         opt,
+         sh->service_name,
+         option);
+    GNUNET_free (opt);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (opt);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add the given UNIX domain path as an address to the
+ * list (as the first entry).
+ *
+ * @param saddrs array to update
+ * @param saddrlens where to store the address length
+ * @param unixpath path to add
+ */
+static void
+add_unixpath (struct sockaddr **saddrs,
+              socklen_t *saddrlens,
+              const char *unixpath)
+{
+#ifdef AF_UNIX
+  struct sockaddr_un *un;
+
+  un = GNUNET_new (struct sockaddr_un);
+  un->sun_family = AF_UNIX;
+  GNUNET_strlcpy (un->sun_path, unixpath, sizeof(un->sun_path));
+#if HAVE_SOCKADDR_UN_SUN_LEN
+  un->sun_len = (u_char) sizeof(struct sockaddr_un);
+#endif
+  *saddrs = (struct sockaddr *) un;
+  *saddrlens = sizeof(struct sockaddr_un);
+#else
+  /* this function should never be called
+   * unless AF_UNIX is defined! */
+  GNUNET_assert (0);
+#endif
+}
+
+
+/**
+ * Get the list of addresses that a server for the given service
+ * should bind to.
+ *
+ * @param service_name name of the service
+ * @param cfg configuration (which specifies the addresses)
+ * @param addrs set (call by reference) to an array of pointers to the
+ *              addresses the server should bind to and listen on; the
+ *              array will be NULL-terminated (on success)
+ * @param addr_lens set (call by reference) to an array of the lengths
+ *              of the respective `struct sockaddr` struct in the @a addrs
+ *              array (on success)
+ * @return number of addresses found on success,
+ *              #GNUNET_SYSERR if the configuration
+ *              did not specify reasonable finding information or
+ *              if it specified a hostname that could not be resolved;
+ *              #GNUNET_NO if the number of addresses configured is
+ *              zero (in this case, `*addrs` and `*addr_lens` will be
+ *              set to NULL).
+ */
+static int
+get_server_addresses (const char *service_name,
+                      const struct GNUNET_CONFIGURATION_Handle *cfg,
+                      struct sockaddr ***addrs,
+                      socklen_t **addr_lens)
+{
+  int disablev6;
+  struct GNUNET_NETWORK_Handle *desc;
+  unsigned long long port;
+  char *unixpath;
+  struct addrinfo hints;
+  struct addrinfo *res;
+  struct addrinfo *pos;
+  struct addrinfo *next;
+  unsigned int i;
+  int resi;
+  int ret;
+  struct sockaddr **saddrs;
+  socklen_t *saddrlens;
+  char *hostname;
+
+  *addrs = NULL;
+  *addr_lens = NULL;
+  desc = NULL;
+  disablev6 = GNUNET_NO;
+  if ((GNUNET_NO == GNUNET_NETWORK_test_pf (PF_INET6)) ||
+      (GNUNET_YES ==
+       GNUNET_CONFIGURATION_get_value_yesno (cfg, service_name, "DISABLEV6")))
+    disablev6 = GNUNET_YES;
+
+  port = 0;
+  if (GNUNET_CONFIGURATION_have_value (cfg, service_name, "PORT"))
+  {
+    if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                            service_name,
+                                                            "PORT",
+                                                            &port))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Require valid port number for service `%s' in configuration!\n"),
+           service_name);
+    }
+    if (port > 65535)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Require valid port number for service `%s' in configuration!\n"),
+           service_name);
+      return GNUNET_SYSERR;
+    }
+  }
+
+  if (GNUNET_CONFIGURATION_have_value (cfg, service_name, "BINDTO"))
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                         service_name,
+                                                         "BINDTO",
+                                                         &hostname));
+  }
+  else
+    hostname = NULL;
+
+  unixpath = NULL;
+#ifdef AF_UNIX
+  if ((GNUNET_YES ==
+       GNUNET_CONFIGURATION_have_value (cfg, service_name, "UNIXPATH")) &&
+      (GNUNET_OK == GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                             service_name,
+                                                             "UNIXPATH",
+                                                             &unixpath)) &&
+      (0 < strlen (unixpath)))
+  {
+    /* probe UNIX support */
+    struct sockaddr_un s_un;
+
+    if (strlen (unixpath) >= sizeof(s_un.sun_path))
+    {
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("UNIXPATH `%s' too long, maximum length is %llu\n"),
+           unixpath,
+           (unsigned long long) sizeof(s_un.sun_path));
+      unixpath = GNUNET_NETWORK_shorten_unixpath (unixpath);
+      LOG (GNUNET_ERROR_TYPE_INFO, _ ("Using `%s' instead\n"), unixpath);
+    }
+    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (unixpath))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "mkdir", unixpath);
+  }
+  if (NULL != unixpath)
+  {
+    desc = GNUNET_NETWORK_socket_create (AF_UNIX, SOCK_STREAM, 0);
+    if (NULL == desc)
+    {
+      if ((ENOBUFS == errno) || (ENOMEM == errno) || (ENFILE == errno) ||
+          (EACCES == errno))
+      {
+        LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "socket");
+        GNUNET_free (hostname);
+        GNUNET_free (unixpath);
+        return GNUNET_SYSERR;
+      }
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ (
+             "Disabling UNIX domain socket support for service `%s', failed to create UNIX domain socket: %s\n"),
+           service_name,
+           strerror (errno));
+      GNUNET_free (unixpath);
+      unixpath = NULL;
+    }
+    else
+    {
+      GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (desc));
+      desc = NULL;
+    }
+  }
+#endif
+
+  if ((0 == port) && (NULL == unixpath))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ (
+           "Have neither PORT nor UNIXPATH for service `%s', but one is required\n"),
+         service_name);
+    GNUNET_free (hostname);
+    return GNUNET_SYSERR;
+  }
+  if (0 == port)
+  {
+    saddrs = GNUNET_new_array (2, struct sockaddr *);
+    saddrlens = GNUNET_new_array (2, socklen_t);
+    add_unixpath (saddrs, saddrlens, unixpath);
+    GNUNET_free (unixpath);
+    GNUNET_free (hostname);
+    *addrs = saddrs;
+    *addr_lens = saddrlens;
+    return 1;
+  }
+
+  if (NULL != hostname)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Resolving `%s' since that is where `%s' will bind to.\n",
+         hostname,
+         service_name);
+    memset (&hints, 0, sizeof(struct addrinfo));
+    if (disablev6)
+      hints.ai_family = AF_INET;
+    hints.ai_protocol = IPPROTO_TCP;
+    if ((0 != (ret = getaddrinfo (hostname, NULL, &hints, &res))) ||
+        (NULL == res))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Failed to resolve `%s': %s\n"),
+           hostname,
+           gai_strerror (ret));
+      GNUNET_free (hostname);
+      GNUNET_free (unixpath);
+      return GNUNET_SYSERR;
+    }
+    next = res;
+    i = 0;
+    while (NULL != (pos = next))
+    {
+      next = pos->ai_next;
+      if ((disablev6) && (pos->ai_family == AF_INET6))
+        continue;
+      i++;
+    }
+    if (0 == i)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Failed to find %saddress for `%s'.\n"),
+           disablev6 ? "IPv4 " : "",
+           hostname);
+      freeaddrinfo (res);
+      GNUNET_free (hostname);
+      GNUNET_free (unixpath);
+      return GNUNET_SYSERR;
+    }
+    resi = i;
+    if (NULL != unixpath)
+      resi++;
+    saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+    saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+    i = 0;
+    if (NULL != unixpath)
+    {
+      add_unixpath (saddrs, saddrlens, unixpath);
+      i++;
+    }
+    next = res;
+    while (NULL != (pos = next))
+    {
+      next = pos->ai_next;
+      if ((disablev6) && (AF_INET6 == pos->ai_family))
+        continue;
+      if ((IPPROTO_TCP != pos->ai_protocol) && (0 != pos->ai_protocol))
+        continue;     /* not TCP */
+      if ((SOCK_STREAM != pos->ai_socktype) && (0 != pos->ai_socktype))
+        continue;     /* huh? */
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Service `%s' will bind to `%s'\n",
+           service_name,
+           GNUNET_a2s (pos->ai_addr, pos->ai_addrlen));
+      if (AF_INET == pos->ai_family)
+      {
+        GNUNET_assert (sizeof(struct sockaddr_in) == pos->ai_addrlen);
+        saddrlens[i] = pos->ai_addrlen;
+        saddrs[i] = GNUNET_malloc (saddrlens[i]);
+        GNUNET_memcpy (saddrs[i], pos->ai_addr, saddrlens[i]);
+        ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+      }
+      else
+      {
+        GNUNET_assert (AF_INET6 == pos->ai_family);
+        GNUNET_assert (sizeof(struct sockaddr_in6) == pos->ai_addrlen);
+        saddrlens[i] = pos->ai_addrlen;
+        saddrs[i] = GNUNET_malloc (saddrlens[i]);
+        GNUNET_memcpy (saddrs[i], pos->ai_addr, saddrlens[i]);
+        ((struct sockaddr_in6 *) saddrs[i])->sin6_port = htons (port);
+      }
+      i++;
+    }
+    GNUNET_free (hostname);
+    freeaddrinfo (res);
+    resi = i;
+  }
+  else
+  {
+    /* will bind against everything, just set port */
+    if (disablev6)
+    {
+      /* V4-only */
+      resi = 1;
+      if (NULL != unixpath)
+        resi++;
+      i = 0;
+      saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+      saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+      if (NULL != unixpath)
+      {
+        add_unixpath (saddrs, saddrlens, unixpath);
+        i++;
+      }
+      saddrlens[i] = sizeof(struct sockaddr_in);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[i];
+#endif
+      ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+      ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+    }
+    else
+    {
+      /* dual stack */
+      resi = 2;
+      if (NULL != unixpath)
+        resi++;
+      saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+      saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+      i = 0;
+      if (NULL != unixpath)
+      {
+        add_unixpath (saddrs, saddrlens, unixpath);
+        i++;
+      }
+      saddrlens[i] = sizeof(struct sockaddr_in6);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_len = saddrlens[0];
+#endif
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_family = AF_INET6;
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_port = htons (port);
+      i++;
+      saddrlens[i] = sizeof(struct sockaddr_in);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[1];
+#endif
+      ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+      ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+    }
+  }
+  GNUNET_free (unixpath);
+  *addrs = saddrs;
+  *addr_lens = saddrlens;
+  return resi;
+}
+
+
+/**
+ * Create and initialize a listen socket for the server.
+ *
+ * @param server_addr address to listen on
+ * @param socklen length of @a server_addr
+ * @return NULL on error, otherwise the listen socket
+ */
+static struct GNUNET_NETWORK_Handle *
+open_listen_socket (const struct sockaddr *server_addr,
+                    socklen_t socklen)
+{
+  struct GNUNET_NETWORK_Handle *sock;
+  uint16_t port;
+  int eno;
+
+  switch (server_addr->sa_family)
+  {
+  case AF_INET:
+    port = ntohs (((const struct sockaddr_in *) server_addr)->sin_port);
+    break;
+  case AF_INET6:
+    port = ntohs (((const struct sockaddr_in6 *) server_addr)->sin6_port);
+    break;
+  case AF_UNIX:
+    port = 0;
+    break;
+  default:
+    GNUNET_break (0);
+    port = 0;
+    break;
+  }
+  sock = GNUNET_NETWORK_socket_create (server_addr->sa_family,
+                                       SOCK_STREAM,
+                                       0);
+  if (NULL == sock)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "socket");
+    errno = 0;
+    return NULL;
+  }
+  /* bind the socket */
+  if (GNUNET_OK !=
+      GNUNET_NETWORK_socket_bind (sock,
+                                  server_addr,
+                                  socklen))
+  {
+    eno = errno;
+    if (EADDRINUSE != errno)
+    {
+      /* we don't log 'EADDRINUSE' here since an IPv4 bind may
+       * fail if we already took the port on IPv6; if both IPv4 and
+       * IPv6 binds fail, then our caller will log using the
+       * errno preserved in 'eno' */
+      if (0 != port)
+        LOG (GNUNET_ERROR_TYPE_ERROR,
+             _ ("`%s' failed for port %d (%s).\n"),
+             "bind",
+             port,
+             (AF_INET == server_addr->sa_family) ? "IPv4" : "IPv6");
+      else
+        LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "bind");
+      eno = 0;
+    }
+    else
+    {
+      if (0 != port)
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             _ ("`%s' failed for port %d (%s): address already in use\n"),
+             "bind",
+             port,
+             (AF_INET == server_addr->sa_family) ? "IPv4" : "IPv6");
+      else if (AF_UNIX == server_addr->sa_family)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             _ ("`%s' failed for `%s': address already in use\n"),
+             "bind",
+             GNUNET_a2s (server_addr, socklen));
+      }
+    }
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (sock));
+    errno = eno;
+    return NULL;
+  }
+  if (GNUNET_OK != GNUNET_NETWORK_socket_listen (sock, 5))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "listen");
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (sock));
+    errno = 0;
+    return NULL;
+  }
+  if (0 != port)
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Server starts to listen on port %u.\n",
+         port);
+  return sock;
+}
+
+
+/**
+ * Setup service handle
+ *
+ * Configuration may specify:
+ * - PORT (where to bind to for TCP)
+ * - UNIXPATH (where to bind to for UNIX domain sockets)
+ * - DISABLEV6 (disable support for IPv6, otherwise we use dual-stack)
+ * - BINDTO (hostname or IP address to bind to, otherwise we take everything)
+ * - ACCEPT_FROM  (only allow connections from specified IPv4 subnets)
+ * - ACCEPT_FROM6 (only allow connections from specified IPv6 subnets)
+ * - REJECT_FROM  (disallow allow connections from specified IPv4 subnets)
+ * - REJECT_FROM6 (disallow allow connections from specified IPv6 subnets)
+ *
+ * @param sh service context to initialize
+ * @return #GNUNET_OK if configuration succeeded
+ */
+static enum GNUNET_GenericReturnValue
+setup_service (struct GNUNET_SERVICE_Handle *sh)
+{
+  int tolerant;
+  struct GNUNET_NETWORK_Handle **csocks = NULL;
+  struct GNUNET_NETWORK_Handle **lsocks;
+  const char *nfds;
+  unsigned int cnt;
+  int flags;
+  char dummy[2];
+
+  if (GNUNET_CONFIGURATION_have_value (sh->cfg,
+                                       sh->service_name,
+                                       "TOLERANT"))
+  {
+    if (GNUNET_SYSERR ==
+        (tolerant = GNUNET_CONFIGURATION_get_value_yesno (sh->cfg,
+                                                          sh->service_name,
+                                                          "TOLERANT")))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Specified value for `%s' of service `%s' is invalid\n"),
+           "TOLERANT",
+           sh->service_name);
+      return GNUNET_SYSERR;
+    }
+  }
+  else
+    tolerant = GNUNET_NO;
+
+  lsocks = NULL;
+  errno = 0;
+  if ( (NULL != (nfds = getenv ("LISTEN_FDS"))) &&
+       (1 == sscanf (nfds, "%u%1s", &cnt, dummy)) && (cnt > 0) &&
+      (cnt < FD_SETSIZE) && (cnt + 4 < FD_SETSIZE))
+  {
+    lsocks = GNUNET_new_array (cnt + 1, struct GNUNET_NETWORK_Handle *);
+    while (0 < cnt--)
+    {
+      flags = fcntl (3 + cnt, F_GETFD);
+      if ((flags < 0) || (0 != (flags & FD_CLOEXEC)) ||
+          (NULL == (lsocks[cnt] = GNUNET_NETWORK_socket_box_native (3 + cnt))))
+      {
+        LOG (GNUNET_ERROR_TYPE_ERROR,
+             _ (
+               "Could not access pre-bound socket %u, will try to bind myself\n"),
+             (unsigned int) 3 + cnt);
+        cnt++;
+        while (NULL != lsocks[cnt])
+          GNUNET_break (GNUNET_OK ==
+                        GNUNET_NETWORK_socket_close (lsocks[cnt++]));
+        GNUNET_free (lsocks);
+        lsocks = NULL;
+        break;
+      }
+    }
+    unsetenv ("LISTEN_FDS");
+  }
+  if ( (0 != (GNUNET_SERVICE_OPTION_CLOSE_LSOCKS & sh->options)) &&
+       (NULL != lsocks) )
+  {
+    csocks = lsocks;
+    lsocks = NULL;
+  }
+
+  if (NULL != lsocks)
+  {
+    /* listen only on inherited sockets if we have any */
+    for (struct GNUNET_NETWORK_Handle **ls = lsocks; NULL != *ls; ls++)
+    {
+      struct ServiceListenContext *slc;
+
+      slc = GNUNET_new (struct ServiceListenContext);
+      slc->sh = sh;
+      slc->listen_socket = *ls;
+      GNUNET_CONTAINER_DLL_insert (sh->slc_head,
+                                   sh->slc_tail,
+                                   slc);
+    }
+    GNUNET_free (lsocks);
+  }
+  else
+  {
+    struct sockaddr **addrs;
+    socklen_t *addrlens;
+    int num;
+
+    num = get_server_addresses (sh->service_name, sh->cfg, &addrs, &addrlens);
+    if (GNUNET_SYSERR == num)
+      return GNUNET_SYSERR;
+
+    for (int i = 0; i < num; i++)
+    {
+      struct ServiceListenContext *slc;
+
+      slc = GNUNET_new (struct ServiceListenContext);
+      slc->sh = sh;
+      slc->listen_socket = open_listen_socket (addrs[i],
+                                               addrlens[i]);
+      GNUNET_free (addrs[i]);
+      if (NULL == slc->listen_socket)
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "bind");
+        GNUNET_free (slc);
+        continue;
+      }
+      GNUNET_CONTAINER_DLL_insert (sh->slc_head,
+                                   sh->slc_tail,
+                                   slc);
+    }
+    GNUNET_free (addrlens);
+    GNUNET_free (addrs);
+    if ((0 != num) && (NULL == sh->slc_head))
+    {
+      /* All attempts to bind failed, hard failure */
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_ERROR,
+        _ (
+          "Could not bind to any of the ports I was supposed to, refusing to run!\n"));
+      GNUNET_free (csocks);
+      return GNUNET_SYSERR;
+    }
+  }
+  if (NULL != csocks)
+  {
+    /* close inherited sockets to signal parent that we are ready */
+    for (struct GNUNET_NETWORK_Handle **ls = csocks; NULL != *ls; ls++)
+      GNUNET_NETWORK_socket_close (*ls);
+    GNUNET_free (csocks);
+  }
+  sh->require_found = (GNUNET_NO == tolerant);
+  sh->match_uid = GNUNET_CONFIGURATION_get_value_yesno (sh->cfg,
+                                                        sh->service_name,
+                                                        "UNIX_MATCH_UID");
+  sh->match_gid = GNUNET_CONFIGURATION_get_value_yesno (sh->cfg,
+                                                        sh->service_name,
+                                                        "UNIX_MATCH_GID");
+  process_acl4 (&sh->v4_denied, sh, "REJECT_FROM");
+  process_acl4 (&sh->v4_allowed, sh, "ACCEPT_FROM");
+  process_acl6 (&sh->v6_denied, sh, "REJECT_FROM6");
+  process_acl6 (&sh->v6_allowed, sh, "ACCEPT_FROM6");
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get the name of the user that'll be used
+ * to provide the service.
+ *
+ * @param sh service context
+ * @return value of the 'USERNAME' option
+ */
+static char *
+get_user_name (struct GNUNET_SERVICE_Handle *sh)
+{
+  char *un;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (sh->cfg,
+                                               sh->service_name,
+                                               "USERNAME",
+                                               &un))
+    return NULL;
+  return un;
+}
+
+
+/**
+ * Set user ID.
+ *
+ * @param sh service context
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+set_user_id (struct GNUNET_SERVICE_Handle *sh)
+{
+  char *user;
+  struct passwd *pws;
+
+  if (NULL == (user = get_user_name (sh)))
+    return GNUNET_OK; /* keep */
+  errno = 0;
+  pws = getpwnam (user);
+  if (NULL == pws)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Cannot obtain information about user `%s': %s\n"),
+         user,
+         errno == 0 ? _ ("No such user") : strerror (errno));
+    GNUNET_free (user);
+    return GNUNET_SYSERR;
+  }
+  if ((0 != setgid (pws->pw_gid)) || (0 != setegid (pws->pw_gid)) ||
+#if HAVE_INITGROUPS
+      (0 != initgroups (user, pws->pw_gid)) ||
+#endif
+      (0 != setuid (pws->pw_uid)) ||
+      (0 != seteuid (pws->pw_uid)))
+  {
+    if ((0 != setregid (pws->pw_gid, pws->pw_gid)) ||
+        (0 != setreuid (pws->pw_uid, pws->pw_uid)))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Cannot change user/group to `%s': %s\n"),
+           user,
+           strerror (errno));
+      GNUNET_free (user);
+      return GNUNET_SYSERR;
+    }
+  }
+
+  GNUNET_free (user);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get the name of the file where we will
+ * write the PID of the service.
+ *
+ * @param sh service context
+ * @return name of the file for the process ID
+ */
+static char *
+get_pid_file_name (struct GNUNET_SERVICE_Handle *sh)
+{
+  char *pif;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (sh->cfg,
+                                               sh->service_name,
+                                               "PIDFILE",
+                                               &pif))
+    return NULL;
+  return pif;
+}
+
+
+/**
+ * Delete the PID file that was created by our parent.
+ *
+ * @param sh service context
+ */
+static void
+pid_file_delete (struct GNUNET_SERVICE_Handle *sh)
+{
+  char *pif = get_pid_file_name (sh);
+
+  if (NULL == pif)
+    return; /* no PID file */
+  if (0 != unlink (pif))
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING,
+                       "unlink",
+                       pif);
+  GNUNET_free (pif);
+}
+
+
+/**
+ * Detach from terminal.
+ *
+ * @param sh service context
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+detach_terminal (struct GNUNET_SERVICE_Handle *sh)
+{
+  pid_t pid;
+  int nullfd;
+  int filedes[2];
+
+  if (0 != pipe (filedes))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "pipe");
+    return GNUNET_SYSERR;
+  }
+  pid = fork ();
+  if (pid < 0)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "fork");
+    return GNUNET_SYSERR;
+  }
+  if (0 != pid)
+  {
+    /* Parent */
+    char c;
+
+    GNUNET_break (0 == close (filedes[1]));
+    c = 'X';
+    if (1 != read (filedes[0], &c, sizeof(char)))
+      LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                    "read");
+    fflush (stdout);
+    switch (c)
+    {
+    case '.':
+      exit (0);
+
+    case 'I':
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ ("Service process failed to initialize\n"));
+      break;
+
+    case 'S':
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ ("Service process could not initialize server function\n"));
+      break;
+
+    case 'X':
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ ("Service process failed to report status\n"));
+      break;
+    }
+    exit (1);  /* child reported error */
+  }
+  GNUNET_break (0 == close (0));
+  GNUNET_break (0 == close (1));
+  GNUNET_break (0 == close (filedes[0]));
+  nullfd = open ("/dev/null", O_RDWR | O_APPEND);
+  if (nullfd < 0)
+    return GNUNET_SYSERR;
+  /* set stdin/stdout to /dev/null */
+  if ((dup2 (nullfd, 0) < 0) || (dup2 (nullfd, 1) < 0))
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "dup2");
+    (void) close (nullfd);
+    return GNUNET_SYSERR;
+  }
+  (void) close (nullfd);
+  /* Detach from controlling terminal */
+  pid = setsid ();
+  if (-1 == pid)
+    LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                  "setsid");
+  sh->ready_confirm_fd = filedes[1];
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Tear down the service, closing the listen sockets and
+ * freeing the ACLs.
+ *
+ * @param sh handle to the service to tear down.
+ */
+static void
+teardown_service (struct GNUNET_SERVICE_Handle *sh)
+{
+  struct ServiceListenContext *slc;
+
+  GNUNET_free (sh->v4_denied);
+  GNUNET_free (sh->v6_denied);
+  GNUNET_free (sh->v4_allowed);
+  GNUNET_free (sh->v6_allowed);
+  while (NULL != (slc = sh->slc_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (sh->slc_head,
+                                 sh->slc_tail,
+                                 slc);
+    if (NULL != slc->listen_task)
+      GNUNET_SCHEDULER_cancel (slc->listen_task);
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (slc->listen_socket));
+    GNUNET_free (slc);
+  }
+}
+
+
+/**
+ * Function to return link to AGPL source upon request.
+ *
+ * @param cls closure with the identification of the client
+ * @param msg AGPL request
+ */
+static void
+return_agpl (void *cls,
+             const struct GNUNET_MessageHeader *msg)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct GNUNET_MQ_Handle *mq;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *res;
+  size_t slen;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+
+  (void) msg;
+  slen = strlen (pd->agpl_url) + 1;
+  env = GNUNET_MQ_msg_extra (res,
+                             GNUNET_MESSAGE_TYPE_RESPONSE_AGPL, slen);
+  memcpy (&res[1],
+          GNUNET_AGPL_URL,
+          slen);
+  mq = GNUNET_SERVICE_client_get_mq (client);
+  GNUNET_MQ_send (mq, env);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+struct GNUNET_SERVICE_Handle *
+GNUNET_SERVICE_start (const char *service_name,
+                      const struct GNUNET_CONFIGURATION_Handle *cfg,
+                      GNUNET_SERVICE_ConnectHandler connect_cb,
+                      GNUNET_SERVICE_DisconnectHandler disconnect_cb,
+                      void *cls,
+                      const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct GNUNET_SERVICE_Handle *sh;
+
+  sh = GNUNET_new (struct GNUNET_SERVICE_Handle);
+  sh->service_name = service_name;
+  sh->cfg = cfg;
+  sh->connect_cb = connect_cb;
+  sh->disconnect_cb = disconnect_cb;
+  sh->cb_cls = cls;
+  sh->handlers = GNUNET_MQ_copy_handlers2 (handlers,
+                                           &return_agpl,
+                                           NULL);
+  if (GNUNET_OK != setup_service (sh))
+  {
+    GNUNET_free (sh->handlers);
+    GNUNET_free (sh);
+    return NULL;
+  }
+  do_resume (sh,
+             SUSPEND_STATE_NONE);
+  return sh;
+}
+
+
+/**
+ * Asynchronously finish dropping the client.
+ *
+ * @param cls the `struct GNUNET_SERVICE_Client`.
+ */
+static void
+finish_client_drop (void *cls)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+  struct GNUNET_SERVICE_Handle *sh = c->sh;
+
+  c->drop_task = NULL;
+  GNUNET_CONTAINER_DLL_remove (sh->clients_head,
+                               sh->clients_tail,
+                               c);
+  GNUNET_assert (NULL == c->send_task);
+  GNUNET_assert (NULL == c->recv_task);
+  GNUNET_assert (NULL == c->warn_task);
+  GNUNET_MST_destroy (c->mst);
+  GNUNET_MQ_destroy (c->mq);
+  if (! c->persist)
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (c->sock));
+    if ((0 != (SUSPEND_STATE_EMFILE & sh->suspend_state)) &&
+        (0 == (SUSPEND_STATE_SHUTDOWN & sh->suspend_state)))
+      do_resume (sh,
+                 SUSPEND_STATE_EMFILE);
+  }
+  else
+  {
+    GNUNET_NETWORK_socket_free_memory_only_ (c->sock);
+  }
+  GNUNET_free (c);
+  if ((0 != (SUSPEND_STATE_SHUTDOWN & sh->suspend_state)) &&
+      (! have_non_monitor_clients (sh)))
+    GNUNET_SERVICE_shutdown (sh);
+}
+
+
+void
+GNUNET_SERVICE_stop (struct GNUNET_SERVICE_Handle *srv)
+{
+  struct GNUNET_SERVICE_Client *client;
+
+  GNUNET_SERVICE_suspend (srv);
+  while (NULL != (client = srv->clients_head))
+  {
+    if (NULL == client->drop_task)
+      GNUNET_SERVICE_client_drop (client);
+    GNUNET_SCHEDULER_cancel (client->drop_task);
+    finish_client_drop (client);
+  }
+  teardown_service (srv);
+  GNUNET_free (srv->handlers);
+  GNUNET_free (srv);
+}
+
+
+int
+GNUNET_SERVICE_run_ (int argc,
+                     char *const *argv,
+                     const char *service_name,
+                     enum GNUNET_SERVICE_Options options,
+                     GNUNET_SERVICE_InitCallback service_init_cb,
+                     GNUNET_SERVICE_ConnectHandler connect_cb,
+                     GNUNET_SERVICE_DisconnectHandler disconnect_cb,
+                     void *cls,
+                     const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct GNUNET_SERVICE_Handle sh;
+
+#if ENABLE_NLS
+  char *path;
+#endif
+  char *cfg_filename;
+  char *opt_cfg_filename;
+  char *loglev;
+  const char *xdg;
+  char *logfile;
+  int do_daemonize;
+  unsigned long long skew_offset;
+  unsigned long long skew_variance;
+  long long clock_offset;
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  int ret;
+  int err;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  struct GNUNET_GETOPT_CommandLineOption service_options[] = {
+    GNUNET_GETOPT_option_cfgfile (&opt_cfg_filename),
+    GNUNET_GETOPT_option_flag ('d',
+                               "daemonize",
+                               gettext_noop (
+                                 "do daemonize (detach from terminal)"),
+                               &do_daemonize),
+    GNUNET_GETOPT_option_help (NULL),
+    GNUNET_GETOPT_option_loglevel (&loglev),
+    GNUNET_GETOPT_option_logfile (&logfile),
+    GNUNET_GETOPT_option_version (pd->version),
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  err = 1;
+  memset (&sh, 0, sizeof(sh));
+  xdg = getenv ("XDG_CONFIG_HOME");
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfg_filename,
+                     "%s%s%s",
+                     xdg,
+                     DIR_SEPARATOR_STR,
+                     pd->config_file);
+  else
+    cfg_filename = GNUNET_strdup (pd->user_config_file);
+  sh.ready_confirm_fd = -1;
+  sh.options = options;
+  sh.cfg = cfg = GNUNET_CONFIGURATION_create ();
+  sh.service_init_cb = service_init_cb;
+  sh.connect_cb = connect_cb;
+  sh.disconnect_cb = disconnect_cb;
+  sh.cb_cls = cls;
+  sh.handlers = (NULL == pd->agpl_url)
+                ? GNUNET_MQ_copy_handlers (handlers)
+                : GNUNET_MQ_copy_handlers2 (handlers, &return_agpl, NULL);
+  sh.service_name = service_name;
+  /* setup subsystems */
+  loglev = NULL;
+  logfile = NULL;
+  opt_cfg_filename = NULL;
+  do_daemonize = 0;
+#if ENABLE_NLS
+  if (NULL != pd->gettext_domain)
+  {
+    setlocale (LC_ALL, "");
+    path = (NULL == pd->gettext_path) ?
+           GNUNET_OS_installation_get_path (GNUNET_OS_IPK_LOCALEDIR) :
+           GNUNET_strdup (pd->gettext_path);
+    if (NULL != path)
+    {
+      bindtextdomain (pd->gettext_domain, path);
+      GNUNET_free (path);
+    }
+    textdomain (pd->gettext_domain);
+  }
+#endif
+  ret = GNUNET_GETOPT_run (service_name,
+                           service_options,
+                           argc,
+                           argv);
+  if (GNUNET_SYSERR == ret)
+    goto shutdown;
+  if (GNUNET_NO == ret)
+  {
+    err = 0;
+    goto shutdown;
+  }
+  if (GNUNET_OK != GNUNET_log_setup (service_name,
+                                     loglev,
+                                     logfile))
+  {
+    GNUNET_break (0);
+    goto shutdown;
+  }
+  if (NULL != opt_cfg_filename)
+  {
+    if ((GNUNET_YES != GNUNET_DISK_file_test (opt_cfg_filename)) ||
+        (GNUNET_SYSERR == GNUNET_CONFIGURATION_load (cfg, opt_cfg_filename)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Malformed configuration file `%s', exit ...\n"),
+                  opt_cfg_filename);
+      goto shutdown;
+    }
+  }
+  else
+  {
+    if (GNUNET_YES ==
+        GNUNET_DISK_file_test (cfg_filename))
+    {
+      if (GNUNET_SYSERR ==
+          GNUNET_CONFIGURATION_load (cfg,
+                                     cfg_filename))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Malformed configuration file `%s', exit ...\n"),
+                    cfg_filename);
+        goto shutdown;
+      }
+    }
+    else
+    {
+      if (GNUNET_SYSERR ==
+          GNUNET_CONFIGURATION_load (cfg,
+                                     NULL))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Malformed configuration, exit ...\n"));
+        goto shutdown;
+      }
+    }
+  }
+  if (GNUNET_OK != setup_service (&sh))
+    goto shutdown;
+  if ( (1 == do_daemonize) &&
+       (GNUNET_OK != detach_terminal (&sh)) )
+  {
+    GNUNET_break (0);
+    goto shutdown;
+  }
+  if (GNUNET_OK != set_user_id (&sh))
+    goto shutdown;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Service `%s' runs with configuration from `%s'\n",
+       service_name,
+       (NULL != opt_cfg_filename) ? opt_cfg_filename : cfg_filename);
+  if ( (GNUNET_OK ==
+        GNUNET_CONFIGURATION_get_value_number (sh.cfg,
+                                               "TESTING",
+                                               "SKEW_OFFSET",
+                                               &skew_offset)) &&
+       (GNUNET_OK ==
+        GNUNET_CONFIGURATION_get_value_number (sh.cfg,
+                                               "TESTING",
+                                               "SKEW_VARIANCE",
+                                               &skew_variance)) )
+  {
+    clock_offset = skew_offset - skew_variance;
+    GNUNET_TIME_set_offset (clock_offset);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Skewing clock by %lld ms\n",
+         (long long) clock_offset);
+  }
+  GNUNET_RESOLVER_connect (sh.cfg);
+
+  /* actually run service */
+  err = 0;
+  GNUNET_SCHEDULER_run (&service_main, &sh);
+  /* shutdown */
+  if (1 == do_daemonize)
+    pid_file_delete (&sh);
+
+shutdown:
+  if (-1 != sh.ready_confirm_fd)
+  {
+    if (1 != write (sh.ready_confirm_fd, err ? "I" : "S", 1))
+      LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING, "write");
+    GNUNET_break (0 == close (sh.ready_confirm_fd));
+  }
+#if HAVE_MALLINFO2
+  {
+    char *counter;
+
+    if ( (GNUNET_YES ==
+          GNUNET_CONFIGURATION_have_value (sh.cfg,
+                                           service_name,
+                                           "GAUGER_HEAP")) &&
+         (GNUNET_OK ==
+          GNUNET_CONFIGURATION_get_value_string (sh.cfg,
+                                                 service_name,
+                                                 "GAUGER_HEAP",
+                                                 &counter)))
+    {
+      struct mallinfo2 mi;
+
+      mi = mallinfo2 ();
+      GAUGER (service_name,
+              counter,
+              mi.usmblks,
+              "blocks");
+      GNUNET_free (counter);
+    }
+  }
+#endif
+  teardown_service (&sh);
+  GNUNET_free (sh.handlers);
+  GNUNET_SPEEDUP_stop_ ();
+  GNUNET_CONFIGURATION_destroy (cfg);
+  GNUNET_free (logfile);
+  GNUNET_free (loglev);
+  GNUNET_free (cfg_filename);
+  GNUNET_free (opt_cfg_filename);
+
+  return err ? GNUNET_SYSERR : 0;
+}
+
+
+/**
+ * A list of service to be launched when GNUNET_SERVICE_main()
+ * is called
+ */
+struct ServiceHandleList
+{
+  /* DLL */
+  struct ServiceHandleList *prev;
+
+  /* DLL */
+  struct ServiceHandleList *next;
+
+  /* Handle to the service to launch */
+  struct GNUNET_SERVICE_Handle *sh;
+};
+
+/* The service list */
+static struct ServiceHandleList *hll_head;
+
+/* The service list */
+static struct ServiceHandleList *hll_tail;
+
+
+int
+GNUNET_SERVICE_register_ (const char *service_name,
+                          enum GNUNET_SERVICE_Options options,
+                          GNUNET_SERVICE_InitCallback service_init_cb,
+                          GNUNET_SERVICE_ConnectHandler connect_cb,
+                          GNUNET_SERVICE_DisconnectHandler disconnect_cb,
+                          void *cls,
+                          const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct ServiceHandleList *hle;
+  struct GNUNET_SERVICE_Handle *sh = GNUNET_new (struct GNUNET_SERVICE_Handle);
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+
+  sh->ready_confirm_fd = -1;
+  sh->options = options;
+  sh->service_init_cb = service_init_cb;
+  sh->connect_cb = connect_cb;
+  sh->disconnect_cb = disconnect_cb;
+  sh->cb_cls = cls;
+  sh->handlers = (NULL == pd->agpl_url)
+                ? GNUNET_MQ_copy_handlers (handlers)
+                : GNUNET_MQ_copy_handlers2 (handlers, &return_agpl, NULL);
+  sh->service_name = service_name;
+  hle = GNUNET_new (struct ServiceHandleList);
+  hle->sh = sh;
+  GNUNET_CONTAINER_DLL_insert (hll_head,
+                               hll_tail,
+                               hle);
+  return 0;
+}
+
+
+static void
+do_registered_services_shutdown (void *cls)
+{
+  while (NULL != hll_head)
+  {
+    struct ServiceHandleList *shl = hll_head;
+    struct GNUNET_SERVICE_Handle *sh = shl->sh;
+
+    GNUNET_CONTAINER_DLL_remove (hll_head,
+                                 hll_tail,
+                                 shl);
+    GNUNET_free (shl);
+    if (-1 != sh->ready_confirm_fd)
+    {
+      if (1 != write (sh->ready_confirm_fd, "S", 1))
+        LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                      "write");
+      GNUNET_break (0 ==
+                    close (sh->ready_confirm_fd));
+    }
+    teardown_service (sh);
+    GNUNET_free (sh->handlers);
+    GNUNET_free (sh);
+  }
+}
+
+
+static void
+launch_registered_services (void *cls)
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+
+  for (struct ServiceHandleList *shl = hll_head;
+       NULL != shl;
+       shl = shl->next)
+  {
+    shl->sh->cfg = cfg;
+    if (GNUNET_OK != setup_service (shl->sh))
+      continue;
+    if (GNUNET_OK != set_user_id (shl->sh))
+      continue;
+    GNUNET_SCHEDULER_add_now (&service_main,
+                              shl->sh);
+  }
+  GNUNET_SCHEDULER_add_shutdown (&do_registered_services_shutdown,
+                                 NULL);
+}
+
+
+void
+GNUNET_SERVICE_main (int argc,
+                     char *const *argv)
+{
+  char *cfg_filename;
+  char *opt_cfg_filename;
+  char *logfile;
+  char *loglev;
+  const char *xdg;
+  int do_daemonize;
+  int ret;
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  struct GNUNET_GETOPT_CommandLineOption service_options[] = {
+    GNUNET_GETOPT_option_cfgfile (&opt_cfg_filename),
+    GNUNET_GETOPT_option_flag ('d',
+                               "daemonize",
+                               gettext_noop (
+                                 "do daemonize (detach from terminal)"),
+                               &do_daemonize),
+    GNUNET_GETOPT_option_help (NULL),
+    GNUNET_GETOPT_option_loglevel (&loglev),
+    GNUNET_GETOPT_option_logfile (&logfile),
+    GNUNET_GETOPT_option_version (pd->version),
+    GNUNET_GETOPT_OPTION_END
+  };
+  
+  xdg = getenv ("XDG_CONFIG_HOME");
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfg_filename,
+                     "%s%s%s",
+                     xdg,
+                     DIR_SEPARATOR_STR,
+                     pd->config_file);
+  else
+    cfg_filename = GNUNET_strdup (pd->user_config_file);
+  cfg = GNUNET_CONFIGURATION_create ();
+  // FIXME we need to set this up for each service!
+  ret = GNUNET_GETOPT_run ("libgnunet",
+                           service_options,
+                           argc,
+                           argv);
+  if (GNUNET_SYSERR == ret)
+    goto shutdown;
+  if (GNUNET_NO == ret)
+  {
+    goto shutdown;
+  }
+  // FIXME we need to set this up for each service!
+  // NOTE: that was not the idea. What are you proposing? -CG
+  if (GNUNET_OK !=
+      GNUNET_log_setup ("libgnunet",
+                        loglev,
+                        logfile))
+  {
+    GNUNET_break (0);
+    goto shutdown;
+  }
+  if (NULL != opt_cfg_filename)
+  {
+    if ( (GNUNET_YES !=
+          GNUNET_DISK_file_test (opt_cfg_filename)) ||
+         (GNUNET_SYSERR ==
+          GNUNET_CONFIGURATION_load (cfg,
+                                     opt_cfg_filename)) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Malformed configuration file `%s', exit ...\n"),
+                  opt_cfg_filename);
+      goto shutdown;
+    }
+  }
+  else
+  {
+    if (GNUNET_YES ==
+        GNUNET_DISK_file_test (cfg_filename))
+    {
+      if (GNUNET_SYSERR ==
+          GNUNET_CONFIGURATION_load (cfg,
+                                     cfg_filename))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Malformed configuration file `%s', exit ...\n"),
+                    cfg_filename);
+        GNUNET_free (cfg_filename);
+        return;
+      }
+    }
+    else
+    {
+      if (GNUNET_SYSERR ==
+          GNUNET_CONFIGURATION_load (cfg,
+                                     NULL))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Malformed configuration, exit ...\n"));
+        GNUNET_free (cfg_filename);
+        return;
+      }
+    }
+  }
+  GNUNET_RESOLVER_connect (cfg);
+
+  GNUNET_SCHEDULER_run (&launch_registered_services,
+                        cfg);
+shutdown:
+  GNUNET_SPEEDUP_stop_ ();
+  GNUNET_CONFIGURATION_destroy (cfg);
+  GNUNET_free (logfile);
+  GNUNET_free (loglev);
+  GNUNET_free (cfg_filename);
+  GNUNET_free (opt_cfg_filename);
+}
+
+
+void
+GNUNET_SERVICE_suspend (struct GNUNET_SERVICE_Handle *sh)
+{
+  do_suspend (sh,
+              SUSPEND_STATE_APP);
+}
+
+
+void
+GNUNET_SERVICE_resume (struct GNUNET_SERVICE_Handle *sh)
+{
+  do_resume (sh,
+             SUSPEND_STATE_APP);
+}
+
+
+/**
+ * Task run to resume receiving data from the client after
+ * the client called #GNUNET_SERVICE_client_continue().
+ *
+ * @param cls our `struct GNUNET_SERVICE_Client`
+ */
+static void
+resume_client_receive (void *cls)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+  int ret;
+
+  c->recv_task = NULL;
+  /* first, check if there is still something in the buffer */
+  ret = GNUNET_MST_next (c->mst,
+                         GNUNET_YES);
+  if (GNUNET_SYSERR == ret)
+  {
+    if (NULL == c->drop_task)
+      GNUNET_SERVICE_client_drop (c);
+    return;
+  }
+  if (GNUNET_NO == ret)
+    return; /* done processing, wait for more later */
+  GNUNET_assert (GNUNET_OK == ret);
+  if (c->needs_continue)
+    return; /* #GNUNET_MST_next() did give a message to the client */
+  /* need to receive more data from the network first */
+  if (NULL != c->recv_task)
+    return;
+  c->recv_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                                c->sock,
+                                                &service_client_recv,
+                                                c);
+}
+
+
+void
+GNUNET_SERVICE_client_continue (struct GNUNET_SERVICE_Client *c)
+{
+  GNUNET_assert (NULL == c->drop_task);
+  GNUNET_assert (c->needs_continue);
+  GNUNET_assert (NULL == c->recv_task);
+  c->needs_continue = false;
+  if (NULL != c->warn_task)
+  {
+    GNUNET_SCHEDULER_cancel (c->warn_task);
+    c->warn_task = NULL;
+  }
+  c->recv_task = GNUNET_SCHEDULER_add_now (&resume_client_receive,
+                                           c);
+}
+
+
+void
+GNUNET_SERVICE_client_disable_continue_warning (struct GNUNET_SERVICE_Client *c)
+{
+  GNUNET_break (NULL != c->warn_task);
+  if (NULL != c->warn_task)
+  {
+    GNUNET_SCHEDULER_cancel (c->warn_task);
+    c->warn_task = NULL;
+  }
+}
+
+
+void
+GNUNET_SERVICE_client_drop (struct GNUNET_SERVICE_Client *c)
+{
+  struct GNUNET_SERVICE_Handle *sh = c->sh;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client dropped: %p (MQ: %p)\n",
+              c,
+              c->mq);
+#if EXECINFO
+  {
+    void *backtrace_array[MAX_TRACE_DEPTH];
+    int num_backtrace_strings = backtrace (backtrace_array,
+                                           MAX_TRACE_DEPTH);
+    char **backtrace_strings =
+      backtrace_symbols (backtrace_array,
+                         t->num_backtrace_strings);
+    for (unsigned int i = 0; i < num_backtrace_strings; i++)
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "client drop trace %u: %s\n",
+           i,
+           backtrace_strings[i]);
+  }
+#endif
+  GNUNET_assert (NULL == c->drop_task);
+  if (NULL != sh->disconnect_cb)
+    sh->disconnect_cb (sh->cb_cls,
+                       c,
+                       c->user_context);
+  if (NULL != c->warn_task)
+  {
+    GNUNET_SCHEDULER_cancel (c->warn_task);
+    c->warn_task = NULL;
+  }
+  if (NULL != c->recv_task)
+  {
+    GNUNET_SCHEDULER_cancel (c->recv_task);
+    c->recv_task = NULL;
+  }
+  if (NULL != c->send_task)
+  {
+    GNUNET_SCHEDULER_cancel (c->send_task);
+    c->send_task = NULL;
+  }
+  c->drop_task = GNUNET_SCHEDULER_add_now (&finish_client_drop,
+                                           c);
+}
+
+
+void
+GNUNET_SERVICE_shutdown (struct GNUNET_SERVICE_Handle *sh)
+{
+  if (0 == (sh->suspend_state & SUSPEND_STATE_SHUTDOWN))
+    do_suspend (sh,
+                SUSPEND_STATE_SHUTDOWN);
+  for (struct GNUNET_SERVICE_Client *client = sh->clients_head;
+       NULL != client;
+       client = client->next)
+  {
+    if (NULL == client->drop_task)
+      GNUNET_SERVICE_client_drop (client);
+  }
+}
+
+
+void
+GNUNET_SERVICE_client_mark_monitor (struct GNUNET_SERVICE_Client *c)
+{
+  c->is_monitor = true;
+  if (((0 != (SUSPEND_STATE_SHUTDOWN & c->sh->suspend_state)) &&
+       (! have_non_monitor_clients (c->sh))))
+    GNUNET_SERVICE_shutdown (c->sh);
+}
+
+
+void
+GNUNET_SERVICE_client_persist (struct GNUNET_SERVICE_Client *c)
+{
+  c->persist = true;
+}
+
+
+struct GNUNET_MQ_Handle *
+GNUNET_SERVICE_client_get_mq (struct GNUNET_SERVICE_Client *c)
+{
+  return c->mq;
+}
+
+
+/* end of service.c */
diff --git a/src/lib/util/signal.c b/src/lib/util/signal.c
new file mode 100644
index 000000000..67849a7d6
--- /dev/null
+++ b/src/lib/util/signal.c
@@ -0,0 +1,110 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/signal.c
+ * @brief code for installing and uninstalling signal handlers
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-signal", __VA_ARGS__)
+
+
+struct GNUNET_SIGNAL_Context
+{
+  struct GNUNET_SIGNAL_Context *next;
+
+  struct GNUNET_SIGNAL_Context *prev;
+
+  int sig;
+
+  GNUNET_SIGNAL_Handler method;
+
+  struct sigaction oldsig;
+};
+
+static struct GNUNET_SIGNAL_Context *sc_head;
+
+static struct GNUNET_SIGNAL_Context *sc_tail;
+
+struct GNUNET_SIGNAL_Context *
+GNUNET_SIGNAL_handler_install (int signum, GNUNET_SIGNAL_Handler handler)
+{
+  struct GNUNET_SIGNAL_Context *ret;
+
+  struct sigaction sig;
+
+  ret = GNUNET_new (struct GNUNET_SIGNAL_Context);
+  ret->sig = signum;
+  ret->method = handler;
+
+  memset (&sig, 0, sizeof(sig));
+  sig.sa_handler = (void *) handler;
+  sigemptyset (&sig.sa_mask);
+#ifdef SA_INTERRUPT
+  sig.sa_flags = SA_INTERRUPT;  /* SunOS */
+#else
+  sig.sa_flags = SA_RESTART;
+#endif
+  sigaction (signum, &sig, &ret->oldsig);
+
+  GNUNET_CONTAINER_DLL_insert_tail (sc_head, sc_tail, ret);
+  return ret;
+}
+
+
+void
+GNUNET_SIGNAL_handler_uninstall (struct GNUNET_SIGNAL_Context *ctx)
+{
+  struct sigaction sig;
+
+  sigemptyset (&sig.sa_mask);
+  sigaction (ctx->sig, &ctx->oldsig, &sig);
+
+  GNUNET_CONTAINER_DLL_remove (sc_head, sc_tail, ctx);
+  GNUNET_free (ctx);
+}
+
+
+/**
+ * Raise the given signal by calling the installed signal handlers.  This will
+ * not use the @em raise() system call but only calls the handlers registered
+ * through GNUNET_SIGNAL_handler_install().
+ *
+ * @param sig the signal to raise
+ */
+void
+GNUNET_SIGNAL_raise (const int sig)
+{
+  struct GNUNET_SIGNAL_Context *ctx;
+
+  for (ctx = sc_head; NULL != ctx; ctx = ctx->next)
+  {
+    if (sig != ctx->sig)
+      continue;
+    if (NULL == ctx->method)
+      continue;
+    ctx->method ();
+  }
+}
diff --git a/src/lib/util/socks.c b/src/lib/util/socks.c
new file mode 100644
index 000000000..ffde8a667
--- /dev/null
+++ b/src/lib/util/socks.c
@@ -0,0 +1,690 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/socks.c
+ * @brief  SOCKS5 connection support
+ * @author Jeffrey Burdges
+ *
+ * These routines should be called only on newly active connections.
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-socks", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util-socks", syscall)
+
+
+/* SOCKS5 authentication methods */
+#define SOCKS5_AUTH_REJECT 0xFF /* No acceptable auth method */
+#define SOCKS5_AUTH_NOAUTH 0x00 /* without authentication */
+#define SOCKS5_AUTH_GSSAPI 0x01 /* GSSAPI */
+#define SOCKS5_AUTH_USERPASS 0x02 /* User/Password */
+#define SOCKS5_AUTH_CHAP 0x03 /* Challenge-Handshake Auth Proto. */
+#define SOCKS5_AUTH_EAP 0x05 /* Extensible Authentication Proto. */
+#define SOCKS5_AUTH_MAF 0x08 /* Multi-Authentication Framework */
+
+
+/* SOCKS5 connection responses */
+#define SOCKS5_REP_SUCCEEDED 0x00 /* succeeded */
+#define SOCKS5_REP_FAIL 0x01 /* general SOCKS serer failure */
+#define SOCKS5_REP_NALLOWED 0x02 /* connection not allowed by ruleset */
+#define SOCKS5_REP_NUNREACH 0x03 /* Network unreachable */
+#define SOCKS5_REP_HUNREACH 0x04 /* Host unreachable */
+#define SOCKS5_REP_REFUSED 0x05 /* connection refused */
+#define SOCKS5_REP_EXPIRED 0x06 /* TTL expired */
+#define SOCKS5_REP_CNOTSUP 0x07 /* Command not supported */
+#define SOCKS5_REP_ANOTSUP 0x08 /* Address not supported */
+#define SOCKS5_REP_INVADDR 0x09 /* Invalid address */
+
+const char *
+SOCKS5_REP_names (int rep)
+{
+  switch (rep)
+  {
+  case SOCKS5_REP_SUCCEEDED:
+    return "succeeded";
+
+  case SOCKS5_REP_FAIL:
+    return "general SOCKS server failure";
+
+  case SOCKS5_REP_NALLOWED:
+    return "connection not allowed by ruleset";
+
+  case SOCKS5_REP_NUNREACH:
+    return "Network unreachable";
+
+  case SOCKS5_REP_HUNREACH:
+    return "Host unreachable";
+
+  case SOCKS5_REP_REFUSED:
+    return "connection refused";
+
+  case SOCKS5_REP_EXPIRED:
+    return "TTL expired";
+
+  case SOCKS5_REP_CNOTSUP:
+    return "Command not supported";
+
+  case SOCKS5_REP_ANOTSUP:
+    return "Address not supported";
+
+  case SOCKS5_REP_INVADDR:
+    return "Invalid address";
+
+  default:
+    return NULL;
+  }
+};
+
+
+/**
+ * Encode a string for the SOCKS5 protocol by prefixing it a byte stating its
+ * length and stripping the trailing zero byte.  Truncates any string longer
+ * than 255 bytes.
+ *
+ * @param b buffer to contain the encoded string
+ * @param s string to encode
+ * @return pointer to the end of the encoded string in the buffer
+ */
+unsigned char *
+SOCK5_proto_string (unsigned char *b, const char *s)
+{
+  size_t l = strlen (s);
+
+  if (l > 255)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "SOCKS5 cannot handle hostnames, usernames, or passwords over 255 bytes, truncating.\n");
+    l = 255;
+  }
+  *(b++) = (unsigned char) l;
+  memcpy (b, s, l);
+  return b + l;
+}
+
+
+#define SOCKS5_step_greet 0
+#define SOCKS5_step_auth 1
+#define SOCKS5_step_cmd 2
+#define SOCKS5_step_done 3
+
+/**
+ * State of the SOCKS5 handshake.
+ */
+struct GNUNET_SOCKS_Handshake
+{
+  /**
+   * Connection handle used for SOCKS5
+   */
+  struct GNUNET_CONNECTION_Handle *socks5_connection;
+
+  /**
+   * Connection handle initially returned to client
+   */
+  struct GNUNET_CONNECTION_Handle *target_connection;
+
+  /**
+   * Transmission handle on socks5_connection.
+   */
+  struct GNUNET_CONNECTION_TransmitHandle *th;
+
+  /**
+   * Our stage in the SOCKS5 handshake
+   */
+  int step;
+
+  /**
+   * Precomputed SOCKS5 handshake output buffer
+   */
+  unsigned char outbuf[1024];
+
+  /**
+   * Pointers delineating protoocol steps in the output buffer
+   */
+  unsigned char *(outstep[4]);
+
+  /**
+   * SOCKS5 handshake input buffer
+   */
+  unsigned char inbuf[1024];
+
+  /**
+   * Pointers delimiting the current step in the input buffer
+   */
+  unsigned char *instart;
+  unsigned char *inend;
+};
+
+
+/* Registering prototypes */
+
+void
+register_reciever (struct GNUNET_SOCKS_Handshake *ih, int want);
+
+/* In fact, the client sends first rule in GNUnet suggests one could take
+ * large mac read sizes without fear of screwing up the proxied protocol,
+ * but we make a proper SOCKS5 client. */
+#define register_reciever_wants(ih) ((SOCKS5_step_cmd == ih->step) ? 10 : 2)
+
+
+struct GNUNET_CONNECTION_TransmitHandle *
+register_sender (struct GNUNET_SOCKS_Handshake *ih);
+
+
+/**
+ * Conclude the SOCKS5 handshake successfully.
+ *
+ * @param ih SOCKS5 handshake, consumed here.
+ * @param c open unused connection, consumed here.
+ * @return Connection handle that becomes usable when the handshake completes.
+ */
+void
+SOCKS5_handshake_done (struct GNUNET_SOCKS_Handshake *ih)
+{
+  GNUNET_CONNECTION_acivate_proxied (ih->target_connection);
+}
+
+
+/**
+ * Read one step in the SOCKS5 handshake.
+ *
+ * @param ih SOCKS5 Handshake
+ */
+void
+SOCKS5_handshake_step (struct GNUNET_SOCKS_Handshake *ih)
+{
+  unsigned char *b = ih->instart;
+  size_t available = ih->inend - b;
+
+  int want = register_reciever_wants (ih);
+
+  if (available < want)
+  {
+    register_reciever (ih, want - available);
+    return;
+  }
+  GNUNET_assert (SOCKS5_step_done > ih->step && ih->step >= 0);
+  switch (ih->step)
+  {
+  case SOCKS5_step_greet:   /* SOCKS5 server's greeting */
+    if (b[0] != 5)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR, "Not a SOCKS5 server\n");
+      GNUNET_assert (0);
+    }
+    switch (b[1])
+    {
+    case SOCKS5_AUTH_NOAUTH:
+      ih->step = SOCKS5_step_cmd;     /* no authentication to do */
+      break;
+
+    case SOCKS5_AUTH_USERPASS:
+      ih->step = SOCKS5_step_auth;
+      break;
+
+    case SOCKS5_AUTH_REJECT:
+      LOG (GNUNET_ERROR_TYPE_ERROR, "No authentication method accepted\n");
+      return;
+
+    default:
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "Not a SOCKS5 server / Nonsensical authentication\n");
+      return;
+    }
+    b += 2;
+    break;
+
+  case SOCKS5_step_auth:   /* SOCKS5 server's response to authentication */
+    if (b[1] != 0)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR, "SOCKS5 authentication failed\n");
+      GNUNET_assert (0);
+    }
+    ih->step = SOCKS5_step_cmd;
+    b += 2;
+    break;
+
+  case SOCKS5_step_cmd:   /* SOCKS5 server's response to command */
+    if (b[0] != 5)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR, "SOCKS5 protocol error\n");
+      GNUNET_assert (0);
+    }
+    if (0 != b[1])
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "SOCKS5 connection error : %s\n",
+           SOCKS5_REP_names (b[1]));
+      return;
+    }
+    b += 3;
+    /* There is no reason to verify host and port afaik. */
+    switch (*(b++))
+    {
+    case 1:     /* IPv4 */
+      b += sizeof(struct in_addr);     /* 4 */
+      break;
+
+    case 4:     /* IPv6 */
+      b += sizeof(struct in6_addr);     /* 16 */
+      break;
+
+    case 3:     /* hostname */
+      b += *b;
+      break;
+    }
+    b += 2;   /* port */
+    if (b > ih->inend)
+    {
+      register_reciever (ih, b - ih->inend);
+      return;
+    }
+    ih->step = SOCKS5_step_done;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "SOCKS5 server : %s\n",
+         SOCKS5_REP_names (b[1]));
+    ih->instart = b;
+    SOCKS5_handshake_done (ih);
+    return;
+
+  case SOCKS5_step_done:
+    GNUNET_assert (0);
+  }
+  ih->instart = b;
+  /* Do not reschedule the sender unless we're done reading.
+   * I imagine this lets us avoid ever cancelling the transmit handle. */
+  register_sender (ih);
+}
+
+
+/**
+ * Callback to read from the SOCKS5 proxy.
+ *
+ * @param client the service
+ * @param handler function to call with the message
+ * @param handler_cls closure for @a handler
+ */
+void
+receiver (void *cls,
+          const void *buf,
+          size_t available,
+          const struct sockaddr *addr,
+          socklen_t addrlen,
+          int errCode)
+{
+  struct GNUNET_SOCKS_Handshake *ih = cls;
+
+  GNUNET_assert (&ih->inend[available] < &ih->inbuf[1024]);
+  GNUNET_memcpy (ih->inend, buf, available);
+  ih->inend += available;
+  SOCKS5_handshake_step (ih);
+}
+
+
+/**
+ * Register callback to read from the SOCKS5 proxy.
+ *
+ * @param client the service
+ * @param handler function to call with the message
+ * @param handler_cls closure for @a handler
+ */
+void
+register_reciever (struct GNUNET_SOCKS_Handshake *ih, int want)
+{
+  GNUNET_CONNECTION_receive (ih->socks5_connection,
+                             want,
+                             GNUNET_TIME_relative_get_minute_ (),
+                             &receiver,
+                             ih);
+}
+
+
+/**
+ * Register SOCKS5 handshake sender
+ *
+ * @param cls closure (SOCKS handshake)
+ * @param size number of bytes available in @a buf
+ * @param buf where the callee should write the message
+ * @return number of bytes written to @a buf
+ */
+size_t
+transmit_ready (void *cls, size_t size, void *buf)
+{
+  struct GNUNET_SOCKS_Handshake *ih = cls;
+
+  /* connection.c has many routines that call us with buf == NULL :
+   * signal_transmit_error() - DNS, etc. active
+   *   connect_fail_continuation()
+   *     connect_probe_continuation() - timeout
+   *     try_connect_using_address() - DNS failure/timeout
+   *     transmit_timeout() - retry failed?
+   * GNUNET_CONNECTION_notify_transmit_ready() can schedule :
+   *   transmit_timeout() - DNS still working
+   *   connect_error() - DNS done but no socket?
+   * transmit_ready() - scheduler shutdown or timeout, or signal_transmit_error()
+   * We'd need to dig into the scheduler to guess at the reason, as
+   * connection.c tells us nothing itself, but mostly its timouts.
+   * Initially, we'll simply ignore this and leave massive timeouts, but
+   * maybe that should change for error handling pruposes.  It appears that
+   * successful operations, including DNS resolution, do not use this.  */if (NULL == buf)
+  {
+    if (0 == ih->step)
+    {
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           "Timeout contacting SOCKS server, retrying indefinitely, but probably hopeless.\n");
+      register_sender (ih);
+    }
+    else
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "Timeout during mid SOCKS handshake (step %u), probably not a SOCKS server.\n",
+           ih->step);
+      GNUNET_break (0);
+    }
+    return 0;
+  }
+
+  GNUNET_assert ((1024 >= size) && (size > 0));
+  GNUNET_assert ((SOCKS5_step_done > ih->step) && (ih->step >= 0));
+  unsigned char *b = ih->outstep[ih->step];
+  unsigned char *e = ih->outstep[ih->step + 1];
+  GNUNET_assert (e <= &ih->outbuf[1024]);
+  unsigned int l = e - b;
+  GNUNET_assert (size >= l);
+  GNUNET_memcpy (buf, b, l);
+  register_reciever (ih, register_reciever_wants (ih));
+  return l;
+}
+
+
+/**
+ * Register SOCKS5 handshake sender
+ *
+ * @param ih handshake
+ * @return non-NULL if the notify callback was queued,
+ *         NULL if we are already going to notify someone else (busy)
+ */
+struct GNUNET_CONNECTION_TransmitHandle *
+register_sender (struct GNUNET_SOCKS_Handshake *ih)
+{
+  struct GNUNET_TIME_Relative timeout = GNUNET_TIME_UNIT_MINUTES;
+
+  GNUNET_assert (SOCKS5_step_done > ih->step);
+  GNUNET_assert (ih->step >= 0);
+  if (0 == ih->step)
+    timeout = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 3);
+  unsigned char *b = ih->outstep[ih->step];
+  unsigned char *e = ih->outstep[ih->step + 1];
+  GNUNET_assert (ih->outbuf <= b && b < e && e < &ih->outbuf[1024]);
+  ih->th = GNUNET_CONNECTION_notify_transmit_ready (ih->socks5_connection,
+                                                    e - b,
+                                                    timeout,
+                                                    &transmit_ready,
+                                                    ih);
+  return ih->th;
+}
+
+
+/**
+ * Initialize a SOCKS5 handshake for authentication via username and
+ * password.  Tor uses SOCKS username and password authentication to assign
+ * programs unique circuits.
+ *
+ * @param user username for the proxy
+ * @param pass password for the proxy
+ * @return Valid SOCKS5 hanbdshake handle
+ */
+struct GNUNET_SOCKS_Handshake *
+GNUNET_SOCKS_init_handshake (const char *user, const char *pass)
+{
+  struct GNUNET_SOCKS_Handshake *ih =
+    GNUNET_new (struct GNUNET_SOCKS_Handshake);
+  unsigned char *b = ih->outbuf;
+
+  ih->outstep[SOCKS5_step_greet] = b;
+  *(b++) = 5; /* SOCKS5 */
+  unsigned char *n = b++;
+  *n = 1; /* Number of authentication methods */
+  /* We support no authentication even when requesting authentication,
+   * but this appears harmless, given the way that Tor uses authentication.
+   * And some SOCKS5 servers might require this.  */
+  *(b++) = SOCKS5_AUTH_NOAUTH;
+  if (NULL != user)
+  {
+    *(b++) = SOCKS5_AUTH_USERPASS;
+    (*n)++;
+  }
+  /* There is no apparent reason to support authentication methods beyond
+   * username and password since afaik Tor does not support them. */
+
+  /* We authenticate with an empty username and password if the server demands
+   * them but we do not have any. */
+  if (user == NULL)
+    user = "";
+  if (pass == NULL)
+    pass = "";
+
+  ih->outstep[SOCKS5_step_auth] = b;
+  *(b++) = 1; /* subnegotiation ver.: 1 */
+  b = SOCK5_proto_string (b, user);
+  b = SOCK5_proto_string (b, pass);
+
+  ih->outstep[SOCKS5_step_cmd] = b;
+
+  ih->inend = ih->instart = ih->inbuf;
+
+  return ih;
+}
+
+
+/**
+ * Initialize a SOCKS5 handshake without authentication, thereby possibly
+ * sharing a Tor circuit with another process.
+ *
+ * @return Valid SOCKS5 hanbdshake handle
+ */
+struct GNUNET_SOCKS_Handshake *
+GNUNET_SOCKS_init_handshake_noauth ()
+{
+  return GNUNET_SOCKS_init_handshake (NULL, NULL);
+}
+
+
+/**
+ * Build request that the SOCKS5 proxy open a TCP/IP stream to the given host
+ * and port.
+ *
+ * @param ih SOCKS5 handshake
+ * @param host
+ * @param port
+ */
+void
+GNUNET_SOCKS_set_handshake_destination (struct GNUNET_SOCKS_Handshake *ih,
+                                        const char *host,
+                                        uint16_t port)
+{
+  union
+  {
+    struct in_addr in4;
+    struct in6_addr in6;
+  } ia;
+  unsigned char *b = ih->outstep[SOCKS5_step_cmd];
+
+  *(b++) = 5; /* SOCKS5 */
+  *(b++) = 1; /* Establish a TCP/IP stream */
+  *(b++) = 0; /* reserved */
+
+  /* Specify destination */
+  if (1 == inet_pton (AF_INET, host, &ia.in4))
+  {
+    *(b++) = 1;   /* IPv4 */
+    GNUNET_memcpy (b, &ia.in4, sizeof(struct in_addr));
+    b += sizeof(struct in_addr);   /* 4 */
+  }
+  else if (1 == inet_pton (AF_INET6, host, &ia.in6))
+  {
+    *(b++) = 4;   /* IPv6 */
+    GNUNET_memcpy (b, &ia.in6, sizeof(struct in6_addr));
+    b += sizeof(struct in6_addr);   /* 16 */
+  }
+  else
+  {
+    *(b++) = 3;   /* hostname */
+    b = SOCK5_proto_string (b, host);
+  }
+
+  /* Specify port */
+  *(uint16_t *) b = htons (port);
+  b += 2;
+
+  ih->outstep[SOCKS5_step_done] = b;
+}
+
+
+/**
+ * Run a SOCKS5 handshake on an open but unused TCP connection.
+ *
+ * @param ih SOCKS5 handshake, consumed here.
+ * @param c open unused connection, consumed here.
+ * @return Connection handle that becomes usable when the SOCKS5 handshake completes.
+ */
+struct GNUNET_CONNECTION_Handle *
+GNUNET_SOCKS_run_handshake (struct GNUNET_SOCKS_Handshake *ih,
+                            struct GNUNET_CONNECTION_Handle *c)
+{
+  ih->socks5_connection = c;
+  ih->target_connection = GNUNET_CONNECTION_create_proxied_from_handshake (c);
+  register_sender (ih);
+
+  return ih->target_connection;
+}
+
+
+/**
+ * Check if a SOCKS proxy is required by a service.  Do not use local service
+ * if a SOCKS proxy port is configured as this could deanonymize a user.
+ *
+ * @param service_name name of service to connect to
+ * @param cfg configuration to use
+ * @return GNUNET_YES if so, GNUNET_NO if not
+ */
+int
+GNUNET_SOCKS_check_service (const char *service_name,
+                            const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  return GNUNET_CONFIGURATION_have_value (cfg, service_name, "SOCKSPORT") ||
+         GNUNET_CONFIGURATION_have_value (cfg, service_name, "SOCKSHOST");
+}
+
+
+/**
+ * Try to connect to a service configured to use a SOCKS5 proxy.
+ *
+ * @param service_name name of service to connect to
+ * @param cfg configuration to use
+ * @return Connection handle that becomes usable when the handshake completes.
+ *         NULL if SOCKS not configured or not configured properly
+ */
+struct GNUNET_CONNECTION_Handle *
+GNUNET_SOCKS_do_connect (const char *service_name,
+                         const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_SOCKS_Handshake *ih;
+  struct GNUNET_CONNECTION_Handle *socks5; /* *proxied */
+  char *host0;
+  char *host1;
+  char *user;
+  char *pass;
+  unsigned long long port0;
+  unsigned long long port1;
+
+  if (GNUNET_YES != GNUNET_SOCKS_check_service (service_name, cfg))
+    return NULL;
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                          service_name,
+                                                          "SOCKSPORT",
+                                                          &port0))
+    port0 = 9050;
+  /* A typical Tor client should usually try port 9150 for the TBB too, but
+   * GNUnet can probably assume a system Tor installation. */
+  if ((port0 > 65535) || (port0 <= 0))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ (
+           "Attempting to use invalid port %d as SOCKS proxy for service `%s'.\n"),
+         port0,
+         service_name);
+    return NULL;
+  }
+  if ((GNUNET_OK != GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                           service_name,
+                                                           "PORT",
+                                                           &port1)) ||
+      (port1 > 65535) || (port1 <= 0) ||
+      (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                           service_name,
+                                                           "HOSTNAME",
+                                                           &host1)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ (
+           "Attempting to proxy service `%s' to invalid port %d or hostname.\n"),
+         service_name,
+         port1);
+    return NULL;
+  }
+  /* Appeared to still work after host0 corrupted, so either test case is broken, or
+     this whole routine is not being called. */
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          service_name,
+                                                          "SOCKSHOST",
+                                                          &host0))
+    host0 = NULL;
+  socks5 = GNUNET_CONNECTION_create_from_connect (cfg,
+                                                  (host0 != NULL) ? host0
+                                                  : "127.0.0.1",
+                                                  port0);
+  GNUNET_free (host0);
+
+  /* Sets to NULL if they do not exist */
+  (void) GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                service_name,
+                                                "SOCKSUSER",
+                                                &user);
+  (void) GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                service_name,
+                                                "SOCKSPASS",
+                                                &pass);
+  ih = GNUNET_SOCKS_init_handshake (user, pass);
+  GNUNET_free (user);
+  GNUNET_free (pass);
+
+  GNUNET_SOCKS_set_handshake_destination (ih, host1, port1);
+  GNUNET_free (host1);
+  return GNUNET_SOCKS_run_handshake (ih, socks5);
+}
+
+
+/* socks.c */
diff --git a/src/lib/util/speedup.c b/src/lib/util/speedup.c
new file mode 100644
index 000000000..02719e56e
--- /dev/null
+++ b/src/lib/util/speedup.c
@@ -0,0 +1,114 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/speedup.c
+ * @author Matthias Wachs
+ * @brief functions to speedup peer execution by manipulation system time
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "speedup.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-speedup", __VA_ARGS__)
+
+
+static struct GNUNET_TIME_Relative interval;
+
+static struct GNUNET_TIME_Relative delta;
+
+static struct GNUNET_SCHEDULER_Task *speedup_task;
+
+
+static void
+do_speedup (void *cls)
+{
+  static long long current_offset;
+
+  (void) cls;
+  speedup_task = NULL;
+  current_offset += delta.rel_value_us;
+  GNUNET_TIME_set_offset (current_offset);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Speeding up execution time by %s\n",
+       GNUNET_STRINGS_relative_time_to_string (delta, GNUNET_NO));
+  speedup_task = GNUNET_SCHEDULER_add_delayed (interval,
+                                               &do_speedup,
+                                               NULL);
+}
+
+
+int
+GNUNET_SPEEDUP_start_ (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  GNUNET_assert (NULL == speedup_task);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_time (cfg,
+                                           "testing",
+                                           "SPEEDUP_INTERVAL",
+                                           &interval))
+    return GNUNET_SYSERR;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_time (cfg,
+                                           "testing",
+                                           "SPEEDUP_DELTA",
+                                           &delta))
+    return GNUNET_SYSERR;
+
+  if ((0 == interval.rel_value_us) ||
+      (0 == delta.rel_value_us))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Speed up disabled\n");
+    return GNUNET_OK;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Speed up execution by %s\n",
+       GNUNET_STRINGS_relative_time_to_string (delta, GNUNET_NO));
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Speed up executed every %s\n",
+       GNUNET_STRINGS_relative_time_to_string (interval, GNUNET_NO));
+  speedup_task = GNUNET_SCHEDULER_add_now_with_lifeness (GNUNET_NO,
+                                                         &do_speedup,
+                                                         NULL);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Stop tasks that modify clock behavior.
+ */
+void
+GNUNET_SPEEDUP_stop_ ()
+{
+  if (NULL != speedup_task)
+  {
+    GNUNET_SCHEDULER_cancel (speedup_task);
+    speedup_task = NULL;
+  }
+  if ((0 != interval.rel_value_us) &&
+      (0 != delta.rel_value_us))
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Stopped execution speed up\n");
+}
+
+
+/* end of speedup.c */
diff --git a/src/lib/util/speedup.h b/src/lib/util/speedup.h
new file mode 100644
index 000000000..505e73bf4
--- /dev/null
+++ b/src/lib/util/speedup.h
@@ -0,0 +1,45 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 -- 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/speedup.c
+ * @brief Interface for speedup routinues
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ */
+
+#ifndef SPEEDUP_H_
+#define SPEEDUP_H_
+
+/**
+ * Start task that may speed up our system clock artificially
+ *
+ * @param cfg configuration to use
+ * @return GNUNET_OK on success, GNUNET_SYSERR if the speedup was not configured
+ */
+int
+GNUNET_SPEEDUP_start_ (const struct GNUNET_CONFIGURATION_Handle *cfg);
+
+/**
+ * Stop tasks that modify clock behavior.
+ */
+void
+GNUNET_SPEEDUP_stop_ (void);
+
+#endif  /* SPEEDUP_H_ */
diff --git a/src/lib/util/strings.c b/src/lib/util/strings.c
new file mode 100644
index 000000000..dc9fd0daf
--- /dev/null
+++ b/src/lib/util/strings.c
@@ -0,0 +1,2077 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2005-2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/strings.c
+ * @brief string functions
+ * @author Nils Durner
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#if HAVE_ICONV
+#include <iconv.h>
+#endif
+#include "gnunet_util_lib.h"
+#include <unicase.h>
+#include <unistr.h>
+#include <uniconv.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-strings", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+        GNUNET_log_from_strerror (kind, "util-strings", syscall)
+
+
+size_t
+GNUNET_STRINGS_buffer_fill (char *buffer,
+                            size_t size,
+                            unsigned int count, ...)
+{
+  size_t needed;
+  va_list ap;
+
+  needed = 0;
+  va_start (ap, count);
+  while (count > 0)
+  {
+    const char *s = va_arg (ap, const char *);
+    size_t slen = strlen (s) + 1;
+
+    GNUNET_assert (slen <= size - needed);
+    if (NULL != buffer)
+      GNUNET_memcpy (&buffer[needed],
+                     s,
+                     slen);
+    needed += slen;
+    count--;
+  }
+  va_end (ap);
+  return needed;
+}
+
+
+unsigned int
+GNUNET_STRINGS_buffer_tokenize (const char *buffer,
+                                size_t size,
+                                unsigned int count,
+                                ...)
+{
+  unsigned int start;
+  unsigned int needed;
+  const char **r;
+  va_list ap;
+
+  needed = 0;
+  va_start (ap, count);
+  while (count > 0)
+  {
+    r = va_arg (ap, const char **);
+
+    start = needed;
+    while ((needed < size) && (buffer[needed] != '\0'))
+      needed++;
+    if (needed == size)
+    {
+      va_end (ap);
+      return 0;     /* error */
+    }
+    *r = &buffer[start];
+    needed++;   /* skip 0-termination */
+    count--;
+  }
+  va_end (ap);
+  return needed;
+}
+
+
+char *
+GNUNET_STRINGS_byte_size_fancy (unsigned long long size)
+{
+  const char *unit = /* size unit */ "b";
+  char *ret;
+
+  if (size > 5 * 1024)
+  {
+    size = size / 1024;
+    unit = "KiB";
+    if (size > 5 * 1024)
+    {
+      size = size / 1024;
+      unit = "MiB";
+      if (size > 5 * 1024)
+      {
+        size = size / 1024;
+        unit = "GiB";
+        if (size > 5 * 1024)
+        {
+          size = size / 1024;
+          unit = "TiB";
+        }
+      }
+    }
+  }
+  ret = GNUNET_malloc (32);
+  GNUNET_snprintf (ret, 32, "%llu %s", size, unit);
+  return ret;
+}
+
+
+size_t
+GNUNET_strlcpy (char *dst,
+                const char *src,
+                size_t n)
+{
+  size_t slen;
+
+  GNUNET_assert (0 != n);
+  slen = strnlen (src, n - 1);
+  memcpy (dst, src, slen);
+  dst[slen] = '\0';
+  return slen;
+}
+
+
+/**
+ * Unit conversion table entry for 'convert_with_table'.
+ */
+struct ConversionTable
+{
+  /**
+   * Name of the unit (or NULL for end of table).
+   */
+  const char *name;
+
+  /**
+   * Factor to apply for this unit.
+   */
+  unsigned long long value;
+};
+
+
+/**
+ * Convert a string of the form "4 X 5 Y" into a numeric value
+ * by interpreting "X" and "Y" as units and then multiplying
+ * the numbers with the values associated with the respective
+ * unit from the conversion table.
+ *
+ * @param input input string to parse
+ * @param table table with the conversion of unit names to numbers
+ * @param output where to store the result
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+convert_with_table (const char *input,
+                    const struct ConversionTable *table,
+                    unsigned long long *output)
+{
+  unsigned long long ret;
+  char *in;
+  const char *tok;
+  unsigned long long last;
+  unsigned int i;
+  char *sptr;
+
+  ret = 0;
+  last = 0;
+  in = GNUNET_strdup (input);
+  for (tok = strtok_r (in, " ", &sptr);
+       tok != NULL;
+       tok = strtok_r (NULL, " ", &sptr))
+  {
+    do
+    {
+      i = 0;
+      while ((table[i].name != NULL) && (0 != strcasecmp (table[i].name, tok)))
+        i++;
+      if (table[i].name != NULL)
+      {
+        last *= table[i].value;
+        break;       /* next tok */
+      }
+      else
+      {
+        char *endptr;
+        ret += last;
+        errno = 0;
+        last = strtoull (tok, &endptr, 10);
+        if ((0 != errno) || (endptr == tok))
+        {
+          GNUNET_free (in);
+          return GNUNET_SYSERR;         /* expected number */
+        }
+        if ('\0' == endptr[0])
+          break;       /* next tok */
+        else
+          tok = endptr;       /* and re-check (handles times like "10s") */
+      }
+    }
+    while (GNUNET_YES);
+  }
+  ret += last;
+  *output = ret;
+  GNUNET_free (in);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
+                                    unsigned long long *size)
+{
+  static const struct ConversionTable table[] =
+  { { "B", 1 },
+    { "KiB", 1024 },
+    { "kB", 1000 },
+    { "MiB", 1024 * 1024 },
+    { "MB", 1000 * 1000 },
+    { "GiB", 1024 * 1024 * 1024 },
+    { "GB", 1000 * 1000 * 1000 },
+    { "TiB", 1024LL * 1024LL * 1024LL * 1024LL },
+    { "TB", 1000LL * 1000LL * 1000LL * 1024LL },
+    { "PiB", 1024LL * 1024LL * 1024LL * 1024LL * 1024LL },
+    { "PB", 1000LL * 1000LL * 1000LL * 1024LL * 1000LL },
+    { "EiB", 1024LL * 1024LL * 1024LL * 1024LL * 1024LL * 1024LL },
+    { "EB", 1000LL * 1000LL * 1000LL * 1024LL * 1000LL * 1000LL },
+    { NULL, 0 } };
+
+  return convert_with_table (fancy_size, table, size);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
+                                       struct GNUNET_TIME_Relative *rtime)
+{
+  static const struct ConversionTable table[] =
+  { { "us", 1 },
+    { "ms", 1000 },
+    { "s", 1000 * 1000LL },
+    { "second", 1000 * 1000LL },
+    { "seconds", 1000 * 1000LL },
+    { "\"", 1000 * 1000LL },
+    { "m", 60 * 1000 * 1000LL },
+    { "min", 60 * 1000 * 1000LL },
+    { "minute", 60 * 1000 * 1000LL },
+    { "minutes", 60 * 1000 * 1000LL },
+    { "'", 60 * 1000 * 1000LL },
+    { "h", 60 * 60 * 1000 * 1000LL },
+    { "hour", 60 * 60 * 1000 * 1000LL },
+    { "hours", 60 * 60 * 1000 * 1000LL },
+    { "d", 24 * 60 * 60 * 1000LL * 1000LL },
+    { "day", 24 * 60 * 60 * 1000LL * 1000LL },
+    { "days", 24 * 60 * 60 * 1000LL * 1000LL },
+    { "week", 7 * 24 * 60 * 60 * 1000LL * 1000LL },
+    { "weeks", 7 * 24 * 60 * 60 * 1000LL * 1000LL },
+    { "year", 31536000000000LL /* year */ },
+    { "years", 31536000000000LL /* year */ },
+    { "a", 31536000000000LL /* year */ },
+    { NULL, 0 } };
+  int ret;
+  unsigned long long val;
+
+  if (0 == strcasecmp ("forever", fancy_time))
+  {
+    *rtime = GNUNET_TIME_UNIT_FOREVER_REL;
+    return GNUNET_OK;
+  }
+  ret = convert_with_table (fancy_time, table, &val);
+  rtime->rel_value_us = (uint64_t) val;
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_absolute (const char *fancy_time,
+                                       struct GNUNET_TIME_Absolute *atime)
+{
+  struct tm tv;
+  time_t t;
+  const char *eos;
+
+  if (0 == strcasecmp ("end of time", fancy_time))
+  {
+    *atime = GNUNET_TIME_UNIT_FOREVER_ABS;
+    return GNUNET_OK;
+  }
+  eos = &fancy_time[strlen (fancy_time)];
+  memset (&tv, 0, sizeof(tv));
+  if ((eos != strptime (fancy_time, "%a %b %d %H:%M:%S %Y", &tv)) &&
+      (eos != strptime (fancy_time, "%c", &tv)) &&
+      (eos != strptime (fancy_time, "%Ec", &tv)) &&
+      (eos != strptime (fancy_time, "%Y-%m-%d %H:%M:%S", &tv)) &&
+      (eos != strptime (fancy_time, "%Y-%m-%d %H:%M", &tv)) &&
+      (eos != strptime (fancy_time, "%x", &tv)) &&
+      (eos != strptime (fancy_time, "%Ex", &tv)) &&
+      (eos != strptime (fancy_time, "%Y-%m-%d", &tv)) &&
+      (eos != strptime (fancy_time, "%Y-%m", &tv)) &&
+      (eos != strptime (fancy_time, "%Y", &tv)))
+    return GNUNET_SYSERR;
+  t = mktime (&tv);
+  atime->abs_value_us = (uint64_t) ((uint64_t) t * 1000LL * 1000LL);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_timestamp (const char *fancy_time,
+                                        struct GNUNET_TIME_Timestamp *atime)
+{
+  return GNUNET_STRINGS_fancy_time_to_absolute (fancy_time,
+                                                &atime->abs_time);
+}
+
+
+char *
+GNUNET_STRINGS_conv (const char *input,
+                     size_t len,
+                     const char *input_charset,
+                     const char *output_charset)
+{
+  char *ret;
+  uint8_t *u8_string;
+  char *encoded_string;
+  size_t u8_string_length;
+  size_t encoded_string_length;
+
+  u8_string = u8_conv_from_encoding (input_charset,
+                                     iconveh_error,
+                                     input,
+                                     len,
+                                     NULL,
+                                     NULL,
+                                     &u8_string_length);
+  if (NULL == u8_string)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING, "u8_conv_from_encoding");
+    goto fail;
+  }
+  if (0 == strcmp (output_charset, "UTF-8"))
+  {
+    ret = GNUNET_malloc (u8_string_length + 1);
+    GNUNET_memcpy (ret, u8_string, u8_string_length);
+    ret[u8_string_length] = '\0';
+    free (u8_string);
+    return ret;
+  }
+  encoded_string = u8_conv_to_encoding (output_charset,
+                                        iconveh_error,
+                                        u8_string,
+                                        u8_string_length,
+                                        NULL,
+                                        NULL,
+                                        &encoded_string_length);
+  free (u8_string);
+  if (NULL == encoded_string)
+  {
+    LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING, "u8_conv_to_encoding");
+    goto fail;
+  }
+  ret = GNUNET_malloc (encoded_string_length + 1);
+  GNUNET_memcpy (ret, encoded_string, encoded_string_length);
+  ret[encoded_string_length] = '\0';
+  free (encoded_string);
+  return ret;
+fail:
+  LOG (GNUNET_ERROR_TYPE_WARNING,
+       _ ("Character sets requested were `%s'->`%s'\n"),
+       "UTF-8",
+       output_charset);
+  ret = GNUNET_malloc (len + 1);
+  GNUNET_memcpy (ret, input, len);
+  ret[len] = '\0';
+  return ret;
+}
+
+
+char *
+GNUNET_STRINGS_to_utf8 (const char *input,
+                        size_t len,
+                        const char *charset)
+{
+  return GNUNET_STRINGS_conv (input,
+                              len,
+                              charset,
+                              "UTF-8");
+}
+
+
+char *
+GNUNET_STRINGS_from_utf8 (const char *input,
+                          size_t len,
+                          const char *charset)
+{
+  return GNUNET_STRINGS_conv (input,
+                              len,
+                              "UTF-8",
+                              charset);
+}
+
+
+char *
+GNUNET_STRINGS_utf8_normalize (const char *input)
+{
+  uint8_t *tmp;
+  size_t len;
+  char *output;
+  tmp = u8_normalize (UNINORM_NFC,
+                      (uint8_t *) input,
+                      strlen ((char*) input),
+                      NULL,
+                      &len);
+  if (NULL == tmp)
+    return NULL;
+  output = GNUNET_malloc (len + 1);
+  GNUNET_memcpy (output, tmp, len);
+  output[len] = '\0';
+  free (tmp);
+  return output;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_utf8_tolower (const char *input,
+                             char *output)
+{
+  uint8_t *tmp_in;
+  size_t len;
+
+  tmp_in = u8_tolower ((uint8_t *) input,
+                       strlen ((char *) input),
+                       NULL,
+                       UNINORM_NFD,
+                       NULL,
+                       &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (output, tmp_in, len);
+  output[len] = '\0';
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_utf8_toupper (const char *input,
+                             char *output)
+{
+  uint8_t *tmp_in;
+  size_t len;
+
+  tmp_in = u8_toupper ((uint8_t *) input,
+                       strlen ((char *) input),
+                       NULL,
+                       UNINORM_NFD,
+                       NULL,
+                       &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
+  /* 0-terminator does not fit */
+  GNUNET_memcpy (output, tmp_in, len);
+  output[len] = '\0';
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
+}
+
+
+char *
+GNUNET_STRINGS_filename_expand (const char *fil)
+{
+  char *buffer;
+  size_t len;
+  char *fm;
+  const char *fil_ptr;
+
+  if (fil == NULL)
+    return NULL;
+
+  if (fil[0] == DIR_SEPARATOR)
+    /* absolute path, just copy */
+    return GNUNET_strdup (fil);
+  if (fil[0] == '~')
+  {
+    fm = getenv ("HOME");
+    if (fm == NULL)
+    {
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("Failed to expand `$HOME': environment variable `HOME' not set"));
+      return NULL;
+    }
+    fm = GNUNET_strdup (fm);
+    /* do not copy '~' */
+    fil_ptr = fil + 1;
+
+    /* skip over dir separator to be consistent */
+    if (fil_ptr[0] == DIR_SEPARATOR)
+      fil_ptr++;
+  }
+  else
+  {
+    /* relative path */
+    fil_ptr = fil;
+    len = 512;
+    fm = NULL;
+    while (1)
+    {
+      buffer = GNUNET_malloc (len);
+      if (getcwd (buffer, len) != NULL)
+      {
+        fm = buffer;
+        break;
+      }
+      if ((errno == ERANGE) && (len < 1024 * 1024 * 4))
+      {
+        len *= 2;
+        GNUNET_free (buffer);
+        continue;
+      }
+      GNUNET_free (buffer);
+      break;
+    }
+    if (fm == NULL)
+    {
+      LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING, "getcwd");
+      buffer = getenv ("PWD");    /* alternative */
+      if (buffer != NULL)
+        fm = GNUNET_strdup (buffer);
+    }
+    if (fm == NULL)
+      fm = GNUNET_strdup ("./");  /* give up */
+  }
+  GNUNET_asprintf (&buffer,
+                   "%s%s%s",
+                   fm,
+                   (fm[strlen (fm) - 1] == DIR_SEPARATOR) ? ""
+                   : DIR_SEPARATOR_STR,
+                   fil_ptr);
+  GNUNET_free (fm);
+  return buffer;
+}
+
+
+const char *
+GNUNET_STRINGS_relative_time_to_string (struct GNUNET_TIME_Relative delta,
+                                        int do_round)
+{
+  static GNUNET_THREAD_LOCAL char buf[128];
+  const char *unit = /* time unit */ "µs";
+  uint64_t dval = delta.rel_value_us;
+
+  if (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us == delta.rel_value_us)
+    return "forever";
+  if (0 == delta.rel_value_us)
+    return "0 ms";
+  if (((GNUNET_YES == do_round) && (dval > 5 * 1000)) || (0 == (dval % 1000)))
+  {
+    dval = dval / 1000;
+    unit = /* time unit */ "ms";
+    if (((GNUNET_YES == do_round) && (dval > 5 * 1000)) || (0 == (dval % 1000)))
+    {
+      dval = dval / 1000;
+      unit = /* time unit */ "s";
+      if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+      {
+        dval = dval / 60;
+        unit = /* time unit */ "m";
+        if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+        {
+          dval = dval / 60;
+          unit = /* time unit */ "h";
+          if (((GNUNET_YES == do_round) && (dval > 5 * 24)) ||
+              (0 == (dval % 24)))
+          {
+            dval = dval / 24;
+            if (1 == dval)
+              unit = /* time unit */ "day";
+            else
+              unit = /* time unit */ "days";
+          }
+        }
+      }
+    }
+  }
+  GNUNET_snprintf (buf, sizeof(buf), "%llu %s",
+                   (unsigned long long) dval, unit);
+  return buf;
+}
+
+
+const char *
+GNUNET_STRINGS_absolute_time_to_string (struct GNUNET_TIME_Absolute t)
+{
+  static GNUNET_THREAD_LOCAL char buf[255];
+  time_t tt;
+  struct tm *tp;
+
+  if (GNUNET_TIME_absolute_is_never (t))
+    return "end of time";
+  tt = t.abs_value_us / 1000LL / 1000LL;
+  tp = localtime (&tt);
+  /* This is hacky, but i don't know a way to detect libc character encoding.
+   * Just expect utf8 from glibc these days.
+   * As for msvcrt, use the wide variant, which always returns utf16
+   * (otherwise we'd have to detect current codepage or use W32API character
+   * set conversion routines to convert to UTF8).
+   */
+  strftime (buf, sizeof(buf), "%a %b %d %H:%M:%S %Y", tp);
+
+  return buf;
+}
+
+
+const char *
+GNUNET_STRINGS_get_short_name (const char *filename)
+{
+  const char *short_fn = filename;
+  const char *ss;
+
+  while (NULL != (ss = strstr (short_fn, DIR_SEPARATOR_STR)) && (ss[1] != '\0'))
+    short_fn = 1 + ss;
+  return short_fn;
+}
+
+
+/**
+ * Get the decoded value corresponding to a character according to Crockford
+ * Base32 encoding.
+ *
+ * @param a a character
+ * @return corresponding numeric value
+ */
+static unsigned int
+getValue__ (unsigned char a)
+{
+  unsigned int dec;
+
+  switch (a)
+  {
+  case 'O':
+  case 'o':
+    a = '0';
+    break;
+
+  case 'i':
+  case 'I':
+  case 'l':
+  case 'L':
+    a = '1';
+    break;
+
+  /* also consider U to be V */
+  case 'u':
+  case 'U':
+    a = 'V';
+    break;
+
+  default:
+    break;
+  }
+  if ((a >= '0') && (a <= '9'))
+    return a - '0';
+  if ((a >= 'a') && (a <= 'z'))
+    a = toupper (a);
+  /* return (a - 'a' + 10); */
+  dec = 0;
+  if ((a >= 'A') && (a <= 'Z'))
+  {
+    if ('I' < a)
+      dec++;
+    if ('L' < a)
+      dec++;
+    if ('O' < a)
+      dec++;
+    if ('U' < a)
+      dec++;
+    return(a - 'A' + 10 - dec);
+  }
+  return -1;
+}
+
+
+char *
+GNUNET_STRINGS_data_to_string (const void *data,
+                               size_t size,
+                               char *out,
+                               size_t out_size)
+{
+  /**
+   * 32 characters for encoding
+   */
+  static char *encTable__ = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+  unsigned int wpos;
+  unsigned int rpos;
+  unsigned int bits;
+  unsigned int vbit;
+  const unsigned char *udata;
+
+  GNUNET_assert (size < SIZE_MAX / 8 - 4);
+  udata = data;
+  if (out_size < (size * 8 + 4) / 5)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  vbit = 0;
+  wpos = 0;
+  rpos = 0;
+  bits = 0;
+  while ((rpos < size) || (vbit > 0))
+  {
+    if ((rpos < size) && (vbit < 5))
+    {
+      bits = (bits << 8) | udata[rpos++];     /* eat 8 more bits */
+      vbit += 8;
+    }
+    if (vbit < 5)
+    {
+      bits <<= (5 - vbit);     /* zero-padding */
+      GNUNET_assert (vbit == ((size * 8) % 5));
+      vbit = 5;
+    }
+    if (wpos >= out_size)
+    {
+      GNUNET_break (0);
+      return NULL;
+    }
+    out[wpos++] = encTable__[(bits >> (vbit - 5)) & 31];
+    vbit -= 5;
+  }
+  GNUNET_assert (0 == vbit);
+  if (wpos < out_size)
+    out[wpos] = '\0';
+  return &out[wpos];
+}
+
+
+char *
+GNUNET_STRINGS_data_to_string_alloc (const void *buf, size_t size)
+{
+  char *str_buf;
+  size_t len = size * 8;
+  char *end;
+
+  if (len % 5 > 0)
+    len += 5 - len % 5;
+  len /= 5;
+  str_buf = GNUNET_malloc (len + 1);
+  end = GNUNET_STRINGS_data_to_string (buf,
+                                       size,
+                                       str_buf,
+                                       len);
+  if (NULL == end)
+  {
+    GNUNET_free (str_buf);
+    return NULL;
+  }
+  *end = '\0';
+  return str_buf;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_string_to_data (const char *enc,
+                               size_t enclen,
+                               void *out,
+                               size_t out_size)
+{
+  size_t rpos;
+  size_t wpos;
+  unsigned int bits;
+  unsigned int vbit;
+  int ret;
+  int shift;
+  unsigned char *uout;
+  size_t encoded_len;
+
+  if (0 == enclen)
+  {
+    if (0 == out_size)
+      return GNUNET_OK;
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (out_size < SIZE_MAX / 8);
+  encoded_len = out_size * 8;
+  uout = out;
+  wpos = out_size;
+  rpos = enclen;
+  if ((encoded_len % 5) > 0)
+  {
+    vbit = encoded_len % 5;   /* padding! */
+    shift = 5 - vbit;
+    bits = (ret = getValue__ (enc[--rpos])) >> shift;
+  }
+  else
+  {
+    vbit = 5;
+    shift = 0;
+    bits = (ret = getValue__ (enc[--rpos]));
+  }
+  if ((encoded_len + shift) / 5 != enclen)
+    return GNUNET_SYSERR;
+  if (-1 == ret)
+    return GNUNET_SYSERR;
+  while (wpos > 0)
+  {
+    if (0 == rpos)
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    bits = ((ret = getValue__ (enc[--rpos])) << vbit) | bits;
+    if (-1 == ret)
+      return GNUNET_SYSERR;
+    vbit += 5;
+    if (vbit >= 8)
+    {
+      uout[--wpos] = (unsigned char) bits;
+      bits >>= 8;
+      vbit -= 8;
+    }
+  }
+  if ((0 != rpos) || (0 != vbit))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_string_to_data_alloc (const char *enc,
+                                     size_t enclen,
+                                     void **out,
+                                     size_t *out_size)
+{
+  size_t size;
+  void *data;
+  int res;
+
+  size = (enclen * 5) / 8;
+  if (size >= GNUNET_MAX_MALLOC_CHECKED)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  data = GNUNET_malloc (size);
+  res = GNUNET_STRINGS_string_to_data (enc,
+                                       enclen,
+                                       data,
+                                       size);
+  if ( (0 < size) &&
+       (GNUNET_OK != res) )
+  {
+    size--;
+    res = GNUNET_STRINGS_string_to_data (enc,
+                                         enclen,
+                                         data,
+                                         size);
+  }
+  if (GNUNET_OK != res)
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (data);
+    return GNUNET_SYSERR;
+  }
+  *out = data;
+  *out_size = size;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_parse_uri (const char *path,
+                          char **scheme_part,
+                          const char **path_part)
+{
+  size_t len;
+  size_t i;
+  int end;
+  int pp_state = 0;
+  const char *post_scheme_part = NULL;
+
+  len = strlen (path);
+  for (end = 0, i = 0; ! end && i < len; i++)
+  {
+    switch (pp_state)
+    {
+    case 0:
+      if ((path[i] == ':') && (i > 0))
+      {
+        pp_state += 1;
+        continue;
+      }
+      if (! (((path[i] >= 'A') && (path[i] <= 'Z') ) ||
+             ((path[i] >= 'a') && (path[i] <= 'z') ) ||
+             ((path[i] >= '0') && (path[i] <= '9') ) || (path[i] == '+') ||
+             (path[i] == '-') || (path[i] == '.')))
+        end = 1;
+      break;
+
+    case 1:
+    case 2:
+      if (path[i] == '/')
+      {
+        pp_state += 1;
+        continue;
+      }
+      end = 1;
+      break;
+
+    case 3:
+      post_scheme_part = &path[i];
+      end = 1;
+      break;
+
+    default:
+      end = 1;
+    }
+  }
+  if (post_scheme_part == NULL)
+    return GNUNET_NO;
+  if (scheme_part)
+  {
+    *scheme_part = GNUNET_strndup (path,
+                                   post_scheme_part - path);
+  }
+  if (path_part)
+    *path_part = post_scheme_part;
+  return GNUNET_YES;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_path_is_absolute (const char *filename,
+                                 int can_be_uri,
+                                 int *r_is_uri,
+                                 char **r_uri_scheme)
+{
+  const char *post_scheme_path;
+  int is_uri;
+  char *uri;
+  /* consider POSIX paths to be absolute too, even on W32,
+   * as plibc expansion will fix them for us.
+   */
+  if (filename[0] == '/')
+    return GNUNET_YES;
+  if (can_be_uri)
+  {
+    is_uri = GNUNET_STRINGS_parse_uri (filename, &uri, &post_scheme_path);
+    if (r_is_uri)
+      *r_is_uri = is_uri;
+    if (is_uri)
+    {
+      if (r_uri_scheme)
+        *r_uri_scheme = uri;
+      else
+        GNUNET_free (uri);
+
+      return GNUNET_STRINGS_path_is_absolute (post_scheme_path,
+                                              GNUNET_NO,
+                                              NULL,
+                                              NULL);
+    }
+  }
+  else
+  {
+    if (r_is_uri)
+      *r_is_uri = GNUNET_NO;
+  }
+
+  return GNUNET_NO;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_check_filename (const char *filename,
+                               enum GNUNET_STRINGS_FilenameCheck checks)
+{
+  struct stat st;
+
+  if ((NULL == filename) || (filename[0] == '\0'))
+    return GNUNET_SYSERR;
+  if (0 != (checks & GNUNET_STRINGS_CHECK_IS_ABSOLUTE))
+    if (! GNUNET_STRINGS_path_is_absolute (filename, GNUNET_NO, NULL, NULL))
+      return GNUNET_NO;
+  if (0 != (checks
+            & (GNUNET_STRINGS_CHECK_EXISTS | GNUNET_STRINGS_CHECK_IS_DIRECTORY
+               | GNUNET_STRINGS_CHECK_IS_LINK)))
+  {
+    if (0 != lstat (filename, &st))
+    {
+      if (0 != (checks & GNUNET_STRINGS_CHECK_EXISTS))
+        return GNUNET_NO;
+      else
+        return GNUNET_SYSERR;
+    }
+  }
+  if (0 != (checks & GNUNET_STRINGS_CHECK_IS_DIRECTORY))
+    if (! S_ISDIR (st.st_mode))
+      return GNUNET_NO;
+  if (0 != (checks & GNUNET_STRINGS_CHECK_IS_LINK))
+    if (! S_ISLNK (st.st_mode))
+      return GNUNET_NO;
+  return GNUNET_YES;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_to_address_ipv6 (const char *zt_addr,
+                                size_t addrlen,
+                                struct sockaddr_in6 *r_buf)
+{
+  if (addrlen < 6)
+    return GNUNET_SYSERR;
+  if (addrlen > 512)
+    return GNUNET_SYSERR; /* sanity check to protect zbuf allocation,
+                             actual limit is not precise */
+  {
+    char zbuf[addrlen + 1];
+    int ret;
+    char *port_colon;
+    unsigned int port;
+    char dummy[2];
+
+    GNUNET_memcpy (zbuf, zt_addr, addrlen);
+    if ('[' != zbuf[0])
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  _ ("IPv6 address did not start with `['\n"));
+      return GNUNET_SYSERR;
+    }
+    zbuf[addrlen] = '\0';
+    port_colon = strrchr (zbuf, ':');
+    if (NULL == port_colon)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  _ ("IPv6 address did contain ':' to separate port number\n"));
+      return GNUNET_SYSERR;
+    }
+    if (']' != *(port_colon - 1))
+    {
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_WARNING,
+        _ (
+          "IPv6 address did contain ']' before ':' to separate port number\n"));
+      return GNUNET_SYSERR;
+    }
+    ret = sscanf (port_colon, ":%u%1s", &port, dummy);
+    if ((1 != ret) || (port > 65535))
+    {
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_WARNING,
+        _ (
+          "IPv6 address did contain a valid port number after the last ':'\n"));
+      return GNUNET_SYSERR;
+    }
+    *(port_colon - 1) = '\0';
+    memset (r_buf, 0, sizeof(struct sockaddr_in6));
+    ret = inet_pton (AF_INET6, &zbuf[1], &r_buf->sin6_addr);
+    if (ret <= 0)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  _ ("Invalid IPv6 address `%s': %s\n"),
+                  &zbuf[1],
+                  strerror (errno));
+      return GNUNET_SYSERR;
+    }
+    r_buf->sin6_port = htons (port);
+    r_buf->sin6_family = AF_INET6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    r_buf->sin6_len = (u_char) sizeof(struct sockaddr_in6);
+#endif
+    return GNUNET_OK;
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_to_address_ipv4 (const char *zt_addr,
+                                size_t addrlen,
+                                struct sockaddr_in *r_buf)
+{
+  unsigned int temps[4];
+  unsigned int port;
+  unsigned int cnt;
+  char dummy[2];
+
+  if (addrlen < 9)
+    return GNUNET_SYSERR;
+  cnt = sscanf (zt_addr,
+                "%u.%u.%u.%u:%u%1s",
+                &temps[0],
+                &temps[1],
+                &temps[2],
+                &temps[3],
+                &port,
+                dummy);
+  if (5 != cnt)
+    return GNUNET_SYSERR;
+  for (cnt = 0; cnt < 4; cnt++)
+    if (temps[cnt] > 0xFF)
+      return GNUNET_SYSERR;
+  if (port > 65535)
+    return GNUNET_SYSERR;
+  r_buf->sin_family = AF_INET;
+  r_buf->sin_port = htons (port);
+  r_buf->sin_addr.s_addr =
+    htonl ((temps[0] << 24) + (temps[1] << 16) + (temps[2] << 8) + temps[3]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  r_buf->sin_len = (u_char) sizeof(struct sockaddr_in);
+#endif
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_to_address_ip (const char *addr,
+                              uint16_t addrlen,
+                              struct sockaddr_storage *r_buf)
+{
+  if (addr[0] == '[')
+    return GNUNET_STRINGS_to_address_ipv6 (addr,
+                                           addrlen,
+                                           (struct sockaddr_in6 *) r_buf);
+  return GNUNET_STRINGS_to_address_ipv4 (addr,
+                                         addrlen,
+                                         (struct sockaddr_in *) r_buf);
+}
+
+
+size_t
+GNUNET_STRINGS_parse_socket_addr (const char *addr,
+                                  uint8_t *af,
+                                  struct sockaddr **sa)
+{
+  *af = AF_UNSPEC;
+  if ('[' == *addr)
+  {
+    /* IPv6 */
+    *sa = GNUNET_malloc (sizeof(struct sockaddr_in6));
+    if (GNUNET_OK !=
+        GNUNET_STRINGS_to_address_ipv6 (addr,
+                                        strlen (addr),
+                                        (struct sockaddr_in6 *) *sa))
+    {
+      GNUNET_free (*sa);
+      *sa = NULL;
+      return 0;
+    }
+    *af = AF_INET6;
+    return sizeof(struct sockaddr_in6);
+  }
+  else
+  {
+    /* IPv4 */
+    *sa = GNUNET_malloc (sizeof(struct sockaddr_in));
+    if (GNUNET_OK !=
+        GNUNET_STRINGS_to_address_ipv4 (addr,
+                                        strlen (addr),
+                                        (struct sockaddr_in *) *sa))
+    {
+      GNUNET_free (*sa);
+      *sa = NULL;
+      return 0;
+    }
+    *af = AF_INET;
+    return sizeof(struct sockaddr_in);
+  }
+}
+
+
+/**
+ * Makes a copy of argv that consists of a single memory chunk that can be
+ * freed with a single call to GNUNET_free();
+ */
+static char *const *
+_make_continuous_arg_copy (int argc,
+                           char *const *argv)
+{
+  size_t argvsize = 0;
+  char **new_argv;
+  char *p;
+
+  for (int i = 0; i < argc; i++)
+  {
+    size_t ail = strlen (argv[i]);
+
+    GNUNET_assert (SIZE_MAX - 1 - sizeof (char *) > argvsize);
+    GNUNET_assert (SIZE_MAX - ail > argvsize + 1 + sizeof (char*));
+    argvsize += strlen (argv[i]) + 1 + sizeof(char *);
+  }
+  new_argv = GNUNET_malloc (argvsize + sizeof(char *));
+  p = (char *) &new_argv[argc + 1];
+  for (int i = 0; i < argc; i++)
+  {
+    new_argv[i] = p;
+    strcpy (p, argv[i]);
+    p += strlen (argv[i]) + 1;
+  }
+  new_argv[argc] = NULL;
+  return (char *const *) new_argv;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_get_utf8_args (int argc,
+                              char *const *argv,
+                              int *u8argc,
+                              char *const **u8argv)
+{
+  char *const *new_argv =
+    (char *const *) _make_continuous_arg_copy (argc, argv);
+  *u8argv = new_argv;
+  *u8argc = argc;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse the given port policy.  The format is
+ * "[!]SPORT[-DPORT]".
+ *
+ * @param port_policy string to parse
+ * @param pp policy to fill in
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the
+ *         @a port_policy is malformed
+ */
+static enum GNUNET_GenericReturnValue
+parse_port_policy (const char *port_policy,
+                   struct GNUNET_STRINGS_PortPolicy *pp)
+{
+  const char *pos;
+  int s;
+  int e;
+  char eol[2];
+
+  pos = port_policy;
+  if ('!' == *pos)
+  {
+    pp->negate_portrange = GNUNET_YES;
+    pos++;
+  }
+  if (2 == sscanf (pos, "%u-%u%1s", &s, &e, eol))
+  {
+    if ((0 == s) || (s > 0xFFFF) || (e < s) || (e > 0xFFFF))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, _ ("Port not in range\n"));
+      return GNUNET_SYSERR;
+    }
+    pp->start_port = (uint16_t) s;
+    pp->end_port = (uint16_t) e;
+    return GNUNET_OK;
+  }
+  if (1 == sscanf (pos, "%u%1s", &s, eol))
+  {
+    if ((0 == s) || (s > 0xFFFF))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, _ ("Port not in range\n"));
+      return GNUNET_SYSERR;
+    }
+
+    pp->start_port = (uint16_t) s;
+    pp->end_port = (uint16_t) s;
+    return GNUNET_OK;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+              _ ("Malformed port policy `%s'\n"),
+              port_policy);
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_STRINGS_IPv4NetworkPolicy *
+GNUNET_STRINGS_parse_ipv4_policy (const char *routeListX)
+{
+  size_t count;
+  size_t len;
+  size_t pos;
+  unsigned int temps[8];
+  struct GNUNET_STRINGS_IPv4NetworkPolicy *result;
+  char *routeList;
+
+  if (NULL == routeListX)
+    return NULL;
+  len = strlen (routeListX);
+  if (0 == len)
+    return NULL;
+  routeList = GNUNET_strdup (routeListX);
+  count = 0;
+  for (size_t i = 0; i < len; i++)
+    if (routeList[i] == ';')
+      count++;
+  GNUNET_assert (count < SIZE_MAX);
+  result = GNUNET_new_array (count + 1,
+                             struct GNUNET_STRINGS_IPv4NetworkPolicy);
+  pos = 0;
+  for (size_t i = 0; i < count; i++)
+  {
+    size_t colon;
+    size_t end;
+    char dummy;
+
+    for (colon = pos; ':' != routeList[colon]; colon++)
+      if ((';' == routeList[colon]) || ('\0' == routeList[colon]))
+        break;
+    for (end = colon; ';' != routeList[end]; end++)
+      if ('\0' == routeList[end])
+        break;
+    if ('\0' == routeList[end])
+      break;
+    routeList[end] = '\0';
+    if (':' == routeList[colon])
+    {
+      routeList[colon] = '\0';
+      if (GNUNET_OK != parse_port_policy (&routeList[colon + 1], &result[i].pp))
+        break;
+    }
+    if (8 ==
+        sscanf (&routeList[pos],
+                "%u.%u.%u.%u/%u.%u.%u.%u%c",
+                &temps[0],
+                &temps[1],
+                &temps[2],
+                &temps[3],
+                &temps[4],
+                &temps[5],
+                &temps[6],
+                &temps[7],
+                &dummy))
+    {
+      for (unsigned int j = 0; j < 8; j++)
+        if (temps[j] > 0xFF)
+        {
+          LOG (GNUNET_ERROR_TYPE_WARNING,
+               _ ("Invalid format for IP: `%s'\n"),
+               &routeList[pos]);
+          GNUNET_free (result);
+          GNUNET_free (routeList);
+          return NULL;
+        }
+      result[i].network.s_addr = htonl ((temps[0] << 24) + (temps[1] << 16)
+                                        + (temps[2] << 8) + temps[3]);
+      result[i].netmask.s_addr = htonl ((temps[4] << 24) + (temps[5] << 16)
+                                        + (temps[6] << 8) + temps[7]);
+      pos = end + 1;
+      continue;
+    }
+
+    /* try second notation */
+    {
+      unsigned int slash;
+
+      if (5 ==
+          sscanf (&routeList[pos],
+                  "%u.%u.%u.%u/%u%c",
+                  &temps[0],
+                  &temps[1],
+                  &temps[2],
+                  &temps[3],
+                  &slash,
+                  &dummy))
+      {
+        for (unsigned int j = 0; j < 4; j++)
+          if (temps[j] > 0xFF)
+          {
+            LOG (GNUNET_ERROR_TYPE_WARNING,
+                 _ ("Invalid format for IP: `%s'\n"),
+                 &routeList[pos]);
+            GNUNET_free (result);
+            GNUNET_free (routeList);
+            return NULL;
+          }
+        result[i].network.s_addr = htonl ((temps[0] << 24) + (temps[1] << 16)
+                                          + (temps[2] << 8) + temps[3]);
+        if (slash <= 32)
+        {
+          result[i].netmask.s_addr = 0;
+          while (slash > 0)
+          {
+            result[i].netmask.s_addr =
+              (result[i].netmask.s_addr >> 1) + 0x80000000;
+            slash--;
+          }
+          result[i].netmask.s_addr = htonl (result[i].netmask.s_addr);
+          pos = end + 1;
+          continue;
+        }
+        else
+        {
+          LOG (GNUNET_ERROR_TYPE_WARNING,
+               _ (
+                 "Invalid network notation ('/%d' is not legal in IPv4 CIDR)."),
+               slash);
+          GNUNET_free (result);
+          GNUNET_free (routeList);
+          return NULL;     /* error */
+        }
+      }
+    }
+
+    /* try third notation */
+    if (4 ==
+        sscanf (&routeList[pos],
+                "%u.%u.%u.%u%c",
+                &temps[0],
+                &temps[1],
+                &temps[2],
+                &temps[3],
+                &dummy))
+    {
+      for (unsigned int j = 0; j < 4; j++)
+        if (temps[j] > 0xFF)
+        {
+          LOG (GNUNET_ERROR_TYPE_WARNING,
+               _ ("Invalid format for IP: `%s'\n"),
+               &routeList[pos]);
+          GNUNET_free (result);
+          GNUNET_free (routeList);
+          return NULL;
+        }
+      result[i].network.s_addr = htonl ((temps[0] << 24) + (temps[1] << 16)
+                                        + (temps[2] << 8) + temps[3]);
+      result[i].netmask.s_addr = htonl (0xffffffff); /* yeah, the htonl is useless */
+      pos = end + 1;
+      continue;
+    }
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Invalid format for IP: `%s'\n"),
+         &routeList[pos]);
+    GNUNET_free (result);
+    GNUNET_free (routeList);
+    return NULL;   /* error */
+  }
+  if (pos < strlen (routeList))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Invalid format: `%s'\n"),
+         &routeListX[pos]);
+    GNUNET_free (result);
+    GNUNET_free (routeList);
+    return NULL;   /* oops */
+  }
+  GNUNET_free (routeList);
+  return result; /* ok */
+}
+
+
+struct GNUNET_STRINGS_IPv6NetworkPolicy *
+GNUNET_STRINGS_parse_ipv6_policy (const char *routeListX)
+{
+  size_t count;
+  size_t len;
+  size_t pos;
+  int ret;
+  char *routeList;
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *result;
+  unsigned int off;
+
+  if (NULL == routeListX)
+    return NULL;
+  len = strlen (routeListX);
+  if (0 == len)
+    return NULL;
+  routeList = GNUNET_strdup (routeListX);
+  count = 0;
+  for (size_t j = 0; j < len; j++)
+    if (';' == routeList[j])
+      count++;
+  if (';' != routeList[len - 1])
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ ("Invalid network notation (does not end with ';': `%s')\n"),
+         routeList);
+    GNUNET_free (routeList);
+    return NULL;
+  }
+  GNUNET_assert (count < UINT_MAX);
+  result = GNUNET_new_array (count + 1,
+                             struct GNUNET_STRINGS_IPv6NetworkPolicy);
+  pos = 0;
+  for (size_t i = 0; i < count; i++)
+  {
+    size_t start;
+    size_t slash;
+
+    start = pos;
+    while (';' != routeList[pos])
+      pos++;
+    slash = pos;
+    while ( (slash > start) &&
+            (routeList[slash] != '/') )
+      slash--;
+    if (slash <= start)
+    {
+      memset (&result[i].netmask,
+              0xFF,
+              sizeof(struct in6_addr));
+      slash = pos;
+    }
+    else
+    {
+      size_t colon;
+
+      routeList[pos] = '\0';
+      for (colon = pos; ':' != routeList[colon]; colon--)
+        if ('/' == routeList[colon])
+          break;
+      if (':' == routeList[colon])
+      {
+        routeList[colon] = '\0';
+        if (GNUNET_OK !=
+            parse_port_policy (&routeList[colon + 1],
+                               &result[i].pp))
+        {
+          GNUNET_free (result);
+          GNUNET_free (routeList);
+          return NULL;
+        }
+      }
+      ret = inet_pton (AF_INET6,
+                       &routeList[slash + 1],
+                       &result[i].netmask);
+      if (ret <= 0)
+      {
+        char dummy;
+        unsigned int bits;
+        int save = errno;
+
+        if ( (1 != sscanf (&routeList[slash + 1],
+                           "%u%c",
+                           &bits,
+                           &dummy)) ||
+             (bits > 128))
+        {
+          if (0 == ret)
+          {
+            LOG (GNUNET_ERROR_TYPE_WARNING,
+                 _ ("Wrong format `%s' for netmask\n"),
+                 &routeList[slash]);
+          }
+          else
+          {
+            errno = save;
+            LOG_STRERROR (GNUNET_ERROR_TYPE_WARNING,
+                          "inet_pton");
+          }
+          GNUNET_free (result);
+          GNUNET_free (routeList);
+          return NULL;
+        }
+        off = 0;
+        while (bits > 8)
+        {
+          result[i].netmask.s6_addr[off++] = 0xFF;
+          bits -= 8;
+        }
+        while (bits > 0)
+        {
+          result[i].netmask.s6_addr[off] =
+            (result[i].netmask.s6_addr[off] >> 1) + 0x80;
+          bits--;
+        }
+      }
+    }
+    routeList[slash] = '\0';
+    ret = inet_pton (AF_INET6,
+                     &routeList[start],
+                     &result[i].network);
+    if (ret <= 0)
+    {
+      if (0 == ret)
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             _ ("Wrong format `%s' for network\n"),
+             &routeList[slash + 1]);
+      else
+        LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR,
+                      "inet_pton");
+      GNUNET_free (result);
+      GNUNET_free (routeList);
+      return NULL;
+    }
+    pos++;
+  }
+  GNUNET_free (routeList);
+  return result;
+}
+
+
+/** ******************** Base64 encoding ***********/
+
+#define FILLCHAR '='
+static char *cvt = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                   "abcdefghijklmnopqrstuvwxyz"
+                   "0123456789+/";
+
+
+size_t
+GNUNET_STRINGS_base64_encode (const void *in,
+                              size_t len,
+                              char **output)
+{
+  const unsigned char *data = in;
+  size_t ret;
+  char *opt;
+
+  ret = 0;
+  GNUNET_assert (len < SIZE_MAX / 4);
+  opt = GNUNET_malloc (2 + (len * 4 / 3) + 8);
+  for (size_t i = 0; i < len; ++i)
+  {
+    char c;
+
+    c = (data[i] >> 2) & 0x3f;
+    opt[ret++] = cvt[(int) c];
+    c = (data[i] << 4) & 0x3f;
+    if (++i < len)
+      c |= (data[i] >> 4) & 0x0f;
+    opt[ret++] = cvt[(int) c];
+    if (i < len)
+    {
+      c = (data[i] << 2) & 0x3f;
+      if (++i < len)
+        c |= (data[i] >> 6) & 0x03;
+      opt[ret++] = cvt[(int) c];
+    }
+    else
+    {
+      ++i;
+      opt[ret++] = FILLCHAR;
+    }
+    if (i < len)
+    {
+      c = data[i] & 0x3f;
+      opt[ret++] = cvt[(int) c];
+    }
+    else
+    {
+      opt[ret++] = FILLCHAR;
+    }
+  }
+  *output = opt;
+  return ret;
+}
+
+
+size_t
+GNUNET_STRINGS_base64url_encode (const void *in,
+                                 size_t len,
+                                 char **output)
+{
+  char *enc;
+  size_t pos;
+
+  GNUNET_STRINGS_base64_encode (in,
+                                len,
+                                output);
+  enc = *output;
+  /* Replace with correct characters for base64url */
+  pos = 0;
+  while ('\0' != enc[pos])
+  {
+    if ('+' == enc[pos])
+      enc[pos] = '-';
+    if ('/' == enc[pos])
+      enc[pos] = '_';
+    if ('=' == enc[pos])
+    {
+      enc[pos] = '\0';
+      break;
+    }
+    pos++;
+  }
+  return strlen (enc);
+}
+
+
+#define cvtfind(a)                        \
+        ((((a) >= 'A') && ((a) <= 'Z'))         \
+   ? (a) - 'A'                          \
+   : (((a) >= 'a') && ((a) <= 'z'))     \
+   ? (a) - 'a' + 26                 \
+   : (((a) >= '0') && ((a) <= '9')) \
+   ? (a) - '0' + 52             \
+   : ((a) == '+') ? 62 : ((a) == '/') ? 63 : -1)
+
+
+#define CHECK_CRLF                                                \
+        while ( (data[i] == '\r') || (data[i] == '\n') )                \
+        {                                                               \
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK, \
+                      "ignoring CR/LF\n");                              \
+          i++;                                                          \
+          if (i >= len) {                                               \
+            goto END;                                                   \
+          }                                                             \
+        }
+
+
+size_t
+GNUNET_STRINGS_base64_decode (const char *data,
+                              size_t len,
+                              void **out)
+{
+  unsigned char *output;
+  size_t ret = 0;
+
+  GNUNET_assert (len / 3 < SIZE_MAX);
+  output = GNUNET_malloc ((len * 3 / 4) + 8);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "base64_decode decoding len=%d\n",
+              (int) len);
+  for (size_t i = 0; i < len; ++i)
+  {
+    unsigned char c;
+    unsigned char c1;
+
+    CHECK_CRLF;
+    if (FILLCHAR == data[i])
+      break;
+    c = (unsigned char) cvtfind (data[i]);
+    ++i;
+    CHECK_CRLF;
+    c1 = (unsigned char) cvtfind (data[i]);
+    c = (c << 2) | ((c1 >> 4) & 0x3);
+    output[ret++] = c;
+    if (++i < len)
+    {
+      CHECK_CRLF;
+      c = data[i];
+      if (FILLCHAR == c)
+        break;
+      c = (unsigned char) cvtfind (c);
+      c1 = ((c1 << 4) & 0xf0) | ((c >> 2) & 0xf);
+      output[ret++] = c1;
+    }
+    if (++i < len)
+    {
+      CHECK_CRLF;
+      c1 = data[i];
+      if (FILLCHAR == c1)
+        break;
+
+      c1 = (unsigned char) cvtfind (c1);
+      c = ((c << 6) & 0xc0) | c1;
+      output[ret++] = c;
+    }
+  }
+END:
+  *out = output;
+  return ret;
+}
+
+
+#undef CHECK_CRLF
+
+
+size_t
+GNUNET_STRINGS_base64url_decode (const char *data,
+                                 size_t len,
+                                 void **out)
+{
+  char *s;
+  int padding;
+  size_t ret;
+
+  /* make enough space for padding */
+  GNUNET_assert (len < SIZE_MAX - 3);
+  s = GNUNET_malloc (len + 3);
+  memcpy (s,
+          data,
+          len);
+  for (size_t i = 0; i < strlen (s); i++)
+  {
+    if (s[i] == '-')
+      s[i] = '+';
+    if (s[i] == '_')
+      s[i] = '/';
+  }
+  padding = len % 4;
+  switch (padding) // Pad with trailing '='s
+  {
+  case 0:
+    break;   // No pad chars in this case
+  case 2:
+    memcpy (&s[len],
+            "==",
+            2);
+    len += 2;
+    break;         // Two pad chars
+  case 3:
+    s[len] = '=';
+    len++;
+    break;         // One pad char
+  default:
+    GNUNET_assert (0);
+    break;
+  }
+  ret = GNUNET_STRINGS_base64_decode (s,
+                                      len,
+                                      out);
+  GNUNET_free (s);
+  return ret;
+}
+
+
+size_t
+GNUNET_STRINGS_urldecode (const char *data,
+                          size_t len,
+                          char **out)
+{
+  const char *rpos = data;
+  *out = GNUNET_malloc (len + 1); /* output should always fit into input */
+  char *wpos = *out;
+  size_t resl = 0;
+
+  while ( ('\0' != *rpos) &&
+          (data + len != rpos) )
+  {
+    unsigned int num;
+    switch (*rpos)
+    {
+    case '%':
+      if (rpos + 3 > data + len)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (*out);
+        return 0;
+      }
+      if (1 != sscanf (rpos + 1,
+                       "%2x",
+                       &num))
+      {
+        /* Invalid URL encoding, try to continue anyway */
+        GNUNET_break_op (0);
+        *wpos = *rpos;
+        wpos++;
+        resl++;
+        rpos++;
+        break;
+      }
+      *wpos = (char) ((unsigned char) num);
+      wpos++;
+      resl++;
+      rpos += 3;
+      break;
+    /* TODO: add bad sequence handling */
+    /* intentional fall through! */
+    default:
+      *wpos = *rpos;
+      wpos++;
+      resl++;
+      rpos++;
+    }
+  }
+  *wpos = '\0'; /* add 0-terminator */
+  return resl;
+}
+
+
+size_t
+GNUNET_STRINGS_urlencode (size_t len,
+                          const char data[static len],
+                          char **out)
+{
+  struct GNUNET_Buffer buf = { 0 };
+  const uint8_t *i8 = (uint8_t *) data;
+  const uint8_t *end = (uint8_t *) (data + len);
+
+  while (end != i8)
+  {
+    if (0 == *i8)
+    {
+      /* invalid UTF-8 (or bad @a len): fail */
+      GNUNET_break (0);
+      GNUNET_buffer_clear (&buf);
+      return 0;
+    }
+    if (0 == (0x80 & *i8))
+    {
+      /* traditional ASCII */
+      if (isalnum (*i8) ||
+          (*i8 == '-') ||
+          (*i8 == '_') ||
+          (*i8 == '.') ||
+          (*i8 == '~') )
+        GNUNET_buffer_write (&buf,
+                             (const char*) i8,
+                             1);
+      else if (*i8 == ' ')
+        GNUNET_buffer_write (&buf,
+                             "+",
+                             1);
+      else
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%%%X%X",
+                                  *i8 >> 4,
+                                  *i8 & 15);
+      i8++;
+      continue;
+    }
+    if (0x80 + 0x40 == ((0x80 + 0x40 + 0x20) & *i8))
+    {
+      /* 2-byte value, percent-encode */
+      GNUNET_buffer_write_fstr (&buf,
+                                "%%%X%X",
+                                *i8 >> 4,
+                                *i8 & 15);
+      i8++;
+      if ( (end == i8) ||
+           (0 == *i8) )
+      {
+        /* invalid UTF-8 (or bad @a len): fail */
+        GNUNET_break (0);
+        GNUNET_buffer_clear (&buf);
+        return 0;
+      }
+      GNUNET_buffer_write_fstr (&buf,
+                                "%%%X%X",
+                                *i8 >> 4,
+                                *i8 & 15);
+      i8++;
+      continue;
+    }
+    if (0x80 + 0x40 + 0x20 == ((0x80 + 0x40 + 0x20 + 0x10) & *i8))
+    {
+      /* 3-byte value, percent-encode */
+      for (unsigned int i = 0; i<3; i++)
+      {
+        if ( (end == i8) ||
+             (0 == *i8) )
+        {
+          /* invalid UTF-8 (or bad @a len): fail */
+          GNUNET_break (0);
+          GNUNET_buffer_clear (&buf);
+          return 0;
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%%%X%X",
+                                  *i8 >> 4,
+                                  *i8 & 15);
+        i8++;
+      }
+      continue;
+    }
+    if (0x80 + 0x40 + 0x20 + 0x10 == ((0x80 + 0x40 + 0x20 + 0x10 + 0x08) & *i8))
+    {
+      /* 4-byte value, percent-encode */
+      for (unsigned int i = 0; i<4; i++)
+      {
+        if ( (end == i8) ||
+             (0 == *i8) )
+        {
+          /* invalid UTF-8 (or bad @a len): fail */
+          GNUNET_break (0);
+          GNUNET_buffer_clear (&buf);
+          return 0;
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%%%X%X",
+                                  *i8 >> 4,
+                                  *i8 & 15);
+        i8++;
+      }
+      continue;
+    }
+    if (0x80 + 0x40 + 0x20 + 0x10 + 0x08 == ((0x80 + 0x40 + 0x20 + 0x10 + 0x08
+                                              + 0x04) & *i8))
+    {
+      /* 5-byte value, percent-encode (outside of UTF-8 modern standard, but so what) */
+      for (unsigned int i = 0; i<5; i++)
+      {
+        if ( (end == i8) ||
+             (0 == *i8) )
+        {
+          /* invalid UTF-8 (or bad @a len): fail */
+          GNUNET_break (0);
+          GNUNET_buffer_clear (&buf);
+          return 0;
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%%%X%X",
+                                  *i8 >> 4,
+                                  *i8 & 15);
+        i8++;
+      }
+      continue;
+    }
+    if (0x80 + 0x40 + 0x20 + 0x10 + 0x08 + 0x04 == ((0x80 + 0x40 + 0x20 + 0x10
+                                                     + 0x08 + 0x04 + 0x02)
+                                                    & *i8))
+    {
+      /* 6-byte value, percent-encode (outside of UTF-8 modern standard, but so what) */
+      for (unsigned int i = 0; i<6; i++)
+      {
+        if ( (end == i8) ||
+             (0 == *i8) )
+        {
+          /* invalid UTF-8 (or bad @a len): fail */
+          GNUNET_break (0);
+          GNUNET_buffer_clear (&buf);
+          return 0;
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%%%X%X",
+                                  *i8 >> 4,
+                                  *i8 & 15);
+        i8++;
+      }
+      continue;
+    }
+    /* really, really invalid UTF-8: fail */
+    GNUNET_break (0);
+    GNUNET_buffer_clear (&buf);
+    return 0;
+  }
+  *out = GNUNET_buffer_reap_str (&buf);
+  return strlen (*out);
+}
+
+
+/**
+ * Sometimes we use the binary name to determine which specific
+ * test to run.  In those cases, the string after the last "_"
+ * in 'argv[0]' specifies a string that determines the configuration
+ * file or plugin to use.
+ *
+ * This function returns the respective substring, taking care
+ * of issues such as binaries ending in '.exe' on W32.
+ *
+ * @param argv0 the name of the binary
+ * @return string between the last '_' and the '.exe' (or the end of the string),
+ *         NULL if argv0 has no '_'
+ */
+char *
+GNUNET_STRINGS_get_suffix_from_binary_name (const char *argv0)
+{
+  const char *ret;
+  const char *dot;
+
+  ret = strrchr (argv0, '_');
+  if (NULL == ret)
+    return NULL;
+  ret++; /* skip underscore */
+  dot = strchr (ret,
+                '.');
+  if (NULL != dot)
+    return GNUNET_strndup (ret,
+                           dot - ret);
+  return GNUNET_strdup (ret);
+}
+
+
+/* end of strings.c */
diff --git a/src/lib/util/test_bio.c b/src/lib/util/test_bio.c
new file mode 100644
index 000000000..b407eccfe
--- /dev/null
+++ b/src/lib/util/test_bio.c
@@ -0,0 +1,383 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2023 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_bio.c
+ * @brief testcase for the buffered IO module
+ * @author Ji Lu
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#define TESTSTRING "testString"
+#define TESTNUMBER64 ((int64_t) 100000L)
+
+
+static int
+test_normal_rw (void)
+{
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  void *buffer;
+  size_t buffer_size = 0;
+  char *filename = GNUNET_DISK_mktemp ("gnunet-bio");
+  char *rString = NULL;
+  int64_t wNum = TESTNUMBER64;
+  int64_t rNum = 0;
+  struct GNUNET_BIO_WriteSpec ws[] = {
+    GNUNET_BIO_write_spec_string ("test-normal-rw-string",
+                                  TESTSTRING),
+    GNUNET_BIO_write_spec_int64 ("test-normal-rw-int64",
+                                 &wNum),
+    GNUNET_BIO_write_spec_end (),
+  };
+  struct GNUNET_BIO_ReadSpec rs[] = {
+    GNUNET_BIO_read_spec_string ("test-normal-rw-string",
+                                 &rString,
+                                 200),
+    GNUNET_BIO_read_spec_int64 ("test-normal-rw-int64",
+                                &rNum),
+    GNUNET_BIO_read_spec_end (),
+  };
+
+  /* I/O on file */
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_spec_commit (wh, ws));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh, NULL));
+
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_spec_commit (rh,
+                                              rs));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_assert (0 == strcmp (TESTSTRING,
+                              rString));
+  GNUNET_assert (wNum == rNum);
+  GNUNET_free (rString);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_directory_remove (filename));
+  GNUNET_free (filename);
+
+  /* I/O on buffer */
+  wh = GNUNET_BIO_write_open_buffer ();
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_spec_commit (wh,
+                                               ws));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_get_buffer_contents (wh,
+                                                 NULL,
+                                                 &buffer,
+                                                 &buffer_size));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh,
+                                         NULL));
+
+  rh = GNUNET_BIO_read_open_buffer (buffer,
+                                    buffer_size);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_spec_commit (rh,
+                                              rs));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_assert (0 == strcmp (TESTSTRING,
+                              rString));
+  GNUNET_assert (wNum == rNum);
+  GNUNET_free (rString);
+  GNUNET_free (buffer);
+
+  return 0;
+}
+
+
+static int
+test_nullstring_rw (void)
+{
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  char *filename = GNUNET_DISK_mktemp ("gnunet_bio");
+  char *rString = "not null";
+
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_string (wh,
+                                          "test-nullstring-rw",
+                                          NULL));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh,
+                                         NULL));
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_string (rh,
+                                         "test-nullstring-rw",
+                                         &rString,
+                                         200));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_assert (NULL == rString);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_directory_remove (filename));
+  GNUNET_free (filename);
+  return 0;
+}
+
+
+static int
+test_emptystring_rw (void)
+{
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  char *filename = GNUNET_DISK_mktemp ("gnunet_bio");
+  char *rString = NULL;
+
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_string (wh,
+                                          "test-emptystring-rw",
+                                          ""));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh,
+                                         NULL));
+
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_string (rh,
+                                         "test-emptystring-rw",
+                                         &rString, 200));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_free (rString);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_directory_remove (filename));
+  GNUNET_free (filename);
+  return 0;
+}
+
+
+static int
+test_bigstring_rw (void)
+{
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  char *filename = GNUNET_DISK_mktemp ("gnunet_bio");
+  char *rString = NULL;
+
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_string (wh,
+                                          "test-bigstring-rw",
+                                          TESTSTRING));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh,
+                                         NULL));
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_string (rh,
+                                         "test-bigstring-rw",
+                                         &rString, 1));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_assert (NULL == rString);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_directory_remove (filename));
+  GNUNET_free (filename);
+  return 0;
+}
+
+
+static int
+test_directory_r (void)
+{
+#ifdef LINUX
+  struct GNUNET_BIO_ReadHandle *rh;
+  char rString[200];
+
+  rh = GNUNET_BIO_read_open_file ("/dev");
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read (rh,
+                                  "test-directory-r",
+                                  rString,
+                                  sizeof (rString)));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+#endif
+  return 0;
+}
+
+
+static int
+test_nullfile_rw (void)
+{
+  static char filename[102401];
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+
+  memset (filename, 'a', sizeof (filename));
+  filename[sizeof (filename) - 1] = '\0';
+
+  GNUNET_log_skip (1, GNUNET_NO);
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_log_skip (0, GNUNET_YES);
+  GNUNET_assert (NULL == wh);
+
+  GNUNET_log_skip (1, GNUNET_NO);
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_log_skip (0, GNUNET_YES);
+  GNUNET_assert (NULL == rh);
+
+  return 0;
+}
+
+
+static int
+test_fullfile_rw (void)
+{
+#ifdef LINUX
+  /* /dev/full doesn't exist on every platform */
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  char *rString = NULL;
+  char rResult[200];
+
+  struct GNUNET_BIO_WriteSpec ws[] = {
+    GNUNET_BIO_write_spec_object ("test-fullfile-rw-bytes",
+                                  TESTSTRING,
+                                  strlen (TESTSTRING)),
+    GNUNET_BIO_write_spec_string ("test-fullfile-rw-string",
+                                  TESTSTRING),
+    GNUNET_BIO_write_spec_end (),
+  };
+
+  struct GNUNET_BIO_ReadSpec rs[] = {
+    GNUNET_BIO_read_spec_object ("test-fullfile-rw-bytes",
+                                 rResult,
+                                 sizeof (rResult)),
+    GNUNET_BIO_read_spec_string ("test-fullfile-rw-string",
+                                 &rString,
+                                 200),
+    GNUNET_BIO_read_spec_end (),
+  };
+
+  wh = GNUNET_BIO_write_open_file ("/dev/full");
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_write_spec_commit (wh, ws));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_write_close (wh, NULL));
+
+  rh = GNUNET_BIO_read_open_file ("/dev/null");
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_spec_commit (rh, rs));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_close (rh, NULL));
+
+  GNUNET_assert (NULL == rString);
+#endif
+  return 0;
+}
+
+
+static int
+test_fakestring_rw (void)
+{
+  struct GNUNET_BIO_WriteHandle *wh;
+  struct GNUNET_BIO_ReadHandle *rh;
+  char *filename = GNUNET_DISK_mktemp ("gnunet_bio");
+  char *rString = NULL;
+
+  wh = GNUNET_BIO_write_open_file (filename);
+  GNUNET_assert (NULL != wh);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_int32 (wh,
+                                         "test-fakestring-rw-int32",
+                                         2));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_BIO_write_close (wh,
+                                         NULL));
+
+  rh = GNUNET_BIO_read_open_file (filename);
+  GNUNET_assert (NULL != rh);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_string (rh,
+                                         "test-fakestring-rw-string",
+                                         &rString,
+                                         200));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_BIO_read_close (rh,
+                                        NULL));
+  GNUNET_assert (NULL == rString);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_DISK_directory_remove (filename));
+  GNUNET_free (filename);
+  return 0;
+}
+
+
+static int
+check_string_rw (void)
+{
+  GNUNET_assert (0 == test_nullstring_rw ());
+  GNUNET_assert (0 == test_emptystring_rw ());
+  GNUNET_assert (0 == test_bigstring_rw ());
+  GNUNET_assert (0 == test_fakestring_rw ());
+  return 0;
+}
+
+
+static int
+check_file_rw (void)
+{
+  GNUNET_assert (0 == test_normal_rw ());
+  GNUNET_assert (0 == test_nullfile_rw ());
+  GNUNET_assert (0 == test_fullfile_rw ());
+  GNUNET_assert (0 == test_directory_r ());
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_log_setup ("test-bio", "WARNING", NULL);
+  GNUNET_assert (0 == check_file_rw ());
+  GNUNET_assert (0 == check_string_rw ());
+  return 0;
+}
+
+
+/* end of test_bio.c */
diff --git a/src/lib/util/test_child_management.c b/src/lib/util/test_child_management.c
new file mode 100644
index 000000000..90cc74c72
--- /dev/null
+++ b/src/lib/util/test_child_management.c
@@ -0,0 +1,178 @@
+/*
+  This file is part of GNUnet
+  Copyright (C) 2014-2021 GNUnet e.V.
+
+  GNUNET is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as
+  published by the Free Software Foundation; either version 3, or
+  (at your option) any later version.
+
+  GNUNET is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public
+  License along with GNUNET; see the file COPYING.  If not, see
+  <http://www.gnu.org/licenses/>
+*/
+
+/**
+ * @file lib/test_child_management.c
+ * @brief testcase to test the child management
+ * @author Christian Grothoff
+ * @author Dominik Meister
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static struct GNUNET_ChildWaitHandle *cwh;
+
+static int global_ret;
+
+static struct GNUNET_OS_Process *pid;
+
+
+static void
+child_completed_callback (void *cls,
+                          enum GNUNET_OS_ProcessStatusType type,
+                          long unsigned int exit_code)
+{
+  cwh = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Process extided with code: %lu \n",
+              exit_code);
+  FILE *file;
+  char code[9];
+
+  file = fopen ("child_management_test.txt", "r");
+  if (NULL == file)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "could not find file: child_management_test.txt in %s:%u\n",
+                __FILE__,
+                __LINE__);
+    global_ret = 1;
+    return;
+  }
+  if (0 == fscanf (file,
+                   "%8s",
+                   code))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "could not read file: child_management_test.txt in %s:%u\n",
+                __FILE__,
+                __LINE__);
+    global_ret = 1;
+    return;
+  }
+
+  if (0 != strcmp ("12345678", code))
+  {
+    global_ret = 1;
+    return;
+  }
+  GNUNET_OS_process_destroy (pid);
+  pid = NULL;
+  GNUNET_break (0 == unlink ("child_management_test.txt"));
+  GNUNET_SCHEDULER_shutdown ();
+  global_ret = 0;
+}
+
+
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != cwh)
+  {
+    GNUNET_wait_child_cancel (cwh);
+    cwh = NULL;
+  }
+  if (NULL != pid)
+  {
+    GNUNET_assert (0 ==
+                   GNUNET_OS_process_kill (pid,
+                                           SIGKILL));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_OS_process_wait (pid));
+    GNUNET_OS_process_destroy (pid);
+    pid = NULL;
+  }
+}
+
+
+static void
+test_child_management (void *cls)
+{
+  const char *command = "./child_management_test.sh";
+  struct GNUNET_DISK_PipeHandle *p;
+  struct GNUNET_DISK_FileHandle *out;
+
+  (void) cls;
+  p = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+  if (NULL == p)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                         "pipe");
+    global_ret = 2;
+    return;
+  }
+  pid = GNUNET_OS_start_process (0,
+                                 p,
+                                 NULL,
+                                 NULL,
+                                 command,
+                                 command,
+                                 "1234",
+                                 "5678",
+                                 NULL);
+  if (NULL == pid)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                         "fork");
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_DISK_pipe_close (p));
+    global_ret = 1;
+    return;
+  }
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_pipe_close_end (p,
+                                            GNUNET_DISK_PIPE_END_READ));
+  out = GNUNET_DISK_pipe_detach_end (p,
+                                     GNUNET_DISK_PIPE_END_WRITE);
+  GNUNET_assert (NULL != out);
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_pipe_close (p));
+
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"Alright");
+  cwh = GNUNET_wait_child (pid,
+                           &child_completed_callback,
+                           cls);
+  GNUNET_break (NULL != cwh);
+  GNUNET_assert (5 ==
+                 GNUNET_DISK_file_write (out,
+                                         "Hello",
+                                         5));
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_file_close (out));
+}
+
+
+int
+main (int argc,
+      const char *const argv[])
+{
+  GNUNET_log_setup (argv[0],
+                    "DEBUG",
+                    NULL);
+  GNUNET_SCHEDULER_run (&test_child_management,
+                        NULL);
+  return global_ret;
+}
+
+
+/* end of test_anastasis_child_management.c */
diff --git a/src/lib/util/test_client.c b/src/lib/util/test_client.c
new file mode 100644
index 000000000..64c32f646
--- /dev/null
+++ b/src/lib/util/test_client.c
@@ -0,0 +1,197 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_client.c
+ * @brief tests for client.c
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static int global_ret;
+
+static struct GNUNET_MQ_Handle *client_mq;
+
+#define MY_TYPE 130
+
+
+/**
+ * Callback that just bounces the message back to the sender.
+ */
+static void
+handle_echo (void *cls,
+             const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+  struct GNUNET_MQ_Handle *mq = GNUNET_SERVICE_client_get_mq (c);
+  struct GNUNET_MQ_Envelope *env;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving message from client, bouncing back\n");
+  env = GNUNET_MQ_msg_copy (message);
+  GNUNET_MQ_send (mq,
+                  env);
+  GNUNET_SERVICE_client_continue (c);
+}
+
+
+static void
+handle_bounce (void *cls,
+               const struct GNUNET_MessageHeader *got)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving bounce, checking content\n");
+  GNUNET_assert (NULL != got);
+  global_ret = 2;
+  GNUNET_MQ_destroy (client_mq);
+  client_mq = NULL;
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_STATISTICS_Handle *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  GNUNET_assert (0);  /* should never happen */
+}
+
+
+static void
+task (void *cls,
+      const struct GNUNET_CONFIGURATION_Handle *cfg,
+      struct GNUNET_SERVICE_Handle *sh)
+{
+  struct GNUNET_MQ_MessageHandler chandlers[] = {
+    GNUNET_MQ_hd_fixed_size (bounce,
+                             MY_TYPE,
+                             struct GNUNET_MessageHeader,
+                             cls),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  /* test that ill-configured client fails instantly */
+  GNUNET_assert (NULL ==
+                 GNUNET_CLIENT_connect (cfg,
+                                        "invalid-service",
+                                        NULL,
+                                        &mq_error_handler,
+                                        NULL));
+  client_mq = GNUNET_CLIENT_connect (cfg,
+                                     "test_client",
+                                     chandlers,
+                                     &mq_error_handler,
+                                     NULL);
+  GNUNET_assert (NULL != client_mq);
+  env = GNUNET_MQ_msg (msg,
+                       MY_TYPE);
+  GNUNET_MQ_send (client_mq,
+                  env);
+}
+
+
+/**
+ * Function called when the client connects to the service.
+ *
+ * @param cls the name of the service
+ * @param c connecting client
+ * @param mq message queue to talk to the client
+ * @return @a c
+ */
+static void *
+connect_cb (void *cls,
+            struct GNUNET_SERVICE_Client *c,
+            struct GNUNET_MQ_Handle *mq)
+{
+  return c;
+}
+
+
+/**
+ * Function called when the client disconnects.
+ *
+ * @param cls our service name
+ * @param c disconnecting client
+ * @param internal_cls must match @a c
+ */
+static void
+disconnect_cb (void *cls,
+               struct GNUNET_SERVICE_Client *c,
+               void *internal_cls)
+{
+  if (2 == global_ret)
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    global_ret = 0;
+  }
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  struct GNUNET_MQ_MessageHandler shandlers[] = {
+    GNUNET_MQ_hd_fixed_size (echo,
+                             MY_TYPE,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+  char *test_argv[] = {
+    (char *) "test_client",
+    "-c",
+    "test_client_data.conf",
+    NULL
+  };
+
+  GNUNET_log_setup ("test_client",
+                    "WARNING",
+                    NULL);
+  if (0 != strstr (argv[0],
+                   "unix"))
+    test_argv[2] = "test_client_unix.conf";
+  global_ret = 1;
+  if (0 !=
+      GNUNET_SERVICE_run_ (3,
+                           test_argv,
+                           "test_client",
+                           GNUNET_SERVICE_OPTION_NONE,
+                           &task,
+                           &connect_cb,
+                           &disconnect_cb,
+                           NULL,
+                           shandlers))
+    global_ret = 3;
+  return global_ret;
+}
+
+
+/* end of test_client.c */
diff --git a/src/lib/util/test_client_data.conf b/src/lib/util/test_client_data.conf
new file mode 100644
index 000000000..fa9a0be03
--- /dev/null
+++ b/src/lib/util/test_client_data.conf
@@ -0,0 +1,3 @@
+[test_client]
+PORT=14325
+HOSTNAME=localhost
diff --git a/src/lib/util/test_client_unix.conf b/src/lib/util/test_client_unix.conf
new file mode 100644
index 000000000..d3d90627d
--- /dev/null
+++ b/src/lib/util/test_client_unix.conf
@@ -0,0 +1,6 @@
+[test_client]
+PORT=0
+HOSTNAME=localhost
+UNIXPATH=$GNUNET_RUNTIME_DIR/test-client-unix.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
diff --git a/src/lib/util/test_common_allocation.c b/src/lib/util/test_common_allocation.c
new file mode 100644
index 000000000..d4cc4bb58
--- /dev/null
+++ b/src/lib/util/test_common_allocation.c
@@ -0,0 +1,179 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2005, 2006, 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_common_allocation.c
+ * @brief testcase for common_allocation.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static int
+check (void)
+{
+#define MAX_TESTVAL 1024
+  char *ptrs[MAX_TESTVAL];
+  unsigned int **a2;
+  char ***a3;
+  char *tmp;
+  int i;
+  int j;
+  int k;
+  unsigned int ui;
+
+  /* GNUNET_malloc/GNUNET_free test */
+  k = 352;                      /* random start value */
+  for (i = 1; i < MAX_TESTVAL; i++)
+  {
+    ptrs[i] = GNUNET_malloc (i);
+    for (j = 0; j < i; j++)
+      ptrs[i][j] = k++;
+  }
+
+  for (i = MAX_TESTVAL - 1; i >= 1; i--)
+  {
+    for (j = i - 1; j >= 0; j--)
+      if (ptrs[i][j] != (char) --k)
+        return 1;
+    GNUNET_free (ptrs[i]);
+  }
+
+  /* GNUNET_free test */
+  tmp = GNUNET_malloc (4);
+  GNUNET_free (tmp);
+
+  /* GNUNET_strdup tests */
+  ptrs[0] = GNUNET_strdup ("bar");
+  if (0 != strcmp (ptrs[0], "bar"))
+    return 3;
+  /* now realloc */
+  ptrs[0] = GNUNET_realloc (ptrs[0], 12);
+  strcpy (ptrs[0], "Hello World");
+
+  GNUNET_free (ptrs[0]);
+  GNUNET_asprintf (&ptrs[0], "%s %s", "Hello", "World");
+  GNUNET_assert (strlen (ptrs[0]) == 11);
+  GNUNET_free (ptrs[0]);
+
+  /* GNUNET_array_grow tests */
+  ptrs[0] = NULL;
+  ui = 0;
+  GNUNET_array_grow (ptrs[0], ui, 42);
+  if (ui != 42)
+    return 4;
+  GNUNET_array_grow (ptrs[0], ui, 22);
+  if (ui != 22)
+    return 5;
+  for (j = 0; j < 22; j++)
+    ptrs[0][j] = j;
+  GNUNET_array_grow (ptrs[0], ui, 32);
+  for (j = 0; j < 22; j++)
+    if (ptrs[0][j] != j)
+      return 6;
+  for (j = 22; j < 32; j++)
+    if (ptrs[0][j] != 0)
+      return 7;
+  GNUNET_array_grow (ptrs[0], ui, 0);
+  if (i != 0)
+    return 8;
+  if (ptrs[0] != NULL)
+    return 9;
+
+  /* GNUNET_new_array_2d tests */
+  a2 = GNUNET_new_array_2d (17, 22, unsigned int);
+  for (i = 0; i < 17; i++)
+  {
+    for (j = 0; j < 22; j++)
+    {
+      if (0 != a2[i][j])
+      {
+        GNUNET_free (a2);
+        return 10;
+      }
+      a2[i][j] = i * 100 + j;
+    }
+  }
+  GNUNET_free (a2);
+
+  /* GNUNET_new_array_3d tests */
+  a3 = GNUNET_new_array_3d (2, 3, 4, char);
+  for (i = 0; i < 2; i++)
+  {
+    for (j = 0; j < 3; j++)
+    {
+      for (k = 0; k < 4; k++)
+      {
+        if (0 != a3[i][j][k])
+        {
+          GNUNET_free (a3);
+          return 11;
+        }
+        a3[i][j][k] = i * 100 + j * 10 + k;
+      }
+    }
+  }
+  GNUNET_free (a3);
+  return 0;
+}
+
+
+static int
+check2 (void)
+{
+  char *a1 = NULL;
+  unsigned int a1_len = 0;
+  const char *a2 = "test";
+
+  GNUNET_array_append (a1,
+                       a1_len,
+                       'x');
+  GNUNET_array_concatenate (a1,
+                            a1_len,
+                            a2,
+                            4);
+  GNUNET_assert (0 == strncmp ("xtest",
+                               a1,
+                               5));
+  GNUNET_assert (5 == a1_len);
+  GNUNET_free (a1);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret;
+
+  GNUNET_log_setup ("test-common-allocation",
+                    "WARNING",
+                    NULL);
+  ret = check () | check2 ();
+  if (ret != 0)
+    fprintf (stderr,
+             "ERROR %d.\n",
+             ret);
+  return ret;
+}
+
+
+/* end of test_common_allocation.c */
diff --git a/src/lib/util/test_common_endian.c b/src/lib/util/test_common_endian.c
new file mode 100644
index 000000000..2c11c594e
--- /dev/null
+++ b/src/lib/util/test_common_endian.c
@@ -0,0 +1,44 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_common_endian.c
+ * @brief testcase for common_endian.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define CHECK(n) if (n != GNUNET_htonll (GNUNET_ntohll (n))) return 1;
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_log_setup ("test-common-endian", "WARNING", NULL);
+  CHECK (1);
+  CHECK (0x12345678);
+  CHECK (123456789012345LL);
+  if ((0x1234567890ABCDEFLL != GNUNET_htonll (0xEFCDAB9078563412LL)) &&
+      (42 != htonl (42)) )
+    return 1;
+  return 0;
+}
+
+
+/* end of test_common_endian.c */
diff --git a/src/lib/util/test_common_logging.c b/src/lib/util/test_common_logging.c
new file mode 100644
index 000000000..a2e49f20a
--- /dev/null
+++ b/src/lib/util/test_common_logging.c
@@ -0,0 +1,100 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_common_logging.c
+ * @brief testcase for the logging module
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static void
+my_log (void *ctx, enum GNUNET_ErrorType kind, const char *component,
+        const char *date, const char *msg)
+{
+  unsigned int *c = ctx;
+
+  (*c)++;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  unsigned int failureCount = 0;
+  unsigned int logs = 0;
+
+  if (0 != putenv ("GNUNET_FORCE_LOG="))
+    fprintf (stderr, "Failed to putenv: %s\n", strerror (errno));
+  GNUNET_log_setup ("test-common-logging", "DEBUG", "/dev/null");
+  GNUNET_logger_add (&my_log, &logs);
+  GNUNET_logger_add (&my_log, &logs);
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Testing...\n");
+  GNUNET_logger_remove (&my_log, &logs);
+  GNUNET_log (GNUNET_ERROR_TYPE_BULK, "Flusher...\n");
+  /* the last 6 calls should be merged (repated bulk messages!) */
+  GNUNET_logger_remove (&my_log, &logs);
+  if (logs != 4)
+  {
+    fprintf (stdout, "Expected 4 log calls, got %u\n", logs);
+    failureCount++;
+  }
+  GNUNET_break (0 ==
+                strcmp (_ ("ERROR"),
+                        GNUNET_error_type_to_string (GNUNET_ERROR_TYPE_ERROR)));
+  GNUNET_break (0 ==
+                strcmp (_ ("WARNING"),
+                        GNUNET_error_type_to_string
+                          (GNUNET_ERROR_TYPE_WARNING)));
+  GNUNET_break (0 ==
+                strcmp (_ ("INFO"),
+                        GNUNET_error_type_to_string (GNUNET_ERROR_TYPE_INFO)));
+  GNUNET_break (0 ==
+                strcmp (_ ("DEBUG"),
+                        GNUNET_error_type_to_string (GNUNET_ERROR_TYPE_DEBUG)));
+  GNUNET_log_setup ("test_common_logging", "WARNING", "/dev/null");
+  logs = 0;
+  GNUNET_logger_add (&my_log, &logs);
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Checker...\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Drop me...\n");
+  GNUNET_logger_remove (&my_log, &logs);
+  if (logs != 1)
+  {
+    fprintf (stdout, "Expected 1 log call, got %u\n", logs);
+    failureCount++;
+  }
+
+  if (failureCount != 0)
+  {
+    fprintf (stdout, "%u TESTS FAILED!\n", failureCount);
+    return -1;
+  }
+  return 0;
+}                               /* end of main */
+
+
+/* end of test_common_logging.c */
diff --git a/src/lib/util/test_common_logging_dummy.c b/src/lib/util/test_common_logging_dummy.c
new file mode 100644
index 000000000..7e362c683
--- /dev/null
+++ b/src/lib/util/test_common_logging_dummy.c
@@ -0,0 +1,123 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_common_logging_dummy.c
+ * @brief dummy labrat for the testcase for the logging module (runtime
+ * log level adjustment)
+ * @author LRN
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#undef GNUNET_EXTRA_LOGGING
+#define GNUNET_EXTRA_LOGGING GNUNET_YES
+
+/**
+ * Artificial delay attached to each log call that is not skipped out.
+ * This must be long enough for us to not to mistake skipped log call
+ * on a slow machine for a non-skipped one.
+ */
+#define OUTPUT_DELAY \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MICROSECONDS, 1000)
+
+static void
+my_log (void *ctx,
+        enum GNUNET_ErrorType kind,
+        const char *component,
+        const char *date,
+        const char *msg)
+{
+  (void) ctx;
+  (void) kind;
+  (void) component;
+  (void) date;
+  if (strncmp ("test-common-logging-dummy", component, 25) != 0)
+    return;
+  fprintf (stdout, "%s", msg);
+  fflush (stdout);
+}
+
+
+#if ! defined(GNUNET_CULL_LOGGING)
+static int
+expensive_func ()
+{
+  return GNUNET_NETWORK_socket_select (NULL, NULL, NULL, OUTPUT_DELAY);
+}
+
+
+#endif
+
+
+#define pr(kind, lvl)                                                         \
+  {                                                                           \
+    struct GNUNET_TIME_Absolute t1, t2;                                       \
+    t1 = GNUNET_TIME_absolute_get ();                                         \
+    GNUNET_log (kind, "L%s %d\n", lvl, expensive_func ());                    \
+    t2 = GNUNET_TIME_absolute_get ();                                         \
+    printf ("1%s %llu\n",                                                     \
+            lvl,                                                              \
+            (unsigned long long) GNUNET_TIME_absolute_get_difference (t1, t2) \
+            .rel_value_us);                                                 \
+  }
+
+#define pr2(kind, lvl)                                                        \
+  {                                                                           \
+    struct GNUNET_TIME_Absolute t1, t2;                                       \
+    t1 = GNUNET_TIME_absolute_get ();                                         \
+    GNUNET_log (kind, "L%s %d\n", lvl, expensive_func ());                    \
+    t2 = GNUNET_TIME_absolute_get ();                                         \
+    printf ("2%s %llu\n",                                                     \
+            lvl,                                                              \
+            (unsigned long long) GNUNET_TIME_absolute_get_difference (t1, t2) \
+            .rel_value_us);                                                 \
+  }
+
+
+int
+main (int argc, char *argv[])
+{
+  (void) argc;
+  (void) argv;
+  /* We set up logging with NULL level - will be overridden by
+   * GNUNET_LOG or GNUNET_FORCE_LOG at runtime.
+   */
+  GNUNET_log_setup ("test-common-logging-dummy", NULL, "/dev/null");
+  GNUNET_logger_add (&my_log, NULL);
+  pr (GNUNET_ERROR_TYPE_ERROR, "ERROR");
+  pr (GNUNET_ERROR_TYPE_WARNING, "WARNING");
+  pr (GNUNET_ERROR_TYPE_INFO, "INFO");
+  pr (GNUNET_ERROR_TYPE_DEBUG, "DEBUG");
+
+  /* We set up logging with WARNING level - will onle be overridden by
+   * GNUNET_FORCE_LOG at runtime.
+   */
+  GNUNET_log_setup ("test-common-logging-dummy", "WARNING", "/dev/null");
+  pr2 (GNUNET_ERROR_TYPE_ERROR, "ERROR");
+  pr2 (GNUNET_ERROR_TYPE_WARNING, "WARNING");
+  pr2 (GNUNET_ERROR_TYPE_INFO, "INFO");
+  pr2 (GNUNET_ERROR_TYPE_DEBUG, "DEBUG");
+  return 0;
+} /* end of main */
+
+
+/* end of test_common_logging_dummy.c */
diff --git a/src/lib/util/test_common_logging_runtime_loglevels.c b/src/lib/util/test_common_logging_runtime_loglevels.c
new file mode 100644
index 000000000..f3f2fd64f
--- /dev/null
+++ b/src/lib/util/test_common_logging_runtime_loglevels.c
@@ -0,0 +1,457 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_common_logging_runtime_loglevels.c
+ * @brief testcase for the logging module  (runtime log level adjustment)
+ * @author LRN
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define VERBOSE GNUNET_NO
+
+/**
+ * How much time the child is allowed to waste on skipped log calls, at most.
+ * Raspberry Pi takes 113 microseconds tops, this is 3x that value.
+ */
+#define MAX_SKIP_DELAY GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MICROSECONDS, 400).rel_value_us
+
+/**
+ * How much time non-skipped log call should take, at least.
+ * Keep in sync with the value in the dummy!
+ */
+#define OUTPUT_DELAY GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MICROSECONDS, 1000).rel_value_us
+
+static int ok;
+
+static int phase = 0;
+
+static struct GNUNET_OS_Process *proc;
+
+/* Pipe to read from started processes stdout (on read end) */
+static struct GNUNET_DISK_PipeHandle *pipe_stdout;
+
+static struct GNUNET_SCHEDULER_Task *die_task;
+
+static struct GNUNET_SCHEDULER_Task *read_task;
+
+static void
+runone (void);
+
+
+static void
+end_task (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ending phase %d, ok is %d\n", phase,
+              ok);
+  if (NULL != proc)
+  {
+    if (0 != GNUNET_OS_process_kill (proc, GNUNET_TERM_SIG))
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+    }
+    GNUNET_OS_process_wait (proc);
+    GNUNET_OS_process_destroy (proc);
+    proc = NULL;
+  }
+  if (NULL != read_task)
+  {
+    GNUNET_SCHEDULER_cancel (read_task);
+    read_task = NULL;
+  }
+  GNUNET_DISK_pipe_close (pipe_stdout);
+  if (ok == 1)
+  {
+    if (phase < 9)
+    {
+      phase += 1;
+      runone ();
+    }
+    else
+      ok = 0;
+  }
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "failing\n");
+}
+
+
+static char *
+read_output_line (int phase_from1, int phase_to1, int phase_from2,
+                  int phase_to2, char c, const char *expect_level,
+                  long delay_morethan, long delay_lessthan, int phase,
+                  char *p,
+                  int *len, long *delay, char level[8])
+{
+  char *r = p;
+  char t[7];
+  int i, j, stop = 0;
+  int level_matches;
+  int delay_is_sane;
+  int delay_is_a_dummy;
+  int delay_outside_of_range;
+
+  j = 0;
+  int stage = 0;
+
+  if (! ((phase >= phase_from1) && (phase <= phase_to1)) &&
+      ! ((phase >= phase_from2) && (phase <= phase_to2)))
+    return p;
+#if 0
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Trying to match '%c%s \\d\\r\\n' on %s\n", c, expect_level, p);
+#endif
+  for (i = 0; i < *len && ! stop; i++)
+  {
+    switch (stage)
+    {
+    case 0:                    /* read first char */
+      if (r[i] != c)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Expected '%c', but got '%c'\n", c,
+                    r[i]);
+        GNUNET_break (0);
+        return NULL;
+      }
+      stage += 1;
+      break;
+
+    case 1:                    /* read at most 7 char-long error level string, finished by ' ' */
+      if (r[i] == ' ')
+      {
+        level[j] = '\0';
+        stage += 1;
+        j = 0;
+      }
+      else if (i == 8)
+      {
+        GNUNET_break (0);
+        ok = 2;
+        return NULL;
+      }
+      else
+        level[j++] = r[i];
+      break;
+
+    case 2:                    /* read the delay, finished by '\n' */
+      t[j++] = r[i];
+      if (r[i] == '\n')
+      {
+        t[j - 1] = '\0';
+        *delay = strtol (t, NULL, 10);
+        stop = 1;
+      }
+      break;
+    }
+  }
+  level_matches = (strcmp (expect_level, level) == 0);
+  delay_is_sane = (*delay >= 0) && (*delay <= 1000000);
+  delay_is_a_dummy = (c == 'L');
+  /* Delay must be either less than 'lessthan' (log call is skipped)
+   * or more than 'morethan' (log call is not skipped)
+   */
+  delay_outside_of_range = ((*delay < delay_lessthan) || (*delay >=
+                                                          delay_morethan));
+  if (delay_is_a_dummy)
+    delay_outside_of_range = 1;
+
+  if (! stop)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Wrong log format?\n");
+  if (! level_matches)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Wrong log level\n");
+  if (! delay_is_sane)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Delay %ld is insane\n",
+                *delay);
+  if (! delay_outside_of_range)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Delay %ld is not outside of range (%ld ; %ld)\n",
+                *delay,
+                delay_lessthan,
+                delay_morethan);
+  if (! stop || ! level_matches || ! delay_is_sane || ! delay_outside_of_range)
+    return NULL;
+  *len = *len - i;
+  return &r[i];
+}
+
+
+/**
+ * Up to 8 non-skipped GNUNET_log() calls
+ * + extra line with delay for each one
+ */
+#define LOG_MAX_NUM_LINES (8 * 2)
+/**
+ * Actual message is 17 chars at most
+ */
+#define LOG_MAX_LINE_LENGTH (17)
+
+#define LOG_BUFFER_SIZE LOG_MAX_NUM_LINES *LOG_MAX_LINE_LENGTH
+
+static char buf[LOG_BUFFER_SIZE];
+
+static char *buf_ptr;
+
+static int bytes;
+
+
+static void
+read_call (void *cls)
+{
+  const struct GNUNET_DISK_FileHandle *stdout_read_handle = cls;
+  char level[8];
+  long delay;
+  long delays[8];
+  int rd;
+
+  read_task = NULL;
+  rd = GNUNET_DISK_file_read (stdout_read_handle, buf_ptr,
+                              sizeof(buf) - bytes);
+  if (rd > 0)
+  {
+    buf_ptr += rd;
+    bytes += rd;
+#if VERBOSE
+    fprintf (stderr, "got %d bytes, reading more\n", rd);
+#endif
+    read_task = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                                stdout_read_handle,
+                                                &read_call,
+                                                (void *) stdout_read_handle);
+    return;
+  }
+
+#if VERBOSE
+  fprintf (stderr, "bytes is %d:%s\n", bytes, buf);
+#endif
+
+  /* +------CHILD OUTPUT--
+   * |      SOFT     HARD
+   * |    E W I D  E W I D
+   * | 0E *        * *
+   * | 1W * *      * *
+   * P 2I * * *    * *
+   * H 3D * * * *  * *
+   * A
+   * S 4E *        *
+   * E 5W * *      * *
+   * | 6I * * *    * * *
+   * | 7D * * * *  * * * *
+   * | 8  * *      * *
+   * | 9  * *      * *
+   */char *p = buf;
+
+  if ((bytes == LOG_BUFFER_SIZE) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, 'L', "ERROR", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '1', "ERROR", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[0], level)) ||
+      ! (p =
+           read_output_line (1, 3, 5, 9, 'L', "WARNING", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '1', "WARNING", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[1], level)) ||
+      ! (p =
+           read_output_line (2, 3, 6, 7, 'L', "INFO", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '1', "INFO", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[2], level)) ||
+      ! (p =
+           read_output_line (3, 3, 7, 7, 'L', "DEBUG", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '1', "DEBUG", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[3], level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, 'L', "ERROR", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '2', "ERROR", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[4], level)) ||
+      ! (p =
+           read_output_line (0, 3, 5, 9, 'L', "WARNING", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '2', "WARNING", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[5], level)) ||
+      ! (p =
+           read_output_line (-1, -1, 6, 7, 'L', "INFO", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '2', "INFO", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[6], level)) ||
+      ! (p =
+           read_output_line (-1, -1, 7, 7, 'L', "DEBUG", -1,
+                             1, phase, p,
+                             &bytes, &delay, level)) ||
+      ! (p =
+           read_output_line (0, 3, 4, 9, '2', "DEBUG", OUTPUT_DELAY,
+                             MAX_SKIP_DELAY, phase, p,
+                             &bytes, &delays[7], level)))
+  {
+    if (bytes == LOG_BUFFER_SIZE)
+      fprintf (stderr, "%s", "Ran out of buffer space!\n");
+    GNUNET_break (0);
+    ok = 2;
+    GNUNET_SCHEDULER_cancel (die_task);
+    GNUNET_SCHEDULER_add_now (&end_task, NULL);
+    return;
+  }
+
+  GNUNET_SCHEDULER_cancel (die_task);
+  GNUNET_SCHEDULER_add_now (&end_task, NULL);
+}
+
+
+static void
+runone ()
+{
+  const struct GNUNET_DISK_FileHandle *stdout_read_handle;
+
+  pipe_stdout = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+
+  if (pipe_stdout == NULL)
+  {
+    GNUNET_break (0);
+    ok = 2;
+    return;
+  }
+
+  putenv ("GNUNET_LOG=");
+  putenv ("GNUNET_FORCE_LOG=");
+  putenv ("GNUNET_FORCE_LOGFILE=");
+  switch (phase)
+  {
+  case 0:
+    putenv ("GNUNET_LOG=;;;;ERROR");
+    break;
+
+  case 1:
+    putenv ("GNUNET_LOG=;;;;WARNING");
+    break;
+
+  case 2:
+    putenv ("GNUNET_LOG=;;;;INFO");
+    break;
+
+  case 3:
+    putenv ("GNUNET_LOG=;;;;DEBUG");
+    break;
+
+  case 4:
+    putenv ("GNUNET_FORCE_LOG=;;;;ERROR");
+    break;
+
+  case 5:
+    putenv ("GNUNET_FORCE_LOG=;;;;WARNING");
+    break;
+
+  case 6:
+    putenv ("GNUNET_FORCE_LOG=;;;;INFO");
+    break;
+
+  case 7:
+    putenv ("GNUNET_FORCE_LOG=;;;;DEBUG");
+    break;
+
+  case 8:
+    putenv ("GNUNET_LOG=blah;;;;ERROR");
+    break;
+
+  case 9:
+    putenv ("GNUNET_FORCE_LOG=blah;;;;ERROR");
+    break;
+  }
+
+  proc = GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                  NULL, pipe_stdout, NULL,
+                                  "./test_common_logging_dummy",
+                                  "test_common_logging_dummy", NULL);
+  GNUNET_assert (NULL != proc);
+  putenv ("GNUNET_FORCE_LOG=");
+  putenv ("GNUNET_LOG=");
+
+  /* Close the write end of the read pipe */
+  GNUNET_DISK_pipe_close_end (pipe_stdout, GNUNET_DISK_PIPE_END_WRITE);
+
+  stdout_read_handle =
+    GNUNET_DISK_pipe_handle (pipe_stdout, GNUNET_DISK_PIPE_END_READ);
+
+  die_task =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                    (GNUNET_TIME_UNIT_SECONDS, 10),
+                                  &end_task,
+                                  NULL);
+
+  bytes = 0;
+  buf_ptr = buf;
+  memset (&buf, 0, sizeof(buf));
+
+  read_task = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                              stdout_read_handle,
+                                              &read_call,
+                                              (void *) stdout_read_handle);
+}
+
+
+static void
+task (void *cls)
+{
+  phase = 0;
+  runone ();
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_log_setup ("test-common-logging-runtime-loglevels",
+                    "WARNING",
+                    NULL);
+  ok = 1;
+  GNUNET_SCHEDULER_run (&task, &ok);
+  return ok;
+}
+
+
+/* end of test_common_logging_runtime_loglevels.c */
diff --git a/src/lib/util/test_configuration.c b/src/lib/util/test_configuration.c
new file mode 100644
index 000000000..75610fc74
--- /dev/null
+++ b/src/lib/util/test_configuration.c
@@ -0,0 +1,581 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2003, 2004, 2005, 2006, 2007 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_configuration.c
+ * @brief Test that the configuration module works.
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+/* Test Configuration Diffs Options */
+enum
+{
+  EDIT_NOTHING,
+  EDIT_SECTION,
+  EDIT_ALL,
+  ADD_NEW_SECTION,
+  ADD_NEW_ENTRY,
+  REMOVE_SECTION,
+  REMOVE_ENTRY,
+  COMPARE,
+  PRINT
+};
+
+static struct GNUNET_CONFIGURATION_Handle *cfg;
+static struct GNUNET_CONFIGURATION_Handle *cfg_default;
+
+struct DiffsCBData
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CONFIGURATION_Handle *cfgDiffs;
+  const char *section;
+  int callBackOption;
+  int status;
+};
+
+
+static void
+initDiffsCBData (struct DiffsCBData *cbData)
+{
+  cbData->section = NULL;
+  cbData->cfg = NULL;
+  cbData->cfgDiffs = NULL;
+  cbData->callBackOption = -1;
+  cbData->status = 0;
+}
+
+
+/**
+ * callback function for modifying
+ * and comparing configuration
+ */
+static void
+diffsCallBack (void *cls,
+               const char *section,
+               const char *option,
+               const char *value)
+{
+  struct DiffsCBData *cbData = cls;
+  int cbOption = cbData->callBackOption;
+
+  if (0 == strcasecmp ("PATHS",
+                       section))
+    return;
+  switch (cbOption)
+  {
+  case EDIT_SECTION:
+    if (NULL == cbData->section)
+      cbData->section = section;
+    if (strcmp (cbData->section, section) == 0)
+    {
+      GNUNET_CONFIGURATION_set_value_string (cbData->cfg, section, option,
+                                             "new-value");
+      GNUNET_CONFIGURATION_set_value_string (cbData->cfgDiffs, section, option,
+                                             "new-value");
+    }
+    break;
+  case EDIT_ALL:
+    GNUNET_CONFIGURATION_set_value_string (cbData->cfg, section, option,
+                                           "new-value");
+    GNUNET_CONFIGURATION_set_value_string (cbData->cfgDiffs, section, option,
+                                           "new-value");
+    break;
+  case ADD_NEW_ENTRY:
+    {
+      static int hit = 0;
+
+      if (hit == 0)
+      {
+        hit = 1;
+        GNUNET_CONFIGURATION_set_value_string (cbData->cfg, section, "new-key",
+                                               "new-value");
+        GNUNET_CONFIGURATION_set_value_string (cbData->cfgDiffs, section,
+                                               "new-key", "new-value");
+      }
+      break;
+    }
+  case COMPARE:
+    {
+      int ret;
+      char *diffValue;
+
+      diffValue = NULL;
+      ret =
+        GNUNET_CONFIGURATION_get_value_string (cbData->cfgDiffs,
+                                               section,
+                                               option,
+                                               &diffValue);
+      if (NULL != diffValue)
+      {
+        if ( (ret == GNUNET_SYSERR) ||
+             (strcmp (diffValue, value) != 0) )
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      "Unexpected value %s in %s/%s\n",
+                      diffValue,
+                      section,
+                      option);
+          cbData->status = 1;
+        }
+      }
+      else
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Unexpected value %s in %s/%s\n",
+                    diffValue,
+                    section,
+                    option);
+        cbData->status = 1;
+      }
+      GNUNET_free (diffValue);
+      break;
+    }
+
+#if 0
+  case PRINT:
+    if (NULL == cbData->section)
+    {
+      cbData->section = section;
+      printf ("\nSection: %s\n", section);
+    }
+    else if (strcmp (cbData->section, section) != 0)
+    {
+      cbData->section = section;
+      printf ("\nSection: %s\n", section);
+    }
+    printf ("%s = %s\n", option, value);
+#endif
+  default:
+    break;
+  }
+}
+
+
+static struct GNUNET_CONFIGURATION_Handle *
+editConfiguration (struct GNUNET_CONFIGURATION_Handle *cfg,
+                   int option)
+{
+  struct DiffsCBData diffsCB;
+
+  initDiffsCBData (&diffsCB);
+  diffsCB.cfgDiffs = GNUNET_CONFIGURATION_create ();
+
+  switch (option)
+  {
+  case EDIT_SECTION:
+  case EDIT_ALL:
+  case ADD_NEW_ENTRY:
+    diffsCB.callBackOption = option;
+    diffsCB.cfg = cfg;
+    GNUNET_CONFIGURATION_iterate (cfg, diffsCallBack, &diffsCB);
+    break;
+
+  case EDIT_NOTHING:
+    /* Do nothing */
+    break;
+
+  case ADD_NEW_SECTION:
+    {
+      int i;
+      char *key;
+
+      for (i = 0; i < 5; i++)
+      {
+        GNUNET_asprintf (&key, "key%d", i);
+        GNUNET_CONFIGURATION_set_value_string (cfg, "new-section", key,
+                                               "new-value");
+        GNUNET_CONFIGURATION_set_value_string (diffsCB.cfgDiffs, "new-section",
+                                               key, "new-value");
+        GNUNET_free (key);
+      }
+      break;
+    }
+
+  case REMOVE_SECTION:
+    break;
+
+  case REMOVE_ENTRY:
+    break;
+
+  default:
+    break;
+  }
+
+  return diffsCB.cfgDiffs;
+}
+
+
+/**
+ * Checking configuration diffs
+ */
+static int
+checkDiffs (struct GNUNET_CONFIGURATION_Handle *cfg_default, int option)
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CONFIGURATION_Handle *cfgDiffs;
+  struct DiffsCBData cbData;
+  int ret;
+  char *diffsFileName;
+
+  initDiffsCBData (&cbData);
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  /* load defaults */
+  GNUNET_assert (GNUNET_OK == GNUNET_CONFIGURATION_load (cfg, NULL));
+
+  /* Modify configuration and save it */
+  cfgDiffs = editConfiguration (cfg, option);
+  diffsFileName = GNUNET_DISK_mktemp ("gnunet-test-configurations-diffs.conf");
+  if (diffsFileName == NULL)
+  {
+    GNUNET_break (0);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    GNUNET_CONFIGURATION_destroy (cfgDiffs);
+    return 1;
+  }
+  GNUNET_CONFIGURATION_write_diffs (cfg_default, cfg, diffsFileName);
+  GNUNET_CONFIGURATION_destroy (cfg);
+
+  /* Compare the dumped configuration with modifications done */
+  cfg = GNUNET_CONFIGURATION_create ();
+  GNUNET_assert (GNUNET_OK == GNUNET_CONFIGURATION_parse (cfg, diffsFileName));
+  if (0 != remove (diffsFileName))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "remove",
+                              diffsFileName);
+  cbData.callBackOption = COMPARE;
+  cbData.cfgDiffs = cfgDiffs;
+  GNUNET_CONFIGURATION_iterate (cfg,
+                                &diffsCallBack,
+                                &cbData);
+  if (1 == (ret = cbData.status))
+  {
+    fprintf (stderr, "%s",
+             "Incorrect Configuration Diffs: Diffs may contain data not actually edited\n");
+    goto housekeeping;
+  }
+  cbData.cfgDiffs = cfg;
+  GNUNET_CONFIGURATION_iterate (cfgDiffs, diffsCallBack, &cbData);
+  if ((ret = cbData.status) == 1)
+    fprintf (stderr, "%s",
+             "Incorrect Configuration Diffs: Data may be missing in diffs\n");
+
+housekeeping:
+#if 0
+  cbData.section = NULL;
+  cbData.callBackOption = PRINT;
+  printf ("\nExpected Diffs:\n");
+  GNUNET_CONFIGURATION_iterate (cfgDiffs, diffsCallBack, &cbData);
+  cbData.section = NULL;
+  printf ("\nActual Diffs:\n");
+  GNUNET_CONFIGURATION_iterate (cfg, diffsCallBack, &cbData);
+#endif
+  GNUNET_CONFIGURATION_destroy (cfg);
+  GNUNET_CONFIGURATION_destroy (cfgDiffs);
+  GNUNET_free (diffsFileName);
+  return ret;
+}
+
+
+static int
+testConfig ()
+{
+  char *c;
+  unsigned long long l;
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg, "test", "b", &c))
+    return 1;
+  if (0 != strcmp ("b", c))
+  {
+    fprintf (stderr, "Got `%s'\n", c);
+    GNUNET_free (c);
+    return 2;
+  }
+  GNUNET_free (c);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (cfg, "test", "five", &l))
+  {
+    GNUNET_break (0);
+    return 3;
+  }
+  if (5 != l)
+  {
+    GNUNET_break (0);
+    return 4;
+  }
+  GNUNET_CONFIGURATION_set_value_string (cfg, "more", "c", "YES");
+  if (GNUNET_NO == GNUNET_CONFIGURATION_get_value_yesno (cfg, "more", "c"))
+  {
+    GNUNET_break (0);
+    return 5;
+  }
+  GNUNET_CONFIGURATION_set_value_number (cfg, "NUMBERS", "TEN", 10);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "NUMBERS", "TEN", &c))
+  {
+    GNUNET_break (0);
+    return 6;
+  }
+  if (0 != strcmp (c, "10"))
+  {
+    GNUNET_free (c);
+    GNUNET_break (0);
+    return 7;
+  }
+  GNUNET_free (c);
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (cfg, "last", "test", &c))
+  {
+    GNUNET_break (0);
+    return 8;
+  }
+
+  if (0 != strcmp (c, "/hello/world"))
+  {
+    GNUNET_break (0);
+    GNUNET_free (c);
+    return 9;
+  }
+  GNUNET_free (c);
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_size (cfg, "last", "size", &l))
+  {
+    GNUNET_break (0);
+    return 10;
+  }
+  if (l != 512 * 1024)
+  {
+    GNUNET_break (0);
+    return 11;
+  }
+  return 0;
+}
+
+
+static const char *want[] = {
+  "/Hello",
+  "/File Name",
+  "/World",
+  NULL,
+  NULL,
+};
+
+static int
+check (void *data, const char *fn)
+{
+  int *idx = data;
+
+  if (0 == strcmp (want[*idx], fn))
+  {
+    (*idx)++;
+    return GNUNET_OK;
+  }
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+static int
+testConfigFilenames ()
+{
+  int idx;
+
+  idx = 0;
+  if (3 !=
+      GNUNET_CONFIGURATION_iterate_value_filenames (cfg, "FILENAMES", "test",
+                                                    &check, &idx))
+  {
+    GNUNET_break (0);
+    return 8;
+  }
+  if (idx != 3)
+    return 16;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_remove_value_filename (cfg, "FILENAMES", "test",
+                                                  "/File Name"))
+  {
+    GNUNET_break (0);
+    return 24;
+  }
+
+  if (GNUNET_NO !=
+      GNUNET_CONFIGURATION_remove_value_filename (cfg, "FILENAMES", "test",
+                                                  "/File Name"))
+  {
+    GNUNET_break (0);
+    return 32;
+  }
+  if (GNUNET_NO !=
+      GNUNET_CONFIGURATION_remove_value_filename (cfg, "FILENAMES", "test",
+                                                  "Stuff"))
+  {
+    GNUNET_break (0);
+    return 40;
+  }
+
+  if (GNUNET_NO !=
+      GNUNET_CONFIGURATION_append_value_filename (cfg, "FILENAMES", "test",
+                                                  "/Hello"))
+  {
+    GNUNET_break (0);
+    return 48;
+  }
+  if (GNUNET_NO !=
+      GNUNET_CONFIGURATION_append_value_filename (cfg, "FILENAMES", "test",
+                                                  "/World"))
+  {
+    GNUNET_break (0);
+    return 56;
+  }
+
+  if (GNUNET_YES !=
+      GNUNET_CONFIGURATION_append_value_filename (cfg, "FILENAMES", "test",
+                                                  "/File 1"))
+  {
+    GNUNET_break (0);
+    return 64;
+  }
+
+  if (GNUNET_YES !=
+      GNUNET_CONFIGURATION_append_value_filename (cfg, "FILENAMES", "test",
+                                                  "/File 2"))
+  {
+    GNUNET_break (0);
+    return 72;
+  }
+
+  idx = 0;
+  want[1] = "/World";
+  want[2] = "/File 1";
+  want[3] = "/File 2";
+  if (4 !=
+      GNUNET_CONFIGURATION_iterate_value_filenames (cfg, "FILENAMES", "test",
+                                                    &check, &idx))
+  {
+    GNUNET_break (0);
+    return 80;
+  }
+  if (idx != 4)
+  {
+    GNUNET_break (0);
+    return 88;
+  }
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failureCount = 0;
+  char *c;
+
+  GNUNET_log_setup ("test_configuration", "WARNING", NULL);
+  cfg = GNUNET_CONFIGURATION_create ();
+  GNUNET_assert (cfg != NULL);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_parse (cfg, "test_configuration_data.conf"))
+  {
+    fprintf (stderr, "%s", "Failed to parse configuration file\n");
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return 1;
+  }
+  failureCount += testConfig ();
+  if (failureCount > 0)
+    goto error;
+
+  failureCount = testConfigFilenames ();
+  if (failureCount > 0)
+    goto error;
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_write (cfg, "/tmp/gnunet-test.conf"))
+  {
+    fprintf (stderr, "%s", "Failed to write configuration file\n");
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return 1;
+  }
+  GNUNET_CONFIGURATION_destroy (cfg);
+  GNUNET_assert (0 == unlink ("/tmp/gnunet-test.conf"));
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_load (cfg, "test_configuration_data.conf"))
+  {
+    GNUNET_break (0);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return 1;
+  }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "TESTING", "WEAKRANDOM", &c))
+  {
+    GNUNET_break (0);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return 1;
+  }
+  if (0 != strcmp (c, "YES"))
+  {
+    GNUNET_break (0);
+    GNUNET_free (c);
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return 1;
+  }
+
+  GNUNET_free (c);
+  GNUNET_CONFIGURATION_destroy (cfg);
+
+  /* Testing configuration diffs */
+  cfg_default = GNUNET_CONFIGURATION_create ();
+  if (GNUNET_OK != GNUNET_CONFIGURATION_load (cfg_default, NULL))
+  {
+    GNUNET_break (0);
+    GNUNET_CONFIGURATION_destroy (cfg_default);
+    return 1;
+  }
+
+  /* Nothing changed in the new configuration */
+  failureCount += checkDiffs (cfg_default, EDIT_NOTHING);
+
+  /* Modify all entries of the last section */
+  failureCount += checkDiffs (cfg_default, EDIT_SECTION);
+
+  /* Add a new section */
+  failureCount += checkDiffs (cfg_default, ADD_NEW_SECTION);
+
+  /* Add a new entry to the last section */
+  failureCount += checkDiffs (cfg_default, ADD_NEW_ENTRY);
+
+  /* Modify all entries in the configuration */
+  failureCount += checkDiffs (cfg_default, EDIT_ALL);
+
+  GNUNET_CONFIGURATION_destroy (cfg_default);
+
+error:
+  if (failureCount != 0)
+  {
+    fprintf (stderr, "Test failed: %u\n", failureCount);
+    return 1;
+  }
+  return 0;
+}
diff --git a/src/lib/util/test_configuration_data.conf b/src/lib/util/test_configuration_data.conf
new file mode 100644
index 000000000..93dfd128a
--- /dev/null
+++ b/src/lib/util/test_configuration_data.conf
@@ -0,0 +1,30 @@
+[PATHS]
+SUBST=/hello
+
+[GNUNET]
+SUBST=hello
+GNUNET_HOME=$GNUNET_TMP/test-hello-configuration-data/
+
+[test]
+a=a
+b=b
+five=5
+
+[more]
+c=c
+five=42
+
+                
+[last]
+test = $SUBST/world
+boom = "1 2 3 testing"
+trailing = YES 
+size = 512 KiB
+
+[FILENAMES]
+test = "/Hello /File\ Name /World"
+
+
+[TESTING]
+WEAKRANDOM = YES
+
diff --git a/src/lib/util/test_container_bloomfilter.c b/src/lib/util/test_container_bloomfilter.c
new file mode 100644
index 000000000..244733dd9
--- /dev/null
+++ b/src/lib/util/test_container_bloomfilter.c
@@ -0,0 +1,302 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2004, 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_container_bloomfilter.c
+ * @brief Testcase for the bloomfilter.
+ * @author Christian Grothoff
+ * @author Igor Wronsky
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define K 4
+#define SIZE 65536
+#define TESTFILE "/tmp/bloomtest.dat"
+
+
+static void
+bernd_interop (void)
+{
+  struct GNUNET_HashCode hc;
+  char val[128];
+  size_t len;
+  struct GNUNET_CONTAINER_BloomFilter *bf;
+
+  len = GNUNET_DNSPARSER_hex_to_bin (
+    "ac4d46b62f8ddaf3cefbc1c01e47536b7ff297cb081e27a396362b1e92e5729b",
+    val);
+  GNUNET_assert (len < 128);
+  GNUNET_CRYPTO_hash (val,
+                      len,
+                      &hc);
+  fprintf (stderr,
+           "sha512: %s\n",
+           GNUNET_DNSPARSER_bin_to_hex (&hc,
+                                        sizeof (hc)));
+  bf = GNUNET_CONTAINER_bloomfilter_init (NULL,
+                                          128,
+                                          16);
+  GNUNET_CONTAINER_bloomfilter_add (bf,
+                                    &hc);
+  len = GNUNET_CONTAINER_bloomfilter_get_size (bf);
+  {
+    char raw[len];
+
+    GNUNET_CONTAINER_bloomfilter_get_raw_data (bf,
+                                               raw,
+                                               len);
+    fprintf (stderr,
+             "BF: %s\n",
+             GNUNET_DNSPARSER_bin_to_hex (raw,
+                                          len));
+  }
+
+}
+
+
+/**
+ * Generate a random hashcode.
+ */
+static void
+nextHC (struct GNUNET_HashCode *hc)
+{
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, hc);
+}
+
+
+static int
+add_iterator (void *cls, struct GNUNET_HashCode *next)
+{
+  int *ret = cls;
+  struct GNUNET_HashCode pos;
+
+  if (0 == (*ret)--)
+    return GNUNET_NO;
+  nextHC (&pos);
+  *next = pos;
+  return GNUNET_YES;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_CONTAINER_BloomFilter *bf;
+  struct GNUNET_CONTAINER_BloomFilter *bfi;
+  struct GNUNET_HashCode tmp;
+  int i;
+  int ok1;
+  int ok2;
+  int falseok;
+  char buf[SIZE];
+  struct stat sbuf;
+
+  GNUNET_log_setup ("test-container-bloomfilter",
+                    "WARNING",
+                    NULL);
+  if (0)
+  {
+    bernd_interop ();
+    return 0;
+  }
+  GNUNET_CRYPTO_seed_weak_random (1);
+  if (0 == stat (TESTFILE, &sbuf))
+    if (0 != unlink (TESTFILE))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "unlink", TESTFILE);
+  bf = GNUNET_CONTAINER_bloomfilter_load (TESTFILE, SIZE, K);
+
+  for (i = 0; i < 200; i++)
+  {
+    nextHC (&tmp);
+    GNUNET_CONTAINER_bloomfilter_add (bf, &tmp);
+  }
+  GNUNET_CRYPTO_seed_weak_random (1);
+  ok1 = 0;
+  for (i = 0; i < 200; i++)
+  {
+    nextHC (&tmp);
+    if (GNUNET_CONTAINER_bloomfilter_test (bf, &tmp) == GNUNET_YES)
+      ok1++;
+  }
+  if (ok1 != 200)
+  {
+    printf ("Got %d elements out of"
+            "200 expected after insertion.\n",
+            ok1);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    return -1;
+  }
+  if (GNUNET_OK != GNUNET_CONTAINER_bloomfilter_get_raw_data (bf, buf, SIZE))
+  {
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    return -1;
+  }
+
+  GNUNET_CONTAINER_bloomfilter_free (bf);
+
+  bf = GNUNET_CONTAINER_bloomfilter_load (TESTFILE, SIZE, K);
+  GNUNET_assert (bf != NULL);
+  bfi = GNUNET_CONTAINER_bloomfilter_init (buf, SIZE, K);
+  GNUNET_assert (bfi != NULL);
+
+  GNUNET_CRYPTO_seed_weak_random (1);
+  ok1 = 0;
+  ok2 = 0;
+  for (i = 0; i < 200; i++)
+  {
+    nextHC (&tmp);
+    if (GNUNET_CONTAINER_bloomfilter_test (bf, &tmp) == GNUNET_YES)
+      ok1++;
+    if (GNUNET_CONTAINER_bloomfilter_test (bfi, &tmp) == GNUNET_YES)
+      ok2++;
+  }
+  if (ok1 != 200)
+  {
+    printf ("Got %d elements out of 200 "
+            "expected after reloading.\n",
+            ok1);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+  if (ok2 != 200)
+  {
+    printf ("Got %d elements out of 200 "
+            "expected after initialization.\n",
+            ok2);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+  GNUNET_CRYPTO_seed_weak_random (1);
+  for (i = 0; i < 100; i++)
+  {
+    nextHC (&tmp);
+    GNUNET_CONTAINER_bloomfilter_remove (bf, &tmp);
+    GNUNET_CONTAINER_bloomfilter_remove (bfi, &tmp);
+  }
+
+  GNUNET_CRYPTO_seed_weak_random (1);
+
+  ok1 = 0;
+  ok2 = 0;
+  for (i = 0; i < 200; i++)
+  {
+    nextHC (&tmp);
+    if (GNUNET_CONTAINER_bloomfilter_test (bf, &tmp) == GNUNET_YES)
+      ok1++;
+    if (GNUNET_CONTAINER_bloomfilter_test (bfi, &tmp) == GNUNET_YES)
+      ok2++;
+  }
+
+  if (ok1 != 100)
+  {
+    printf ("Expected 100 elements in loaded filter"
+            " after adding 200 and deleting 100, got %d\n",
+            ok1);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+  if (ok2 != 200)
+  {
+    printf ("Expected 200 elements in initialized filter"
+            " after adding 200 and deleting 100 "
+            "(which should do nothing for a filter not backed by a file), got %d\n",
+            ok2);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+  GNUNET_CRYPTO_seed_weak_random (3);
+
+  GNUNET_CONTAINER_bloomfilter_clear (bf);
+  falseok = 0;
+  for (i = 0; i < 1000; i++)
+  {
+    nextHC (&tmp);
+    if (GNUNET_CONTAINER_bloomfilter_test (bf, &tmp) == GNUNET_YES)
+      falseok++;
+  }
+  if (falseok > 0)
+  {
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+  if (GNUNET_OK != GNUNET_CONTAINER_bloomfilter_or (bf, buf, SIZE))
+  {
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+  GNUNET_CRYPTO_seed_weak_random (2);
+  i = 20;
+  GNUNET_CONTAINER_bloomfilter_resize (bfi, &add_iterator, &i, SIZE * 2, K);
+
+  GNUNET_CRYPTO_seed_weak_random (2);
+  i = 20;
+  GNUNET_CONTAINER_bloomfilter_resize (bf, &add_iterator, &i, SIZE * 2, K);
+  GNUNET_CRYPTO_seed_weak_random (2);
+
+  ok1 = 0;
+  ok2 = 0;
+  for (i = 0; i < 20; i++)
+  {
+    nextHC (&tmp);
+    if (GNUNET_CONTAINER_bloomfilter_test (bf, &tmp) == GNUNET_YES)
+      ok1++;
+    if (GNUNET_CONTAINER_bloomfilter_test (bfi, &tmp) == GNUNET_YES)
+      ok2++;
+  }
+
+  if (ok1 != 20)
+  {
+    printf ("Expected 20 elements in resized file-backed filter"
+            " after adding 20, got %d\n",
+            ok1);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+  if (ok2 != 20)
+  {
+    printf ("Expected 20 elements in resized filter"
+            " after adding 20, got %d\n",
+            ok2);
+    GNUNET_CONTAINER_bloomfilter_free (bf);
+    GNUNET_CONTAINER_bloomfilter_free (bfi);
+    return -1;
+  }
+
+
+  GNUNET_CONTAINER_bloomfilter_free (bf);
+  GNUNET_CONTAINER_bloomfilter_free (bfi);
+
+  GNUNET_break (0 == unlink (TESTFILE));
+  return 0;
+}
diff --git a/src/lib/util/test_container_dll.c b/src/lib/util/test_container_dll.c
new file mode 100644
index 000000000..fcbef4e8b
--- /dev/null
+++ b/src/lib/util/test_container_dll.c
@@ -0,0 +1,114 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2017 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/test_container_dll.c
+ * @brief Test of DLL operations
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Element in the DLL.
+ */
+struct Element
+{
+  /**
+   * Required pointer to previous element.
+   */
+  struct Element *prev;
+
+  /**
+   * Required pointer to next element.
+   */
+  struct Element *next;
+
+  /**
+   * Used to sort.
+   */
+  unsigned int value;
+};
+
+
+/**
+ * Compare two elements.
+ *
+ * @param cls closure, NULL
+ * @param e1 an element of to sort
+ * @param e2 another element to sort
+ * @return #GNUNET_YES if @e1 < @e2, otherwise #GNUNET_NO
+ */
+static int
+cmp_elem (void *cls,
+          struct Element *e1,
+          struct Element *e2)
+{
+  if (e1->value == e2->value)
+    return 0;
+  return (e1->value < e2->value) ? 1 : -1;
+}
+
+
+int
+main (int argc, char **argv)
+{
+  unsigned int values[] = {
+    4, 5, 8, 6, 9, 3, 7, 2, 1, 0
+  };
+  struct Element *head = NULL;
+  struct Element *tail = NULL;
+  struct Element *e;
+  unsigned int want;
+
+  GNUNET_log_setup ("test-container-dll",
+                    "WARNING",
+                    NULL);
+  for (unsigned int off = 0;
+       0 != values[off];
+       off++)
+  {
+    e = GNUNET_new (struct Element);
+    e->value = values[off];
+    GNUNET_CONTAINER_DLL_insert_sorted (struct Element,
+                                        cmp_elem,
+                                        NULL,
+                                        head,
+                                        tail,
+                                        e);
+  }
+
+  want = 1;
+  while (NULL != (e = head))
+  {
+    GNUNET_assert (e->value == want);
+    GNUNET_CONTAINER_DLL_remove (head,
+                                 tail,
+                                 e);
+    GNUNET_free (e);
+    want++;
+  }
+  return 0;
+}
+
+
+/* end of test_container_heap.c */
diff --git a/src/lib/util/test_container_heap.c b/src/lib/util/test_container_heap.c
new file mode 100644
index 000000000..f11070ed5
--- /dev/null
+++ b/src/lib/util/test_container_heap.c
@@ -0,0 +1,294 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2008 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Nathan Evans
+ * @file util/test_container_heap.c
+ * @brief Test of heap operations
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static int
+iterator_callback (void *cls,
+                   struct GNUNET_CONTAINER_HeapNode *node,
+                   void *element, GNUNET_CONTAINER_HeapCostType cost)
+{
+  return GNUNET_OK;
+}
+
+
+static int
+nstrcmp (const char *a, const char *b)
+{
+  GNUNET_assert (a != NULL);
+  GNUNET_assert (b != NULL);
+  return strcmp (a, b);
+}
+
+
+static int
+check ()
+{
+  struct GNUNET_CONTAINER_Heap *myHeap;
+  struct GNUNET_CONTAINER_HeapNode *n1;
+  struct GNUNET_CONTAINER_HeapNode *n2;
+  struct GNUNET_CONTAINER_HeapNode *n3;
+  struct GNUNET_CONTAINER_HeapNode *n4;
+  struct GNUNET_CONTAINER_HeapNode *n5;
+  struct GNUNET_CONTAINER_HeapNode *n6;
+  struct GNUNET_CONTAINER_HeapNode *n7;
+  struct GNUNET_CONTAINER_HeapNode *n8;
+  const char *r;
+
+  myHeap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+
+  // GNUNET_CONTAINER_heap_remove_root heap empty, taking if-branch
+  n1 = GNUNET_CONTAINER_heap_remove_root (myHeap);
+  GNUNET_assert (NULL == n1);
+
+  // GNUNET_CONTAINER_heap_peek heap empty, taking if-branch
+  n1 = GNUNET_CONTAINER_heap_peek (myHeap);
+  GNUNET_assert (NULL == n1);
+
+  // GNUNET_CONTAINER_heap_walk_get_next: heap empty, taking if-branch
+  n1 = GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_assert (NULL == n1);
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "11", 11);
+  GNUNET_assert (NULL != n1);
+
+
+  // GNUNET_CONTAINER_heap_peek not empty, taking if-branch
+  n2 = NULL;
+  n2 = GNUNET_CONTAINER_heap_peek (myHeap);
+  GNUNET_assert (NULL != n2);
+
+  // GNUNET_CONTAINER_heap_walk_get_next: 1 element
+  n1 = NULL;
+  n1 = GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_assert (NULL != n1);
+
+  GNUNET_CONTAINER_heap_iterate (myHeap, &iterator_callback, NULL);
+  GNUNET_assert (1 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "78", 78);
+  GNUNET_assert (2 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  GNUNET_assert (0 == strcmp ("78", GNUNET_CONTAINER_heap_remove_node (n2)));
+  GNUNET_assert (1 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  GNUNET_CONTAINER_heap_iterate (myHeap, &iterator_callback, NULL);
+
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "15", 5);
+  GNUNET_CONTAINER_heap_update_cost (n3, 15);
+  GNUNET_assert (2 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  GNUNET_CONTAINER_heap_iterate (myHeap, &iterator_callback, NULL);
+
+  n4 = GNUNET_CONTAINER_heap_insert (myHeap, "50", 50);
+  GNUNET_CONTAINER_heap_update_cost (n4, 50);
+  GNUNET_assert (3 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  GNUNET_CONTAINER_heap_iterate (myHeap, &iterator_callback, NULL);
+
+  n5 = GNUNET_CONTAINER_heap_insert (myHeap, "100", 100);
+  n6 = GNUNET_CONTAINER_heap_insert (myHeap, "30/200", 30);
+  GNUNET_assert (5 == GNUNET_CONTAINER_heap_get_size (myHeap));
+  GNUNET_CONTAINER_heap_remove_node (n5);
+  r = GNUNET_CONTAINER_heap_remove_root (myHeap);        /* n1 */
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("11", r));
+  GNUNET_CONTAINER_heap_update_cost (n6, 200);
+  GNUNET_CONTAINER_heap_remove_node (n3);
+  r = GNUNET_CONTAINER_heap_remove_root (myHeap);        /* n4 */
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("50", r));
+  r = GNUNET_CONTAINER_heap_remove_root (myHeap);        /* n6 */
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("30/200", r));
+  GNUNET_assert (0 == GNUNET_CONTAINER_heap_get_size (myHeap));
+
+  GNUNET_CONTAINER_heap_destroy (myHeap);
+
+  // My additions to a complete testcase
+  // Testing a GNUNET_CONTAINER_HEAP_ORDER_MIN
+  // Testing remove_node
+
+  myHeap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  GNUNET_CONTAINER_heap_update_cost (n1, 15);
+
+  r = GNUNET_CONTAINER_heap_remove_node (n1);
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("10", r));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  r = GNUNET_CONTAINER_heap_remove_node (n2);
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("20", r));
+  r = GNUNET_CONTAINER_heap_remove_node (n1);
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("10", r));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 10);
+
+  GNUNET_CONTAINER_heap_remove_node (n2);
+  GNUNET_CONTAINER_heap_remove_node (n1);
+  r = GNUNET_CONTAINER_heap_remove_root (myHeap);
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("30", r));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 10);
+
+  GNUNET_CONTAINER_heap_remove_node (n2);
+  GNUNET_CONTAINER_heap_remove_node (n1);
+  r = GNUNET_CONTAINER_heap_remove_node (n3);
+  GNUNET_assert (NULL != r);
+  GNUNET_assert (0 == strcmp ("30", r));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 20);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 30);
+
+  GNUNET_assert (0 == nstrcmp ("20", GNUNET_CONTAINER_heap_remove_node (n2)));
+  GNUNET_assert (0 ==
+                 nstrcmp ("10", GNUNET_CONTAINER_heap_remove_root (myHeap)));
+  GNUNET_assert (0 ==
+                 nstrcmp ("30", GNUNET_CONTAINER_heap_remove_root (myHeap)));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 20);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 30);
+  n4 = GNUNET_CONTAINER_heap_insert (myHeap, "40", 40);
+  n5 = GNUNET_CONTAINER_heap_insert (myHeap, "50", 50);
+  n6 = GNUNET_CONTAINER_heap_insert (myHeap, "60", 60);
+
+  // Inserting nodes deeper in the tree with lower costs
+  n7 = GNUNET_CONTAINER_heap_insert (myHeap, "70", 10);
+  n8 = GNUNET_CONTAINER_heap_insert (myHeap, "80", 10);
+
+  GNUNET_assert (0 == nstrcmp ("30", GNUNET_CONTAINER_heap_remove_node (n3)));
+
+  // Cleaning up...
+  GNUNET_assert (0 == nstrcmp ("60", GNUNET_CONTAINER_heap_remove_node (n6)));
+  GNUNET_assert (0 == nstrcmp ("50", GNUNET_CONTAINER_heap_remove_node (n5)));
+
+  // Testing heap_walk_get_next
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);;
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+
+  GNUNET_assert (0 == nstrcmp ("10", GNUNET_CONTAINER_heap_remove_node (n1)));
+  GNUNET_assert (0 == nstrcmp ("20", GNUNET_CONTAINER_heap_remove_node (n2)));
+  GNUNET_assert (0 == nstrcmp ("40", GNUNET_CONTAINER_heap_remove_node (n4)));
+  GNUNET_assert (0 == nstrcmp ("70", GNUNET_CONTAINER_heap_remove_node (n7)));
+  GNUNET_assert (0 == nstrcmp ("80", GNUNET_CONTAINER_heap_remove_node (n8)));
+
+  // End Testing remove_node
+
+  // Testing a GNUNET_CONTAINER_HEAP_ORDER_MAX
+  GNUNET_CONTAINER_heap_destroy (myHeap);
+
+  myHeap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MAX);
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  GNUNET_CONTAINER_heap_update_cost (n1, 15);
+
+  GNUNET_assert (0 == nstrcmp ("10", GNUNET_CONTAINER_heap_remove_node (n1)));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_assert (0 == nstrcmp ("20", GNUNET_CONTAINER_heap_remove_node (n2)));
+  GNUNET_assert (0 == nstrcmp ("10", GNUNET_CONTAINER_heap_remove_node (n1)));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 10);
+
+  GNUNET_CONTAINER_heap_remove_node (n2);
+  GNUNET_CONTAINER_heap_remove_node (n1);
+  GNUNET_assert (0 ==
+                 nstrcmp ("30", GNUNET_CONTAINER_heap_remove_root (myHeap)));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 10);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 10);
+
+  GNUNET_CONTAINER_heap_remove_node (n2);
+  GNUNET_CONTAINER_heap_remove_node (n1);
+  GNUNET_assert (0 == nstrcmp ("30", GNUNET_CONTAINER_heap_remove_node (n3)));
+
+  n1 = GNUNET_CONTAINER_heap_insert (myHeap, "10", 10);
+  n2 = GNUNET_CONTAINER_heap_insert (myHeap, "20", 20);
+  n3 = GNUNET_CONTAINER_heap_insert (myHeap, "30", 30);
+  n4 = GNUNET_CONTAINER_heap_insert (myHeap, "40", 40);
+  n5 = GNUNET_CONTAINER_heap_insert (myHeap, "50", 50);
+  n6 = GNUNET_CONTAINER_heap_insert (myHeap, "60", 60);
+
+  // Inserting nodes deeper in the tree with lower costs
+  n7 = GNUNET_CONTAINER_heap_insert (myHeap, "70", 10);
+  n8 = GNUNET_CONTAINER_heap_insert (myHeap, "80", 10);
+
+  GNUNET_assert (0 == nstrcmp ("30", GNUNET_CONTAINER_heap_remove_node (n3)));
+
+  // Cleaning up...
+  GNUNET_assert (0 == nstrcmp ("60", GNUNET_CONTAINER_heap_remove_node (n6)));
+  GNUNET_assert (0 == nstrcmp ("50", GNUNET_CONTAINER_heap_remove_node (n5)));
+
+  // Testing heap_walk_get_next
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);;
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+  GNUNET_CONTAINER_heap_walk_get_next (myHeap);
+
+  GNUNET_assert (0 == nstrcmp ("10", GNUNET_CONTAINER_heap_remove_node (n1)));
+  GNUNET_assert (0 == nstrcmp ("20", GNUNET_CONTAINER_heap_remove_node (n2)));
+  GNUNET_assert (0 == nstrcmp ("40", GNUNET_CONTAINER_heap_remove_node (n4)));
+  GNUNET_assert (0 == nstrcmp ("70", GNUNET_CONTAINER_heap_remove_node (n7)));
+  GNUNET_assert (0 == nstrcmp ("80", GNUNET_CONTAINER_heap_remove_node (n8)));
+
+  // End Testing remove_node
+
+  GNUNET_CONTAINER_heap_destroy (myHeap);
+
+  return 0;
+}
+
+
+int
+main (int argc, char **argv)
+{
+  GNUNET_log_setup ("test-container-heap", "WARNING", NULL);
+  return check ();
+}
+
+
+/* end of test_container_heap.c */
diff --git a/src/lib/util/test_container_multihashmap.c b/src/lib/util/test_container_multihashmap.c
new file mode 100644
index 000000000..233369257
--- /dev/null
+++ b/src/lib/util/test_container_multihashmap.c
@@ -0,0 +1,140 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_container_multihashmap.c
+ * @brief Test for container_multihashmap.c
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define ABORT() { fprintf (stderr, "Error at %s:%d\n", __FILE__, __LINE__); \
+                  if (m != NULL) GNUNET_CONTAINER_multihashmap_destroy (m); \
+                  if (NULL != \
+                      iter) \
+                  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter); \
+                  return 1; }
+#define CHECK(c) { if (! (c)) ABORT (); }
+
+static int
+testMap (int i)
+{
+  struct GNUNET_CONTAINER_MultiHashMap *m;
+  struct GNUNET_HashCode k1;
+  struct GNUNET_HashCode k2;
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter = NULL;
+  struct GNUNET_HashCode key_ret;
+  const char *ret;
+  int j;
+
+  CHECK (NULL != (m = GNUNET_CONTAINER_multihashmap_create (i, GNUNET_NO)));
+  memset (&k1, 0, sizeof(k1));
+  memset (&k2, 1, sizeof(k2));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (m, &k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (m, &k2));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_remove (m, &k1, NULL));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_remove (m, &k2, NULL));
+  CHECK (NULL == GNUNET_CONTAINER_multihashmap_get (m, &k1));
+  CHECK (NULL == GNUNET_CONTAINER_multihashmap_get (m, &k2));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap_remove_all (m, &k1));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap_size (m));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap_iterate (m, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap_get_multiple (m, &k1, NULL, NULL));
+
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap_put (m, &k1, "v1",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multihashmap_size (m));
+  ret = GNUNET_CONTAINER_multihashmap_get (m, &k1);
+  GNUNET_assert (ret != NULL);
+  CHECK (0 == strcmp ("v1", ret));
+  CHECK (GNUNET_NO ==
+         GNUNET_CONTAINER_multihashmap_put (m, &k1, "v1",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multihashmap_size (m));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap_put (m, &k1, "v2",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap_put (m, &k1, "v3",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (3 == GNUNET_CONTAINER_multihashmap_size (m));
+  CHECK (GNUNET_OK == GNUNET_CONTAINER_multihashmap_remove (m, &k1, "v3"));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap_size (m));
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (m, &k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (m, &k2));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap_get_multiple (m, &k1, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap_get_multiple (m, &k2, NULL, NULL));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap_iterate (m, NULL, NULL));
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (m);
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                                    &key_ret,
+                                                                    (const
+                                                                     void **) &
+                                                                    ret));
+  CHECK (0 == memcmp (&key_ret, &k1, sizeof(key_ret)));
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                                    &key_ret,
+                                                                    (const
+                                                                     void **) &
+                                                                    ret));
+  CHECK (0 == memcmp (&key_ret, &k1, sizeof(key_ret)));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_iterator_next (iter, NULL,
+                                                                   NULL));
+  GNUNET_free (iter);
+
+  CHECK (2 == GNUNET_CONTAINER_multihashmap_remove_all (m, &k1));
+  for (j = 0; j < 1024; j++)
+    CHECK (GNUNET_OK ==
+           GNUNET_CONTAINER_multihashmap_put (m, &k1, "v2",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (m);
+  for (j = 0; j < GNUNET_CONTAINER_multihashmap_size (m); j++)
+    CHECK (GNUNET_YES == GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                                      NULL,
+                                                                      NULL));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap_iterator_next (iter, NULL,
+                                                                   NULL));
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+
+  GNUNET_CONTAINER_multihashmap_destroy (m);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failureCount = 0;
+  int i;
+
+  GNUNET_log_setup ("test-container-multihashmap", "WARNING", NULL);
+  for (i = 1; i < 255; i++)
+    failureCount += testMap (i);
+  if (failureCount != 0)
+    return 1;
+  return 0;
+}
+
+
+/* end of test_container_multihashmap.c */
diff --git a/src/lib/util/test_container_multihashmap32.c b/src/lib/util/test_container_multihashmap32.c
new file mode 100644
index 000000000..eab5ad795
--- /dev/null
+++ b/src/lib/util/test_container_multihashmap32.c
@@ -0,0 +1,110 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_container_multihashmap32.c
+ * @brief Test for container_multihashmap32.c
+ * @author Christian Grothoff
+ * @author Sree Harsha Totakura
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define ABORT() { fprintf (stderr, "Error at %s:%d\n", __FILE__, __LINE__); \
+                  if (m != NULL) GNUNET_CONTAINER_multihashmap32_destroy (m); \
+                  return 1; }
+#define CHECK(c) { if (! (c)) ABORT (); }
+
+static int
+testMap (int i)
+{
+  struct GNUNET_CONTAINER_MultiHashMap32 *m;
+  uint32_t k1;
+  uint32_t k2;
+  const char *ret;
+  int j;
+
+  CHECK (NULL != (m = GNUNET_CONTAINER_multihashmap32_create (i)));
+  k1 = 0;
+  k2 = UINT32_MAX;
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap32_contains (m, k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap32_contains (m, k2));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap32_remove (m, k1, NULL));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap32_remove (m, k2, NULL));
+  CHECK (NULL == GNUNET_CONTAINER_multihashmap32_get (m, k1));
+  CHECK (NULL == GNUNET_CONTAINER_multihashmap32_get (m, k2));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap32_remove_all (m, k1));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap32_size (m));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap32_iterate (m, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap32_get_multiple (m, k1, NULL, NULL));
+
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap32_put (m, k1, "v1",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multihashmap32_size (m));
+  ret = GNUNET_CONTAINER_multihashmap32_get (m, k1);
+  GNUNET_assert (ret != NULL);
+  CHECK (0 == strcmp ("v1", ret));
+  CHECK (GNUNET_NO ==
+         GNUNET_CONTAINER_multihashmap32_put (m, k1, "v1",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multihashmap32_size (m));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap32_put (m, k1, "v2",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multihashmap32_put (m, k1, "v3",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (3 == GNUNET_CONTAINER_multihashmap32_size (m));
+  CHECK (GNUNET_OK == GNUNET_CONTAINER_multihashmap32_remove (m, k1, "v3"));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap32_size (m));
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multihashmap32_contains (m, k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multihashmap32_contains (m, k2));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap32_get_multiple (m, k1, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multihashmap32_get_multiple (m, k2, NULL, NULL));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap32_iterate (m, NULL, NULL));
+  CHECK (2 == GNUNET_CONTAINER_multihashmap32_remove_all (m, k1));
+  for (j = 0; j < 1024; j++)
+    CHECK (GNUNET_OK ==
+           GNUNET_CONTAINER_multihashmap32_put (m, k1, "v2",
+                                                GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  GNUNET_CONTAINER_multihashmap32_destroy (m);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failureCount = 0;
+  int i;
+
+  GNUNET_log_setup ("test-container-multihashmap", "WARNING", NULL);
+  for (i = 1; i < 255; i++)
+    failureCount += testMap (i);
+  if (failureCount != 0)
+    return 1;
+  return 0;
+}
+
+
+/* end of test_container_multihashmap.c */
diff --git a/src/lib/util/test_container_multipeermap.c b/src/lib/util/test_container_multipeermap.c
new file mode 100644
index 000000000..6639b05ea
--- /dev/null
+++ b/src/lib/util/test_container_multipeermap.c
@@ -0,0 +1,140 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2008, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_container_multipeermap.c
+ * @brief Test for container_multipeermap.c
+ * @author Christian Grothoff
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define ABORT() { fprintf (stderr, "Error at %s:%d\n", __FILE__, __LINE__); \
+                  if (NULL != m) GNUNET_CONTAINER_multipeermap_destroy (m); \
+                  if (NULL != \
+                      iter) \
+                  GNUNET_CONTAINER_multipeermap_iterator_destroy (iter); \
+                  return 1; }
+#define CHECK(c) { if (! (c)) ABORT (); }
+
+static int
+testMap (int i)
+{
+  struct GNUNET_CONTAINER_MultiPeerMap *m;
+  struct GNUNET_PeerIdentity k1;
+  struct GNUNET_PeerIdentity k2;
+  struct GNUNET_CONTAINER_MultiPeerMapIterator *iter = NULL;
+  struct GNUNET_PeerIdentity key_ret;
+  const char *ret;
+  int j;
+
+  CHECK (NULL != (m = GNUNET_CONTAINER_multipeermap_create (i, GNUNET_NO)));
+  memset (&k1, 0, sizeof(k1));
+  memset (&k2, 1, sizeof(k2));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_contains (m, &k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_contains (m, &k2));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_remove (m, &k1, NULL));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_remove (m, &k2, NULL));
+  CHECK (NULL == GNUNET_CONTAINER_multipeermap_get (m, &k1));
+  CHECK (NULL == GNUNET_CONTAINER_multipeermap_get (m, &k2));
+  CHECK (0 == GNUNET_CONTAINER_multipeermap_remove_all (m, &k1));
+  CHECK (0 == GNUNET_CONTAINER_multipeermap_size (m));
+  CHECK (0 == GNUNET_CONTAINER_multipeermap_iterate (m, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multipeermap_get_multiple (m, &k1, NULL, NULL));
+
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multipeermap_put (m, &k1, "v1",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multipeermap_size (m));
+  ret = GNUNET_CONTAINER_multipeermap_get (m, &k1);
+  GNUNET_assert (ret != NULL);
+  CHECK (0 == strcmp ("v1", ret));
+  CHECK (GNUNET_NO ==
+         GNUNET_CONTAINER_multipeermap_put (m, &k1, "v1",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+  CHECK (1 == GNUNET_CONTAINER_multipeermap_size (m));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multipeermap_put (m, &k1, "v2",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (GNUNET_OK ==
+         GNUNET_CONTAINER_multipeermap_put (m, &k1, "v3",
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  CHECK (3 == GNUNET_CONTAINER_multipeermap_size (m));
+  CHECK (GNUNET_OK == GNUNET_CONTAINER_multipeermap_remove (m, &k1, "v3"));
+  CHECK (2 == GNUNET_CONTAINER_multipeermap_size (m));
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multipeermap_contains (m, &k1));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_contains (m, &k2));
+  CHECK (2 == GNUNET_CONTAINER_multipeermap_get_multiple (m, &k1, NULL, NULL));
+  CHECK (0 == GNUNET_CONTAINER_multipeermap_get_multiple (m, &k2, NULL, NULL));
+  CHECK (2 == GNUNET_CONTAINER_multipeermap_iterate (m, NULL, NULL));
+  iter = GNUNET_CONTAINER_multipeermap_iterator_create (m);
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multipeermap_iterator_next (iter,
+                                                                    &key_ret,
+                                                                    (const
+                                                                     void **) &
+                                                                    ret));
+  CHECK (0 == memcmp (&key_ret, &k1, sizeof(key_ret)));
+  CHECK (GNUNET_YES == GNUNET_CONTAINER_multipeermap_iterator_next (iter,
+                                                                    &key_ret,
+                                                                    (const
+                                                                     void **) &
+                                                                    ret));
+  CHECK (0 == memcmp (&key_ret, &k1, sizeof(key_ret)));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_iterator_next (iter, NULL,
+                                                                   NULL));
+  GNUNET_free (iter);
+
+  CHECK (2 == GNUNET_CONTAINER_multipeermap_remove_all (m, &k1));
+  for (j = 0; j < 1024; j++)
+    CHECK (GNUNET_OK ==
+           GNUNET_CONTAINER_multipeermap_put (m, &k1, "v2",
+                                              GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+  iter = GNUNET_CONTAINER_multipeermap_iterator_create (m);
+  for (j = 0; j < GNUNET_CONTAINER_multipeermap_size (m); j++)
+    CHECK (GNUNET_YES == GNUNET_CONTAINER_multipeermap_iterator_next (iter,
+                                                                      NULL,
+                                                                      NULL));
+  CHECK (GNUNET_NO == GNUNET_CONTAINER_multipeermap_iterator_next (iter, NULL,
+                                                                   NULL));
+  GNUNET_CONTAINER_multipeermap_iterator_destroy (iter);
+
+  GNUNET_CONTAINER_multipeermap_destroy (m);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failureCount = 0;
+  int i;
+
+  GNUNET_log_setup ("test-container-multipeermap", "WARNING", NULL);
+  for (i = 1; i < 255; i++)
+    failureCount += testMap (i);
+  if (failureCount != 0)
+    return 1;
+  return 0;
+}
+
+
+/* end of test_container_multipeermap.c */
diff --git a/src/lib/util/test_crypto_blind.c b/src/lib/util/test_crypto_blind.c
new file mode 100644
index 000000000..1b256fca3
--- /dev/null
+++ b/src/lib/util/test_crypto_blind.c
@@ -0,0 +1,87 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_crypto_blind.c
+ * @brief testcase for utility functions for blind signatures
+ * @author Christian Grothoff <grothoff@gnunet.org>
+ */
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *priv;
+  struct GNUNET_CRYPTO_BlindSignPublicKey *pub;
+  struct GNUNET_CRYPTO_BlindingInputValues *biv;
+  struct GNUNET_CRYPTO_BlindedMessage *bm;
+  struct GNUNET_CRYPTO_BlindedSignature *bsig;
+  struct GNUNET_CRYPTO_UnblindedSignature *sig;
+  union GNUNET_CRYPTO_BlindingSecretP bsec;
+  union GNUNET_CRYPTO_BlindSessionNonce nonce;
+
+  GNUNET_log_setup ("test-crypto-blind",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              &bsec,
+                              sizeof (bsec));
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              &nonce,
+                              sizeof (nonce));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_blind_sign_keys_create (&priv,
+                                                       &pub,
+                                                       GNUNET_CRYPTO_BSA_CS));
+  biv = GNUNET_CRYPTO_get_blinding_input_values (priv,
+                                                 &nonce,
+                                                 "salt");
+  bm = GNUNET_CRYPTO_message_blind_to_sign (pub,
+                                            &bsec,
+                                            &nonce,
+                                            "hello",
+                                            5,
+                                            biv);
+  bsig = GNUNET_CRYPTO_blind_sign (priv,
+                                   "salt",
+                                   bm);
+  sig = GNUNET_CRYPTO_blind_sig_unblind (bsig,
+                                         &bsec,
+                                         "hello",
+                                         5,
+                                         biv,
+                                         pub);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_blind_sig_verify (pub,
+                                                 sig,
+                                                 "hello",
+                                                 5));
+  GNUNET_CRYPTO_blinding_input_values_decref (biv);
+  GNUNET_CRYPTO_blinded_sig_decref (bsig);
+  GNUNET_CRYPTO_unblinded_sig_decref (sig);
+  GNUNET_CRYPTO_blinded_message_decref (bm);
+  GNUNET_CRYPTO_blind_sign_priv_decref (priv);
+  GNUNET_CRYPTO_blind_sign_pub_decref (pub);
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_crc.c b/src/lib/util/test_crypto_crc.c
new file mode 100644
index 000000000..d95eaf260
--- /dev/null
+++ b/src/lib/util/test_crypto_crc.c
@@ -0,0 +1,221 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2004, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+     For the actual CRC code:
+     Copyright abandoned; this code is in the public domain.
+     Provided to GNUnet by peter@horizon.com
+ */
+
+/**
+ * @file util/test_crypto_crc.c
+ * @brief testcase for crypto_crc.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static int expected[] = {
+  -1223996378, 929797997, -1048047323, 1791081351, -425765913, 2138425902,
+  82584863, 1939615314, 1806463044, -1505003452, 1878277636, -997353517,
+  201238705, 1723258694, -1107452366, -344562561, -1102247383, 1973035265,
+  715213337, -1886586005, 2021214515, -1387332962, 593019378, -571088044,
+  1412577760, 412164558, -1626111170, 1556494863, -289796528, -850404775,
+  2066714587, -911838105, -1426027382, 499684507, -835420055, 1817119454,
+  -1221795958, 1516966784, -1038806877, -2115880691, 532627620, 1984437415,
+  -396341583, -1345366324, -590766745, -1801923449, 1752427988, -386896390,
+  453906317, 1552589433, -858925718, 1160445643, -740188079, -486609040,
+  1102529269, -515846212, -1614217202, 1572162207, 943558923, -467330358,
+  -1870764193, 1477005328, -793029208, -888983175, -696956020, 842706021,
+  1642390067, -805889494, 1284862057, 1562545388, 2091626273, 1852404553,
+  -2076508101, 370903003, 1186422975, 1936085227, 769358463, 180401058,
+  2032612572, -105461719, -1119935472, 617249831, 1169304728, 1771205256,
+  -2042554284, 653270859, -918610713, 336081663, -913685370, 1962213744,
+  -505406126, -838622649, -1141518710, 893143582, -1330296611, 122119483,
+  1111564496, 688811976, 1016241049, -1803438473, 359630107, 1034798954,
+  -581359286, 1590946527, -389997034, 2020318460, 1695967527, -464069727,
+  -862641495, -1405012109, -771244841, 738226150, -1035328134, -933945474,
+  1254965774, 1661863830, -884127998, 1800460481, 814702567, -1214068102,
+  -541120421, 1898656429, -236825530, 1505866267, 1252462132, -981007520,
+  1502096471, -2134644056, 483221797, 1276403836, 541133290, -1234093967,
+  350748780, 257941070, 1030457090, 434988890, -1098135432, -1000556640,
+  -577128022, 644806294, -787536281, -1288346343, 998079404, 1259353935,
+  955771631, -958377466, 1746756252, 451579658, 1913409243, -952026299,
+  -1556035958, -830279881, 834744289, -1878491428, 700000962, -1027245802,
+  1393574384, -1260409147, -841420884, 892132797, 1494730226, -1649181766,
+  1651097838, -1041807403, -1916675721, -1324525963, 157405899, -655788033,
+  -1943555237, -79747022, 339721623, -138341083, 1111902411, -435322914,
+  -533294200, -190220608, -1718346014, -1631301894, 1706265243, 745533899,
+  1351941230, 1803009594, -1218191958, 1467751062, 84368433, -711251880,
+  1699423788, -768792716, 846639904, 2103267723, -2095288070, -440571408,
+  -362144485, 2020468971, 352105963, -849211036, -1272592429, 1743440467,
+  2020667861, -1649992312, 172682343, 816705364, -1990206923, 902689869,
+  -298510060, 164207498, 190378213, 242531543, 113383268, 304810777,
+  -1081099373, 819221134, -1100982926, -855941239, 1091308887, -934548124,
+  520508733, -1381763773, -491593287, -2143492665, 700894653, -2049034808,
+  -160942046, -2009323577, 1464245054, 1584746011, -768646852, -993282698,
+  1265838699, -1873820824, 575704373, -986682955, 1270688416, 88587481,
+  -1723991633, -409928242, 866669946, -483811323, -181759253, -963525431,
+  -1686612238, -1663460076, -1128449775, -1368922329, 122318131, 795862385,
+  528576131, -19927090, 1369299478, 1285665642, -738964611, 1328292127,
+  552041252, -1431494354, -1205275362, 42768297, -1329537238, -449177266,
+  943925221, 987016465, -945138414, -270064876, 1650366626, -369252552,
+  582030210, -1229235374, 147901387, -517510506, -1609742888, -1086838308,
+  1391998445, -313975512, -613392078, 855706229, 1475706341, -1112105406,
+  2032001400, 1565777625, 2030937777, 435522421, 1823527907, -691390605,
+  -827253664, 1057171580, -314146639, -630099999, -1347514552, 478716232,
+  -1533658804, -1425371979, 761987780, 1560243817, -1945893959, 1205759225,
+  -959343783, -576742354, -154125407, -1158108776, 1183788580, 1354198127,
+  -1534207721, -823991517, -170534462, -912524170, 1858513573, 467072185,
+  2091040157, -1765027018, -1659401643, -1173890143, -1912754057, -84568053,
+  2010781784, -921970156, 944508352, -922040609, 1055102010, 1018688871,
+  -1186761311, -2012263648, 1311654161, 277659086, 2029602288, 1127061510,
+  1029452642, 285677123, -188521091, -641039012, 653836416, -805916340,
+  -1644860596, 1352872213, 691634876, -1477113308, -748430369, 1030697363,
+  -2007864449, -1196662616, 1313997192, 177342476, -566676450, -1118618118,
+  1697953104, 344671484, -1489783116, -889507873, 1259591310, -716567168,
+  2116447062, 324368527, 1789366816, 1558930442, 1950250221, -785460151,
+  1174714258, -430047304, -859487565, -580633932, 607732845, -1128150220,
+  1544355315, 1460298016, -1771194297, 1215703690, 277231808, -416020628,
+  -418936577, -1724839216, 404731389, 1058730508, -1508366681, 229883053,
+  -572310243, 1883189553, 931286849, 1659300867, -94236383, -241524462,
+  548020458, -302406981, 579986475, 73468197, -984957614, 1554382245,
+  2084807492, -1456802798, -1105192593, 629440327, -16313961, -2102585261,
+  1873675206, 161035128, 1497033351, 1990150811, -499405222, 304019482,
+  41935663, -805987182, -571699268, 1748462913, 2096239823, -116359807,
+  -1871127553, -1074832534, -1558866192, 231353861, 2122854560, -2102323721,
+  -281462361, -343403210, -673268171, 1776058383, 1581561150, 2059580579,
+  768848632, 1347190372, -1701705879, 245282007, -563267886, -592558289,
+  1662399958, 1390406821, -1522485580, -706446863, 2069516289, -301855859,
+  -778346387, -1454093198, 1249083752, -1760506745, 262193320, 630751125,
+  -1495939124, -29980580, -1989626563, 659039376, -329477132, -1003507166,
+  -1322549020, 358606508, -2052572059, 1848014133, 1826958586, -1004948862,
+  -1775370541, 2134177912, -1739214473, 1892700918, 926629675, -1042761322,
+  2020075900, 606370962, -1256609305, 117577265, -586848924, 191368285,
+  1653535275, -1329269701, -375879127, -1089901406, 1206489978, 534223924,
+  -1042752982, -1178316881, -445594741, -1501682065, -1598136839,
+  -467688289, 750784023, 1781080461, 1729380226, 16906088, 862168532,
+  -2037752683, 1455274138, -1491220107, 1058323960, 1711530558, 1355062750,
+  227640096, 396568027, -173579098, -408975801, -993618329, -1470751562,
+  371076647, 209563718, 2015405719, -723460281, -1423934420, -2089643958,
+  353260489, 2084264341, -792676687, 701391030, -1440658244, 1479321011,
+  1907822880, 1232524257, -256712289, 401077577, 621808069, 868263613,
+  1244930119, 2020996902, 117483907, 1341376744, -1936988014, -445200547,
+  -843751811, -435291191, 1041695743, 476132726, -1226874735, -1436046747,
+  -297047422, 1739645396, 1948680937, -718144374, 1141983978, 1673650568,
+  -197244350, 1604464002, 1424069853, -485626505, 1708710014, -849136541,
+  1573778103, 530360999, 1777767203, 1376958336, -1088364352, 1826167753,
+  742735448, -1386211659, -1991323164, -444115655, -443055378, -1586901006,
+  -1741686587, 1925818034, -2118916824, 803890920, -1481793154, 992278937,
+  1302616410, 444517030, 1393144770, -2025632978, 1902300505, -1683582981,
+  800654133, 873850324, -619580878, -2002070410, -2024936385, 1978986634,
+  2012024264, 675768872, 389435615, -867217540, 231209167, -303917385,
+  1445676969, -1385982721, 1310476490, 580273453, -160600202, -1330895874,
+  487110497, 1124384798, 227637416, -1829783306, 1014818058, -1336870683,
+  -1042199518, -468525587, -1186267363, -472843891, 1215617600, -2056648329,
+  -873216891, 156780951, -1883246047, -842549253, -717684332, 760531638,
+  1074787431, 786267513, 814031289, -561255343, -110302255, -1837376592,
+  989669060, -81350614, 546038730, 222899882, 1298746805, 1791615733,
+  1565630269, 1516024174, 421691479, 1860326051, -1973359550, 1854393443,
+  -1401468528, -158562295, 1509929255, -124024738, -462937489, 259890715,
+  -1515121317, -289511197, -913738664, 698079062, -1631229382, -507275144,
+  1897739663, -1118192766, -1687033399, 61405556, -1913606579, -473308896,
+  -259107170, -576944609, -1689355510, 322156799, 545090192, 127425176,
+  -1815211748, -2070235628, -1172529316, 599259550, -910906653, 1797380363,
+  -938649427, 142991392, 504559631, 1208867355, -807699247, -616021271,
+  -254935281, -57151221, -1095534993, 1998380318, 1772459584, 713271407,
+  -1197898266, 808881935, -308133481, -1314455137, 284321772, -743117625,
+  -1622364240, -1667535152, 118713606, 1053615347, -2072876023, -178189072,
+  -828319551, 2047304928, -1311435786, -1970672907, -747972100, 86806159,
+  -436088421, 1464645587, 735840899, 32600466, -190473426, -735703440,
+  482872155, 475662392, -713681085, 1424078728, -150668609, -1137197868,
+  -1682762563, -48035649, 1143959866, -1542015129, 284920371, -1587695586,
+  -625236551, -753893357, -433976266, -1329796037, -1636712478, 1686783454,
+  27839146, 1748631474, -879528256, 2057796026, 773734654, 112269667,
+  -2011541314, 1517797297, -1943171794, 268166111, -1037010413, -1945824504,
+  -1672323792, 306260758, -692968628, -701704965, -462980996, 939188824,
+  553289792, 1790245000, 2093793129, -658085781, -186055037, -2130433650,
+  -1013235433, 1190870089, -2126586963, -1509655742, -1291895256,
+  -1427857845, 309538950, 388316741, 259659733, -1895092434, 110126220,
+  -170175575, -419430224, -696234084, -832170948, -353431720, -797675726,
+  -1644136054, 715163272, -1305904349, -145786463, -99586244, -695450446,
+  -871327102, -725496060, 952863853, -688441983, -1729929460, -103732092,
+  1059054528, 568873585, -982665223, -128672783, 2099418320, 1508239336,
+  -2089480835, -390935727, 664306522, -1607364342, -163246802, -1121295140,
+  -128375779, -615694409, -2079391797, 760542037, 677761593, -750117849,
+  -1060525080, 2128437080, 525250908, 1987657172, 2032530557, -2011247936,
+  1942775263, 1681562788, 688229491, -803856505, 684707948, 1308988965,
+  1455480037, 790659611, 1557968784, -383203149, -361510986, -742575828,
+  558837193, -1214977424, 1253274105, -119513513, -993964385, -33438767,
+  -177452803, 1186928041, -2073533871, 1188528559, 1896514695, 1200128512,
+  1930588755, -1914141443, 1534656032, -1192989829, -1848274656, -220848455,
+  1001806509, 1298797392, 1533031884, -1912322446, 1705583815, 1568094347,
+  -1397640627, 807828512, -1852996497, -1529733505, -1575634185,
+  -1280270160, -1567624159, -1861904922, 1276738579, 1163432999, 626879833,
+  316942006, -1871138342, 1341039701, 1595907877, 1950911580, 1634717748,
+  1071476055, -809354290, -1161553341, -2081621710, -2085557943, 19360224,
+  322135580, -698485151, 1267663094, -233890834, -126361189, -1426257522,
+  1094007921, 500179855, -283548002, -1678987343, 1946999943, 1489410849,
+  2089571262, 1430799093, 1961848046, -99462663, -552833264, 1168700661,
+  -1783882181, 2089196401, 1092839657, 914488673, 80263859, -2140947098,
+  -726384741, -1022448237, 2113887675, 1485770846, -112922517, 1995461466,
+  774613726, 944068011, 1521975359, 289086919, -386920759, -1960513175,
+  358460021, -238698524, -1913640563, -1000324864, 1731755224, -1271586254,
+  -1917469655, 2134162829, -828097534, -1089292503, -1514835999, 1682931514,
+  -482307169, 2110243841, 115744834, -2038340170, 65889188, -539445712,
+  -1713206408, -1842396726, -1659545588, -909558923, 860164922, 1328713040,
+  1044007120, -2103807103, -1073990344, -1312783785, -884980824, -705318011,
+  -1263408788, -2032228692, -1732844111, -1813827156, 1462566279,
+  1179250845, 1732421772, 604429013, -92284336, -1192166516, 304654351,
+  1998552034, -1802461575, -1802704071, -1704833934, -976264396, 1005840702,
+  2108843914, 1363909309, 843040834, -1039625241, 1285007226, 91610001,
+  418426329, 678422358, -945360697, -440008081, -1053091357, 425719777,
+  -1372778676, 591912153, 1229089037, -56663158, 2140251400, 830257037,
+  763914157, 175610373, -2105655963, -1040826150, 1174443038, 339290593,
+  346618443, -180504100, -1363190515, 210620018, 1028894425, 573529714,
+  698460117, 136999397, 1015621712, -1401813739, -297990684, -1820934845,
+  -1299093313, 1299361369, -366522415, 91527707, 1113466178, -956229484,
+  22204763, -1394374195, -1912666711, -1453789804, 1613408399, -169509567,
+  1350520309, 540761213, -2086682848, 1095131491, -812787911, 1860108594,
+  -1121378737, -1667252487, -486084366, 166519760, 1609891237, 728218405,
+  291075010, 646168382, 108462277, -1616661910, 1016600360, 2099958568,
+  27934736, 183821196, 13660496, -805589719, 936068730, -439037934,
+  1414622584, 215845485, -1352304469, -1817427526, -1318710977, -110207199,
+  228524335, 1704746590, 998293651, -1521016702, -641956531, -2089808167,
+  2094404052, -1446381065, -662186492, 1670154584, 9637833, 493925511,
+  660047318, 1197537103, 1696017374, -204994399, -1104145601, -852330465,
+  -1936369658, -829716674, -1255255217, 1264013799, 1642611772, -652520861,
+  777247164, 2028895987, -1424241853, -54367829, -1940161761, -1802831079,
+  -449405299, 838242661, -323055438, 794295411, -136989378, -446686673,
+  -421252799, -16777216,
+};
+
+int
+main (int argc, char *argv[])
+{
+  char buf[1024];
+  int i;
+
+  GNUNET_log_setup ("test-crypto-crc", "WARNING", NULL);
+  for (i = 0; i < 1024; i++)
+    buf[i] = (char) i;
+  for (i = 0; i < 1024; i++)
+    if (expected[i] != GNUNET_CRYPTO_crc32_n (&buf[i], 1024 - i))
+      return 1;
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_cs.c b/src/lib/util/test_crypto_cs.c
new file mode 100644
index 000000000..ee68db72f
--- /dev/null
+++ b/src/lib/util/test_crypto_cs.c
@@ -0,0 +1,621 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2021,2022, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_crypto_cs.c
+ * @brief testcase for utility functions for clause blind schnorr signature scheme cryptography
+ * @author Lucien Heuzeveldt <lucienclaude.heuzeveldt@students.bfh.ch>
+ * @author Gian Demarmels <gian@demarmels.org>
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <sodium.h>
+
+#define ITER 25
+
+
+static void
+test_create_priv (struct GNUNET_CRYPTO_CsPrivateKey *priv)
+{
+  /* TEST 1
+   * Check that privkey is set
+   */
+  struct GNUNET_CRYPTO_CsPrivateKey other_priv;
+
+  GNUNET_CRYPTO_cs_private_key_generate (priv);
+  memset (&other_priv,
+          42,
+          sizeof (other_priv));
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_priv.scalar,
+                                &priv->scalar));
+}
+
+
+static void
+test_generate_pub (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                   struct GNUNET_CRYPTO_CsPublicKey *pub)
+{
+  /* TEST 1
+   * Check that pubkey is set
+   */
+  struct GNUNET_CRYPTO_CsPublicKey other_pub;
+
+  GNUNET_CRYPTO_cs_private_key_get_public (priv,
+                                           pub);
+  memset (&other_pub,
+          42,
+          sizeof (other_pub));
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_pub.point,
+                                &pub->point));
+
+  /* TEST 2
+   * Check that pubkey is a valid point
+   */
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (pub->point.y));
+
+  /* TEST 3
+   * Check if function gives the same result for the same output
+   */
+  other_pub = *pub;
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_private_key_get_public (priv,
+                                             pub);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_pub.point,
+                                  &pub->point));
+  }
+}
+
+
+static void
+test_derive_rsecret (const struct GNUNET_CRYPTO_CsSessionNonce *nonce,
+                     const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                     struct GNUNET_CRYPTO_CsRSecret r[2])
+{
+  /* TEST 1
+   * Check that r are set
+   */
+  struct GNUNET_CRYPTO_CsPrivateKey other_r[2];
+
+  memcpy (other_r,
+          r,
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
+  GNUNET_CRYPTO_cs_r_derive (nonce,
+                             "nw",
+                             priv,
+                             r);
+  GNUNET_assert (0 !=
+                 memcmp (&other_r[0],
+                         &r[0],
+                         sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+
+  /* TEST 2
+   * Check if function gives the same result for the same input.
+   * This test ensures that the derivation is deterministic.
+   */
+  memcpy (other_r,
+          r,
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_r_derive (nonce,
+                               "nw",
+                               priv,
+                               r);
+    GNUNET_assert (0 ==
+                   memcmp (other_r,
+                           r,
+                           sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+  }
+}
+
+
+static void
+test_generate_rpublic (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
+                       struct GNUNET_CRYPTO_CsRPublic *r_pub)
+{
+  /* TEST 1
+   * Check that r_pub is set
+   */
+  struct GNUNET_CRYPTO_CsRPublic other_r_pub;
+
+  other_r_pub = *r_pub;
+  GNUNET_CRYPTO_cs_r_get_public (r_priv,
+                                 r_pub);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_r_pub.point,
+                                &r_pub->point));
+  /* TEST 2
+   * Check that r_pub is a valid point
+   */
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (r_pub->point.y));
+
+  /* TEST 3
+   * Check if function gives the same result for the same output
+   */
+  other_r_pub.point = r_pub->point;
+  for (int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_r_get_public (r_priv,
+                                   r_pub);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_r_pub.point,
+                                  &r_pub->point));
+  }
+}
+
+
+static void
+test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsBlindingNonce *blind_seed,
+                             struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
+{
+  /* TEST 1
+   * Check that blinding secrets are set
+   */
+  struct GNUNET_CRYPTO_CsBlindingSecret other_bs[2];
+
+  memcpy (other_bs,
+          bs,
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
+
+  GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed,
+                                            bs);
+
+  GNUNET_assert (0 !=
+                 memcmp (other_bs,
+                         bs,
+                         sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+                         * 2));
+
+  /* TEST 2
+   * Check if function gives the same result for the same input.
+   * This test ensures that the derivation is deterministic.
+   */
+  memcpy (other_bs,
+          bs,
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed,
+                                              bs);
+    GNUNET_assert (0 == memcmp (&other_bs[0],
+                                &bs[0],
+                                sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+                                * 2));
+  }
+}
+
+
+static void
+test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
+                    const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+                    const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                    const void *msg,
+                    size_t msg_len,
+                    struct GNUNET_CRYPTO_CsC blinded_cs[2],
+                    struct GNUNET_CRYPTO_CSPublicRPairP *blinded_r_pub)
+{
+  /* TEST 1
+   * Check that the blinded c's and blinded r's
+   */
+  struct GNUNET_CRYPTO_CsC other_blinded_c[2];
+
+  memcpy (&other_blinded_c[0],
+          &blinded_cs[0],
+          sizeof(struct GNUNET_CRYPTO_CsC) * 2);
+
+  struct GNUNET_CRYPTO_CSPublicRPairP other_blinded_pub;
+  other_blinded_pub = *blinded_r_pub;
+
+  GNUNET_CRYPTO_cs_calc_blinded_c (bs,
+                                   r_pub,
+                                   pub,
+                                   msg,
+                                   msg_len,
+                                   blinded_cs,
+                                   blinded_r_pub);
+
+  GNUNET_assert (0 != memcmp (&other_blinded_c[0],
+                              &blinded_cs[0],
+                              sizeof(struct GNUNET_CRYPTO_CsC) * 2));
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_blinded_pub,
+                                blinded_r_pub));
+
+  /* TEST 2
+   * Check if R' - aG -bX = R for b = 0
+   * This test does the opposite operations and checks whether the equation is still correct.
+   */
+  for (unsigned int b = 0; b <= 1; b++)
+  {
+    struct GNUNET_CRYPTO_Cs25519Point aG;
+    struct GNUNET_CRYPTO_Cs25519Point bX;
+    struct GNUNET_CRYPTO_Cs25519Point r_min_aG;
+    struct GNUNET_CRYPTO_CsRPublic res;
+
+    GNUNET_assert (0 ==
+                   crypto_scalarmult_ed25519_base_noclamp (
+                     aG.y,
+                     bs[b].alpha.d));
+    GNUNET_assert (0 ==
+                   crypto_scalarmult_ed25519_noclamp (
+                     bX.y,
+                     bs[b].beta.d,
+                     pub->point.y));
+    GNUNET_assert (0 ==
+                   crypto_core_ed25519_sub (
+                     r_min_aG.y,
+                     blinded_r_pub->r_pub[b].point.y,
+                     aG.y));
+    GNUNET_assert (0 == crypto_core_ed25519_sub (
+                     res.point.y,
+                     r_min_aG.y,
+                     bX.y));
+
+    GNUNET_assert (0 ==
+                   memcmp (&res,
+                           &r_pub[b],
+                           sizeof(struct GNUNET_CRYPTO_CsRPublic)));
+  }
+
+
+  /* TEST 3
+   * Check that the blinded r_pubs' are valid points
+   */
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (
+                   blinded_r_pub->r_pub[0].point.y));
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (
+                   blinded_r_pub->r_pub[1].point.y));
+
+  /* TEST 4
+   * Check if function gives the same result for the same input.
+   */
+  memcpy (&other_blinded_c[0],
+          &blinded_cs[0],
+          sizeof(struct GNUNET_CRYPTO_CsC) * 2);
+  other_blinded_pub = *blinded_r_pub;
+
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_calc_blinded_c (bs,
+                                     r_pub,
+                                     pub,
+                                     msg,
+                                     msg_len,
+                                     blinded_cs,
+                                     blinded_r_pub);
+    GNUNET_assert (0 ==
+                   memcmp (&other_blinded_c[0],
+                           &blinded_cs[0],
+                           sizeof(struct GNUNET_CRYPTO_CsC) * 2));
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_blinded_pub,
+                                  blinded_r_pub));
+  }
+}
+
+
+static void
+test_blind_sign (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                 const struct GNUNET_CRYPTO_CsRSecret r[2],
+                 const struct GNUNET_CRYPTO_CsBlindedMessage *bm,
+                 struct GNUNET_CRYPTO_CsBlindSignature *cs_blind_sig)
+{
+  /* TEST 1
+   * Check that blinded_s is set
+   */
+  struct GNUNET_CRYPTO_CsBlindSignature other_blind_sig;
+
+  memset (&other_blind_sig,
+          44,
+          sizeof (other_blind_sig));
+  GNUNET_CRYPTO_cs_sign_derive (priv,
+                                r,
+                                bm,
+                                &other_blind_sig);
+  GNUNET_assert (0 == other_blind_sig.b ||
+                 1 == other_blind_sig.b);
+
+  /* TEST 2
+   * Check if s := rb + cbX
+   * This test does the opposite operations and checks whether the equation is still correct.
+   */
+  struct GNUNET_CRYPTO_Cs25519Scalar cb_mul_x;
+  struct GNUNET_CRYPTO_Cs25519Scalar s_min_rb;
+ 
+  crypto_core_ed25519_scalar_mul (cb_mul_x.d,
+                                  bm->c[other_blind_sig.b].scalar.d,
+                                  priv->scalar.d);
+  crypto_core_ed25519_scalar_sub (s_min_rb.d,
+                                  other_blind_sig.s_scalar.scalar.d,
+                                  r[other_blind_sig.b].scalar.d);
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (&s_min_rb,
+                                &cb_mul_x));
+
+  /* TEST 3
+   * Check if function gives the same result for the same input.
+   */
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_sign_derive (priv,
+                                  r,
+                                  bm,
+                                  cs_blind_sig);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_blind_sig,
+                                  cs_blind_sig));
+  }
+}
+
+
+static void
+test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+               const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+               struct GNUNET_CRYPTO_CsS *signature_scalar)
+{
+  /* TEST 1
+   * Check that signature_scalar is set
+   */
+  struct GNUNET_CRYPTO_CsS other_signature_scalar;
+  memcpy (&other_signature_scalar,
+          signature_scalar,
+          sizeof(struct GNUNET_CRYPTO_CsS));
+
+  GNUNET_CRYPTO_cs_unblind (blinded_signature_scalar,
+                            bs,
+                            signature_scalar);
+
+  GNUNET_assert (0 != memcmp (&other_signature_scalar,
+                              signature_scalar,
+                              sizeof(struct GNUNET_CRYPTO_CsS)));
+
+  /* TEST 2
+   * Check if s' := s + a mod p
+   * This test does the opposite operations and checks whether the equation is still correct.
+   */
+  struct GNUNET_CRYPTO_Cs25519Scalar s_min_a;
+
+  crypto_core_ed25519_scalar_sub (s_min_a.d,
+                                  signature_scalar->scalar.d,
+                                  bs->alpha.d);
+
+  GNUNET_assert (0 == memcmp (&s_min_a, &blinded_signature_scalar->scalar,
+                              sizeof(struct
+                                     GNUNET_CRYPTO_Cs25519Scalar)));
+
+  /* TEST 3
+   * Check if function gives the same result for the same input.
+   */
+  memcpy (&other_signature_scalar, signature_scalar,
+          sizeof(struct GNUNET_CRYPTO_CsS));
+
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_unblind (blinded_signature_scalar, bs, signature_scalar);
+    GNUNET_assert (0 == memcmp (&other_signature_scalar,
+                                signature_scalar,
+                                sizeof(struct GNUNET_CRYPTO_CsS)));
+  }
+}
+
+
+static void
+test_blind_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
+                   const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                   const struct GNUNET_CRYPTO_CsC *c)
+{
+  /* TEST 1
+   * Test verifies the blinded signature sG == Rb + cbX
+   */
+  struct GNUNET_CRYPTO_Cs25519Point sig_scal_mul_base;
+  struct GNUNET_CRYPTO_Cs25519Point c_mul_pub;
+  struct GNUNET_CRYPTO_Cs25519Point r_add_c_mul_pub;
+
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_base_noclamp (
+                   sig_scal_mul_base.y,
+                   sig->s_scalar.scalar.d));
+  GNUNET_assert (0 ==
+                 crypto_scalarmult_ed25519_noclamp (c_mul_pub.y,
+                                                    c->scalar.d,
+                                                    pub->point.y));
+  GNUNET_assert (0 ==
+                 crypto_core_ed25519_add (r_add_c_mul_pub.y,
+                                          sig->r_point.point.y,
+                                          c_mul_pub.y));
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (sig_scal_mul_base.y,
+                                r_add_c_mul_pub.y));
+}
+
+
+static void
+test_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
+             const struct GNUNET_CRYPTO_CsPublicKey *pub,
+             const void *msg,
+             size_t msg_len)
+{
+  /* TEST 1
+   * Test simple verification
+   */
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_cs_verify (sig,
+                                          pub,
+                                          msg,
+                                          msg_len));
+  /* TEST 2
+   * Test verification of "wrong" message
+   */
+  char other_msg[] = "test massege";
+  size_t other_msg_len = strlen ("test massege");
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_CRYPTO_cs_verify (sig,
+                                          pub,
+                                          other_msg,
+                                          other_msg_len));
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  printf ("Test started\n");
+
+  // ---------- actions performed by signer
+  char message[] = "test message";
+  size_t message_len = strlen ("test message");
+
+  struct GNUNET_CRYPTO_CsPrivateKey priv;
+
+  GNUNET_log_setup ("test-crypto-cs",
+                    "INFO",
+                    NULL);
+  memset (&priv,
+          42,
+          sizeof (priv));
+  test_create_priv (&priv);
+
+  struct GNUNET_CRYPTO_CsPublicKey pub;
+
+  memset (&pub,
+          42,
+          sizeof (pub));
+  test_generate_pub (&priv,
+                     &pub);
+
+  // set nonce
+  struct GNUNET_CRYPTO_CsSessionNonce nonce;
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (&nonce,
+                                    sizeof(nonce),
+                                    "nonce",
+                                    strlen ("nonce"),
+                                    "nonce_secret",
+                                    strlen ("nonce_secret"),
+                                    NULL,
+                                    0));
+
+  // generate r, R
+  struct GNUNET_CRYPTO_CsRSecret r_secrets[2];
+
+  memset (r_secrets,
+          42,
+          sizeof (r_secrets));
+  test_derive_rsecret (&nonce,
+                       &priv,
+                       r_secrets);
+
+  struct GNUNET_CRYPTO_CsRPublic r_publics[2];
+
+  memset (r_publics,
+          42,
+          sizeof (r_publics));
+  test_generate_rpublic (&r_secrets[0],
+                         &r_publics[0]);
+  test_generate_rpublic (&r_secrets[1],
+                         &r_publics[1]);
+
+  // ---------- actions performed by user
+
+  // generate blinding secrets
+  struct GNUNET_CRYPTO_CsBlindingSecret blindingsecrets[2];
+  struct GNUNET_CRYPTO_CsBlindingNonce bnonce;
+
+  memset (&bnonce,
+          42,
+          sizeof (bnonce));
+  memset (blindingsecrets,
+          42,
+          sizeof (blindingsecrets));
+  test_derive_blindingsecrets (&bnonce,
+                               blindingsecrets);
+
+  // calculate blinded c's
+  struct GNUNET_CRYPTO_CsBlindedMessage bm; 
+  struct GNUNET_CRYPTO_CsC blinded_cs[2];
+  struct GNUNET_CRYPTO_CSPublicRPairP blinded_r_pubs;
+
+  memset (blinded_cs,
+          42,
+          sizeof (blinded_cs));
+  memset (&blinded_r_pubs,
+          42,
+          sizeof (blinded_r_pubs));
+  test_calc_blindedc (blindingsecrets,
+                      r_publics,
+                      &pub,
+                      message,
+                      message_len,
+                      blinded_cs,
+                      &blinded_r_pubs);
+
+  // ---------- actions performed by signer
+  // sign blinded c's and get b and s in return
+  struct GNUNET_CRYPTO_CsBlindSignature blinded_s;
+
+  memset (&blinded_s,
+          42,
+          sizeof (blinded_s));
+  bm.c[0] = blinded_cs[0];
+  bm.c[1] = blinded_cs[1];
+  bm.nonce = nonce;
+  test_blind_sign (&priv,
+                   r_secrets,
+                   &bm,
+                   &blinded_s);
+  // verify blinded signature
+  struct GNUNET_CRYPTO_CsSignature blinded_signature;
+
+  blinded_signature.r_point = r_publics[blinded_s.b];
+  blinded_signature.s_scalar.scalar = blinded_s.s_scalar.scalar;
+  test_blind_verify (&blinded_signature,
+                     &pub,
+                     &blinded_cs[blinded_s.b]);
+
+  // ---------- actions performed by user
+  struct GNUNET_CRYPTO_CsS sig_scalar;
+
+  memset (&sig_scalar,
+          42,
+          sizeof (sig_scalar));
+  test_unblinds (&blinded_s.s_scalar,
+                 &blindingsecrets[blinded_s.b],
+                 &sig_scalar);
+
+  // verify unblinded signature
+  struct GNUNET_CRYPTO_CsSignature signature;
+  signature.r_point = blinded_r_pubs.r_pub[blinded_s.b];
+  signature.s_scalar = sig_scalar;
+  test_verify (&signature,
+               &pub,
+               message,
+               message_len);
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_ecc_dlog.c b/src/lib/util/test_crypto_ecc_dlog.c
new file mode 100644
index 000000000..c3382a4fa
--- /dev/null
+++ b/src/lib/util/test_crypto_ecc_dlog.c
@@ -0,0 +1,219 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_ecc_dlog.c
+ * @brief testcase for ECC DLOG calculation
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+
+/**
+ * Name of the curve we are using.  Note that we have hard-coded
+ * structs that use 256 bits, so using a bigger curve will require
+ * changes that break stuff badly.  The name of the curve given here
+ * must be agreed by all peers and be supported by libgcrypt.
+ */
+#define CURVE "Ed25519"
+
+/**
+ * Maximum value we test dlog for.
+ */
+#define MAX_FACT 100
+
+/**
+ * Maximum memory to use, sqrt(MAX_FACT) is a good choice.
+ */
+#define MAX_MEM 10
+
+/**
+ * How many values do we test?
+ */
+#define TEST_ITER 100
+
+/**
+ * Range of values to use for MATH tests.
+ */
+#define MATH_MAX 5
+
+
+/**
+ * Do some DLOG operations for testing.
+ *
+ * @param edc context for ECC operations
+ */
+static void
+test_dlog (struct GNUNET_CRYPTO_EccDlogContext *edc)
+{
+  for (unsigned int i = 0; i < TEST_ITER; i++)
+  {
+    struct GNUNET_CRYPTO_EccScalar fact;
+    struct GNUNET_CRYPTO_EccScalar n;
+    struct GNUNET_CRYPTO_EccPoint q;
+    int x;
+
+    fprintf (stderr, ".");
+    x = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  MAX_FACT);
+    memset (&n,
+            0,
+            sizeof (n));
+    for (unsigned int j = 0; j < x; j++)
+      sodium_increment (n.v,
+                        sizeof (n.v));
+    if (0 == GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                       2))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Trying negative %d\n",
+                  -x);
+      crypto_core_ed25519_scalar_negate (fact.v,
+                                         n.v);
+      x = -x;
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Trying positive %d\n",
+                  x);
+      fact = n;
+    }
+    if (0 == x)
+    {
+      /* libsodium does not like to multiply with zero; make sure
+         'q' is a valid point (g) first, then use q = q - q to get
+         the product with zero */
+      sodium_increment (fact.v,
+                        sizeof (fact.v));
+      GNUNET_assert (0 ==
+                     crypto_scalarmult_ed25519_base_noclamp (q.v,
+                                                             fact.v));
+      GNUNET_assert (
+        0 ==
+        crypto_core_ed25519_sub (q.v,
+                                 q.v,
+                                 q.v));
+    }
+    else
+      GNUNET_assert (0 ==
+                     crypto_scalarmult_ed25519_base_noclamp (q.v,
+                                                             fact.v));
+    {
+      int iret;
+
+      if (x !=
+          (iret = GNUNET_CRYPTO_ecc_dlog (edc,
+                                          &q)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "DLOG failed for value %d (got: %d)\n",
+                    x,
+                    iret);
+        GNUNET_assert (0);
+      }
+    }
+  }
+  fprintf (stderr,
+           "\n");
+}
+
+
+/**
+ * Do some arithmetic operations for testing.
+ *
+ * @param edc context for ECC operations
+ */
+static void
+test_math (struct GNUNET_CRYPTO_EccDlogContext *edc)
+{
+  int i;
+  int j;
+  struct GNUNET_CRYPTO_EccPoint ip;
+  struct GNUNET_CRYPTO_EccPoint jp;
+  struct GNUNET_CRYPTO_EccPoint r;
+  struct GNUNET_CRYPTO_EccPoint ir;
+  struct GNUNET_CRYPTO_EccPoint irj;
+  struct GNUNET_CRYPTO_EccPoint r_inv;
+  struct GNUNET_CRYPTO_EccPoint sum;
+
+  for (i = -MATH_MAX; i < MATH_MAX; i++)
+  {
+    GNUNET_CRYPTO_ecc_dexp (i, &ip);
+    for (j = -MATH_MAX; j < MATH_MAX; j++)
+    {
+      fprintf (stderr, ".");
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "%d + %d\n",
+                  i,
+                  j);
+      GNUNET_CRYPTO_ecc_dexp (j, &jp);
+      GNUNET_CRYPTO_ecc_rnd (&r,
+                             &r_inv);
+      GNUNET_CRYPTO_ecc_add (&ip, &r, &ir);
+      GNUNET_CRYPTO_ecc_add (&ir, &jp, &irj);
+      GNUNET_CRYPTO_ecc_add (&irj, &r_inv, &sum);
+      int res = GNUNET_CRYPTO_ecc_dlog (edc, &sum);
+      if (i + j != res)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Got %d, expected %d\n",
+                    res,
+                    i + j);
+        // GNUNET_assert (0);
+      }
+    }
+  }
+  fprintf (stderr, "\n");
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_CRYPTO_EccDlogContext *edc;
+
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             _
+             (
+               "libgcrypt has not the expected version (version %s is required).\n"),
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-ecc-dlog",
+                    "WARNING",
+                    NULL);
+  edc = GNUNET_CRYPTO_ecc_dlog_prepare (MAX_FACT,
+                                        MAX_MEM);
+  test_dlog (edc);
+  test_math (edc);
+  GNUNET_CRYPTO_ecc_dlog_release (edc);
+  return 0;
+}
+
+
+/* end of test_crypto_ecc_dlog.c */
diff --git a/src/lib/util/test_crypto_ecdh_ecdsa.c b/src/lib/util/test_crypto_ecdh_ecdsa.c
new file mode 100644
index 000000000..609f05282
--- /dev/null
+++ b/src/lib/util/test_crypto_ecdh_ecdsa.c
@@ -0,0 +1,95 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_ecdh_ecdsa.c
+ * @brief testcase for ECC DH key exchange with ECDSA private keys.
+ * @author Christian Grothoff
+ * @author Bart Polot
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+
+static int
+test_ecdh ()
+{
+  struct GNUNET_CRYPTO_EcdsaPrivateKey priv_dsa;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv_ecdh;
+  struct GNUNET_CRYPTO_EcdsaPublicKey id1;
+  struct GNUNET_CRYPTO_EcdhePublicKey id2;
+  struct GNUNET_HashCode dh[2];
+
+  /* Generate keys */
+  GNUNET_CRYPTO_ecdsa_key_create (&priv_dsa);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&priv_dsa,
+                                      &id1);
+  for (unsigned int j = 0; j < 4; j++)
+  {
+    fprintf (stderr, ",");
+    GNUNET_CRYPTO_ecdhe_key_create (&priv_ecdh);
+    /* Extract public keys */
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv_ecdh,
+                                        &id2);
+    /* Do ECDH */
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_ecdsa_ecdh (&priv_dsa,
+                                             &id2,
+                                             &dh[0]));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_ecdh_ecdsa (&priv_ecdh,
+                                             &id1,
+                                             &dh[1]));
+    /* Check that both DH results are equal. */
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&dh[0],
+                                  &dh[1]));
+  }
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             "libgcrypt has not the expected version (version %s is required).\n",
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-ecdh-ecdsa", "WARNING", NULL);
+  for (unsigned int i = 0; i < 4; i++)
+  {
+    fprintf (stderr,
+             ".");
+    if (0 != test_ecdh ())
+      return 1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_ecdh_ecdsa.c */
diff --git a/src/lib/util/test_crypto_ecdh_eddsa.c b/src/lib/util/test_crypto_ecdh_eddsa.c
new file mode 100644
index 000000000..875f479c2
--- /dev/null
+++ b/src/lib/util/test_crypto_ecdh_eddsa.c
@@ -0,0 +1,96 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_ecdh_eddsa.c
+ * @brief testcase for ECC DH key exchange with EdDSA private keys.
+ * @author Christian Grothoff
+ * @author Bart Polot
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+
+static int
+test_ecdh ()
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey priv_dsa;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv_ecdh;
+  struct GNUNET_CRYPTO_EddsaPublicKey id1;
+  struct GNUNET_CRYPTO_EcdhePublicKey id2;
+  struct GNUNET_HashCode dh[2];
+
+  /* Generate keys */
+  GNUNET_CRYPTO_eddsa_key_create (&priv_dsa);
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv_dsa,
+                                      &id1);
+  for (unsigned int j = 0; j < 4; j++)
+  {
+    fprintf (stderr, ",");
+    GNUNET_CRYPTO_ecdhe_key_create (&priv_ecdh);
+    /* Extract public keys */
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv_ecdh,
+                                        &id2);
+    /* Do ECDH */
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_eddsa_ecdh (&priv_dsa,
+                                             &id2,
+                                             &dh[0]));
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_ecdh_eddsa (&priv_ecdh,
+                                             &id1,
+                                             &dh[1]));
+    /* Check that both DH results are equal. */
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&dh[0],
+                                  &dh[1]));
+  }
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             _ (
+               "libgcrypt has not the expected version (version %s is required).\n"),
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-ecdh-eddsa", "WARNING", NULL);
+  for (unsigned int i = 0; i < 4; i++)
+  {
+    fprintf (stderr,
+             ".");
+    if (0 != test_ecdh ())
+      return 1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_ecdh_eddsa.c */
diff --git a/src/lib/util/test_crypto_ecdhe.c b/src/lib/util/test_crypto_ecdhe.c
new file mode 100644
index 000000000..cf59cfa64
--- /dev/null
+++ b/src/lib/util/test_crypto_ecdhe.c
@@ -0,0 +1,71 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_ecdhe.c
+ * @brief testcase for ECC ECDHE public key crypto
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv1;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv2;
+  struct GNUNET_CRYPTO_EcdhePublicKey pub1;
+  struct GNUNET_CRYPTO_EcdhePublicKey pub2;
+  struct GNUNET_HashCode ecdh1;
+  struct GNUNET_HashCode ecdh2;
+
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             "libgcrypt has not the expected version (version %s is required).\n",
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-ecdhe", "WARNING", NULL);
+
+  for (unsigned int i = 0; i < 100; i++)
+  {
+    fprintf (stderr,
+             ".");
+    GNUNET_CRYPTO_ecdhe_key_create (&priv1);
+    GNUNET_CRYPTO_ecdhe_key_create (&priv2);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv1, &pub1);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv2, &pub2);
+    GNUNET_CRYPTO_ecc_ecdh (&priv1, &pub2, &ecdh1);
+    GNUNET_CRYPTO_ecc_ecdh (&priv2, &pub1, &ecdh2);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&ecdh1,
+                                  &ecdh2));
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_ecdhe.c */
diff --git a/src/lib/util/test_crypto_ecdsa.c b/src/lib/util/test_crypto_ecdsa.c
new file mode 100644
index 000000000..9dc1f863d
--- /dev/null
+++ b/src/lib/util/test_crypto_ecdsa.c
@@ -0,0 +1,282 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_ecdsa.c
+ * @brief testcase for ECC ECDSA public key crypto
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_signatures.h"
+#include <gcrypt.h>
+
+#define ITER 25
+
+#define PERF GNUNET_YES
+
+
+static struct GNUNET_CRYPTO_EcdsaPrivateKey key;
+
+
+static int
+testSignVerify (void)
+{
+  struct GNUNET_CRYPTO_EcdsaSignature sig;
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_ecdsa_key_get_public (&key,
+                                      &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_ecdsa_sign_ (&key,
+                                   &purp,
+                                   &sig))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_ecdsa_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                     &purp,
+                                     &sig,
+                                     &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_ecdsa_verify failed!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR !=
+        GNUNET_CRYPTO_ecdsa_verify_ (
+          GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+          &purp,
+          &sig,
+          &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  printf ("%d ECDSA sign/verify operations %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+static int
+testDeriveSignVerify (void)
+{
+  struct GNUNET_CRYPTO_EcdsaSignature sig;
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey *dpriv;
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_CRYPTO_EcdsaPublicKey dpub;
+  struct GNUNET_CRYPTO_EcdsaPublicKey dpub2;
+
+  dpriv = GNUNET_CRYPTO_ecdsa_private_key_derive (&key,
+                                                  "test-derive",
+                                                  "test-CTX");
+  GNUNET_CRYPTO_ecdsa_key_get_public (&key,
+                                      &pkey);
+  GNUNET_CRYPTO_ecdsa_public_key_derive (&pkey,
+                                         "test-derive",
+                                         "test-CTX",
+                                         &dpub);
+  GNUNET_CRYPTO_ecdsa_key_get_public (dpriv, &dpub2);
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  if (0 != GNUNET_memcmp (&dpub.q_y, &dpub2.q_y))
+  {
+    fprintf (stderr, "%s", "key derivation failed\n");
+    GNUNET_free (dpriv);
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_ecdsa_sign_ (dpriv,
+                                 &purp,
+                                 &sig))
+  {
+    fprintf (stderr, "%s", "GNUNET_CRYPTO_ecdsa_sign returned SYSERR\n");
+    GNUNET_free (dpriv);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                   &purp,
+                                   &sig,
+                                   &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed!\n");
+    GNUNET_free (dpriv);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                   &purp,
+                                   &sig,
+                                   &pkey))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+    GNUNET_free (dpriv);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+                                   &purp,
+                                   &sig,
+                                   &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+    GNUNET_free (dpriv);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (dpriv);
+  return GNUNET_OK;
+}
+
+
+#if PERF
+static int
+testSignPerformance (void)
+{
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EcdsaSignature sig;
+  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  int i;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_ecdsa_key_get_public (key, &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  for (i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", "."); fflush (stderr);
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdsa_sign_ (key, &purp, &sig))
+    {
+      fprintf (stderr, "%s",
+               "GNUNET_CRYPTO_ecdsa_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  printf ("%d ECC sign operations %s\n", ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+#endif
+
+
+static void
+perf_keygen (void)
+{
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
+
+  fprintf (stderr, "%s", "W");
+  start = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < 10; i++)
+  {
+    fprintf (stderr, ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_ecdsa_key_create (&pk);
+  }
+  fflush (stderr);
+  printf ("10 ECDSA keys created in %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failure_count = 0;
+
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             "libgcrypt has not the expected version (version %s is required).\n",
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-ecc", "WARNING", NULL);
+  GNUNET_CRYPTO_ecdsa_key_create (&key);
+  if (GNUNET_OK != testDeriveSignVerify ())
+  {
+    failure_count++;
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n", failure_count);
+    return -1;
+  }
+#if PERF
+  if (GNUNET_OK != testSignPerformance ())
+    failure_count++;
+#endif
+  if (GNUNET_OK != testSignVerify ())
+    failure_count++;
+  perf_keygen ();
+
+  if (0 != failure_count)
+  {
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n",
+             failure_count);
+    return -1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_ecdsa.c */
diff --git a/src/lib/util/test_crypto_eddsa.c b/src/lib/util/test_crypto_eddsa.c
new file mode 100644
index 000000000..820230fd2
--- /dev/null
+++ b/src/lib/util/test_crypto_eddsa.c
@@ -0,0 +1,319 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_eddsa.c
+ * @brief testcase for ECC public key crypto
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_signatures.h"
+#include <gcrypt.h>
+
+#define ITER 25
+
+#define KEYFILE "/tmp/test-gnunet-crypto-eddsa.key"
+
+#define PERF GNUNET_YES
+
+
+static struct GNUNET_CRYPTO_EddsaPrivateKey key;
+
+
+static int
+testSignVerify (void)
+{
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EddsaPublicKey pkey;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", "."); fflush (stderr);
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_sign_ (&key,
+                                                    &purp,
+                                                    &sig))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                     &purp,
+                                     &sig,
+                                     &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_verify failed!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR !=
+        GNUNET_CRYPTO_eddsa_verify_ (
+          GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+          &purp,
+          &sig,
+          &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_verify failed to fail!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  fprintf (stderr, "\n");
+  printf ("%d EdDSA sign/verify operations %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+static int
+testDeriveSignVerify (void)
+{
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EddsaPrivateScalar dpriv;
+  struct GNUNET_CRYPTO_EddsaPublicKey pkey;
+  struct GNUNET_CRYPTO_EddsaPublicKey dpub;
+  struct GNUNET_CRYPTO_EddsaPublicKey dpub2;
+
+  GNUNET_CRYPTO_eddsa_private_key_derive (&key,
+                                          "test-derive",
+                                          "test-CTX",
+                                          &dpriv);
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &pkey);
+  GNUNET_CRYPTO_eddsa_public_key_derive (&pkey,
+                                         "test-derive",
+                                         "test-CTX",
+                                         &dpub);
+  GNUNET_CRYPTO_eddsa_key_get_public_from_scalar (&dpriv, &dpub2);
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  if (0 != GNUNET_memcmp (&dpub.q_y, &dpub2.q_y))
+  {
+    fprintf (stderr, "%s", "key derivation failed\n");
+    return GNUNET_SYSERR;
+  }
+
+  GNUNET_CRYPTO_eddsa_sign_derived (&key,
+                                    "test-derive",
+                                    "test-CTX",
+                                    &purp,
+                                    &sig);
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                   &purp,
+                                   &sig,
+                                   &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_eddsa_verify failed!\n");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                   &purp,
+                                   &sig,
+                                   &pkey))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_eddsa_verify failed to fail!\n");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+                                   &purp,
+                                   &sig,
+                                   &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_eddsa_verify failed to fail!\n");
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+#if PERF
+static int
+testSignPerformance ()
+{
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_CRYPTO_EddsaPublicKey pkey;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_eddsa_sign_ (&key,
+                                   &purp,
+                                   &sig))
+    {
+      fprintf (stderr, "%s", "GNUNET_CRYPTO_eddsa_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  fprintf (stderr, "\n");
+  printf ("%d EdDSA sign operations %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+#endif
+
+
+static int
+testCreateFromFile (void)
+{
+  struct GNUNET_CRYPTO_EddsaPublicKey p1;
+  struct GNUNET_CRYPTO_EddsaPublicKey p2;
+
+  /* do_create == GNUNET_YES and non-existing file MUST return GNUNET_YES */
+  GNUNET_assert (0 == unlink (KEYFILE) || ENOENT == errno);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_YES,
+                                                    &key));
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &p1);
+
+  /* do_create == GNUNET_YES and _existing_ file MUST return GNUNET_NO */
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_YES,
+                                                    &key));
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &p2);
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (&p1,
+                                &p2));
+
+  /* do_create == GNUNET_NO and non-existing file MUST return GNUNET_SYSERR */
+  GNUNET_assert (0 == unlink (KEYFILE));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_NO,
+                                                    &key));
+  return GNUNET_OK;
+}
+
+
+static void
+perf_keygen (void)
+{
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
+
+  fprintf (stderr, "%s", "W");
+  start = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < 10; i++)
+  {
+    fprintf (stderr, ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_eddsa_key_create (&pk);
+  }
+  fprintf (stderr, "\n");
+  printf ("10 EdDSA keys created in %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start), GNUNET_YES));
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failure_count = 0;
+
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             "libgcrypt has not the expected version (version %s is required).\n",
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-eddsa",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_eddsa_key_create (&key);
+  if (GNUNET_OK != testDeriveSignVerify ())
+  {
+    failure_count++;
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n", failure_count);
+    return -1;
+  }
+#if PERF
+  if (GNUNET_OK != testSignPerformance ())
+    failure_count++;
+#endif
+  if (GNUNET_OK != testSignVerify ())
+    failure_count++;
+  if (GNUNET_OK != testCreateFromFile ())
+    failure_count++;
+  perf_keygen ();
+
+  if (0 != failure_count)
+  {
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n",
+             failure_count);
+    return -1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_eddsa.c */
diff --git a/src/lib/util/test_crypto_edx25519.c b/src/lib/util/test_crypto_edx25519.c
new file mode 100644
index 000000000..85e235546
--- /dev/null
+++ b/src/lib/util/test_crypto_edx25519.c
@@ -0,0 +1,327 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_edx25519.c
+ * @brief testcase for ECC public key crypto for edx25519
+ * @author Özgür Kesim
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_signatures.h"
+#include <gcrypt.h>
+
+#define ITER 25
+
+#define KEYFILE "/tmp/test-gnunet-crypto-edx25519.key"
+
+#define PERF GNUNET_YES
+
+
+static struct GNUNET_CRYPTO_Edx25519PrivateKey key;
+
+
+static int
+testSignVerify (void)
+{
+  struct GNUNET_CRYPTO_Edx25519Signature sig;
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_Edx25519PublicKey pkey;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_edx25519_key_get_public (&key,
+                                         &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", "."); fflush (stderr);
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_edx25519_sign_ (&key,
+                                                       &purp,
+                                                       &sig))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_edx25519_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_edx25519_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                        &purp,
+                                        &sig,
+                                        &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_edx25519_verify failed!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+    if (GNUNET_SYSERR !=
+        GNUNET_CRYPTO_edx25519_verify_ (
+          GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+          &purp,
+          &sig,
+          &pkey))
+    {
+      fprintf (stderr,
+               "GNUNET_CRYPTO_edx25519_verify failed to fail!\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  fprintf (stderr, "\n");
+  printf ("%d EdDSA sign/verify operations %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+static int
+testDeriveSignVerify (void)
+{
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_Edx25519Signature sig;
+  struct GNUNET_CRYPTO_Edx25519PrivateKey dkey;
+  struct GNUNET_CRYPTO_Edx25519PublicKey pub;
+  struct GNUNET_CRYPTO_Edx25519PublicKey dpub;
+  struct GNUNET_CRYPTO_Edx25519PublicKey dpub2;
+
+  GNUNET_CRYPTO_edx25519_key_get_public (&key, &pub);
+  GNUNET_CRYPTO_edx25519_private_key_derive (&key,
+                                             "test-derive",
+                                             sizeof("test-derive"),
+                                             &dkey);
+  GNUNET_CRYPTO_edx25519_public_key_derive (&pub,
+                                            "test-derive",
+                                            sizeof("test-derive"),
+                                            &dpub);
+  GNUNET_CRYPTO_edx25519_key_get_public (&dkey, &dpub2);
+
+  if (0 != GNUNET_memcmp (&dpub.q_y, &dpub2.q_y))
+  {
+    fprintf (stderr, "key deriviation failed\n");
+    return GNUNET_SYSERR;
+  }
+
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+
+  GNUNET_CRYPTO_edx25519_sign_ (&dkey,
+                                &purp,
+                                &sig);
+
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_edx25519_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                      &purp,
+                                      &sig,
+                                      &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_edx25519_verify failed after derivation!\n");
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_edx25519_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                      &purp,
+                                      &sig,
+                                      &pub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_edx25519_verify failed to fail after derivation!\n");
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_SYSERR !=
+      GNUNET_CRYPTO_edx25519_verify_ (
+        GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
+        &purp,
+        &sig,
+        &dpub))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_edx25519_verify failed to fail after derivation!\n");
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+#if PERF
+static int
+testSignPerformance ()
+{
+  struct GNUNET_CRYPTO_EccSignaturePurpose purp;
+  struct GNUNET_CRYPTO_Edx25519Signature sig;
+  struct GNUNET_CRYPTO_Edx25519PublicKey pkey;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
+  purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
+  fprintf (stderr, "%s", "W");
+  GNUNET_CRYPTO_edx25519_key_get_public (&key,
+                                         &pkey);
+  start = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_edx25519_sign_ (&key,
+                                      &purp,
+                                      &sig))
+    {
+      fprintf (stderr, "%s", "GNUNET_CRYPTO_edx25519_sign returned SYSERR\n");
+      ok = GNUNET_SYSERR;
+      continue;
+    }
+  }
+  fprintf (stderr, "\n");
+  printf ("%d EdDSA sign operations %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+#endif
+
+
+#if 0 /* not implemented */
+static int
+testCreateFromFile (void)
+{
+  struct GNUNET_CRYPTO_Edx25519PublicKey p1;
+  struct GNUNET_CRYPTO_Edx25519PublicKey p2;
+
+  /* do_create == GNUNET_YES and non-existing file MUST return GNUNET_YES */
+  GNUNET_assert (0 == unlink (KEYFILE) || ENOENT == errno);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_edx25519_key_from_file (KEYFILE,
+                                                       GNUNET_YES,
+                                                       &key));
+  GNUNET_CRYPTO_edx25519_key_get_public (&key,
+                                         &p1);
+
+  /* do_create == GNUNET_YES and _existing_ file MUST return GNUNET_NO */
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_CRYPTO_edx25519_key_from_file (KEYFILE,
+                                                       GNUNET_YES,
+                                                       &key));
+  GNUNET_CRYPTO_edx25519_key_get_public (&key,
+                                         &p2);
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (&p1,
+                                &p2));
+
+  /* do_create == GNUNET_NO and non-existing file MUST return GNUNET_SYSERR */
+  GNUNET_assert (0 == unlink (KEYFILE));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_CRYPTO_edx25519_key_from_file (KEYFILE,
+                                                       GNUNET_NO,
+                                                       &key));
+  return GNUNET_OK;
+}
+
+
+#endif
+
+
+static void
+perf_keygen (void)
+{
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_CRYPTO_Edx25519PrivateKey pk;
+
+  fprintf (stderr, "%s", "W");
+  start = GNUNET_TIME_absolute_get ();
+  for (unsigned int i = 0; i < 10; i++)
+  {
+    fprintf (stderr, ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_edx25519_key_create (&pk);
+  }
+  fprintf (stderr, "\n");
+  printf ("10 EdDSA keys created in %s\n",
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start), GNUNET_YES));
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failure_count = 0;
+
+  if (! gcry_check_version ("1.6.0"))
+  {
+    fprintf (stderr,
+             "libgcrypt has not the expected version (version %s is required).\n",
+             "1.6.0");
+    return 0;
+  }
+  if (getenv ("GNUNET_GCRYPT_DEBUG"))
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  GNUNET_log_setup ("test-crypto-edx25519",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_edx25519_key_create (&key);
+  if (GNUNET_OK != testDeriveSignVerify ())
+  {
+    failure_count++;
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n", failure_count);
+    return -1;
+  }
+#if PERF
+  if (GNUNET_OK != testSignPerformance ())
+    failure_count++;
+#endif
+  if (GNUNET_OK != testSignVerify ())
+    failure_count++;
+#if 0 /* not implemented */
+  if (GNUNET_OK != testCreateFromFile ())
+    failure_count++;
+#endif
+  perf_keygen ();
+
+  if (0 != failure_count)
+  {
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n",
+             failure_count);
+    return -1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_edx25519.c */
diff --git a/src/lib/util/test_crypto_elligator.c b/src/lib/util/test_crypto_elligator.c
new file mode 100644
index 000000000..2e178b7b1
--- /dev/null
+++ b/src/lib/util/test_crypto_elligator.c
@@ -0,0 +1,302 @@
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+#include <stdio.h>
+#include <sodium.h>
+
+#define ITER 25
+
+
+// Test vector from https://github.com/Kleshni/Elligator-2/blob/master/test-vectors.c
+// Using Decoding as a wrapper around direct_map
+static int
+testDirectMap (void)
+{
+  int ok = GNUNET_OK;
+
+  uint8_t repr1[32] = {
+    0x95, 0xa1, 0x60, 0x19, 0x04, 0x1d, 0xbe, 0xfe,
+    0xd9, 0x83, 0x20, 0x48, 0xed, 0xe1, 0x19, 0x28,
+    0xd9, 0x03, 0x65, 0xf2, 0x4a, 0x38, 0xaa, 0x7a,
+    0xef, 0x1b, 0x97, 0xe2, 0x39, 0x54, 0x10, 0x1b
+  };
+
+  uint8_t point1[32] = {
+    0x79, 0x4f, 0x05, 0xba, 0x3e, 0x3a, 0x72, 0x95,
+    0x80, 0x22, 0x46, 0x8c, 0x88, 0x98, 0x1e, 0x0b,
+    0xe5, 0x78, 0x2b, 0xe1, 0xe1, 0x14, 0x5c, 0xe2,
+    0xc3, 0xc6, 0xfd, 0xe1, 0x6d, 0xed, 0x53, 0x63
+  };
+
+  struct GNUNET_CRYPTO_EcdhePublicKey pointResult = {0};
+  struct GNUNET_CRYPTO_ElligatorRepresentative representative = {0};
+  memcpy (&representative.r, &repr1, sizeof(repr1));
+
+  bool highYResult;
+
+  GNUNET_CRYPTO_ecdhe_elligator_decoding (
+    &pointResult,
+    &highYResult,
+    &representative);
+
+  if (memcmp (point1, pointResult.q_y, sizeof(point1)) != 0)
+  {
+    ok = GNUNET_SYSERR;
+  }
+
+  return ok;
+}
+
+
+// Test vector from https://github.com/Kleshni/Elligator-2/blob/master/test-vectors.c
+static int
+testInverseMap (void)
+{
+  int ok = GNUNET_OK;
+  uint8_t point1[32] = {
+    0x33, 0x95, 0x19, 0x64, 0x00, 0x3c, 0x94, 0x08,
+    0x78, 0x06, 0x3c, 0xcf, 0xd0, 0x34, 0x8a, 0xf4,
+    0x21, 0x50, 0xca, 0x16, 0xd2, 0x64, 0x6f, 0x2c,
+    0x58, 0x56, 0xe8, 0x33, 0x83, 0x77, 0xd8, 0x00
+  };
+
+  uint8_t repr1[32] = {
+    0x99, 0x9b, 0x59, 0x1b, 0x66, 0x97, 0xd0, 0x74,
+    0xf2, 0x66, 0x19, 0x22, 0x77, 0xd5, 0x54, 0xde,
+    0xc3, 0xc2, 0x4c, 0x2e, 0xf6, 0x10, 0x81, 0x01,
+    0xf6, 0x3d, 0x94, 0xf7, 0xff, 0xf3, 0xa0, 0x13
+  };
+
+  // uint8_t reprResult1[32];
+  struct GNUNET_CRYPTO_ElligatorRepresentative r = {0};
+  struct GNUNET_CRYPTO_EcdhePublicKey pub = {0};
+  memcpy (&pub.q_y,&point1,sizeof(point1));
+  bool yHigh1 = false;
+
+  bool success = GNUNET_CRYPTO_ecdhe_elligator_encoding (&r,
+                                                         &pub,
+                                                         yHigh1);
+  if (success == false)
+  {
+    ok = GNUNET_SYSERR;
+  }
+  if (memcmp (&repr1,&r.r,sizeof(repr1)) != 0)
+  {
+    ok = GNUNET_SYSERR;
+  }
+
+  return ok;
+}
+
+
+/*
+* Test description: GNUNET_CRYPTO_ecdhe_elligator_generate_public_key() projects a point from the prime subgroup to the whole curve.
+* Both, the original point and the projectes point, should result in the same point when multiplied with a clamped scalar.
+*/
+static int
+testGeneratePkScalarMult (void)
+{
+  struct GNUNET_CRYPTO_EcdhePrivateKey pk;
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
+                              &pk,
+                              sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+
+  struct GNUNET_CRYPTO_EcdhePublicKey pubWholeCurve = {0};
+  unsigned char pubPrimeCurve[crypto_scalarmult_SCALARBYTES];
+
+  if (GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (&pubWholeCurve,
+                                                         &pk) == -1)
+  {
+    return GNUNET_SYSERR;
+  }
+  crypto_scalarmult_base (pubPrimeCurve, pk.d);
+
+  struct GNUNET_CRYPTO_EcdsaPrivateKey clampedPk;
+  GNUNET_CRYPTO_ecdsa_key_create (&clampedPk);
+  crypto_scalarmult_base (pubWholeCurve.q_y, clampedPk.d);
+  crypto_scalarmult_base (pubPrimeCurve, clampedPk.d);
+  if (memcmp (pubWholeCurve.q_y, pubPrimeCurve, sizeof(pubWholeCurve)) != 0)
+  {
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/*
+* Test Description: After generating a valid private key and the corresponding representative with
+* GNUNET_CRYPTO_ecdhe_elligator_key_create(), check if using the direct map results in the corresponding public key.
+*/
+static int
+testInverseDirect (void)
+{
+  struct GNUNET_CRYPTO_ElligatorRepresentative repr;
+  struct GNUNET_CRYPTO_EcdhePublicKey point;
+  struct GNUNET_CRYPTO_EcdhePrivateKey pk;
+  GNUNET_CRYPTO_ecdhe_elligator_key_create (&repr, &pk);
+
+  struct GNUNET_CRYPTO_EcdhePublicKey pub = {0};
+  if (GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (&pub, &pk) == -1)
+  {
+    return GNUNET_SYSERR;
+  }
+
+  GNUNET_CRYPTO_ecdhe_elligator_decoding (&point, NULL, &repr);
+
+  if (memcmp (pub.q_y, point.q_y, sizeof(point.q_y)) != 0)
+  {
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
+
+
+/*
+* Test Description: Measuring the time it takes to generate 25 key pairs (pk, representative).
+* Time value can vary because GNUNET_CRYPTO_ecdhe_elligator_key_create generates internally random
+* public keys which are just valid 50% of the time for elligators inverse map.
+* GNUNET_CRYPTO_ecdhe_elligator_key_create will therefore generate as many public keys needed
+* till a valid public key is generated.
+*/
+static int
+testTimeKeyGenerate (void)
+{
+  struct GNUNET_CRYPTO_ElligatorRepresentative repr;
+  struct GNUNET_CRYPTO_EcdhePrivateKey pk;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  fprintf (stderr, "%s", "W");
+  start = GNUNET_TIME_absolute_get ();
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_ecdhe_elligator_key_create (&repr, &pk);
+  }
+  printf ("%d encoded public keys generated in %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+static int
+testTimeDecoding (void)
+{
+  struct GNUNET_CRYPTO_EcdhePublicKey point;
+  struct GNUNET_CRYPTO_ElligatorRepresentative repr[ITER];
+  struct GNUNET_CRYPTO_EcdhePrivateKey pk;
+  struct GNUNET_TIME_Absolute start;
+  int ok = GNUNET_OK;
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    GNUNET_CRYPTO_ecdhe_elligator_key_create (&repr[i], &pk);
+  }
+
+  fprintf (stderr, "%s", "W");
+  start = GNUNET_TIME_absolute_get ();
+
+  for (unsigned int i = 0; i < ITER; i++)
+  {
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_ecdhe_elligator_decoding (&point, NULL, &repr[i]);
+
+  }
+
+  printf ("%d decoded public keys generated in %s\n",
+          ITER,
+          GNUNET_STRINGS_relative_time_to_string (
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
+  return ok;
+}
+
+
+static int
+elligatorKEM ()
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk_receiver;
+  struct GNUNET_CRYPTO_EddsaPublicKey pub_receiver;
+  GNUNET_CRYPTO_eddsa_key_create (&pk_receiver);
+  GNUNET_CRYPTO_eddsa_key_get_public (&pk_receiver, &pub_receiver);
+
+  struct GNUNET_CRYPTO_ElligatorRepresentative r_sender;
+
+  // Sender side
+  struct GNUNET_HashCode key_material_encaps;
+  GNUNET_CRYPTO_eddsa_elligator_kem_encaps (&pub_receiver, &r_sender,
+                                            &key_material_encaps);
+
+  // Receiving side
+  struct GNUNET_HashCode key_material_decaps;
+  GNUNET_CRYPTO_eddsa_elligator_kem_decaps (&pk_receiver, &r_sender,
+                                            &key_material_decaps);
+
+  if (memcmp (&(key_material_encaps.bits),&(key_material_decaps.bits),
+              sizeof(key_material_encaps.bits)) != 0)
+  {
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+
+  int failure_count = 0;
+
+  if (GNUNET_OK != testInverseMap ())
+  {
+    printf ("inverse failed!");
+    failure_count++;
+  }
+  if (GNUNET_OK != testDirectMap ())
+  {
+    printf ("direct failed!");
+    failure_count++;
+  }
+  if (GNUNET_OK != testGeneratePkScalarMult ())
+  {
+    printf ("generate PK failed!");
+    failure_count++;
+  }
+  if (GNUNET_OK != testInverseDirect ())
+  {
+    printf ("Inverse and direct map failed!");
+    failure_count++;
+  }
+  if (GNUNET_OK != testTimeKeyGenerate ())
+  {
+    printf ("Time measurement of key generation failed!");
+    failure_count++;
+  }
+  if (GNUNET_OK != testTimeDecoding ())
+  {
+    printf ("Time measurement of decoding failed!");
+    failure_count++;
+  }
+
+  if (GNUNET_OK != elligatorKEM ())
+  {
+    printf ("Elligator KEM failed!");
+    failure_count++;
+  }
+
+  if (0 != failure_count)
+  {
+    fprintf (stderr,
+             "\n\n%d TESTS FAILED!\n\n",
+             failure_count);
+    return -1;
+  }
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_hash.c b/src/lib/util/test_crypto_hash.c
new file mode 100644
index 000000000..337694a89
--- /dev/null
+++ b/src/lib/util/test_crypto_hash.c
@@ -0,0 +1,218 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002, 2003, 2004, 2006, 2009, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file util/test_crypto_hash.c
+ * @brief Test for crypto_hash.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static char block[65536];
+
+#define FILENAME "testblock.dat"
+
+static int
+test (int number)
+{
+  struct GNUNET_HashCode h1;
+  struct GNUNET_HashCode h2;
+  struct GNUNET_CRYPTO_HashAsciiEncoded enc;
+
+  memset (&h1,
+          number,
+          sizeof(struct GNUNET_HashCode));
+  GNUNET_CRYPTO_hash_to_enc (&h1,
+                             &enc);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_hash_from_string ((char *) &enc,
+                                      &h2))
+  {
+    printf ("enc2hash failed!\n");
+    return 1;
+  }
+  if (0 != GNUNET_memcmp (&h1,
+                          &h2))
+    return 1;
+  return 0;
+}
+
+
+static int
+test_encoding (void)
+{
+  for (int i = 0; i < 255; i++)
+    if (0 != test (i))
+      return 1;
+  return 0;
+}
+
+
+static int
+test_arithmetic (void)
+{
+  struct GNUNET_HashCode h1;
+  struct GNUNET_HashCode h2;
+  struct GNUNET_HashCode d;
+  struct GNUNET_HashCode s;
+  struct GNUNET_CRYPTO_SymmetricSessionKey skey;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                    &h1);
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                    &h2);
+  if (GNUNET_CRYPTO_hash_distance_u32 (&h1,
+                                       &h2) !=
+      GNUNET_CRYPTO_hash_distance_u32 (&h2,
+                                       &h1))
+    return 1;
+  GNUNET_CRYPTO_hash_difference (&h1,
+                                 &h2,
+                                 &d);
+  GNUNET_CRYPTO_hash_sum (&h1,
+                          &d,
+                          &s);
+  if (0 !=
+      GNUNET_CRYPTO_hash_cmp (&s,
+                              &h2))
+    return 1;
+  GNUNET_CRYPTO_hash_xor (&h1,
+                          &h2,
+                          &d);
+  GNUNET_CRYPTO_hash_xor (&h1,
+                          &d,
+                          &s);
+  if (0 !=
+      GNUNET_CRYPTO_hash_cmp (&s,
+                              &h2))
+    return 1;
+  if (0 !=
+      GNUNET_CRYPTO_hash_xorcmp (&s,
+                                 &h2,
+                                 &h1))
+    return 1;
+  if (-1 !=
+      GNUNET_CRYPTO_hash_xorcmp (&h1,
+                                 &h2,
+                                 &h1))
+    return 1;
+  if (1 !=
+      GNUNET_CRYPTO_hash_xorcmp (&h1,
+                                 &h2,
+                                 &h2))
+    return 1;
+  memset (&d,
+          0,
+          sizeof(d));
+  GNUNET_CRYPTO_hash_to_aes_key (&d,
+                                 &skey,
+                                 &iv);
+  memset (&h1,
+          0,
+          sizeof (h1));
+  h1.bits[1] = htonl (0x00200000); /* 32 + 8 + 2 = 42 MSB bits cleared */
+  GNUNET_assert (42 ==
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&h1));
+  GNUNET_assert (512 - 42 - 1 ==
+                 GNUNET_CRYPTO_hash_count_tailing_zeros (&h1));
+  return 0;
+}
+
+
+static void
+finished_task (void *cls,
+               const struct GNUNET_HashCode *res)
+{
+  int *ret = cls;
+  struct GNUNET_HashCode want;
+
+  GNUNET_CRYPTO_hash (block,
+                      sizeof(block),
+                      &want);
+  if (0 != GNUNET_memcmp (res,
+                          &want))
+    *ret = 2;
+  else
+    *ret = 0;
+}
+
+
+static void
+file_hasher (void *cls)
+{
+  GNUNET_assert (NULL !=
+                 GNUNET_CRYPTO_hash_file (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                          FILENAME,
+                                          1024,
+                                          &finished_task,
+                                          cls));
+}
+
+
+static int
+test_file_hash (void)
+{
+  int ret;
+  FILE *f;
+
+  memset (block,
+          42,
+          sizeof(block) / 2);
+  memset (&block[sizeof(block) / 2],
+          43,
+          sizeof(block) / 2);
+  GNUNET_assert (NULL != (f = fopen (FILENAME, "w+")));
+  GNUNET_break (sizeof(block) ==
+                fwrite (block,
+                        1,
+                        sizeof(block),
+                        f));
+  GNUNET_break (0 == fclose (f));
+  ret = 1;
+  GNUNET_SCHEDULER_run (&file_hasher,
+                        &ret);
+  GNUNET_break (0 == unlink (FILENAME));
+  return ret;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int failureCount = 0;
+
+  GNUNET_log_setup ("test-crypto-hash",
+                    "WARNING",
+                    NULL);
+  for (int i = 0; i < 10; i++)
+    failureCount += test_encoding ();
+  failureCount += test_arithmetic ();
+  failureCount += test_file_hash ();
+  if (0 != failureCount)
+    return 1;
+  return 0;
+}
+
+
+/* end of test_crypto_hash.c */
diff --git a/src/lib/util/test_crypto_hash_context.c b/src/lib/util/test_crypto_hash_context.c
new file mode 100644
index 000000000..08b63800f
--- /dev/null
+++ b/src/lib/util/test_crypto_hash_context.c
@@ -0,0 +1,50 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_crypto_hash_context.c
+ * @brief test case for incremental hashing
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define LEN 1234
+
+int
+main ()
+{
+  char data[1234];
+  struct GNUNET_HashCode hc1;
+  struct GNUNET_HashCode hc2;
+  struct GNUNET_HashContext *hctx;
+
+  memset (data, 42, LEN);
+
+  hctx = GNUNET_CRYPTO_hash_context_start ();
+  GNUNET_CRYPTO_hash_context_read (hctx, data, LEN);
+  GNUNET_CRYPTO_hash_context_finish (hctx, &hc1);
+
+  GNUNET_CRYPTO_hash (data, LEN, &hc2);
+
+  if (0 == memcmp (&hc1, &hc2, sizeof(struct GNUNET_HashCode)))
+    return 0;
+  return 1;
+}
diff --git a/src/lib/util/test_crypto_hkdf.c b/src/lib/util/test_crypto_hkdf.c
new file mode 100644
index 000000000..a9a4db7a0
--- /dev/null
+++ b/src/lib/util/test_crypto_hkdf.c
@@ -0,0 +1,339 @@
+/*
+    Copyright (c) 2010 Nils Durner
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+ */
+
+/**
+ * @file src/util/test_crypt_hkdf.c
+ * @brief Testcases for HKDF
+ * @todo: test for out_len < hash_len
+ * @author Nils Durner
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+
+
+#include "gnunet_util_lib.h"
+
+void
+tc1 ()
+{
+  unsigned char ikm[22] =
+  { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+    0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b };
+  unsigned char salt[13] =
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+    0x0a, 0x0b, 0x0c };
+  unsigned char info[10] =
+  { 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9 };
+  unsigned char okm[42] =
+  { 0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a, 0x90, 0x43,
+    0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a, 0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a,
+    0x5a, 0x4c, 0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf, 0x34, 0x00,
+    0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18, 0x58, 0x65 };
+  unsigned char result[44];
+  int l = 42;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA256, GCRY_MD_SHA256, salt,
+                   sizeof(salt), ikm, sizeof(ikm), info, sizeof(info),
+                   NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc2 ()
+{
+  unsigned char ikm[80] =
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+    0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
+    0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21,
+    0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
+    0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+    0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45,
+    0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f };
+  unsigned char salt[80] =
+  { 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+    0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+    0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81,
+    0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d,
+    0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99,
+    0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5,
+    0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf };
+  unsigned char info[80] =
+  { 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9,
+    0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5,
+    0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1,
+    0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd,
+    0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9,
+    0xea, 0xeb, 0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5,
+    0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff };
+  unsigned char okm[82] =
+  { 0xb1, 0x1e, 0x39, 0x8d, 0xc8, 0x03, 0x27, 0xa1, 0xc8, 0xe7,
+    0xf7, 0x8c, 0x59, 0x6a, 0x49, 0x34, 0x4f, 0x01, 0x2e, 0xda, 0x2d, 0x4e,
+    0xfa, 0xd8, 0xa0, 0x50, 0xcc, 0x4c, 0x19, 0xaf, 0xa9, 0x7c, 0x59, 0x04,
+    0x5a, 0x99, 0xca, 0xc7, 0x82, 0x72, 0x71, 0xcb, 0x41, 0xc6, 0x5e, 0x59,
+    0x0e, 0x09, 0xda, 0x32, 0x75, 0x60, 0x0c, 0x2f, 0x09, 0xb8, 0x36, 0x77,
+    0x93, 0xa9, 0xac, 0xa3, 0xdb, 0x71, 0xcc, 0x30, 0xc5, 0x81, 0x79, 0xec,
+    0x3e, 0x87, 0xc1, 0x4c, 0x01, 0xd5, 0xc1, 0xf3, 0x43, 0x4f, 0x1d, 0x87 };
+  char result[84];
+  int l = 82;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA256, GCRY_MD_SHA256, salt,
+                   sizeof(salt), ikm, sizeof(ikm), info, sizeof(info),
+                   NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc3 ()
+{
+  unsigned char ikm[22] =
+  { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+    0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b };
+  unsigned char okm[42] =
+  { 0x8d, 0xa4, 0xe7, 0x75, 0xa5, 0x63, 0xc1, 0x8f, 0x71, 0x5f,
+    0x80, 0x2a, 0x06, 0x3c, 0x5a, 0x31, 0xb8, 0xa1, 0x1f, 0x5c, 0x5e, 0xe1,
+    0x87, 0x9e, 0xc3, 0x45, 0x4e, 0x5f, 0x3c, 0x73, 0x8d, 0x2d, 0x9d, 0x20,
+    0x13, 0x95, 0xfa, 0xa4, 0xb6, 0x1a, 0x96, 0xc8 };
+  unsigned char result[44];
+  int l = 42;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA256, GCRY_MD_SHA256, NULL, 0, ikm,
+                   sizeof(ikm), NULL, 0, NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc4 ()
+{
+  unsigned char ikm[11] =
+  { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+    0x0b };
+  unsigned char salt[13] =
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+    0x0a, 0x0b, 0x0c };
+  unsigned char info[10] =
+  { 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9 };
+  unsigned char okm[42] =
+  { 0x08, 0x5a, 0x01, 0xea, 0x1b, 0x10, 0xf3, 0x69, 0x33, 0x06,
+    0x8b, 0x56, 0xef, 0xa5, 0xad, 0x81, 0xa4, 0xf1, 0x4b, 0x82, 0x2f, 0x5b,
+    0x09, 0x15, 0x68, 0xa9, 0xcd, 0xd4, 0xf1, 0x55, 0xfd, 0xa2, 0xc2, 0x2e,
+    0x42, 0x24, 0x78, 0xd3, 0x05, 0xf3, 0xf8, 0x96 };
+  char result[84];
+  int l = 42;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA1, GCRY_MD_SHA1, salt, sizeof(salt),
+                   ikm, sizeof(ikm), info, sizeof(info), NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc5 ()
+{
+  unsigned char ikm[80] =
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+    0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
+    0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21,
+    0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
+    0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+    0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45,
+    0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f };
+  unsigned char salt[80] =
+  { 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+    0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+    0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81,
+    0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d,
+    0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99,
+    0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5,
+    0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf };
+  unsigned char info[80] =
+  { 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9,
+    0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5,
+    0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1,
+    0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd,
+    0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9,
+    0xea, 0xeb, 0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5,
+    0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff };
+  unsigned char okm[82] =
+  { 0x0b, 0xd7, 0x70, 0xa7, 0x4d, 0x11, 0x60, 0xf7, 0xc9, 0xf1,
+    0x2c, 0xd5, 0x91, 0x2a, 0x06, 0xeb, 0xff, 0x6a, 0xdc, 0xae, 0x89, 0x9d,
+    0x92, 0x19, 0x1f, 0xe4, 0x30, 0x56, 0x73, 0xba, 0x2f, 0xfe, 0x8f, 0xa3,
+    0xf1, 0xa4, 0xe5, 0xad, 0x79, 0xf3, 0xf3, 0x34, 0xb3, 0xb2, 0x02, 0xb2,
+    0x17, 0x3c, 0x48, 0x6e, 0xa3, 0x7c, 0xe3, 0xd3, 0x97, 0xed, 0x03, 0x4c,
+    0x7f, 0x9d, 0xfe, 0xb1, 0x5c, 0x5e, 0x92, 0x73, 0x36, 0xd0, 0x44, 0x1f,
+    0x4c, 0x43, 0x00, 0xe2, 0xcf, 0xf0, 0xd0, 0x90, 0x0b, 0x52, 0xd3, 0xb4 };
+  char result[84];
+  int l = 82;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA1, GCRY_MD_SHA1, salt, sizeof(salt),
+                   ikm, sizeof(ikm), info, sizeof(info), NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc6 ()
+{
+  unsigned char ikm[22] =
+  { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+    0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b };
+  unsigned char okm[42] =
+  { 0x0a, 0xc1, 0xaf, 0x70, 0x02, 0xb3, 0xd7, 0x61, 0xd1, 0xe5,
+    0x52, 0x98, 0xda, 0x9d, 0x05, 0x06, 0xb9, 0xae, 0x52, 0x05, 0x72, 0x20,
+    0xa3, 0x06, 0xe0, 0x7b, 0x6b, 0x87, 0xe8, 0xdf, 0x21, 0xd0, 0xea, 0x00,
+    0x03, 0x3d, 0xe0, 0x39, 0x84, 0xd3, 0x49, 0x18 };
+  char result[44];
+  int l = 42;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA1, GCRY_MD_SHA1, NULL, 0, ikm,
+                   sizeof(ikm), NULL, 0, NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc7 ()
+{
+  unsigned char ikm[80] =
+  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+    0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
+    0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21,
+    0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
+    0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+    0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45,
+    0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f };
+  unsigned char salt[80] =
+  { 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+    0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75,
+    0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81,
+    0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d,
+    0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99,
+    0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5,
+    0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf };
+  unsigned char info1[34] = { 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+                              0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+                              0xc0, 0xc1, 0xc2, 0xc3,
+                              0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
+                              0xcc, 0xcd, 0xce, 0xcf,
+                              0xd0, 0xd1 };
+  unsigned char info2[46] = { 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9,
+                              0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1,
+                              0xe2, 0xe3, 0xe4, 0xe5,
+                              0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed,
+                              0xee, 0xef, 0xf0, 0xf1,
+                              0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9,
+                              0xfa, 0xfb, 0xfc, 0xfd,
+                              0xfe, 0xff };
+  unsigned char okm[82] =
+  { 0x0b, 0xd7, 0x70, 0xa7, 0x4d, 0x11, 0x60, 0xf7, 0xc9, 0xf1,
+    0x2c, 0xd5, 0x91, 0x2a, 0x06, 0xeb, 0xff, 0x6a, 0xdc, 0xae, 0x89, 0x9d,
+    0x92, 0x19, 0x1f, 0xe4, 0x30, 0x56, 0x73, 0xba, 0x2f, 0xfe, 0x8f, 0xa3,
+    0xf1, 0xa4, 0xe5, 0xad, 0x79, 0xf3, 0xf3, 0x34, 0xb3, 0xb2, 0x02, 0xb2,
+    0x17, 0x3c, 0x48, 0x6e, 0xa3, 0x7c, 0xe3, 0xd3, 0x97, 0xed, 0x03, 0x4c,
+    0x7f, 0x9d, 0xfe, 0xb1, 0x5c, 0x5e, 0x92, 0x73, 0x36, 0xd0, 0x44, 0x1f,
+    0x4c, 0x43, 0x00, 0xe2, 0xcf, 0xf0, 0xd0, 0x90, 0x0b, 0x52, 0xd3, 0xb4 };
+  char result[84];
+  int l = 82;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA1, GCRY_MD_SHA1, salt, sizeof(salt),
+                   ikm, sizeof(ikm), info1, sizeof(info1), info2,
+                   sizeof(info2), NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+void
+tc8 ()
+{
+  unsigned char ikm[32] =
+  { 0xbf, 0x16, 0x6e, 0x46, 0x3a, 0x6c, 0xf3, 0x93, 0xa7, 0x72,
+    0x11, 0xa1, 0xdc, 0x0b, 0x07, 0xdb, 0x1a, 0x5e, 0xd9, 0xb9, 0x81, 0xbe,
+    0xea, 0xe4, 0x31, 0x5f, 0x24, 0xff, 0xfe, 0x50, 0x8a, 0xde };
+  unsigned char salt[4] = { 0xfc, 0x62, 0x76, 0x35 };
+  unsigned char info[86] =
+  { 0x8c, 0x0d, 0xcf, 0xb3, 0x25, 0x6e, 0x88, 0x0d, 0xc1, 0x0b,
+    0x1d, 0x33, 0x15, 0x3e, 0x52, 0x0b, 0xb0, 0x77, 0xff, 0x7d, 0xc3, 0xc7,
+    0xef, 0xe5, 0x8e, 0x3c, 0xc4, 0x4e, 0x8b, 0x41, 0x46, 0x1f, 0x02, 0x94,
+    0x82, 0x35, 0xc5, 0xa6, 0x5e, 0x91, 0xd8, 0xa2, 0x90, 0xfd, 0x6f, 0xb4,
+    0x07, 0xc9, 0xed, 0x6b, 0x18, 0x90, 0x31, 0xab, 0x0f, 0xb5, 0x6b, 0xec,
+    0x9e, 0x45, 0xa2, 0x83, 0x65, 0x41, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61,
+    0x6c, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x76, 0x65, 0x63,
+    0x74, 0x6f, 0x72, 0x00 };
+  unsigned char okm[16] =
+  { 0xd6, 0x90, 0xec, 0x9e, 0x62, 0xdf, 0xb9, 0x41, 0xff, 0x92,
+    0x4f, 0xd2, 0xf6, 0x1d, 0x67, 0xe0 };
+  char result[18];
+  int l = 16;
+
+  memset (result, 0, sizeof(result));
+  GNUNET_assert (GNUNET_CRYPTO_hkdf
+                   (result, l, GCRY_MD_SHA512, GCRY_MD_SHA256, salt,
+                   sizeof(salt), ikm, sizeof(ikm), info, sizeof(info),
+                   NULL) == GNUNET_YES);
+  GNUNET_assert (memcmp (result, okm, l) == 0);
+  GNUNET_assert (memcmp (result + l, "\0", 2) == 0);
+}
+
+
+int
+main ()
+{
+  GNUNET_log_setup ("test-crypto-hkdf", "WARNING", NULL);
+
+  /* Official test vectors */
+  tc1 ();
+  tc2 ();
+  tc3 ();
+  tc4 ();
+  tc5 ();
+  tc6 ();
+
+  /* Additional tests */
+  tc7 ();
+  tc8 ();
+
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_kdf.c b/src/lib/util/test_crypto_kdf.c
new file mode 100644
index 000000000..81e4b4451
--- /dev/null
+++ b/src/lib/util/test_crypto_kdf.c
@@ -0,0 +1,72 @@
+/*
+    Copyright (c) 2010 Jeffrey Burdges
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.
+ */
+
+/**
+ * @file src/util/test_crypt_kdf.c
+ * @brief Testcases for KDF mod n
+ * @author Jeffrey Burdges <burdges@gnunet.org>
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+
+
+#include "gnunet_util_lib.h"
+
+
+int
+main ()
+{
+#define RND_BLK_SIZE 4096
+  unsigned char rnd_blk[RND_BLK_SIZE];
+  int i;
+  gcry_mpi_t r, n;
+
+  GNUNET_log_setup ("test-crypto-kdf", "WARNING", NULL);
+
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              rnd_blk,
+                              RND_BLK_SIZE);
+
+  /* test full domain hash size */
+  for (i = 0; i < 100; i++)
+  {
+    gcry_mpi_scan (&n,
+                   GCRYMPI_FMT_USG,
+                   rnd_blk, RND_BLK_SIZE,
+                   NULL);
+    GNUNET_CRYPTO_kdf_mod_mpi (&r, n,
+                               "", 0,
+                               "", 0,
+                               "");
+    GNUNET_assert (0 > gcry_mpi_cmp (r, n));
+
+    /* Is it worth checking that it's not too small? */
+    /* GNUNET_assert (gcry_mpi_get_nbits(r) > 3*RND_BLK_SIZE/4); */
+    /* This test necessarily randomly fails with probability 2^(3 - RND_BLK_SIZE/4) */
+
+    gcry_mpi_release (n);
+    gcry_mpi_release (r);
+  }
+
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_paillier.c b/src/lib/util/test_crypto_paillier.c
new file mode 100644
index 000000000..412ce5c23
--- /dev/null
+++ b/src/lib/util/test_crypto_paillier.c
@@ -0,0 +1,248 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @file util/test_crypto_paillier.c
+ * @brief testcase paillier crypto
+ * @author Christian Fuchs
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+
+static int
+test_crypto ()
+{
+  gcry_mpi_t plaintext;
+  gcry_mpi_t plaintext_result;
+  struct GNUNET_CRYPTO_PaillierCiphertext ciphertext;
+  struct GNUNET_CRYPTO_PaillierPublicKey public_key;
+  struct GNUNET_CRYPTO_PaillierPrivateKey private_key;
+  int ret = 0;
+
+  GNUNET_CRYPTO_paillier_create (&public_key,
+                                 &private_key);
+  GNUNET_assert (NULL != (plaintext = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (plaintext_result = gcry_mpi_new (0)));
+  gcry_mpi_randomize (plaintext,
+                      GNUNET_CRYPTO_PAILLIER_BITS / 2,
+                      GCRY_WEAK_RANDOM);
+
+  GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                  plaintext,
+                                  0 /* 0 hom ops */,
+                                  &ciphertext);
+  GNUNET_CRYPTO_paillier_decrypt (&private_key,
+                                  &public_key,
+                                  &ciphertext,
+                                  plaintext_result);
+  if (0 != gcry_mpi_cmp (plaintext,
+                         plaintext_result))
+  {
+    fprintf (stderr,
+             "Paillier decryption failed with plaintext of size %u\n",
+             gcry_mpi_get_nbits (plaintext));
+    gcry_log_debugmpi ("\n",
+                       plaintext);
+    gcry_log_debugmpi ("\n",
+                       plaintext_result);
+    ret = 1;
+  }
+  gcry_mpi_release (plaintext);
+  gcry_mpi_release (plaintext_result);
+  return ret;
+}
+
+
+static int
+test_hom_simple (unsigned int a,
+                 unsigned int b)
+{
+  gcry_mpi_t m1;
+  gcry_mpi_t m2;
+  gcry_mpi_t result;
+  gcry_mpi_t hom_result;
+  struct GNUNET_CRYPTO_PaillierCiphertext c1;
+  struct GNUNET_CRYPTO_PaillierCiphertext c2;
+  struct GNUNET_CRYPTO_PaillierCiphertext c_result;
+  struct GNUNET_CRYPTO_PaillierPublicKey public_key;
+  struct GNUNET_CRYPTO_PaillierPrivateKey private_key;
+  int ret = 0;
+
+  GNUNET_CRYPTO_paillier_create (&public_key,
+                                 &private_key);
+
+  GNUNET_assert (NULL != (m1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (m2 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (result = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (hom_result = gcry_mpi_new (0)));
+  m1 = gcry_mpi_set_ui (m1, a);
+  m2 = gcry_mpi_set_ui (m2, b);
+  gcry_mpi_add (result,
+                m1,
+                m2);
+  GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                  m1,
+                                  2,
+                                  &c1);
+  GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                  m2,
+                                  2,
+                                  &c2);
+  GNUNET_CRYPTO_paillier_hom_add (&public_key,
+                                  &c1,
+                                  &c2,
+                                  &c_result);
+  GNUNET_CRYPTO_paillier_decrypt (&private_key,
+                                  &public_key,
+                                  &c_result,
+                                  hom_result);
+  if (0 != gcry_mpi_cmp (result, hom_result))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_paillier failed simple math!\n");
+    gcry_log_debugmpi ("got ", hom_result);
+    gcry_log_debugmpi ("wanted ", result);
+    ret = 1;
+  }
+  gcry_mpi_release (m1);
+  gcry_mpi_release (m2);
+  gcry_mpi_release (result);
+  gcry_mpi_release (hom_result);
+  return ret;
+}
+
+
+static int
+test_hom ()
+{
+  int ret;
+  gcry_mpi_t m1;
+  gcry_mpi_t m2;
+  gcry_mpi_t result;
+  gcry_mpi_t hom_result;
+  struct GNUNET_CRYPTO_PaillierCiphertext c1;
+  struct GNUNET_CRYPTO_PaillierCiphertext c2;
+  struct GNUNET_CRYPTO_PaillierCiphertext c_result;
+  struct GNUNET_CRYPTO_PaillierPublicKey public_key;
+  struct GNUNET_CRYPTO_PaillierPrivateKey private_key;
+
+  GNUNET_CRYPTO_paillier_create (&public_key,
+                                 &private_key);
+
+  GNUNET_assert (NULL != (m1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (m2 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (result = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (hom_result = gcry_mpi_new (0)));
+  m1 = gcry_mpi_set_ui (m1, 1);
+  /* m1 = m1 * 2 ^ (GCPB - 3) */
+  gcry_mpi_mul_2exp (m1,
+                     m1,
+                     GNUNET_CRYPTO_PAILLIER_BITS - 3);
+  m2 = gcry_mpi_set_ui (m2, 15);
+  /* m1 = m1 * 2 ^ (GCPB / 2) */
+  gcry_mpi_mul_2exp (m2,
+                     m2,
+                     GNUNET_CRYPTO_PAILLIER_BITS / 2);
+  gcry_mpi_add (result,
+                m1,
+                m2);
+
+  if (1 != (ret = GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                                  m1,
+                                                  2,
+                                                  &c1)))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_paillier_encrypt 1 failed, should return 1 allowed operation, got %d!\n",
+             ret);
+    ret = 1;
+    goto out;
+  }
+  if (2 != (ret = GNUNET_CRYPTO_paillier_encrypt (&public_key,
+                                                  m2,
+                                                  2,
+                                                  &c2)))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_paillier_encrypt 2 failed, should return 2 allowed operation, got %d!\n",
+             ret);
+    ret = 1;
+    goto out;
+  }
+
+  if (0 != (ret = GNUNET_CRYPTO_paillier_hom_add (&public_key,
+                                                  &c1,
+                                                  &c2,
+                                                  &c_result)))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_paillier_hom_add failed, expected 0 remaining operations, got %d!\n",
+             ret);
+    ret = 1;
+    goto out;
+  }
+
+  GNUNET_CRYPTO_paillier_decrypt (&private_key,
+                                  &public_key,
+                                  &c_result,
+                                  hom_result);
+
+  if (0 != gcry_mpi_cmp (result, hom_result))
+  {
+    fprintf (stderr,
+             "GNUNET_CRYPTO_paillier miscalculated with large numbers!\n");
+    gcry_log_debugmpi ("got", hom_result);
+    gcry_log_debugmpi ("wanted", result);
+    ret = 1;
+  }
+out:
+  gcry_mpi_release (m1);
+  gcry_mpi_release (m2);
+  gcry_mpi_release (result);
+  gcry_mpi_release (hom_result);
+  return ret;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int ret;
+
+  ret = test_crypto ();
+  if (0 != ret)
+    return ret;
+  ret = test_hom_simple (2, 4);
+  if (0 != ret)
+    return ret;
+  ret = test_hom_simple (13, 17);
+  if (0 != ret)
+    return ret;
+  ret = test_hom ();
+  return ret;
+}
+
+
+/* end of test_crypto_paillier.c */
diff --git a/src/lib/util/test_crypto_random.c b/src/lib/util/test_crypto_random.c
new file mode 100644
index 000000000..b776aef18
--- /dev/null
+++ b/src/lib/util/test_crypto_random.c
@@ -0,0 +1,74 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+
+/**
+ * @file util/test_crypto_random.c
+ * @brief testcase for crypto_random.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static int
+test (enum GNUNET_CRYPTO_Quality mode)
+{
+  int buf[1024];
+  unsigned int *b2;
+  int i;
+  unsigned long long n;
+  struct GNUNET_Uuid tf;
+
+  for (i = 0; i < 1024; i++)
+    GNUNET_break (1024 > (buf[i] = GNUNET_CRYPTO_random_u32 (mode, 1024)));
+  for (i = 0; i < 10; i++)
+  {
+    b2 = GNUNET_CRYPTO_random_permute (mode, 1024);
+    if (0 == memcmp (b2, buf, sizeof(buf)))
+    {
+      fprintf (stderr, "%s", "!");
+      GNUNET_free (b2);
+      continue;
+    }
+    GNUNET_free (b2);
+    break;
+  }
+  if (i == 10)
+    return 1;                   /* virtually impossible... */
+
+  for (n = 10; n < 1024LL * 1024LL * 1024LL; n *= 10)
+    GNUNET_break (n > GNUNET_CRYPTO_random_u64 (mode, n));
+  GNUNET_CRYPTO_random_timeflake (mode,
+                                  &tf);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_log_setup ("test-crypto-random", "WARNING", NULL);
+  if (0 != test (GNUNET_CRYPTO_QUALITY_WEAK))
+    return 1;
+  if (0 != test (GNUNET_CRYPTO_QUALITY_STRONG))
+    return 1;
+
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_rsa.c b/src/lib/util/test_crypto_rsa.c
new file mode 100644
index 000000000..c513a68fe
--- /dev/null
+++ b/src/lib/util/test_crypto_rsa.c
@@ -0,0 +1,171 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2014, 2015, 2023 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_crypto_rsa.c
+ * @brief testcase for utility functions for RSA cryptography
+ * @author Sree Harsha Totakura <sreeharsha@totakura.in>
+ * @author Jeffrey Burdges <burdges@gnunet.org>
+ */
+
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+
+#define KEY_SIZE 1024
+
+
+int
+main (int argc,
+      char *argv[])
+{
+#define RND_BLK_SIZE 4096
+  unsigned char rnd_blk[RND_BLK_SIZE];
+  struct GNUNET_CRYPTO_RsaPrivateKey *priv;
+  struct GNUNET_CRYPTO_RsaPrivateKey *priv_copy;
+  struct GNUNET_CRYPTO_RsaPublicKey *pub;
+  struct GNUNET_CRYPTO_RsaPublicKey *pub_copy;
+  struct GNUNET_CRYPTO_RsaSignature *sig;
+  struct GNUNET_CRYPTO_RsaSignature *sig_copy;
+  struct GNUNET_CRYPTO_RsaSignature *bsig;
+  struct GNUNET_CRYPTO_RsaBlindingKeySecret bsec;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_log_setup ("test-crypto-rsa",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              rnd_blk,
+                              RND_BLK_SIZE);
+  GNUNET_CRYPTO_hash (rnd_blk,
+                      RND_BLK_SIZE,
+                      &hash);
+  priv = GNUNET_CRYPTO_rsa_private_key_create (KEY_SIZE);
+  priv_copy = GNUNET_CRYPTO_rsa_private_key_dup (priv);
+  GNUNET_assert (NULL != priv_copy);
+  GNUNET_assert (0 == GNUNET_CRYPTO_rsa_private_key_cmp (priv,
+                                                         priv_copy));
+  pub = GNUNET_CRYPTO_rsa_private_key_get_public (priv);
+
+  /* Encoding */
+  size_t size;
+  void *enc;
+  enc = NULL;
+  size = GNUNET_CRYPTO_rsa_private_key_encode (priv,
+                                               &enc);
+
+  /* Decoding */
+  GNUNET_CRYPTO_rsa_private_key_free (priv);
+  priv = NULL;
+  priv = GNUNET_CRYPTO_rsa_private_key_decode (enc,
+                                               size);
+  GNUNET_assert (NULL != priv);
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              enc,
+                              size);
+  GNUNET_assert (NULL ==
+                 GNUNET_CRYPTO_rsa_private_key_decode (enc,
+                                                       size));
+  (void) fprintf (stderr,
+                  "The above warning is expected.\n");
+  GNUNET_free (enc);
+
+  /* try ordinary sig first */
+  sig = GNUNET_CRYPTO_rsa_sign_fdh (priv,
+                                    &hash,
+                                    sizeof (hash));
+  sig_copy = GNUNET_CRYPTO_rsa_signature_dup (sig);
+  GNUNET_assert (NULL != sig);
+  GNUNET_assert (0 == GNUNET_CRYPTO_rsa_signature_cmp (sig,
+                                                       sig_copy));
+  pub_copy = GNUNET_CRYPTO_rsa_public_key_dup (pub);
+  GNUNET_assert (NULL != pub_copy);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_rsa_verify (&hash,
+                                           sizeof (hash),
+                                           sig,
+                                           pub_copy));
+  {
+    void *buf;
+    size_t buf_size;
+    struct GNUNET_CRYPTO_RsaPublicKey *pub2;
+    struct GNUNET_CRYPTO_RsaSignature *sig2;
+
+    buf_size = GNUNET_CRYPTO_rsa_public_key_encode (pub,
+                                                    &buf);
+    pub2 = GNUNET_CRYPTO_rsa_public_key_decode (buf,
+                                                buf_size);
+    GNUNET_free (buf);
+    buf_size = GNUNET_CRYPTO_rsa_signature_encode (sig,
+                                                   &buf);
+    sig2 = GNUNET_CRYPTO_rsa_signature_decode (buf,
+                                               buf_size);
+    GNUNET_free (buf);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_rsa_verify (&hash,
+                                             sizeof (hash),
+                                             sig2,
+                                             pub2));
+    GNUNET_CRYPTO_rsa_public_key_free (pub2);
+    GNUNET_CRYPTO_rsa_signature_free (sig2);
+  }
+  /* corrupt our hash and see if the signature is still valid */
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              &hash,
+                              sizeof(hash));
+  GNUNET_assert (GNUNET_OK !=
+                 GNUNET_CRYPTO_rsa_verify (&hash,
+                                           sizeof (hash),
+                                           sig,
+                                           pub));
+  (void) fprintf (stderr,
+                  "The above warning is expected.\n");
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+
+  /* test blind signing */
+  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                              &bsec,
+                              sizeof(bsec));
+  struct GNUNET_CRYPTO_RsaBlindedMessage bm;
+  GNUNET_CRYPTO_rsa_blind (&hash,
+                           sizeof (hash),
+                           &bsec,
+                           pub,
+                           &bm);
+  bsig = GNUNET_CRYPTO_rsa_sign_blinded (priv,
+                                         &bm);
+  GNUNET_CRYPTO_rsa_blinded_message_free (&bm);
+  sig = GNUNET_CRYPTO_rsa_unblind (bsig,
+                                   &bsec,
+                                   pub);
+  GNUNET_CRYPTO_rsa_signature_free (bsig);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_rsa_verify (&hash,
+                                           sizeof (hash),
+                                           sig,
+                                           pub));
+  GNUNET_CRYPTO_rsa_signature_free (sig);
+  GNUNET_CRYPTO_rsa_signature_free (sig_copy);
+  GNUNET_CRYPTO_rsa_private_key_free (priv);
+  GNUNET_CRYPTO_rsa_private_key_free (priv_copy);
+  GNUNET_CRYPTO_rsa_public_key_free (pub);
+  GNUNET_CRYPTO_rsa_public_key_free (pub_copy);
+  return 0;
+}
diff --git a/src/lib/util/test_crypto_symmetric.c b/src/lib/util/test_crypto_symmetric.c
new file mode 100644
index 000000000..4c8c2f0c2
--- /dev/null
+++ b/src/lib/util/test_crypto_symmetric.c
@@ -0,0 +1,176 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2002, 2003, 2004, 2006 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @author Christian Grothoff
+ * @file util/test_crypto_symmetric.c
+ * @brief test for AES ciphers
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define TESTSTRING "Hello World!"
+#define INITVALUE "InitializationVectorValueinitializationvectorvalue"
+
+static int
+testSymcipher ()
+{
+  struct GNUNET_CRYPTO_SymmetricSessionKey key;
+  char result[100];
+  int size;
+  char res[100];
+
+  GNUNET_CRYPTO_symmetric_create_session_key (&key);
+  size =
+    GNUNET_CRYPTO_symmetric_encrypt (TESTSTRING, strlen (TESTSTRING) + 1, &key,
+                                     (const struct
+                                      GNUNET_CRYPTO_SymmetricInitializationVector
+                                      *)
+                                     INITVALUE, result);
+  if (size == -1)
+  {
+    printf ("symciphertest failed: encryptBlock returned %d\n", size);
+    return 1;
+  }
+  size =
+    GNUNET_CRYPTO_symmetric_decrypt (result, size, &key,
+                                     (const struct
+                                      GNUNET_CRYPTO_SymmetricInitializationVector
+                                      *)
+                                     INITVALUE, res);
+  if (strlen (TESTSTRING) + 1 != size)
+  {
+    printf ("symciphertest failed: decryptBlock returned %d\n", size);
+    return 1;
+  }
+  if (0 != strcmp (res, TESTSTRING))
+  {
+    printf ("symciphertest failed: %s != %s\n", res, TESTSTRING);
+    return 1;
+  }
+  else
+    return 0;
+}
+
+
+static int
+verifyCrypto ()
+{
+  struct GNUNET_CRYPTO_SymmetricSessionKey key;
+  char result[GNUNET_CRYPTO_AES_KEY_LENGTH];
+  char *res;
+  int ret;
+
+  unsigned char plain[] = {
+    29, 128, 192, 253, 74, 171, 38, 187, 84, 219, 76, 76, 209, 118, 33, 249,
+    172, 124, 96, 9, 157, 110, 8, 215, 200, 63, 69, 230, 157, 104, 247, 164
+  };
+  unsigned char raw_key_aes[] = {
+    106, 74, 209, 88, 145, 55, 189, 135, 125, 180, 225, 108, 183, 54, 25,
+    169, 129, 188, 131, 75, 227, 245, 105, 10, 225, 15, 115, 159, 148, 184,
+    34, 191
+  };
+  unsigned char raw_key_twofish[] = {
+    145, 55, 189, 135, 125, 180, 225, 108, 183, 54, 25,
+    169, 129, 188, 131, 75, 227, 245, 105, 10, 225, 15, 115, 159, 148, 184,
+    34, 191, 106, 74, 209, 88
+  };
+  unsigned char encrresult[] = {
+    155, 88, 106, 174, 124, 172, 47, 149, 85, 15, 208, 176, 65, 124, 155,
+    74, 215, 25, 177, 231, 162, 109, 165, 4, 133, 165, 93, 44, 213, 77,
+    206, 204, 1
+  };
+
+  res = NULL;
+  ret = 0;
+
+  GNUNET_memcpy (key.aes_key, raw_key_aes, GNUNET_CRYPTO_AES_KEY_LENGTH);
+  GNUNET_memcpy (key.twofish_key, raw_key_twofish,
+                 GNUNET_CRYPTO_AES_KEY_LENGTH);
+  if (GNUNET_CRYPTO_AES_KEY_LENGTH !=
+      GNUNET_CRYPTO_symmetric_encrypt (plain, GNUNET_CRYPTO_AES_KEY_LENGTH,
+                                       &key,
+                                       (const struct
+                                        GNUNET_CRYPTO_SymmetricInitializationVector
+                                        *)
+                                       "testtesttesttesttesttesttesttest",
+                                       result))
+  {
+    printf ("Wrong return value from encrypt block.\n");
+    ret = 1;
+    goto error;
+  }
+
+  if (0 != memcmp (encrresult, result, GNUNET_CRYPTO_AES_KEY_LENGTH))
+  {
+    int i;
+    printf ("Encrypted result wrong.\n");
+    for (i = 0; i < GNUNET_CRYPTO_AES_KEY_LENGTH; i++)
+      printf ("%u, ", (uint8_t) result[i]);
+    ret = 1;
+    goto error;
+  }
+
+  res = GNUNET_malloc (GNUNET_CRYPTO_AES_KEY_LENGTH);
+  if (GNUNET_CRYPTO_AES_KEY_LENGTH !=
+      GNUNET_CRYPTO_symmetric_decrypt (result, GNUNET_CRYPTO_AES_KEY_LENGTH,
+                                       &key,
+                                       (const struct
+                                        GNUNET_CRYPTO_SymmetricInitializationVector
+                                        *)
+                                       "testtesttesttesttesttesttesttest", res))
+  {
+    printf ("Wrong return value from decrypt block.\n");
+    ret = 1;
+    goto error;
+  }
+  if (0 != memcmp (res, plain, GNUNET_CRYPTO_AES_KEY_LENGTH))
+  {
+    printf ("Decrypted result does not match input.\n");
+    ret = 1;
+  }
+error:
+  GNUNET_free (res);
+  return ret;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int failureCount = 0;
+
+  GNUNET_log_setup ("test-crypto-aes", "WARNING", NULL);
+  GNUNET_assert (strlen (INITVALUE) >
+                 sizeof(struct GNUNET_CRYPTO_SymmetricInitializationVector));
+  failureCount += testSymcipher ();
+  failureCount += verifyCrypto ();
+
+  if (failureCount != 0)
+  {
+    printf ("%d TESTS FAILED!\n", failureCount);
+    return -1;
+  }
+  return 0;
+}
+
+
+/* end of test_crypto_aes.c */
diff --git a/src/lib/util/test_disk.c b/src/lib/util/test_disk.c
new file mode 100644
index 000000000..35b4bd14a
--- /dev/null
+++ b/src/lib/util/test_disk.c
@@ -0,0 +1,291 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001, 2002, 2003, 2005, 2006, 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_disk.c
+ * @brief testcase for the storage module
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define TESTSTRING "Hello World\0"
+
+
+static int
+testReadWrite (void)
+{
+  char tmp[100 + 1];
+  int ret;
+
+  if (GNUNET_OK !=
+      GNUNET_DISK_fn_write (".testfile", TESTSTRING, strlen (TESTSTRING),
+                            GNUNET_DISK_PERM_USER_READ
+                            | GNUNET_DISK_PERM_USER_WRITE))
+    return 1;
+  if (GNUNET_OK != GNUNET_DISK_file_test (".testfile"))
+    return 1;
+  ret = GNUNET_DISK_fn_read (".testfile", tmp, sizeof(tmp) - 1);
+  if (ret < 0)
+  {
+    fprintf (stderr, "Error reading file `%s' in testReadWrite\n", ".testfile");
+    return 1;
+  }
+  tmp[ret] = '\0';
+  if (0 != memcmp (tmp, TESTSTRING, strlen (TESTSTRING) + 1))
+  {
+    fprintf (stderr, "Error in testReadWrite: *%s* != *%s* for file %s\n", tmp,
+             TESTSTRING, ".testfile");
+    return 1;
+  }
+  GNUNET_DISK_file_copy (".testfile", ".testfile2");
+  memset (tmp, 0, sizeof(tmp));
+  ret = GNUNET_DISK_fn_read (".testfile2", tmp, sizeof(tmp) - 1);
+  if (ret < 0)
+  {
+    fprintf (stderr, "Error reading file `%s' in testReadWrite\n",
+             ".testfile2");
+    return 1;
+  }
+  tmp[ret] = '\0';
+  if (0 != memcmp (tmp, TESTSTRING, strlen (TESTSTRING) + 1))
+  {
+    fprintf (stderr, "Error in testReadWrite: *%s* != *%s* for file %s\n", tmp,
+             TESTSTRING, ".testfile2");
+    return 1;
+  }
+
+  GNUNET_break (0 == unlink (".testfile"));
+  GNUNET_break (0 == unlink (".testfile2"));
+  if (GNUNET_NO != GNUNET_DISK_file_test (".testfile"))
+    return 1;
+
+  return 0;
+}
+
+
+static int
+testOpenClose ()
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  uint64_t size;
+
+  fh = GNUNET_DISK_file_open (".testfile",
+                              GNUNET_DISK_OPEN_READWRITE
+                              | GNUNET_DISK_OPEN_CREATE,
+                              GNUNET_DISK_PERM_USER_READ
+                              | GNUNET_DISK_PERM_USER_WRITE);
+  GNUNET_assert (GNUNET_NO == GNUNET_DISK_handle_invalid (fh));
+  GNUNET_break (5 == GNUNET_DISK_file_write (fh, "Hello", 5));
+  GNUNET_DISK_file_close (fh);
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_file_size (".testfile", &size, GNUNET_NO,
+                                       GNUNET_YES));
+  if (size != 5)
+    return 1;
+  GNUNET_break (0 == unlink (".testfile"));
+
+  return 0;
+}
+
+
+static int ok;
+
+
+static int
+scan_callback (void *want, const char *filename)
+{
+  if (NULL != strstr (filename, want))
+    ok++;
+  return GNUNET_OK;
+}
+
+
+static int
+testDirScan ()
+{
+  if (GNUNET_OK !=
+      GNUNET_DISK_directory_create ("test" DIR_SEPARATOR_STR "entry"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK !=
+      GNUNET_DISK_directory_create ("test" DIR_SEPARATOR_STR "entry_more"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  GNUNET_DISK_directory_scan ("test", &scan_callback,
+                              "test" DIR_SEPARATOR_STR "entry");
+  if (GNUNET_OK != GNUNET_DISK_directory_remove ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (ok < 2)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+static int
+iter_callback (void *cls,
+               const char *filename)
+{
+  int *i = cls;
+
+  (*i)++;
+  return GNUNET_OK;
+}
+
+
+static int
+testDirIter ()
+{
+  int i;
+
+  i = 0;
+  if (GNUNET_OK != GNUNET_DISK_directory_create ("test/entry"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK != GNUNET_DISK_directory_create ("test/entry_many"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK != GNUNET_DISK_directory_create ("test/entry_more"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  GNUNET_DISK_directory_scan ("test",
+                              &iter_callback,
+                              &i);
+  if (GNUNET_OK != GNUNET_DISK_directory_remove ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (i < 3)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+static int
+testCanonicalize ()
+{
+  char *fn = GNUNET_strdup ("ab?><|cd*ef:/g\"");
+
+  GNUNET_DISK_filename_canonicalize (fn);
+  if (0 != strcmp (fn, "ab____cd_ef__g_"))
+  {
+    GNUNET_free (fn);
+    return 1;
+  }
+  GNUNET_free (fn);
+  return 0;
+}
+
+
+static int
+testChangeOwner ()
+{
+  GNUNET_log_skip (1, GNUNET_NO);
+  if (GNUNET_OK == GNUNET_DISK_file_change_owner ("/dev/null", "unknownuser"))
+    return 1;
+  return 0;
+}
+
+
+static int
+testDirMani ()
+{
+  if (GNUNET_OK != GNUNET_DISK_directory_create_for_file ("test/ing"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_NO != GNUNET_DISK_file_test ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_NO != GNUNET_DISK_file_test ("test/ing"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK != GNUNET_DISK_directory_remove ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK != GNUNET_DISK_directory_create ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_YES != GNUNET_DISK_directory_test ("test", GNUNET_YES))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (GNUNET_OK != GNUNET_DISK_directory_remove ("test"))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  unsigned int failureCount = 0;
+
+  GNUNET_log_setup ("test-disk", "WARNING", NULL);
+  failureCount += testReadWrite ();
+  failureCount += testOpenClose ();
+  failureCount += testDirScan ();
+  failureCount += testDirIter ();
+  failureCount += testCanonicalize ();
+  failureCount += testChangeOwner ();
+  failureCount += testDirMani ();
+  if (0 != failureCount)
+  {
+    fprintf (stderr,
+             "\n%u TESTS FAILED!\n",
+             failureCount);
+    return -1;
+  }
+  return 0;
+}                               /* end of main */
diff --git a/src/lib/util/test_getopt.c b/src/lib/util/test_getopt.c
new file mode 100644
index 000000000..cad10504d
--- /dev/null
+++ b/src/lib/util/test_getopt.c
@@ -0,0 +1,183 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2003, 2004, 2005, 2006, 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_getopt.c
+ * @brief testcase for util/getopt.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static int
+testMinimal ()
+{
+  char *const emptyargv[] = { "test", NULL };
+  const struct GNUNET_GETOPT_CommandLineOption emptyoptionlist[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  if (1 != GNUNET_GETOPT_run ("test", emptyoptionlist, 1, emptyargv))
+    return 1;
+
+  return 0;
+}
+
+
+static int
+testVerbose ()
+{
+  char *const myargv[] = { "test", "-V", "-V", "more", NULL };
+  unsigned int vflags = 0;
+
+  const struct GNUNET_GETOPT_CommandLineOption verboseoptionlist[] =
+  { GNUNET_GETOPT_option_verbose (&vflags), GNUNET_GETOPT_OPTION_END };
+
+  if (3 != GNUNET_GETOPT_run ("test", verboseoptionlist, 4, myargv))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (vflags != 2)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+static int
+testVersion ()
+{
+  char *const myargv[] = { "test_getopt", "-v", NULL };
+  const struct GNUNET_GETOPT_CommandLineOption versionoptionlist[] =
+  { GNUNET_GETOPT_option_version (PACKAGE_VERSION " " VCS_VERSION),
+    GNUNET_GETOPT_OPTION_END };
+
+  if (0 != GNUNET_GETOPT_run ("test_getopt", versionoptionlist, 2, myargv))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+static int
+testAbout ()
+{
+  char *const myargv[] = { "test_getopt", "-h", NULL };
+  const struct GNUNET_GETOPT_CommandLineOption aboutoptionlist[] =
+  { GNUNET_GETOPT_option_help ("Testing"), GNUNET_GETOPT_OPTION_END };
+
+  if (0 != GNUNET_GETOPT_run ("test_getopt", aboutoptionlist, 2, myargv))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+static int
+testLogOpts ()
+{
+  char *const myargv[] =
+  { "test_getopt", "-l", "filename", "-L", "WARNING", NULL };
+  char *level = GNUNET_strdup ("stuff");
+  char *fn = NULL;
+
+  const struct GNUNET_GETOPT_CommandLineOption logoptionlist[] =
+  { GNUNET_GETOPT_option_logfile (&fn),
+    GNUNET_GETOPT_option_loglevel (&level),
+    GNUNET_GETOPT_OPTION_END };
+
+  if (5 != GNUNET_GETOPT_run ("test_getopt", logoptionlist, 5, myargv))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  GNUNET_assert (NULL != fn);
+  if ((0 != strcmp (level, "WARNING")) || (NULL == strstr (fn, "/filename")))
+  {
+    GNUNET_break (0);
+    GNUNET_free (level);
+    GNUNET_free (fn);
+    return 1;
+  }
+  GNUNET_free (level);
+  GNUNET_free (fn);
+  return 0;
+}
+
+
+static int
+testFlagNum ()
+{
+  char *const myargv[] = { "test_getopt", "-f", "-n", "42", "-N", "42", NULL };
+  int flag = 0;
+  unsigned int num = 0;
+  unsigned long long lnum = 0;
+
+  const struct GNUNET_GETOPT_CommandLineOption logoptionlist[] =
+  { GNUNET_GETOPT_option_flag ('f', "--flag", "helptext", &flag),
+    GNUNET_GETOPT_option_uint ('n', "--num", "ARG", "helptext", &num),
+    GNUNET_GETOPT_option_ulong ('N', "--lnum", "ARG", "helptext", &lnum),
+    GNUNET_GETOPT_OPTION_END };
+
+  if (6 != GNUNET_GETOPT_run ("test_getopt", logoptionlist, 6, myargv))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if ((1 != flag) || (42 != num) || (42 != lnum))
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int errCnt = 0;
+
+  GNUNET_log_setup ("test_getopt", "WARNING", NULL);
+  /* suppress output from -h, -v options */
+
+  GNUNET_break (0 == close (1));
+
+  if (0 != testMinimal ())
+    errCnt++;
+  if (0 != testVerbose ())
+    errCnt++;
+  if (0 != testVersion ())
+    errCnt++;
+  if (0 != testAbout ())
+    errCnt++;
+  if (0 != testLogOpts ())
+    errCnt++;
+  if (0 != testFlagNum ())
+    errCnt++;
+  return errCnt;
+}
diff --git a/src/lib/util/test_hexcoder.c b/src/lib/util/test_hexcoder.c
new file mode 100644
index 000000000..e04631188
--- /dev/null
+++ b/src/lib/util/test_hexcoder.c
@@ -0,0 +1,56 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+
+ */
+/**
+ * @author Christian Grothoff
+ * @file dns/test_hexcoder.c
+ * @brief test for #GNUNET_DNSPARSER_hex_to_bin() and
+ *                 #GNUNET_DNSPARSER_bin_to_hex()
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define TESTSTRING "Hello World!"
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  char buf[strlen (TESTSTRING) + 1];
+  char *ret;
+
+  GNUNET_log_setup ("test-hexcoder", "WARNING", NULL);
+  ret = GNUNET_DNSPARSER_bin_to_hex (TESTSTRING,
+                                     strlen (TESTSTRING) + 1);
+  GNUNET_assert (NULL != ret);
+  GNUNET_assert (sizeof(buf) ==
+                 GNUNET_DNSPARSER_hex_to_bin (ret,
+                                              buf));
+  GNUNET_assert (0 == memcmp (TESTSTRING,
+                              buf,
+                              sizeof(buf)));
+  GNUNET_free (ret);
+  return 0;
+}
+
+
+/* end of test_hexcoder.c */
diff --git a/src/lib/util/test_mq.c b/src/lib/util/test_mq.c
new file mode 100644
index 000000000..522589daf
--- /dev/null
+++ b/src/lib/util/test_mq.c
@@ -0,0 +1,342 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/test_mq.c
+ * @brief tests for mq
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#define NUM_TRANSMISSIONS 500
+
+/**
+ * How long does the receiver take per message?
+ */
+#define RECEIVER_THROTTLE GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MILLISECONDS, 1)
+
+static unsigned int received_cnt;
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+struct MyMessage
+{
+  struct GNUNET_MessageHeader header;
+  uint32_t x GNUNET_PACKED;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+static int global_ret;
+
+static struct GNUNET_SCHEDULER_Task *tt;
+
+static struct GNUNET_SCHEDULER_Task *dt;
+
+static struct GNUNET_MQ_Handle *cmq;
+
+
+static void
+do_shutdown (void *cls)
+{
+  (void) cls;
+  if (NULL != tt)
+  {
+    GNUNET_SCHEDULER_cancel (tt);
+    tt = NULL;
+  }
+  if (NULL != cmq)
+  {
+    GNUNET_MQ_destroy (cmq);
+    cmq = NULL;
+  }
+}
+
+
+static void
+do_timeout (void *cls)
+{
+  (void) cls;
+  tt = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+  global_ret = 1;
+}
+
+
+/**
+ * Generic error handler, called with the appropriate
+ * error code and the same closure specified at the creation of
+ * the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure
+ * @param error error code
+ */
+static void
+error_cb (void *cls,
+          enum GNUNET_MQ_Error error)
+{
+  GNUNET_break (0);
+  global_ret = 3;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+client_continue (void *cls)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+
+  dt = NULL;
+  GNUNET_SERVICE_client_continue (c);
+}
+
+
+static void
+handle_dummy (void *cls,
+              const struct MyMessage *msg)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+
+  GNUNET_assert (NULL == dt);
+  /* artificially make receiver slower than sender */
+  dt = GNUNET_SCHEDULER_add_delayed (RECEIVER_THROTTLE,
+                                     &client_continue,
+                                     c);
+  if (received_cnt != ntohl (msg->x))
+  {
+    GNUNET_break (0);
+    global_ret = 4;
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  received_cnt++;
+}
+
+
+static void
+handle_dummy2 (void *cls,
+               const struct MyMessage *msg)
+{
+  struct GNUNET_SERVICE_Client *c = cls;
+
+  GNUNET_SERVICE_client_continue (c);
+  if (NUM_TRANSMISSIONS != received_cnt)
+  {
+    GNUNET_break (0);
+    global_ret = 5;
+  }
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Function called whenever MQ has sent a message.
+ */
+static void
+notify_sent_cb (void *cls)
+{
+  static unsigned int seen;
+  unsigned int *cnt = cls;
+
+  if (seen != *cnt)
+  {
+    GNUNET_break (0);
+    global_ret = 6;
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  seen++;
+  GNUNET_free (cnt);
+}
+
+
+/**
+ * Start running the actual test.
+ *
+ * @param cls closure passed to #GNUNET_SERVICE_MAIN
+ * @param cfg configuration to use for this service
+ * @param sh handle to the newly create service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_SERVICE_Handle *sh)
+{
+  struct GNUNET_MQ_MessageHandler ch[] = {
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *env;
+  struct MyMessage *m;
+
+  (void) cls;
+  (void) sh;
+  cmq = GNUNET_CLIENT_connect (cfg,
+                               "test_client",
+                               ch,
+                               &error_cb,
+                               NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  tt = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MINUTES,
+                                     &do_timeout,
+                                     NULL);
+  for (unsigned int i = 0; i < NUM_TRANSMISSIONS; i++)
+  {
+    unsigned int *cnt;
+
+    cnt = GNUNET_new (unsigned int);
+    *cnt = i;
+    env = GNUNET_MQ_msg (m,
+                         GNUNET_MESSAGE_TYPE_DUMMY);
+    GNUNET_MQ_notify_sent (env,
+                           &notify_sent_cb,
+                           cnt);
+    m->x = htonl (i);
+    GNUNET_MQ_send (cmq,
+                    env);
+  }
+  env = GNUNET_MQ_msg (m,
+                       GNUNET_MESSAGE_TYPE_DUMMY2);
+  GNUNET_MQ_send (cmq,
+                  env);
+}
+
+
+/**
+ * Callback to be called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return the client-specific (`internal') closure
+ */
+static void *
+connect_cb (void *cls,
+            struct GNUNET_SERVICE_Client *c,
+            struct GNUNET_MQ_Handle *mq)
+{
+  (void) cls;
+  (void) mq;
+  return c;
+}
+
+
+/**
+ * Callback to be called when a client disconnected from the service
+ *
+ * @param cls closure for the service
+ * @param c the client that disconnected
+ * @param internal_cls the client-specific (`internal') closure
+ */
+static void
+disconnect_cb (void *cls,
+               struct GNUNET_SERVICE_Client *c,
+               void *internal_cls)
+{
+  (void) cls;
+  (void) c;
+  (void) internal_cls;
+}
+
+
+static void
+test1 ()
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct MyMessage *mm;
+
+  mm = NULL;
+  mqm = NULL;
+
+  mqm = GNUNET_MQ_msg (mm,
+                       GNUNET_MESSAGE_TYPE_DUMMY);
+  GNUNET_assert (NULL != mqm);
+  GNUNET_assert (NULL != mm);
+  GNUNET_assert (GNUNET_MESSAGE_TYPE_DUMMY == ntohs (mm->header.type));
+  GNUNET_assert (sizeof(struct MyMessage) == ntohs (mm->header.size));
+  GNUNET_MQ_discard (mqm);
+}
+
+
+static void
+test2 ()
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_MessageHeader *mh;
+
+  mqm = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_DUMMY);
+  /* how could the above be checked? */
+
+  GNUNET_MQ_discard (mqm);
+
+  mqm = GNUNET_MQ_msg_header_extra (mh,
+                                    20,
+                                    GNUNET_MESSAGE_TYPE_DUMMY);
+  GNUNET_assert (GNUNET_MESSAGE_TYPE_DUMMY == ntohs (mh->type));
+  GNUNET_assert (sizeof(struct GNUNET_MessageHeader) + 20 == ntohs (mh->size));
+  GNUNET_MQ_discard (mqm);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  char *test_argv[] = {
+    (char *) "test_client",
+    "-c",
+    "test_client_data.conf",
+    NULL
+  };
+  struct GNUNET_MQ_MessageHandler mh[] = {
+    GNUNET_MQ_hd_fixed_size (dummy,
+                             GNUNET_MESSAGE_TYPE_DUMMY,
+                             struct MyMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (dummy2,
+                             GNUNET_MESSAGE_TYPE_DUMMY2,
+                             struct MyMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  (void) argc;
+  (void) argv;
+  GNUNET_log_setup ("test-mq",
+                    "INFO",
+                    NULL);
+  test1 ();
+  test2 ();
+  if (0 !=
+      GNUNET_SERVICE_run_ (3,
+                           test_argv,
+                           "test_client",
+                           GNUNET_SERVICE_OPTION_NONE,
+                           &run,
+                           &connect_cb,
+                           &disconnect_cb,
+                           NULL,
+                           mh))
+    return 1;
+  return global_ret;
+}
diff --git a/src/lib/util/test_os_network.c b/src/lib/util/test_os_network.c
new file mode 100644
index 000000000..3bf4e1ba0
--- /dev/null
+++ b/src/lib/util/test_os_network.c
@@ -0,0 +1,93 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2003, 2004, 2005, 2006, 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_os_network.c
+ * @brief testcase for util/os_network.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Check if the address we got is IPv4 or IPv6 loopback (which should
+ * be present on all systems at all times); if so, set ok to 0
+ * (success).
+ */
+static int
+proc (void *cls,
+      const char *name,
+      int isDefault,
+      const struct sockaddr *addr,
+      const struct sockaddr *broadcast_addr,
+      const struct sockaddr *netmask,
+      socklen_t addrlen)
+{
+  int *ok = cls;
+  char buf[INET6_ADDRSTRLEN];
+  const char *protocol;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE, "hiho\n");
+  if (NULL == addr)
+    return GNUNET_OK;
+  if (addrlen == sizeof(struct sockaddr_in))
+    protocol = "IPv4";
+  else
+    protocol = "IPv6";
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "%s Address `%s'\n",
+              protocol,
+              GNUNET_a2s ((const struct sockaddr *) addr,
+                          addrlen));
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Netmask `%s'\n",
+              GNUNET_a2s ((const struct sockaddr *) netmask,
+                          addrlen));
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "`%s'\n",
+              GNUNET_a2s ((const struct sockaddr *) broadcast_addr,
+                          addrlen));
+  inet_ntop (addr->sa_family,
+             (addr->sa_family ==
+              AF_INET) ? (void *) &((struct sockaddr_in *) addr)->sin_addr
+             : (void *) &((struct sockaddr_in6 *) addr)->sin6_addr, buf,
+             sizeof(buf));
+  if ((0 == strcmp ("::1", buf)) || (0 == strcmp ("127.0.0.1", buf)))
+    *ok = 0;
+  return GNUNET_OK;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret;
+
+  GNUNET_log_setup ("test-os-network",
+                    "WARNING",
+                    NULL);
+  ret = 1;
+  GNUNET_OS_network_interfaces_list (&proc,
+                                     &ret);
+  return ret;
+}
+
+
+/* end of test_os_network.c */
diff --git a/src/lib/util/test_os_start_process.c b/src/lib/util/test_os_start_process.c
new file mode 100644
index 000000000..cdb1acf03
--- /dev/null
+++ b/src/lib/util/test_os_start_process.c
@@ -0,0 +1,290 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_os_start_process.c
+ * @brief testcase for os start process code
+ *
+ * This testcase simply calls the os start process code
+ * giving a file descriptor to write stdout to.  If the
+ * correct data "HELLO" is read then all is well.
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "disk.h"
+
+
+static const char *test_phrase = "HELLO WORLD";
+
+static int ok;
+
+static struct GNUNET_OS_Process *proc;
+
+/**
+ * Pipe to write to started processes stdin (on write end)
+ */
+static struct GNUNET_DISK_PipeHandle *hello_pipe_stdin;
+
+/**
+ * Pipe to read from started processes stdout (on read end)
+ */
+static struct GNUNET_DISK_PipeHandle *hello_pipe_stdout;
+
+static struct GNUNET_SCHEDULER_Task *die_task;
+
+struct read_context
+{
+  char buf[16];
+  int buf_offset;
+  const struct GNUNET_DISK_FileHandle *stdout_read_handle;
+};
+
+
+static struct read_context rc;
+
+
+static void
+end_task (void *cls)
+{
+  if (0 != GNUNET_OS_process_kill (proc, GNUNET_TERM_SIG))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+  }
+  GNUNET_assert (GNUNET_OK == GNUNET_OS_process_wait (proc));
+  GNUNET_OS_process_destroy (proc);
+  proc = NULL;
+  GNUNET_DISK_pipe_close (hello_pipe_stdout);
+  GNUNET_DISK_pipe_close (hello_pipe_stdin);
+}
+
+
+static void
+read_call (void *cls)
+{
+  int bytes;
+
+  bytes = GNUNET_DISK_file_read (rc.stdout_read_handle,
+                                 &rc.buf[rc.buf_offset],
+                                 sizeof(rc.buf) - rc.buf_offset);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "bytes is %d\n",
+              bytes);
+
+  if (bytes < 1)
+  {
+    GNUNET_break (0);
+    ok = 1;
+    GNUNET_SCHEDULER_cancel (die_task);
+    (void) GNUNET_SCHEDULER_add_now (&end_task, NULL);
+    return;
+  }
+
+  ok = strncmp (rc.buf, test_phrase, strlen (test_phrase));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "read %s\n",
+              &rc.buf[rc.buf_offset]);
+  rc.buf_offset += bytes;
+
+  if (0 == ok)
+  {
+    GNUNET_SCHEDULER_cancel (die_task);
+    (void) GNUNET_SCHEDULER_add_now (&end_task, NULL);
+    return;
+  }
+
+  GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                  rc.stdout_read_handle,
+                                  &read_call,
+                                  NULL);
+}
+
+
+static void
+run_task (void *cls)
+{
+  const struct GNUNET_DISK_FileHandle *stdout_read_handle;
+  const struct GNUNET_DISK_FileHandle *wh;
+
+  hello_pipe_stdin = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  hello_pipe_stdout = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  if ((hello_pipe_stdout == NULL) || (hello_pipe_stdin == NULL))
+  {
+    GNUNET_break (0);
+    ok = 1;
+    return;
+  }
+
+  proc =
+    GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_ERR,
+                             hello_pipe_stdin, hello_pipe_stdout, NULL,
+                             "cat",
+                             "cat", "-", NULL);
+  /* Close the write end of the read pipe */
+  GNUNET_DISK_pipe_close_end (hello_pipe_stdout, GNUNET_DISK_PIPE_END_WRITE);
+  /* Close the read end of the write pipe */
+  GNUNET_DISK_pipe_close_end (hello_pipe_stdin, GNUNET_DISK_PIPE_END_READ);
+
+  wh = GNUNET_DISK_pipe_handle (hello_pipe_stdin, GNUNET_DISK_PIPE_END_WRITE);
+
+  /* Write the test_phrase to the cat process */
+  if (GNUNET_DISK_file_write (wh, test_phrase, strlen (test_phrase) + 1) !=
+      strlen (test_phrase) + 1)
+  {
+    GNUNET_break (0);
+    ok = 1;
+    return;
+  }
+
+  /* Close the write end to end the cycle! */
+  GNUNET_DISK_pipe_close_end (hello_pipe_stdin, GNUNET_DISK_PIPE_END_WRITE);
+
+  stdout_read_handle =
+    GNUNET_DISK_pipe_handle (hello_pipe_stdout, GNUNET_DISK_PIPE_END_READ);
+
+  die_task =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                    (GNUNET_TIME_UNIT_MINUTES, 1),
+                                  &end_task,
+                                  NULL);
+
+  memset (&rc, 0, sizeof(rc));
+  rc.stdout_read_handle = stdout_read_handle;
+  GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                  stdout_read_handle,
+                                  &read_call,
+                                  NULL);
+}
+
+
+/**
+ * Main method, starts scheduler with task1,
+ * checks that "ok" is correct at the end.
+ */
+static int
+check_run ()
+{
+  ok = 1;
+  GNUNET_SCHEDULER_run (&run_task, &ok);
+  return ok;
+}
+
+
+/**
+ * Test killing via pipe.
+ */
+static int
+check_kill ()
+{
+  char *fn;
+
+  hello_pipe_stdin = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  hello_pipe_stdout = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  if ((hello_pipe_stdout == NULL) || (hello_pipe_stdin == NULL))
+  {
+    return 1;
+  }
+  fn = GNUNET_OS_get_libexec_binary_path ("gnunet-service-resolver");
+  proc =
+    GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_ERR
+                             | GNUNET_OS_USE_PIPE_CONTROL,
+                             hello_pipe_stdin,
+                             hello_pipe_stdout,
+                             NULL,
+                             fn,
+                             "gnunet-service-resolver", "-",
+                             NULL);
+  if (NULL == proc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to launch gnunet-service-resolver. Is your system setup correct?\n");
+    return 77;
+  }
+  sleep (1);  /* give process time to start, so we actually use the pipe-kill mechanism! */
+  GNUNET_free (fn);
+  if (0 != GNUNET_OS_process_kill (proc, GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+  GNUNET_assert (GNUNET_OK == GNUNET_OS_process_wait (proc));
+  GNUNET_OS_process_destroy (proc);
+  proc = NULL;
+  GNUNET_DISK_pipe_close (hello_pipe_stdout);
+  GNUNET_DISK_pipe_close (hello_pipe_stdin);
+  return 0;
+}
+
+
+/**
+ * Test killing via pipe.
+ */
+static int
+check_instant_kill ()
+{
+  char *fn;
+
+  hello_pipe_stdin = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  hello_pipe_stdout = GNUNET_DISK_pipe (GNUNET_DISK_PF_BLOCKING_RW);
+  if ((hello_pipe_stdout == NULL) || (hello_pipe_stdin == NULL))
+  {
+    return 1;
+  }
+  fn = GNUNET_OS_get_libexec_binary_path ("gnunet-service-resolver");
+  proc =
+    GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_ERR
+                             | GNUNET_OS_USE_PIPE_CONTROL,
+                             hello_pipe_stdin, hello_pipe_stdout, NULL,
+                             fn,
+                             "gnunet-service-resolver", "-", NULL);
+  if (NULL == proc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to launch gnunet-service-resolver. Is your system setup correct?\n");
+    return 77;
+  }
+  if (0 != GNUNET_OS_process_kill (proc,
+                                   GNUNET_TERM_SIG))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+  }
+  GNUNET_free (fn);
+  GNUNET_assert (GNUNET_OK == GNUNET_OS_process_wait (proc));
+  GNUNET_OS_process_destroy (proc);
+  proc = NULL;
+  GNUNET_DISK_pipe_close (hello_pipe_stdout);
+  GNUNET_DISK_pipe_close (hello_pipe_stdin);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret;
+
+  GNUNET_log_setup ("test-os-start-process",
+                    "WARNING",
+                    NULL);
+  ret = 0;
+  ret |= check_run ();
+  ret |= check_kill ();
+  ret |= check_instant_kill ();
+  return ret;
+}
+
+
+/* end of test_os_start_process.c */
diff --git a/src/lib/util/test_peer.c b/src/lib/util/test_peer.c
new file mode 100644
index 000000000..ad4e6aac9
--- /dev/null
+++ b/src/lib/util/test_peer.c
@@ -0,0 +1,140 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_peer.c
+ * @brief testcase for peer.c
+ * @author Safey Mohammed
+ */
+
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <gcrypt.h>
+
+#define NUMBER_OF_PEERS 10
+
+/**
+ * A list of Peer ID's to play with
+ */
+static struct GNUNET_PeerIdentity pidArr[NUMBER_OF_PEERS];
+
+
+static void
+generatePeerIdList ()
+{
+  for (unsigned int i = 0; i < NUMBER_OF_PEERS; i++)
+  {
+    gcry_randomize (&pidArr[i],
+                    sizeof(struct GNUNET_PeerIdentity),
+                    GCRY_STRONG_RANDOM);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Peer %u: %s\n",
+                i,
+                GNUNET_i2s (&pidArr[i]));
+  }
+}
+
+
+static int
+check ()
+{
+  GNUNET_PEER_Id pid;
+  struct GNUNET_PeerIdentity res;
+  GNUNET_PEER_Id ids[] = { 1, 2, 3 };
+
+  GNUNET_assert (0 == GNUNET_PEER_intern (NULL));
+  /* Insert Peers into PeerEntry table and hashmap */
+  for (unsigned int i = 0; i < NUMBER_OF_PEERS; i++)
+  {
+    pid = GNUNET_PEER_intern (&pidArr[i]);
+    if (pid != (i + 1))
+    {
+      fprintf (stderr, "%s",
+               "Unexpected Peer ID returned by intern function\n");
+      return 1;
+    }
+  }
+
+  /* Referencing the first 3 peers once again */
+  for (unsigned int i = 0; i < 3; i++)
+  {
+    pid = GNUNET_PEER_intern (&pidArr[i]);
+    if (pid != (i + 1))
+    {
+      fprintf (stderr, "%s",
+               "Unexpected Peer ID returned by intern function\n");
+      return 1;
+    }
+  }
+
+  /* Dereferencing the first 3 peers once [decrementing their reference count] */
+  GNUNET_PEER_decrement_rcs (ids, 3);
+
+  /* re-referencing the first 3 peers using the change_rc function */
+  for (unsigned int i = 1; i <= 3; i++)
+    GNUNET_PEER_change_rc (i, 1);
+
+  /* Removing the second Peer from the PeerEntry hash map */
+  GNUNET_PEER_change_rc (2, -2);
+
+  /* convert the pid of the first PeerEntry into that of the third */
+  GNUNET_PEER_resolve (1,
+                       &res);
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (&res,
+                                &pidArr[0]));
+
+  /*
+   * Attempt to convert pid = 0 (which is reserved)
+   * into a peer identity object, the peer identity memory
+   * is expected to be set to zero
+   */GNUNET_log_skip (1, GNUNET_YES);
+  GNUNET_PEER_resolve (0, &res);
+  GNUNET_assert (GNUNET_YES == GNUNET_is_zero (&res));
+
+  /* Removing peer entries 1 and 3 from table using the list decrement function */
+  /* If count = 0, nothing should be done whatsoever */
+  GNUNET_PEER_decrement_rcs (ids, 0);
+
+  ids[1] = 3;
+  GNUNET_PEER_decrement_rcs (ids, 2);
+  GNUNET_PEER_decrement_rcs (ids, 2);
+
+  return 0;
+}
+
+
+int
+main ()
+{
+  GNUNET_log_setup ("test-peer",
+                    "ERROR",
+                    NULL);
+  for (unsigned int i = 0; i < 1; i++)
+  {
+    generatePeerIdList ();
+    if (0 != check ())
+      return 1;
+  }
+  return 0;
+}
+
+
+/* end of test_peer.c */
diff --git a/src/lib/util/test_plugin.c b/src/lib/util/test_plugin.c
new file mode 100644
index 000000000..0831f3068
--- /dev/null
+++ b/src/lib/util/test_plugin.c
@@ -0,0 +1,88 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_plugin.c
+ * @brief testcase for plugin.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static void
+test_cb (void *cls,
+         const char *libname,
+         void *lib_ret)
+{
+  const char *test_cls = cls;
+  char *ret;
+
+  GNUNET_assert (0 == strcmp (test_cls,
+                              "test-closure"));
+  GNUNET_assert (0 == strcmp (lib_ret,
+                              "Hello"));
+  ret = GNUNET_PLUGIN_unload (libname,
+                              "out");
+  GNUNET_assert (NULL != ret);
+  GNUNET_assert (0 == strcmp (ret,
+                              "World"));
+  free (ret);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  void *ret;
+
+  GNUNET_log_setup ("test-plugin",
+                    "WARNING",
+                    NULL);
+  GNUNET_log_skip (1,
+                   GNUNET_NO);
+  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_missing",
+                            NULL);
+  GNUNET_log_skip (0, GNUNET_NO);
+  if (NULL != ret)
+    return 1;
+  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_utiltest",
+                            "in");
+  if (NULL == ret)
+    return 1;
+  if (0 != strcmp (ret,
+                   "Hello"))
+    return 2;
+  ret = GNUNET_PLUGIN_unload ("libgnunet_plugin_utiltest",
+                              "out");
+  if (NULL == ret)
+    return 3;
+  if (0 != strcmp (ret,
+                   "World"))
+    return 4;
+  free (ret);
+  GNUNET_PLUGIN_load_all ("libgnunet_plugin_utiltes",
+                          "in",
+                          &test_cb,
+                          "test-closure");
+  return 0;
+}
+
+
+/* end of test_plugin.c */
diff --git a/src/lib/util/test_plugin_plug.c b/src/lib/util/test_plugin_plug.c
new file mode 100644
index 000000000..ed582517b
--- /dev/null
+++ b/src/lib/util/test_plugin_plug.c
@@ -0,0 +1,46 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_plugin_plug.c
+ * @brief plugin for testing
+ */
+
+#include "platform.h"
+
+
+void *
+libgnunet_plugin_utiltest_init (void *arg)
+{
+  if (0 == strcmp (arg, "in"))
+    return "Hello";
+  return NULL;
+}
+
+
+void *
+libgnunet_plugin_utiltest_done (void *arg)
+{
+  if (0 == strcmp (arg, "out"))
+    return strdup ("World");
+  return NULL;
+}
+
+
+/* end of test_plugin_plug.c */
diff --git a/src/lib/util/test_program.c b/src/lib/util/test_program.c
new file mode 100644
index 000000000..3d63b0336
--- /dev/null
+++ b/src/lib/util/test_program.c
@@ -0,0 +1,139 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_program.c
+ * @brief tests for program.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static int setme1;
+
+static int setme2;
+
+
+/**
+ * Main function that will be run.
+ */
+static void
+runner (void *cls,
+        char *const *args,
+        const char *cfgfile,
+        const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  int *ok = cls;
+
+  GNUNET_assert (setme1 == 1);
+  GNUNET_assert (0 == strcmp (args[0], "extra"));
+  GNUNET_assert (args[1] == NULL);
+  GNUNET_assert (NULL != strstr (cfgfile, "/test_program_data.conf"));
+  *ok = 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ok = 1;
+  char *const argvx[] = {
+    "test_program",
+    "-c",
+    "test_program_data.conf",
+    "-L",
+    "WARNING",
+    "-n",
+    "extra",
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options1[] = {
+    GNUNET_GETOPT_option_flag ('n',
+                               "name",
+                               "description",
+                               &setme1),
+    GNUNET_GETOPT_OPTION_END
+  };
+  struct GNUNET_GETOPT_CommandLineOption options2[] = {
+    GNUNET_GETOPT_option_flag ('n',
+                               "name",
+                               "description",
+                               &setme1),
+    GNUNET_GETOPT_option_flag ('N',
+                               "number",
+                               "description",
+                               &setme2),
+    GNUNET_GETOPT_OPTION_END
+  };
+  struct GNUNET_GETOPT_CommandLineOption options3[] = {
+    GNUNET_GETOPT_option_flag ('N',
+                               "number",
+                               "description",
+                               &setme1),
+    GNUNET_GETOPT_option_flag ('n',
+                               "name",
+                               "description",
+                               &setme2),
+    GNUNET_GETOPT_OPTION_END
+  };
+  struct GNUNET_GETOPT_CommandLineOption options4[] = {
+    GNUNET_GETOPT_option_flag ('n',
+                               "name",
+                               "description",
+                               &setme1),
+    GNUNET_GETOPT_option_flag ('n',
+                               "name",
+                               "description",
+                               &setme2),
+    GNUNET_GETOPT_OPTION_END
+  };
+
+
+  GNUNET_log_setup ("test_program",
+                    "WARNING",
+                    NULL);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run (7, argvx,
+                                     "test_program",
+                                     "A test",
+                                     options1,
+                                     &runner, &ok));
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run (7, argvx,
+                                     "test_program", "A test",
+                                     options2,
+                                     &runner, &ok));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run (7, argvx,
+                                     "test_program", "A test",
+                                     options3,
+                                     &runner, &ok));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run (7, argvx,
+                                     "test_program", "A test",
+                                     options4,
+                                     &runner, &ok));
+
+  return ok;
+}
+
+
+/* end of test_program.c */
diff --git a/src/lib/util/test_program_data.conf b/src/lib/util/test_program_data.conf
new file mode 100644
index 000000000..fbf745644
--- /dev/null
+++ b/src/lib/util/test_program_data.conf
@@ -0,0 +1,2 @@
+[resolver]
+HOSTNAME = localhost
diff --git a/src/lib/util/test_regex.c b/src/lib/util/test_regex.c
new file mode 100644
index 000000000..789418fa0
--- /dev/null
+++ b/src/lib/util/test_regex.c
@@ -0,0 +1,194 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file tun/test_regex.c
+ * @brief simple test for regex.c iptoregex functions
+ * @author Maximilian Szengel
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * 'wildcard', matches all possible values (for HEX encoding).
+ */
+#define DOT "(0|1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"
+
+
+static int
+test_iptoregex (const char *ipv4,
+                uint16_t port,
+                const char *expectedv4,
+                const char *ipv6,
+                uint16_t port6,
+                const char *expectedv6)
+{
+  int error = 0;
+
+  struct in_addr a;
+  struct in6_addr b;
+  char rxv4[GNUNET_TUN_IPV4_REGEXLEN];
+  char rxv6[GNUNET_TUN_IPV6_REGEXLEN];
+
+  GNUNET_assert (1 == inet_pton (AF_INET, ipv4, &a));
+  GNUNET_TUN_ipv4toregexsearch (&a, port, rxv4);
+
+  if (0 != strcmp (rxv4, expectedv4))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: %s but got: %s\n",
+                expectedv4,
+                rxv4);
+    error++;
+  }
+
+  GNUNET_assert (1 == inet_pton (AF_INET6, ipv6, &b));
+  GNUNET_TUN_ipv6toregexsearch (&b, port6, rxv6);
+  if (0 != strcmp (rxv6, expectedv6))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: %s but got: %s\n",
+                expectedv6, rxv6);
+    error++;
+  }
+  return error;
+}
+
+
+static int
+test_policy4toregex (const char *policy,
+                     const char *regex)
+{
+  char *r;
+  int ret;
+
+  ret = 0;
+  r = GNUNET_TUN_ipv4policy2regex (policy);
+  if (NULL == r)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (0 != strcmp (regex, r))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: `%s' but got: `%s'\n",
+                regex, r);
+    ret = 2;
+  }
+  GNUNET_free (r);
+  return ret;
+}
+
+
+static int
+test_policy6toregex (const char *policy,
+                     const char *regex)
+{
+  char *r;
+  int ret;
+
+  ret = 0;
+  r = GNUNET_TUN_ipv6policy2regex (policy);
+  if (NULL == r)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to parse `%s'\n",
+                policy);
+    GNUNET_break (0);
+    return 1;
+  }
+  if (0 != strcmp (regex,
+                   r))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: `%s' but got: `%s'\n",
+                regex, r);
+    ret = 2;
+  }
+  GNUNET_free (r);
+  return ret;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int error;
+  char *r;
+
+  GNUNET_log_setup ("test-regex", "WARNING", NULL);
+  error = 0;
+
+  /* this is just a performance test ... */
+  r = GNUNET_TUN_ipv4policy2regex ("1.2.3.4/16:!25;");
+  GNUNET_break (NULL != r);
+  GNUNET_free (r);
+
+  error +=
+    test_iptoregex ("192.1.2.3", 2086,
+                    "4-0826-C0010203",
+                    "FFFF::1", 8080,
+                    "6-1F90-FFFF0000000000000000000000000001");
+  error +=
+    test_iptoregex ("187.238.255.0", 80,
+                    "4-0050-BBEEFF00",
+                    "E1E1:73F9:51BE::0", 49,
+                    "6-0031-E1E173F951BE00000000000000000000");
+  error +=
+    test_policy4toregex ("192.1.2.0/24:80;",
+                         "4-0050-C00102" DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/16;",
+                         "4-" DOT DOT DOT DOT "-C001" DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/16:80-81;",
+                         "4-(0050|0051)-C001" DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/8:!3-65535;",
+                         "4-000(0|1|2)-C0" DOT DOT DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/8:!25-56;",
+                         "4-(0(0(0"DOT
+                         "|1(0|1|2|3|4|5|6|7|8)|3(9|A|B|C|D|E|F)|(4|5|6|7|8|9|A|B|C|D|E|F)"DOT
+                         ")|(1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"DOT DOT
+                         ")|(1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"DOT DOT
+                         DOT ")-C0"DOT DOT DOT DOT DOT DOT);
+  error +=
+    test_policy6toregex ("E1E1::1;",
+                         "6-"DOT DOT DOT
+                         DOT "-E1E10000000000000000000000000001");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::1/120;",
+                         "6-"DOT DOT DOT
+                         DOT "-E1E1ABCD0000000000000000000000" DOT DOT);
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/126;",
+                         "6-"DOT DOT DOT
+                         DOT "-E1E1ABCD00000000000000000000ABC(C|D|E|F)");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/127;",
+                         "6-"DOT DOT DOT
+                         DOT "-E1E1ABCD00000000000000000000ABC(C|D)");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/128:80;",
+                         "6-0050-E1E1ABCD00000000000000000000ABCD");
+  return error;
+}
diff --git a/src/lib/util/test_scheduler.c b/src/lib/util/test_scheduler.c
new file mode 100644
index 000000000..4573518fd
--- /dev/null
+++ b/src/lib/util/test_scheduler.c
@@ -0,0 +1,294 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_scheduler.c
+ * @brief tests for the scheduler
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+static struct GNUNET_DISK_PipeHandle *p;
+
+static const struct GNUNET_DISK_FileHandle *fds[2];
+
+static struct GNUNET_SCHEDULER_Task *never_run_task;
+
+
+static void
+task2 (void *cls)
+{
+  int *ok = cls;
+
+  /* t3 should be ready (albeit with lower priority) */
+  GNUNET_assert (1 ==
+                 GNUNET_SCHEDULER_get_load (GNUNET_SCHEDULER_PRIORITY_COUNT));
+  GNUNET_assert (2 == *ok);
+  (*ok) = 3;
+}
+
+
+static void
+task3 (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (3 == *ok);
+  (*ok) = 4;
+}
+
+
+static void
+taskWrt (void *cls)
+{
+  static char c;
+  int *ok = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  GNUNET_assert (6 == *ok);
+  GNUNET_assert (GNUNET_NETWORK_fdset_handle_isset (tc->write_ready, fds[1]));
+  (*ok) = 7;
+  GNUNET_assert (1 == GNUNET_DISK_file_write (fds[1], &c, 1));
+}
+
+
+static void
+taskNeverRun (void *cls)
+{
+  GNUNET_assert (0);
+}
+
+
+static void
+taskLastRd (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (8 == *ok);
+  (*ok) = 0;
+}
+
+
+static void
+taskLastSig (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_SCHEDULER_cancel (never_run_task);
+  GNUNET_assert (9 == *ok);
+  (*ok) = 0;
+}
+
+
+static void
+taskLastShutdown (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (10 == *ok);
+  (*ok) = 0;
+}
+
+
+static void
+taskRd (void *cls)
+{
+  static char c;
+  int *ok = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  GNUNET_assert (7 == *ok);
+  GNUNET_assert (GNUNET_NETWORK_fdset_handle_isset (tc->read_ready, fds[0]));
+  GNUNET_assert (1 == GNUNET_DISK_file_read (fds[0], &c, 1));
+  (*ok) = 8;
+  GNUNET_SCHEDULER_add_shutdown (&taskLastRd,
+                                 cls);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+task4 (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (4 == *ok);
+  (*ok) = 6;
+  p = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+  GNUNET_assert (NULL != p);
+  fds[0] = GNUNET_DISK_pipe_handle (p, GNUNET_DISK_PIPE_END_READ);
+  fds[1] = GNUNET_DISK_pipe_handle (p, GNUNET_DISK_PIPE_END_WRITE);
+  GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                  fds[0],
+                                  &taskRd,
+                                  cls);
+  GNUNET_SCHEDULER_add_write_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                   fds[1],
+                                   &taskWrt,
+                                   cls);
+}
+
+
+static void
+task1 (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (1 == *ok);
+  (*ok) = 2;
+  GNUNET_SCHEDULER_add_now (&task3, cls);
+  GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_UI,
+                                      &task2,
+                                      cls);
+  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                &task4,
+                                cls);
+}
+
+
+/**
+ * Main method, starts scheduler with task1,
+ * checks that "ok" is correct at the end.
+ */
+static int
+check ()
+{
+  int ok;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "[Check scheduling]\n");
+  ok = 1;
+  GNUNET_SCHEDULER_run (&task1, &ok);
+  return ok;
+}
+
+
+static void
+taskShutdown (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (1 == *ok);
+  *ok = 10;
+  GNUNET_SCHEDULER_add_shutdown (&taskLastShutdown, cls);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Main method, starts scheduler with task1,
+ * checks that "ok" is correct at the end.
+ */
+static int
+checkShutdown ()
+{
+  int ok;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "[Check shutdown]\n");
+  ok = 1;
+  GNUNET_SCHEDULER_run (&taskShutdown, &ok);
+  return ok;
+}
+
+
+static void
+taskSig (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (1 == *ok);
+  *ok = 9;
+  GNUNET_SCHEDULER_add_shutdown (&taskLastSig, cls);
+  never_run_task =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply (
+                                    GNUNET_TIME_UNIT_SECONDS, 5),
+                                  &taskNeverRun,
+                                  NULL);
+  GNUNET_break (0 == kill (getpid (),
+                           GNUNET_TERM_SIG));
+}
+
+
+/**
+ * Main method, starts scheduler with task1,
+ * checks that "ok" is correct at the end.
+ */
+static int
+checkSignal (void)
+{
+  int ok;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "[Check signal handling]\n");
+  ok = 1;
+  GNUNET_SCHEDULER_run (&taskSig, &ok);
+  return ok;
+}
+
+
+static void
+taskCancel (void *cls)
+{
+  int *ok = cls;
+
+  GNUNET_assert (1 == *ok);
+  *ok = 0;
+  GNUNET_SCHEDULER_cancel (GNUNET_SCHEDULER_add_now (&taskNeverRun, NULL));
+}
+
+
+/**
+ * Main method, starts scheduler with task1,
+ * checks that "ok" is correct at the end.
+ */
+static int
+checkCancel ()
+{
+  int ok;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "[Check task cancellation]\n");
+  ok = 1;
+  GNUNET_SCHEDULER_run (&taskCancel, &ok);
+  return ok;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret = 0;
+
+  GNUNET_log_setup ("test_scheduler", "WARNING", NULL);
+  ret += check ();
+  ret += checkCancel ();
+  ret += checkSignal ();
+  ret += checkShutdown ();
+  GNUNET_DISK_pipe_close (p);
+
+  return ret;
+}
+
+
+/* end of test_scheduler.c */
diff --git a/src/lib/util/test_scheduler_delay.c b/src/lib/util/test_scheduler_delay.c
new file mode 100644
index 000000000..41990272a
--- /dev/null
+++ b/src/lib/util/test_scheduler_delay.c
@@ -0,0 +1,96 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_scheduler_delay.c
+ * @brief testcase for delay of scheduler, measures how
+ *  precise the timers are.  Expect values between 0.2 and 2 ms on
+ *  modern machines.
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static struct GNUNET_TIME_Absolute target;
+
+static int i;
+
+static unsigned long long cumDelta;
+
+#define INCR 47
+
+#define MAXV 5000
+
+
+/**
+ * Signature of the main function of a task.
+ *
+ * @param cls closure
+ */
+static void
+test_task (void *cls)
+{
+  struct GNUNET_TIME_Absolute now;
+
+  now = GNUNET_TIME_absolute_get ();
+  if (now.abs_value_us > target.abs_value_us)
+    cumDelta += (now.abs_value_us - target.abs_value_us);
+  else
+    cumDelta += (target.abs_value_us - now.abs_value_us);
+  target =
+    GNUNET_TIME_relative_to_absolute (GNUNET_TIME_relative_multiply
+                                        (GNUNET_TIME_UNIT_MICROSECONDS, i));
+  fprintf (stderr, "%s", ".");
+  if (i > MAXV)
+  {
+    fprintf (stderr, "%s", "\n");
+    return;
+  }
+  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                  (GNUNET_TIME_UNIT_MICROSECONDS, i),
+                                &test_task,
+                                NULL);
+  i += INCR;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_log_setup ("test-scheduler-delay",
+                    "WARNING",
+                    NULL);
+  target = GNUNET_TIME_absolute_get ();
+  GNUNET_SCHEDULER_run (&test_task, NULL);
+  fprintf (stdout,
+           "Sleep precision: %llu microseconds (average delta). ",
+           cumDelta / (MAXV / INCR));
+  if (cumDelta <= 500 * MAXV / INCR)
+    fprintf (stdout, "%s", "Timer precision is excellent.\n");
+  else if (cumDelta <= 5000 * MAXV / INCR)        /* 5 ms average deviation */
+    fprintf (stdout, "%s", "Timer precision is good.\n");
+  else if (cumDelta > 25000 * MAXV / INCR)
+    fprintf (stdout, "%s", "Timer precision is awful.\n");
+  else
+    fprintf (stdout, "%s", "Timer precision is acceptable.\n");
+  return 0;
+}
+
+
+/* end of test_scheduler_delay.c */
diff --git a/src/lib/util/test_scheduler_hogging_cancel.c b/src/lib/util/test_scheduler_hogging_cancel.c
new file mode 100644
index 000000000..7611338b3
--- /dev/null
+++ b/src/lib/util/test_scheduler_hogging_cancel.c
@@ -0,0 +1,51 @@
+#include "gnunet_util_lib.h"
+#include <unistd.h>
+
+static int count = 0;
+static int final_count;
+static struct GNUNET_SCHEDULER_Task *t4;
+
+static void end (void *cls)
+{
+  final_count = count;
+  count = 5000;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+static void self_rescheduling (void *cls)
+{
+  if (0 == count)
+  {
+    GNUNET_SCHEDULER_cancel (t4);
+    GNUNET_SCHEDULER_add_delayed_with_priority (GNUNET_TIME_UNIT_MILLISECONDS,
+                                                GNUNET_SCHEDULER_PRIORITY_URGENT,
+                                                &end,
+                                                NULL);
+    sleep (1);
+    /* end should be added to ready queue on next scheduler pass for certain
+       now */
+  }
+  if (++count < 5000)
+    {
+      GNUNET_SCHEDULER_add_now (&self_rescheduling, NULL);
+    }
+}
+
+static void to_be_canceled (void *cls)
+{
+  /* Don't run me! */
+}
+
+
+static void init (void *cls)
+{
+  GNUNET_SCHEDULER_add_now (&self_rescheduling, NULL);
+  t4 = GNUNET_SCHEDULER_add_now (&to_be_canceled, NULL);
+}
+
+
+int main (int argc, char **argv)
+{
+  GNUNET_SCHEDULER_run (&init, NULL);
+  return final_count < 5000 ? 0 : 1;
+}
diff --git a/src/lib/util/test_scheduler_hogging_priority.c b/src/lib/util/test_scheduler_hogging_priority.c
new file mode 100644
index 000000000..217a39ce7
--- /dev/null
+++ b/src/lib/util/test_scheduler_hogging_priority.c
@@ -0,0 +1,55 @@
+#include "gnunet_util_lib.h"
+#include <unistd.h>
+
+static int count = 0;
+static int final_count;
+
+static void end (void *cls)
+{
+  final_count = count;
+  count = 5000;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+static void self_rescheduling (void *cls)
+{
+  if (count == 0)
+  {
+    GNUNET_SCHEDULER_add_delayed_with_priority (GNUNET_TIME_UNIT_MILLISECONDS,
+                                                GNUNET_SCHEDULER_PRIORITY_URGENT,
+                                                &end,
+                                                NULL);
+    sleep(1);
+    /* end should be added to ready queue on next scheduler pass for certain
+       now */
+  }
+  if (++count < 5000)
+  {
+    GNUNET_SCHEDULER_add_now (&self_rescheduling, NULL);
+  }
+}
+
+
+static void noop (void *cls)
+{
+}
+
+static void indirection (void *cls)
+{
+  GNUNET_SCHEDULER_add_with_reason_and_priority (&self_rescheduling, NULL,
+                                                 GNUNET_SCHEDULER_REASON_STARTUP,
+                                                 GNUNET_SCHEDULER_PRIORITY_HIGH);
+}
+
+static void init (void *cls)
+{
+  GNUNET_SCHEDULER_add_now (&indirection, NULL);
+  GNUNET_SCHEDULER_add_now (&noop, NULL);
+}
+
+
+int main (int argc, char **argv)
+{
+  GNUNET_SCHEDULER_run (&init, NULL);
+  return final_count < 5000 ? 0 : 1;
+}
diff --git a/src/lib/util/test_service.c b/src/lib/util/test_service.c
new file mode 100644
index 000000000..198ae68ec
--- /dev/null
+++ b/src/lib/util/test_service.c
@@ -0,0 +1,239 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2013, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_service.c
+ * @brief tests for service.c
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Message type we use for testing.
+ */
+#define MY_TYPE 256
+
+#define TIMEOUT GNUNET_TIME_UNIT_SECONDS
+
+static int global_ret = 1;
+
+static struct GNUNET_MQ_Handle *mq;
+
+/**
+ * Timeout task.
+ */
+static struct GNUNET_SCHEDULER_Task *tt;
+
+
+static void
+handle_recv (void *cls,
+             const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received client message...\n");
+  GNUNET_SERVICE_client_continue (client);
+  global_ret = 2;
+  if (NULL != mq)
+  {
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+  }
+}
+
+
+/**
+ * Function called when the client connects to the service.
+ *
+ * @param cls the name of the service
+ * @param c connecting client
+ * @param mq message queue to talk to the client
+ * @return @a c so we have the client handle in the future
+ */
+static void *
+connect_cb (void *cls,
+            struct GNUNET_SERVICE_Client *c,
+            struct GNUNET_MQ_Handle *mq)
+{
+  /* FIXME: in the future, do something with mq
+     to test sending messages to the client! */
+  return c;
+}
+
+
+/**
+ * Function called when the client disconnects.
+ *
+ * @param cls our service name
+ * @param c disconnecting client
+ * @param internal_cls must match @a c
+ */
+static void
+disconnect_cb (void *cls,
+               struct GNUNET_SERVICE_Client *c,
+               void *internal_cls)
+{
+  GNUNET_assert (c == internal_cls);
+  if (2 == global_ret)
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    global_ret = 0;
+    if (NULL != tt)
+    {
+      GNUNET_SCHEDULER_cancel (tt);
+      tt = NULL;
+    }
+  }
+}
+
+
+static void
+timeout_task (void *cls)
+{
+  tt = NULL;
+  if (NULL != mq)
+  {
+    GNUNET_MQ_destroy (mq);
+    mq = NULL;
+  }
+  global_ret = 33;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Initialization function of the service.  Starts
+ * a client to connect to the service.
+ *
+ * @param cls the name of the service (const char *)
+ * @param cfg the configuration we use
+ * @param sh handle to the service
+ */
+static void
+service_init (void *cls,
+              const struct GNUNET_CONFIGURATION_Handle *cfg,
+              struct GNUNET_SERVICE_Handle *sh)
+{
+  const char *service_name = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  GNUNET_assert (NULL == tt);
+  tt = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                     &timeout_task,
+                                     NULL);
+  mq = GNUNET_CLIENT_connect (cfg,
+                              service_name,
+                              NULL,
+                              NULL,
+                              NULL);
+  GNUNET_assert (NULL != mq);
+  env = GNUNET_MQ_msg (msg,
+                       MY_TYPE);
+  GNUNET_MQ_send (mq,
+                  env);
+}
+
+
+/**
+ * Main method, starts the service and initiates
+ * the running of the test.
+ *
+ * @param sname name of the service to run
+ */
+static int
+check (const char *sname)
+{
+  struct GNUNET_MQ_MessageHandler myhandlers[] = {
+    GNUNET_MQ_hd_fixed_size (recv,
+                             MY_TYPE,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+  char *const argv[] = {
+    (char *) sname,
+    "-c",
+    "test_service_data.conf",
+    NULL
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting `%s' service\n",
+              sname);
+  global_ret = 1;
+  GNUNET_assert (0 ==
+                 GNUNET_SERVICE_run_ (3,
+                                      argv,
+                                      sname,
+                                      GNUNET_SERVICE_OPTION_NONE,
+                                      &service_init,
+                                      &connect_cb,
+                                      &disconnect_cb,
+                                      (void *) sname,
+                                      myhandlers));
+  return global_ret;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int ret = 0;
+  struct GNUNET_NETWORK_Handle *s = NULL;
+
+  GNUNET_log_setup ("test-service",
+                    "WARNING",
+                    NULL);
+  ret += check ("test_service");
+  ret += check ("test_service");
+  s = GNUNET_NETWORK_socket_create (PF_INET6,
+                                    SOCK_STREAM,
+                                    0);
+
+  if (NULL == s)
+  {
+    if ((errno == ENOBUFS) ||
+        (errno == ENOMEM) ||
+        (errno == ENFILE) ||
+        (errno == EACCES))
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                           "socket");
+      return 1;
+    }
+    fprintf (stderr,
+             "IPv6 support seems to not be available (%s), not testing it!\n",
+             strerror (errno));
+  }
+  else
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (s));
+    ret += check ("test_service6");
+  }
+  return ret;
+}
+
+
+/* end of test_service.c */
diff --git a/src/lib/util/test_service_data.conf b/src/lib/util/test_service_data.conf
new file mode 100644
index 000000000..3263a52c0
--- /dev/null
+++ b/src/lib/util/test_service_data.conf
@@ -0,0 +1,28 @@
+[test_service]
+PORT=12435
+BINDTO=127.0.0.1
+PIDFILE=$GNUNET_TMP/test-service.pid
+MAXBUF=1024
+DISABLEV6=NO
+ACCEPT_FROM=127.0.0.1;
+REJECT_FROM=1.2.3.0/15;4.5.0.0/8;6.7.8.9/255.255.255.0;
+ACCEPT_FROM6=::1;
+REJECT_FROM6=AB:CD:EF::00;AB:CD::00/40;
+HOSTNAME=localhost
+
+[test_service6]
+PORT=12435
+PIDFILE=$GNUNET_TMP/test-service.pid
+TIMEOUT=30 s
+MAXBUF=1024
+DISABLEV6=NO
+ACCEPT_FROM=127.0.0.1;
+REJECT_FROM=1.2.3.0/15;4.5.0.0/8;6.7.8.9/255.255.255.0;
+ACCEPT_FROM6=::1;
+REJECT_FROM6=AB:CD:EF::00;AB:CD::00/40;
+HOSTNAME=::1
+
+[resolver]
+HOSTNAME=localhost
+
+
diff --git a/src/lib/util/test_socks.c b/src/lib/util/test_socks.c
new file mode 100644
index 000000000..680ecada5
--- /dev/null
+++ b/src/lib/util/test_socks.c
@@ -0,0 +1,258 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_socks.c
+ * @brief tests for socks.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define PORT 35124
+
+#define MYNAME "test_sockst"
+
+static struct GNUNET_MQ_Handle *mq;
+
+static struct GNUNET_SERVER_Handle *server;
+
+static struct GNUNET_CONFIGURATION_Handle *cfg;
+
+#define MY_TYPE 130
+
+struct CopyContext
+{
+  struct GNUNET_SERVER_Client *client;
+  struct GNUNET_MessageHeader *cpy;
+};
+
+static size_t
+copy_msg (void *cls, size_t size, void *buf)
+{
+  struct CopyContext *ctx = cls;
+  struct GNUNET_MessageHeader *cpy = ctx->cpy;
+
+  GNUNET_assert (sizeof(struct GNUNET_MessageHeader) == ntohs (cpy->size));
+  GNUNET_assert (size >= ntohs (cpy->size));
+  GNUNET_memcpy (buf, cpy, ntohs (cpy->size));
+  GNUNET_SERVER_receive_done (ctx->client, GNUNET_OK);
+  GNUNET_free (cpy);
+  GNUNET_free (ctx);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Message bounced back to client\n");
+  return sizeof(struct GNUNET_MessageHeader);
+}
+
+
+/**
+ * Callback that just bounces the message back to the sender.
+ */
+static void
+echo_cb (void *cls, struct GNUNET_SERVER_Client *client,
+         const struct GNUNET_MessageHeader *message)
+{
+  struct CopyContext *cc;
+  struct GNUNET_MessageHeader *cpy;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving message from client, bouncing back\n");
+  GNUNET_assert (sizeof(struct GNUNET_MessageHeader) == ntohs (message->size));
+  cc = GNUNET_new (struct CopyContext);
+  cc->client = client;
+  cpy = GNUNET_malloc (ntohs (message->size));
+  GNUNET_memcpy (cpy, message, ntohs (message->size));
+  cc->cpy = cpy;
+  GNUNET_assert (NULL !=
+                 GNUNET_SERVER_notify_transmit_ready (client,
+                                                      ntohs (message->size),
+                                                      GNUNET_TIME_UNIT_SECONDS,
+                                                      &copy_msg, cc));
+}
+
+
+static struct GNUNET_SERVER_MessageHandler handlers[] = {
+  { &echo_cb, NULL, MY_TYPE, sizeof(struct GNUNET_MessageHeader) },
+  { NULL, NULL, 0, 0 }
+};
+
+
+static void
+handle_bounce (void *cls,
+               const struct GNUNET_MessageHeader *got)
+{
+  int *ok = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving bounce, checking content\n");
+  GNUNET_assert (NULL != got);
+  GNUNET_MQ_destroy (mq);
+  mq = NULL;
+  GNUNET_SERVER_destroy (server);
+  server = NULL;
+  *ok = 0;
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_STATISTICS_Handle *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  GNUNET_assert (0);  /* should never happen */
+}
+
+
+static void
+task (void *cls)
+{
+  struct sockaddr_in sa;
+  struct sockaddr *sap[2];
+  socklen_t slens[2];
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+  struct GNUNET_MQ_MessageHandler chandlers[] = {
+    GNUNET_MQ_hd_fixed_size (bounce,
+                             MY_TYPE,
+                             struct GNUNET_MessageHeader,
+                             cls),
+    GNUNET_MQ_handler_end ()
+  };
+
+  /* test IPC between client and server */
+  sap[0] = (struct sockaddr *) &sa;
+  slens[0] = sizeof(sa);
+  sap[1] = NULL;
+  slens[1] = 0;
+  memset (&sa, 0, sizeof(sa));
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  sa.sin_len = sizeof(sa);
+#endif
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons (PORT);
+  server =
+    GNUNET_SERVER_create (NULL, NULL, sap, slens,
+                          GNUNET_TIME_relative_multiply
+                            (GNUNET_TIME_UNIT_MILLISECONDS, 10000), GNUNET_NO);
+  GNUNET_assert (server != NULL);
+  handlers[0].callback_cls = cls;
+  handlers[1].callback_cls = cls;
+  GNUNET_SERVER_add_handlers (server, handlers);
+  mq = GNUNET_CLIENT_connect (cfg,
+                              MYNAME,
+                              chandlers,
+                              &mq_error_handler,
+                              NULL);
+  GNUNET_assert (NULL != mq);
+  env = GNUNET_MQ_msg (msg,
+                       MY_TYPE);
+  GNUNET_MQ_send (mq,
+                  env);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ok;
+  int status;
+  const char *socksport = "1081";
+
+  GNUNET_log_setup ("test_client",
+                    "WARNING",
+                    NULL);
+
+  pid_t pid = fork ();
+  GNUNET_assert (pid >= 0);
+  if (pid == 0)
+  {
+    execlp ("ssh",
+            "ssh", "-D", socksport,
+            "-o", "BatchMode yes",
+            "-o", "UserKnownHostsFile /tmp/gnunet_test_socks_ssh_garbage",
+            "-o", "StrictHostKeyChecking no",
+            "127.0.0.1", "-N", (char *) NULL);
+    perror (
+      "execlp (\"ssh\",\"ssh\",...,\"-D\",\"1081\",\"127.0.0.1\",\"-N\") ");
+    printf (""
+            "Please ensure you have ssh installed and have sshd installed and running :\n"
+            "\tsudo apt-get install openssh-client openssh-server\n"
+            "If you run Tor as a network proxy then Tor might prevent ssh from connecting\n"
+            "to localhost.  Please either run  make check  from an unproxied user, or else\n"
+            "add these lines to the beginning of your ~/.ssh/config file :"
+            "\tHost 127.0.0.1 localhost\n"
+            "\t  CheckHostIP no\n"
+            "\t  Protocol 2\n"
+            "\t  ProxyCommand nc 127.0.0.1 22\n");
+    kill (getppid (), SIGALRM);
+    return 1;
+  }
+  if (0 != sleep (1))
+  {
+    /* sleep interrupted, likely SIGALRM, failure to
+       launch child, terminate */
+    printf (""
+            "Please ensure you have ssh installed and have sshd installed and running :\n"
+            "\tsudo apt-get install openssh-client openssh-server\n"
+            "If you run Tor as a network proxy then Tor might prevent ssh from connecting\n"
+            "to localhost.  Please either run  make check  from an unproxied user, or else\n"
+            "add these lines to the beginning of your ~/.ssh/config file :"
+            "\tHost 127.0.0.1 localhost\n"
+            "\t  CheckHostIP no\n"
+            "\t  Protocol 2\n"
+            "\t  ProxyCommand nc 127.0.0.1 22\n");
+    return 77;
+  }
+  /* check if child exec()ed but died */
+  if (0 != waitpid (pid, &status, WNOHANG))
+  {
+    printf (""
+            "If you run Tor as a network proxy then Tor might prevent ssh from connecting\n"
+            "to localhost.  Please either run  make check  from an unproxied user, or else\n"
+            "add these lines to the beginning of your ~/.ssh/config file :"
+            "\tHost 127.0.0.1 localhost\n"
+            "\t  CheckHostIP no\n"
+            "\t  Protocol 2\n"
+            "\t  ProxyCommand nc 127.0.0.1 22\n");
+    return 77;
+  }
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  GNUNET_CONFIGURATION_set_value_string (cfg, MYNAME, "SOCKSHOST", "127.0.0.1");
+  GNUNET_CONFIGURATION_set_value_string (cfg, MYNAME, "SOCKSPORT", socksport);
+  GNUNET_CONFIGURATION_set_value_number (cfg, MYNAME, "PORT", PORT);
+  GNUNET_CONFIGURATION_set_value_string (cfg, MYNAME, "HOSTNAME", "127.0.0.1");
+  ok = 1;
+  GNUNET_SCHEDULER_run (&task, &ok);
+  GNUNET_CONFIGURATION_destroy (cfg);
+
+  GNUNET_break (0 == kill (pid, SIGTERM));
+  GNUNET_break (pid == waitpid (pid, &status, 0));
+  return ok;
+}
+
+
+/* end of test_socks.c */
diff --git a/src/lib/util/test_speedup.c b/src/lib/util/test_speedup.c
new file mode 100644
index 000000000..58d78641b
--- /dev/null
+++ b/src/lib/util/test_speedup.c
@@ -0,0 +1,127 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011-2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_speedup.c
+ * @brief testcase for speedup.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Start time of the testcase
+ */
+static struct GNUNET_TIME_Absolute start;
+
+/**
+ * End-time of the testcase (affected by speed-up)
+ */
+static struct GNUNET_TIME_Absolute end;
+
+/**
+ * Number of cycles we have spent in 'run'.
+ */
+static unsigned int cycles;
+
+
+/**
+ * Main task that is scheduled with the speed-up.
+ *
+ * @param cls NULL
+ * @param tc scheduler context, unused
+ */
+static void
+run (void *cls)
+{
+  cycles++;
+  fprintf (stderr, "..%u", cycles);
+  if (cycles <= 5)
+  {
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                  &run,
+                                  NULL);
+    return;
+  }
+  end = GNUNET_TIME_absolute_get ();
+  fprintf (stderr, "\n");
+  fflush (stdout);
+}
+
+
+/**
+ *
+ */
+static void
+check (void *cls,
+       char *const *args,
+       const char *cfgfile,
+       const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  fprintf (stderr, "0");
+  fflush (stdout);
+  GNUNET_SCHEDULER_add_now (&run, NULL);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  static char *const argvn[] = {
+    "test-speedup",
+    "-c", "test_speedup_data.conf",
+    NULL
+  };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+  time_t start_real;
+  time_t end_real;
+  struct GNUNET_TIME_Relative delta;
+
+  start_real = time (NULL);
+  start = GNUNET_TIME_absolute_get ();
+  GNUNET_PROGRAM_run ((sizeof(argvn) / sizeof(char *)) - 1, argvn,
+                      "test-speedup",
+                      "nohelp", options, &check, NULL);
+
+  end_real = time (NULL);
+  delta = GNUNET_TIME_absolute_get_difference (start, end);
+
+  if (delta.rel_value_us > ((end_real - start_real) * 1500LL * 1000LL))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Execution time in GNUnet time: %s\n",
+                GNUNET_STRINGS_relative_time_to_string (delta, GNUNET_YES));
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Execution time in system time: %llu ms\n",
+                (unsigned long long) ((end_real - start_real) * 1000LL));
+    return 0;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Execution time in GNUnet time: %s\n",
+              GNUNET_STRINGS_relative_time_to_string (delta, GNUNET_YES));
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Execution time in system time: %llu ms\n",
+              (unsigned long long) ((end_real - start_real) * 1000LL));
+  return 1;
+}
+
+
+/* end of test_speedup.c */
diff --git a/src/lib/util/test_speedup_data.conf b/src/lib/util/test_speedup_data.conf
new file mode 100644
index 000000000..699cdc933
--- /dev/null
+++ b/src/lib/util/test_speedup_data.conf
@@ -0,0 +1,3 @@
+[testing]
+SPEEDUP_INTERVAL = 100 ms
+SPEEDUP_DELTA = 100 ms
diff --git a/src/lib/util/test_strings.c b/src/lib/util/test_strings.c
new file mode 100644
index 000000000..806324be3
--- /dev/null
+++ b/src/lib/util/test_strings.c
@@ -0,0 +1,174 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_strings.c
+ * @brief testcase for strings.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+#define WANT(a, b) if (0 != strcmp (a, b)) { fprintf (stderr, \
+                                                      "Got `%s', wanted `%s'\n", \
+                                                      b, a); GNUNET_free (b); \
+                                             GNUNET_break (0); \
+                                             return 1; } else { GNUNET_free (b); \
+}
+#define WANTNF(a, b) do { if (0 != strcmp (a, b)) { fprintf (stderr, \
+                                                             "Got `%s', wanted `%s'\n", \
+                                                             b, a); \
+                                                    GNUNET_break (0); return 1; \
+                          } } while (0)
+#define WANTB(a, b, l) if (0 != memcmp (a, b, l)) { GNUNET_break (0); return 1; \
+} else { }
+
+#define URLENCODE_TEST_VECTOR_PLAIN "Asbjlaw=ljsdlasjd?人aslkdsa"
+
+#define URLENCODE_TEST_VECTOR_ENCODED \
+  "Asbjlaw\%3Dljsdlasjd\%3F\%E4\%BA\%BAaslkdsa"
+
+int
+main (int argc, char *argv[])
+{
+  char buf[128];
+  char *r;
+  char *b;
+  const char *bc;
+  struct GNUNET_TIME_Absolute at;
+  struct GNUNET_TIME_Absolute atx;
+  struct GNUNET_TIME_Relative rt;
+  struct GNUNET_TIME_Relative rtx;
+  const char *hdir;
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *pol;
+
+  pol = GNUNET_STRINGS_parse_ipv6_policy ("::1;");
+  GNUNET_assert (NULL != pol);
+  GNUNET_free (pol);
+
+  GNUNET_log_setup ("test_strings", "ERROR", NULL);
+  sprintf (buf, "4 %s", _ (/* size unit */ "b"));
+  b = GNUNET_STRINGS_byte_size_fancy (4);
+  WANT (buf, b);
+  sprintf (buf, "10 %s", _ (/* size unit */ "KiB"));
+  b = GNUNET_STRINGS_byte_size_fancy (10240);
+  WANT (buf, b);
+  sprintf (buf, "10 %s", _ (/* size unit */ "TiB"));
+  b = GNUNET_STRINGS_byte_size_fancy (10240LL * 1024LL * 1024LL * 1024LL);
+  WANT (buf, b);
+  sprintf (buf, "4 %s", _ (/* time unit */ "ms"));
+  bc = GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_relative_multiply
+                                                 (GNUNET_TIME_UNIT_MILLISECONDS,
+                                                 4), GNUNET_YES);
+  WANTNF (buf, bc);
+  sprintf (buf, "7 %s", _ (/* time unit */ "s"));
+  bc = GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_relative_multiply
+                                                 (GNUNET_TIME_UNIT_MILLISECONDS,
+                                                 7 * 1000), GNUNET_YES);
+  WANTNF (buf, bc);
+  sprintf (buf, "7 %s", _ (/* time unit */ "h"));
+  bc = GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_relative_multiply
+                                                 (GNUNET_TIME_UNIT_MILLISECONDS,
+                                                 7 * 60 * 60 * 1000),
+                                               GNUNET_YES);
+  WANTNF (buf, bc);
+
+  hdir = getenv ("HOME");
+
+  GNUNET_snprintf (buf, sizeof(buf), "%s%s", hdir, DIR_SEPARATOR_STR);
+  b = GNUNET_STRINGS_filename_expand ("~");
+  GNUNET_assert (b != NULL);
+  WANT (buf, b);
+  GNUNET_STRINGS_buffer_fill (buf, sizeof(buf), 3, "a", "btx", "c");
+  WANTB ("a\0btx\0c", buf, 8);
+  if (6 != GNUNET_STRINGS_buffer_tokenize (buf, sizeof(buf), 2, &r, &b))
+    return 1;
+  r = GNUNET_strdup (r);
+  WANT ("a", r);
+  b = GNUNET_strdup (b);
+  WANT ("btx", b);
+  if (0 != GNUNET_STRINGS_buffer_tokenize (buf, 2, 2, &r, &b))
+    return 1;
+  at.abs_value_us = 5000000;
+  bc = GNUNET_STRINGS_absolute_time_to_string (at);
+  /* bc should be something like "Wed Dec 31 17:00:05 1969"
+   * where the details of the day and hour depend on the timezone;
+   * however, the "0:05 19" should always be there; hence: */
+  if (NULL == strstr (bc, "0:05 19"))
+  {
+    fprintf (stderr, "Got %s\n", bc);
+    GNUNET_break (0);
+    return 1;
+  }
+  /* Normalization */
+  r = "q\u0307\u0323"; /* Non-canonical order */
+
+  b = GNUNET_STRINGS_utf8_normalize (r);
+  GNUNET_assert (0 == strcmp ("q\u0323\u0307", b));
+  GNUNET_free (b);
+  b = GNUNET_STRINGS_to_utf8 ("TEST", 4, "ASCII");
+  WANT ("TEST", b);
+
+  at = GNUNET_TIME_UNIT_FOREVER_ABS;
+  bc = GNUNET_STRINGS_absolute_time_to_string (at);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_STRINGS_fancy_time_to_absolute (bc, &atx));
+  GNUNET_assert (atx.abs_value_us == at.abs_value_us);
+
+  at.abs_value_us = 50000000000;
+  bc = GNUNET_STRINGS_absolute_time_to_string (at);
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_STRINGS_fancy_time_to_absolute (bc, &atx));
+
+  if (atx.abs_value_us != at.abs_value_us)
+  {
+    GNUNET_assert (0);
+  }
+
+  GNUNET_log_skip (2, GNUNET_NO);
+  b = GNUNET_STRINGS_to_utf8 ("TEST", 4, "unknown");
+  GNUNET_log_skip (0, GNUNET_YES);
+  WANT ("TEST", b);
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_STRINGS_fancy_time_to_relative ("15m", &rt));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_STRINGS_fancy_time_to_relative ("15 m", &rtx));
+  GNUNET_assert (rt.rel_value_us == rtx.rel_value_us);
+
+  GNUNET_assert (0 != GNUNET_STRINGS_urlencode (strlen (
+                                                  URLENCODE_TEST_VECTOR_PLAIN),
+                                                URLENCODE_TEST_VECTOR_PLAIN,
+                                                &b));
+  WANT (URLENCODE_TEST_VECTOR_ENCODED, b);
+  GNUNET_free (b);
+  GNUNET_assert (0 !=
+                 GNUNET_STRINGS_urldecode (
+                   URLENCODE_TEST_VECTOR_ENCODED,
+                   strlen (URLENCODE_TEST_VECTOR_ENCODED),
+                   &b));
+  WANT (URLENCODE_TEST_VECTOR_PLAIN, b);
+  GNUNET_free (b);
+  return 0;
+}
+
+
+/* end of test_strings.c */
diff --git a/src/lib/util/test_strings_to_data.c b/src/lib/util/test_strings_to_data.c
new file mode 100644
index 000000000..75cbd135d
--- /dev/null
+++ b/src/lib/util/test_strings_to_data.c
@@ -0,0 +1,66 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_strings_to_data.c
+ * @brief testcase for strings.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+int
+main (int argc, char *argv[])
+{
+  char buf[1024];
+  char *end;
+  char src[128];
+  char dst[128];
+  unsigned int i;
+  int ret = 0;
+
+  GNUNET_log_setup ("util", "DEBUG", NULL);
+  for (i = 0; i < sizeof(src); i++)
+  {
+    memset (src, i, sizeof(src));
+    memset (dst, i + 1, sizeof(dst));
+
+    end = GNUNET_STRINGS_data_to_string (&src, i, buf, sizeof(buf));
+    GNUNET_assert (NULL != end);
+    end[0] = '\0';
+    if (GNUNET_OK !=
+        GNUNET_STRINGS_string_to_data (buf, strlen (buf), dst, i))
+    {
+      fprintf (stderr, "%u failed decode (%u bytes)\n", i, (unsigned
+                                                            int) strlen (buf));
+      ret = 1;
+    }
+    else if (0 != memcmp (src, dst, i))
+    {
+      fprintf (stderr, "%u wrong decode (%u bytes)\n", i, (unsigned
+                                                           int) strlen (buf));
+      ret = 1;
+    }
+  }
+  return ret;
+}
+
+
+/* end of test_strings_to_data.c */
diff --git a/src/lib/util/test_time.c b/src/lib/util/test_time.c
new file mode 100644
index 000000000..35f270a44
--- /dev/null
+++ b/src/lib/util/test_time.c
@@ -0,0 +1,265 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2013, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file util/test_time.c
+ * @brief testcase for time.c
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+int
+main (int argc, char *argv[])
+{
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_AbsoluteNBO nown;
+  struct GNUNET_TIME_Absolute future;
+  struct GNUNET_TIME_Absolute past;
+  struct GNUNET_TIME_Absolute last;
+  struct GNUNET_TIME_Absolute forever;
+  struct GNUNET_TIME_Absolute zero;
+  struct GNUNET_TIME_Relative rel;
+  struct GNUNET_TIME_Relative relForever;
+  struct GNUNET_TIME_Relative relUnit;
+  struct GNUNET_TIME_RelativeNBO reln;
+  unsigned int i;
+
+  GNUNET_log_setup ("test-time", "WARNING", NULL);
+  forever = GNUNET_TIME_UNIT_FOREVER_ABS;
+  relForever = GNUNET_TIME_UNIT_FOREVER_REL;
+  relUnit = GNUNET_TIME_UNIT_MILLISECONDS;
+  zero.abs_value_us = 0;
+
+  last = now = GNUNET_TIME_absolute_get ();
+  while (now.abs_value_us == last.abs_value_us)
+    now = GNUNET_TIME_absolute_get ();
+  GNUNET_assert (now.abs_value_us > last.abs_value_us);
+
+  /* test overflow checking in multiply */
+  rel = GNUNET_TIME_UNIT_MILLISECONDS;
+  GNUNET_log_skip (1, GNUNET_NO);
+  for (i = 0; i < 55; i++)
+    rel = GNUNET_TIME_relative_multiply (rel, 2);
+  GNUNET_log_skip (0, GNUNET_NO);
+  GNUNET_assert (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us);
+  /*check zero */
+  rel.rel_value_us = (UINT64_MAX) -1024;
+  GNUNET_assert (GNUNET_TIME_UNIT_ZERO.rel_value_us ==
+                 GNUNET_TIME_relative_multiply (rel, 0).rel_value_us);
+
+  /* test infinity-check for relative to absolute */
+  GNUNET_log_skip (1, GNUNET_NO);
+  last = GNUNET_TIME_relative_to_absolute (rel);
+  GNUNET_assert (last.abs_value_us ==
+                 GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us);
+  GNUNET_log_skip (0, GNUNET_YES);
+
+  /* check relative to absolute */
+  rel.rel_value_us = 1000000;
+  GNUNET_assert (GNUNET_TIME_absolute_get ().abs_value_us <
+                 GNUNET_TIME_relative_to_absolute (rel).abs_value_us);
+  /*check forever */
+  rel.rel_value_us = UINT64_MAX;
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us ==
+                 GNUNET_TIME_relative_to_absolute (rel).abs_value_us);
+  /* check overflow for r2a */
+  rel.rel_value_us = (UINT64_MAX) -1024;
+  GNUNET_log_skip (1, GNUNET_NO);
+  last = GNUNET_TIME_relative_to_absolute (rel);
+  GNUNET_log_skip (0, GNUNET_NO);
+  GNUNET_assert (last.abs_value_us ==
+                 GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us);
+
+  /* check overflow for relative add */
+  GNUNET_log_skip (1, GNUNET_NO);
+  rel = GNUNET_TIME_relative_add (rel, rel);
+  GNUNET_log_skip (0, GNUNET_NO);
+  GNUNET_assert (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us);
+
+  GNUNET_log_skip (1, GNUNET_NO);
+  rel = GNUNET_TIME_relative_add (relForever, relForever);
+  GNUNET_log_skip (0, GNUNET_NO);
+  GNUNET_assert (rel.rel_value_us == relForever.rel_value_us);
+
+  GNUNET_log_skip (1, GNUNET_NO);
+  rel = GNUNET_TIME_relative_add (relUnit, relUnit);
+  GNUNET_assert (rel.rel_value_us == 2 * relUnit.rel_value_us);
+
+  /* check relation check in get_duration */
+  future.abs_value_us = now.abs_value_us + 1000000;
+  GNUNET_assert (GNUNET_TIME_absolute_get_difference (now,
+                                                      future).rel_value_us ==
+                 1000000);
+  GNUNET_assert (GNUNET_TIME_absolute_get_difference (future,
+                                                      now).rel_value_us ==
+                 0);
+
+  GNUNET_assert (GNUNET_TIME_absolute_get_difference (zero,
+                                                      forever).rel_value_us
+                 == forever.abs_value_us);
+
+  past.abs_value_us = now.abs_value_us - 1000000;
+  rel = GNUNET_TIME_absolute_get_duration (future);
+  GNUNET_assert (rel.rel_value_us == 0);
+  rel = GNUNET_TIME_absolute_get_duration (past);
+  GNUNET_assert (rel.rel_value_us >= 1000000);
+
+  /* check get remaining */
+  rel = GNUNET_TIME_absolute_get_remaining (now);
+  GNUNET_assert (rel.rel_value_us == 0);
+  rel = GNUNET_TIME_absolute_get_remaining (past);
+  GNUNET_assert (rel.rel_value_us == 0);
+  rel = GNUNET_TIME_absolute_get_remaining (future);
+  GNUNET_assert (rel.rel_value_us > 0);
+  GNUNET_assert (rel.rel_value_us <= 1000000);
+  forever = GNUNET_TIME_UNIT_FOREVER_ABS;
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us ==
+                 GNUNET_TIME_absolute_get_remaining (forever).rel_value_us);
+
+  /* check endianness */
+  reln = GNUNET_TIME_relative_hton (rel);
+  GNUNET_assert (rel.rel_value_us == GNUNET_TIME_relative_ntoh (
+                   reln).rel_value_us);
+  nown = GNUNET_TIME_absolute_hton (now);
+  GNUNET_assert (now.abs_value_us == GNUNET_TIME_absolute_ntoh (
+                   nown).abs_value_us);
+
+  /* check absolute addition */
+  future = GNUNET_TIME_absolute_add (now, GNUNET_TIME_UNIT_SECONDS);
+  GNUNET_assert (future.abs_value_us == now.abs_value_us + 1000 * 1000LL);
+
+  future = GNUNET_TIME_absolute_add (forever, GNUNET_TIME_UNIT_ZERO);
+  GNUNET_assert (future.abs_value_us == forever.abs_value_us);
+
+  rel.rel_value_us = (UINT64_MAX) -1024;
+  now.abs_value_us = rel.rel_value_us;
+  future = GNUNET_TIME_absolute_add (now, rel);
+  GNUNET_assert (future.abs_value_us == forever.abs_value_us);
+
+  /* check zero */
+  future = GNUNET_TIME_absolute_add (now, GNUNET_TIME_UNIT_ZERO);
+  GNUNET_assert (future.abs_value_us == now.abs_value_us);
+
+  GNUNET_assert (forever.abs_value_us ==
+                 GNUNET_TIME_absolute_subtract (forever,
+                                                GNUNET_TIME_UNIT_MINUTES).
+                 abs_value_us);
+  /*check absolute subtract */
+  now.abs_value_us = 50000;
+  rel.rel_value_us = 100000;
+  GNUNET_assert (GNUNET_TIME_UNIT_ZERO_ABS.abs_value_us ==
+                 (GNUNET_TIME_absolute_subtract (now, rel)).abs_value_us);
+  rel.rel_value_us = 10000;
+  GNUNET_assert (40000 == (GNUNET_TIME_absolute_subtract (now,
+                                                          rel)).abs_value_us);
+
+  /*check relative divide */
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us ==
+                 (GNUNET_TIME_relative_divide (rel, 0)).rel_value_us);
+
+  rel = GNUNET_TIME_UNIT_FOREVER_REL;
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us ==
+                 (GNUNET_TIME_relative_divide (rel, 2)).rel_value_us);
+
+  rel = GNUNET_TIME_relative_divide (relUnit, 2);
+  GNUNET_assert (rel.rel_value_us == relUnit.rel_value_us / 2);
+
+
+  /* check Return absolute time of 0ms */
+  zero = GNUNET_TIME_UNIT_ZERO_ABS;
+
+  /* check GNUNET_TIME_calculate_eta */
+  last.abs_value_us = GNUNET_TIME_absolute_get ().abs_value_us - 1024;
+  forever = GNUNET_TIME_UNIT_FOREVER_ABS;
+  forever.abs_value_us = forever.abs_value_us - 1024;
+  GNUNET_assert (GNUNET_TIME_UNIT_ZERO_ABS.abs_value_us ==
+                 GNUNET_TIME_calculate_eta (forever, 50000,
+                                            100000).rel_value_us);
+  /* check zero */
+  GNUNET_log_skip (1, GNUNET_NO);
+  GNUNET_assert (GNUNET_TIME_UNIT_ZERO.rel_value_us ==
+                 (GNUNET_TIME_calculate_eta (last, 60000, 50000)).rel_value_us);
+  GNUNET_log_skip (0, GNUNET_YES);
+  /*check forever */
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us ==
+                 (GNUNET_TIME_calculate_eta (last, 0, 50000)).rel_value_us);
+
+  /*check relative subtract */
+  now = GNUNET_TIME_absolute_get ();
+  rel.rel_value_us = now.abs_value_us;
+  relForever.rel_value_us = rel.rel_value_us + 1024;
+  GNUNET_assert (1024 ==
+                 GNUNET_TIME_relative_subtract (relForever, rel).rel_value_us);
+  /*check zero */
+  GNUNET_assert (GNUNET_TIME_UNIT_ZERO.rel_value_us ==
+                 GNUNET_TIME_relative_subtract (rel, relForever).rel_value_us);
+  /*check forever */
+  rel.rel_value_us = UINT64_MAX;
+  GNUNET_assert (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us ==
+                 GNUNET_TIME_relative_subtract (rel, relForever).rel_value_us);
+
+  /*check GNUNET_TIME_relative_min */
+  now = GNUNET_TIME_absolute_get ();
+  rel.rel_value_us = now.abs_value_us;
+  relForever.rel_value_us = rel.rel_value_us - 1024;
+  GNUNET_assert (relForever.rel_value_us ==
+                 GNUNET_TIME_relative_min (rel, relForever).rel_value_us);
+
+  /*check GNUNET_TIME_relative_max */
+  GNUNET_assert (rel.rel_value_us ==
+                 GNUNET_TIME_relative_max (rel, relForever).rel_value_us);
+
+  /*check GNUNET_TIME_absolute_min */
+  now = GNUNET_TIME_absolute_get ();
+  last.abs_value_us = now.abs_value_us - 1024;
+  GNUNET_assert (last.abs_value_us ==
+                 GNUNET_TIME_absolute_min (now, last).abs_value_us);
+
+  /*check  GNUNET_TIME_absolute_max */
+  GNUNET_assert (now.abs_value_us ==
+                 GNUNET_TIME_absolute_max (now, last).abs_value_us);
+  for (unsigned int i = 0; i < 30; i++)
+  {
+    struct GNUNET_CONFIGURATION_Handle *cfg;
+
+    cfg = GNUNET_CONFIGURATION_create ();
+    last = GNUNET_TIME_absolute_get_monotonic (cfg);
+    now = GNUNET_TIME_absolute_get_monotonic (cfg);
+    GNUNET_assert (now.abs_value_us > last.abs_value_us);
+    (void) GNUNET_TIME_absolute_get_monotonic (NULL);
+    GNUNET_CONFIGURATION_set_value_string (cfg,
+                                           "util",
+                                           "MONOTONIC_TIME_FILENAME",
+                                           "monotonic-time.dat");
+    last = GNUNET_TIME_absolute_get_monotonic (cfg);
+    now = GNUNET_TIME_absolute_get_monotonic (cfg);
+    (void) GNUNET_TIME_absolute_get_monotonic (NULL);
+    GNUNET_assert (now.abs_value_us > last.abs_value_us);
+    GNUNET_CONFIGURATION_destroy (cfg);
+  }
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_DISK_directory_remove ("monotonic-time.dat"));
+
+  return 0;
+}
+
+
+/* end of test_time.c */
diff --git a/src/lib/util/test_tun.c b/src/lib/util/test_tun.c
new file mode 100644
index 000000000..1086ef3ca
--- /dev/null
+++ b/src/lib/util/test_tun.c
@@ -0,0 +1,77 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2011, 2012 Christian Grothoff
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file tun/test_tun.c
+ * @brief test for tun.c
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+static int ret;
+
+static void
+test_udp (size_t pll,
+          int pl_fill,
+          uint16_t crc)
+{
+  struct GNUNET_TUN_IPv4Header ip;
+  struct GNUNET_TUN_UdpHeader udp;
+  char payload[pll];
+  struct in_addr src;
+  struct in_addr dst;
+
+  GNUNET_assert (1 == inet_pton (AF_INET, "1.2.3.4", &src));
+  GNUNET_assert (1 == inet_pton (AF_INET, "122.2.3.5", &dst));
+  memset (payload, pl_fill, sizeof(payload));
+  GNUNET_TUN_initialize_ipv4_header (&ip,
+                                     IPPROTO_UDP,
+                                     pll + sizeof(udp),
+                                     &src,
+                                     &dst);
+  udp.source_port = htons (4242);
+  udp.destination_port = htons (4242);
+  udp.len = htons (pll);
+  GNUNET_TUN_calculate_udp4_checksum (&ip,
+                                      &udp,
+                                      payload,
+                                      pll);
+  if (crc != ntohs (udp.crc))
+  {
+    fprintf (stderr, "Got CRC: %u, wanted: %u\n",
+             ntohs (udp.crc),
+             crc);
+    ret = 1;
+  }
+}
+
+
+int
+main (int argc,
+      char **argv)
+{
+  test_udp (4, 3, 22439);
+  test_udp (4, 1, 23467);
+  test_udp (7, 17, 6516);
+  test_udp (12451, 251, 42771);
+  return ret;
+}
diff --git a/src/lib/util/test_uri.c b/src/lib/util/test_uri.c
new file mode 100644
index 000000000..d8fa38e96
--- /dev/null
+++ b/src/lib/util/test_uri.c
@@ -0,0 +1,838 @@
+#include "platform.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "gnunet_uri_lib.h"
+
+#define KNRM  "\x1B[0m"
+#define KBLU  "\x1B[34m"
+#define KGRN  "\x1B[32m"
+#define KERR  "\x1B[5;31;50m"
+
+/* macro to print out the header for a new group of tests */
+#define mu_group(name) printf ("%s • %s%s\n", KBLU, name, KNRM)
+
+/* macro for asserting a statement */
+#define mu_assert(message, test) do { \
+    if (!(test)) { \
+      printf ("\t%s× %s%s\n", KERR, message, KNRM); \
+      return message; \
+    } \
+    printf ("\t%s• %s%s\n", KGRN, message, KNRM); \
+  } while (0)
+
+/* macro for asserting a statement without printing it unless it is a failure */
+#define mu_silent_assert(message, test) do { \
+    if (!(test)) { \
+      printf ("\t\t%s× %s%s\n", KERR, message, KNRM); \
+      return message; \
+    } \
+  } while (0)
+
+/* run a test function and return result */
+#define mu_run_test(test) do { \
+    char *message = test (); tests_run++; \
+    if (message) { return message; } \
+  } while (0)
+
+
+int tests_run;
+
+static int
+strcmp_wrap (const char *str,
+             const char *str2)
+{
+  if (NULL == str && NULL == str2) {
+    return 0;
+  }
+  if (NULL == str) {
+    return 1;
+  }
+  if (NULL == str2) {
+    return -1;
+  }
+
+  return strcmp (str, str2);
+}
+
+#define assert_struct(as_url, \
+                      as_scheme, \
+                      as_user, \
+                      as_pass, \
+                      as_host, \
+                      as_port, \
+                      as_path, \
+                      as_query, \
+                      as_fragment) \
+  mu_silent_assert ("should set the scheme attribute correctly", \
+                    0 == strcmp_wrap (as_url.scheme, as_scheme)); \
+  mu_silent_assert ("should set the username attribute correctly", \
+                    0 == strcmp_wrap (as_url.username, as_user)); \
+  mu_silent_assert ("should set the password attribute correctly", \
+                    0 == strcmp_wrap (as_url.password, as_pass)); \
+  mu_silent_assert ("should set the host attribute correctly", \
+                    0 == strcmp_wrap (as_url.host, as_host)); \
+  mu_silent_assert ("should set the port attribute correctly", \
+                    as_port == as_url.port); \
+  mu_silent_assert ("should set the path attribute correctly", \
+                    0 == strcmp_wrap (as_url.path, as_path)); \
+  mu_silent_assert ("should set the query attribute correctly", \
+                    0 == strcmp_wrap (as_url.query, as_query)); \
+  mu_silent_assert ("should set the fragment attribute correctly", \
+                    0 == strcmp_wrap (as_url.fragment, as_fragment));
+
+static char *
+test_parse_http_url_ok (void)
+{
+  int rc;
+  struct GNUNET_Uri url;
+  char *url_string;
+
+  /* Minimal URL */
+  url_string = strdup ("http://example.com");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("minimal HTTP URL", -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With path (/) */
+  url_string = strdup ("http://example.com/");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with path ('/')", -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 "",
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With path */
+  url_string = strdup ("http://example.com/path");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with path ('/path')", -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 "path",
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With port */
+  url_string = strdup ("http://example.com:80");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port only",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 80,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With query */
+  url_string = strdup ("http://example.com?query=only");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with query only",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 NULL,
+                 "query=only",
+                 NULL);
+  free (url_string);
+
+  /* With fragment */
+  url_string = strdup ("http://example.com#frag=f1");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with fragment only",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 NULL,
+                 NULL,
+                 "frag=f1");
+  free (url_string);
+
+  /* With credentials */
+  url_string = strdup ("http://u:p@example.com");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with credentials only",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 "u",
+                 "p",
+                 "example.com",
+                 0,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With port and path */
+  url_string = strdup ("http://example.com:8080/port/and/path");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port and path",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 8080,
+                 "port/and/path",
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With port and query */
+  url_string = strdup ("http://example.com:8080?query=portANDquery");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port and query",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 8080,
+                 NULL,
+                 "query=portANDquery",
+                 NULL);
+  free (url_string);
+
+  /* With port and fragment */
+  url_string = strdup ("http://example.com:8080#f1");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port and fragment",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 8080,
+                 NULL,
+                 NULL,
+                 "f1");
+  free (url_string);
+
+  /* With port and credentials */
+  url_string = strdup ("http://u:p@example.com:8080");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port and credentials",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 "u",
+                 "p",
+                 "example.com",
+                 8080,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With path and query */
+  url_string = strdup ("http://example.com/path/and/query?q=yes");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with path and query",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 "path/and/query",
+                 "q=yes",
+                 NULL);
+  free (url_string);
+
+  /* With path and fragment */
+  url_string = strdup ("http://example.com/path/and#fragment");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with path and fragment",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 "path/and",
+                 NULL,
+                 "fragment");
+  free (url_string);
+
+  /* With query and fragment */
+  url_string = strdup ("http://example.com?q=yes#f1");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with query and fragment",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 NULL,
+                 NULL,
+                 "example.com",
+                 0,
+                 NULL,
+                 "q=yes",
+                 "f1");
+  free (url_string);
+
+  /* With query and credentials */
+  url_string = strdup ("http://u:p@example.com?q=yes");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with query and credentials",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 "u",
+                 "p",
+                 "example.com",
+                 0,
+                 NULL,
+                 "q=yes",
+                 NULL);
+  free (url_string);
+
+  /* With empty credentials */
+  url_string = strdup ("http://:@example.com");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with empty credentials",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 "",
+                 "",
+                 "example.com",
+                 0,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* With empty credentials and port */
+  url_string = strdup ("http://:@example.com:89");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with empty credentials and port",
+             -1 != rc);
+  assert_struct (url,
+                 "http",
+                 "",
+                 "",
+                 "example.com",
+                 89,
+                 NULL,
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* Full URL */
+  url_string = strdup ("https://jack:password@localhost:8989/path/to/test?query=yes&q=jack#fragment1");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("with port, path and query",
+             -1 != rc);
+  assert_struct (url,
+                 "https",
+                 "jack",
+                 "password",
+                 "localhost",
+                 8989,
+                 "path/to/test",
+                 "query=yes&q=jack",
+                 "fragment1");
+  free (url_string);
+
+  return NULL;
+}
+
+static char *
+test_parse_http_rel_url_ok (void)
+{
+  int rc;
+  struct GNUNET_Uri url;
+  char *url_string;
+
+  /* Minimal relative URL */
+  url_string = strdup ("/");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("minimal relative URL",
+             -1 != rc);
+  assert_struct (url,
+                 NULL,
+                 NULL,
+                 NULL,
+                 NULL,
+                 0,
+                 "",
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* Path only */
+  url_string = strdup ("/hejsan");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("path only",
+             -1 != rc);
+  assert_struct (url,
+                 NULL,
+                 NULL,
+                 NULL,
+                 NULL,
+                 0,
+                 "hejsan",
+                 NULL,
+                 NULL);
+  free (url_string);
+
+  /* Path and query */
+  url_string = strdup ("/hejsan?q=yes");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("path only",
+             -1 != rc);
+  assert_struct (url,
+                 NULL,
+                 NULL,
+                 NULL,
+                 NULL,
+                 0,
+                 "hejsan",
+                 "q=yes",
+                 NULL);
+  free (url_string);
+
+  /* Path and fragment */
+  url_string = strdup ("/hejsan#fragment");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("path and fragment",
+             -1 != rc);
+  assert_struct (url,
+                 NULL,
+                 NULL,
+                 NULL,
+                 NULL,
+                 0,
+                 "hejsan",
+                 NULL,
+                 "fragment");
+  free (url_string);
+
+  /* Path, query and fragment */
+  url_string = strdup ("/?q=yes&q2=no#fragment");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("path, query and fragment",
+             -1 != rc);
+  assert_struct (url,
+                 NULL,
+                 NULL,
+                 NULL,
+                 NULL,
+                 0,
+                 "",
+                 "q=yes&q2=no",
+                 "fragment");
+  free (url_string);
+
+  return NULL;
+}
+
+static char *
+test_parse_url_fail (void)
+{
+  int rc;
+  struct GNUNET_Uri url;
+  char *url_string;
+
+  /* Empty */
+  url_string = strdup ("");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("empty string should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Scheme only */
+  url_string = strdup ("rtsp://");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("scheme only should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Hostname only */
+  url_string = strdup ("hostname");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("hostname only should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Query only */
+  url_string = strdup ("?query=only");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("query only should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Missing scheme */
+  url_string = strdup ("://");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("missing scheme should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Missing hostname */
+  url_string = strdup ("rtsp://:8910/path");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("missing hostname should return -1",
+             -1 == rc);
+  free (url_string);
+
+  /* Missing credentials */
+  url_string = strdup ("rtsp://@hostname:8910/path");
+  rc = GNUNET_uri_parse (&url,
+                         url_string);
+  mu_assert ("missing credentials should return -1",
+             -1 == rc);
+  free (url_string);
+
+  return NULL;
+}
+
+static char *
+test_split_path_ok (void)
+{
+  int rc;
+  char *path;
+  char *parts[10];
+
+  /* Simple path */
+  path = strdup ("/this/is/a/path");
+  rc = GNUNET_uri_split_path (path,
+                              parts,
+                              10);
+  mu_assert ("should be able to parse a regular path",
+             4 == rc);
+  mu_silent_assert ("first part should be 'this'",
+                    0 == strcmp ("this", parts[0]));
+  mu_silent_assert ("second part should be 'is'",
+                    0 == strcmp ("is", parts[1]));
+  mu_silent_assert ("third part should be 'a'",
+                    0 == strcmp ("a", parts[2]));
+  mu_silent_assert ("fourth part should be 'path'",
+                    0 == strcmp ("path", parts[3]));
+  free (path);
+
+  /* Relative path */
+  path = strdup ("this/is/a/path");
+  rc = GNUNET_uri_split_path (path,
+                              parts,
+                              10);
+  mu_assert ("should be able to parse a relative path",
+             4 == rc);
+  mu_silent_assert ("first part should be 'this'",
+                    0 == strcmp ("this", parts[0]));
+  mu_silent_assert ("second part should be 'is'",
+                    0 == strcmp ("is", parts[1]));
+  mu_silent_assert ("third part should be 'a'",
+                    0 == strcmp ("a", parts[2]));
+  mu_silent_assert ("fourth part should be 'path'",
+                    0 == strcmp ("path", parts[3]));
+  free (path);
+
+  /* Path with empty parts */
+  path = strdup ("//this//is/a/path/");
+  rc = GNUNET_uri_split_path (path,
+                              parts,
+                              10);
+  mu_assert ("should treat multiple slashes as one",
+             4 == rc);
+  mu_silent_assert ("first part should be 'this'",
+                    0 == strcmp("this", parts[0]));
+  mu_silent_assert ("second part should be 'is'",
+                    0 == strcmp("is", parts[1]));
+  mu_silent_assert ("third part should be 'a'",
+                    0 == strcmp("a", parts[2]));
+  mu_silent_assert ("fourth part should be 'path'",
+                    0 == strcmp("path", parts[3]));
+  free (path);
+
+  /* Just one level */
+  path = strdup("/one_level");
+  rc = GNUNET_uri_split_path(path, parts, 10);
+  mu_assert("should be able to parse a path with one level", 1 == rc);
+  mu_silent_assert("first part should be 'this'", 0 == strcmp("one_level", parts[0]));
+  free(path);
+
+  return NULL;
+}
+
+static char *
+test_parse_query_ok (void)
+{
+  int rc;
+  char *q;
+  struct GNUNET_UriParam params[10];
+
+  /* One param query */
+  q = strdup ("q=yes");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("single parameter with value",
+             1 == rc);
+  mu_silent_assert ("first param key should be 'q'",
+                    0 == strcmp ("q", params[0].key));
+  mu_silent_assert ("first param val should be 'yes'",
+                    0 == strcmp ("yes", params[0].val));
+  free (q);
+
+  /* One param query without value */
+  q = strdup ("q");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("single parameter without value",
+             1 == rc);
+  mu_silent_assert ("first param key should be 'q'",
+                    0 == strcmp ("q", params[0].key));
+  mu_silent_assert ("first param val should be NULL",
+                    NULL == params[0].val);
+  free (q);
+
+  /* Two param query */
+  q = strdup ("query=yes&a1=hello");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("multiple params with value",
+             2 == rc);
+  mu_silent_assert ("first param key should be 'query'",
+                    0 == strcmp ("query", params[0].key));
+  mu_silent_assert ("first param val should be 'yes'",
+                    0 == strcmp ("yes", params[0].val));
+  mu_silent_assert ("second param key should be 'a1'",
+                    0 == strcmp ("a1", params[1].key));
+  mu_silent_assert ("second param val should be 'hello'",
+                    0 == strcmp ("hello", params[1].val));
+  free (q);
+
+  /* Two param query, one without value */
+  q = strdup ("query=yes&forceHttps");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("multiple params one without value",
+             2 == rc);
+  mu_silent_assert ("first param key should be 'query'",
+                    0 == strcmp ("query", params[0].key));
+  mu_silent_assert ("first param val should be 'yes'",
+                    0 == strcmp ("yes", params[0].val));
+  mu_silent_assert ("second param key should be 'forceHttps'",
+                    0 == strcmp ("forceHttps", params[1].key));
+  mu_silent_assert ("second param val should be NULL",
+                    NULL == params[1].val);
+  free (q);
+
+  /* Three param query, all without value */
+  q = strdup ("query&forceHttps&log");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("multiple params all without value",
+             3 == rc);
+  mu_silent_assert ("first param key should be 'query'",
+                    0 == strcmp ("query", params[0].key));
+  mu_silent_assert ("first param val should be NULL",
+                    NULL == params[0].val);
+  mu_silent_assert ("second param key should be 'forceHttps'",
+                    0 == strcmp ("forceHttps", params[1].key));
+  mu_silent_assert ("second param val should be NULL",
+                    NULL == params[1].val);
+  mu_silent_assert ("third param key should be 'log'",
+                    0 == strcmp ("log", params[2].key));
+  mu_silent_assert ("third param val should be NULL",
+                    NULL == params[2].val);
+  free (q);
+
+  /* Param with empty value */
+  q = strdup ("param=&query=no");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("param with empty value",
+             2 == rc);
+  mu_silent_assert ("first param key should be 'param'",
+                    0 == strcmp ("param", params[0].key));
+  mu_silent_assert ("first param val should be ''",
+                    0 == strcmp ("", params[0].val));
+  mu_silent_assert ("second param key should be 'query'",
+                    0 == strcmp ("query", params[1].key));
+  mu_silent_assert ("second param val should be 'no'",
+                    0 == strcmp ("no", params[1].val));
+  free (q);
+
+  /* Double delimiter */
+  q = strdup ("param=jack&&query=no");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("double delimiter",
+             3 == rc);
+  mu_silent_assert ("first param key should be 'param'",
+                    0 == strcmp ("param", params[0].key));
+  mu_silent_assert ("first param val should be 'jack'",
+                    0 == strcmp ("jack", params[0].val));
+  mu_silent_assert ("second param key should be ''",
+                    0 == strcmp ("", params[1].key));
+  mu_silent_assert ("second param val should be NULL",
+                    NULL == params[1].val);
+  mu_silent_assert ("third param key should be 'query'",
+                    0 == strcmp ("query", params[2].key));
+  mu_silent_assert ("third param val should be 'no'",
+                    0 == strcmp ("no", params[2].val));
+  free (q);
+
+  /* Delimiter in beginning */
+  q = strdup ("&param=jack&query=no");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("delimiter in beginning",
+             3 == rc);
+  mu_silent_assert ("first param key should be ''",
+                    0 == strcmp ("", params[0].key));
+  mu_silent_assert ("first param val should be NULL",
+                    NULL == params[0].val);
+  mu_silent_assert ("second param key should be 'param'",
+                    0 == strcmp ("param", params[1].key));
+  mu_silent_assert ("second param val should be 'jack'",
+                    0 == strcmp ("jack", params[1].val));
+  mu_silent_assert ("third param key should be 'query'",
+                    0 == strcmp ("query", params[2].key));
+  mu_silent_assert ("third param val should be 'no'",
+                    0 == strcmp ("no", params[2].val));
+  free (q);
+
+  /* Delimiter at the end */
+  q = strdup ("param=jack&query=no&");
+  rc = GNUNET_uri_parse_query (q,
+                               '&',
+                               params,
+                               10);
+  mu_assert ("delimiter at the end",
+             3 == rc);
+  mu_silent_assert ("first param key should be 'param'",
+                    0 == strcmp ("param", params[0].key));
+  mu_silent_assert ("first param val should be 'jack'",
+                    0 == strcmp ("jack", params[0].val));
+  mu_silent_assert ("second param key should be 'query'",
+                    0 == strcmp ("query", params[1].key));
+  mu_silent_assert ("second param val should be 'no'",
+                    0 == strcmp ("no", params[1].val));
+  mu_silent_assert ("third param key should be ''",
+                    0 == strcmp ("", params[2].key));
+  mu_silent_assert ("third param val should be NULL",
+                    NULL == params[2].val);
+  free (q);
+
+  return NULL;
+}
+
+static char *
+all_tests (void)
+{
+  mu_group ("GNUNET_uri_parse () with an HTTP URL");
+  mu_run_test (test_parse_http_url_ok);
+
+  mu_group ("GNUNET_uri_parse () with an relative URL");
+  mu_run_test (test_parse_http_rel_url_ok);
+
+  mu_group ("GNUNET_uri_parse () with faulty values");
+  mu_run_test (test_parse_url_fail);
+
+  mu_group ("GNUNET_uri_split_path ()");
+  mu_run_test (test_split_path_ok);
+
+  mu_group ("GNUNET_uri_parse_query ()");
+  mu_run_test (test_parse_query_ok);
+
+  return NULL;
+}
+
+int
+main (void)
+{
+  char *result;
+
+  result = all_tests ();
+  if (result != NULL) {
+    exit (EXIT_FAILURE);
+  }
+
+  exit (EXIT_SUCCESS);
+}
diff --git a/src/lib/util/time.c b/src/lib/util/time.c
new file mode 100644
index 000000000..1bc7baeaa
--- /dev/null
+++ b/src/lib/util/time.c
@@ -0,0 +1,991 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2001-2013, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file util/time.c
+ * @author Christian Grothoff
+ * @brief functions for handling time and time arithmetic
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#if __STDC_NO_ATOMICS__
+#define ATOMIC
+#else
+#ifdef HAVE_STDATOMIC_H
+#include <stdatomic.h>
+#define ATOMIC _Atomic
+#else
+#define __STDC_NO_ATOMICS__ 1
+#define ATOMIC
+#endif
+#endif
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util-time", __VA_ARGS__)
+
+/**
+ * Variable used to simulate clock skew.  Used for testing, never in production.
+ */
+static long long timestamp_offset;
+
+void
+GNUNET_TIME_set_offset (long long offset)
+{
+  timestamp_offset = offset;
+}
+
+
+long long
+GNUNET_TIME_get_offset ()
+{
+  return timestamp_offset;
+}
+
+
+bool
+GNUNET_TIME_absolute_approx_eq (struct GNUNET_TIME_Absolute a1,
+                                struct GNUNET_TIME_Absolute a2,
+                                struct GNUNET_TIME_Relative t)
+{
+  struct GNUNET_TIME_Relative delta;
+
+  delta = GNUNET_TIME_relative_min (
+    GNUNET_TIME_absolute_get_difference (a1, a2),
+    GNUNET_TIME_absolute_get_difference (a2, a1));
+  return GNUNET_TIME_relative_cmp (delta,
+                                   <=,
+                                   t);
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_absolute_to_timestamp (struct GNUNET_TIME_Absolute at)
+{
+  struct GNUNET_TIME_Timestamp ts;
+
+  if (GNUNET_TIME_absolute_is_never (at))
+    return GNUNET_TIME_UNIT_FOREVER_TS;
+  ts.abs_time.abs_value_us = at.abs_value_us - at.abs_value_us % 1000000;
+  return ts;
+}
+
+
+struct GNUNET_TIME_TimestampNBO
+GNUNET_TIME_timestamp_hton (struct GNUNET_TIME_Timestamp t)
+{
+  struct GNUNET_TIME_TimestampNBO tn;
+
+  tn.abs_time_nbo = GNUNET_TIME_absolute_hton (t.abs_time);
+  return tn;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_ntoh (struct GNUNET_TIME_TimestampNBO tn)
+{
+  struct GNUNET_TIME_Timestamp t;
+
+  t.abs_time = GNUNET_TIME_absolute_ntoh (tn.abs_time_nbo);
+  return t;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_get ()
+{
+  struct GNUNET_TIME_Absolute ret;
+  struct timeval tv;
+
+  gettimeofday (&tv, NULL);
+  ret.abs_value_us = (uint64_t) (((uint64_t) tv.tv_sec * 1000LL * 1000LL)
+                                 + ((uint64_t) tv.tv_usec))
+                     + timestamp_offset;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_get ()
+{
+  return GNUNET_TIME_absolute_to_timestamp (
+    GNUNET_TIME_absolute_get ());
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_zero_ ()
+{
+  static struct GNUNET_TIME_Relative zero;
+
+  return zero;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_get_zero_ ()
+{
+  static struct GNUNET_TIME_Absolute zero;
+
+  return zero;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_unit_ ()
+{
+  static struct GNUNET_TIME_Relative one = { 1 };
+
+  return one;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_millisecond_ ()
+{
+  static struct GNUNET_TIME_Relative one = { 1000 };
+
+  return one;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_second_ ()
+{
+  static struct GNUNET_TIME_Relative one = { 1000 * 1000LL };
+
+  return one;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_minute_ ()
+{
+  static struct GNUNET_TIME_Relative one = { 60 * 1000 * 1000LL };
+
+  return one;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_hour_ ()
+{
+  static struct GNUNET_TIME_Relative one = { 60 * 60 * 1000 * 1000LL };
+
+  return one;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_get_forever_ ()
+{
+  static struct GNUNET_TIME_Relative forever = { UINT64_MAX };
+
+  return forever;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_get_forever_ ()
+{
+  static struct GNUNET_TIME_Absolute forever = { UINT64_MAX };
+
+  return forever;
+}
+
+
+const char *
+GNUNET_TIME_timestamp2s (struct GNUNET_TIME_Timestamp ts)
+{
+  static GNUNET_THREAD_LOCAL char buf[255];
+  time_t tt;
+  struct tm *tp;
+
+  if (GNUNET_TIME_absolute_is_never (ts.abs_time))
+    return "end of time";
+  tt = ts.abs_time.abs_value_us / 1000LL / 1000LL;
+  tp = localtime (&tt);
+  /* This is hacky, but i don't know a way to detect libc character encoding.
+   * Just expect utf8 from glibc these days.
+   * As for msvcrt, use the wide variant, which always returns utf16
+   * (otherwise we'd have to detect current codepage or use W32API character
+   * set conversion routines to convert to UTF8).
+   */
+  strftime (buf,
+            sizeof(buf),
+            "%a %b %d %H:%M:%S %Y",
+            tp);
+  return buf;
+}
+
+
+const char *
+GNUNET_TIME_absolute2s (struct GNUNET_TIME_Absolute t)
+{
+  static GNUNET_THREAD_LOCAL char buf[255];
+  time_t tt;
+  struct tm *tp;
+
+  if (GNUNET_TIME_absolute_is_never (t))
+    return "end of time";
+  tt = t.abs_value_us / 1000LL / 1000LL;
+  tp = localtime (&tt);
+  /* This is hacky, but i don't know a way to detect libc character encoding.
+   * Just expect utf8 from glibc these days.
+   * As for msvcrt, use the wide variant, which always returns utf16
+   * (otherwise we'd have to detect current codepage or use W32API character
+   * set conversion routines to convert to UTF8).
+   */
+  strftime (buf,
+            sizeof(buf),
+            "%a %b %d %H:%M:%S %Y",
+            tp);
+  return buf;
+}
+
+
+const char *
+GNUNET_TIME_relative2s (struct GNUNET_TIME_Relative delta,
+                        bool do_round)
+{
+  static GNUNET_THREAD_LOCAL char buf[128];
+  const char *unit = /* time unit */ "µs";
+  uint64_t dval = delta.rel_value_us;
+
+  if (GNUNET_TIME_relative_is_forever (delta))
+    return "forever";
+  if (0 == delta.rel_value_us)
+    return "0 ms";
+  if ( ((GNUNET_YES == do_round) &&
+        (dval > 5 * 1000)) ||
+       (0 == (dval % 1000)))
+  {
+    dval = dval / 1000;
+    unit = /* time unit */ "ms";
+    if (((GNUNET_YES == do_round) && (dval > 5 * 1000)) || (0 == (dval % 1000)))
+    {
+      dval = dval / 1000;
+      unit = /* time unit */ "s";
+      if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+      {
+        dval = dval / 60;
+        unit = /* time unit */ "m";
+        if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+        {
+          dval = dval / 60;
+          unit = /* time unit */ "h";
+          if (((GNUNET_YES == do_round) && (dval > 5 * 24)) ||
+              (0 == (dval % 24)))
+          {
+            dval = dval / 24;
+            if (1 == dval)
+              unit = /* time unit */ "day";
+            else
+              unit = /* time unit */ "days";
+          }
+        }
+      }
+    }
+  }
+  GNUNET_snprintf (buf,
+                   sizeof(buf),
+                   "%llu %s",
+                   (unsigned long long) dval,
+                   unit);
+  return buf;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_relative_to_absolute (struct GNUNET_TIME_Relative rel)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  if (GNUNET_TIME_relative_is_forever (rel))
+    return GNUNET_TIME_UNIT_FOREVER_ABS;
+  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
+
+  if (rel.rel_value_us + now.abs_value_us < rel.rel_value_us)
+  {
+    GNUNET_break (0);  /* overflow... */
+    return GNUNET_TIME_UNIT_FOREVER_ABS;
+  }
+  ret.abs_value_us = rel.rel_value_us + now.abs_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_relative_to_timestamp (struct GNUNET_TIME_Relative rel)
+{
+  return GNUNET_TIME_absolute_to_timestamp (
+    GNUNET_TIME_relative_to_absolute (rel));
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_min (struct GNUNET_TIME_Relative t1,
+                          struct GNUNET_TIME_Relative t2)
+{
+  return (t1.rel_value_us < t2.rel_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_max (struct GNUNET_TIME_Relative t1,
+                          struct GNUNET_TIME_Relative t2)
+{
+  return (t1.rel_value_us > t2.rel_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_min (struct GNUNET_TIME_Absolute t1,
+                          struct GNUNET_TIME_Absolute t2)
+{
+  return (t1.abs_value_us < t2.abs_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_max (struct GNUNET_TIME_Absolute t1,
+                          struct GNUNET_TIME_Absolute t2)
+{
+  return (t1.abs_value_us > t2.abs_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_max (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2)
+{
+  return (t1.abs_time.abs_value_us > t2.abs_time.abs_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_min (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2)
+{
+  return (t1.abs_time.abs_value_us < t2.abs_time.abs_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_round_down (struct GNUNET_TIME_Absolute at,
+                                 struct GNUNET_TIME_Relative rt)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  GNUNET_assert (! GNUNET_TIME_relative_is_zero (rt));
+  ret.abs_value_us
+    = at.abs_value_us
+    - at.abs_value_us % rt.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_absolute_get_remaining (struct GNUNET_TIME_Absolute future)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if (GNUNET_TIME_absolute_is_never (future))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
+
+  if (now.abs_value_us > future.abs_value_us)
+    return GNUNET_TIME_UNIT_ZERO;
+  ret.rel_value_us = future.abs_value_us - now.abs_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_absolute_get_difference (struct GNUNET_TIME_Absolute start,
+                                     struct GNUNET_TIME_Absolute end)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if (GNUNET_TIME_absolute_is_never (end))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  if (end.abs_value_us < start.abs_value_us)
+    return GNUNET_TIME_UNIT_ZERO;
+  ret.rel_value_us = end.abs_value_us - start.abs_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_absolute_get_duration (struct GNUNET_TIME_Absolute whence)
+{
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Relative ret;
+
+  now = GNUNET_TIME_absolute_get ();
+  if (whence.abs_value_us > now.abs_value_us)
+    return GNUNET_TIME_UNIT_ZERO;
+  ret.rel_value_us = now.abs_value_us - whence.abs_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_add (struct GNUNET_TIME_Absolute start,
+                          struct GNUNET_TIME_Relative duration)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  if (GNUNET_TIME_absolute_is_never (start) ||
+      GNUNET_TIME_relative_is_forever (duration))
+    return GNUNET_TIME_UNIT_FOREVER_ABS;
+  if (start.abs_value_us + duration.rel_value_us < start.abs_value_us)
+  {
+    GNUNET_break (0);
+    return GNUNET_TIME_UNIT_FOREVER_ABS;
+  }
+  ret.abs_value_us = start.abs_value_us + duration.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_subtract (struct GNUNET_TIME_Absolute start,
+                               struct GNUNET_TIME_Relative duration)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  if (start.abs_value_us <= duration.rel_value_us)
+    return GNUNET_TIME_UNIT_ZERO_ABS;
+  if (GNUNET_TIME_absolute_is_never (start))
+    return GNUNET_TIME_UNIT_FOREVER_ABS;
+  ret.abs_value_us = start.abs_value_us - duration.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_multiply (struct GNUNET_TIME_Relative rel,
+                               unsigned long long factor)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if (0 == factor)
+    return GNUNET_TIME_UNIT_ZERO;
+  if (GNUNET_TIME_relative_is_forever (rel))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  ret.rel_value_us = rel.rel_value_us * factor;
+  if (ret.rel_value_us / factor != rel.rel_value_us)
+  {
+    GNUNET_break (0);
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_multiply_double (struct GNUNET_TIME_Relative rel,
+                          double factor)
+{
+  struct GNUNET_TIME_Relative out;
+  double m;
+
+  GNUNET_assert (0 <= factor);
+
+  if (0 == factor)
+    return GNUNET_TIME_UNIT_ZERO;
+  if (GNUNET_TIME_relative_is_forever (rel))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+
+  m = ((double) rel.rel_value_us) * factor;
+
+  if (m >= (double) (GNUNET_TIME_UNIT_FOREVER_REL).rel_value_us)
+  {
+    GNUNET_break (0);
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+
+  out.rel_value_us = (uint64_t) m;
+  return out;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_saturating_multiply (struct GNUNET_TIME_Relative rel,
+                                          unsigned long long factor)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if (0 == factor)
+    return GNUNET_TIME_UNIT_ZERO;
+  if (GNUNET_TIME_relative_is_forever (rel))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  ret.rel_value_us = rel.rel_value_us * factor;
+  if (ret.rel_value_us / factor != rel.rel_value_us)
+  {
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_divide (struct GNUNET_TIME_Relative rel,
+                             unsigned long long factor)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if ((0 == factor) ||
+      (GNUNET_TIME_relative_is_forever (rel)))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  ret.rel_value_us = rel.rel_value_us / factor;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_calculate_eta (struct GNUNET_TIME_Absolute start,
+                           uint64_t finished,
+                           uint64_t total)
+{
+  struct GNUNET_TIME_Relative due;
+  double exp;
+  struct GNUNET_TIME_Relative ret;
+
+  GNUNET_break (finished <= total);
+  if (finished >= total)
+    return GNUNET_TIME_UNIT_ZERO;
+  if (0 == finished)
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  due = GNUNET_TIME_absolute_get_duration (start);
+  exp = ((double) due.rel_value_us) * ((double) total) / ((double) finished);
+  ret.rel_value_us = ((uint64_t) exp) - due.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_add (struct GNUNET_TIME_Relative a1,
+                          struct GNUNET_TIME_Relative a2)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if ((a1.rel_value_us == UINT64_MAX) || (a2.rel_value_us == UINT64_MAX))
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  if (a1.rel_value_us + a2.rel_value_us < a1.rel_value_us)
+  {
+    GNUNET_break (0);
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  }
+  ret.rel_value_us = a1.rel_value_us + a2.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_subtract (struct GNUNET_TIME_Relative a1,
+                               struct GNUNET_TIME_Relative a2)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  if (a2.rel_value_us >= a1.rel_value_us)
+    return GNUNET_TIME_UNIT_ZERO;
+  if (a1.rel_value_us == UINT64_MAX)
+    return GNUNET_TIME_UNIT_FOREVER_REL;
+  ret.rel_value_us = a1.rel_value_us - a2.rel_value_us;
+  return ret;
+}
+
+
+struct GNUNET_TIME_RelativeNBO
+GNUNET_TIME_relative_hton (struct GNUNET_TIME_Relative a)
+{
+  struct GNUNET_TIME_RelativeNBO ret;
+
+  ret.rel_value_us__ = GNUNET_htonll (a.rel_value_us);
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_relative_ntoh (struct GNUNET_TIME_RelativeNBO a)
+{
+  struct GNUNET_TIME_Relative ret;
+
+  ret.rel_value_us = GNUNET_ntohll (a.rel_value_us__);
+  return ret;
+}
+
+
+struct GNUNET_TIME_AbsoluteNBO
+GNUNET_TIME_absolute_hton (struct GNUNET_TIME_Absolute a)
+{
+  struct GNUNET_TIME_AbsoluteNBO ret;
+
+  ret.abs_value_us__ = GNUNET_htonll (a.abs_value_us);
+  return ret;
+}
+
+
+bool
+GNUNET_TIME_absolute_is_never (struct GNUNET_TIME_Absolute abs)
+{
+  return GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us == abs.abs_value_us;
+}
+
+
+bool
+GNUNET_TIME_relative_is_forever (struct GNUNET_TIME_Relative rel)
+{
+  return GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us == rel.rel_value_us;
+}
+
+
+bool
+GNUNET_TIME_relative_is_zero (struct GNUNET_TIME_Relative rel)
+{
+  return 0 == rel.rel_value_us;
+}
+
+
+bool
+GNUNET_TIME_absolute_is_past (struct GNUNET_TIME_Absolute abs)
+{
+  struct GNUNET_TIME_Absolute now;
+
+  now = GNUNET_TIME_absolute_get ();
+  return abs.abs_value_us < now.abs_value_us;
+}
+
+
+bool
+GNUNET_TIME_absolute_is_future (struct GNUNET_TIME_Absolute abs)
+{
+  struct GNUNET_TIME_Absolute now;
+
+  now = GNUNET_TIME_absolute_get ();
+  return abs.abs_value_us > now.abs_value_us;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_from_ms (uint64_t ms_after_epoch)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  ret.abs_value_us = GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us
+                     * ms_after_epoch;
+  if (ret.abs_value_us / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us !=
+      ms_after_epoch)
+    ret = GNUNET_TIME_UNIT_FOREVER_ABS;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  ret.abs_value_us = GNUNET_TIME_UNIT_SECONDS.rel_value_us * s_after_epoch;
+  if (ret.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us !=
+      s_after_epoch)
+    ret = GNUNET_TIME_UNIT_FOREVER_ABS;
+  return ret;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch)
+{
+  struct GNUNET_TIME_Timestamp ret;
+
+  ret.abs_time.abs_value_us
+    = GNUNET_TIME_UNIT_SECONDS.rel_value_us * s_after_epoch;
+  if (ret.abs_time.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us
+      != s_after_epoch)
+    ret = GNUNET_TIME_UNIT_FOREVER_TS;
+  return ret;
+}
+
+
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts)
+{
+  return ts.abs_time.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a)
+{
+  struct GNUNET_TIME_Absolute ret;
+
+  ret.abs_value_us = GNUNET_ntohll (a.abs_value_us__);
+  return ret;
+}
+
+
+unsigned int
+GNUNET_TIME_get_current_year ()
+{
+  time_t tp;
+  struct tm *t;
+
+  tp = time (NULL);
+  t = gmtime (&tp);
+  if (t == NULL)
+    return 0;
+  return t->tm_year + 1900;
+}
+
+
+unsigned int
+GNUNET_TIME_time_to_year (struct GNUNET_TIME_Absolute at)
+{
+  struct tm *t;
+  time_t tp;
+
+  tp = at.abs_value_us / 1000LL / 1000LL; /* microseconds to seconds */
+  t = gmtime (&tp);
+  if (t == NULL)
+    return 0;
+  return t->tm_year + 1900;
+}
+
+
+#ifndef HAVE_TIMEGM
+/**
+ * As suggested in the timegm() man page.
+ */
+static time_t
+my_timegm (struct tm *tm)
+{
+  time_t ret;
+  char *tz;
+
+  tz = getenv ("TZ");
+  setenv ("TZ", "", 1);
+  tzset ();
+  ret = mktime (tm);
+  if (tz)
+    setenv ("TZ", tz, 1);
+  else
+    unsetenv ("TZ");
+  tzset ();
+  return ret;
+}
+
+
+#endif
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_year_to_time (unsigned int year)
+{
+  struct GNUNET_TIME_Absolute ret;
+  time_t tp;
+  struct tm t;
+
+  memset (&t, 0, sizeof(t));
+  if (year < 1900)
+  {
+    GNUNET_break (0);
+    return GNUNET_TIME_absolute_get ();  /* now */
+  }
+  t.tm_year = year - 1900;
+  t.tm_mday = 1;
+  t.tm_mon = 0;
+  t.tm_wday = 1;
+  t.tm_yday = 1;
+#ifndef HAVE_TIMEGM
+  tp = my_timegm (&t);
+#else
+  tp = timegm (&t);
+#endif
+  GNUNET_break (tp != (time_t) -1);
+  ret.abs_value_us = tp * 1000LL * 1000LL; /* seconds to microseconds */
+  return ret;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt,
+                                struct GNUNET_TIME_Relative threshold)
+{
+  double r = (rand () % 500) / 1000.0;
+  struct GNUNET_TIME_Relative t;
+
+  t = GNUNET_TIME_relative_multiply_double (
+    GNUNET_TIME_relative_max (GNUNET_TIME_UNIT_MILLISECONDS, rt),
+    2 + r);
+  return GNUNET_TIME_relative_min (threshold, t);
+}
+
+
+bool
+GNUNET_TIME_absolute_is_zero (struct GNUNET_TIME_Absolute abs)
+{
+  return 0 == abs.abs_value_us;
+}
+
+
+struct GNUNET_TIME_Relative
+GNUNET_TIME_randomize (struct GNUNET_TIME_Relative r)
+{
+  double d = ((rand () % 1001) + 500) / 1000.0;
+
+  return GNUNET_TIME_relative_multiply_double (r, d);
+}
+
+
+struct GNUNET_TIME_Absolute
+GNUNET_TIME_absolute_get_monotonic (
+  const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  static const struct GNUNET_CONFIGURATION_Handle *last_cfg;
+  static struct GNUNET_TIME_Absolute last_time;
+  static struct GNUNET_DISK_MapHandle *map_handle;
+  static ATOMIC volatile uint64_t *map;
+  struct GNUNET_TIME_Absolute now;
+
+  now = GNUNET_TIME_absolute_get ();
+  if (last_cfg != cfg)
+  {
+    char *filename;
+
+    if (NULL != map_handle)
+    {
+      GNUNET_DISK_file_unmap (map_handle);
+      map_handle = NULL;
+    }
+    map = NULL;
+
+    last_cfg = cfg;
+    if ((NULL != cfg) &&
+        (GNUNET_OK ==
+         GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                  "util",
+                                                  "MONOTONIC_TIME_FILENAME",
+                                                  &filename)))
+    {
+      struct GNUNET_DISK_FileHandle *fh;
+
+      fh = GNUNET_DISK_file_open (filename,
+                                  GNUNET_DISK_OPEN_READWRITE
+                                  | GNUNET_DISK_OPEN_CREATE,
+                                  GNUNET_DISK_PERM_USER_WRITE
+                                  | GNUNET_DISK_PERM_GROUP_WRITE
+                                  | GNUNET_DISK_PERM_USER_READ
+                                  | GNUNET_DISK_PERM_GROUP_READ);
+      if (NULL == fh)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    _ ("Failed to map `%s', cannot assure monotonic time!\n"),
+                    filename);
+      }
+      else
+      {
+        off_t size;
+
+        size = 0;
+        GNUNET_break (GNUNET_OK == GNUNET_DISK_file_handle_size (fh, &size));
+        if (size < (off_t) sizeof(*map))
+        {
+          struct GNUNET_TIME_AbsoluteNBO o;
+
+          o = GNUNET_TIME_absolute_hton (now);
+          if (sizeof(o) != GNUNET_DISK_file_write (fh, &o, sizeof(o)))
+            size = 0;
+          else
+            size = sizeof(o);
+        }
+        if (size == sizeof(*map))
+        {
+          map = GNUNET_DISK_file_map (fh,
+                                      &map_handle,
+                                      GNUNET_DISK_MAP_TYPE_READWRITE,
+                                      sizeof(*map));
+          if (NULL == map)
+            GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                        _ (
+                          "Failed to map `%s', cannot assure monotonic time!\n"),
+                        filename);
+        }
+        else
+        {
+          GNUNET_log (
+            GNUNET_ERROR_TYPE_WARNING,
+            _ (
+              "Failed to setup monotonic time file `%s', cannot assure monotonic time!\n"),
+            filename);
+        }
+      }
+      GNUNET_DISK_file_close (fh);
+      GNUNET_free (filename);
+    }
+  }
+  if (NULL != map)
+  {
+    struct GNUNET_TIME_AbsoluteNBO mt;
+
+#if __STDC_NO_ATOMICS__
+#if __GNUC__
+    mt.abs_value_us__ = __sync_fetch_and_or (map, 0);
+#else
+    mt.abs_value_us__ = *map;   /* godspeed, pray this is atomic */
+#endif
+#else
+    mt.abs_value_us__ = atomic_load (map);
+#endif
+    last_time =
+      GNUNET_TIME_absolute_max (GNUNET_TIME_absolute_ntoh (mt), last_time);
+  }
+  if (now.abs_value_us <= last_time.abs_value_us)
+    now.abs_value_us = last_time.abs_value_us + 1;
+  last_time = now;
+  if (NULL != map)
+  {
+    uint64_t val = GNUNET_TIME_absolute_hton (now).abs_value_us__;
+#if __STDC_NO_ATOMICS__
+#if __GNUC__
+    (void) __sync_lock_test_and_set (map, val);
+#else
+    *map = val;   /* godspeed, pray this is atomic */
+#endif
+#else
+    atomic_store (map, val);
+#endif
+  }
+  return now;
+}
+
+
+/**
+ * Destructor
+ */
+void __attribute__ ((destructor))
+GNUNET_util_time_fini ()
+{
+  (void) GNUNET_TIME_absolute_get_monotonic (NULL);
+}
+
+
+/* end of time.c */
diff --git a/src/lib/util/tun.c b/src/lib/util/tun.c
new file mode 100644
index 000000000..c4ac6ff88
--- /dev/null
+++ b/src/lib/util/tun.c
@@ -0,0 +1,281 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2011, 2012 Christian Grothoff
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file tun/tun.c
+ * @brief standard IP calculations for TUN interaction
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * IP TTL we use for packets that we assemble (8 bit unsigned integer)
+ */
+#define FRESH_TTL 64
+
+
+/**
+ * Initialize an IPv4 header.
+ *
+ * @param ip header to initialize
+ * @param protocol protocol to use (e.g. IPPROTO_UDP)
+ * @param payload_length number of bytes of payload that follow (excluding IPv4 header)
+ * @param src source IP address to use
+ * @param dst destination IP address to use
+ */
+void
+GNUNET_TUN_initialize_ipv4_header (struct GNUNET_TUN_IPv4Header *ip,
+                                   uint8_t protocol,
+                                   uint16_t payload_length,
+                                   const struct in_addr *src,
+                                   const struct in_addr *dst)
+{
+  GNUNET_assert (20 == sizeof(struct GNUNET_TUN_IPv4Header));
+  GNUNET_assert (payload_length <=
+                 UINT16_MAX - sizeof(struct GNUNET_TUN_IPv4Header));
+  memset (ip, 0, sizeof(struct GNUNET_TUN_IPv4Header));
+  ip->header_length = sizeof(struct GNUNET_TUN_IPv4Header) / 4;
+  ip->version = 4;
+  ip->total_length =
+    htons (sizeof(struct GNUNET_TUN_IPv4Header) + payload_length);
+  ip->identification =
+    (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 65536);
+  ip->ttl = FRESH_TTL;
+  ip->protocol = protocol;
+  ip->source_address = *src;
+  ip->destination_address = *dst;
+  ip->checksum =
+    GNUNET_CRYPTO_crc16_n (ip, sizeof(struct GNUNET_TUN_IPv4Header));
+}
+
+
+/**
+ * Initialize an IPv6 header.
+ *
+ * @param ip header to initialize
+ * @param protocol protocol to use (e.g. IPPROTO_UDP), technically "next_header" for IPv6
+ * @param payload_length number of bytes of payload that follow (excluding IPv6 header)
+ * @param src source IP address to use
+ * @param dst destination IP address to use
+ */
+void
+GNUNET_TUN_initialize_ipv6_header (struct GNUNET_TUN_IPv6Header *ip,
+                                   uint8_t protocol,
+                                   uint16_t payload_length,
+                                   const struct in6_addr *src,
+                                   const struct in6_addr *dst)
+{
+  GNUNET_assert (40 == sizeof(struct GNUNET_TUN_IPv6Header));
+  GNUNET_assert (payload_length <=
+                 UINT16_MAX - sizeof(struct GNUNET_TUN_IPv6Header));
+  memset (ip, 0, sizeof(struct GNUNET_TUN_IPv6Header));
+  ip->version = 6;
+  ip->next_header = protocol;
+  ip->payload_length = htons ((uint16_t) payload_length);
+  ip->hop_limit = FRESH_TTL;
+  ip->destination_address = *dst;
+  ip->source_address = *src;
+}
+
+
+void
+GNUNET_TUN_calculate_tcp4_checksum (const struct GNUNET_TUN_IPv4Header *ip,
+                                    struct GNUNET_TUN_TcpHeader *tcp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint16_t tmp;
+
+  GNUNET_assert (20 == sizeof(struct GNUNET_TUN_TcpHeader));
+  GNUNET_assert (payload_length + sizeof(struct GNUNET_TUN_IPv4Header)
+                 + sizeof(struct GNUNET_TUN_TcpHeader) ==
+                 ntohs (ip->total_length));
+  GNUNET_assert (IPPROTO_TCP == ip->protocol);
+
+  tcp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof(struct in_addr) * 2);
+  tmp = htons (IPPROTO_TCP);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint16_t));
+  tmp = htons (payload_length + sizeof(struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint16_t));
+  sum =
+    GNUNET_CRYPTO_crc16_step (sum, tcp, sizeof(struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+void
+GNUNET_TUN_calculate_tcp6_checksum (const struct GNUNET_TUN_IPv6Header *ip,
+                                    struct GNUNET_TUN_TcpHeader *tcp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint32_t tmp;
+
+  GNUNET_assert (20 == sizeof(struct GNUNET_TUN_TcpHeader));
+  GNUNET_assert (payload_length + sizeof(struct GNUNET_TUN_TcpHeader) ==
+                 ntohs (ip->payload_length));
+  GNUNET_assert (IPPROTO_TCP == ip->next_header);
+  tcp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  2 * sizeof(struct in6_addr));
+  tmp = htonl (sizeof(struct GNUNET_TUN_TcpHeader) + payload_length);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint32_t));
+  tmp = htonl (IPPROTO_TCP);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint32_t));
+  sum =
+    GNUNET_CRYPTO_crc16_step (sum, tcp, sizeof(struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+void
+GNUNET_TUN_calculate_udp4_checksum (const struct GNUNET_TUN_IPv4Header *ip,
+                                    struct GNUNET_TUN_UdpHeader *udp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint16_t tmp;
+
+  GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
+  GNUNET_assert (payload_length + sizeof(struct GNUNET_TUN_IPv4Header)
+                 + sizeof(struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (ip->total_length));
+  GNUNET_assert (IPPROTO_UDP == ip->protocol);
+
+  udp->crc =
+    0; /* technically optional, but we calculate it anyway, just to be sure */
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof(struct in_addr) * 2);
+  tmp = htons (IPPROTO_UDP);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint16_t));
+  tmp = htons (sizeof(struct GNUNET_TUN_UdpHeader) + payload_length);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint16_t));
+  sum =
+    GNUNET_CRYPTO_crc16_step (sum, udp, sizeof(struct GNUNET_TUN_UdpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  udp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+void
+GNUNET_TUN_calculate_udp6_checksum (const struct GNUNET_TUN_IPv6Header *ip,
+                                    struct GNUNET_TUN_UdpHeader *udp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint32_t tmp;
+
+  GNUNET_assert (payload_length + sizeof(struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (ip->payload_length));
+  GNUNET_assert (payload_length + sizeof(struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (udp->len));
+  GNUNET_assert (IPPROTO_UDP == ip->next_header);
+
+  udp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof(struct in6_addr) * 2);
+  tmp = htons (sizeof(struct GNUNET_TUN_UdpHeader)
+               + payload_length); /* aka udp->len */
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint32_t));
+  tmp = htons (ip->next_header);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof(uint32_t));
+  sum =
+    GNUNET_CRYPTO_crc16_step (sum, udp, sizeof(struct GNUNET_TUN_UdpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  udp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+void
+GNUNET_TUN_calculate_icmp_checksum (struct GNUNET_TUN_IcmpHeader *icmp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+
+  GNUNET_assert (8 == sizeof(struct GNUNET_TUN_IcmpHeader));
+  icmp->crc = 0;
+  sum =
+    GNUNET_CRYPTO_crc16_step (0, icmp, sizeof(struct GNUNET_TUN_IcmpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  icmp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Check if two sockaddrs are equal.
+ *
+ * @param sa one address
+ * @param sb another address
+ * @param include_port also check ports
+ * @return #GNUNET_YES if they are equal
+ */
+int
+GNUNET_TUN_sockaddr_cmp (const struct sockaddr *sa,
+                         const struct sockaddr *sb,
+                         int include_port)
+{
+  if (sa->sa_family != sb->sa_family)
+    return GNUNET_NO;
+
+  switch (sa->sa_family)
+  {
+  case AF_INET: {
+      const struct sockaddr_in *sa4 = (const struct sockaddr_in *) sa;
+      const struct sockaddr_in *sb4 = (const struct sockaddr_in *) sb;
+      if ((include_port) && (sa4->sin_port != sb4->sin_port))
+        return GNUNET_NO;
+      return(sa4->sin_addr.s_addr == sb4->sin_addr.s_addr);
+    }
+
+  case AF_INET6: {
+      const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *) sa;
+      const struct sockaddr_in6 *sb6 = (const struct sockaddr_in6 *) sb;
+
+      if ((include_port) && (sa6->sin6_port != sb6->sin6_port))
+        return GNUNET_NO;
+      return(
+        0 == memcmp (&sa6->sin6_addr, &sb6->sin6_addr, sizeof(struct
+                                                              in6_addr)));
+    }
+
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/* end of tun.c */
diff --git a/src/lib/util/uri.c b/src/lib/util/uri.c
new file mode 100644
index 000000000..b09968581
--- /dev/null
+++ b/src/lib/util/uri.c
@@ -0,0 +1,345 @@
+/**
+ * Copyright (C) 2016,2017 Jack Engqvist Johansson
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include "platform.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include "gnunet_uri_lib.h"
+
+
+/**
+ * Parse a non null terminated string into an integer.
+ *
+ * str: the string containing the number.
+ * len: Number of characters to parse.
+ */
+static inline int
+natoi (const char *str,
+       size_t len)
+{
+  int i, r = 0;
+  for (i = 0; i < len; i++) {
+    r *= 10;
+    r += str[i] - '0';
+  }
+
+  return r;
+}
+
+
+/**
+ * Check if a URL is relative (no scheme and hostname).
+ *
+ * url: the string containing the URL to check.
+ *
+ * Returns 1 if relative, otherwise 0.
+ */
+static inline int
+is_relative (const char *url)
+{
+  return (*url == '/') ? 1 : 0;
+}
+
+
+/**
+ * Parse the scheme of a URL by inserting a null terminator after the scheme.
+ *
+ * str: the string containing the URL to parse. Will be modified.
+ *
+ * Returns a pointer to the hostname on success, otherwise NULL.
+ */
+static inline char *
+parse_scheme (char *str)
+{
+  char *s;
+
+  /* If not found or first in string, return error */
+  s = strchr (str, ':');
+  if (s == NULL || s == str) {
+    return NULL;
+  }
+
+  /* If not followed by two slashes, return error */
+  if (s[1] == '\0' || s[1] != '/' || s[2] == '\0' || s[2] != '/') {
+    return NULL;
+  }
+
+  *s = '\0'; // Replace ':' with NULL
+
+  return s + 3;
+}
+
+
+/**
+ * Find a character in a string, replace it with '\0' and return the next
+ * character in the string.
+ *
+ * str: the string to search in.
+ * find: the character to search for.
+ *
+ * Returns a pointer to the character after the one to search for. If not
+ * found, NULL is returned.
+ */
+static inline char *
+find_and_terminate (char *str,
+                    char find)
+{
+  str = strchr(str, find);
+  if (NULL == str) {
+    return NULL;
+  }
+
+  *str = '\0';
+  return str + 1;
+}
+
+
+/* Yes, the following functions could be implemented as preprocessor macros
+     instead of inline functions, but I think that this approach will be more
+     clean in this case. */
+static inline char *
+find_fragment (char *str)
+{
+  return find_and_terminate (str, '#');
+}
+
+
+static inline char *
+find_query (char *str)
+{
+  return find_and_terminate (str, '?');
+}
+
+
+static inline char *
+find_path (char *str)
+{
+  return find_and_terminate (str, '/');
+}
+
+
+/**
+ * Parse a URL to a struct.
+ *
+ * The URL string should be in one of the following formats:
+ *
+ * Absolute URL:
+ * scheme ":" [ "//" ] [ username ":" password "@" ] host [ ":" port ] [ "/" ] [ path ] [ "?" query ] [ "#" fragment ]
+ *
+ * Relative URL:
+ * path [ "?" query ] [ "#" fragment ]
+ *
+ * The following parts will be parsed to the corresponding struct member.
+ *
+ * *url:     a pointer to the struct where to store the parsed values.
+ * *url_str: a pointer to the url to be parsed (null terminated). The string
+ *           will be modified.
+ *
+ * Returns 0 on success, otherwise -1.
+ */
+int
+GNUNET_uri_parse (struct GNUNET_Uri *url,
+                  char *u)
+{
+  if (NULL == url || NULL == u) {
+    return -1;
+  }
+
+  memset(url, 0, sizeof (struct GNUNET_Uri));
+
+  /* (Fragment) */
+  url->fragment = find_fragment (u);
+
+  /* (Query) */
+  url->query = find_query (u);
+
+  /* Relative URL? Parse scheme and hostname */
+  if (!is_relative (u)) {
+    /* Scheme */
+    url->scheme = u;
+    u = parse_scheme (u);
+    if (u == NULL) {
+      return -1;
+    }
+
+    /* Host */
+    if ('\0' == *u) {
+      return -1;
+    }
+    url->host = u;
+
+    /* (Path) */
+    url->path = find_path (u);
+
+    /* (Credentials) */
+    u = strchr (url->host, '@');
+    if (NULL != u) {
+      /* Missing credentials? */
+      if (u == url->host) {
+        return -1;
+      }
+
+      url->username = url->host;
+      url->host = u + 1;
+      *u = '\0';
+
+      u = strchr (url->username, ':');
+      if (NULL == u) {
+        return -1;
+      }
+
+      url->password = u + 1;
+      *u = '\0';
+    }
+
+    /* Missing hostname? */
+    if ('\0' == *url->host) {
+      return -1;
+    }
+
+    /* (Port) */
+    u = strchr (url->host, ':');
+    if (NULL != u && (NULL == url->path || u < url->path)) {
+      *(u++) = '\0';
+      if ('\0' == *u) {
+        return -1;
+      }
+
+      if (url->path) {
+        url->port = natoi (u, url->path - u - 1);
+      } else {
+        url->port = atoi (u);
+      }
+    }
+
+    /* Missing hostname? */
+    if ('\0' == *url->host) {
+      return -1;
+    }
+  } else {
+    /* (Path) */
+    url->path = find_path (u);
+  }
+
+  return 0;
+}
+
+
+/**
+ * Split a path into several strings.
+ *
+ * No data is copied, the slashed are used as null terminators and then
+ * pointers to each path part will be stored in **parts. Double slashes will be
+ * treated as one.
+ *
+ * *path:     the path to split. The string will be modified.
+ * **parts:   a pointer to an array of (char *) where to store the result.
+ * max_parts: max number of parts to parse.
+ *
+ * Returns the number of parsed items. -1 on error.
+ */
+int
+GNUNET_uri_split_path (char *path,
+                       char **parts,
+                       int max_parts)
+{
+  int i = 0;
+
+  if (NULL == path || '\0' == *path) {
+    return -1;
+  }
+
+  do {
+    /* Forward to after slashes */
+    while (*path == '/') path++;
+
+    if ('\0' == *path) {
+      break;
+    }
+
+    parts[i++] = path;
+
+    path = strchr (path, '/');
+    if (NULL == path) {
+      break;
+    }
+
+    *(path++) = '\0';
+  } while (i < max_parts);
+
+  return i;
+}
+
+
+/**
+ * Parse a query string into a key/value struct.
+ *
+ * The query string should be a null terminated string of parameters separated by
+ * a delimiter. Each parameter are checked for the equal sign character. If it
+ * appears in the parameter, it will be used as a null terminator and the part
+ * that comes after it will be the value of the parameter.
+ *
+ * No data are copied, the equal sign and delimiters are used as null
+ * terminators and then pointers to each parameter key and value will be stored
+ * in the yuarel_param struct.
+ *
+ * *query:     the query string to parse. The string will be modified.
+ * delimiter:  the character that separates the key/value pairs from each other.
+ * *params:    an array of (struct yuarel_param) where to store the result.
+ * max_values: max number of parameters to parse.
+ *
+ * Returns the number of parsed items. -1 on error.
+ */
+int
+GNUNET_uri_parse_query (char *query,
+                        char delimiter,
+                        struct GNUNET_UriParam *params,
+                        int max_params)
+{
+  int i = 0;
+
+  if (NULL == query || '\0' == *query) {
+    return -1;
+  }
+
+  params[i++].key = query;
+  while (i < max_params && NULL != (query = strchr (query, delimiter))) {
+    *query = '\0';
+    params[i].key = ++query;
+    params[i].val = NULL;
+
+    /* Go back and split previous param */
+    if (i > 0) {
+      if ((params[i - 1].val = strchr (params[i - 1].key, '=')) != NULL) {
+        *(params[i - 1].val)++ = '\0';
+      }
+    }
+    i++;
+  }
+
+  /* Go back and split last param */
+  if ((params[i - 1].val = strchr (params[i - 1].key, '=')) != NULL) {
+    *(params[i - 1].val)++ = '\0';
+  }
+
+  return i;
+}
diff --git a/src/lib/util/util.conf b/src/lib/util/util.conf
new file mode 100644
index 000000000..4f0860a49
--- /dev/null
+++ b/src/lib/util/util.conf
@@ -0,0 +1,79 @@
+[PATHS]
+# The PATHS section is special, as filenames including $-expression are
+# expanded using the values from PATHS or the system environment (PATHS
+# is checked first).  GNUnet also supports expanding $-expressions using
+# defaults with the syntax "${VAR:-default}".  Here, "default" can again
+# be a $-expression.
+#
+# We usually want $HOME for $GNUNET_HOME, but we allow testcases to
+# easily override this by setting $GNUNET_TEST_HOME.
+#
+GNUNET_HOME = ${GNUNET_TEST_HOME:-${HOME:-${USERPROFILE}}}
+
+# see XDG Base Directory Specification at
+# http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html
+# for how these should be used.
+
+# Persistent data storage
+GNUNET_DATA_HOME = ${XDG_DATA_HOME:-$GNUNET_HOME/.local/share}/gnunet/
+
+# Configuration files
+GNUNET_CONFIG_HOME = ${XDG_CONFIG_HOME:-$GNUNET_HOME/.config}/gnunet/
+
+# Cached data, no big deal if lost
+GNUNET_CACHE_HOME = ${XDG_CACHE_HOME:-$GNUNET_HOME/.cache}/gnunet/
+
+# Runtime data (i.e UNIX domain sockets, locks, always lost on system boot)
+# This is the variable for system-wide services; use GNUNET_USER_RUNTIME_DIR
+# for per-user services (where RUN_PER_USER=YES is set)
+# Note that the 'gnunet'/system user must have $TMPDIR/$TMP set to
+# exactly the same values as 'normal' users, otherwise this will fail.
+# If $TMPDIR or $TMP are set to different directories for different
+# users, this option should be changed to point to the same directory
+# for all users (i.e. by simply using "/tmp/gnunet-system-runtime/").
+GNUNET_RUNTIME_DIR = ${TMPDIR:-${TMP:-/tmp}}/gnunet-system-runtime/
+
+# Runtime data for per-user services
+GNUNET_USER_RUNTIME_DIR = ${TMPDIR:-${TMP:-/tmp}}/gnunet-${USERHOME:-${USER:-user}}-runtime/
+
+# Directory to use for temporary files.
+GNUNET_TMP = ${TMPDIR:-${TMP:-/tmp}}/gnunet/
+
+
+# Override for GNUNET_HOME used by test cases.
+# GNUNET_TEST_HOME = /tmp/foo/bar
+
+# DEFAULTCONFIG = /etc/gnunet.conf
+# If 'DEFAULTCONFIG' is not defined, the current
+# configuration file is assumed to be the default,
+# which is what we want by default...
+
+# Location of binaries requiring setuid or setgid flags, e.g. gnunet-helper-vpn.
+# By default it is assumed to be in the libexec directory, but on some systems
+# like NixOS setuid / setgid is only possible through a wrapper in a specific
+# location.
+# SUID_BINARY_PATH =
+
+
+[PEER]
+# Where do we store our private key?
+PRIVATE_KEY = $GNUNET_DATA_HOME/private_key.ecc
+
+# What kind of system are we on? Choices are
+# INFRASTRUCTURE (always-on, grid, data center)
+# DESKTOP (sometimes-on, grid, office)
+# NOTEBOOK (sometimes-on, mobile, often limited network,
+#           if on-battery than large battery)
+# MOBILE (sometimes-on, mobile, always limited network,
+#           always battery limited)
+# UNKNOWN (not configured/specified/known)
+SYSTEM_TYPE = UNKNOWN
+
+[TESTING]
+SPEEDUP_INTERVAL = 0 ms
+SPEEDUP_DELTA = 0 ms
+# This following option is applicable to LINUX.  Enabling this option causes all
+# UNIX domain sockets to be opened as abstract sockets.  Note that the
+# filesystem level restrictions no longer apply for abstract sockets.  An
+# end-user should not modify this option.
+USE_ABSTRACT_SOCKETS = NO
diff --git a/src/lib/util/util.supp b/src/lib/util/util.supp
new file mode 100644
index 000000000..f04775cac
--- /dev/null
+++ b/src/lib/util/util.supp
@@ -0,0 +1,11 @@
+{
+  cache-libexecdir-value
+  Memcheck:Leak
+  fun:malloc
+  fun:GNUNET_xmalloc_unchecked_
+  fun:GNUNET_xmalloc_
+  fun:GNUNET_asprintf
+  fun:GNUNET_OS_installation_get_path
+  fun:GNUNET_OS_get_libexec_binary_path
+  ...
+}
\ No newline at end of file