100 files changed, 21074 insertions, 0 deletions

diff --git a/src/plugin/Makefile.am b/src/plugin/Makefile.am
new file mode 100644
index 000000000..f74726ea2
--- /dev/null
+++ b/src/plugin/Makefile.am
@@ -0,0 +1,18 @@
+SUBDIRS = \
+        block \
+        dns \
+        gnsrecord \
+        peerstore \
+        datacache \
+        datastore \
+        namecache \
+        namestore \
+        dht \
+        setu \
+        seti \
+        revocation \
+        regex \
+        gns \
+        fs \
+        reclaim \
+        messenger
diff --git a/src/plugin/block/Makefile.am b/src/plugin/block/Makefile.am
new file mode 100644
index 000000000..9b72e4e3c
--- /dev/null
+++ b/src/plugin/block/Makefile.am
@@ -0,0 +1,37 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_test.la
+
+# Real plugins should of course go into
+# plugin_LTLIBRARIES
+noinst_LTLIBRARIES = \
+  libgnunet_plugin_block_template.la
+
+libgnunet_plugin_block_template_la_SOURCES = \
+  plugin_block_template.c
+libgnunet_plugin_block_template_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_template_la_LDFLAGS = \
+  $(GN_PLUGIN_LDFLAGS)
+
+libgnunet_plugin_block_test_la_SOURCES = \
+  plugin_block_test.c
+libgnunet_plugin_block_test_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la  \
+  $(LTLIBINTL)
+libgnunet_plugin_block_test_la_LDFLAGS = \
+  $(GN_PLUGIN_LDFLAGS)
+
diff --git a/src/plugin/block/meson.build b/src/plugin/block/meson.build
new file mode 100644
index 000000000..480a9f4ca
--- /dev/null
+++ b/src/plugin/block/meson.build
@@ -0,0 +1,15 @@
+plugin_dep = [libgnunetutil_dep, libgnunetblock_dep, libgnunetblockgroup_dep]
+shared_module('gnunet_plugin_block_test',
+      ['plugin_block_test.c'],
+      dependencies: plugin_dep,
+      include_directories: [incdir, configuration_inc],
+      install: true,
+      install_dir: get_option('libdir')/'gnunet')
+
+shared_module('gnunet_plugin_block_template',
+      ['plugin_block_template.c'],
+      dependencies: plugin_dep,
+      include_directories: [incdir, configuration_inc],
+      install: false,
+      install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/block/plugin_block_template.c b/src/plugin/block/plugin_block_template.c
new file mode 100644
index 000000000..4a271fa42
--- /dev/null
+++ b/src/plugin/block/plugin_block_template.c
@@ -0,0 +1,222 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file block/plugin_block_template.c
+ * @brief template for a block plugin
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+#define DEBUG_TEMPLATE GNUNET_EXTRA_LOGGING
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+
+/**
+ * How big is the BF we use for DHT blocks?
+ */
+#define TEMPLATE_BF_SIZE 8
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_template_create_group (void *ctx,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const void *raw_data,
+                                    size_t raw_data_size,
+                                    va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                   int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = TEMPLATE_BF_SIZE;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (ctx,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_template_check_query (void *cls,
+                                   enum GNUNET_BLOCK_Type type,
+                                   const struct GNUNET_HashCode *query,
+                                   const void *xquery,
+                                   size_t xquery_size)
+{
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_template_check_block (void *cls,
+                                   enum GNUNET_BLOCK_Type type,
+                                   const void *block,
+                                   size_t block_size)
+{
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_template_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_template_get_key (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *block,
+                               size_t block_size,
+                               struct GNUNET_HashCode *key)
+{
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls a `const struct GNUNET_CONFIGURATION_Handle`
+ */
+void *
+libgnunet_plugin_block_template_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    /* NOTE: insert supported block types here */
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_template_get_key;
+  api->check_query = &block_plugin_template_check_query;
+  api->check_block = &block_plugin_template_check_block;
+  api->check_reply = &block_plugin_template_check_reply;
+  api->create_group = &block_plugin_template_create_group;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_template_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_template.c */
diff --git a/src/plugin/block/plugin_block_test.c b/src/plugin/block/plugin_block_test.c
new file mode 100644
index 000000000..5afac9205
--- /dev/null
+++ b/src/plugin/block/plugin_block_test.c
@@ -0,0 +1,270 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file block/plugin_block_test.c
+ * @brief block plugin to test the DHT as a simple key-value store;
+ *        this plugin simply accepts any (new) response for any key
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+/**
+ * How big is the BF we use for DHT blocks?
+ */
+#define TEST_BF_SIZE 8
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_test_create_group (void *ctx,
+                                enum GNUNET_BLOCK_Type type,
+                                const void *raw_data,
+                                size_t raw_data_size,
+                                va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                   int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = TEST_BF_SIZE;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (ctx,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_test_check_query (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const struct GNUNET_HashCode *query,
+                               const void *xquery,
+                               size_t xquery_size)
+{
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_test_check_block (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *block,
+                               size_t block_size)
+{
+  (void) cls;
+  (void) block;
+  (void) block_size;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_test_check_reply (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               struct GNUNET_BLOCK_Group *group,
+                               const struct GNUNET_HashCode *query,
+                               const void *xquery,
+                               size_t xquery_size,
+                               const void *reply_block,
+                               size_t reply_block_size)
+{
+  struct GNUNET_HashCode chash;
+
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  GNUNET_CRYPTO_hash (reply_block,
+                      reply_block_size,
+                      &chash);
+  if (GNUNET_YES ==
+      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                          &chash))
+    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in @a block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_test_get_key (void *cls,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *block,
+                           size_t block_size,
+                           struct GNUNET_HashCode *key)
+{
+  (void) cls;
+  (void) block;
+  (void) block_size;
+  (void) key;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_block_test_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_TEST,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_test_get_key;
+  api->check_query = &block_plugin_test_check_query;
+  api->check_block = &block_plugin_test_check_block;
+  api->check_reply = &block_plugin_test_check_reply;
+  api->create_group = &block_plugin_test_create_group;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init
+ * @return NULL
+ */
+void *
+libgnunet_plugin_block_test_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_test.c */
diff --git a/src/plugin/datacache/Makefile.am b/src/plugin/datacache/Makefile.am
new file mode 100644
index 000000000..b9ae06975
--- /dev/null
+++ b/src/plugin/datacache/Makefile.am
@@ -0,0 +1,76 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+sqldir = $(prefix)/share/gnunet/sql/
+
+sql_DATA = \
+  datacache-0001.sql \
+  datacache-drop.sql
+
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+if HAVE_SQLITE
+  SQLITE_PLUGIN = libgnunet_plugin_datacache_sqlite.la
+endif
+if HAVE_POSTGRESQL
+  POSTGRES_PLUGIN = libgnunet_plugin_datacache_postgres.la
+endif
+
+plugin_LTLIBRARIES = \
+  $(SQLITE_PLUGIN) \
+  $(POSTGRES_PLUGIN) \
+  libgnunet_plugin_datacache_heap.la
+
+# Real plugins should of course go into
+# plugin_LTLIBRARIES
+noinst_LTLIBRARIES = \
+  libgnunet_plugin_datacache_template.la
+
+
+libgnunet_plugin_datacache_sqlite_la_SOURCES = \
+  plugin_datacache_sqlite.c
+libgnunet_plugin_datacache_sqlite_la_LIBADD = \
+  $(top_builddir)/src/lib/sq/libgnunetsq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
+  $(LTLIBINTL)
+libgnunet_plugin_datacache_sqlite_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+libgnunet_plugin_datacache_heap_la_SOURCES = \
+  plugin_datacache_heap.c
+libgnunet_plugin_datacache_heap_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_datacache_heap_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+libgnunet_plugin_datacache_postgres_la_SOURCES = \
+  plugin_datacache_postgres.c
+libgnunet_plugin_datacache_postgres_la_LIBADD = \
+  $(top_builddir)/src/lib/pq/libgnunetpq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_PLUGIN_LDFLAGS) -lpq
+libgnunet_plugin_datacache_postgres_la_CPPFLAGS = \
+ $(POSTGRESQL_CPPFLAGS) $(AM_CPPFLAGS)
+libgnunet_plugin_datacache_postgres_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
+
+libgnunet_plugin_datacache_template_la_SOURCES = \
+  plugin_datacache_template.c
+libgnunet_plugin_datacache_template_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_datacache_template_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+EXTRA_DIST = \
+ $(sql_DATA)
diff --git a/src/plugin/datacache/datacache-0001.sql b/src/plugin/datacache/datacache-0001.sql
new file mode 100644
index 000000000..6567de3c2
--- /dev/null
+++ b/src/plugin/datacache/datacache-0001.sql
@@ -0,0 +1,48 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+-- Check patch versioning is in place.
+SELECT _v.register_patch('datacache-0001', NULL, NULL);
+
+-------------------- Schema ----------------------------
+
+CREATE SCHEMA datacache;
+COMMENT ON SCHEMA datacache IS 'gnunet-datacache data';
+
+SET search_path TO datacache;
+
+CREATE TABLE IF NOT EXISTS gn180dc (
+  oid BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  type INT4 NOT NULL,
+  ro INT4 NOT NULL,
+  prox INT4 NOT NULL,
+  expiration_time INT8 NOT NULL,
+  key BYTEA NOT NULL CHECK(LENGTH(key)=64),
+  trunc BYTEA NOT NULL CHECK(LENGTH(trunc)=32),
+  value BYTEA NOT NULL,
+  path BYTEA DEFAULT NULL);
+
+CREATE INDEX IF NOT EXISTS idx_oid
+  ON gn180dc (oid);
+CREATE INDEX IF NOT EXISTS idx_key
+  ON gn180dc (key);
+CREATE INDEX IF NOT EXISTS idx_dt
+  ON gn180dc (expiration_time);
+
+COMMIT;
diff --git a/src/plugin/datacache/datacache-drop.sql b/src/plugin/datacache/datacache-drop.sql
new file mode 100644
index 000000000..2dd84bca8
--- /dev/null
+++ b/src/plugin/datacache/datacache-drop.sql
@@ -0,0 +1,25 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+
+SELECT _v.unregister_patch('datacache-0001');
+
+DROP SCHEMA datacache CASCADE;
+
+COMMIT;
diff --git a/src/plugin/datacache/meson.build b/src/plugin/datacache/meson.build
new file mode 100644
index 000000000..3c9e7d330
--- /dev/null
+++ b/src/plugin/datacache/meson.build
@@ -0,0 +1,30 @@
+install_data ('datacache-0001.sql',
+              'datacache-drop.sql',
+               install_dir: get_option('datadir')/'gnunet'/'sql')
+
+shared_module('gnunet_plugin_datacache_sqlite',
+        ['plugin_datacache_sqlite.c'],
+        dependencies: [libgnunetutil_dep,
+                       sqlite_dep,
+                       libgnunetsq_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+shared_module('gnunet_plugin_datacache_heap',
+        ['plugin_datacache_heap.c'],
+        dependencies: [libgnunetutil_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+if pq_dep.found()
+  shared_module('gnunet_plugin_datacache_postgres',
+          ['plugin_datacache_postgres.c'],
+          dependencies: [libgnunetutil_dep,
+                         pq_dep,
+                         libgnunetpq_dep],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+endif
diff --git a/src/plugin/datacache/plugin_datacache_heap.c b/src/plugin/datacache/plugin_datacache_heap.c
new file mode 100644
index 000000000..0dd8e47f8
--- /dev/null
+++ b/src/plugin/datacache/plugin_datacache_heap.c
@@ -0,0 +1,530 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012, 2015, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datacache/plugin_datacache_heap.c
+ * @brief heap-only implementation of a database backend for the datacache
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_datacache_plugin.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-heap", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, op, fn) GNUNET_log_from_strerror_file (kind, \
+                                                                       "datacache-heap", \
+                                                                       op, fn)
+
+#define NUM_HEAPS 24
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATACACHE_PluginEnvironment *env;
+
+  /**
+   * Our hash map.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *map;
+
+  /**
+   * Heaps sorted by distance.
+   */
+  struct GNUNET_CONTAINER_Heap *heaps[NUM_HEAPS];
+};
+
+
+/**
+ * Entry in the hash map.
+ */
+struct Value
+{
+  /**
+   * Block data.
+   */
+  struct GNUNET_DATACACHE_Block block;
+
+  /**
+   * Corresponding node in the heap.
+   */
+  struct GNUNET_CONTAINER_HeapNode *hn;
+
+  /**
+   * Put path as a non-const pointer.
+   */
+  struct GNUNET_DHT_PathElement *put_path;
+
+  /**
+   * How close is the hash to us? Determines which heap we are in!
+   */
+  uint32_t distance;
+
+};
+
+
+#define OVERHEAD (sizeof(struct Value) + 64)
+
+
+/**
+ * Closure for #put_cb().
+ */
+struct PutContext
+{
+  /**
+   * Block data.
+   */
+  const struct GNUNET_DATACACHE_Block *block;
+
+  /**
+   * Value to set to true if an equivalent block was found.
+   */
+  bool found;
+};
+
+
+/**
+ * Function called during PUT to detect if an equivalent block
+ * already exists.
+ *
+ * @param cls the `struct PutContext`
+ * @param key the key for the value(s)
+ * @param value an existing value
+ * @return #GNUNET_YES if not found (to continue to iterate)
+ */
+static enum GNUNET_GenericReturnValue
+put_cb (void *cls,
+        const struct GNUNET_HashCode *key,
+        void *value)
+{
+  struct PutContext *put_ctx = cls;
+  struct Value *val = value;
+
+  if ((val->block.data_size == put_ctx->block->data_size) &&
+      (val->block.type == put_ctx->block->type) &&
+      (0 == memcmp (val->block.data,
+                    put_ctx->block->data,
+                    put_ctx->block->data_size)))
+  {
+    put_ctx->found = true;
+    val->block.expiration_time
+      = GNUNET_TIME_absolute_max (val->block.expiration_time,
+                                  put_ctx->block->expiration_time);
+    /* replace old path with new path */
+    GNUNET_free (val->put_path);
+    val->put_path = GNUNET_memdup (put_ctx->block->put_path,
+                                   put_ctx->block->put_path_length
+                                   * sizeof (struct GNUNET_DHT_PathElement));
+    val->block.put_path = val->put_path;
+    val->block.put_path_length = put_ctx->block->put_path_length;
+    GNUNET_CONTAINER_heap_update_cost (val->hn,
+                                       val->block.expiration_time.abs_value_us);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got same value for key %s and type %u (size %u vs %u)\n",
+                GNUNET_h2s (key),
+                (unsigned int) val->block.type,
+                (unsigned int) val->block.data_size,
+                (unsigned int) put_ctx->block->data_size);
+    return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param xor_distance how close is @a key to our PID?
+ * @param block data to store
+ * @return 0 if duplicate, -1 on error, number of bytes used otherwise
+ */
+static ssize_t
+heap_plugin_put (void *cls,
+                 uint32_t xor_distance,
+                 const struct GNUNET_DATACACHE_Block *block)
+{
+  struct Plugin *plugin = cls;
+  struct Value *val;
+  struct PutContext put_ctx = {
+    .block = block,
+    .found = false
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Storing %u bytes under key %s with path length %u\n",
+              (unsigned int) block->data_size,
+              GNUNET_h2s (&block->key),
+              block->put_path_length);
+  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
+                                              &block->key,
+                                              &put_cb,
+                                              &put_ctx);
+  if (GNUNET_YES == put_ctx.found)
+    return 0;
+  val = GNUNET_malloc (sizeof(struct Value)
+                       + block->data_size);
+  GNUNET_memcpy (&val[1],
+                 block->data,
+                 block->data_size);
+  val->block = *block;
+  val->block.data = &val[1];
+  if (xor_distance >= NUM_HEAPS)
+    val->distance = NUM_HEAPS - 1;
+  else
+    val->distance = xor_distance;
+  if (0 != block->put_path_length)
+  {
+    val->put_path
+      = GNUNET_memdup (block->put_path,
+                       block->put_path_length
+                       * sizeof (struct GNUNET_DHT_PathElement));
+    val->block.put_path = val->put_path;
+  }
+  (void) GNUNET_CONTAINER_multihashmap_put (plugin->map,
+                                            &val->block.key,
+                                            val,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+  val->hn = GNUNET_CONTAINER_heap_insert (
+    plugin->heaps[val->distance],
+    val,
+    val->block.expiration_time.abs_value_us);
+  return val->block.data_size + OVERHEAD;
+}
+
+
+/**
+ * Closure for #get_cb().
+ */
+struct GetContext
+{
+  /**
+   * Function to call for each result.
+   */
+  GNUNET_DATACACHE_Iterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+
+  /**
+   * Number of results found.
+   */
+  unsigned int cnt;
+
+  /**
+   * Block type requested.
+   */
+  enum GNUNET_BLOCK_Type type;
+};
+
+
+/**
+ * Function called during GET to find matching blocks.
+ * Only matches by type.
+ *
+ * @param cls the `struct GetContext`
+ * @param key the key for the value(s)
+ * @param value an existing value
+ * @return #GNUNET_YES to continue to iterate
+ */
+static enum GNUNET_GenericReturnValue
+get_cb (void *cls,
+        const struct GNUNET_HashCode *key,
+        void *value)
+{
+  struct GetContext *get_ctx = cls;
+  struct Value *val = value;
+  enum GNUNET_GenericReturnValue ret;
+
+  if ( (get_ctx->type != val->block.type) &&
+       (GNUNET_BLOCK_TYPE_ANY != get_ctx->type) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s does not match block type %d\n",
+                GNUNET_h2s (key),
+                get_ctx->type);
+    return GNUNET_OK;
+  }
+  if (GNUNET_TIME_absolute_is_past (val->block.expiration_time))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s is expired\n",
+                GNUNET_h2s (key));
+    return GNUNET_OK;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found result for key %s\n",
+              GNUNET_h2s (key));
+  if (NULL != get_ctx->iter)
+    ret = get_ctx->iter (get_ctx->iter_cls,
+                         &val->block);
+  else
+    ret = GNUNET_YES;
+  get_ctx->cnt++;
+  return ret;
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key
+ * @param type entries of which type are relevant?
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+heap_plugin_get (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 enum GNUNET_BLOCK_Type type,
+                 GNUNET_DATACACHE_Iterator iter,
+                 void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GetContext get_ctx;
+
+  get_ctx.type = type;
+  get_ctx.iter = iter;
+  get_ctx.iter_cls = iter_cls;
+  get_ctx.cnt = 0;
+  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
+                                              key,
+                                              &get_cb,
+                                              &get_ctx);
+  return get_ctx.cnt;
+}
+
+
+/**
+ * Delete the entry with the lowest expiration value
+ * from the datacache right now.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+heap_plugin_del (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct Value *val;
+
+  for (unsigned int i = 0; i < NUM_HEAPS; i++)
+  {
+    val = GNUNET_CONTAINER_heap_remove_root (plugin->heaps[i]);
+    if (NULL != val)
+      break;
+  }
+  if (NULL == val)
+    return GNUNET_SYSERR;
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (plugin->map,
+                                                       &val->block.key,
+                                                       val));
+  plugin->env->delete_notify (plugin->env->cls,
+                              &val->block.key,
+                              val->block.data_size + OVERHEAD);
+  GNUNET_free (val->put_path);
+  GNUNET_free (val);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Closure for #find_closest().
+ */
+struct GetClosestContext
+{
+  struct Value **values;
+
+  const struct GNUNET_HashCode *key;
+
+  enum GNUNET_BLOCK_Type type;
+
+  unsigned int num_results;
+
+};
+
+
+static enum GNUNET_GenericReturnValue
+find_closest (void *cls,
+              const struct GNUNET_HashCode *key,
+              void *value)
+{
+  struct GetClosestContext *gcc = cls;
+  struct Value *val = value;
+  unsigned int j;
+
+  if (1 != GNUNET_CRYPTO_hash_cmp (key,
+                                   gcc->key))
+    return GNUNET_OK; /* useless */
+  if ( (val->block.type != gcc->type) &&
+       (GNUNET_BLOCK_TYPE_ANY != gcc->type) )
+    return GNUNET_OK; /* useless */
+  j = gcc->num_results;
+  for (unsigned int i = 0; i < gcc->num_results; i++)
+  {
+    if (NULL == gcc->values[i])
+    {
+      j = i;
+      break;
+    }
+    if (1 ==
+        GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->block.key,
+                                key))
+    {
+      j = i;
+      break;
+    }
+  }
+  if (j == gcc->num_results)
+    return GNUNET_OK;
+  gcc->values[j] = val;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over the results that are "close" to a particular key in
+ * the datacache.  "close" is defined as numerically larger than @a
+ * key (when interpreted as a circular address space), with small
+ * distance.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
+ * @param num_results number of results that should be returned to @a iter
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+heap_plugin_get_closest (void *cls,
+                         const struct GNUNET_HashCode *key,
+                         enum GNUNET_BLOCK_Type type,
+                         unsigned int num_results,
+                         GNUNET_DATACACHE_Iterator iter,
+                         void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct Value *values[num_results];
+  struct GetClosestContext gcc = {
+    .values = values,
+    .type = type,
+    .num_results = num_results * 2,
+    .key = key
+  };
+
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->map,
+                                         &find_closest,
+                                         &gcc);
+  for (unsigned int i = 0; i < num_results * 2; i++)
+  {
+    if (NULL == values[i])
+      return i;
+    if ( (NULL != iter) &&
+         (GNUNET_SYSERR ==
+          iter (iter_cls,
+                &values[i]->block)) )
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Ending iteration (client error)\n");
+      return i;
+    }
+  }
+  return num_results * 2;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
+ * @return the plugin's closure (our `struct Plugin`)
+ */
+void *
+libgnunet_plugin_datacache_heap_init (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
+  struct GNUNET_DATACACHE_PluginFunctions *api;
+  struct Plugin *plugin;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->map = GNUNET_CONTAINER_multihashmap_create (1024,   /* FIXME: base on quota! */
+                                                      GNUNET_YES);
+  for (unsigned int i = 0; i < NUM_HEAPS; i++)
+    plugin->heaps[i] = GNUNET_CONTAINER_heap_create (
+      GNUNET_CONTAINER_HEAP_ORDER_MIN);
+  plugin->env = env;
+  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
+  api->cls = plugin;
+  api->get = &heap_plugin_get;
+  api->put = &heap_plugin_put;
+  api->del = &heap_plugin_del;
+  api->get_closest = &heap_plugin_get_closest;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       _ ("Heap datacache running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our "struct Plugin")
+ * @return NULL
+ */
+void *
+libgnunet_plugin_datacache_heap_done (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+  struct Value *val;
+
+  for (unsigned int i = 0; i < NUM_HEAPS; i++)
+  {
+    while (NULL != (val = GNUNET_CONTAINER_heap_remove_root (plugin->heaps[i])))
+    {
+      GNUNET_assert (GNUNET_YES ==
+                     GNUNET_CONTAINER_multihashmap_remove (plugin->map,
+                                                           &val->block.key,
+                                                           val));
+      GNUNET_free (val->put_path);
+      GNUNET_free (val);
+    }
+    GNUNET_CONTAINER_heap_destroy (plugin->heaps[i]);
+  }
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->map);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datacache_heap.c */
diff --git a/src/plugin/datacache/plugin_datacache_postgres.c b/src/plugin/datacache/plugin_datacache_postgres.c
new file mode 100644
index 000000000..8bfd04aea
--- /dev/null
+++ b/src/plugin/datacache/plugin_datacache_postgres.c
@@ -0,0 +1,616 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datacache/plugin_datacache_postgres.c
+ * @brief postgres for an implementation of a database backend for the datacache
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_pq_lib.h"
+#include "gnunet_datacache_plugin.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-postgres", __VA_ARGS__)
+
+/**
+ * Per-entry overhead estimate
+ */
+#define OVERHEAD (sizeof(struct GNUNET_HashCode) + 24)
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATACACHE_PluginEnvironment *env;
+
+  /**
+   * Native Postgres database handle.
+   */
+  struct GNUNET_PQ_Context *dbh;
+
+  /**
+   * Number of key-value pairs in the database.
+   */
+  unsigned int num_items;
+};
+
+
+/**
+ * @brief Get a database handle
+ *
+ * @param plugin global context
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+init_connection (struct Plugin *plugin)
+{
+  struct GNUNET_PQ_PreparedStatement ps[] = {
+    GNUNET_PQ_make_prepare ("getkt",
+                            "SELECT expiration_time,type,ro,value,trunc,path"
+                            " FROM datacache.gn180dc"
+                            " WHERE key=$1 AND type=$2 AND expiration_time >= $3"),
+    GNUNET_PQ_make_prepare ("getk",
+                            "SELECT expiration_time,type,ro,value,trunc,path"
+                            " FROM datacache.gn180dc"
+                            " WHERE key=$1 AND expiration_time >= $2"),
+    GNUNET_PQ_make_prepare ("getex",
+                            "SELECT LENGTH(value) AS len,oid,key"
+                            " FROM datacache.gn180dc"
+                            " WHERE expiration_time < $1"
+                            " ORDER BY expiration_time ASC LIMIT 1"),
+    GNUNET_PQ_make_prepare ("getm",
+                            "SELECT LENGTH(value) AS len,oid,key"
+                            " FROM datacache.gn180dc"
+                            " ORDER BY prox ASC, expiration_time ASC LIMIT 1"),
+    GNUNET_PQ_make_prepare ("get_closest",
+                            "(SELECT expiration_time,type,ro,value,trunc,path,key"
+                            " FROM datacache.gn180dc"
+                            " WHERE key >= $1"
+                            "   AND expiration_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key ASC"
+                            " LIMIT $4)"
+                            " UNION "
+                            "(SELECT expiration_time,type,ro,value,trunc,path,key"
+                            " FROM datacache.gn180dc"
+                            " WHERE key <= $1"
+                            "   AND expiration_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key DESC"
+                            " LIMIT $4)"),
+    GNUNET_PQ_make_prepare ("delrow",
+                            "DELETE FROM datacache.gn180dc"
+                            " WHERE oid=$1"),
+    GNUNET_PQ_make_prepare ("put",
+                            "INSERT INTO datacache.gn180dc"
+                            " (type, ro, prox, expiration_time, key, value, trunc, path) "
+                            "VALUES ($1, $2, $3, $4, $5, $6, $7, $8)"),
+    GNUNET_PQ_PREPARED_STATEMENT_END
+  };
+
+  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->env->cfg,
+                                            "datacache-postgres",
+                                            "datacache-",
+                                            NULL,
+                                            ps);
+  if (NULL == plugin->dbh)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param prox proximity of @a key to my PID
+ * @param block data to store
+ * @return 0 if duplicate, -1 on error, number of bytes used otherwise
+ */
+static ssize_t
+postgres_plugin_put (void *cls,
+                     uint32_t prox,
+                     const struct GNUNET_DATACACHE_Block *block)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = (uint32_t) block->type;
+  uint32_t ro32 = (uint32_t) block->type;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_uint32 (&type32),
+    GNUNET_PQ_query_param_uint32 (&ro32),
+    GNUNET_PQ_query_param_uint32 (&prox),
+    GNUNET_PQ_query_param_absolute_time (&block->expiration_time),
+    GNUNET_PQ_query_param_auto_from_type (&block->key),
+    GNUNET_PQ_query_param_fixed_size (block->data,
+                                      block->data_size),
+    GNUNET_PQ_query_param_auto_from_type (&block->trunc_peer),
+    (0 == block->put_path_length)
+    ? GNUNET_PQ_query_param_null ()
+    : GNUNET_PQ_query_param_fixed_size (
+      block->put_path,
+      block->put_path_length
+      * sizeof(struct GNUNET_DHT_PathElement)),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus ret;
+
+  ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "put",
+                                            params);
+  if (0 > ret)
+    return -1;
+  plugin->num_items++;
+  return block->data_size + OVERHEAD;
+}
+
+
+/**
+ * Closure for #handle_results.
+ */
+struct HandleResultContext
+{
+  /**
+   * Function to call on each result, may be NULL.
+   */
+  GNUNET_DATACACHE_Iterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+
+  /**
+   * Key used.
+   */
+  const struct GNUNET_HashCode *key;
+};
+
+
+/**
+ * Function to be called with the results of a SELECT statement
+ * that has returned @a num_results results.  Parse the result
+ * and call the callback given in @a cls
+ *
+ * @param cls closure of type `struct HandleResultContext`
+ * @param result the postgres result
+ * @param num_results the number of results in @a result
+ */
+static void
+handle_results (void *cls,
+                PGresult *result,
+                unsigned int num_results)
+{
+  struct HandleResultContext *hrc = cls;
+
+  for (unsigned int i = 0; i < num_results; i++)
+  {
+    uint32_t type32;
+    uint32_t bro32;
+    void *data;
+    struct GNUNET_DATACACHE_Block block;
+    void *path = NULL;
+    size_t path_size = 0;
+    struct GNUNET_PQ_ResultSpec rs[] = {
+      GNUNET_PQ_result_spec_absolute_time ("expiration_time",
+                                           &block.expiration_time),
+      GNUNET_PQ_result_spec_uint32 ("type",
+                                    &type32),
+      GNUNET_PQ_result_spec_uint32 ("ro",
+                                    &bro32),
+      GNUNET_PQ_result_spec_variable_size ("value",
+                                           &data,
+                                           &block.data_size),
+      GNUNET_PQ_result_spec_auto_from_type ("trunc",
+                                            &block.trunc_peer),
+      GNUNET_PQ_result_spec_allow_null (
+        GNUNET_PQ_result_spec_variable_size ("path",
+                                             &path,
+                                             &path_size),
+        NULL),
+      GNUNET_PQ_result_spec_end
+    };
+
+    if (GNUNET_YES !=
+        GNUNET_PQ_extract_result (result,
+                                  rs,
+                                  i))
+    {
+      GNUNET_break (0);
+      return;
+    }
+    if (0 != (path_size % sizeof(struct GNUNET_DHT_PathElement)))
+    {
+      GNUNET_break (0);
+      path_size = 0;
+      path = NULL;
+    }
+    block.data = data;
+    block.put_path = path;
+    block.put_path_length
+      = path_size / sizeof (struct GNUNET_DHT_PathElement);
+    block.type = (enum GNUNET_BLOCK_Type) type32;
+    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
+    block.key = *hrc->key;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Found result of size %u bytes and type %u in database\n",
+         (unsigned int) block.data_size,
+         (unsigned int) block.type);
+    if ( (NULL != hrc->iter) &&
+         (GNUNET_SYSERR ==
+          hrc->iter (hrc->iter_cls,
+                     &block)) )
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Ending iteration (client error)\n");
+      GNUNET_PQ_cleanup_result (rs);
+      return;
+    }
+    GNUNET_PQ_cleanup_result (rs);
+  }
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key key to look for
+ * @param type entries of which type are relevant?
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+postgres_plugin_get (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     enum GNUNET_BLOCK_Type type,
+                     GNUNET_DATACACHE_Iterator iter,
+                     void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = (uint32_t) type;
+  struct GNUNET_TIME_Absolute now = { 0 };
+  struct GNUNET_PQ_QueryParam paramk[] = {
+    GNUNET_PQ_query_param_auto_from_type (key),
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_QueryParam paramkt[] = {
+    GNUNET_PQ_query_param_auto_from_type (key),
+    GNUNET_PQ_query_param_uint32 (&type32),
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+  struct HandleResultContext hr_ctx;
+
+  now = GNUNET_TIME_absolute_get ();
+  hr_ctx.iter = iter;
+  hr_ctx.iter_cls = iter_cls;
+  hr_ctx.key = key;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              (0 == type) ? "getk" : "getkt",
+                                              (0 == type) ? paramk : paramkt,
+                                              &handle_results,
+                                              &hr_ctx);
+  if (res < 0)
+    return 0;
+  return res;
+}
+
+
+/**
+ * Delete the entry with the lowest expiration value
+ * from the datacache right now.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+postgres_plugin_del (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_QueryParam pempty[] = {
+    GNUNET_PQ_query_param_end
+  };
+  uint32_t size;
+  uint64_t oid;
+  struct GNUNET_HashCode key;
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_uint32 ("len",
+                                  &size),
+    GNUNET_PQ_result_spec_uint64 ("oid",
+                                  &oid),
+    GNUNET_PQ_result_spec_auto_from_type ("key",
+                                          &key),
+    GNUNET_PQ_result_spec_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+  struct GNUNET_PQ_QueryParam dparam[] = {
+    GNUNET_PQ_query_param_uint64 (&oid),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_PQ_QueryParam xparam[] = {
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_end
+  };
+
+  now = GNUNET_TIME_absolute_get ();
+  res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
+                                                  "getex",
+                                                  xparam,
+                                                  rs);
+  if (0 >= res)
+    res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
+                                                    "getm",
+                                                    pempty,
+                                                    rs);
+  if (0 > res)
+    return GNUNET_SYSERR;
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+  {
+    /* no result */
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Ending iteration (no more results)\n");
+    return 0;
+  }
+  res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "delrow",
+                                            dparam);
+  if (0 > res)
+  {
+    GNUNET_PQ_cleanup_result (rs);
+    return GNUNET_SYSERR;
+  }
+  plugin->num_items--;
+  plugin->env->delete_notify (plugin->env->cls,
+                              &key,
+                              size + OVERHEAD);
+  GNUNET_PQ_cleanup_result (rs);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Closure for #extract_result_cb.
+ */
+struct ExtractResultContext
+{
+  /**
+   * Function to call for each result found.
+   */
+  GNUNET_DATACACHE_Iterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+};
+
+
+/**
+ * Function to be called with the results of a SELECT statement
+ * that has returned @a num_results results.  Calls the `iter`
+ * from @a cls for each result.
+ *
+ * @param cls closure with the `struct ExtractResultContext`
+ * @param result the postgres result
+ * @param num_results the number of results in @a result
+ */
+static void
+extract_result_cb (void *cls,
+                   PGresult *result,
+                   unsigned int num_results)
+{
+  struct ExtractResultContext *erc = cls;
+
+  if (NULL == erc->iter)
+    return;
+  for (unsigned int i = 0; i < num_results; i++)
+  {
+    uint32_t type32;
+    uint32_t bro32;
+    struct GNUNET_DATACACHE_Block block;
+    void *data;
+    void *path;
+    size_t path_size;
+    struct GNUNET_PQ_ResultSpec rs[] = {
+      GNUNET_PQ_result_spec_absolute_time ("expiration_time",
+                                           &block.expiration_time),
+      GNUNET_PQ_result_spec_uint32 ("type",
+                                    &type32),
+      GNUNET_PQ_result_spec_uint32 ("ro",
+                                    &bro32),
+      GNUNET_PQ_result_spec_variable_size ("value",
+                                           &data,
+                                           &block.data_size),
+      GNUNET_PQ_result_spec_auto_from_type ("trunc",
+                                            &block.trunc_peer),
+      GNUNET_PQ_result_spec_variable_size ("path",
+                                           &path,
+                                           &path_size),
+      GNUNET_PQ_result_spec_auto_from_type ("key",
+                                            &block.key),
+      GNUNET_PQ_result_spec_end
+    };
+
+    if (GNUNET_YES !=
+        GNUNET_PQ_extract_result (result,
+                                  rs,
+                                  i))
+    {
+      GNUNET_break (0);
+      return;
+    }
+    if (0 != (path_size % sizeof(struct GNUNET_DHT_PathElement)))
+    {
+      GNUNET_break (0);
+      path_size = 0;
+      path = NULL;
+    }
+    block.type = (enum GNUNET_BLOCK_Type) type32;
+    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
+    block.data = data;
+    block.put_path = path;
+    block.put_path_length = path_size / sizeof (struct GNUNET_DHT_PathElement);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Found result of size %u bytes and type %u in database\n",
+         (unsigned int) block.data_size,
+         (unsigned int) block.type);
+    if ( (NULL != erc->iter) &&
+         (GNUNET_SYSERR ==
+          erc->iter (erc->iter_cls,
+                     &block)) )
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Ending iteration (client error)\n");
+      GNUNET_PQ_cleanup_result (rs);
+      break;
+    }
+    GNUNET_PQ_cleanup_result (rs);
+  }
+}
+
+
+/**
+ * Iterate over the results that are "close" to a particular key in
+ * the datacache.  "close" is defined as numerically larger than @a
+ * key (when interpreted as a circular address space), with small
+ * distance.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
+ * @param num_results number of results that should be returned to @a iter
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+postgres_plugin_get_closest (void *cls,
+                             const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
+                             unsigned int num_results,
+                             GNUNET_DATACACHE_Iterator iter,
+                             void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t num_results32 = (uint32_t) num_results;
+  uint32_t type32 = (uint32_t) type;
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (key),
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_uint32 (&type32),
+    GNUNET_PQ_query_param_uint32 (&num_results32),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+  struct ExtractResultContext erc;
+
+  erc.iter = iter;
+  erc.iter_cls = iter_cls;
+  now = GNUNET_TIME_absolute_get ();
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "get_closest",
+                                              params,
+                                              &extract_result_cb,
+                                              &erc);
+  if (0 > res)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Ending iteration (postgres error)\n");
+    return 0;
+  }
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+  {
+    /* no result */
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Ending iteration (no more results)\n");
+    return 0;
+  }
+  return res;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
+ * @return the plugin's closure (our `struct Plugin`)
+ */
+void *
+libgnunet_plugin_datacache_postgres_init (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
+  struct GNUNET_DATACACHE_PluginFunctions *api;
+  struct Plugin *plugin;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+
+  if (GNUNET_OK != init_connection (plugin))
+  {
+    GNUNET_free (plugin);
+    return NULL;
+  }
+
+  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
+  api->cls = plugin;
+  api->get = &postgres_plugin_get;
+  api->put = &postgres_plugin_put;
+  api->del = &postgres_plugin_del;
+  api->get_closest = &postgres_plugin_get_closest;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Postgres datacache running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return NULL
+ */
+void *
+libgnunet_plugin_datacache_postgres_done (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_PQ_exec_sql (plugin->dbh,
+                                    "datacache-drop"));
+  GNUNET_PQ_disconnect (plugin->dbh);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datacache_postgres.c */
diff --git a/src/plugin/datacache/plugin_datacache_sqlite.c b/src/plugin/datacache/plugin_datacache_sqlite.c
new file mode 100644
index 000000000..1c6f24a82
--- /dev/null
+++ b/src/plugin/datacache/plugin_datacache_sqlite.c
@@ -0,0 +1,1063 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datacache/plugin_datacache_sqlite.c
+ * @brief sqlite for an implementation of a database backend for the datacache
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_datacache_plugin.h"
+#include "gnunet_sq_lib.h"
+#include <sqlite3.h>
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-sqlite", __VA_ARGS__)
+
+#define LOG_STRERROR_FILE(kind, op, fn) \
+  GNUNET_log_from_strerror_file (kind, "datacache-sqlite", op, fn)
+
+
+/**
+ * How much overhead do we assume per entry in the
+ * datacache?
+ */
+#define OVERHEAD (sizeof(struct GNUNET_HashCode) + 36)
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATACACHE_PluginEnvironment *env;
+
+  /**
+   * Handle to the sqlite database.
+   */
+  sqlite3 *dbh;
+
+  /**
+   * Filename used for the DB.
+   */
+  char *fn;
+
+  /**
+   * Prepared statement for #sqlite_plugin_put.
+   */
+  sqlite3_stmt *insert_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_get.
+   */
+  sqlite3_stmt *get_count_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_get.
+   */
+  sqlite3_stmt *get_count_any_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_get.
+   */
+  sqlite3_stmt *get_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_get.
+   */
+  sqlite3_stmt *get_any_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_del.
+   */
+  sqlite3_stmt *del_select_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_del.
+   */
+  sqlite3_stmt *del_expired_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_del.
+   */
+  sqlite3_stmt *del_stmt;
+
+  /**
+   * Prepared statement for #sqlite_plugin_get_closest.
+   */
+  sqlite3_stmt *get_closest_stmt;
+
+  /**
+   * Number of key-value pairs in the database.
+   */
+  unsigned int num_items;
+};
+
+
+/**
+ * Log an error message at log-level @a level that indicates
+ * a failure of the command @a cmd with the error from the database @a db
+ *
+ * @param db database handle
+ * @param level log level
+ * @param cmd failed command
+ */
+#define LOG_SQLITE(db, level, cmd)                    \
+  do                                                  \
+  {                                                   \
+    LOG (level,                                       \
+         _ ("`%s' failed at %s:%d with error: %s\n"), \
+         cmd,                                         \
+         __FILE__,                                    \
+         __LINE__,                                    \
+         sqlite3_errmsg (db));                        \
+  } while (0)
+
+
+/**
+ * Execute SQL statement.
+ *
+ * @param db database handle
+ * @param cmd SQL command to execute
+ */
+#define SQLITE3_EXEC(db, cmd)                                   \
+  do                                                            \
+  {                                                             \
+    emsg = NULL;                                                \
+    if (SQLITE_OK !=                                            \
+        sqlite3_exec (db, cmd, NULL, NULL, &emsg))              \
+    {                                                           \
+      LOG (GNUNET_ERROR_TYPE_ERROR,                             \
+           _ ("`%s' failed at %s:%d with error: %s\n"),         \
+           "sqlite3_exec",                                      \
+           __FILE__,                                            \
+           __LINE__,                                            \
+           emsg);                                               \
+      sqlite3_free (emsg);                                      \
+    }                                                           \
+  } while (0)
+
+
+/**
+ * @brief Prepare a SQL statement
+ *
+ * @param dbh database handle
+ * @param zSql SQL statement text
+ * @param[out] ppStmt set to the prepared statement
+ * @return 0 on success
+ */
+static int
+sq_prepare (sqlite3 *dbh,
+            const char *zSql, /* SQL statement, UTF-8 encoded */
+            sqlite3_stmt **ppStmt)
+{ /* OUT: Statement handle */
+  char *dummy;
+
+  return sqlite3_prepare (dbh,
+                          zSql,
+                          strlen (zSql),
+                          ppStmt,
+                          (const char **) &dummy);
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param xor_distance how close is @a key to our PID?
+ * @param block data to store
+ * @return 0 if duplicate, -1 on error, number of bytes used otherwise
+ */
+static ssize_t
+sqlite_plugin_put (void *cls,
+                   uint32_t xor_distance,
+                   const struct GNUNET_DATACACHE_Block *block)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = (uint32_t) block->type;
+  uint32_t ro32 = (uint32_t) block->ro;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_uint32 (&ro32),
+    GNUNET_SQ_query_param_absolute_time (&block->expiration_time),
+    GNUNET_SQ_query_param_auto_from_type (&block->key),
+    GNUNET_SQ_query_param_uint32 (&xor_distance),
+    GNUNET_SQ_query_param_fixed_size (block->data,
+                                      block->data_size),
+    GNUNET_SQ_query_param_fixed_size (block->put_path,
+                                      block->put_path_length
+                                      * sizeof(struct GNUNET_DHT_PathElement)),
+    GNUNET_SQ_query_param_auto_from_type (&block->trunc_peer),
+    GNUNET_SQ_query_param_end
+  };
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing PUT of %u bytes with key `%s' and expiration %s\n",
+       (unsigned int) block->data_size,
+       GNUNET_h2s (&block->key),
+       GNUNET_STRINGS_relative_time_to_string (
+         GNUNET_TIME_absolute_get_remaining (
+           block->expiration_time),
+         GNUNET_YES));
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->insert_stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_bind_xxx");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->insert_stmt);
+    return -1;
+  }
+  if (SQLITE_DONE !=
+      sqlite3_step (plugin->insert_stmt))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->insert_stmt);
+    return -1;
+  }
+  plugin->num_items++;
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->insert_stmt);
+  return block->data_size + OVERHEAD;
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+get_any (void *cls,
+         const struct GNUNET_HashCode *key,
+         GNUNET_DATACACHE_Iterator iter,
+         void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_TIME_Absolute now;
+  unsigned int cnt;
+  uint32_t off;
+  uint32_t btype32;
+  uint32_t bro32;
+  unsigned int total;
+  struct GNUNET_DATACACHE_Block block;
+  void *path;
+  void *data;
+  size_t path_size;
+  struct GNUNET_SQ_QueryParam params_count[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_QueryParam params_select[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_uint32 (&off),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size (&data,
+                                         &block.data_size),
+    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
+    GNUNET_SQ_result_spec_variable_size (&path,
+                                         &path_size),
+    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
+    GNUNET_SQ_result_spec_uint32 (&btype32),
+    GNUNET_SQ_result_spec_uint32 (&bro32),
+    GNUNET_SQ_result_spec_end
+  };
+
+  now = GNUNET_TIME_absolute_get ();
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing GET for key `%s'\n",
+       GNUNET_h2s (key));
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->get_count_any_stmt,
+                      params_count))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_bind_xxx");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_count_any_stmt);
+    return 0;
+  }
+  if (SQLITE_ROW !=
+      sqlite3_step (plugin->get_count_any_stmt))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite_step");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_count_any_stmt);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "No content found when processing GET for key `%s'\n",
+         GNUNET_h2s (key));
+    return 0;
+  }
+  total = sqlite3_column_int (plugin->get_count_any_stmt,
+                              0);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_count_any_stmt);
+  if ( (0 == total) ||
+       (NULL == iter) )
+  {
+    if (0 == total)
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "No content found when processing GET for key `%s'\n",
+           GNUNET_h2s (key));
+    return total;
+  }
+
+  cnt = 0;
+  block.key = *key;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  total);
+  while (cnt < total)
+  {
+    off = (off + 1) % total;
+    if (GNUNET_OK !=
+        GNUNET_SQ_bind (plugin->get_any_stmt,
+                        params_select))
+    {
+      LOG_SQLITE (plugin->dbh,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite3_bind_xxx");
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_any_stmt);
+      return cnt;
+    }
+    if (SQLITE_ROW !=
+        sqlite3_step (plugin->get_any_stmt))
+      break;
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->get_any_stmt,
+                                  rs))
+    {
+      GNUNET_break (0);
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_any_stmt);
+      break;
+    }
+    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
+    {
+      GNUNET_break (0);
+      path_size = 0;
+      path = NULL;
+    }
+    block.data = data;
+    block.put_path = path;
+    block.put_path_length = path_size / sizeof(struct GNUNET_DHT_PathElement);
+    block.type = (enum GNUNET_BLOCK_Type) btype32;
+    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
+    cnt++;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Found %u-byte result when processing GET for key `%s'\n",
+         (unsigned int) block.data_size,
+         GNUNET_h2s (&block.key));
+    if (GNUNET_OK !=
+        iter (iter_cls,
+              &block))
+    {
+      GNUNET_SQ_cleanup_result (rs);
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_any_stmt);
+      break;
+    }
+    GNUNET_SQ_cleanup_result (rs);
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_any_stmt);
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_any_stmt);
+  return cnt;
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key
+ * @param type entries of which type are relevant?
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+get_typed (void *cls,
+           const struct GNUNET_HashCode *key,
+           enum GNUNET_BLOCK_Type type,
+           GNUNET_DATACACHE_Iterator iter,
+           void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = type;
+  struct GNUNET_TIME_Absolute now;
+  unsigned int cnt;
+  uint32_t off;
+  uint32_t bro32;
+  unsigned int total;
+  struct GNUNET_DATACACHE_Block block;
+  void *path;
+  void *data;
+  size_t path_size;
+  struct GNUNET_SQ_QueryParam params_count[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_QueryParam params_select[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_uint32 (&off),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size (&data,
+                                         &block.data_size),
+    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
+    GNUNET_SQ_result_spec_variable_size (&path,
+                                         &path_size),
+    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
+    GNUNET_SQ_result_spec_uint32 (&bro32),
+    GNUNET_SQ_result_spec_end
+  };
+
+  now = GNUNET_TIME_absolute_get ();
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing GET for key `%s'\n",
+       GNUNET_h2s (key));
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->get_count_stmt,
+                      params_count))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_bind_xxx");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_count_stmt);
+    return 0;
+  }
+  if (SQLITE_ROW !=
+      sqlite3_step (plugin->get_count_stmt))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite_step");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_count_stmt);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "No content found when processing GET for key `%s'\n",
+         GNUNET_h2s (key));
+    return 0;
+  }
+  total = sqlite3_column_int (plugin->get_count_stmt,
+                              0);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_count_stmt);
+  if ( (0 == total) ||
+       (NULL == iter) )
+  {
+    if (0 == total)
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "No content found when processing GET for key `%s'\n",
+           GNUNET_h2s (key));
+    return total;
+  }
+
+  cnt = 0;
+  block.key = *key;
+  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  total);
+  while (cnt < total)
+  {
+    off = (off + 1) % total;
+    if (GNUNET_OK !=
+        GNUNET_SQ_bind (plugin->get_stmt,
+                        params_select))
+    {
+      LOG_SQLITE (plugin->dbh,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite3_bind_xxx");
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_stmt);
+      return cnt;
+    }
+    if (SQLITE_ROW !=
+        sqlite3_step (plugin->get_stmt))
+      break;
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->get_stmt,
+                                  rs))
+    {
+      GNUNET_break (0);
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_stmt);
+      break;
+    }
+    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
+    {
+      GNUNET_break (0);
+      path_size = 0;
+      path = NULL;
+    }
+    block.data = data;
+    block.put_path = path;
+    block.put_path_length = path_size / sizeof(struct GNUNET_DHT_PathElement);
+    block.type = type;
+    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
+    cnt++;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Found %u-byte result when processing GET for key `%s'\n",
+         (unsigned int) block.data_size,
+         GNUNET_h2s (&block.key));
+    if ( (NULL != iter) &&
+         (GNUNET_OK !=
+          iter (iter_cls,
+                &block)) )
+    {
+      GNUNET_SQ_cleanup_result (rs);
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->get_stmt);
+      break;
+    }
+    GNUNET_SQ_cleanup_result (rs);
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_stmt);
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_stmt);
+  return cnt;
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key
+ * @param type entries of which type are relevant?
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+sqlite_plugin_get (void *cls,
+                   const struct GNUNET_HashCode *key,
+                   enum GNUNET_BLOCK_Type type,
+                   GNUNET_DATACACHE_Iterator iter,
+                   void *iter_cls)
+{
+  if (GNUNET_BLOCK_TYPE_ANY == type)
+    return get_any (cls,
+                    key,
+                    iter,
+                    iter_cls);
+  return get_typed (cls,
+                    key,
+                    type,
+                    iter,
+                    iter_cls);
+}
+
+
+/**
+ * Delete the entry with the lowest expiration value
+ * from the datacache right now.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+sqlite_plugin_del (void *cls)
+{
+  struct Plugin *plugin = cls;
+  uint64_t rowid;
+  void *data;
+  size_t data_size;
+  struct GNUNET_HashCode hc;
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_uint64 (&rowid),
+    GNUNET_SQ_result_spec_auto_from_type (&hc),
+    GNUNET_SQ_result_spec_variable_size (&data,
+                                         &data_size),
+    GNUNET_SQ_result_spec_end
+  };
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_uint64 (&rowid),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_QueryParam time_params[] = {
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_end
+  };
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing DEL\n");
+  now = GNUNET_TIME_absolute_get ();
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->del_expired_stmt,
+                      time_params))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->del_expired_stmt);
+    return GNUNET_SYSERR;
+  }
+  if ( (SQLITE_ROW !=
+        sqlite3_step (plugin->del_expired_stmt)) ||
+       (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->del_expired_stmt,
+                                  rs)))
+  {
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->del_expired_stmt);
+    if (SQLITE_ROW !=
+        sqlite3_step (plugin->del_select_stmt))
+    {
+      LOG_SQLITE (plugin->dbh,
+                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "sqlite3_step");
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->del_select_stmt);
+      return GNUNET_SYSERR;
+    }
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->del_select_stmt,
+                                  rs))
+    {
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->del_select_stmt);
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+  }
+  GNUNET_SQ_cleanup_result (rs);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->del_select_stmt);
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->del_stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->del_stmt);
+    return GNUNET_SYSERR;
+  }
+  if (SQLITE_DONE !=
+      sqlite3_step (plugin->del_stmt))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->del_stmt);
+    return GNUNET_SYSERR;
+  }
+  plugin->num_items--;
+  plugin->env->delete_notify (plugin->env->cls,
+                              &hc,
+                              data_size + OVERHEAD);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->del_stmt);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over the results that are "close" to a particular key in
+ * the datacache.  "close" is defined as numerically larger than @a
+ * key (when interpreted as a circular address space), with small
+ * distance.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
+ * @param num_results number of results that should be returned to @a iter
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+sqlite_plugin_get_closest (void *cls,
+                           const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
+                           unsigned int num_results,
+                           GNUNET_DATACACHE_Iterator iter,
+                           void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = type;
+  uint32_t num_results32 = num_results;
+  struct GNUNET_TIME_Absolute now;
+  void *data;
+  void *path;
+  size_t path_size;
+  unsigned int cnt;
+  uint32_t bro32;
+  struct GNUNET_DATACACHE_Block block;
+  uint32_t rtype32;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_uint32 (&num_results32),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size (&data,
+                                         &block.data_size),
+    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
+    GNUNET_SQ_result_spec_variable_size (&path,
+                                         &path_size),
+    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
+    GNUNET_SQ_result_spec_uint32 (&rtype32),
+    GNUNET_SQ_result_spec_uint32 (&bro32),
+    GNUNET_SQ_result_spec_auto_from_type (&block.key),
+    GNUNET_SQ_result_spec_end
+  };
+
+  now = GNUNET_TIME_absolute_get ();
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing GET_CLOSEST for key `%s'\n",
+       GNUNET_h2s (key));
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->get_closest_stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_xxx");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_closest_stmt);
+    return 0;
+  }
+  cnt = 0;
+  while (SQLITE_ROW ==
+         sqlite3_step (plugin->get_closest_stmt))
+  {
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->get_closest_stmt,
+                                  rs))
+    {
+      GNUNET_break (0);
+      break;
+    }
+    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
+    {
+      GNUNET_break (0);
+      path_size = 0;
+      path = NULL;
+    }
+    block.put_path_length
+      = path_size / sizeof(struct GNUNET_DHT_PathElement);
+    block.put_path = path;
+    block.data = data;
+    block.type = (enum GNUNET_BLOCK_Type) rtype32;
+    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
+    cnt++;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Found %u-byte result at %s when processing GET_CLOSE\n",
+         (unsigned int) block.data_size,
+         GNUNET_h2s (&block.key));
+
+    if (GNUNET_OK !=
+        iter (iter_cls,
+              &block))
+    {
+      GNUNET_SQ_cleanup_result (rs);
+      break;
+    }
+    GNUNET_SQ_cleanup_result (rs);
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_closest_stmt);
+  return cnt;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironment`)
+ * @return the plugin's closure (our `struct Plugin`)
+ */
+void *
+libgnunet_plugin_datacache_sqlite_init (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
+  struct GNUNET_DATACACHE_PluginFunctions *api;
+  struct Plugin *plugin;
+  char *fn;
+  char *fn_utf8;
+  sqlite3 *dbh;
+  char *emsg;
+
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
+                                            "datacache-sqlite",
+                                            "IN_MEMORY"))
+  {
+    if (SQLITE_OK !=
+        sqlite3_open (":memory:",
+                      &dbh))
+      return NULL;
+    fn_utf8 = NULL;
+  }
+  else
+  {
+    fn = GNUNET_DISK_mktemp ("gnunet-datacache");
+    if (NULL == fn)
+    {
+      GNUNET_break (0);
+      return NULL;
+    }
+    /* fn should be UTF-8-encoded. If it isn't, it's a bug. */
+    fn_utf8 = GNUNET_strdup (fn);
+    if (SQLITE_OK !=
+        sqlite3_open (fn_utf8,
+                      &dbh))
+    {
+      GNUNET_free (fn);
+      GNUNET_free (fn_utf8);
+      return NULL;
+    }
+    GNUNET_free (fn);
+  }
+
+  SQLITE3_EXEC (dbh, "PRAGMA temp_store=MEMORY");
+  SQLITE3_EXEC (dbh, "PRAGMA locking_mode=EXCLUSIVE");
+  SQLITE3_EXEC (dbh, "PRAGMA journal_mode=OFF");
+  SQLITE3_EXEC (dbh, "PRAGMA synchronous=OFF");
+  SQLITE3_EXEC (dbh, "PRAGMA page_size=4092");
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
+                                            "datacache-sqlite",
+                                            "IN_MEMORY"))
+    SQLITE3_EXEC (dbh, "PRAGMA sqlite_temp_store=3");
+
+  SQLITE3_EXEC (dbh,
+                "CREATE TABLE ds180 ("
+                "  type INTEGER NOT NULL DEFAULT 0,"
+                "  ro INTEGER NOT NULL DEFAULT 0,"
+                "  expire INTEGER NOT NULL,"
+                "  key BLOB NOT NULL DEFAULT '',"
+                "  prox INTEGER NOT NULL,"
+                "  value BLOB NOT NULL,"
+                "  trunc BLOB NOT NULL,"
+                "  path BLOB DEFAULT '')");
+  SQLITE3_EXEC (dbh,
+                "CREATE INDEX idx_hashidx"
+                " ON ds180 (key,type,expire)");
+  SQLITE3_EXEC (dbh,
+                "CREATE INDEX idx_prox_expire"
+                " ON ds180 (prox,expire)");
+  SQLITE3_EXEC (dbh,
+                "CREATE INDEX idx_expire_only"
+                " ON ds180 (expire)");
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  plugin->dbh = dbh;
+  plugin->fn = fn_utf8;
+
+  if ((SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "INSERT INTO ds180"
+                   " (type, ro, expire, key, prox, value, path, trunc)"
+                   " VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+                   &plugin->insert_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT COUNT(*) FROM ds180 "
+                   "WHERE key=?"
+                   " AND type=?"
+                   " AND expire >= ?",
+                   &plugin->get_count_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT COUNT(*) FROM ds180 "
+                   "WHERE key=? AND expire >= ?",
+                   &plugin->get_count_any_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT value,expire,path,trunc,ro"
+                   " FROM ds180"
+                   " WHERE key=?"
+                   " AND type=?"
+                   " AND expire >= ?"
+                   " LIMIT 1 OFFSET ?",
+                   &plugin->get_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT value,expire,path,trunc,type,ro"
+                   " FROM ds180"
+                   " WHERE key=?"
+                   " AND expire >= ?"
+                   " LIMIT 1 OFFSET ?",
+                   &plugin->get_any_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT _ROWID_,key,value FROM ds180"
+                   " WHERE expire < ?1"
+                   " ORDER BY expire ASC LIMIT 1",
+                   &plugin->del_expired_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT _ROWID_,key,value FROM ds180"
+                   " ORDER BY prox ASC, expire ASC LIMIT 1",
+                   &plugin->del_select_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "DELETE FROM ds180 WHERE _ROWID_=?",
+                   &plugin->del_stmt)) ||
+      (SQLITE_OK !=
+       sq_prepare (plugin->dbh,
+                   "SELECT * FROM ("
+                   " SELECT value,expire,path,trunc,type,ro,key"
+                   " FROM ds180 "
+                   " WHERE key>=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY ASC LIMIT ?4)"
+                   "UNION "
+                   "SELECT * FROM ("
+                   " SELECT value,expire,path,trunc,type,ro,key"
+                   " FROM ds180 "
+                   " WHERE key<=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY DESC LIMIT ?4)",
+                   &plugin->get_closest_stmt)))
+  {
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sq_prepare");
+    GNUNET_break (SQLITE_OK ==
+                  sqlite3_close (plugin->dbh));
+    GNUNET_free (plugin);
+    return NULL;
+  }
+
+  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
+  api->cls = plugin;
+  api->get = &sqlite_plugin_get;
+  api->put = &sqlite_plugin_put;
+  api->del = &sqlite_plugin_del;
+  api->get_closest = &sqlite_plugin_get_closest;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Sqlite datacache running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return NULL
+ */
+void *
+libgnunet_plugin_datacache_sqlite_done (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+  int result;
+
+#if SQLITE_VERSION_NUMBER >= 3007000
+  sqlite3_stmt *stmt;
+#endif
+
+#if ! WINDOWS || defined(__CYGWIN__)
+  if ( (NULL != plugin->fn) &&
+       (0 != unlink (plugin->fn)) )
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING,
+                       "unlink",
+                       plugin->fn);
+  GNUNET_free (plugin->fn);
+#endif
+  sqlite3_finalize (plugin->insert_stmt);
+  sqlite3_finalize (plugin->get_count_stmt);
+  sqlite3_finalize (plugin->get_count_any_stmt);
+  sqlite3_finalize (plugin->get_stmt);
+  sqlite3_finalize (plugin->get_any_stmt);
+  sqlite3_finalize (plugin->del_select_stmt);
+  sqlite3_finalize (plugin->del_expired_stmt);
+  sqlite3_finalize (plugin->del_stmt);
+  sqlite3_finalize (plugin->get_closest_stmt);
+  result = sqlite3_close (plugin->dbh);
+#if SQLITE_VERSION_NUMBER >= 3007000
+  if (SQLITE_BUSY == result)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ (
+           "Tried to close sqlite without finalizing all prepared statements.\n"));
+    stmt = sqlite3_next_stmt (plugin->dbh,
+                              NULL);
+    while (NULL != stmt)
+    {
+      result = sqlite3_finalize (stmt);
+      if (result != SQLITE_OK)
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Failed to close statement %p: %d\n",
+             stmt,
+             result);
+      stmt = sqlite3_next_stmt (plugin->dbh,
+                                NULL);
+    }
+    result = sqlite3_close (plugin->dbh);
+  }
+#endif
+  if (SQLITE_OK != result)
+    LOG_SQLITE (plugin->dbh,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_close");
+
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datacache_sqlite.c */
diff --git a/src/plugin/datacache/plugin_datacache_template.c b/src/plugin/datacache/plugin_datacache_template.c
new file mode 100644
index 000000000..1bd712d39
--- /dev/null
+++ b/src/plugin/datacache/plugin_datacache_template.c
@@ -0,0 +1,172 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datacache/plugin_datacache_template.c
+ * @brief template for an implementation of a database backend for the datacache
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_datacache_plugin.h"
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATACACHE_PluginEnvironment *env;
+};
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param xor_distance distance of @a key to our PID
+ * @param block data to store
+ * @return 0 if duplicate, -1 on error, number of bytes used otherwise
+ */
+static ssize_t
+template_plugin_put (void *cls,
+                     uint32_t xor_distance,
+                     const struct GNUNET_DATACACHE_Block *block)
+{
+  GNUNET_break (0);
+  return -1;
+}
+
+
+/**
+ * Iterate over the results for a particular key
+ * in the datastore.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @param key
+ * @param type entries of which type are relevant?
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+template_plugin_get (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     enum GNUNET_BLOCK_Type type,
+                     GNUNET_DATACACHE_Iterator iter,
+                     void *iter_cls)
+{
+  GNUNET_break (0);
+  return 0;
+}
+
+
+/**
+ * Delete the entry with the lowest expiration value
+ * from the datacache right now.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+template_plugin_del (void *cls)
+{
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Iterate over the results that are "close" to a particular key in
+ * the datacache.  "close" is defined as numerically larger than @a
+ * key (when interpreted as a circular address space), with small
+ * distance.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
+ * @param num_results number of results that should be returned to @a iter
+ * @param iter maybe NULL (to just count)
+ * @param iter_cls closure for @a iter
+ * @return the number of results found
+ */
+static unsigned int
+template_plugin_get_closest (void *cls,
+                             const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
+                             unsigned int num_results,
+                             GNUNET_DATACACHE_Iterator iter,
+                             void *iter_cls)
+{
+  GNUNET_break (0);
+  return 0;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
+ * @return the plugin's closure (our `struct Plugin`)
+ */
+void *
+libgnunet_plugin_datacache_template_init (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
+  struct GNUNET_DATACACHE_PluginFunctions *api;
+  struct Plugin *plugin;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
+  api->cls = plugin;
+  api->get = &template_plugin_get;
+  api->put = &template_plugin_put;
+  api->del = &template_plugin_del;
+  api->get_closest = &template_plugin_get_closest;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
+                   "template",
+                   "Template datacache running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return NULL
+ */
+void *
+libgnunet_plugin_datacache_template_done (void *cls)
+{
+  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datacache_template.c */
diff --git a/src/plugin/datastore/Makefile.am b/src/plugin/datastore/Makefile.am
new file mode 100644
index 000000000..1f4ab59c8
--- /dev/null
+++ b/src/plugin/datastore/Makefile.am
@@ -0,0 +1,150 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+sqldir = $(prefix)/share/gnunet/sql/
+
+sql_DATA = \
+  datastore-0001.sql \
+  datastore-drop.sql
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+
+if HAVE_SQLITE
+ SQLITE_PLUGIN = libgnunet_plugin_datastore_sqlite.la
+if HAVE_BENCHMARKS
+  SQLITE_BENCHMARKS = \
+   perf_plugin_datastore_sqlite
+endif
+ SQLITE_TESTS = \
+  test_plugin_datastore_sqlite \
+  $(SQLITE_BENCHMARKS)
+endif
+if HAVE_POSTGRESQL
+ POSTGRES_PLUGIN = libgnunet_plugin_datastore_postgres.la
+if HAVE_BENCHMARKS
+  POSTGRES_BENCHMARKS = \
+   perf_plugin_datastore_postgres
+endif
+ POSTGRES_TESTS = \
+  test_plugin_datastore_postgres \
+  $(POSTGRES_BENCHMARKS)
+endif
+
+plugin_LTLIBRARIES = \
+  $(SQLITE_PLUGIN) \
+  $(POSTGRES_PLUGIN) \
+  libgnunet_plugin_datastore_heap.la
+
+# Real plugins should of course go into
+# plugin_LTLIBRARIES
+noinst_LTLIBRARIES = \
+  libgnunet_plugin_datastore_template.la
+
+
+libgnunet_plugin_datastore_sqlite_la_SOURCES = \
+  plugin_datastore_sqlite.c
+libgnunet_plugin_datastore_sqlite_la_LIBADD = \
+  $(top_builddir)/src/lib/sq/libgnunetsq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
+  $(LTLIBINTL)
+libgnunet_plugin_datastore_sqlite_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+libgnunet_plugin_datastore_heap_la_SOURCES = \
+  plugin_datastore_heap.c
+libgnunet_plugin_datastore_heap_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_datastore_heap_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+libgnunet_plugin_datastore_postgres_la_SOURCES = \
+  plugin_datastore_postgres.c
+libgnunet_plugin_datastore_postgres_la_LIBADD = \
+  $(top_builddir)/src/lib/pq/libgnunetpq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lpq
+libgnunet_plugin_datastore_postgres_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
+libgnunet_plugin_datastore_postgres_la_CPPFLAGS = \
+ $(POSTGRESQL_CPPFLAGS) $(AM_CPPFLAGS)
+
+
+libgnunet_plugin_datastore_template_la_SOURCES = \
+  plugin_datastore_template.c
+libgnunet_plugin_datastore_template_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_datastore_template_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+check_PROGRAMS = \
+  perf_plugin_datastore_heap \
+  test_plugin_datastore_heap \
+  $(SQLITE_TESTS) \
+  $(POSTGRES_TESTS)
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
+
+perf_plugin_datastore_heap_SOURCES = \
+ perf_plugin_datastore.c
+perf_plugin_datastore_heap_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_plugin_datastore_heap_SOURCES = \
+ test_plugin_datastore.c
+test_plugin_datastore_heap_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+perf_plugin_datastore_sqlite_SOURCES = \
+ perf_plugin_datastore.c
+perf_plugin_datastore_sqlite_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_plugin_datastore_sqlite_SOURCES = \
+ test_plugin_datastore.c
+test_plugin_datastore_sqlite_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+test_plugin_datastore_postgres_SOURCES = \
+ test_plugin_datastore.c
+test_plugin_datastore_postgres_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+perf_plugin_datastore_postgres_SOURCES = \
+ perf_plugin_datastore.c
+perf_plugin_datastore_postgres_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+
+EXTRA_DIST = \
+ test_defaults.conf \
+ perf_plugin_datastore_data_sqlite.conf \
+ test_plugin_datastore_data_sqlite.conf \
+ perf_plugin_datastore_data_heap.conf \
+ test_plugin_datastore_data_heap.conf \
+ perf_plugin_datastore_data_postgres.conf \
+ test_plugin_datastore_data_postgres.conf \
+ $(sql_DATA)
diff --git a/src/plugin/datastore/datastore-0001.sql b/src/plugin/datastore/datastore-0001.sql
new file mode 100644
index 000000000..0d4758be2
--- /dev/null
+++ b/src/plugin/datastore/datastore-0001.sql
@@ -0,0 +1,49 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+-- Check patch versioning is in place.
+SELECT _v.register_patch('datastore-0001', NULL, NULL);
+
+-------------------- Schema ----------------------------
+
+CREATE SCHEMA datastore;
+COMMENT ON SCHEMA datastore IS 'gnunet-datastore data';
+
+SET search_path TO datastore;
+
+CREATE TABLE IF NOT EXISTS gn090 (
+  repl INTEGER NOT NULL DEFAULT 0,
+  type INTEGER NOT NULL DEFAULT 0,
+  prio INTEGER NOT NULL DEFAULT 0,
+  anonLevel INTEGER NOT NULL DEFAULT 0,
+  expire BIGINT NOT NULL DEFAULT 0,
+  rvalue BIGINT NOT NULL DEFAULT 0,
+  hash BYTEA NOT NULL DEFAULT '',
+  vhash BYTEA NOT NULL DEFAULT '',
+  value BYTEA NOT NULL DEFAULT '',
+  oid  BIGINT GENERATED BY DEFAULT AS IDENTITY);
+
+CREATE INDEX IF NOT EXISTS oid_hash ON gn090 (oid);
+CREATE INDEX IF NOT EXISTS idx_hash ON gn090 (hash);
+CREATE INDEX IF NOT EXISTS idx_prio_anon ON gn090 (prio,anonLevel);
+CREATE INDEX IF NOT EXISTS idx_prio_hash_anon ON gn090 (prio,hash,anonLevel);
+CREATE INDEX IF NOT EXISTS idx_repl_rvalue ON gn090 (repl,rvalue);
+CREATE INDEX IF NOT EXISTS idx_expire_hash ON gn090 (expire,hash);
+
+COMMIT;
diff --git a/src/plugin/datastore/datastore-drop.sql b/src/plugin/datastore/datastore-drop.sql
new file mode 100644
index 000000000..67fee303d
--- /dev/null
+++ b/src/plugin/datastore/datastore-drop.sql
@@ -0,0 +1,25 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+
+SELECT _v.unregister_patch('datastore-0001');
+
+DROP SCHEMA datastore CASCADE;
+
+COMMIT;
diff --git a/src/plugin/datastore/meson.build b/src/plugin/datastore/meson.build
new file mode 100644
index 000000000..6769cb78b
--- /dev/null
+++ b/src/plugin/datastore/meson.build
@@ -0,0 +1,75 @@
+install_data ('datastore-0001.sql',
+              'datastore-drop.sql',
+               install_dir: get_option('datadir')/'gnunet'/'sql')
+
+shared_module('gnunet_plugin_datastore_sqlite',
+        ['plugin_datastore_sqlite.c'],
+        dependencies: [libgnunetutil_dep,
+                       sqlite_dep,
+                       libgnunetsq_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+shared_module('gnunet_plugin_datastore_heap',
+        ['plugin_datastore_heap.c'],
+        dependencies: [libgnunetutil_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+if pq_dep.found()
+  shared_module('gnunet_plugin_datastore_postgres',
+          ['plugin_datastore_postgres.c'],
+          dependencies: [libgnunetutil_dep,
+                         pq_dep,
+                         libgnunetpq_dep],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+endif
+
+testds_plugin_sqlite = executable ('test_plugin_datastore_sqlite',
+            ['test_plugin_datastore.c'],
+            dependencies: [
+              libgnunetutil_dep,
+              ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+testds_plugin_heap = executable ('test_plugin_datastore_heap',
+            ['test_plugin_datastore.c'],
+            dependencies: [
+              libgnunetutil_dep,
+              ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+testds_plugin_pq = executable ('test_plugin_datastore_postgres',
+            ['test_plugin_datastore.c'],
+            dependencies: [
+              libgnunetutil_dep,
+              ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+configure_file(input : 'test_defaults.conf',
+               output : 'test_defaults.conf',
+               copy: true)
+configure_file(input : 'test_plugin_datastore_data_sqlite.conf',
+               output : 'test_plugin_datastore_data_sqlite.conf',
+               copy: true)
+configure_file(input : 'test_plugin_datastore_data_heap.conf',
+               output : 'test_plugin_datastore_data_heap.conf',
+               copy: true)
+configure_file(input : 'test_plugin_datastore_data_postgres.conf',
+               output : 'test_plugin_datastore_data_postgres.conf',
+               copy: true)
+
+test('test_plugin_datastore_sqlite', testds_plugin_sqlite,
+  suite: 'datastore', workdir: meson.current_build_dir())
+test('test_plugin_datastore_heap', testds_plugin_heap,
+  suite: 'datastore', workdir: meson.current_build_dir())
+test('test_plugin_datastore_postgres', testds_plugin_pq,
+  suite: 'datastore', workdir: meson.current_build_dir())
+
diff --git a/src/plugin/datastore/perf_plugin_datastore.c b/src/plugin/datastore/perf_plugin_datastore.c
new file mode 100644
index 000000000..8e63b08e6
--- /dev/null
+++ b/src/plugin/datastore/perf_plugin_datastore.c
@@ -0,0 +1,573 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2004, 2005, 2006, 2007, 2009, 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/*
+ * @file perf_plugin_datastore.c
+ * @brief Profile database plugin directly, focusing on iterators.
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_datastore_plugin.h"
+#include "gnunet_testing_lib.h"
+#include <gauger.h>
+
+/**
+ * Target datastore size (in bytes).  Realistic sizes are
+ * more like 16 GB (not the default of 16 MB); however,
+ * those take too long to run them in the usual "make check"
+ * sequence.  Hence the value used for shipping is tiny.
+ */
+#define MAX_SIZE 1024LL * 1024 * 16 * 1
+
+#define ITERATIONS 2
+
+/**
+ * Number of put operations equivalent to 1/10th of MAX_SIZE
+ */
+#define PUT_10 (MAX_SIZE / 32 / 1024 / ITERATIONS)
+
+static char category[256];
+
+static unsigned int hits[PUT_10 / 8 + 1];
+
+static unsigned long long stored_bytes;
+
+static unsigned long long stored_entries;
+
+static unsigned long long stored_ops;
+
+static const char *plugin_name;
+
+static int ok;
+
+enum RunPhase
+{
+  RP_ERROR = 0,
+  RP_PUT,
+  RP_REP_GET,
+  RP_ZA_GET,
+  RP_EXP_GET,
+  RP_DONE
+};
+
+
+struct CpsRunContext
+{
+  unsigned int i;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Absolute end;
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  enum RunPhase phase;
+  unsigned int cnt;
+  unsigned int iter;
+  uint64_t offset;
+};
+
+
+/**
+ * Function called by plugins to notify us about a
+ * change in their disk utilization.
+ *
+ * @param cls closure (NULL)
+ * @param delta change in disk utilization,
+ *        0 for "reset to empty"
+ */
+static void
+disk_utilization_change_cb (void *cls, int delta)
+{
+}
+
+
+static void
+test (void *cls);
+
+
+/**
+ * Put continuation.
+ *
+ * @param cls closure
+ * @param key key for the item stored
+ * @param size size of the item stored
+ * @param status #GNUNET_OK or #GNUNET_SYSERROR
+ * @param msg error message on error
+ */
+static void
+put_continuation (void *cls,
+                  const struct GNUNET_HashCode *key,
+                  uint32_t size,
+                  int status,
+                  const char *msg)
+{
+  struct CpsRunContext *crc = cls;
+
+  if (GNUNET_OK != status)
+  {
+    fprintf (stderr, "ERROR: `%s'\n", msg);
+  }
+  else
+  {
+    stored_bytes += size;
+    stored_ops++;
+    stored_entries++;
+  }
+  GNUNET_SCHEDULER_add_now (&test, crc);
+}
+
+
+static void
+do_put (struct CpsRunContext *crc)
+{
+  char value[65536];
+  size_t size;
+  static struct GNUNET_HashCode key;
+  static int i;
+  unsigned int prio;
+
+  if (0 == i)
+    crc->start = GNUNET_TIME_absolute_get ();
+  if (PUT_10 == i)
+  {
+    i = 0;
+    crc->end = GNUNET_TIME_absolute_get ();
+    {
+      printf ("%s took %s for %llu items\n", "Storing an item",
+              GNUNET_STRINGS_relative_time_to_string (
+                GNUNET_TIME_absolute_get_difference (crc->start,
+                                                     crc
+                                                     ->end),
+                GNUNET_YES),
+              PUT_10);
+      if (PUT_10 > 0)
+        GAUGER (category, "Storing an item",
+                (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
+                / PUT_10,
+                "ms/item");
+    }
+    crc->i++;
+    crc->start = GNUNET_TIME_absolute_get ();
+    crc->phase++;
+    GNUNET_SCHEDULER_add_now (&test, crc);
+    return;
+  }
+  /* most content is 32k */
+  size = 32 * 1024;
+  if (GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 16) == 0)   /* but some of it is less! */
+    size = 8 + GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 32 * 1024);
+  size = size - (size & 7);     /* always multiple of 8 */
+
+  /* generate random key */
+  key.bits[0] = (unsigned int) GNUNET_TIME_absolute_get ().abs_value_us;
+  GNUNET_CRYPTO_hash (&key, sizeof(struct GNUNET_HashCode), &key);
+  memset (value, i, size);
+  if (i > 255)
+    memset (value, i - 255, size / 2);
+  value[0] = crc->i;
+  GNUNET_memcpy (&value[4], &i, sizeof(i));
+  prio = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 100);
+  crc->api->put (crc->api->cls,
+                 &key,
+                 false /* absent */,
+                 size,
+                 value,
+                 1 + i % 4 /* type */,
+                 prio,
+                 i % 4 /* anonymity */,
+                 0 /* replication */,
+                 GNUNET_TIME_relative_to_absolute
+                   (GNUNET_TIME_relative_multiply
+                     (GNUNET_TIME_UNIT_MILLISECONDS,
+                     60 * 60 * 60 * 1000
+                     + GNUNET_CRYPTO_random_u32
+                       (GNUNET_CRYPTO_QUALITY_WEAK, 1000))),
+                 put_continuation,
+                 crc);
+  i++;
+}
+
+
+static int
+iterate_zeros (void *cls,
+               const struct GNUNET_HashCode *key,
+               uint32_t size,
+               const void *data,
+               enum GNUNET_BLOCK_Type type,
+               uint32_t priority,
+               uint32_t anonymity,
+               uint32_t replication,
+               struct GNUNET_TIME_Absolute expiration,
+               uint64_t uid)
+{
+  struct CpsRunContext *crc = cls;
+  int i;
+  const char *cdata = data;
+
+  GNUNET_assert (key != NULL);
+  GNUNET_assert (size >= 8);
+  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
+  hits[i / 8] |= (1 << (i % 8));
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found result %d type=%u, priority=%u, size=%u, expire=%s\n",
+              i,
+              type, priority, size,
+              GNUNET_STRINGS_absolute_time_to_string (expiration));
+  crc->cnt++;
+  if (crc->cnt == PUT_10 / 4 - 1)
+  {
+    unsigned int bc;
+
+    bc = 0;
+    for (i = 0; i < PUT_10; i++)
+      if (0 != (hits[i / 8] & (1 << (i % 8))))
+        bc++;
+
+    crc->end = GNUNET_TIME_absolute_get ();
+    printf ("%s took %s yielding %u/%u items\n",
+            "Select random zero-anonymity item",
+            GNUNET_STRINGS_relative_time_to_string (
+              GNUNET_TIME_absolute_get_difference (crc->start,
+                                                   crc
+                                                   ->end),
+              GNUNET_YES),
+            bc, crc->cnt);
+    if (crc->cnt > 0)
+      GAUGER (category, "Select random zero-anonymity item",
+              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
+              / crc->cnt,
+              "ms/item");
+    memset (hits, 0, sizeof(hits));
+    crc->phase++;
+    crc->cnt = 0;
+    crc->start = GNUNET_TIME_absolute_get ();
+  }
+  GNUNET_SCHEDULER_add_now (&test, crc);
+  return GNUNET_OK;
+}
+
+
+static int
+expiration_get (void *cls,
+                const struct GNUNET_HashCode *key,
+                uint32_t size,
+                const void *data,
+                enum GNUNET_BLOCK_Type type,
+                uint32_t priority,
+                uint32_t anonymity,
+                uint32_t replication,
+                struct GNUNET_TIME_Absolute expiration,
+                uint64_t uid)
+{
+  struct CpsRunContext *crc = cls;
+  int i;
+  const char *cdata = data;
+
+  GNUNET_assert (size >= 8);
+  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
+  hits[i / 8] |= (1 << (i % 8));
+  crc->cnt++;
+  if (PUT_10 <= crc->cnt)
+  {
+    unsigned int bc;
+
+    bc = 0;
+    for (i = 0; i < PUT_10; i++)
+      if (0 != (hits[i / 8] & (1 << (i % 8))))
+        bc++;
+
+    crc->end = GNUNET_TIME_absolute_get ();
+    printf ("%s took %s yielding %u/%u items\n",
+            "Selecting and deleting by expiration",
+            GNUNET_STRINGS_relative_time_to_string (
+              GNUNET_TIME_absolute_get_difference (crc->start,
+                                                   crc
+                                                   ->end),
+              GNUNET_YES),
+            bc, (unsigned int) PUT_10);
+    if (crc->cnt > 0)
+      GAUGER (category, "Selecting and deleting by expiration",
+              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
+              / crc->cnt,
+              "ms/item");
+    memset (hits, 0, sizeof(hits));
+    if (++crc->iter == ITERATIONS)
+      crc->phase++;
+    else
+      crc->phase = RP_PUT;
+    crc->cnt = 0;
+    crc->start = GNUNET_TIME_absolute_get ();
+  }
+  GNUNET_SCHEDULER_add_now (&test, crc);
+  return GNUNET_NO;
+}
+
+
+static int
+replication_get (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 uint32_t size,
+                 const void *data,
+                 enum GNUNET_BLOCK_Type type,
+                 uint32_t priority,
+                 uint32_t anonymity,
+                 uint32_t replication,
+                 struct GNUNET_TIME_Absolute expiration,
+                 uint64_t uid)
+{
+  struct CpsRunContext *crc = cls;
+  int i;
+  const char *cdata = data;
+
+  GNUNET_assert (NULL != key);
+  GNUNET_assert (size >= 8);
+  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
+  hits[i / 8] |= (1 << (i % 8));
+  crc->cnt++;
+  if (PUT_10 <= crc->cnt)
+  {
+    unsigned int bc;
+
+    bc = 0;
+    for (i = 0; i < PUT_10; i++)
+      if (0 != (hits[i / 8] & (1 << (i % 8))))
+        bc++;
+
+    crc->end = GNUNET_TIME_absolute_get ();
+    printf ("%s took %s yielding %u/%u items\n",
+            "Selecting random item for replication",
+            GNUNET_STRINGS_relative_time_to_string (
+              GNUNET_TIME_absolute_get_difference (crc->start,
+                                                   crc
+                                                   ->end),
+              GNUNET_YES),
+            bc, (unsigned int) PUT_10);
+    if (crc->cnt > 0)
+      GAUGER (category, "Selecting random item for replication",
+              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
+              / crc->cnt,
+              "ms/item");
+    memset (hits, 0, sizeof(hits));
+    crc->phase++;
+    crc->offset = 0;
+    crc->cnt = 0;
+    crc->start = GNUNET_TIME_absolute_get ();
+  }
+
+  GNUNET_SCHEDULER_add_now (&test, crc);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called when the service shuts
+ * down.  Unloads our datastore plugin.
+ *
+ * @param api api to unload
+ * @param cfg configuration to use
+ */
+static void
+unload_plugin (struct GNUNET_DATASTORE_PluginFunctions *api,
+               const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  char *name;
+  char *libname;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "DATASTORE", "DATABASE",
+                                             &name))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("No `%s' specified for `%s' in configuration!\n"),
+                "DATABASE",
+                "DATASTORE");
+    return;
+  }
+  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
+  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_free (libname);
+  GNUNET_free (name);
+}
+
+
+/**
+ * Last task run during shutdown.  Disconnects us from
+ * the transport and core.
+ */
+static void
+cleaning_task (void *cls)
+{
+  struct CpsRunContext *crc = cls;
+
+  unload_plugin (crc->api, crc->cfg);
+  GNUNET_free (crc);
+}
+
+
+static void
+test (void *cls)
+{
+  struct CpsRunContext *crc = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "In phase %d, iteration %u\n", crc->phase, crc->cnt);
+  switch (crc->phase)
+  {
+  case RP_ERROR:
+    GNUNET_break (0);
+    crc->api->drop (crc->api->cls);
+    ok = 1;
+    GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_IDLE,
+                                        &cleaning_task, crc);
+    break;
+
+  case RP_PUT:
+    do_put (crc);
+    break;
+
+  case RP_REP_GET:
+    crc->api->get_replication (crc->api->cls, &replication_get, crc);
+    break;
+
+  case RP_ZA_GET:
+    crc->api->get_zero_anonymity (crc->api->cls, crc->offset++, 1,
+                                  &iterate_zeros, crc);
+    break;
+
+  case RP_EXP_GET:
+    crc->api->get_expiration (crc->api->cls, &expiration_get, crc);
+    break;
+
+  case RP_DONE:
+    crc->api->drop (crc->api->cls);
+    ok = 0;
+    GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_IDLE,
+                                        &cleaning_task, crc);
+    break;
+  }
+}
+
+
+/**
+ * Load the datastore plugin.
+ */
+static struct GNUNET_DATASTORE_PluginFunctions *
+load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  static struct GNUNET_DATASTORE_PluginEnvironment env;
+  struct GNUNET_DATASTORE_PluginFunctions *ret;
+  char *name;
+  char *libname;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "DATASTORE", "DATABASE",
+                                             &name))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("No `%s' specified for `%s' in configuration!\n"),
+                "DATABASE",
+                "DATASTORE");
+    return NULL;
+  }
+  env.cfg = cfg;
+  env.duc = &disk_utilization_change_cb;
+  env.cls = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datastore plugin\n"),
+              name);
+  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
+  if (NULL == (ret = GNUNET_PLUGIN_load (libname, &env)))
+  {
+    fprintf (stderr, "Failed to load plugin `%s'!\n", name);
+    GNUNET_free (name);
+    GNUNET_free (libname);
+    return NULL;
+  }
+  GNUNET_free (libname);
+  GNUNET_free (name);
+  return ret;
+}
+
+
+static void
+run (void *cls, char *const *args, const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  struct CpsRunContext *crc;
+
+  if (NULL == c)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  api = load_plugin (c);
+  if (api == NULL)
+  {
+    fprintf (stderr,
+             "%s",
+             "Could not initialize plugin, assuming database not configured. Test not run!\n");
+    return;
+  }
+  crc = GNUNET_new (struct CpsRunContext);
+  crc->api = api;
+  crc->cfg = c;
+  crc->phase = RP_PUT;
+  ok = 2;
+  GNUNET_SCHEDULER_add_now (&test, crc);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  char dir_name[PATH_MAX];
+  char cfg_name[PATH_MAX];
+  char *const xargv[] = {
+    "perf-plugin-datastore",
+    "-c",
+    cfg_name,
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+  GNUNET_snprintf (dir_name, sizeof(dir_name), "/tmp/perf-gnunet-datastore-%s",
+                   plugin_name);
+  GNUNET_DISK_directory_remove (dir_name);
+  GNUNET_log_setup ("perf-plugin-datastore",
+                    "WARNING",
+                    NULL);
+  GNUNET_snprintf (category, sizeof(category), "DATASTORE-%s", plugin_name);
+  GNUNET_snprintf (cfg_name, sizeof(cfg_name),
+                   "perf_plugin_datastore_data_%s.conf", plugin_name);
+  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1, xargv,
+                      "perf-plugin-datastore", "nohelp", options, &run, NULL);
+  if (ok != 0)
+    fprintf (stderr, "Missed some testcases: %u\n", ok);
+  GNUNET_DISK_directory_remove (dir_name);
+
+  return ok;
+}
+
+
+/* end of perf_plugin_datastore.c */
diff --git a/src/plugin/datastore/perf_plugin_datastore_data_heap.conf b/src/plugin/datastore/perf_plugin_datastore_data_heap.conf
new file mode 100644
index 000000000..873cf9606
--- /dev/null
+++ b/src/plugin/datastore/perf_plugin_datastore_data_heap.conf
@@ -0,0 +1,7 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-heap/
+
+
+[datastore]
+DATABASE = heap
diff --git a/src/plugin/datastore/perf_plugin_datastore_data_postgres.conf b/src/plugin/datastore/perf_plugin_datastore_data_postgres.conf
new file mode 100644
index 000000000..7683887a8
--- /dev/null
+++ b/src/plugin/datastore/perf_plugin_datastore_data_postgres.conf
@@ -0,0 +1,10 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-postgres/
+
+[datastore]
+DATABASE = postgres
+
+[datastore-postgres]
+CONFIG = dbname=gnunetcheck
+
diff --git a/src/plugin/datastore/perf_plugin_datastore_data_sqlite.conf b/src/plugin/datastore/perf_plugin_datastore_data_sqlite.conf
new file mode 100644
index 000000000..888e020a6
--- /dev/null
+++ b/src/plugin/datastore/perf_plugin_datastore_data_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-sqlite/
+
diff --git a/src/plugin/datastore/plugin_datastore_heap.c b/src/plugin/datastore/plugin_datastore_heap.c
new file mode 100644
index 000000000..a827a2763
--- /dev/null
+++ b/src/plugin/datastore/plugin_datastore_heap.c
@@ -0,0 +1,944 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datastore/plugin_datastore_heap.c
+ * @brief heap-based datastore backend; usually we want the datastore
+ *        to be persistent, and storing data in the heap is obviously
+ *        NOT going to be persistent; still, this plugin is useful for
+ *        testing/benchmarking --- but never for production!
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_datastore_plugin.h"
+
+
+/**
+ * A value that we are storing.
+ */
+struct Value
+{
+  /**
+   * Key for the value.
+   */
+  struct GNUNET_HashCode key;
+
+  /**
+   * Pointer to the value's data (allocated at the end of this struct).
+   */
+  const void *data;
+
+  /**
+   * Entry for this value in the 'expire' heap.
+   */
+  struct GNUNET_CONTAINER_HeapNode *expire_heap;
+
+  /**
+   * Entry for this value in the 'replication' heap.
+   */
+  struct GNUNET_CONTAINER_HeapNode *replication_heap;
+
+  /**
+   * Expiration time for this value.
+   */
+  struct GNUNET_TIME_Absolute expiration;
+
+  /**
+   * Offset of this value in the array of the 'struct ZeroAnonByType';
+   * only used if anonymity is zero.
+   */
+  unsigned int zero_anon_offset;
+
+  /**
+   * Number of bytes in 'data'.
+   */
+  uint32_t size;
+
+  /**
+   * Priority of the value.
+   */
+  uint32_t priority;
+
+  /**
+   * Anonymity level for the value.
+   */
+  uint32_t anonymity;
+
+  /**
+   * Replication level for the value.
+   */
+  uint32_t replication;
+
+  /**
+   * Type of 'data'.
+   */
+  enum GNUNET_BLOCK_Type type;
+};
+
+
+/**
+ * We organize 0-anonymity values in arrays "by type".
+ */
+struct ZeroAnonByType
+{
+  /**
+   * We keep these in a DLL.
+   */
+  struct ZeroAnonByType *next;
+
+  /**
+   * We keep these in a DLL.
+   */
+  struct ZeroAnonByType *prev;
+
+  /**
+   * Array of 0-anonymity items of the given type.
+   */
+  struct Value **array;
+
+  /**
+   * Allocated size of the array.
+   */
+  unsigned int array_size;
+
+  /**
+   * First unused offset in 'array'.
+   */
+  unsigned int array_pos;
+
+  /**
+   * Type of all of the values in 'array'.
+   */
+  enum GNUNET_BLOCK_Type type;
+};
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATASTORE_PluginEnvironment *env;
+
+  /**
+   * Mapping from keys to 'struct Value's.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *keyvalue;
+
+  /**
+   * Heap organized by minimum expiration time.
+   */
+  struct GNUNET_CONTAINER_Heap *by_expiration;
+
+  /**
+   * Heap organized by maximum replication value.
+   */
+  struct GNUNET_CONTAINER_Heap *by_replication;
+
+  /**
+   * Head of list of arrays containing zero-anonymity values by type.
+   */
+  struct ZeroAnonByType *zero_head;
+
+  /**
+   * Tail of list of arrays containing zero-anonymity values by type.
+   */
+  struct ZeroAnonByType *zero_tail;
+
+  /**
+   * Size of all values we're storing.
+   */
+  unsigned long long size;
+};
+
+
+/**
+ * Get an estimate of how much space the database is
+ * currently using.
+ *
+ * @param cls our "struct Plugin*"
+ * @return number of bytes used on disk
+ */
+static void
+heap_plugin_estimate_size (void *cls, unsigned long long *estimate)
+{
+  struct Plugin *plugin = cls;
+
+  if (NULL != estimate)
+    *estimate = plugin->size;
+}
+
+
+/**
+ * Closure for iterator for updating.
+ */
+struct UpdateContext
+{
+  /**
+   * Number of bytes in 'data'.
+   */
+  uint32_t size;
+
+  /**
+   * Pointer to the data.
+   */
+  const void *data;
+
+  /**
+   * Priority of the value.
+   */
+  uint32_t priority;
+
+  /**
+   * Replication level for the value.
+   */
+  uint32_t replication;
+
+  /**
+   * Expiration time for this value.
+   */
+  struct GNUNET_TIME_Absolute expiration;
+
+  /**
+   * True if the value was found and updated.
+   */
+  bool updated;
+};
+
+
+/**
+ * Update the matching value.
+ *
+ * @param cls the 'struct UpdateContext'
+ * @param key unused
+ * @param val the 'struct Value'
+ * @return GNUNET_YES (continue iteration), GNUNET_NO if value was found
+ */
+static int
+update_iterator (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 void *val)
+{
+  struct UpdateContext *uc = cls;
+  struct Value *value = val;
+
+  if (value->size != uc->size)
+    return GNUNET_YES;
+  if (0 != memcmp (value->data, uc->data, uc->size))
+    return GNUNET_YES;
+  uc->expiration = GNUNET_TIME_absolute_max (value->expiration,
+                                             uc->expiration);
+  if (value->expiration.abs_value_us != uc->expiration.abs_value_us)
+  {
+    value->expiration = uc->expiration;
+    GNUNET_CONTAINER_heap_update_cost (value->expire_heap,
+                                       value->expiration.abs_value_us);
+  }
+  /* Saturating adds, don't overflow */
+  if (value->priority > UINT32_MAX - uc->priority)
+    value->priority = UINT32_MAX;
+  else
+    value->priority += uc->priority;
+  if (value->replication > UINT32_MAX - uc->replication)
+    value->replication = UINT32_MAX;
+  else
+    value->replication += uc->replication;
+  uc->updated = true;
+  return GNUNET_NO;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the item
+ * @param absent true if the key was not found in the bloom filter
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure
+ */
+static void
+heap_plugin_put (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 bool absent,
+                 uint32_t size,
+                 const void *data,
+                 enum GNUNET_BLOCK_Type type,
+                 uint32_t priority,
+                 uint32_t anonymity,
+                 uint32_t replication,
+                 struct GNUNET_TIME_Absolute expiration,
+                 PluginPutCont cont,
+                 void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  struct Value *value;
+
+  if (! absent)
+  {
+    struct UpdateContext uc;
+
+    uc.size = size;
+    uc.data = data;
+    uc.priority = priority;
+    uc.replication = replication;
+    uc.expiration = expiration;
+    uc.updated = false;
+    GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
+                                                key,
+                                                &update_iterator,
+                                                &uc);
+    if (uc.updated)
+    {
+      cont (cont_cls, key, size, GNUNET_NO, NULL);
+      return;
+    }
+  }
+  value = GNUNET_malloc (sizeof(struct Value) + size);
+  value->key = *key;
+  value->data = &value[1];
+  value->expire_heap = GNUNET_CONTAINER_heap_insert (plugin->by_expiration,
+                                                     value,
+                                                     expiration.abs_value_us);
+  value->replication_heap = GNUNET_CONTAINER_heap_insert (
+    plugin->by_replication,
+    value,
+    replication);
+  value->expiration = expiration;
+  if (0 == anonymity)
+  {
+    struct ZeroAnonByType *zabt;
+
+    for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
+      if (zabt->type == type)
+        break;
+    if (NULL == zabt)
+    {
+      zabt = GNUNET_new (struct ZeroAnonByType);
+      zabt->type = type;
+      GNUNET_CONTAINER_DLL_insert (plugin->zero_head,
+                                   plugin->zero_tail,
+                                   zabt);
+    }
+    if (zabt->array_size == zabt->array_pos)
+    {
+      GNUNET_array_grow (zabt->array,
+                         zabt->array_size,
+                         zabt->array_size * 2 + 4);
+    }
+    value->zero_anon_offset = zabt->array_pos;
+    zabt->array[zabt->array_pos++] = value;
+  }
+  value->size = size;
+  value->priority = priority;
+  value->anonymity = anonymity;
+  value->replication = replication;
+  value->type = type;
+  GNUNET_memcpy (&value[1], data, size);
+  GNUNET_CONTAINER_multihashmap_put (plugin->keyvalue,
+                                     &value->key,
+                                     value,
+                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+  plugin->size += size;
+  cont (cont_cls, key, size, GNUNET_OK, NULL);
+}
+
+
+/**
+ * Delete the given value, removing it from the plugin's data
+ * structures.
+ *
+ * @param plugin the plugin
+ * @param value value to delete
+ */
+static void
+delete_value (struct Plugin *plugin,
+              struct Value *value)
+{
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (plugin->keyvalue,
+                                                       &value->key,
+                                                       value));
+  GNUNET_assert (value == GNUNET_CONTAINER_heap_remove_node (
+                   value->expire_heap));
+  GNUNET_assert (value == GNUNET_CONTAINER_heap_remove_node (
+                   value->replication_heap));
+  if (0 == value->anonymity)
+  {
+    struct ZeroAnonByType *zabt;
+
+    for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
+      if (zabt->type == value->type)
+        break;
+    GNUNET_assert (NULL != zabt);
+    zabt->array[value->zero_anon_offset] = zabt->array[--zabt->array_pos];
+    zabt->array[value->zero_anon_offset]->zero_anon_offset =
+      value->zero_anon_offset;
+    if (0 == zabt->array_pos)
+    {
+      GNUNET_array_grow (zabt->array,
+                         zabt->array_size,
+                         0);
+      GNUNET_CONTAINER_DLL_remove (plugin->zero_head,
+                                   plugin->zero_tail,
+                                   zabt);
+      GNUNET_free (zabt);
+    }
+  }
+  plugin->size -= value->size;
+  GNUNET_free (value);
+}
+
+
+/**
+ * Closure for iterator called during 'get_key'.
+ */
+struct GetContext
+{
+  /**
+   * Lowest uid to consider.
+   */
+  uint64_t next_uid;
+
+  /**
+   * Value with lowest uid >= next_uid found so far.
+   */
+  struct Value *value;
+
+  /**
+   * Requested type.
+   */
+  enum GNUNET_BLOCK_Type type;
+
+  /**
+   * If true, return a random value
+   */
+  bool random;
+};
+
+
+/**
+ * Obtain the matching value with the lowest uid >= next_uid.
+ *
+ * @param cls the 'struct GetContext'
+ * @param key unused
+ * @param val the 'struct Value'
+ * @return GNUNET_YES (continue iteration), GNUNET_NO if result was found
+ */
+static int
+get_iterator (void *cls,
+              const struct GNUNET_HashCode *key,
+              void *val)
+{
+  struct GetContext *gc = cls;
+  struct Value *value = val;
+
+  if ((gc->type != GNUNET_BLOCK_TYPE_ANY) &&
+      (gc->type != value->type))
+    return GNUNET_OK;
+  if (gc->random)
+  {
+    gc->value = value;
+    return GNUNET_NO;
+  }
+  if ((uint64_t) (intptr_t) value < gc->next_uid)
+    return GNUNET_OK;
+  if ((NULL != gc->value) &&
+      (value > gc->value))
+    return GNUNET_OK;
+  gc->value = value;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get one of the results for a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param random if true, return a random result instead of using next_uid
+ * @param key maybe NULL (to match all entries)
+ * @param type entries of which type are relevant?
+ *     Use 0 for any type.
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if nothing matches
+ * @param proc_cls closure for @a proc
+ */
+static void
+heap_plugin_get_key (void *cls,
+                     uint64_t next_uid,
+                     bool random,
+                     const struct GNUNET_HashCode *key,
+                     enum GNUNET_BLOCK_Type type,
+                     PluginDatumProcessor proc,
+                     void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GetContext gc;
+
+  gc.value = NULL;
+  gc.next_uid = next_uid;
+  gc.random = random;
+  gc.type = type;
+  if (NULL == key)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
+                                           &get_iterator,
+                                           &gc);
+  }
+  else
+  {
+    GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
+                                                key,
+                                                &get_iterator,
+                                                &gc);
+  }
+  if (NULL == gc.value)
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 proc (proc_cls,
+                       &gc.value->key,
+                       gc.value->size,
+                       &gc.value[1],
+                       gc.value->type,
+                       gc.value->priority,
+                       gc.value->anonymity,
+                       gc.value->replication,
+                       gc.value->expiration,
+                       (uint64_t) (intptr_t) gc.value));
+}
+
+
+/**
+ * Get a random item for replication.  Returns a single, not expired,
+ * random item from those with the highest replication counters.  The
+ * item's replication counter is decremented by one IF it was positive
+ * before.  Call 'proc' with all values ZERO or NULL if the datastore
+ * is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for proc
+ */
+static void
+heap_plugin_get_replication (void *cls,
+                             PluginDatumProcessor proc,
+                             void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct Value *value;
+
+  value = GNUNET_CONTAINER_heap_remove_root (plugin->by_replication);
+  if (NULL == value)
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  if (value->replication > 0)
+  {
+    value->replication--;
+    value->replication_heap = GNUNET_CONTAINER_heap_insert (
+      plugin->by_replication,
+      value,
+      value->replication);
+  }
+  else
+  {
+    /* need a better way to pick a random item, replication level is always 0 */
+    value->replication_heap = GNUNET_CONTAINER_heap_insert (
+      plugin->by_replication,
+      value,
+      value->replication);
+    value = GNUNET_CONTAINER_heap_walk_get_next (plugin->by_replication);
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 proc (proc_cls,
+                       &value->key,
+                       value->size,
+                       &value[1],
+                       value->type,
+                       value->priority,
+                       value->anonymity,
+                       value->replication,
+                       value->expiration,
+                       (uint64_t) (intptr_t) value));
+}
+
+
+/**
+ * Get a random item for expiration.  Call 'proc' with all values ZERO
+ * or NULL if the datastore is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for proc
+ */
+static void
+heap_plugin_get_expiration (void *cls, PluginDatumProcessor proc,
+                            void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct Value *value;
+
+  value = GNUNET_CONTAINER_heap_peek (plugin->by_expiration);
+  if (NULL == value)
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  if (GNUNET_NO ==
+      proc (proc_cls,
+            &value->key,
+            value->size,
+            &value[1],
+            value->type,
+            value->priority,
+            value->anonymity,
+            value->replication,
+            value->expiration,
+            (uint64_t) (intptr_t) value))
+    delete_value (plugin, value);
+}
+
+
+/**
+ * Call the given processor on an item with zero anonymity.
+ *
+ * @param cls our "struct Plugin*"
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param type entries of which type should be considered?
+ *        Must not be zero (ANY).
+ * @param proc function to call on each matching value;
+ *        will be called with NULL if no value matches
+ * @param proc_cls closure for proc
+ */
+static void
+heap_plugin_get_zero_anonymity (void *cls, uint64_t next_uid,
+                                enum GNUNET_BLOCK_Type type,
+                                PluginDatumProcessor proc, void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct ZeroAnonByType *zabt;
+  struct Value *value = NULL;
+
+  for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
+  {
+    if ((type != GNUNET_BLOCK_TYPE_ANY) &&
+        (type != zabt->type))
+      continue;
+    for (int i = 0; i < zabt->array_pos; ++i)
+    {
+      if ((uint64_t) (intptr_t) zabt->array[i] < next_uid)
+        continue;
+      if ((NULL != value) &&
+          (zabt->array[i] > value))
+        continue;
+      value = zabt->array[i];
+    }
+  }
+  if (NULL == value)
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 proc (proc_cls,
+                       &value->key,
+                       value->size,
+                       &value[1],
+                       value->type,
+                       value->priority,
+                       value->anonymity,
+                       value->replication,
+                       value->expiration,
+                       (uint64_t) (intptr_t) value));
+}
+
+
+/**
+ * Drop database.
+ */
+static void
+heap_plugin_drop (void *cls)
+{
+  /* nothing needs to be done */
+}
+
+
+/**
+ * Closure for the 'return_value' function.
+ */
+struct GetAllContext
+{
+  /**
+   * Function to call.
+   */
+  PluginKeyProcessor proc;
+
+  /**
+   * Closure for 'proc'.
+   */
+  void *proc_cls;
+};
+
+
+/**
+ * Callback invoked to call callback on each value.
+ *
+ * @param cls the plugin
+ * @param key unused
+ * @param val the value
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+return_value (void *cls,
+              const struct GNUNET_HashCode *key,
+              void *val)
+{
+  struct GetAllContext *gac = cls;
+
+  gac->proc (gac->proc_cls,
+             key,
+             1);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get all of the keys in the datastore.
+ *
+ * @param cls closure
+ * @param proc function to call on each key
+ * @param proc_cls closure for proc
+ */
+static void
+heap_get_keys (void *cls,
+               PluginKeyProcessor proc,
+               void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GetAllContext gac;
+
+  gac.proc = proc;
+  gac.proc_cls = proc_cls;
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
+                                         &return_value,
+                                         &gac);
+  proc (proc_cls, NULL, 0);
+}
+
+
+/**
+ * Closure for iterator called during 'remove_key'.
+ */
+struct RemoveContext
+{
+  /**
+   * Value found.
+   */
+  struct Value *value;
+
+  /**
+   * Size of data.
+   */
+  uint32_t size;
+
+  /**
+   * Data to remove.
+   */
+  const void *data;
+};
+
+
+/**
+ * Obtain the matching value with the lowest uid >= next_uid.
+ *
+ * @param cls the 'struct GetContext'
+ * @param key unused
+ * @param val the 'struct Value'
+ * @return GNUNET_YES (continue iteration), GNUNET_NO if result was found
+ */
+static int
+remove_iterator (void *cls,
+                 const struct GNUNET_HashCode *key,
+                 void *val)
+{
+  struct RemoveContext *rc = cls;
+  struct Value *value = val;
+
+  if (value->size != rc->size)
+    return GNUNET_YES;
+  if (0 != memcmp (value->data, rc->data, rc->size))
+    return GNUNET_YES;
+  rc->value = value;
+  return GNUNET_NO;
+}
+
+
+/**
+ * Remove a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the content
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure for @a cont
+ */
+static void
+heap_plugin_remove_key (void *cls,
+                        const struct GNUNET_HashCode *key,
+                        uint32_t size,
+                        const void *data,
+                        PluginRemoveCont cont,
+                        void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  struct RemoveContext rc;
+
+  rc.value = NULL;
+  rc.size = size;
+  rc.data = data;
+  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
+                                              key,
+                                              &remove_iterator,
+                                              &rc);
+  if (NULL == rc.value)
+  {
+    cont (cont_cls,
+          key,
+          size,
+          GNUNET_NO,
+          NULL);
+    return;
+  }
+  delete_value (plugin,
+                rc.value);
+  cont (cont_cls,
+        key,
+        size,
+        GNUNET_OK,
+        NULL);
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_DATASTORE_PluginEnvironment*"
+ * @return our "struct Plugin*"
+ */
+void *
+libgnunet_plugin_datastore_heap_init (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  struct Plugin *plugin;
+  unsigned long long esize;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (env->cfg,
+                                             "datastore-heap",
+                                             "HASHMAPSIZE",
+                                             &esize))
+    esize = 128 * 1024;
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  plugin->keyvalue = GNUNET_CONTAINER_multihashmap_create (esize, GNUNET_YES);
+  plugin->by_expiration = GNUNET_CONTAINER_heap_create (
+    GNUNET_CONTAINER_HEAP_ORDER_MIN);
+  plugin->by_replication = GNUNET_CONTAINER_heap_create (
+    GNUNET_CONTAINER_HEAP_ORDER_MAX);
+  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
+  api->cls = plugin;
+  api->estimate_size = &heap_plugin_estimate_size;
+  api->put = &heap_plugin_put;
+  api->get_key = &heap_plugin_get_key;
+  api->get_replication = &heap_plugin_get_replication;
+  api->get_expiration = &heap_plugin_get_expiration;
+  api->get_zero_anonymity = &heap_plugin_get_zero_anonymity;
+  api->drop = &heap_plugin_drop;
+  api->get_keys = &heap_get_keys;
+  api->remove_key = &heap_plugin_remove_key;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "heap",
+                   _ ("Heap database running\n"));
+  return api;
+}
+
+
+/**
+ * Callback invoked to free all value.
+ *
+ * @param cls the plugin
+ * @param key unused
+ * @param val the value
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+free_value (void *cls,
+            const struct GNUNET_HashCode *key,
+            void *val)
+{
+  struct Plugin *plugin = cls;
+  struct Value *value = val;
+
+  delete_value (plugin, value);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Exit point from the plugin.
+ * @param cls our "struct Plugin*"
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_datastore_heap_done (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
+                                         &free_value,
+                                         plugin);
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->keyvalue);
+  GNUNET_CONTAINER_heap_destroy (plugin->by_expiration);
+  GNUNET_CONTAINER_heap_destroy (plugin->by_replication);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datastore_heap.c */
diff --git a/src/plugin/datastore/plugin_datastore_postgres.c b/src/plugin/datastore/plugin_datastore_postgres.c
new file mode 100644
index 000000000..5fcacc17b
--- /dev/null
+++ b/src/plugin/datastore/plugin_datastore_postgres.c
@@ -0,0 +1,930 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2009-2017, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datastore/plugin_datastore_postgres.c
+ * @brief postgres-based datastore backend
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_datastore_plugin.h"
+#include "gnunet_pq_lib.h"
+
+
+/**
+ * After how many ms "busy" should a DB operation fail for good?
+ * A low value makes sure that we are more responsive to requests
+ * (especially PUTs).  A high value guarantees a higher success
+ * rate (SELECTs in iterate can take several seconds despite LIMIT=1).
+ *
+ * The default value of 1s should ensure that users do not experience
+ * huge latencies while at the same time allowing operations to succeed
+ * with reasonable probability.
+ */
+#define BUSY_TIMEOUT GNUNET_TIME_UNIT_SECONDS
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATASTORE_PluginEnvironment *env;
+
+  /**
+   * Native Postgres database handle.
+   */
+  struct GNUNET_PQ_Context *dbh;
+};
+
+
+/**
+ * @brief Get a database handle
+ *
+ * @param plugin global context
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+init_connection (struct Plugin *plugin)
+{
+#define RESULT_COLUMNS "repl, type, prio, anonLevel, expire, hash, value, oid"
+  struct GNUNET_PQ_PreparedStatement ps[] = {
+    GNUNET_PQ_make_prepare ("get",
+                            "SELECT " RESULT_COLUMNS
+                            " FROM datastore.gn090"
+                            " WHERE oid >= $1::bigint AND"
+                            " (rvalue >= $2 OR 0 = $3::smallint) AND"
+                            " (hash = $4 OR 0 = $5::smallint) AND"
+                            " (type = $6 OR 0 = $7::smallint)"
+                            " ORDER BY oid ASC LIMIT 1"),
+    GNUNET_PQ_make_prepare ("put",
+                            "INSERT INTO datastore.gn090"
+                            " (repl, type, prio, anonLevel, expire, rvalue, hash, vhash, value) "
+                            "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)"),
+    GNUNET_PQ_make_prepare ("update",
+                            "UPDATE datastore.gn090"
+                            " SET prio = prio + $1,"
+                            " repl = repl + $2,"
+                            " expire = GREATEST(expire, $3)"
+                            " WHERE hash = $4 AND vhash = $5"),
+    GNUNET_PQ_make_prepare ("decrepl",
+                            "UPDATE datastore.gn090"
+                            " SET repl = GREATEST (repl - 1, 0)"
+                            " WHERE oid = $1"),
+    GNUNET_PQ_make_prepare ("select_non_anonymous",
+                            "SELECT " RESULT_COLUMNS
+                            " FROM datastore.gn090"
+                            " WHERE anonLevel = 0 AND type = $1 AND oid >= $2::bigint"
+                            " ORDER BY oid ASC LIMIT 1"),
+    GNUNET_PQ_make_prepare ("select_expiration_order",
+                            "(SELECT " RESULT_COLUMNS
+                            " FROM datastore.gn090"
+                            " WHERE expire < $1 ORDER BY prio ASC LIMIT 1) "
+                            "UNION "
+                            "(SELECT " RESULT_COLUMNS
+                            " FROM datastore.gn090"
+                            " ORDER BY prio ASC LIMIT 1)"
+                            " ORDER BY expire ASC LIMIT 1"),
+    GNUNET_PQ_make_prepare ("select_replication_order",
+                            "SELECT " RESULT_COLUMNS
+                            " FROM datastore.gn090"
+                            " ORDER BY repl DESC,RANDOM() LIMIT 1"),
+    GNUNET_PQ_make_prepare ("delrow",
+                            "DELETE FROM datastore.gn090"
+                            " WHERE oid=$1"),
+    GNUNET_PQ_make_prepare ("remove",
+                            "DELETE FROM datastore.gn090"
+                            " WHERE hash = $1 AND"
+                            " value = $2"),
+    GNUNET_PQ_make_prepare ("get_keys",
+                            "SELECT hash"
+                            " FROM datastore.gn090"),
+    GNUNET_PQ_make_prepare ("estimate_size",
+                            "SELECT CASE WHEN NOT EXISTS"
+                            "  (SELECT 1 FROM datastore.gn090)"
+                            "  THEN 0"
+                            "  ELSE (SELECT SUM(LENGTH(value))+256*COUNT(*)"
+                            "        FROM datastore.gn090)"
+                            "END AS total"),
+    GNUNET_PQ_PREPARED_STATEMENT_END
+  };
+#undef RESULT_COLUMNS
+
+  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->env->cfg,
+                                            "datastore-postgres",
+                                            "datastore-",
+                                            NULL,
+                                            ps);
+  if (NULL == plugin->dbh)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get an estimate of how much space the database is
+ * currently using.
+ *
+ * @param cls our `struct Plugin *`
+ * @return number of bytes used on disk
+ */
+static void
+postgres_plugin_estimate_size (void *cls,
+                               unsigned long long *estimate)
+{
+  struct Plugin *plugin = cls;
+  uint64_t total;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_uint64 ("total",
+                                  &total),
+    GNUNET_PQ_result_spec_end
+  };
+  enum GNUNET_DB_QueryStatus ret;
+
+  if (NULL == estimate)
+    return;
+  ret = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
+                                                  "estimate_size",
+                                                  params,
+                                                  rs);
+  if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != ret)
+  {
+    *estimate = 0LL;
+    return;
+  }
+  *estimate = total;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure with the `struct Plugin`
+ * @param key key for the item
+ * @param absent true if the key was not found in the bloom filter
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure
+ */
+static void
+postgres_plugin_put (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     bool absent,
+                     uint32_t size,
+                     const void *data,
+                     enum GNUNET_BLOCK_Type type,
+                     uint32_t priority,
+                     uint32_t anonymity,
+                     uint32_t replication,
+                     struct GNUNET_TIME_Absolute expiration,
+                     PluginPutCont cont,
+                     void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode vhash;
+  enum GNUNET_DB_QueryStatus ret;
+
+  GNUNET_CRYPTO_hash (data,
+                      size,
+                      &vhash);
+  if (! absent)
+  {
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_uint32 (&priority),
+      GNUNET_PQ_query_param_uint32 (&replication),
+      GNUNET_PQ_query_param_absolute_time (&expiration),
+      GNUNET_PQ_query_param_auto_from_type (key),
+      GNUNET_PQ_query_param_auto_from_type (&vhash),
+      GNUNET_PQ_query_param_end
+    };
+    ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "update",
+                                              params);
+    if (0 > ret)
+    {
+      cont (cont_cls,
+            key,
+            size,
+            GNUNET_SYSERR,
+            _ ("Postgresql exec failure"));
+      return;
+    }
+    bool affected = (0 != ret);
+    if (affected)
+    {
+      cont (cont_cls,
+            key,
+            size,
+            GNUNET_NO,
+            NULL);
+      return;
+    }
+  }
+
+  {
+    uint32_t utype = (uint32_t) type;
+    uint64_t rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                                UINT64_MAX);
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_uint32 (&replication),
+      GNUNET_PQ_query_param_uint32 (&utype),
+      GNUNET_PQ_query_param_uint32 (&priority),
+      GNUNET_PQ_query_param_uint32 (&anonymity),
+      GNUNET_PQ_query_param_absolute_time (&expiration),
+      GNUNET_PQ_query_param_uint64 (&rvalue),
+      GNUNET_PQ_query_param_auto_from_type (key),
+      GNUNET_PQ_query_param_auto_from_type (&vhash),
+      GNUNET_PQ_query_param_fixed_size (data, size),
+      GNUNET_PQ_query_param_end
+    };
+
+    ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "put",
+                                              params);
+    if (0 > ret)
+    {
+      cont (cont_cls,
+            key,
+            size,
+            GNUNET_SYSERR,
+            "Postgresql exec failure");
+      return;
+    }
+  }
+  plugin->env->duc (plugin->env->cls,
+                    size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "datastore-postgres",
+                   "Stored %u bytes in database\n",
+                   (unsigned int) size);
+  cont (cont_cls,
+        key,
+        size,
+        GNUNET_OK,
+        NULL);
+}
+
+
+/**
+ * Closure for #process_result.
+ */
+struct ProcessResultContext
+{
+  /**
+   * The plugin handle.
+   */
+  struct Plugin *plugin;
+
+  /**
+   * Function to call on each result.
+   */
+  PluginDatumProcessor proc;
+
+  /**
+   * Closure for @e proc.
+   */
+  void *proc_cls;
+};
+
+
+/**
+ * Function invoked to process the result and call the processor of @a
+ * cls.
+ *
+ * @param cls our `struct ProcessResultContext`
+ * @param res result from exec
+ * @param num_results number of results in @a res
+ */
+static void
+process_result (void *cls,
+                PGresult *res,
+                unsigned int num_results)
+{
+  struct ProcessResultContext *prc = cls;
+  struct Plugin *plugin = prc->plugin;
+
+  if (0 == num_results)
+  {
+    /* no result */
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "datastore-postgres",
+                     "Ending iteration (no more results)\n");
+    prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+               GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  if (1 != num_results)
+  {
+    GNUNET_break (0);
+    prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+               GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  /* Technically we don't need the loop here, but nicer in case
+     we ever relax the condition above. */
+  for (unsigned int i = 0; i < num_results; i++)
+  {
+    int iret;
+    uint64_t rowid;
+    uint32_t utype;
+    uint32_t anonymity;
+    uint32_t replication;
+    uint32_t priority;
+    size_t size;
+    void *data;
+    struct GNUNET_TIME_Absolute expiration_time;
+    struct GNUNET_HashCode key;
+    struct GNUNET_PQ_ResultSpec rs[] = {
+      GNUNET_PQ_result_spec_uint32 ("repl", &replication),
+      GNUNET_PQ_result_spec_uint32 ("type", &utype),
+      GNUNET_PQ_result_spec_uint32 ("prio", &priority),
+      GNUNET_PQ_result_spec_uint32 ("anonLevel", &anonymity),
+      GNUNET_PQ_result_spec_absolute_time ("expire", &expiration_time),
+      GNUNET_PQ_result_spec_auto_from_type ("hash", &key),
+      GNUNET_PQ_result_spec_variable_size ("value", &data, &size),
+      GNUNET_PQ_result_spec_uint64 ("oid", &rowid),
+      GNUNET_PQ_result_spec_end
+    };
+
+    if (GNUNET_OK !=
+        GNUNET_PQ_extract_result (res,
+                                  rs,
+                                  i))
+    {
+      GNUNET_break (0);
+      prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+                 GNUNET_TIME_UNIT_ZERO_ABS, 0);
+      return;
+    }
+
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "datastore-postgres",
+                     "Found result of size %u bytes and type %u in database\n",
+                     (unsigned int) size,
+                     (unsigned int) utype);
+    iret = prc->proc (prc->proc_cls,
+                      &key,
+                      size,
+                      data,
+                      (enum GNUNET_BLOCK_Type) utype,
+                      priority,
+                      anonymity,
+                      replication,
+                      expiration_time,
+                      rowid);
+    if (iret == GNUNET_NO)
+    {
+      struct GNUNET_PQ_QueryParam param[] = {
+        GNUNET_PQ_query_param_uint64 (&rowid),
+        GNUNET_PQ_query_param_end
+      };
+
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Processor asked for item %u to be removed.\n",
+                  (unsigned int) rowid);
+      if (0 <
+          GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "delrow",
+                                              param))
+      {
+        GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                         "datastore-postgres",
+                         "Deleting %u bytes from database\n",
+                         (unsigned int) size);
+        plugin->env->duc (plugin->env->cls,
+                          -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
+        GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                         "datastore-postgres",
+                         "Deleted %u bytes from database\n",
+                         (unsigned int) size);
+      }
+    }
+    GNUNET_PQ_cleanup_result (rs);
+  }   /* for (i) */
+}
+
+
+/**
+ * Get one of the results for a particular key in the datastore.
+ *
+ * @param cls closure with the `struct Plugin`
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param random if true, return a random result instead of using next_uid
+ * @param key maybe NULL (to match all entries)
+ * @param type entries of which type are relevant?
+ *     Use 0 for any type.
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if nothing matches
+ * @param proc_cls closure for @a proc
+ */
+static void
+postgres_plugin_get_key (void *cls,
+                         uint64_t next_uid,
+                         bool random,
+                         const struct GNUNET_HashCode *key,
+                         enum GNUNET_BLOCK_Type type,
+                         PluginDatumProcessor proc,
+                         void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t utype = type;
+  uint16_t use_rvalue = random;
+  uint16_t use_key = NULL != key;
+  uint16_t use_type = GNUNET_BLOCK_TYPE_ANY != type;
+  uint64_t rvalue;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_uint64 (&next_uid),
+    GNUNET_PQ_query_param_uint64 (&rvalue),
+    GNUNET_PQ_query_param_uint16 (&use_rvalue),
+    GNUNET_PQ_query_param_auto_from_type (key),
+    GNUNET_PQ_query_param_uint16 (&use_key),
+    GNUNET_PQ_query_param_uint32 (&utype),
+    GNUNET_PQ_query_param_uint16 (&use_type),
+    GNUNET_PQ_query_param_end
+  };
+  struct ProcessResultContext prc;
+  enum GNUNET_DB_QueryStatus res;
+
+  if (random)
+  {
+    rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                       UINT64_MAX);
+    next_uid = 0;
+  }
+  else
+  {
+    rvalue = 0;
+  }
+  prc.plugin = plugin;
+  prc.proc = proc;
+  prc.proc_cls = proc_cls;
+
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "get",
+                                              params,
+                                              &process_result,
+                                              &prc);
+  if (0 > res)
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+          GNUNET_TIME_UNIT_ZERO_ABS, 0);
+}
+
+
+/**
+ * Select a subset of the items in the datastore and call
+ * the given iterator for each of them.
+ *
+ * @param cls our `struct Plugin *`
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param type entries of which type should be considered?
+ *        Must not be zero (ANY).
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if no value matches
+ * @param proc_cls closure for @a proc
+ */
+static void
+postgres_plugin_get_zero_anonymity (void *cls,
+                                    uint64_t next_uid,
+                                    enum GNUNET_BLOCK_Type type,
+                                    PluginDatumProcessor proc,
+                                    void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t utype = type;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_uint32 (&utype),
+    GNUNET_PQ_query_param_uint64 (&next_uid),
+    GNUNET_PQ_query_param_end
+  };
+  struct ProcessResultContext prc;
+  enum GNUNET_DB_QueryStatus res;
+
+  prc.plugin = plugin;
+  prc.proc = proc;
+  prc.proc_cls = proc_cls;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "select_non_anonymous",
+                                              params,
+                                              &process_result,
+                                              &prc);
+  if (0 > res)
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+          GNUNET_TIME_UNIT_ZERO_ABS, 0);
+}
+
+
+/**
+ * Context for #repl_iter() function.
+ */
+struct ReplCtx
+{
+  /**
+   * Plugin handle.
+   */
+  struct Plugin *plugin;
+
+  /**
+   * Function to call for the result (or the NULL).
+   */
+  PluginDatumProcessor proc;
+
+  /**
+   * Closure for @e proc.
+   */
+  void *proc_cls;
+};
+
+
+/**
+ * Wrapper for the iterator for 'sqlite_plugin_replication_get'.
+ * Decrements the replication counter and calls the original
+ * iterator.
+ *
+ * @param cls closure with the `struct ReplCtx *`
+ * @param key key for the content
+ * @param size number of bytes in @a data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param uid unique identifier for the datum;
+ *        maybe 0 if no unique identifier is available
+ * @return #GNUNET_SYSERR to abort the iteration,
+ *         #GNUNET_OK to continue
+ *         (continue on call to "next", of course),
+ *         #GNUNET_NO to delete the item and continue (if supported)
+ */
+static int
+repl_proc (void *cls,
+           const struct GNUNET_HashCode *key,
+           uint32_t size,
+           const void *data,
+           enum GNUNET_BLOCK_Type type,
+           uint32_t priority,
+           uint32_t anonymity,
+           uint32_t replication,
+           struct GNUNET_TIME_Absolute expiration,
+           uint64_t uid)
+{
+  struct ReplCtx *rc = cls;
+  struct Plugin *plugin = rc->plugin;
+  int ret;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_uint64 (&uid),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus qret;
+
+  ret = rc->proc (rc->proc_cls,
+                  key,
+                  size,
+                  data,
+                  type,
+                  priority,
+                  anonymity,
+                  replication,
+                  expiration,
+                  uid);
+  if (NULL == key)
+    return ret;
+  qret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                             "decrepl",
+                                             params);
+  if (0 > qret)
+    return GNUNET_SYSERR;
+  return ret;
+}
+
+
+/**
+ * Get a random item for replication.  Returns a single, not expired,
+ * random item from those with the highest replication counters.  The
+ * item's replication counter is decremented by one IF it was positive
+ * before.  Call @a proc with all values ZERO or NULL if the datastore
+ * is empty.
+ *
+ * @param cls closure with the `struct Plugin`
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for @a proc
+ */
+static void
+postgres_plugin_get_replication (void *cls,
+                                 PluginDatumProcessor proc,
+                                 void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_end
+  };
+  struct ReplCtx rc;
+  struct ProcessResultContext prc;
+  enum GNUNET_DB_QueryStatus res;
+
+  rc.plugin = plugin;
+  rc.proc = proc;
+  rc.proc_cls = proc_cls;
+  prc.plugin = plugin;
+  prc.proc = &repl_proc;
+  prc.proc_cls = &rc;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "select_replication_order",
+                                              params,
+                                              &process_result,
+                                              &prc);
+  if (0 > res)
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
+          GNUNET_TIME_UNIT_ZERO_ABS, 0);
+}
+
+
+/**
+ * Get a random item for expiration.  Call @a proc with all values
+ * ZERO or NULL if the datastore is empty.
+ *
+ * @param cls closure with the `struct Plugin`
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for @a proc
+ */
+static void
+postgres_plugin_get_expiration (void *cls,
+                                PluginDatumProcessor proc,
+                                void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_TIME_Absolute now = { 0 };
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_end
+  };
+  struct ProcessResultContext prc;
+
+  now = GNUNET_TIME_absolute_get ();
+  prc.plugin = plugin;
+  prc.proc = proc;
+  prc.proc_cls = proc_cls;
+  (void) GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                               "select_expiration_order",
+                                               params,
+                                               &process_result,
+                                               &prc);
+}
+
+
+/**
+ * Closure for #process_keys.
+ */
+struct ProcessKeysContext
+{
+  /**
+   * Function to call for each key.
+   */
+  PluginKeyProcessor proc;
+
+  /**
+   * Closure for @e proc.
+   */
+  void *proc_cls;
+};
+
+
+/**
+ * Function to be called with the results of a SELECT statement
+ * that has returned @a num_results results.
+ *
+ * @param cls closure with a `struct ProcessKeysContext`
+ * @param result the postgres result
+ * @param num_results the number of results in @a result
+ */
+static void
+process_keys (void *cls,
+              PGresult *result,
+              unsigned int num_results)
+{
+  struct ProcessKeysContext *pkc = cls;
+
+  for (unsigned i = 0; i < num_results; i++)
+  {
+    struct GNUNET_HashCode key;
+    struct GNUNET_PQ_ResultSpec rs[] = {
+      GNUNET_PQ_result_spec_auto_from_type ("hash",
+                                            &key),
+      GNUNET_PQ_result_spec_end
+    };
+
+    if (GNUNET_OK !=
+        GNUNET_PQ_extract_result (result,
+                                  rs,
+                                  i))
+    {
+      GNUNET_break (0);
+      continue;
+    }
+    pkc->proc (pkc->proc_cls,
+               &key,
+               1);
+    GNUNET_PQ_cleanup_result (rs);
+  }
+}
+
+
+/**
+ * Get all of the keys in the datastore.
+ *
+ * @param cls closure with the `struct Plugin *`
+ * @param proc function to call on each key
+ * @param proc_cls closure for @a proc
+ */
+static void
+postgres_plugin_get_keys (void *cls,
+                          PluginKeyProcessor proc,
+                          void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_end
+  };
+  struct ProcessKeysContext pkc;
+
+  pkc.proc = proc;
+  pkc.proc_cls = proc_cls;
+  (void) GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                               "get_keys",
+                                               params,
+                                               &process_keys,
+                                               &pkc);
+  proc (proc_cls,
+        NULL,
+        0);
+}
+
+
+/**
+ * Drop database.
+ *
+ * @param cls closure with the `struct Plugin *`
+ */
+static void
+postgres_plugin_drop (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_ExecuteStatement es[] = {
+    GNUNET_PQ_make_execute ("DROP TABLE gn090"),
+    GNUNET_PQ_EXECUTE_STATEMENT_END
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_PQ_exec_statements (plugin->dbh,
+                                 es))
+    GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                     "postgres",
+                     _ ("Failed to drop table from database.\n"));
+}
+
+
+/**
+ * Remove a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the content
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure for @a cont
+ */
+static void
+postgres_plugin_remove_key (void *cls,
+                            const struct GNUNET_HashCode *key,
+                            uint32_t size,
+                            const void *data,
+                            PluginRemoveCont cont,
+                            void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  enum GNUNET_DB_QueryStatus ret;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (key),
+    GNUNET_PQ_query_param_fixed_size (data, size),
+    GNUNET_PQ_query_param_end
+  };
+
+  ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "remove",
+                                            params);
+  if (0 > ret)
+  {
+    cont (cont_cls,
+          key,
+          size,
+          GNUNET_SYSERR,
+          _ ("Postgresql exec failure"));
+    return;
+  }
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == ret)
+  {
+    cont (cont_cls,
+          key,
+          size,
+          GNUNET_NO,
+          NULL);
+    return;
+  }
+  plugin->env->duc (plugin->env->cls,
+                    -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "datastore-postgres",
+                   "Deleted %u bytes from database\n",
+                   (unsigned int) size);
+  cont (cont_cls,
+        key,
+        size,
+        GNUNET_OK,
+        NULL);
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the `struct GNUNET_DATASTORE_PluginEnvironment*`
+ * @return our `struct Plugin *`
+ */
+void *
+libgnunet_plugin_datastore_postgres_init (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  struct Plugin *plugin;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  if (GNUNET_OK != init_connection (plugin))
+  {
+    GNUNET_free (plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
+  api->cls = plugin;
+  api->estimate_size = &postgres_plugin_estimate_size;
+  api->put = &postgres_plugin_put;
+  api->get_key = &postgres_plugin_get_key;
+  api->get_replication = &postgres_plugin_get_replication;
+  api->get_expiration = &postgres_plugin_get_expiration;
+  api->get_zero_anonymity = &postgres_plugin_get_zero_anonymity;
+  api->get_keys = &postgres_plugin_get_keys;
+  api->drop = &postgres_plugin_drop;
+  api->remove_key = &postgres_plugin_remove_key;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls our `struct Plugin *`
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_datastore_postgres_done (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_PQ_disconnect (plugin->dbh);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datastore_postgres.c */
diff --git a/src/plugin/datastore/plugin_datastore_sqlite.c b/src/plugin/datastore/plugin_datastore_sqlite.c
new file mode 100644
index 000000000..5ea9da4cb
--- /dev/null
+++ b/src/plugin/datastore/plugin_datastore_sqlite.c
@@ -0,0 +1,1375 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009, 2011, 2017 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datastore/plugin_datastore_sqlite.c
+ * @brief sqlite-based datastore backend
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_datastore_plugin.h"
+#include "gnunet_sq_lib.h"
+#include <sqlite3.h>
+
+
+/**
+ * We allocate items on the stack at times.  To prevent a stack
+ * overflow, we impose a limit on the maximum size for the data per
+ * item.  64k should be enough.
+ */
+#define MAX_ITEM_SIZE 65536
+
+/**
+ * After how many ms "busy" should a DB operation fail for good?
+ * A low value makes sure that we are more responsive to requests
+ * (especially PUTs).  A high value guarantees a higher success
+ * rate (SELECTs in iterate can take several seconds despite LIMIT=1).
+ *
+ * The default value of 250ms should ensure that users do not experience
+ * huge latencies while at the same time allowing operations to succeed
+ * with reasonable probability.
+ */
+#define BUSY_TIMEOUT_MS 250
+
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' on file 'filename'
+ * with the message given by strerror(errno).
+ */
+#define LOG_SQLITE(db, level, cmd)                                \
+  do                                                              \
+  {                                                               \
+    GNUNET_log_from (level,                                       \
+                     "sqlite",                                    \
+                     _ ("`%s' failed at %s:%d with error: %s\n"), \
+                     cmd,                                         \
+                     __FILE__,                                    \
+                     __LINE__,                                    \
+                     sqlite3_errmsg (db->dbh));                   \
+  } while (0)
+
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' on file 'filename'
+ * with the message given by strerror(errno).
+ */
+#define LOG_SQLITE_MSG(db, msg, level, cmd)                       \
+  do                                                              \
+  {                                                               \
+    GNUNET_log_from (level,                                       \
+                     "sqlite",                                    \
+                     _ ("`%s' failed at %s:%d with error: %s\n"), \
+                     cmd,                                         \
+                     __FILE__,                                    \
+                     __LINE__,                                    \
+                     sqlite3_errmsg (db->dbh));                   \
+    GNUNET_asprintf (msg,                                         \
+                     _ ("`%s' failed at %s:%u with error: %s"),   \
+                     cmd,                                         \
+                     __FILE__,                                    \
+                     __LINE__,                                    \
+                     sqlite3_errmsg (db->dbh));                   \
+  } while (0)
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATASTORE_PluginEnvironment *env;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * Native SQLite database handle.
+   */
+  sqlite3 *dbh;
+
+  /**
+   * Precompiled SQL for remove_key.
+   */
+  sqlite3_stmt *remove;
+
+  /**
+   * Precompiled SQL for deletion.
+   */
+  sqlite3_stmt *delRow;
+
+  /**
+   * Precompiled SQL for update.
+   */
+  sqlite3_stmt *update;
+
+  /**
+   * Get maximum repl value in database.
+   */
+  sqlite3_stmt *maxRepl;
+
+  /**
+   * Precompiled SQL for replication decrement.
+   */
+  sqlite3_stmt *updRepl;
+
+  /**
+   * Precompiled SQL for replication selection.
+   */
+  sqlite3_stmt *selRepl;
+
+  /**
+   * Precompiled SQL for expiration selection.
+   */
+  sqlite3_stmt *selExpi;
+
+  /**
+   * Precompiled SQL for expiration selection.
+   */
+  sqlite3_stmt *selZeroAnon;
+
+  /**
+   * Precompiled SQL for insertion.
+   */
+  sqlite3_stmt *insertContent;
+
+  /**
+   * Precompiled SQL for selection
+   */
+  sqlite3_stmt *get[8];
+
+  /**
+   * Should the database be dropped on shutdown?
+   */
+  int drop_on_shutdown;
+};
+
+
+/**
+ * @brief Prepare a SQL statement
+ *
+ * @param dbh handle to the database
+ * @param zSql SQL statement, UTF-8 encoded
+ * @param ppStmt set to the prepared statement
+ * @return 0 on success
+ */
+static int
+sq_prepare (sqlite3 *dbh, const char *zSql, sqlite3_stmt **ppStmt)
+{
+  char *dummy;
+  int result;
+
+  result = sqlite3_prepare_v2 (dbh,
+                               zSql,
+                               strlen (zSql),
+                               ppStmt,
+                               (const char **) &dummy);
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "sqlite",
+                   "Prepared `%s' / %p: %d\n",
+                   zSql,
+                   *ppStmt,
+                   result);
+  return result;
+}
+
+
+/**
+ * Create our database indices.
+ *
+ * @param dbh handle to the database
+ */
+static void
+create_indices (sqlite3 *dbh)
+{
+  /* create indices */
+  if (
+    0 !=
+    (SQLITE_OK !=
+     sqlite3_exec (dbh,
+                   "CREATE INDEX IF NOT EXISTS idx_hash ON gn091 (hash)",
+                   NULL,
+                   NULL,
+                   NULL))
+    + (SQLITE_OK !=
+       sqlite3_exec (
+         dbh,
+         "CREATE INDEX IF NOT EXISTS idx_anon_type ON gn091 (anonLevel ASC,type)",
+         NULL,
+         NULL,
+         NULL))
+    + (SQLITE_OK !=
+       sqlite3_exec (dbh,
+                     "CREATE INDEX IF NOT EXISTS idx_expire ON gn091 (expire ASC)",
+                     NULL,
+                     NULL,
+                     NULL))
+    + (SQLITE_OK !=
+       sqlite3_exec (
+         dbh,
+         "CREATE INDEX IF NOT EXISTS idx_repl_rvalue ON gn091 (repl,rvalue)",
+         NULL,
+         NULL,
+         NULL)))
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "sqlite",
+                     "Failed to create indices: %s\n",
+                     sqlite3_errmsg (dbh));
+}
+
+
+#if 0
+#define CHECK(a) GNUNET_break (a)
+#define ENULL NULL
+#else
+#define ENULL &e
+#define ENULL_DEFINED 1
+#define CHECK(a)                                     \
+  if (! (a))                                         \
+  {                                                  \
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "%s\n", e); \
+    sqlite3_free (e);                                \
+    e = NULL;                                        \
+  }
+#endif
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param cfg our configuration
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static int
+database_setup (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                struct Plugin *plugin)
+{
+  sqlite3_stmt *stmt;
+  char *afsdir;
+
+#if ENULL_DEFINED
+  char *e;
+#endif
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                            "datastore-sqlite",
+                                                            "FILENAME",
+                                                            &afsdir))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "datastore-sqlite",
+                               "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK != GNUNET_DISK_file_test (afsdir))
+  {
+    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (afsdir))
+    {
+      GNUNET_break (0);
+      GNUNET_free (afsdir);
+      return GNUNET_SYSERR;
+    }
+    /* database is new or got deleted, reset payload to zero! */
+    if (NULL != plugin->env->duc)
+      plugin->env->duc (plugin->env->cls, 0);
+  }
+  /* afsdir should be UTF-8-encoded. If it isn't, it's a bug */
+  plugin->fn = afsdir;
+
+  /* Open database and precompile statements */
+  if (SQLITE_OK != sqlite3_open (plugin->fn, &plugin->dbh))
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "sqlite",
+                     _ ("Unable to initialize SQLite: %s.\n"),
+                     sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  CHECK (
+    SQLITE_OK ==
+    sqlite3_exec (plugin->dbh, "PRAGMA temp_store=MEMORY", NULL, NULL, ENULL));
+  CHECK (
+    SQLITE_OK ==
+    sqlite3_exec (plugin->dbh, "PRAGMA synchronous=OFF", NULL, NULL, ENULL));
+  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
+                                    "PRAGMA legacy_file_format=OFF",
+                                    NULL,
+                                    NULL,
+                                    ENULL));
+  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
+                                    "PRAGMA auto_vacuum=INCREMENTAL",
+                                    NULL,
+                                    NULL,
+                                    ENULL));
+  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
+                                    "PRAGMA locking_mode=EXCLUSIVE",
+                                    NULL,
+                                    NULL,
+                                    ENULL));
+  CHECK (
+    SQLITE_OK ==
+    sqlite3_exec (plugin->dbh, "PRAGMA page_size=4096", NULL, NULL, ENULL));
+
+  CHECK (SQLITE_OK == sqlite3_busy_timeout (plugin->dbh, BUSY_TIMEOUT_MS));
+
+
+  /* We have to do it here, because otherwise precompiling SQL might fail */
+  CHECK (SQLITE_OK ==
+         sq_prepare (plugin->dbh,
+                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'gn091'",
+                     &stmt));
+
+  /* FIXME: SQLite does not have unsigned integers! This is ok for the type column because
+   * we only test equality on it and can cast it to/from uint32_t. For repl, prio, and anonLevel
+   * we do math or inequality tests, so we can't handle the entire range of uint32_t.
+   * This will also cause problems for expiration times after 294247-01-10-04:00:54 UTC.
+   */if ((SQLITE_DONE == sqlite3_step (stmt)) &&
+      (SQLITE_OK != sqlite3_exec (plugin->dbh,
+                                  "CREATE TABLE gn091 ("
+                                  "  repl INT4 NOT NULL DEFAULT 0,"
+                                  "  type INT4 NOT NULL DEFAULT 0,"
+                                  "  prio INT4 NOT NULL DEFAULT 0,"
+                                  "  anonLevel INT4 NOT NULL DEFAULT 0,"
+                                  "  expire INT8 NOT NULL DEFAULT 0,"
+                                  "  rvalue INT8 NOT NULL,"
+                                  "  hash TEXT NOT NULL DEFAULT '',"
+                                  "  vhash TEXT NOT NULL DEFAULT '',"
+                                  "  value BLOB NOT NULL DEFAULT '')",
+                                  NULL,
+                                  NULL,
+                                  NULL)))
+  {
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_exec");
+    sqlite3_finalize (stmt);
+    return GNUNET_SYSERR;
+  }
+  sqlite3_finalize (stmt);
+  create_indices (plugin->dbh);
+
+#define RESULT_COLUMNS \
+  "repl, type, prio, anonLevel, expire, hash, value, _ROWID_"
+  if (
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "UPDATE gn091 "
+                              "SET prio = prio + ?, "
+                              "repl = repl + ?, "
+                              "expire = MAX(expire, ?) "
+                              "WHERE hash = ? AND vhash = ?",
+                              &plugin->update)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "UPDATE gn091 "
+                              "SET repl = MAX (0, repl - 1) WHERE _ROWID_ = ?",
+                              &plugin->updRepl)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE repl=?2 AND "
+                              " (rvalue>=?1 OR "
+                              "  NOT EXISTS (SELECT 1 FROM gn091 "
+                              "WHERE repl=?2 AND rvalue>=?1 LIMIT 1) ) "
+                              "ORDER BY rvalue ASC LIMIT 1",
+                              &plugin->selRepl)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT MAX(repl) FROM gn091",
+                              &plugin->maxRepl)) ||
+    (SQLITE_OK !=
+     sq_prepare (plugin->dbh,
+                 "SELECT " RESULT_COLUMNS " FROM gn091 "
+                 "WHERE NOT EXISTS (SELECT 1 FROM gn091 WHERE expire < ?1 LIMIT 1) OR (expire < ?1) "
+                 "ORDER BY expire ASC LIMIT 1",
+                 &plugin->selExpi)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ? AND "
+                              "anonLevel = 0 AND "
+                              "type = ? "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->selZeroAnon)) ||
+    (SQLITE_OK !=
+     sq_prepare (plugin->dbh,
+                 "INSERT INTO gn091 (repl, type, prio, anonLevel, expire, rvalue, hash, vhash, value) "
+                 "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+                 &plugin->insertContent)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[0])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "type = ?4 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[1])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "hash = ?3 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[2])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "hash = ?3 AND "
+                              "type = ?4 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[3])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "rvalue >= ?2 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[4])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "rvalue >= ?2 AND "
+                              "type = ?4 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[5])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "rvalue >= ?2 AND "
+                              "hash = ?3 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[6])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "SELECT " RESULT_COLUMNS " FROM gn091 "
+                              "WHERE _ROWID_ >= ?1 AND "
+                              "rvalue >= ?2 AND "
+                              "hash = ?3 AND "
+                              "type = ?4 "
+                              "ORDER BY _ROWID_ ASC LIMIT 1",
+                              &plugin->get[7])) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "DELETE FROM gn091 WHERE _ROWID_ = ?",
+                              &plugin->delRow)) ||
+    (SQLITE_OK != sq_prepare (plugin->dbh,
+                              "DELETE FROM gn091 "
+                              "WHERE hash = ? AND "
+                              "value = ? ",
+                              &plugin->remove)) ||
+    false)
+  {
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "precompiling");
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ *
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  int result;
+
+#if SQLITE_VERSION_NUMBER >= 3007000
+  sqlite3_stmt *stmt;
+#endif
+
+  if (NULL != plugin->remove)
+    sqlite3_finalize (plugin->remove);
+  if (NULL != plugin->delRow)
+    sqlite3_finalize (plugin->delRow);
+  if (NULL != plugin->update)
+    sqlite3_finalize (plugin->update);
+  if (NULL != plugin->updRepl)
+    sqlite3_finalize (plugin->updRepl);
+  if (NULL != plugin->selRepl)
+    sqlite3_finalize (plugin->selRepl);
+  if (NULL != plugin->maxRepl)
+    sqlite3_finalize (plugin->maxRepl);
+  if (NULL != plugin->selExpi)
+    sqlite3_finalize (plugin->selExpi);
+  if (NULL != plugin->selZeroAnon)
+    sqlite3_finalize (plugin->selZeroAnon);
+  if (NULL != plugin->insertContent)
+    sqlite3_finalize (plugin->insertContent);
+  for (int i = 0; i < 8; ++i)
+    if (NULL != plugin->get[i])
+      sqlite3_finalize (plugin->get[i]);
+  result = sqlite3_close (plugin->dbh);
+#if SQLITE_VERSION_NUMBER >= 3007000
+  if (result == SQLITE_BUSY)
+  {
+    GNUNET_log_from (
+      GNUNET_ERROR_TYPE_WARNING,
+      "sqlite",
+      _ (
+        "Tried to close sqlite without finalizing all prepared statements.\n"));
+    stmt = sqlite3_next_stmt (plugin->dbh, NULL);
+    while (NULL != stmt)
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "sqlite",
+                       "Closing statement %p\n",
+                       stmt);
+      result = sqlite3_finalize (stmt);
+      if (result != SQLITE_OK)
+        GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                         "sqlite",
+                         "Failed to close statement %p: %d\n",
+                         stmt,
+                         result);
+      stmt = sqlite3_next_stmt (plugin->dbh, NULL);
+    }
+    result = sqlite3_close (plugin->dbh);
+  }
+#endif
+  if (SQLITE_OK != result)
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_close");
+  GNUNET_free (plugin->fn);
+}
+
+
+/**
+ * Delete the database entry with the given
+ * row identifier.
+ *
+ * @param plugin the plugin context (state for this module)
+ * @param rid the ID of the row to delete
+ */
+static int
+delete_by_rowid (struct Plugin *plugin, uint64_t rid)
+{
+  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_uint64 (&rid),
+                                           GNUNET_SQ_query_param_end };
+
+  if (GNUNET_OK != GNUNET_SQ_bind (plugin->delRow, params))
+    return GNUNET_SYSERR;
+  if (SQLITE_DONE != sqlite3_step (plugin->delRow))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh, plugin->delRow);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_SQ_reset (plugin->dbh, plugin->delRow);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the item
+ * @param absent true if the key was not found in the bloom filter
+ * @param size number of bytes in @a data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure
+ */
+static void
+sqlite_plugin_put (void *cls,
+                   const struct GNUNET_HashCode *key,
+                   bool absent,
+                   uint32_t size,
+                   const void *data,
+                   enum GNUNET_BLOCK_Type type,
+                   uint32_t priority,
+                   uint32_t anonymity,
+                   uint32_t replication,
+                   struct GNUNET_TIME_Absolute expiration,
+                   PluginPutCont cont,
+                   void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode vhash;
+  char *msg = NULL;
+
+  GNUNET_CRYPTO_hash (data, size, &vhash);
+
+  if (! absent)
+  {
+    struct GNUNET_SQ_QueryParam params[] =
+    { GNUNET_SQ_query_param_uint32 (&priority),
+      GNUNET_SQ_query_param_uint32 (&replication),
+      GNUNET_SQ_query_param_absolute_time (&expiration),
+      GNUNET_SQ_query_param_auto_from_type (key),
+      GNUNET_SQ_query_param_auto_from_type (&vhash),
+      GNUNET_SQ_query_param_end };
+
+    if (GNUNET_OK != GNUNET_SQ_bind (plugin->update, params))
+    {
+      cont (cont_cls, key, size, GNUNET_SYSERR, _ ("sqlite bind failure"));
+      return;
+    }
+    if (SQLITE_DONE != sqlite3_step (plugin->update))
+    {
+      LOG_SQLITE_MSG (plugin,
+                      &msg,
+                      GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                      "sqlite3_step");
+      cont (cont_cls, key, size, GNUNET_SYSERR, msg);
+      GNUNET_free (msg);
+      return;
+    }
+    int changes = sqlite3_changes (plugin->dbh);
+    GNUNET_SQ_reset (plugin->dbh, plugin->update);
+    if (0 != changes)
+    {
+      cont (cont_cls, key, size, GNUNET_NO, NULL);
+      return;
+    }
+  }
+
+  uint64_t rvalue;
+  uint32_t type32 = (uint32_t) type;
+  struct GNUNET_SQ_QueryParam params[] =
+  { GNUNET_SQ_query_param_uint32 (&replication),
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_uint32 (&priority),
+    GNUNET_SQ_query_param_uint32 (&anonymity),
+    GNUNET_SQ_query_param_absolute_time (&expiration),
+    GNUNET_SQ_query_param_uint64 (&rvalue),
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_auto_from_type (&vhash),
+    GNUNET_SQ_query_param_fixed_size (data, size),
+    GNUNET_SQ_query_param_end };
+  int n;
+  int ret;
+  sqlite3_stmt *stmt;
+
+  if (size > MAX_ITEM_SIZE)
+  {
+    cont (cont_cls, key, size, GNUNET_SYSERR, _ ("Data too large"));
+    return;
+  }
+  GNUNET_log_from (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "sqlite",
+    "Storing in database block with type %u/key `%s'/priority %u/expiration in %s (%s).\n",
+    type,
+    GNUNET_h2s (key),
+    priority,
+    GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_remaining (
+                                              expiration),
+                                            GNUNET_YES),
+    GNUNET_STRINGS_absolute_time_to_string (expiration));
+  stmt = plugin->insertContent;
+  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
+  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
+  {
+    cont (cont_cls, key, size, GNUNET_SYSERR, NULL);
+    return;
+  }
+  n = sqlite3_step (stmt);
+  switch (n)
+  {
+  case SQLITE_DONE:
+    if (NULL != plugin->env->duc)
+      plugin->env->duc (plugin->env->cls,
+                        size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Stored new entry (%u bytes)\n",
+                     size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
+    ret = GNUNET_OK;
+    break;
+
+  case SQLITE_BUSY:
+    GNUNET_break (0);
+    LOG_SQLITE_MSG (plugin,
+                    &msg,
+                    GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                    "sqlite3_step");
+    ret = GNUNET_SYSERR;
+    break;
+
+  default:
+    LOG_SQLITE_MSG (plugin,
+                    &msg,
+                    GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                    "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh, stmt);
+    database_shutdown (plugin);
+    database_setup (plugin->env->cfg, plugin);
+    cont (cont_cls, key, size, GNUNET_SYSERR, msg);
+    GNUNET_free (msg);
+    return;
+  }
+  GNUNET_SQ_reset (plugin->dbh, stmt);
+  cont (cont_cls, key, size, ret, msg);
+  GNUNET_free (msg);
+}
+
+
+/**
+ * Execute statement that gets a row and call the callback
+ * with the result.  Resets the statement afterwards.
+ *
+ * @param plugin the plugin
+ * @param stmt the statement
+ * @param proc processor to call
+ * @param proc_cls closure for @a proc
+ */
+static void
+execute_get (struct Plugin *plugin,
+             sqlite3_stmt *stmt,
+             PluginDatumProcessor proc,
+             void *proc_cls)
+{
+  int n;
+  struct GNUNET_TIME_Absolute expiration;
+  uint32_t replication;
+  uint32_t type;
+  uint32_t priority;
+  uint32_t anonymity;
+  uint64_t rowid;
+  void *value;
+  size_t value_size;
+  struct GNUNET_HashCode key;
+  int ret;
+  struct GNUNET_SQ_ResultSpec rs[] =
+  { GNUNET_SQ_result_spec_uint32 (&replication),
+    GNUNET_SQ_result_spec_uint32 (&type),
+    GNUNET_SQ_result_spec_uint32 (&priority),
+    GNUNET_SQ_result_spec_uint32 (&anonymity),
+    GNUNET_SQ_result_spec_absolute_time (&expiration),
+    GNUNET_SQ_result_spec_auto_from_type (&key),
+    GNUNET_SQ_result_spec_variable_size (&value, &value_size),
+    GNUNET_SQ_result_spec_uint64 (&rowid),
+    GNUNET_SQ_result_spec_end };
+
+  n = sqlite3_step (stmt);
+  switch (n)
+  {
+  case SQLITE_ROW:
+    if (GNUNET_OK != GNUNET_SQ_extract_result (stmt, rs))
+    {
+      GNUNET_break (0);
+      break;
+    }
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Found reply in database with expiration %s\n",
+                     GNUNET_STRINGS_absolute_time_to_string (expiration));
+    ret = proc (proc_cls,
+                &key,
+                value_size,
+                value,
+                type,
+                priority,
+                anonymity,
+                replication,
+                expiration,
+                rowid);
+    GNUNET_SQ_cleanup_result (rs);
+    GNUNET_SQ_reset (plugin->dbh, stmt);
+    if ((GNUNET_NO == ret) && (GNUNET_OK == delete_by_rowid (plugin, rowid)) &&
+        (NULL != plugin->env->duc))
+      plugin->env->duc (plugin->env->cls,
+                        -(value_size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
+    return;
+
+  case SQLITE_DONE:
+    /* database must be empty */
+    break;
+
+  case SQLITE_BUSY:
+  case SQLITE_ERROR:
+  case SQLITE_MISUSE:
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    if (SQLITE_OK != sqlite3_reset (stmt))
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "sqlite3_reset");
+    GNUNET_break (0);
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    database_shutdown (plugin);
+    database_setup (plugin->env->cfg, plugin);
+    return;
+  }
+  GNUNET_SQ_reset (plugin->dbh, stmt);
+  proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+}
+
+
+/**
+ * Select a subset of the items in the datastore and call
+ * the given processor for the item.
+ *
+ * @param cls our plugin context
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param type entries of which type should be considered?
+ *        Must not be zero (ANY).
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if no value matches
+ * @param proc_cls closure for @a proc
+ */
+static void
+sqlite_plugin_get_zero_anonymity (void *cls,
+                                  uint64_t next_uid,
+                                  enum GNUNET_BLOCK_Type type,
+                                  PluginDatumProcessor proc,
+                                  void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  uint32_t type32 = type;
+  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_uint64 (
+                                             &next_uid),
+                                           GNUNET_SQ_query_param_uint32 (
+                                             &type32),
+                                           GNUNET_SQ_query_param_end };
+
+  GNUNET_assert (type != GNUNET_BLOCK_TYPE_ANY);
+  if (GNUNET_OK != GNUNET_SQ_bind (plugin->selZeroAnon, params))
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  execute_get (plugin, plugin->selZeroAnon, proc, proc_cls);
+}
+
+
+/**
+ * Get results for a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param random if true, return a random result instead of using next_uid
+ * @param key maybe NULL (to match all entries)
+ * @param type entries of which type are relevant?
+ *     Use 0 for any type.
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if nothing matches
+ * @param proc_cls closure for @a proc
+ */
+static void
+sqlite_plugin_get_key (void *cls,
+                       uint64_t next_uid,
+                       bool random,
+                       const struct GNUNET_HashCode *key,
+                       enum GNUNET_BLOCK_Type type,
+                       PluginDatumProcessor proc,
+                       void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  uint64_t rvalue;
+  int use_rvalue = random;
+  uint32_t type32 = (uint32_t) type;
+  int use_type = GNUNET_BLOCK_TYPE_ANY != type;
+  int use_key = NULL != key;
+  sqlite3_stmt *stmt = plugin->get[use_rvalue * 4 + use_key * 2 + use_type];
+  struct GNUNET_SQ_QueryParam params[] =
+  { GNUNET_SQ_query_param_uint64 (&next_uid),
+    GNUNET_SQ_query_param_uint64 (&rvalue),
+    GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_uint32 (&type32),
+    GNUNET_SQ_query_param_end };
+
+  /* SQLite doesn't like it when you try to bind a parameter greater than the
+   * last numbered parameter, but unused parameters in the middle are OK.
+   */
+  if (! use_type)
+  {
+    params[3] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
+    if (! use_key)
+    {
+      params[2] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
+      if (! use_rvalue)
+        params[1] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
+    }
+  }
+  if (random)
+  {
+    rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
+    next_uid = 0;
+  }
+  else
+    rvalue = 0;
+
+  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  execute_get (plugin, stmt, proc, proc_cls);
+}
+
+
+/**
+ * Context for #repl_proc() function.
+ */
+struct ReplCtx
+{
+  /**
+   * Function to call for the result (or the NULL).
+   */
+  PluginDatumProcessor proc;
+
+  /**
+   * Closure for @e proc.
+   */
+  void *proc_cls;
+
+  /**
+   * UID to use.
+   */
+  uint64_t uid;
+
+  /**
+   * Yes if UID was set.
+   */
+  int have_uid;
+};
+
+
+/**
+ * Wrapper for the processor for #sqlite_plugin_get_replication().
+ * Decrements the replication counter and calls the original
+ * processor.
+ *
+ * @param cls closure
+ * @param key key for the content
+ * @param size number of bytes in @a data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param uid unique identifier for the datum;
+ *        maybe 0 if no unique identifier is available
+ * @return #GNUNET_OK for normal return,
+ *         #GNUNET_NO to delete the item
+ */
+static int
+repl_proc (void *cls,
+           const struct GNUNET_HashCode *key,
+           uint32_t size,
+           const void *data,
+           enum GNUNET_BLOCK_Type type,
+           uint32_t priority,
+           uint32_t anonymity,
+           uint32_t replication,
+           struct GNUNET_TIME_Absolute expiration,
+           uint64_t uid)
+{
+  struct ReplCtx *rc = cls;
+  int ret;
+
+  if (GNUNET_SYSERR == rc->have_uid)
+    rc->have_uid = GNUNET_NO;
+  ret = rc->proc (rc->proc_cls,
+                  key,
+                  size,
+                  data,
+                  type,
+                  priority,
+                  anonymity,
+                  replication,
+                  expiration,
+                  uid);
+  if (NULL != key)
+  {
+    rc->uid = uid;
+    rc->have_uid = GNUNET_YES;
+  }
+  return ret;
+}
+
+
+/**
+ * Get a random item for replication.  Returns a single random item
+ * from those with the highest replication counters.  The item's
+ * replication counter is decremented by one IF it was positive before.
+ * Call @a proc with all values ZERO or NULL if the datastore is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for @a proc
+ */
+static void
+sqlite_plugin_get_replication (void *cls,
+                               PluginDatumProcessor proc,
+                               void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct ReplCtx rc;
+  uint64_t rvalue = 0;
+  uint32_t repl;
+  struct GNUNET_SQ_QueryParam params_sel_repl[] =
+  { GNUNET_SQ_query_param_uint64 (&rvalue),
+    GNUNET_SQ_query_param_uint32 (&repl),
+    GNUNET_SQ_query_param_end };
+  struct GNUNET_SQ_QueryParam params_upd_repl[] =
+  { GNUNET_SQ_query_param_uint64 (&rc.uid), GNUNET_SQ_query_param_end };
+
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "datastore-sqlite",
+                   "Getting random block based on replication order.\n");
+  if (SQLITE_ROW != sqlite3_step (plugin->maxRepl))
+  {
+    GNUNET_SQ_reset (plugin->dbh, plugin->maxRepl);
+    /* DB empty */
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  repl = sqlite3_column_int (plugin->maxRepl, 0);
+  GNUNET_SQ_reset (plugin->dbh, plugin->maxRepl);
+  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
+  if (GNUNET_OK != GNUNET_SQ_bind (plugin->selRepl, params_sel_repl))
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  rc.have_uid = GNUNET_SYSERR;
+  rc.proc = proc;
+  rc.proc_cls = proc_cls;
+  execute_get (plugin, plugin->selRepl, &repl_proc, &rc);
+  if (GNUNET_YES == rc.have_uid)
+  {
+    if (GNUNET_OK != GNUNET_SQ_bind (plugin->updRepl, params_upd_repl))
+    {
+      proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+      return;
+    }
+    if (SQLITE_DONE != sqlite3_step (plugin->updRepl))
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh, plugin->updRepl);
+  }
+  if (GNUNET_SYSERR == rc.have_uid)
+  {
+    /* proc was not called at all so far, do it now. */
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+  }
+}
+
+
+/**
+ * Get a random item that has expired or has low priority.
+ * Call @a proc with all values ZERO or NULL if the datastore is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for @a proc
+ */
+static void
+sqlite_plugin_get_expiration (void *cls,
+                              PluginDatumProcessor proc,
+                              void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt;
+  struct GNUNET_TIME_Absolute now = { 0 };
+  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_absolute_time (
+                                             &now),
+                                           GNUNET_SQ_query_param_end };
+
+  GNUNET_log_from (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "sqlite",
+    "Getting random block based on expiration and priority order.\n");
+  now = GNUNET_TIME_absolute_get ();
+  stmt = plugin->selExpi;
+  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
+  {
+    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
+    return;
+  }
+  execute_get (plugin, stmt, proc, proc_cls);
+}
+
+
+/**
+ * Get all of the keys in the datastore.
+ *
+ * @param cls closure
+ * @param proc function to call on each key
+ * @param proc_cls closure for @a proc
+ */
+static void
+sqlite_plugin_get_keys (void *cls, PluginKeyProcessor proc, void *proc_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode key;
+  struct GNUNET_SQ_ResultSpec results[] =
+  { GNUNET_SQ_result_spec_auto_from_type (&key), GNUNET_SQ_result_spec_end };
+  sqlite3_stmt *stmt;
+  int ret;
+
+  GNUNET_assert (NULL != proc);
+  if (SQLITE_OK != sq_prepare (plugin->dbh, "SELECT hash FROM gn091", &stmt))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite_prepare");
+    proc (proc_cls, NULL, 0);
+    return;
+  }
+  while (SQLITE_ROW == (ret = sqlite3_step (stmt)))
+  {
+    if (GNUNET_OK == GNUNET_SQ_extract_result (stmt, results))
+      proc (proc_cls, &key, 1);
+    else
+      GNUNET_break (0);
+  }
+  if (SQLITE_DONE != ret)
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite_step");
+  sqlite3_finalize (stmt);
+  proc (proc_cls, NULL, 0);
+}
+
+
+/**
+ * Drop database.
+ *
+ * @param cls our plugin context
+ */
+static void
+sqlite_plugin_drop (void *cls)
+{
+  struct Plugin *plugin = cls;
+
+  plugin->drop_on_shutdown = GNUNET_YES;
+}
+
+
+/**
+ * Remove a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the content
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure for @a cont
+ */
+static void
+sqlite_plugin_remove_key (void *cls,
+                          const struct GNUNET_HashCode *key,
+                          uint32_t size,
+                          const void *data,
+                          PluginRemoveCont cont,
+                          void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_SQ_QueryParam params[] =
+  { GNUNET_SQ_query_param_auto_from_type (key),
+    GNUNET_SQ_query_param_fixed_size (data, size),
+    GNUNET_SQ_query_param_end };
+
+  if (GNUNET_OK != GNUNET_SQ_bind (plugin->remove, params))
+  {
+    cont (cont_cls, key, size, GNUNET_SYSERR, "bind failed");
+    return;
+  }
+  if (SQLITE_DONE != sqlite3_step (plugin->remove))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh, plugin->remove);
+    cont (cont_cls, key, size, GNUNET_SYSERR, "sqlite3_step failed");
+    return;
+  }
+  int changes = sqlite3_changes (plugin->dbh);
+  GNUNET_SQ_reset (plugin->dbh, plugin->remove);
+  if (0 == changes)
+  {
+    cont (cont_cls, key, size, GNUNET_NO, NULL);
+    return;
+  }
+  if (NULL != plugin->env->duc)
+    plugin->env->duc (plugin->env->cls,
+                      -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
+  cont (cont_cls, key, size, GNUNET_OK, NULL);
+}
+
+
+/**
+ * Get an estimate of how much space the database is
+ * currently using.
+ *
+ * @param cls the `struct Plugin`
+ * @return the size of the database on disk (estimate)
+ */
+static void
+sqlite_plugin_estimate_size (void *cls, unsigned long long *estimate)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt;
+  uint64_t pages;
+  uint64_t page_size;
+
+#if ENULL_DEFINED
+  char *e;
+#endif
+
+  if (NULL == estimate)
+    return;
+  if (SQLITE_VERSION_NUMBER < 3006000)
+  {
+    GNUNET_log_from (
+      GNUNET_ERROR_TYPE_WARNING,
+      "datastore-sqlite",
+      _ ("sqlite version to old to determine size, assuming zero\n"));
+    *estimate = 0;
+    return;
+  }
+  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh, "VACUUM", NULL, NULL, ENULL));
+  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
+                                    "PRAGMA auto_vacuum=INCREMENTAL",
+                                    NULL,
+                                    NULL,
+                                    ENULL));
+  if (SQLITE_OK != sq_prepare (plugin->dbh, "PRAGMA page_count", &stmt))
+  {
+    GNUNET_log_from (
+      GNUNET_ERROR_TYPE_WARNING,
+      "datastore-sqlite",
+      _("error preparing statement\n"));
+    return;
+  }
+  if (SQLITE_ROW == sqlite3_step (stmt))
+    pages = sqlite3_column_int64 (stmt, 0);
+  else
+    pages = 0;
+  sqlite3_finalize (stmt);
+  if (SQLITE_OK != sq_prepare (plugin->dbh, "PRAGMA page_size", &stmt))
+  {
+    GNUNET_log_from (
+      GNUNET_ERROR_TYPE_WARNING,
+      "datastore-sqlite",
+      _("error preparing statement\n"));
+    return;
+  }
+  if (SQLITE_ROW != sqlite3_step (stmt))
+  {
+    GNUNET_log_from (
+      GNUNET_ERROR_TYPE_WARNING,
+      "datastore-sqlite",
+      _("error stepping\n"));
+    return;
+  }
+  page_size = sqlite3_column_int64 (stmt, 0);
+  sqlite3_finalize (stmt);
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_INFO,
+    _ (
+      "Using sqlite page utilization to estimate payload (%llu pages of size %llu bytes)\n"),
+    (unsigned long long) pages,
+    (unsigned long long) page_size);
+  *estimate = pages * page_size;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the `struct GNUNET_DATASTORE_PluginEnvironment *`
+ * @return NULL on error, othrewise the plugin context
+ */
+void *
+libgnunet_plugin_datastore_sqlite_init (void *cls)
+{
+  static struct Plugin plugin;
+  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+
+  if (NULL != plugin.env)
+    return NULL; /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.env = env;
+  if (GNUNET_OK != database_setup (env->cfg, &plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
+  api->cls = &plugin;
+  api->estimate_size = &sqlite_plugin_estimate_size;
+  api->put = &sqlite_plugin_put;
+  api->get_key = &sqlite_plugin_get_key;
+  api->get_replication = &sqlite_plugin_get_replication;
+  api->get_expiration = &sqlite_plugin_get_expiration;
+  api->get_zero_anonymity = &sqlite_plugin_get_zero_anonymity;
+  api->get_keys = &sqlite_plugin_get_keys;
+  api->drop = &sqlite_plugin_drop;
+  api->remove_key = &sqlite_plugin_remove_key;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
+                   "sqlite",
+                   _ ("Sqlite database running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_datastore_sqlite_done (void *cls)
+{
+  char *fn;
+  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                   "sqlite",
+                   "sqlite plugin is done\n");
+  fn = NULL;
+  if (plugin->drop_on_shutdown)
+    fn = GNUNET_strdup (plugin->fn);
+  database_shutdown (plugin);
+  plugin->env = NULL;
+  GNUNET_free (api);
+  if (NULL != fn)
+  {
+    if (0 != unlink (fn))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "unlink", fn);
+    GNUNET_free (fn);
+  }
+  return NULL;
+}
+
+
+/* end of plugin_datastore_sqlite.c */
diff --git a/src/plugin/datastore/plugin_datastore_template.c b/src/plugin/datastore/plugin_datastore_template.c
new file mode 100644
index 000000000..2b455f8cb
--- /dev/null
+++ b/src/plugin/datastore/plugin_datastore_template.c
@@ -0,0 +1,274 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2009, 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file datastore/plugin_datastore_template.c
+ * @brief template-based datastore backend
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_datastore_plugin.h"
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our execution environment.
+   */
+  struct GNUNET_DATASTORE_PluginEnvironment *env;
+};
+
+
+/**
+ * Get an estimate of how much space the database is
+ * currently using.
+ *
+ * @param cls our "struct Plugin*"
+ * @return number of bytes used on disk
+ */
+static void
+template_plugin_estimate_size (void *cls, unsigned long long *estimate)
+{
+  if (NULL == estimate)
+    return;
+  GNUNET_break (0);
+  *estimate = 0;
+}
+
+
+/**
+ * Store an item in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the item
+ * @param absent true if the key was not found in the bloom filter
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param type type of the content
+ * @param priority priority of the content
+ * @param anonymity anonymity-level for the content
+ * @param replication replication-level for the content
+ * @param expiration expiration time for the content
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure
+ */
+static void
+template_plugin_put (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     bool absent,
+                     uint32_t size,
+                     const void *data,
+                     enum GNUNET_BLOCK_Type type,
+                     uint32_t priority,
+                     uint32_t anonymity,
+                     uint32_t replication,
+                     struct GNUNET_TIME_Absolute expiration,
+                     PluginPutCont cont,
+                     void *cont_cls)
+{
+  GNUNET_break (0);
+  cont (cont_cls, key, size, GNUNET_SYSERR, "not implemented");
+}
+
+
+/**
+ * Get one of the results for a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param random if true, return a random result instead of using next_uid
+ * @param key maybe NULL (to match all entries)
+ * @param type entries of which type are relevant?
+ *     Use 0 for any type.
+ * @param proc function to call on each matching value;
+ *        will be called with NULL if nothing matches
+ * @param proc_cls closure for proc
+ */
+static void
+template_plugin_get_key (void *cls,
+                         uint64_t next_uid,
+                         bool random,
+                         const struct GNUNET_HashCode *key,
+                         enum GNUNET_BLOCK_Type type,
+                         PluginDatumProcessor proc,
+                         void *proc_cls)
+{
+  GNUNET_break (0);
+}
+
+
+/**
+ * Get a random item for replication.  Returns a single, not expired,
+ * random item from those with the highest replication counters.  The
+ * item's replication counter is decremented by one IF it was positive
+ * before.  Call 'proc' with all values ZERO or NULL if the datastore
+ * is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for proc
+ */
+static void
+template_plugin_get_replication (void *cls, PluginDatumProcessor proc,
+                                 void *proc_cls)
+{
+  GNUNET_break (0);
+}
+
+
+/**
+ * Get a random item for expiration.  Call 'proc' with all values ZERO
+ * or NULL if the datastore is empty.
+ *
+ * @param cls closure
+ * @param proc function to call the value (once only).
+ * @param proc_cls closure for proc
+ */
+static void
+template_plugin_get_expiration (void *cls, PluginDatumProcessor proc,
+                                void *proc_cls)
+{
+  GNUNET_break (0);
+}
+
+
+/**
+ * Call the given processor on an item with zero anonymity.
+ *
+ * @param cls our "struct Plugin*"
+ * @param next_uid return the result with lowest uid >= next_uid
+ * @param type entries of which type should be considered?
+ *        Must not be zero (ANY).
+ * @param proc function to call on the matching value;
+ *        will be called with NULL if no value matches
+ * @param proc_cls closure for proc
+ */
+static void
+template_plugin_get_zero_anonymity (void *cls, uint64_t next_uid,
+                                    enum GNUNET_BLOCK_Type type,
+                                    PluginDatumProcessor proc, void *proc_cls)
+{
+  GNUNET_break (0);
+}
+
+
+/**
+ * Drop database.
+ */
+static void
+template_plugin_drop (void *cls)
+{
+  GNUNET_break (0);
+}
+
+
+/**
+ * Get all of the keys in the datastore.
+ *
+ * @param cls closure
+ * @param proc function to call on each key
+ * @param proc_cls closure for proc
+ */
+static void
+template_get_keys (void *cls,
+                   PluginKeyProcessor proc,
+                   void *proc_cls)
+{
+  proc (proc_cls, NULL, 0);
+}
+
+
+/**
+ * Remove a particular key in the datastore.
+ *
+ * @param cls closure
+ * @param key key for the content
+ * @param size number of bytes in data
+ * @param data content stored
+ * @param cont continuation called with success or failure status
+ * @param cont_cls continuation closure for @a cont
+ */
+static void
+template_plugin_remove_key (void *cls,
+                            const struct GNUNET_HashCode *key,
+                            uint32_t size,
+                            const void *data,
+                            PluginRemoveCont cont,
+                            void *cont_cls)
+{
+  GNUNET_break (0);
+  cont (cont_cls, key, size, GNUNET_SYSERR, "not implemented");
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_DATASTORE_PluginEnvironment*"
+ * @return our "struct Plugin*"
+ */
+void *
+libgnunet_plugin_datastore_template_init (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  struct Plugin *plugin;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
+  api->cls = plugin;
+  api->estimate_size = &template_plugin_estimate_size;
+  api->put = &template_plugin_put;
+  api->get_key = &template_plugin_get_key;
+  api->get_replication = &template_plugin_get_replication;
+  api->get_expiration = &template_plugin_get_expiration;
+  api->get_zero_anonymity = &template_plugin_get_zero_anonymity;
+  api->drop = &template_plugin_drop;
+  api->get_keys = &template_get_keys;
+  api->remove_key = &template_plugin_remove_key;
+  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "template",
+                   _ ("Template database running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ * @param cls our "struct Plugin*"
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_datastore_template_done (void *cls)
+{
+  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_datastore_template.c */
diff --git a/src/plugin/datastore/test_defaults.conf b/src/plugin/datastore/test_defaults.conf
new file mode 100644
index 000000000..1e6bbeeaf
--- /dev/null
+++ b/src/plugin/datastore/test_defaults.conf
@@ -0,0 +1,10 @@
+@inline@ ../../../contrib/conf/gnunet/no_autostart_above_core.conf
+@inline@ ../../../contrib/conf/gnunet/no_forcestart.conf
+
+[datastore]
+PORT = 22654
+QUOTA = 1 MB
+START_ON_DEMAND = YES
+
+[nse]
+WORKBITS = 1
diff --git a/src/plugin/datastore/test_plugin_datastore.c b/src/plugin/datastore/test_plugin_datastore.c
new file mode 100644
index 000000000..7de1acf2d
--- /dev/null
+++ b/src/plugin/datastore/test_plugin_datastore.c
@@ -0,0 +1,478 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/*
+ * @file test_plugin_datastore.c
+ * @brief Test database plugin directly, calling each API function once
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_datastore_plugin.h"
+#include "gnunet_testing_lib.h"
+
+/**
+ * Number of put operations to perform.
+ */
+#define PUT_10 10
+
+static unsigned long long stored_bytes;
+
+static unsigned long long stored_entries;
+
+static unsigned long long stored_ops;
+
+static const char *plugin_name;
+
+static int ok;
+
+enum RunPhase
+{
+  RP_ERROR = 0,
+  RP_PUT,
+  RP_GET,
+  RP_ITER_ZERO,
+  RP_REPL_GET,
+  RP_EXPI_GET,
+  RP_REMOVE,
+  RP_DROP
+};
+
+
+struct CpsRunContext
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  enum RunPhase phase;
+  unsigned int cnt;
+  unsigned int i;
+};
+
+
+/**
+ * Function called by plugins to notify us about a
+ * change in their disk utilization.
+ *
+ * @param cls closure (NULL)
+ * @param delta change in disk utilization,
+ *        0 for "reset to empty"
+ */
+static void
+disk_utilization_change_cb (void *cls, int delta)
+{
+  /* do nothing */
+}
+
+
+static void
+test (void *cls);
+
+
+/**
+ * Put continuation.
+ *
+ * @param cls closure
+ * @param key key for the item stored
+ * @param size size of the item stored
+ * @param status #GNUNET_OK or #GNUNET_SYSERROR
+ * @param msg error message on error
+ */
+static void
+put_continuation (void *cls,
+                  const struct GNUNET_HashCode *key,
+                  uint32_t size,
+                  int status,
+                  const char *msg)
+{
+  struct CpsRunContext *crc = cls;
+  static unsigned long long os;
+  unsigned long long cs;
+
+  if (GNUNET_OK != status)
+  {
+    fprintf (stderr,
+             "ERROR: `%s'\n",
+             msg);
+  }
+  else
+  {
+    crc->api->estimate_size (crc->api->cls,
+                             &cs);
+    GNUNET_assert (os <= cs);
+    os = cs;
+    stored_bytes += size;
+    stored_ops++;
+    stored_entries++;
+  }
+  GNUNET_SCHEDULER_add_now (&test, crc);
+}
+
+
+static void
+gen_key (int i, struct GNUNET_HashCode *key)
+{
+  memset (key, 0, sizeof(struct GNUNET_HashCode));
+  key->bits[0] = (unsigned int) i;
+  GNUNET_CRYPTO_hash (key, sizeof(struct GNUNET_HashCode), key);
+}
+
+
+static void
+do_put (struct CpsRunContext *crc)
+{
+  char value[65536];
+  size_t size;
+  struct GNUNET_HashCode key;
+  unsigned int prio;
+  static int i;
+
+  if (PUT_10 == i)
+  {
+    i = 0;
+    crc->phase++;
+    GNUNET_SCHEDULER_add_now (&test, crc);
+    return;
+  }
+  /* most content is 32k */
+  size = 32 * 1024;
+
+  if ((0 != i) && (GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 16) ==
+                   0) )                                                           /* but some of it is less! */
+    size = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 32 * 1024);
+  size = size - (size & 7);     /* always multiple of 8 */
+
+  /* generate random key */
+  gen_key (i, &key);
+  memset (value, i, size);
+  if (i > 255)
+    memset (value, i - 255, size / 2);
+  value[0] = crc->i;
+  prio = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 100);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "putting type %u, anon %u under key %s\n", i + 1, i,
+              GNUNET_h2s (&key));
+  crc->api->put (crc->api->cls,
+                 &key,
+                 false /* absent */,
+                 size,
+                 value, i + 1 /* type */,
+                 prio,
+                 i /* anonymity */,
+                 0 /* replication */,
+                 GNUNET_TIME_relative_to_absolute
+                   (GNUNET_TIME_relative_multiply
+                     (GNUNET_TIME_UNIT_MILLISECONDS,
+                     60 * 60 * 60 * 1000
+                     + GNUNET_CRYPTO_random_u32
+                       (GNUNET_CRYPTO_QUALITY_WEAK, 1000))),
+                 put_continuation,
+                 crc);
+  i++;
+}
+
+
+static uint64_t guid;
+
+
+static int
+iterate_one_shot (void *cls,
+                  const struct GNUNET_HashCode *key,
+                  uint32_t size,
+                  const void *data,
+                  enum GNUNET_BLOCK_Type type,
+                  uint32_t priority,
+                  uint32_t anonymity,
+                  uint32_t replication,
+                  struct GNUNET_TIME_Absolute expiration,
+                  uint64_t uid)
+{
+  struct CpsRunContext *crc = cls;
+
+  GNUNET_assert (NULL != key);
+  guid = uid;
+  crc->phase++;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found result type=%u, priority=%u, size=%u, expire=%s, key %s\n",
+              (unsigned int) type,
+              (unsigned int) priority,
+              (unsigned int) size,
+              GNUNET_STRINGS_absolute_time_to_string (expiration),
+              GNUNET_h2s (key));
+  GNUNET_SCHEDULER_add_now (&test,
+                            crc);
+  return GNUNET_OK;
+}
+
+
+static void
+remove_continuation (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     uint32_t size,
+                     int status,
+                     const char *msg)
+{
+  struct CpsRunContext *crc = cls;
+
+  GNUNET_assert (NULL != key);
+  GNUNET_assert (32768 == size);
+  GNUNET_assert (GNUNET_OK == status);
+  GNUNET_assert (NULL == msg);
+  crc->phase++;
+  GNUNET_SCHEDULER_add_now (&test,
+                            crc);
+}
+
+
+/**
+ * Function called when the service shuts
+ * down.  Unloads our datastore plugin.
+ *
+ * @param api api to unload
+ * @param cfg configuration to use
+ */
+static void
+unload_plugin (struct GNUNET_DATASTORE_PluginFunctions *api,
+               const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  char *name;
+  char *libname;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             "DATASTORE",
+                                             "DATABASE",
+                                             &name))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("No `%s' specified for `%s' in configuration!\n"),
+                "DATABASE",
+                "DATASTORE");
+    return;
+  }
+  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
+  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_free (libname);
+  GNUNET_free (name);
+}
+
+
+/**
+ * Last task run during shutdown.  Disconnects us from
+ * the transport and core.
+ */
+static void
+cleaning_task (void *cls)
+{
+  struct CpsRunContext *crc = cls;
+
+  unload_plugin (crc->api, crc->cfg);
+  GNUNET_free (crc);
+}
+
+
+static void
+test (void *cls)
+{
+  struct CpsRunContext *crc = cls;
+  struct GNUNET_HashCode key;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "In phase %d, iteration %u\n", crc->phase, crc->cnt);
+  switch (crc->phase)
+  {
+  case RP_ERROR:
+    ok = 1;
+    GNUNET_break (0);
+    crc->api->drop (crc->api->cls);
+    GNUNET_SCHEDULER_add_now (&cleaning_task, crc);
+    break;
+
+  case RP_PUT:
+    do_put (crc);
+    break;
+
+  case RP_GET:
+    if (crc->cnt == 1)
+    {
+      crc->cnt = 0;
+      crc->phase++;
+      GNUNET_SCHEDULER_add_now (&test, crc);
+      break;
+    }
+    gen_key (5, &key);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Looking for %s\n",
+                GNUNET_h2s (&key));
+    crc->api->get_key (crc->api->cls,
+                       0,
+                       false,
+                       &key,
+                       GNUNET_BLOCK_TYPE_ANY,
+                       &iterate_one_shot,
+                       crc);
+    break;
+
+  case RP_ITER_ZERO:
+    if (crc->cnt == 1)
+    {
+      crc->cnt = 0;
+      crc->phase++;
+      GNUNET_SCHEDULER_add_now (&test, crc);
+      break;
+    }
+    crc->api->get_zero_anonymity (crc->api->cls, 0, 1, &iterate_one_shot, crc);
+    break;
+
+  case RP_REPL_GET:
+    crc->api->get_replication (crc->api->cls, &iterate_one_shot, crc);
+    break;
+
+  case RP_EXPI_GET:
+    crc->api->get_expiration (crc->api->cls, &iterate_one_shot, crc);
+    break;
+
+  case RP_REMOVE:
+    {
+      struct GNUNET_HashCode key;
+      uint32_t size = 32768;
+      char value[size];
+
+      gen_key (0, &key);
+      memset (value, 0, size);
+      value[0] = crc->i;
+      crc->api->remove_key (crc->api->cls,
+                            &key,
+                            size,
+                            value,
+                            &remove_continuation,
+                            crc);
+      break;
+    }
+
+  case RP_DROP:
+    crc->api->drop (crc->api->cls);
+    GNUNET_SCHEDULER_add_now (&cleaning_task, crc);
+    break;
+  }
+}
+
+
+/**
+ * Load the datastore plugin.
+ */
+static struct GNUNET_DATASTORE_PluginFunctions *
+load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  static struct GNUNET_DATASTORE_PluginEnvironment env;
+  struct GNUNET_DATASTORE_PluginFunctions *ret;
+  char *name;
+  char *libname;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             "DATASTORE",
+                                             "DATABASE",
+                                             &name))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("No `%s' specified for `%s' in configuration!\n"),
+                "DATABASE",
+                "DATASTORE");
+    return NULL;
+  }
+  env.cfg = cfg;
+  env.duc = &disk_utilization_change_cb;
+  env.cls = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datastore plugin\n"),
+              name);
+  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
+  if (NULL == (ret = GNUNET_PLUGIN_load (libname, &env)))
+  {
+    fprintf (stderr, "Failed to load plugin `%s'!\n", name);
+    GNUNET_free (libname);
+    GNUNET_free (name);
+    ok = 77;   /* mark test as skipped */
+    return NULL;
+  }
+  GNUNET_free (libname);
+  GNUNET_free (name);
+  return ret;
+}
+
+
+static void
+run (void *cls, char *const *args, const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  struct GNUNET_DATASTORE_PluginFunctions *api;
+  struct CpsRunContext *crc;
+
+  api = load_plugin (c);
+  if (api == NULL)
+  {
+    fprintf (stderr,
+             "%s",
+             "Could not initialize plugin, assuming database not configured. Test not run!\n");
+    return;
+  }
+  crc = GNUNET_new (struct CpsRunContext);
+  crc->api = api;
+  crc->cfg = c;
+  crc->phase = RP_PUT;
+  GNUNET_SCHEDULER_add_now (&test, crc);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  char dir_name[PATH_MAX];
+  char cfg_name[PATH_MAX];
+  char *const xargv[] = {
+    "test-plugin-datastore",
+    "-c",
+    cfg_name,
+    NULL
+  };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  /* determine name of plugin to use */
+  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+  GNUNET_snprintf (dir_name, sizeof(dir_name),
+                   "/tmp/test-gnunet-datastore-plugin-%s", plugin_name);
+  GNUNET_DISK_directory_remove (dir_name);
+  GNUNET_log_setup ("test-plugin-datastore",
+                    "WARNING",
+                    NULL);
+  GNUNET_snprintf (cfg_name, sizeof(cfg_name),
+                   "test_plugin_datastore_data_%s.conf", plugin_name);
+  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1, xargv,
+                      "test-plugin-datastore", "nohelp", options, &run, NULL);
+  if ((0 != ok) && (77 != ok))
+    fprintf (stderr, "Missed some testcases: %u\n", ok);
+  GNUNET_DISK_directory_remove (dir_name);
+  return ok;
+}
+
+
+/* end of test_plugin_datastore.c */
diff --git a/src/plugin/datastore/test_plugin_datastore_data_heap.conf b/src/plugin/datastore/test_plugin_datastore_data_heap.conf
new file mode 100644
index 000000000..b1ea8ff67
--- /dev/null
+++ b/src/plugin/datastore/test_plugin_datastore_data_heap.conf
@@ -0,0 +1,6 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-heap/
+
+[datastore]
+DATABASE = heap
diff --git a/src/plugin/datastore/test_plugin_datastore_data_postgres.conf b/src/plugin/datastore/test_plugin_datastore_data_postgres.conf
new file mode 100644
index 000000000..d0e29437f
--- /dev/null
+++ b/src/plugin/datastore/test_plugin_datastore_data_postgres.conf
@@ -0,0 +1,10 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-postgres/
+
+[datastore]
+DATABASE = postgres
+
+[datastore-postgres]
+CONFIG = dbname=gnunetcheck
+
diff --git a/src/plugin/datastore/test_plugin_datastore_data_sqlite.conf b/src/plugin/datastore/test_plugin_datastore_data_sqlite.conf
new file mode 100644
index 000000000..ca837c77a
--- /dev/null
+++ b/src/plugin/datastore/test_plugin_datastore_data_sqlite.conf
@@ -0,0 +1,4 @@
+@INLINE@ test_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-sqlite/
+
diff --git a/src/plugin/dht/Makefile.am b/src/plugin/dht/Makefile.am
new file mode 100644
index 000000000..4df810066
--- /dev/null
+++ b/src/plugin/dht/Makefile.am
@@ -0,0 +1,27 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_dht.la
+
+libgnunet_plugin_block_dht_la_SOURCES = \
+  plugin_block_dht.c
+libgnunet_plugin_block_dht_la_LIBADD = \
+  $(top_builddir)/src/lib/hello/libgnunethello.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_dht_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/dht/meson.build b/src/plugin/dht/meson.build
new file mode 100644
index 000000000..81b829dac
--- /dev/null
+++ b/src/plugin/dht/meson.build
@@ -0,0 +1,9 @@
+shared_module('gnunet_plugin_block_dht',
+        ['plugin_block_dht.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunethello_dep,
+                       libgnunetblock_dep,
+                       libgnunetblockgroup_dep],
+        include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
diff --git a/src/plugin/dht/plugin_block_dht.c b/src/plugin/dht/plugin_block_dht.c
new file mode 100644
index 000000000..ede23ea57
--- /dev/null
+++ b/src/plugin/dht/plugin_block_dht.c
@@ -0,0 +1,308 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010, 2017, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file dht/plugin_block_dht.c
+ * @brief block plugin for DHT internals (right now, find-peer requests only);
+ *        other plugins should be used to store "useful" data in the
+ *        DHT (see fs block plugin)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_constants.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+#define DEBUG_DHT GNUNET_EXTRA_LOGGING
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_dht_create_group (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *raw_data,
+                               size_t raw_data_size,
+                               va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va,
+                                                                   unsigned int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = 8;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (cls,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dht_check_query (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dht_check_block (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const void *block,
+                              size_t block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      const struct GNUNET_PeerIdentity *pid;
+      struct GNUNET_HashCode h_pid;
+
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        return GNUNET_NO;
+      }
+      pid = GNUNET_HELLO_builder_iterate (b,
+                                          NULL, NULL);
+      GNUNET_CRYPTO_hash (pid,
+                          sizeof (*pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_dht_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      const struct GNUNET_PeerIdentity *pid;
+      struct GNUNET_HashCode h_pid;
+
+      b = GNUNET_HELLO_builder_from_block (reply_block,
+                                           reply_block_size);
+      GNUNET_assert (NULL != b);
+      pid = GNUNET_HELLO_builder_iterate (b,
+                                          NULL, NULL);
+      GNUNET_CRYPTO_hash (pid,
+                          sizeof (*pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &h_pid))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes @a block
+ * @param[out] key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dht_get_key (void *cls,
+                          enum GNUNET_BLOCK_Type type,
+                          const void *block,
+                          size_t block_size,
+                          struct GNUNET_HashCode *key)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      const struct GNUNET_PeerIdentity *pid;
+
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      pid = GNUNET_HELLO_builder_iterate (b,
+                                          NULL, NULL);
+      GNUNET_CRYPTO_hash (pid,
+                          sizeof (*pid),
+                          key);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_dht_init (void *cls)
+{
+  static enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_DHT_HELLO,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_dht_get_key;
+  api->check_query = &block_plugin_dht_check_query;
+  api->check_block = &block_plugin_dht_check_block;
+  api->check_reply = &block_plugin_dht_check_reply;
+  api->create_group = &block_plugin_dht_create_group;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_dht_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_dht.c */
diff --git a/src/plugin/dns/Makefile.am b/src/plugin/dns/Makefile.am
new file mode 100644
index 000000000..8b5843159
--- /dev/null
+++ b/src/plugin/dns/Makefile.am
@@ -0,0 +1,25 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_dns.la
+
+libgnunet_plugin_block_dns_la_SOURCES = \
+  plugin_block_dns.c
+libgnunet_plugin_block_dns_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunet_plugin_block_dns_la_LDFLAGS = \
+  $(GN_LIBINTL) \
+  $(top_builddir)/src/block/$(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/dns/meson.build b/src/plugin/dns/meson.build
new file mode 100644
index 000000000..974b2c38d
--- /dev/null
+++ b/src/plugin/dns/meson.build
@@ -0,0 +1,6 @@
+shared_module('gnunet_plugin_block_dns',
+        ['plugin_block_dns.c'],
+        dependencies: [libgnunetutil_dep, libgnunetblockgroup_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
diff --git a/src/plugin/dns/plugin_block_dns.c b/src/plugin/dns/plugin_block_dns.c
new file mode 100644
index 000000000..1bbd7f750
--- /dev/null
+++ b/src/plugin/dns/plugin_block_dns.c
@@ -0,0 +1,290 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file dns/plugin_block_dns.c
+ * @brief block plugin for advertising a DNS exit service
+ * @author Christian Grothoff
+ *
+ * Note that this plugin might more belong with EXIT and PT
+ * as those two are using this type of block.  Still, this
+ * might be a natural enough place for people to find the code...
+ */
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "block_dns.h"
+#include "gnunet_signatures.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_dns_create_group (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *raw_data,
+                               size_t raw_data_size,
+                               va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                   int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = 8;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (cls,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dns_check_query (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dns_check_block (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const void *block,
+                              size_t block_size)
+{
+  const struct GNUNET_DNS_Advertisement *ad;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    if (sizeof(struct GNUNET_DNS_Advertisement) != block_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    ad = block;
+
+    if (ntohl (ad->purpose.size) !=
+        sizeof(struct GNUNET_DNS_Advertisement)
+        - sizeof(struct GNUNET_CRYPTO_EddsaSignature))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    if (GNUNET_TIME_absolute_is_past (
+          GNUNET_TIME_absolute_ntoh (ad->expiration_time)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "DNS advertisement has expired\n");
+      return GNUNET_NO;
+    }
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_DNS_RECORD,
+                                     &ad->purpose,
+                                     &ad->signature,
+                                     &ad->peer.public_key))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_dns_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  struct GNUNET_HashCode phash;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    GNUNET_CRYPTO_hash (reply_block,
+                        reply_block_size,
+                        &phash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                            &phash))
+      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  default:
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in @a block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dns_get_key (void *cls,
+                          enum GNUNET_BLOCK_Type type,
+                          const void *block,
+                          size_t block_size,
+                          struct GNUNET_HashCode *key)
+{
+  if (GNUNET_BLOCK_TYPE_DNS != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_dns_init (void *cls)
+{
+  static enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_DNS,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_dns_get_key;
+  api->check_query = &block_plugin_dns_check_query;
+  api->check_block = &block_plugin_dns_check_block;
+  api->check_reply = &block_plugin_dns_check_reply;
+  api->create_group = &block_plugin_dns_create_group;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_dns_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_dns.c */
diff --git a/src/plugin/fs/Makefile.am b/src/plugin/fs/Makefile.am
new file mode 100644
index 000000000..7c0e55cba
--- /dev/null
+++ b/src/plugin/fs/Makefile.am
@@ -0,0 +1,35 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_fs.la
+
+libgnunet_plugin_block_fs_la_SOURCES = \
+  plugin_block_fs.c
+libgnunet_plugin_block_fs_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_fs_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+check_PROGRAMS = \
+ test_plugin_block_fs
+
+test_plugin_block_fs_SOURCES = \
+ test_plugin_block_fs.c
+test_plugin_block_fs_LDADD = \
+ $(top_builddir)/src/lib/block/libgnunetblock.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
diff --git a/src/plugin/fs/meson.build b/src/plugin/fs/meson.build
new file mode 100644
index 000000000..7978070f9
--- /dev/null
+++ b/src/plugin/fs/meson.build
@@ -0,0 +1,8 @@
+shared_module('gnunet_plugin_block_fs',
+              ['plugin_block_fs.c'],
+              dependencies: [libgnunetutil_dep,
+                             libgnunetblockgroup_dep],
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/fs/plugin_block_fs.c b/src/plugin/fs/plugin_block_fs.c
new file mode 100644
index 000000000..bbd0ff57b
--- /dev/null
+++ b/src/plugin/fs/plugin_block_fs.c
@@ -0,0 +1,337 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010, 2013, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file fs/plugin_block_fs.c
+ * @brief blocks used for file-sharing
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+
+#include "gnunet_fs_service.h"
+#include "block_fs.h"
+#include "gnunet_signatures.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_fs_create_group (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const void *raw_data,
+                              size_t raw_data_size,
+                              va_list va)
+{
+  unsigned int size;
+  const char *guard;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+    GNUNET_break (NULL == va_arg (va, const char *));
+    return NULL;
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    GNUNET_break (NULL == va_arg (va, const char *));
+    return NULL;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    guard = va_arg (va, const char *);
+    if (0 == strcmp (guard,
+                     "seen-set-size"))
+    {
+      size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                  int),
+                                                          BLOOMFILTER_K);
+    }
+    else if (0 == strcmp (guard,
+                          "filter-size"))
+    {
+      size = va_arg (va, unsigned int);
+    }
+    else
+    {
+      /* va-args invalid! bad bug, complain! */
+      GNUNET_break (0);
+      size = 8;
+    }
+    if (0 == size)
+      size = raw_data_size;   /* not for us to determine, use what we got! */
+    GNUNET_break (NULL == va_arg (va, const char *));
+    return GNUNET_BLOCK_GROUP_bf_create (cls,
+                                         size,
+                                         BLOOMFILTER_K,
+                                         type,
+                                         raw_data,
+                                         raw_data_size);
+
+  default:
+    GNUNET_break (NULL == va_arg (va, const char *));
+    GNUNET_break (0);
+    return NULL;
+  }
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in @a block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_fs_get_key (void *cls,
+                         enum GNUNET_BLOCK_Type type,
+                         const void *block,
+                         size_t block_size,
+                         struct GNUNET_HashCode *key)
+{
+  const struct UBlock *ub;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    GNUNET_CRYPTO_hash (block,
+                        block_size,
+                        key);
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    if (block_size < sizeof(struct UBlock))
+    {
+      GNUNET_break_op (0);
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
+    }
+    ub = block;
+    GNUNET_CRYPTO_hash (&ub->verification_key,
+                        sizeof(ub->verification_key),
+                        key);
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_fs_check_query (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             const struct GNUNET_HashCode *query,
+                             const void *xquery,
+                             size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_fs_check_block (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             const void *block,
+                             size_t block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    {
+      const struct UBlock *ub;
+
+      if (block_size < sizeof(struct UBlock))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      ub = block;
+      if (block_size !=
+          ntohl (ub->purpose.size)
+          + sizeof (struct GNUNET_CRYPTO_EcdsaSignature))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      if (GNUNET_OK !=
+          GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK,
+                                       &ub->purpose,
+                                       &ub->signature,
+                                       &ub->verification_key))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_fs_check_reply (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             struct GNUNET_BLOCK_Group *group,
+                             const struct GNUNET_HashCode *query,
+                             const void *xquery,
+                             size_t xquery_size,
+                             const void *reply_block,
+                             size_t reply_block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    return GNUNET_BLOCK_REPLY_OK_LAST;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    {
+      struct GNUNET_HashCode chash;
+
+      GNUNET_CRYPTO_hash (reply_block,
+                          reply_block_size,
+                          &chash);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &chash))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_fs_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_FS_DBLOCK,
+    GNUNET_BLOCK_TYPE_FS_IBLOCK,
+    GNUNET_BLOCK_TYPE_FS_UBLOCK,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_fs_get_key;
+  api->create_group = &block_plugin_fs_create_group;
+  api->check_query = &block_plugin_fs_check_query;
+  api->check_block = &block_plugin_fs_check_block;
+  api->check_reply = &block_plugin_fs_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_fs_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_fs.c */
diff --git a/src/plugin/fs/test_plugin_block_fs.c b/src/plugin/fs/test_plugin_block_fs.c
new file mode 100644
index 000000000..f15d10b17
--- /dev/null
+++ b/src/plugin/fs/test_plugin_block_fs.c
@@ -0,0 +1,86 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010, 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file fs/test_plugin_block_fs.c
+ * @brief test for plugin_block_fs.c
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_block_lib.h"
+
+
+static int
+test_fs (struct GNUNET_BLOCK_Context *ctx)
+{
+  struct GNUNET_HashCode key;
+  char block[4];
+
+  memset (block, 1, sizeof(block));
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_get_key (ctx,
+                            GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                            block,
+                            sizeof(block),
+                            &key))
+    return 1;
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                block,
+                                sizeof(block)))
+    return 2;
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_query (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                &key,
+                                NULL, 0))
+    return 4;
+  GNUNET_log_skip (1, GNUNET_NO);
+  if (GNUNET_NO !=
+      GNUNET_BLOCK_check_query (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                &key,
+                                "bogus", 5))
+    return 8;
+  GNUNET_log_skip (0, GNUNET_YES);
+  return 0;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret;
+  struct GNUNET_BLOCK_Context *ctx;
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  GNUNET_log_setup ("test-block", "WARNING", NULL);
+  cfg = GNUNET_CONFIGURATION_create ();
+  ctx = GNUNET_BLOCK_context_create (cfg);
+  ret = test_fs (ctx);
+  GNUNET_BLOCK_context_destroy (ctx);
+  GNUNET_CONFIGURATION_destroy (cfg);
+  if (ret != 0)
+    fprintf (stderr, "Tests failed: %d\n", ret);
+  return ret;
+}
+
+
+/* end of test_plugin_block_fs.c */
diff --git a/src/plugin/gns/Makefile.am b/src/plugin/gns/Makefile.am
new file mode 100644
index 000000000..8dc9ef2b2
--- /dev/null
+++ b/src/plugin/gns/Makefile.am
@@ -0,0 +1,59 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if HAVE_LIBIDN
+  LIBIDN= -lidn
+else
+  LIBIDN=
+endif
+
+if HAVE_LIBIDN2
+  LIBIDN2= -lidn2
+else
+  LIBIDN2=
+endif
+
+USE_VPN = $(top_builddir)/src/service/vpn/libgnunetvpn.la
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+endif
+
+pkgcfgdir = $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_gns.la \
+  libgnunet_plugin_gnsrecord_gns.la
+
+
+libgnunet_plugin_gnsrecord_gns_la_SOURCES = \
+  plugin_gnsrecord_gns.c
+libgnunet_plugin_gnsrecord_gns_la_LIBADD = \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_gnsrecord_gns_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+libgnunet_plugin_block_gns_la_SOURCES = \
+  plugin_block_gns.c
+libgnunet_plugin_block_gns_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la
+libgnunet_plugin_block_gns_la_LDFLAGS = \
+  $(GN_LIBINTL) \
+  $(GN_PLUGIN_LDFLAGS)
+
+if ENABLE_TEST_RUN
+if HAVE_SQLITE
+ AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+ TESTS = $(check_SCRIPTS)
+endif
+endif
diff --git a/src/plugin/gns/meson.build b/src/plugin/gns/meson.build
new file mode 100644
index 000000000..2cdf770f8
--- /dev/null
+++ b/src/plugin/gns/meson.build
@@ -0,0 +1,17 @@
+shared_module('gnunet_plugin_gnsrecord_gns',
+        ['plugin_gnsrecord_gns.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetgnsrecord_dep,
+                      ],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+shared_module('gnunet_plugin_block_gns',
+              ['plugin_block_gns.c'],
+              dependencies: [libgnunetutil_dep,
+                             libgnunetgnsrecord_dep,
+                             libgnunetblockgroup_dep],
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/gns/plugin_block_gns.c b/src/plugin/gns/plugin_block_gns.c
new file mode 100644
index 000000000..75e182092
--- /dev/null
+++ b/src/plugin/gns/plugin_block_gns.c
@@ -0,0 +1,289 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010-2013, 2021, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gns/plugin_block_gns.c
+ * @brief blocks used for GNS records
+ * @author Martin Schanzenbach
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_block_group_lib.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_namestore_service.h"
+#include "gnunet_signatures.h"
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change! -from fs
+ */
+#define BLOOMFILTER_K 16
+
+/**
+ * How big is the BF we use for GNS blocks?
+ */
+#define GNS_BF_SIZE 8
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_gns_create_group (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *raw_data,
+                               size_t raw_data_size,
+                               va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                   int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = GNS_BF_SIZE;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (cls,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param reply_block block to get the key for
+ * @param reply_block_size number of bytes in @a reply_block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_gns_get_key (void *cls,
+                          enum GNUNET_BLOCK_Type type,
+                          const void *reply_block,
+                          size_t reply_block_size,
+                          struct GNUNET_HashCode *key)
+{
+  const struct GNUNET_GNSRECORD_Block *block;
+
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  {
+    GNUNET_break_op (0);
+    memset (key,
+            0,
+            sizeof (*key));
+    return GNUNET_OK;
+  }
+  block = reply_block;
+  GNUNET_GNSRECORD_query_from_block (block,
+                                     key);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_gns_check_query (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size)
+{
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_gns_check_block (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const void *block,
+                              size_t block_size)
+{
+  const struct GNUNET_GNSRECORD_Block *gblock;
+
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  gblock = block;
+  if (GNUNET_GNSRECORD_block_get_size (gblock) > block_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (GNUNET_OK !=
+      GNUNET_GNSRECORD_block_verify (gblock))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_gns_check_reply (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              struct GNUNET_BLOCK_Group *group,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size,
+                              const void *reply_block,
+                              size_t reply_block_size)
+{
+  const struct GNUNET_GNSRECORD_Block *block = reply_block;
+  struct GNUNET_HashCode chash;
+
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_GNSRECORD_Block));
+  GNUNET_assert (reply_block_size >= GNUNET_GNSRECORD_block_get_size (block));
+  GNUNET_CRYPTO_hash (reply_block,
+                      reply_block_size,
+                      &chash);
+  if (GNUNET_YES ==
+      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                          &chash))
+    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_gns_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_gns_get_key;
+  api->create_group = &block_plugin_gns_create_group;
+  api->check_query = &block_plugin_gns_check_query;
+  api->check_block = &block_plugin_gns_check_block;
+  api->check_reply = &block_plugin_gns_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_gns_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_gns.c */
diff --git a/src/plugin/gns/plugin_gnsrecord_gns.c b/src/plugin/gns/plugin_gnsrecord_gns.c
new file mode 100644
index 000000000..36e0c9fde
--- /dev/null
+++ b/src/plugin/gns/plugin_gnsrecord_gns.c
@@ -0,0 +1,515 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gns/plugin_gnsrecord_gns.c
+ * @brief gnsrecord plugin to provide the API for fundamental GNS records
+ *                  This includes the VPN record because GNS resolution
+ *                  is expected to understand VPN records and (if needed)
+ *                  map the result to A/AAAA.
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_gnsrecord_plugin.h"
+#include <inttypes.h>
+
+
+/**
+ * Convert the 'value' of a record to a string.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+static char *
+gns_value_to_string (void *cls,
+                     uint32_t type,
+                     const void *data,
+                     size_t data_size)
+{
+  const char *cdata;
+  struct GNUNET_CRYPTO_PublicKey pk;
+
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_identity_from_data (data,
+                                             data_size,
+                                             type,
+                                             &pk))
+      return NULL;
+    return GNUNET_CRYPTO_public_key_to_string (&pk);
+
+  case GNUNET_GNSRECORD_TYPE_NICK:
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
+  case GNUNET_GNSRECORD_TYPE_LEHO:
+    return GNUNET_strndup (data, data_size);
+
+  case GNUNET_GNSRECORD_TYPE_GNS2DNS: {
+      char *ns;
+      char *ip;
+      size_t off;
+      char *nstr;
+
+      off = 0;
+      ns = GNUNET_DNSPARSER_parse_name (data, data_size, &off);
+      if (NULL == ns)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (ns);
+        return NULL;
+      }
+      /* DNS server IP/name must be UTF-8 */
+      ip = GNUNET_strdup (&((const char*) data)[off]);
+      GNUNET_asprintf (&nstr, "%s@%s", ns, ip);
+      GNUNET_free (ns);
+      GNUNET_free (ip);
+      return nstr;
+    }
+
+  case GNUNET_GNSRECORD_TYPE_VPN: {
+      struct GNUNET_TUN_GnsVpnRecord vpn;
+      char *vpn_str;
+
+      cdata = data;
+      if ((data_size <= sizeof(vpn)) || ('\0' != cdata[data_size - 1]))
+        return NULL; /* malformed */
+      /* need to memcpy for alignment */
+      GNUNET_memcpy (&vpn, data, sizeof(vpn));
+      GNUNET_asprintf (&vpn_str,
+                       "%u %s %s",
+                       (unsigned int) ntohs (vpn.proto),
+                       (const char *) GNUNET_i2s_full (&vpn.peer),
+                       (const char *) &cdata[sizeof(vpn)]);
+      return vpn_str;
+    }
+
+  case GNUNET_GNSRECORD_TYPE_BOX: {
+      struct GNUNET_GNSRECORD_BoxRecord box;
+      uint32_t rt;
+      char *box_str;
+      char *ival;
+
+      cdata = data;
+      if (data_size < sizeof(struct GNUNET_GNSRECORD_BoxRecord))
+        return NULL; /* malformed */
+      GNUNET_memcpy (&box, data, sizeof(box));
+      rt = ntohl (box.record_type);
+      ival = GNUNET_GNSRECORD_value_to_string (rt,
+                                               &cdata[sizeof(box)],
+                                               data_size - sizeof(box));
+      if (NULL == ival)
+        return NULL; /* malformed */
+      GNUNET_asprintf (&box_str,
+                       "%u %u %u %s",
+                       (unsigned int) ntohs (box.protocol),
+                       (unsigned int) ntohs (box.service),
+                       (unsigned int) rt,
+                       ival);
+      GNUNET_free (ival);
+      return box_str;
+    }
+  case GNUNET_GNSRECORD_TYPE_SBOX: {
+      struct GNUNET_GNSRECORD_SBoxRecord box;
+      uint32_t rt;
+      char *box_str;
+      char *ival;
+      char *prefix;
+
+      cdata = data;
+      if (data_size < sizeof(struct GNUNET_GNSRECORD_SBoxRecord))
+        return NULL; /* malformed */
+      GNUNET_memcpy (&box, data, sizeof(box));
+      rt = ntohl (box.record_type);
+
+      prefix = GNUNET_strdup (&cdata[sizeof(box)]);
+      ival = GNUNET_GNSRECORD_value_to_string (rt, &cdata[sizeof(box)
+                                                          + strlen (prefix)
+                                                          + 1],
+                                               data_size - sizeof(box)
+                                               - strlen (prefix) - 1);
+      if (NULL == ival)
+        return NULL; /* malformed */
+      GNUNET_asprintf (&box_str,
+                       "%s %u %s",
+                       prefix,
+                       (unsigned int) rt,
+                       ival);
+      GNUNET_free (prefix);
+      GNUNET_free (ival);
+      return box_str;
+    }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+      return GNUNET_strdup (_ (
+                              "This is a memento of an older block for internal maintenance."));
+    }
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of a record to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+gns_string_to_value (void *cls,
+                     uint32_t type,
+                     const char *s,
+                     void **data,
+                     size_t *data_size)
+{
+  struct GNUNET_CRYPTO_PublicKey pk;
+  uint32_t record_type;
+
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_public_key_from_string (s, &pk))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Unable to parse zone key record `%s'\n"),
+                  s);
+      return GNUNET_SYSERR;
+    }
+    *data_size = GNUNET_CRYPTO_public_key_get_length (&pk);
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_data_from_identity (&pk,
+                                             (char **) data,
+                                             data_size,
+                                             &record_type))
+      return GNUNET_SYSERR;
+    if (record_type != type)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Record type does not match parsed record type\n"));
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+
+  case GNUNET_GNSRECORD_TYPE_NICK:
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
+  case GNUNET_GNSRECORD_TYPE_LEHO:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s);
+    return GNUNET_OK;
+
+  case GNUNET_GNSRECORD_TYPE_GNS2DNS: {
+      char nsbuf[514];
+      char *cpy;
+      char *at;
+      size_t off;
+
+      cpy = GNUNET_strdup (s);
+      at = strchr (cpy, '@');
+      if (NULL == at)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse GNS2DNS record `%s'\n"),
+                    s);
+        GNUNET_free (cpy);
+        return GNUNET_SYSERR;
+      }
+      *at = '\0';
+      at++;
+
+      off = 0;
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_name (nsbuf,
+                                             sizeof(nsbuf),
+                                             &off,
+                                             cpy))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ (
+                      "Failed to serialize GNS2DNS record with value `%s': Not a DNS name.\n"),
+                    s);
+        GNUNET_free (cpy);
+        return GNUNET_SYSERR;
+      }
+      /* The DNS server location/name is in UTF-8 */
+      GNUNET_memcpy (&nsbuf[off], at, strlen (at) + 1);
+      off += strlen (at) + 1;
+      GNUNET_free (cpy);
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, nsbuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_GNSRECORD_TYPE_VPN: {
+      struct GNUNET_TUN_GnsVpnRecord *vpn;
+      char s_peer[103 + 1];
+      char s_serv[253 + 1];
+      unsigned int proto;
+
+      if (3 != sscanf (s, "%u %103s %253s", &proto, s_peer, s_serv))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse VPN record string `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      *data_size = sizeof(struct GNUNET_TUN_GnsVpnRecord) + strlen (s_serv) + 1;
+      *data = vpn = GNUNET_malloc (*data_size);
+      if (GNUNET_OK !=
+          GNUNET_CRYPTO_eddsa_public_key_from_string ((char *) s_peer,
+                                                      strlen (s_peer),
+                                                      &vpn->peer.public_key))
+      {
+        GNUNET_free (vpn);
+        *data_size = 0;
+        return GNUNET_SYSERR;
+      }
+      vpn->proto = htons ((uint16_t) proto);
+      strcpy ((char *) &vpn[1], s_serv);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_GNSRECORD_TYPE_BOX: {
+      struct GNUNET_GNSRECORD_BoxRecord *box;
+      size_t rest;
+      unsigned int protocol;
+      unsigned int service;
+      unsigned int record_type;
+      void *bval;
+      size_t bval_size;
+
+      if (3 != sscanf (s, "%u %u %u ", &protocol, &service, &record_type))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse BOX record string `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      rest = snprintf (NULL, 0, "%u %u %u ", protocol, service, record_type);
+      if (GNUNET_OK != GNUNET_GNSRECORD_string_to_value (record_type,
+                                                         &s[rest],
+                                                         &bval,
+                                                         &bval_size))
+        return GNUNET_SYSERR;
+      *data_size = sizeof(struct GNUNET_GNSRECORD_BoxRecord) + bval_size;
+      *data = box = GNUNET_malloc (*data_size);
+      box->protocol = htons (protocol);
+      box->service = htons (service);
+      box->record_type = htonl (record_type);
+      GNUNET_memcpy (&box[1], bval, bval_size);
+      GNUNET_free (bval);
+      return GNUNET_OK;
+    }
+  case GNUNET_GNSRECORD_TYPE_SBOX: {
+      struct GNUNET_GNSRECORD_SBoxRecord *box;
+      size_t rest;
+      char *prefix;
+      char *underscore_prefix;
+      unsigned int record_type;
+      void *bval;
+      size_t bval_size;
+      prefix = GNUNET_malloc (strlen (s));
+      size_t prefix_size;
+      if (2 != sscanf (s, "%s %u ", prefix, &record_type))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse SBOX record string `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      underscore_prefix = strrchr (prefix, '.');
+      if (underscore_prefix == NULL)
+      {
+        underscore_prefix = prefix;
+      }
+      else
+      {
+        underscore_prefix++;
+      }
+      if ('_' != underscore_prefix[0])
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ (
+                      "Unable to parse SBOX record string `%s', the rightmost label `%s' does not start with an underscore\n"),
+                    prefix, underscore_prefix);
+        return GNUNET_SYSERR;
+      }
+      rest = snprintf (NULL, 0, "%s %u ", prefix, record_type);
+      if (GNUNET_OK != GNUNET_GNSRECORD_string_to_value (record_type,
+                                                         &s[rest],
+                                                         &bval,
+                                                         &bval_size))
+        return GNUNET_SYSERR;
+      prefix_size = strlen (prefix) + 1;
+      *data_size = sizeof(struct GNUNET_GNSRECORD_SBoxRecord) + prefix_size
+                   + bval_size;
+      void *p = *data = box = GNUNET_malloc (*data_size);
+      box->record_type = htonl (record_type);
+      p += sizeof(struct GNUNET_GNSRECORD_SBoxRecord);
+      GNUNET_memcpy (p, prefix, prefix_size);
+      p += prefix_size;
+      GNUNET_memcpy (p, bval, bval_size);
+      GNUNET_free (bval);
+      GNUNET_free (prefix);
+      return GNUNET_OK;
+    }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+      *data_size = 0;
+      *data = NULL;
+      return GNUNET_OK;
+    }
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of record type numbers to human-readable
+ * record type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} gns_name_map[] = {
+  { "PKEY", GNUNET_GNSRECORD_TYPE_PKEY },
+  { "EDKEY", GNUNET_GNSRECORD_TYPE_EDKEY },
+  { "NICK", GNUNET_GNSRECORD_TYPE_NICK },
+  { "LEHO", GNUNET_GNSRECORD_TYPE_LEHO },
+  { "VPN", GNUNET_GNSRECORD_TYPE_VPN },
+  { "GNS2DNS", GNUNET_GNSRECORD_TYPE_GNS2DNS },
+  { "BOX", GNUNET_GNSRECORD_TYPE_BOX },
+  { "SBOX", GNUNET_GNSRECORD_TYPE_SBOX },
+  { "REDIRECT", GNUNET_GNSRECORD_TYPE_REDIRECT },
+  /* Tombstones should never be added manually
+                    * so this makes sense, kind of */
+  { "\u271E", GNUNET_GNSRECORD_TYPE_TOMBSTONE },
+  { NULL, UINT32_MAX }
+};
+
+
+/**
+ * Convert a type name (e.g. "AAAA") to the corresponding number.
+ *
+ * @param cls closure, unused
+ * @param gns_typename name to convert
+ * @return corresponding number, UINT32_MAX on error
+ */
+static uint32_t
+gns_typename_to_number (void *cls,
+                        const char *gns_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != gns_name_map[i].name) &&
+         (0 != strcasecmp (gns_typename, gns_name_map[i].name)))
+    i++;
+  return gns_name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+gns_number_to_typename (void *cls,
+                        uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ( (NULL != gns_name_map[i].name) &&
+          (type != gns_name_map[i].number) )
+    i++;
+  return gns_name_map[i].name;
+}
+
+
+static enum GNUNET_GenericReturnValue
+gns_is_critical (void *cls, uint32_t type)
+{
+  return ((type == GNUNET_GNSRECORD_TYPE_PKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_EDKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_GNS2DNS) ||
+          (type == GNUNET_GNSRECORD_TYPE_REDIRECT) ?
+          GNUNET_YES : GNUNET_NO);
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_gnsrecord_gns_init (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_GNSRECORD_PluginFunctions);
+  api->value_to_string = &gns_value_to_string;
+  api->string_to_value = &gns_string_to_value;
+  api->typename_to_number = &gns_typename_to_number;
+  api->number_to_typename = &gns_number_to_typename;
+  api->is_critical = &gns_is_critical;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init()
+ * @return NULL
+ */
+void *
+libgnunet_plugin_gnsrecord_gns_done (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_gnsrecord_gns.c */
diff --git a/src/plugin/gnsrecord/Makefile.am b/src/plugin/gnsrecord/Makefile.am
new file mode 100644
index 000000000..1b008cf62
--- /dev/null
+++ b/src/plugin/gnsrecord/Makefile.am
@@ -0,0 +1,25 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include ${MHD_CFLAGS}
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_gnsrecord_dns.la
+
+
+libgnunet_plugin_gnsrecord_dns_la_SOURCES = \
+  plugin_gnsrecord_dns.c
+libgnunet_plugin_gnsrecord_dns_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_gnsrecord_dns_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/gnsrecord/meson.build b/src/plugin/gnsrecord/meson.build
new file mode 100644
index 000000000..0778fb233
--- /dev/null
+++ b/src/plugin/gnsrecord/meson.build
@@ -0,0 +1,6 @@
+shared_module('gnunet_plugin_gnsrecord_dns',
+              ['plugin_gnsrecord_dns.c'],
+              dependencies: [libgnunetutil_dep, libgnunetgnsrecord_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir')/'gnunet')
diff --git a/src/plugin/gnsrecord/plugin_gnsrecord_dns.c b/src/plugin/gnsrecord/plugin_gnsrecord_dns.c
new file mode 100644
index 000000000..94b2686a1
--- /dev/null
+++ b/src/plugin/gnsrecord/plugin_gnsrecord_dns.c
@@ -0,0 +1,893 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file gnsrecord/plugin_gnsrecord_dns.c
+ * @brief gnsrecord plugin to provide the API for basic DNS records
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_plugin.h"
+
+
+/**
+ * Convert the 'value' of a record to a string.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+static char *
+dns_value_to_string (void *cls,
+                     uint32_t type,
+                     const void *data,
+                     size_t data_size)
+{
+  char *result;
+  char tmp[INET6_ADDRSTRLEN];
+
+  switch (type)
+  {
+  case GNUNET_DNSPARSER_TYPE_A:
+    if (data_size != sizeof(struct in_addr))
+      return NULL;
+    if (NULL == inet_ntop (AF_INET, data, tmp, sizeof(tmp)))
+      return NULL;
+    return GNUNET_strdup (tmp);
+
+  case GNUNET_DNSPARSER_TYPE_NS: {
+      char *ns;
+      size_t off;
+
+      off = 0;
+      ns = GNUNET_DNSPARSER_parse_name (data, data_size, &off);
+      if ((NULL == ns) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (ns);
+        return NULL;
+      }
+      return ns;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CNAME: {
+      char *cname;
+      size_t off;
+
+      off = 0;
+      cname = GNUNET_DNSPARSER_parse_name (data, data_size, &off);
+      if ((NULL == cname) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (cname);
+        return NULL;
+      }
+      return cname;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SOA: {
+      struct GNUNET_DNSPARSER_SoaRecord *soa;
+      size_t off;
+
+      off = 0;
+      soa = GNUNET_DNSPARSER_parse_soa (data, data_size, &off);
+      if ((NULL == soa) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        if (NULL != soa)
+          GNUNET_DNSPARSER_free_soa (soa);
+        return NULL;
+      }
+      GNUNET_asprintf (&result,
+                       "%s %s ( %u %u %u %u %u )",
+                       soa->rname,
+                       soa->mname,
+                       soa->serial,
+                       soa->refresh,
+                       soa->retry,
+                       soa->expire,
+                       soa->minimum_ttl);
+      GNUNET_DNSPARSER_free_soa (soa);
+      return result;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_PTR: {
+      char *ptr;
+      size_t off;
+
+      off = 0;
+      ptr = GNUNET_DNSPARSER_parse_name (data, data_size, &off);
+      if ((NULL == ptr) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (ptr);
+        return NULL;
+      }
+      return ptr;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CERT: {
+      struct GNUNET_DNSPARSER_CertRecord *cert;
+      size_t off;
+      char *base64;
+      int len;
+
+      off = 0;
+      cert = GNUNET_DNSPARSER_parse_cert (data, data_size, &off);
+      if ((NULL == cert) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        GNUNET_DNSPARSER_free_cert (cert);
+        return NULL;
+      }
+      len = GNUNET_STRINGS_base64_encode (cert->certificate_data,
+                                          cert->certificate_size,
+                                          &base64);
+      GNUNET_asprintf (&result,
+                       "%u %u %u %.*s",
+                       cert->cert_type,
+                       cert->cert_tag,
+                       cert->algorithm,
+                       len,
+                       base64);
+      GNUNET_free (base64);
+      GNUNET_DNSPARSER_free_cert (cert);
+      return result;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_MX: {
+      struct GNUNET_DNSPARSER_MxRecord *mx;
+      size_t off;
+
+      off = 0;
+      mx = GNUNET_DNSPARSER_parse_mx (data, data_size, &off);
+      if ((NULL == mx) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        GNUNET_DNSPARSER_free_mx (mx);
+        return NULL;
+      }
+      GNUNET_asprintf (&result,
+                       "%u %s",
+                       (unsigned int) mx->preference,
+                       mx->mxhost);
+      GNUNET_DNSPARSER_free_mx (mx);
+      return result;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_TXT:
+    return GNUNET_strndup (data, data_size);
+
+  case GNUNET_DNSPARSER_TYPE_AAAA:
+    if (data_size != sizeof(struct in6_addr))
+      return NULL;
+    if (NULL == inet_ntop (AF_INET6, data, tmp, sizeof(tmp)))
+      return NULL;
+    return GNUNET_strdup (tmp);
+
+  case GNUNET_DNSPARSER_TYPE_SRV: {
+      struct GNUNET_DNSPARSER_SrvRecord *srv;
+      size_t off;
+
+      off = 0;
+      srv = GNUNET_DNSPARSER_parse_srv (data, data_size, &off);
+      if ((NULL == srv) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        if (NULL != srv)
+          GNUNET_DNSPARSER_free_srv (srv);
+        return NULL;
+      }
+      GNUNET_asprintf (&result,
+                       "%d %d %d %s",
+                       srv->priority,
+                       srv->weight,
+                       srv->port,
+                       srv->target);
+      GNUNET_DNSPARSER_free_srv (srv);
+      return result;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_URI: {   // RFC7553
+      struct GNUNET_DNSPARSER_UriRecord *uri;
+      size_t off;
+
+      off = 0;
+      uri = GNUNET_DNSPARSER_parse_uri (data, data_size, &off);
+      if ((NULL == uri) || (off != data_size))
+      {
+        GNUNET_break_op (0);
+        if (NULL != uri)
+          GNUNET_DNSPARSER_free_uri (uri);
+        return NULL;
+      }
+      GNUNET_asprintf (&result,
+                       "%d %d \"%s\"",
+                       uri->priority,
+                       uri->weight,
+                       uri->target);
+      GNUNET_DNSPARSER_free_uri (uri);
+      return result;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SMIMEA:
+  case GNUNET_DNSPARSER_TYPE_TLSA: {
+      const struct GNUNET_TUN_DnsTlsaRecord *tlsa;
+      char *tlsa_str;
+      char *hex;
+
+      if (data_size < sizeof(struct GNUNET_TUN_DnsTlsaRecord))
+        return NULL; /* malformed */
+      tlsa = data;
+      hex =
+        GNUNET_DNSPARSER_bin_to_hex (&tlsa[1],
+                                     data_size
+                                     - sizeof(struct GNUNET_TUN_DnsTlsaRecord));
+      if (0 == GNUNET_asprintf (&tlsa_str,
+                                "%u %u %u %s",
+                                (unsigned int) tlsa->usage,
+                                (unsigned int) tlsa->selector,
+                                (unsigned int) tlsa->matching_type,
+                                hex))
+      {
+        GNUNET_free (hex);
+        GNUNET_free (tlsa_str);
+        return NULL;
+      }
+      GNUNET_free (hex);
+      return tlsa_str;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CAA: {   // RFC6844
+      const struct GNUNET_DNSPARSER_CaaRecord *caa;
+      char tag[15]; // between 1 and 15 bytes
+      char value[data_size];
+      char *caa_str;
+      if (data_size < sizeof(struct GNUNET_DNSPARSER_CaaRecord))
+        return NULL; /* malformed */
+      caa = data;
+      if ((1 > caa->tag_len) || (15 < caa->tag_len))
+        return NULL; /* malformed */
+      memset (tag, 0, sizeof(tag));
+      memset (value, 0, data_size);
+      memcpy (tag, &caa[1], caa->tag_len);
+      memcpy (value,
+              (char *) &caa[1] + caa->tag_len,
+              data_size - caa->tag_len - 2);
+      if (0 == GNUNET_asprintf (&caa_str,
+                                "%u %s %s",
+                                (unsigned int) caa->flags,
+                                tag,
+                                value))
+      {
+        GNUNET_free (caa_str);
+        return NULL;
+      }
+      return caa_str;
+    }
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert RFC 4394 Mnemonics to the corresponding integer values.
+ *
+ * @param mnemonic string to look up
+ * @return the value, 0 if not found
+ */
+static unsigned int
+rfc4398_mnemonic_to_value (const char *mnemonic)
+{
+  static struct
+  {
+    const char *mnemonic;
+    unsigned int val;
+  } table[] = { { "PKIX", 1 },
+                { "SPKI", 2 },
+                { "PGP", 3 },
+                { "IPKIX", 4 },
+                { "ISPKI", 5 },
+                { "IPGP", 6 },
+                { "ACPKIX", 7 },
+                { "IACPKIX", 8 },
+                { "URI", 253 },
+                { "OID", 254 },
+                { NULL, 0 } };
+  unsigned int i;
+
+  for (i = 0; NULL != table[i].mnemonic; i++)
+    if (0 == strcasecmp (mnemonic, table[i].mnemonic))
+      return table[i].val;
+  return 0;
+}
+
+
+/**
+ * Convert RFC 4034 algorithm types to the corresponding integer values.
+ *
+ * @param mnemonic string to look up
+ * @return the value, 0 if not found
+ */
+static unsigned int
+rfc4034_mnemonic_to_value (const char *mnemonic)
+{
+  static struct
+  {
+    const char *mnemonic;
+    unsigned int val;
+  } table[] = { { "RSAMD5", 1 },
+                { "DH", 2 },
+                { "DSA", 3 },
+                { "ECC", 4 },
+                { "RSASHA1", 5 },
+                { "INDIRECT", 252 },
+                { "PRIVATEDNS", 253 },
+                { "PRIVATEOID", 254 },
+                { NULL, 0 } };
+  unsigned int i;
+
+  for (i = 0; NULL != table[i].mnemonic; i++)
+    if (0 == strcasecmp (mnemonic, table[i].mnemonic))
+      return table[i].val;
+  return 0;
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of a record to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+dns_string_to_value (void *cls,
+                     uint32_t type,
+                     const char *s,
+                     void **data,
+                     size_t *data_size)
+{
+  struct in_addr value_a;
+  struct in6_addr value_aaaa;
+  struct GNUNET_TUN_DnsTlsaRecord *tlsa;
+
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_DNSPARSER_TYPE_A:
+    if (1 != inet_pton (AF_INET, s, &value_a))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Unable to parse IPv4 address `%s'\n"),
+                  s);
+      return GNUNET_SYSERR;
+    }
+    *data = GNUNET_new (struct in_addr);
+    GNUNET_memcpy (*data, &value_a, sizeof(value_a));
+    *data_size = sizeof(value_a);
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_NS: {
+      char nsbuf[256];
+      size_t off;
+
+      off = 0;
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_name (nsbuf, sizeof(nsbuf), &off, s))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize NS record with value `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, nsbuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CNAME: {
+      char cnamebuf[256];
+      size_t off;
+
+      off = 0;
+      if (GNUNET_OK != GNUNET_DNSPARSER_builder_add_name (cnamebuf,
+                                                          sizeof(cnamebuf),
+                                                          &off,
+                                                          s))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize CNAME record with value `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, cnamebuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CERT: {
+      char *sdup;
+      const char *typep;
+      const char *keyp;
+      const char *algp;
+      const char *certp;
+      unsigned int type;
+      unsigned int key;
+      unsigned int alg;
+      size_t cert_size;
+      char *cert_data;
+      struct GNUNET_DNSPARSER_CertRecord cert;
+
+      sdup = GNUNET_strdup (s);
+      typep = strtok (sdup, " ");
+      if ((NULL == typep) ||
+          ((0 == (type = rfc4398_mnemonic_to_value (typep))) &&
+           ((1 != sscanf (typep, "%u", &type)) || (type > UINT16_MAX))))
+      {
+        GNUNET_free (sdup);
+        return GNUNET_SYSERR;
+      }
+      keyp = strtok (NULL, " ");
+      if ((NULL == keyp) || (1 != sscanf (keyp, "%u", &key)) ||
+          (key > UINT16_MAX))
+      {
+        GNUNET_free (sdup);
+        return GNUNET_SYSERR;
+      }
+      alg = 0;
+      algp = strtok (NULL, " ");
+      if ((NULL == algp) ||
+          ((0 == (type = rfc4034_mnemonic_to_value (typep))) &&
+           ((1 != sscanf (algp, "%u", &alg)) || (alg > UINT8_MAX))))
+      {
+        GNUNET_free (sdup);
+        return GNUNET_SYSERR;
+      }
+      certp = strtok (NULL, " ");
+      if ((NULL == certp) || (0 == strlen (certp)))
+      {
+        GNUNET_free (sdup);
+        return GNUNET_SYSERR;
+      }
+      cert_size = GNUNET_STRINGS_base64_decode (certp,
+                                                strlen (certp),
+                                                (void **) &cert_data);
+      GNUNET_free (sdup);
+      cert.cert_type = type;
+      cert.cert_tag = key;
+      cert.algorithm = alg;
+      cert.certificate_size = cert_size;
+      cert.certificate_data = cert_data;
+      {
+        char certbuf[cert_size + sizeof(struct GNUNET_TUN_DnsCertRecord)];
+        size_t off;
+
+        off = 0;
+        if (GNUNET_OK != GNUNET_DNSPARSER_builder_add_cert (certbuf,
+                                                            sizeof(certbuf),
+                                                            &off,
+                                                            &cert))
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _ ("Failed to serialize CERT record with %u bytes\n"),
+                      (unsigned int) cert_size);
+          GNUNET_free (cert_data);
+          return GNUNET_SYSERR;
+        }
+        *data_size = off;
+        *data = GNUNET_malloc (off);
+        GNUNET_memcpy (*data, certbuf, off);
+      }
+      GNUNET_free (cert_data);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SOA: {
+      struct GNUNET_DNSPARSER_SoaRecord soa;
+      char soabuf[540];
+      char soa_rname[253 + 1];
+      char soa_mname[253 + 1];
+      unsigned int soa_serial;
+      unsigned int soa_refresh;
+      unsigned int soa_retry;
+      unsigned int soa_expire;
+      unsigned int soa_min;
+      size_t off;
+
+      if (7 != sscanf (s,
+                       "%253s %253s ( %u %u %u %u %u )",
+                       soa_rname,
+                       soa_mname,
+                       &soa_serial,
+                       &soa_refresh,
+                       &soa_retry,
+                       &soa_expire,
+                       &soa_min))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse SOA record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      soa.mname = soa_mname;
+      soa.rname = soa_rname;
+      soa.serial = (uint32_t) soa_serial;
+      soa.refresh = (uint32_t) soa_refresh;
+      soa.retry = (uint32_t) soa_retry;
+      soa.expire = (uint32_t) soa_expire;
+      soa.minimum_ttl = (uint32_t) soa_min;
+      off = 0;
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_soa (soabuf, sizeof(soabuf), &off, &soa))
+      {
+        GNUNET_log (
+          GNUNET_ERROR_TYPE_ERROR,
+          _ ("Failed to serialize SOA record with mname `%s' and rname `%s'\n"),
+          soa_mname,
+          soa_rname);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, soabuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_PTR: {
+      char ptrbuf[256];
+      size_t off;
+
+      off = 0;
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_name (ptrbuf, sizeof(ptrbuf), &off, s))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize PTR record with value `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, ptrbuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_MX: {
+      struct GNUNET_DNSPARSER_MxRecord mx;
+      char mxbuf[258];
+      char mxhost[253 + 1];
+      unsigned int mx_pref;
+      size_t off;
+
+      if (2 != sscanf (s, "%u %253s", &mx_pref, mxhost))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse MX record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      mx.preference = (uint16_t) mx_pref;
+      mx.mxhost = mxhost;
+      off = 0;
+
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_mx (mxbuf, sizeof(mxbuf), &off, &mx))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize MX record with hostname `%s'\n"),
+                    mxhost);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, mxbuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_SRV: {
+      struct GNUNET_DNSPARSER_SrvRecord srv;
+      char srvbuf[270];
+      char srvtarget[253 + 1];
+      unsigned int priority;
+      unsigned int weight;
+      unsigned int port;
+      size_t off;
+
+      if (4 != sscanf (s, "%u %u %u %253s", &priority, &weight, &port,
+                       srvtarget))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse SRV record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      srv.priority = (uint16_t) priority;
+      srv.weight = (uint16_t) weight;
+      srv.port = (uint16_t) port;
+      srv.target = srvtarget;
+      off = 0;
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_srv (srvbuf, sizeof(srvbuf), &off, &srv))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize SRV record with target `%s'\n"),
+                    srvtarget);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, srvbuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_URI: {
+      struct GNUNET_DNSPARSER_UriRecord uri;
+      char target[strlen (s)];
+      unsigned int priority;
+      unsigned int weight;
+      size_t off;
+
+      if (3 != sscanf (s, "%u %u \"%s", &priority, &weight, &target[0])) // only \" befor %s because %s will consume the ending " of the presentation of the URI record
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse URI record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+      target[strlen (target) - 1] = '\0'; // Removing the last " of the presentation of the URI record
+
+      uri.priority = (uint16_t) priority;
+      uri.weight = (uint16_t) weight;
+      uri.target = target;
+      off = 0;
+
+      // TODO add more precise uri checking (RFC3986)
+      if (strstr (target, ":") == NULL ||
+          target[0] == 58 ||
+          target[strlen (target) - 1] == 58)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize URI record with target `%s'\n"),
+                    target);
+        return GNUNET_SYSERR;
+      }
+
+      char uribuf[sizeof(struct GNUNET_TUN_DnsUriRecord) + strlen (target) + 1];
+
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_builder_add_uri (uribuf, sizeof(uribuf), &off, &uri))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Failed to serialize URI record with target `%s'\n"),
+                    target);
+        return GNUNET_SYSERR;
+      }
+      *data_size = off;
+      *data = GNUNET_malloc (off);
+      GNUNET_memcpy (*data, uribuf, off);
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_TXT:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s);
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_AAAA:
+    if (1 != inet_pton (AF_INET6, s, &value_aaaa))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _ ("Unable to parse IPv6 address `%s'\n"),
+                  s);
+      return GNUNET_SYSERR;
+    }
+    *data = GNUNET_new (struct in6_addr);
+    *data_size = sizeof(struct in6_addr);
+    GNUNET_memcpy (*data, &value_aaaa, sizeof(value_aaaa));
+    return GNUNET_OK;
+
+  case GNUNET_DNSPARSER_TYPE_SMIMEA:
+  case GNUNET_DNSPARSER_TYPE_TLSA: {
+      unsigned int usage;
+      unsigned int selector;
+      unsigned int matching_type;
+      size_t slen = strlen (s) + 1;
+      char hex[slen];
+
+      if (4 != sscanf (s, "%u %u %u %s", &usage, &selector, &matching_type,
+                       hex))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse TLSA/SMIMEA record string `%s'\n"),
+                    s);
+        *data_size = 0;
+        return GNUNET_SYSERR;
+      }
+
+      *data_size = sizeof(struct GNUNET_TUN_DnsTlsaRecord) + strlen (hex) / 2;
+      *data = tlsa = GNUNET_malloc (*data_size);
+      tlsa->usage = (uint8_t) usage;
+      tlsa->selector = (uint8_t) selector;
+      tlsa->matching_type = (uint8_t) matching_type;
+      if (strlen (hex) / 2 != GNUNET_DNSPARSER_hex_to_bin (hex, &tlsa[1]))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse TLSA/SMIMEA record string `%s'\n"),
+                    s);
+        GNUNET_free (*data);
+        *data = NULL;
+        *data_size = 0;
+        return GNUNET_SYSERR;
+      }
+      return GNUNET_OK;
+    }
+
+  case GNUNET_DNSPARSER_TYPE_CAA: {   // RFC6844
+      struct GNUNET_DNSPARSER_CaaRecord *caa;
+      unsigned int flags;
+      char tag[15]; // Max tag length 15
+      char value[strlen (s) + 1]; // Should be more than enough
+
+      if (3 != sscanf (s, "%u %s %[^\n]", &flags, tag, value))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse CAA record string `%s'\n"),
+                    s);
+        *data_size = 0;
+        return GNUNET_SYSERR;
+      }
+      *data_size = sizeof(struct GNUNET_DNSPARSER_CaaRecord) + strlen (tag)
+                   + strlen (value);
+      *data = caa = GNUNET_malloc (*data_size);
+      caa->flags = flags;
+      memcpy (&caa[1], tag, strlen (tag));
+      caa->tag_len = strlen (tag);
+      memcpy ((char *) &caa[1] + caa->tag_len, value, strlen (value));
+      return GNUNET_OK;
+    }
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of record type numbers to human-readable
+ * record type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} name_map[] = { { "A", GNUNET_DNSPARSER_TYPE_A },
+                 { "NS", GNUNET_DNSPARSER_TYPE_NS },
+                 { "CNAME", GNUNET_DNSPARSER_TYPE_CNAME },
+                 { "SOA", GNUNET_DNSPARSER_TYPE_SOA },
+                 { "PTR", GNUNET_DNSPARSER_TYPE_PTR },
+                 { "MX", GNUNET_DNSPARSER_TYPE_MX },
+                 { "TXT", GNUNET_DNSPARSER_TYPE_TXT },
+                 { "AAAA", GNUNET_DNSPARSER_TYPE_AAAA },
+                 { "SRV", GNUNET_DNSPARSER_TYPE_SRV },
+                 { "URI", GNUNET_DNSPARSER_TYPE_URI },
+                 { "TLSA", GNUNET_DNSPARSER_TYPE_TLSA },
+                 { "SMIMEA", GNUNET_DNSPARSER_TYPE_SMIMEA },
+                 { "CERT", GNUNET_DNSPARSER_TYPE_CERT },
+                 { "CAA", GNUNET_DNSPARSER_TYPE_CAA },
+                 { NULL, UINT32_MAX } };
+
+
+/**
+ * Convert a type name (e.g. "AAAA") to the corresponding number.
+ *
+ * @param cls closure, unused
+ * @param dns_typename name to convert
+ * @return corresponding number, UINT32_MAX on error
+ */
+static uint32_t
+dns_typename_to_number (void *cls, const char *dns_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != name_map[i].name) &&
+         (0 != strcasecmp (dns_typename, name_map[i].name)))
+    i++;
+  return name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+dns_number_to_typename (void *cls, uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != name_map[i].name) && (type != name_map[i].number))
+    i++;
+  return name_map[i].name;
+}
+
+
+static enum GNUNET_GenericReturnValue
+dns_is_critical (void *cls, uint32_t type)
+{
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_gnsrecord_dns_init (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_GNSRECORD_PluginFunctions);
+  api->value_to_string = &dns_value_to_string;
+  api->string_to_value = &dns_string_to_value;
+  api->typename_to_number = &dns_typename_to_number;
+  api->number_to_typename = &dns_number_to_typename;
+  api->is_critical = &dns_is_critical;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init
+ * @return NULL
+ */
+void *
+libgnunet_plugin_gnsrecord_dns_done (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_gnsrecord_dns.c */
diff --git a/src/plugin/meson.build b/src/plugin/meson.build
new file mode 100644
index 000000000..d4f797c54
--- /dev/null
+++ b/src/plugin/meson.build
@@ -0,0 +1,17 @@
+subdir('block')
+subdir('dns')
+subdir('gnsrecord')
+subdir('datacache')
+subdir('datastore')
+subdir('peerstore')
+subdir('namecache')
+subdir('namestore')
+subdir('dht')
+subdir('seti')
+subdir('setu')
+subdir('regex')
+subdir('revocation')
+subdir('gns')
+subdir('fs')
+subdir('reclaim')
+subdir('messenger')
diff --git a/src/plugin/messenger/Makefile.am b/src/plugin/messenger/Makefile.am
new file mode 100644
index 000000000..e3c69ea33
--- /dev/null
+++ b/src/plugin/messenger/Makefile.am
@@ -0,0 +1,26 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_gnsrecord_messenger.la
+
+
+libgnunet_plugin_gnsrecord_messenger_la_SOURCES = \
+  plugin_gnsrecord_messenger.c
+libgnunet_plugin_gnsrecord_messenger_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_gnsrecord_messenger_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+plugindir = $(libdir)/gnunet
diff --git a/src/plugin/messenger/meson.build b/src/plugin/messenger/meson.build
new file mode 100644
index 000000000..17dd9bd32
--- /dev/null
+++ b/src/plugin/messenger/meson.build
@@ -0,0 +1,7 @@
+shared_module('gnunet_plugin_gnsrecord_messenger',
+              ['plugin_gnsrecord_messenger.c'],
+              dependencies: [libgnunetutil_dep, libgnunetgnsrecord_dep,
+                            ],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir')/'gnunet')
diff --git a/src/plugin/messenger/plugin_gnsrecord_messenger.c b/src/plugin/messenger/plugin_gnsrecord_messenger.c
new file mode 100644
index 000000000..81763e3b5
--- /dev/null
+++ b/src/plugin/messenger/plugin_gnsrecord_messenger.c
@@ -0,0 +1,305 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2021--2024 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Tobias Frisch
+ * @file src/messenger/plugin_gnsrecord_messenger.c
+ * @brief Plugin to provide the API for useful GNS records to improve
+ *        the usability of the messenger service.
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_messenger_service.h"
+#include "gnunet_gnsrecord_plugin.h"
+
+
+/**
+ * Convert the 'value' of a record to a string.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+static char *
+messenger_value_to_string (void *cls,
+                           uint32_t type,
+                           const void *data,
+                           size_t data_size)
+{
+  (void) cls;
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY:
+    {
+      if (data_size != sizeof(struct GNUNET_MESSENGER_RoomEntryRecord))
+      {
+        GNUNET_break_op (0);
+        return NULL;
+      }
+
+      const struct GNUNET_MESSENGER_RoomEntryRecord *record = data;
+
+      char *door = GNUNET_CRYPTO_eddsa_public_key_to_string (
+        &(record->door.public_key));
+      char *key = GNUNET_STRINGS_data_to_string_alloc (&(record->key),
+                                                       sizeof(struct
+                                                              GNUNET_HashCode));
+
+      char *ret;
+      GNUNET_asprintf (&ret, "%s-%s", key, door);
+      GNUNET_free (key);
+      GNUNET_free (door);
+      return ret;
+    }
+  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS:
+    {
+      if (data_size != sizeof(struct GNUNET_MESSENGER_RoomDetailsRecord))
+      {
+        GNUNET_break_op (0);
+        return NULL;
+      }
+
+      const struct GNUNET_MESSENGER_RoomDetailsRecord *record = data;
+
+      char *name = GNUNET_strndup (record->name, 256);
+      char *flags = GNUNET_STRINGS_data_to_string_alloc (&(record->flags),
+                                                         sizeof(uint32_t));
+
+      char *ret;
+      GNUNET_asprintf (&ret, "%s-%s", flags, name);
+      GNUNET_free (flags);
+      GNUNET_free (name);
+      return ret;
+    }
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of a record to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+messenger_string_to_value (void *cls,
+                           uint32_t type,
+                           const char *s,
+                           void **data,
+                           size_t *data_size)
+{
+  (void) cls;
+  if (NULL == s)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY:
+    {
+      char key[104];
+      const char *dash;
+      struct GNUNET_PeerIdentity door;
+
+      if ((NULL == (dash = strchr (s, '-'))) ||
+          (1 != sscanf (s, "%103s-", key)) ||
+          (GNUNET_OK != GNUNET_CRYPTO_eddsa_public_key_from_string (dash + 1,
+                                                                    strlen (
+                                                                      dash + 1),
+                                                                    &(door.
+                                                                      public_key))))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse MESSENGER_ROOM_ENTRY record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+
+      struct GNUNET_MESSENGER_RoomEntryRecord *record = GNUNET_new (
+        struct GNUNET_MESSENGER_RoomEntryRecord
+        );
+
+      if (GNUNET_OK != GNUNET_STRINGS_string_to_data (key,
+                                                      strlen (key),
+                                                      &(record->key),
+                                                      sizeof(struct
+                                                             GNUNET_HashCode)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse MESSENGER_ROOM_ENTRY record `%s'\n"),
+                    s);
+        GNUNET_free (record);
+        return GNUNET_SYSERR;
+      }
+
+      record->door = door;
+      *data = record;
+      *data_size = sizeof(struct GNUNET_MESSENGER_RoomEntryRecord);
+      return GNUNET_OK;
+    }
+  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS:
+    {
+      char flags[8];
+      const char *dash;
+
+      if ((NULL == (dash = strchr (s, '-'))) ||
+          (1 != sscanf (s, "%7s-", flags)) ||
+          (strlen (dash + 1) > 256))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse MESSENGER_ROOM_DETAILS record `%s'\n"),
+                    s);
+        return GNUNET_SYSERR;
+      }
+
+      struct GNUNET_MESSENGER_RoomDetailsRecord *record = GNUNET_new (
+        struct GNUNET_MESSENGER_RoomDetailsRecord
+        );
+
+      if (GNUNET_OK != GNUNET_STRINGS_string_to_data (flags,
+                                                      strlen (flags),
+                                                      &(record->flags),
+                                                      sizeof(uint32_t)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    _ ("Unable to parse MESSENGER_ROOM_DETAILS record `%s'\n"),
+                    s);
+        GNUNET_free (record);
+        return GNUNET_SYSERR;
+      }
+
+      GNUNET_memcpy (record->name, dash + 1, strlen (dash + 1));
+
+      *data = record;
+      *data_size = sizeof(struct GNUNET_MESSENGER_RoomDetailsRecord);
+      return GNUNET_OK;
+    }
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of record type numbers to human-readable
+ * record type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} name_map[] = {
+  { "MESSENGER_ROOM_ENTRY", GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY },
+  { "MESSENGER_ROOM_DETAILS", GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS },
+  { NULL, UINT32_MAX }
+};
+
+
+/**
+ * Convert a type name (e.g. "AAAA") to the corresponding number.
+ *
+ * @param cls closure, unused
+ * @param gns_typename name to convert
+ * @return corresponding number, UINT32_MAX on error
+ */
+static uint32_t
+messenger_typename_to_number (void *cls,
+                              const char *gns_typename)
+{
+  unsigned int i;
+
+  (void) cls;
+  i = 0;
+  while ((name_map[i].name != NULL) &&
+         (0 != strcasecmp (gns_typename, name_map[i].name)))
+    i++;
+  return name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+messenger_number_to_typename (void *cls,
+                              uint32_t type)
+{
+  unsigned int i;
+
+  (void) cls;
+  i = 0;
+  while ((name_map[i].name != NULL) &&
+         (type != name_map[i].number))
+    i++;
+  return name_map[i].name;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_gnsrecord_messenger_init (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api;
+
+  (void) cls;
+  api = GNUNET_new (struct GNUNET_GNSRECORD_PluginFunctions);
+  api->value_to_string = &messenger_value_to_string;
+  api->string_to_value = &messenger_string_to_value;
+  api->typename_to_number = &messenger_typename_to_number;
+  api->number_to_typename = &messenger_number_to_typename;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init
+ * @return NULL
+ */
+void *
+libgnunet_plugin_gnsrecord_messenger_done (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
diff --git a/src/plugin/namecache/Makefile.am b/src/plugin/namecache/Makefile.am
new file mode 100644
index 000000000..bf8fc9b8d
--- /dev/null
+++ b/src/plugin/namecache/Makefile.am
@@ -0,0 +1,108 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include $(POSTGRESQL_CPPFLAGS)
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+sqldir = $(prefix)/share/gnunet/sql/
+
+sql_DATA = \
+  namecache-0001.sql \
+  namecache-drop.sql
+
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+if HAVE_EXPERIMENTAL
+FLAT_PLUGIN = libgnunet_plugin_namecache_flat.la
+FLAT_TESTS = test_plugin_namecache_flat
+endif
+
+if HAVE_SQLITE
+SQLITE_PLUGIN = libgnunet_plugin_namecache_sqlite.la
+SQLITE_TESTS = test_plugin_namecache_sqlite
+endif
+
+if HAVE_POSTGRESQL
+POSTGRES_PLUGIN = libgnunet_plugin_namecache_postgres.la
+POSTGRES_TESTS = test_plugin_namecache_postgres
+endif
+
+if HAVE_SQLITE
+check_PROGRAMS = \
+ $(SQLITE_TESTS) \
+ $(POSTGRES_TESTS) \
+ $(FLAT_TESTS) \
+ $(TESTING_TESTS)
+endif
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = \
+  $(check_PROGRAMS)
+endif
+
+plugin_LTLIBRARIES = \
+  $(SQLITE_PLUGIN) \
+        $(FLAT_PLUGIN) \
+  $(POSTGRES_PLUGIN)
+
+libgnunet_plugin_namecache_flat_la_SOURCES = \
+  plugin_namecache_flat.c
+libgnunet_plugin_namecache_flat_la_LIBADD = \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_namecache_flat_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+libgnunet_plugin_namecache_sqlite_la_SOURCES = \
+  plugin_namecache_sqlite.c
+libgnunet_plugin_namecache_sqlite_la_LIBADD = \
+  $(top_builddir)/src/lib/sq/libgnunetsq.la \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
+  $(LTLIBINTL)
+libgnunet_plugin_namecache_sqlite_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+libgnunet_plugin_namecache_postgres_la_SOURCES = \
+  plugin_namecache_postgres.c
+libgnunet_plugin_namecache_postgres_la_LIBADD = \
+  $(top_builddir)/src/lib/pq/libgnunetpq.la  \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lpq \
+  $(LTLIBINTL)
+libgnunet_plugin_namecache_postgres_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
+
+test_plugin_namecache_flat_SOURCES = \
+ test_plugin_namecache.c
+test_plugin_namecache_flat_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_plugin_namecache_sqlite_SOURCES = \
+ test_plugin_namecache.c
+test_plugin_namecache_sqlite_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_plugin_namecache_postgres_SOURCES = \
+ test_plugin_namecache.c
+test_plugin_namecache_postgres_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_plugin_namecache_sqlite.conf \
+  test_plugin_namecache_postgres.conf \
+  test_plugin_namecache_flat.conf \
+  $(sql_DATA)
diff --git a/src/plugin/namecache/meson.build b/src/plugin/namecache/meson.build
new file mode 100644
index 000000000..51504314d
--- /dev/null
+++ b/src/plugin/namecache/meson.build
@@ -0,0 +1,22 @@
+shared_module('gnunet_plugin_namecache_sqlite',
+        ['plugin_namecache_sqlite.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetgnsrecord_dep,
+                       sqlite_dep,
+                       libgnunetsq_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+if pq_dep.found()
+  shared_module('gnunet_plugin_namecache_postgres',
+          ['plugin_namecache_postgres.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep,
+                         pq_dep,
+                         libgnunetpq_dep],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+endif
+
diff --git a/src/plugin/namecache/namecache-0001.sql b/src/plugin/namecache/namecache-0001.sql
new file mode 100644
index 000000000..8509b078f
--- /dev/null
+++ b/src/plugin/namecache/namecache-0001.sql
@@ -0,0 +1,42 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+-- Check patch versioning is in place.
+SELECT _v.register_patch('namecache-0001', NULL, NULL);
+
+-------------------- Schema ----------------------------
+
+CREATE SCHEMA datacache;
+COMMENT ON SCHEMA datacache IS 'gnunet-datacache data';
+
+SET search_path TO datacache;
+
+CREATE TABLE IF NOT EXISTS ns096blocks (
+  query BYTEA NOT NULL DEFAULT '',
+  block BYTEA NOT NULL DEFAULT '',
+  expiration_time BIGINT NOT NULL DEFAULT 0);
+
+CREATE INDEX ir_query_hash
+  ON ns096blocks (query,expiration_time);
+
+CREATE INDEX ir_block_expiration
+  ON ns096blocks (expiration_time);
+
+
+COMMIT;
diff --git a/src/plugin/namecache/namecache-drop.sql b/src/plugin/namecache/namecache-drop.sql
new file mode 100644
index 000000000..197ee78c1
--- /dev/null
+++ b/src/plugin/namecache/namecache-drop.sql
@@ -0,0 +1,25 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+
+SELECT _v.unregister_patch('namecache-0001');
+
+DROP SCHEMA namecache CASCADE;
+
+COMMIT;
diff --git a/src/plugin/namecache/plugin_namecache_flat.c b/src/plugin/namecache/plugin_namecache_flat.c
new file mode 100644
index 000000000..ba118bf02
--- /dev/null
+++ b/src/plugin/namecache/plugin_namecache_flat.c
@@ -0,0 +1,429 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2015 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file namecache/plugin_namecache_flat.c
+ * @brief flat file-based namecache backend
+ * @author Martin Schanzenbach
+ */
+
+#include "platform.h"
+#include "gnunet_namecache_plugin.h"
+#include "gnunet_namecache_service.h"
+#include "gnunet_gnsrecord_lib.h"
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * HashMap
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *hm;
+};
+
+struct FlatFileEntry
+{
+  /**
+   * Block
+   */
+  struct GNUNET_GNSRECORD_Block *block;
+
+  /**
+   * query
+   */
+  struct GNUNET_HashCode query;
+};
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static int
+database_setup (struct Plugin *plugin)
+{
+  char *afsdir;
+  char*block_buffer;
+  char*buffer;
+  char*line;
+  char*query;
+  char*block;
+  uint64_t size;
+  struct FlatFileEntry *entry;
+  struct GNUNET_DISK_FileHandle *fh;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
+                                               "namecache-flat",
+                                               "FILENAME",
+                                               &afsdir))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "namecache-flat", "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK != GNUNET_DISK_file_test (afsdir))
+  {
+    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (afsdir))
+    {
+      GNUNET_break (0);
+      GNUNET_free (afsdir);
+      return GNUNET_SYSERR;
+    }
+  }
+  /* afsdir should be UTF-8-encoded. If it isn't, it's a bug */
+  plugin->fn = afsdir;
+
+  /* Load data from file into hashmap */
+  plugin->hm = GNUNET_CONTAINER_multihashmap_create (10,
+                                                     GNUNET_NO);
+  fh = GNUNET_DISK_file_open (afsdir,
+                              GNUNET_DISK_OPEN_CREATE
+                              | GNUNET_DISK_OPEN_READWRITE,
+                              GNUNET_DISK_PERM_USER_WRITE
+                              | GNUNET_DISK_PERM_USER_READ);
+  if (NULL == fh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to initialize file: %s.\n"),
+                afsdir);
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_SYSERR == GNUNET_DISK_file_size (afsdir,
+                                              &size,
+                                              GNUNET_YES,
+                                              GNUNET_YES))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to get filesize: %s.\n"),
+                afsdir);
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+
+  if (0 == size)
+  {
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_OK;
+  }
+
+  buffer = GNUNET_malloc (size + 1);
+
+  if (GNUNET_SYSERR == GNUNET_DISK_file_read (fh,
+                                              buffer,
+                                              size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to read file: %s.\n"),
+                afsdir);
+    GNUNET_free (buffer);
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+  buffer[size] = '\0';
+
+  GNUNET_DISK_file_close (fh);
+  if (0 < size)
+  {
+    line = strtok (buffer, "\n");
+    while (line != NULL)
+    {
+      query = strtok (line, ",");
+      if (NULL == query)
+        break;
+      block = strtok (NULL, ",");
+      if (NULL == block)
+        break;
+      line = strtok (NULL, "\n");
+      entry = GNUNET_malloc (sizeof(struct FlatFileEntry));
+      GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_hash_from_string (query,
+                                                                  &entry->query));
+      GNUNET_STRINGS_base64_decode (block,
+                                    strlen (block),
+                                    (void **) &block_buffer);
+      entry->block = (struct GNUNET_GNSRECORD_Block *) block_buffer;
+      if (GNUNET_OK !=
+          GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                             &entry->query,
+                                             entry,
+                                             GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+      {
+        GNUNET_free (entry);
+        GNUNET_break (0);
+      }
+    }
+  }
+  GNUNET_free (buffer);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Store values in hashmap in file and free data
+ *
+ * @param plugin the plugin context
+ */
+static int
+store_and_free_entries (void *cls,
+                        const struct GNUNET_HashCode *key,
+                        void *value)
+{
+  struct GNUNET_DISK_FileHandle *fh = cls;
+  struct FlatFileEntry *entry = value;
+
+  char *line;
+  char *block_b64;
+  struct GNUNET_CRYPTO_HashAsciiEncoded query;
+  size_t block_size;
+
+  block_size = GNUNET_GNSRECORD_block_get_size (entry->block);
+  GNUNET_STRINGS_base64_encode ((char *) entry->block,
+                                block_size,
+                                &block_b64);
+  GNUNET_CRYPTO_hash_to_enc (&entry->query,
+                             &query);
+  GNUNET_asprintf (&line,
+                   "%s,%s\n",
+                   (char *) &query,
+                   block_b64);
+
+  GNUNET_free (block_b64);
+
+  GNUNET_DISK_file_write (fh,
+                          line,
+                          strlen (line));
+
+  GNUNET_free (entry->block);
+  GNUNET_free (entry);
+  GNUNET_free (line);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+
+  fh = GNUNET_DISK_file_open (plugin->fn,
+                              GNUNET_DISK_OPEN_CREATE
+                              | GNUNET_DISK_OPEN_TRUNCATE
+                              | GNUNET_DISK_OPEN_READWRITE,
+                              GNUNET_DISK_PERM_USER_WRITE
+                              | GNUNET_DISK_PERM_USER_READ);
+  if (NULL == fh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to initialize file: %s.\n"),
+                plugin->fn);
+    return;
+  }
+
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
+                                         &store_and_free_entries,
+                                         fh);
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->hm);
+  GNUNET_DISK_file_close (fh);
+}
+
+
+static int
+expire_blocks (void *cls,
+               const struct GNUNET_HashCode *key,
+               void *value)
+{
+  struct Plugin *plugin = cls;
+  struct FlatFileEntry *entry = value;
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute expiration;
+
+  now = GNUNET_TIME_absolute_get ();
+  expiration = GNUNET_GNSRECORD_block_get_expiration (entry->block);
+
+  if (0 == GNUNET_TIME_absolute_get_difference (now,
+                                                expiration).rel_value_us)
+  {
+    GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm, key);
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Removes any expired block.
+ *
+ * @param plugin the plugin
+ */
+static void
+namecache_expire_blocks (struct Plugin *plugin)
+{
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
+                                         &expire_blocks,
+                                         plugin);
+}
+
+
+/**
+ * Cache a block in the datastore.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param block block to cache
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static int
+namecache_cache_block (void *cls,
+                       const struct GNUNET_GNSRECORD_Block *block)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode query;
+  struct FlatFileEntry *entry;
+  size_t block_size;
+
+  namecache_expire_blocks (plugin);
+  GNUNET_GNSRECORD_query_from_block (block,
+                                     &query);
+  block_size = GNUNET_GNSRECORD_block_get_size (block);
+  if (block_size > 64 * 65536)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  entry = GNUNET_malloc (sizeof(struct FlatFileEntry));
+  entry->block = GNUNET_malloc (block_size);
+  GNUNET_memcpy (entry->block, block, block_size);
+  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm, &query);
+  if (GNUNET_OK !=
+      GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                         &query,
+                                         entry,
+                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+  {
+    GNUNET_free (entry);
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Caching block under derived key `%s'\n",
+              GNUNET_h2s_full (&query));
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get the block for a particular zone and label in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param query hash of public key derived from the zone and the label
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static int
+namecache_lookup_block (void *cls,
+                        const struct GNUNET_HashCode *query,
+                        GNUNET_NAMECACHE_BlockCallback iter, void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  const struct GNUNET_GNSRECORD_Block *block;
+
+  block = GNUNET_CONTAINER_multihashmap_get (plugin->hm, query);
+  if (NULL == block)
+    return GNUNET_NO;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found block under derived key `%s'\n",
+              GNUNET_h2s_full (query));
+  iter (iter_cls, block);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMECACHE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_namecache_flat_init (void *cls)
+{
+  static struct Plugin plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMECACHE_PluginFunctions *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  if (GNUNET_OK != database_setup (&plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMECACHE_PluginFunctions);
+  api->cls = &plugin;
+  api->cache_block = &namecache_cache_block;
+  api->lookup_block = &namecache_lookup_block;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("flat plugin running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namecache_flat_done (void *cls)
+{
+  struct GNUNET_NAMECACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "flat plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namecache_sqlite.c */
diff --git a/src/plugin/namecache/plugin_namecache_postgres.c b/src/plugin/namecache/plugin_namecache_postgres.c
new file mode 100644
index 000000000..7e2925d1a
--- /dev/null
+++ b/src/plugin/namecache/plugin_namecache_postgres.c
@@ -0,0 +1,315 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2013, 2016, 2017, 2022 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file namecache/plugin_namecache_postgres.c
+ * @brief postgres-based namecache backend
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_namecache_plugin.h"
+#include "gnunet_namecache_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_pq_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "namecache-postgres", __VA_ARGS__)
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Postgres database handle.
+   */
+  struct GNUNET_PQ_Context *dbh;
+};
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+database_setup (struct Plugin *plugin)
+{
+  struct GNUNET_PQ_PreparedStatement ps[] = {
+    GNUNET_PQ_make_prepare ("cache_block",
+                            "INSERT INTO namecache.ns096blocks"
+                            " (query, block, expiration_time)"
+                            " VALUES"
+                            " ($1, $2, $3)"),
+    GNUNET_PQ_make_prepare ("expire_blocks",
+                            "DELETE FROM namecache.ns096blocks"
+                            " WHERE expiration_time<$1"),
+    GNUNET_PQ_make_prepare ("delete_block",
+                            "DELETE FROM namecache.ns096blocks"
+                            " WHERE query=$1 AND expiration_time<=$2"),
+    GNUNET_PQ_make_prepare ("lookup_block",
+                            "SELECT block"
+                            " FROM namecache.ns096blocks"
+                            " WHERE query=$1"
+                            " ORDER BY expiration_time DESC LIMIT 1"),
+    GNUNET_PQ_PREPARED_STATEMENT_END
+  };
+
+  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->cfg,
+                                            "namecache-postgres",
+                                            "namecache-",
+                                            NULL,
+                                            ps);
+  if (NULL == plugin->dbh)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Removes any expired block.
+ *
+ * @param plugin the plugin
+ */
+static void
+namecache_postgres_expire_blocks (struct Plugin *plugin)
+{
+  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+
+  res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "expire_blocks",
+                                            params);
+  GNUNET_break (GNUNET_DB_STATUS_HARD_ERROR != res);
+}
+
+
+/**
+ * Delete older block in the datastore.
+ *
+ * @param plugin the plugin
+ * @param query query for the block
+ * @param expiration_time how old does the block have to be for deletion
+ */
+static void
+delete_old_block (struct Plugin *plugin,
+                  const struct GNUNET_HashCode *query,
+                  struct GNUNET_TIME_Absolute expiration_time)
+{
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (query),
+    GNUNET_PQ_query_param_absolute_time (&expiration_time),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+
+  res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "delete_block",
+                                            params);
+  GNUNET_break (GNUNET_DB_STATUS_HARD_ERROR != res);
+}
+
+
+/**
+ * Cache a block in the datastore.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param block block to cache
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namecache_postgres_cache_block (void *cls,
+                                const struct GNUNET_GNSRECORD_Block *block)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode query;
+  size_t block_size = GNUNET_GNSRECORD_block_get_size (block);
+  struct GNUNET_TIME_Absolute exp;
+  exp = GNUNET_GNSRECORD_block_get_expiration (block);
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (&query),
+    GNUNET_PQ_query_param_fixed_size (block, block_size),
+    GNUNET_PQ_query_param_absolute_time (&exp),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+
+  namecache_postgres_expire_blocks (plugin);
+  GNUNET_GNSRECORD_query_from_block (block,
+                                     &query);
+  if (block_size > 64 * 65536)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  delete_old_block (plugin,
+                    &query,
+                    exp);
+
+  res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                            "cache_block",
+                                            params);
+  if (0 > res)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Get the block for a particular zone and label in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param query hash of public key derived from the zone and the label
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+namecache_postgres_lookup_block (void *cls,
+                                 const struct GNUNET_HashCode *query,
+                                 GNUNET_NAMECACHE_BlockCallback iter,
+                                 void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  size_t bsize;
+  struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (query),
+    GNUNET_PQ_query_param_end
+  };
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_variable_size ("block",
+                                         (void **) &block,
+                                         &bsize),
+    GNUNET_PQ_result_spec_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+
+  res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
+                                                  "lookup_block",
+                                                  params,
+                                                  rs);
+  if (0 > res)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Failing lookup block in namecache (postgres error)\n");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+  {
+    /* no result */
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Ending iteration (no more results)\n");
+    return GNUNET_NO;
+  }
+  if ((bsize < sizeof(*block)))
+  {
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Failing lookup (corrupt block)\n");
+    GNUNET_PQ_cleanup_result (rs);
+    return GNUNET_SYSERR;
+  }
+  iter (iter_cls,
+        block);
+  GNUNET_PQ_cleanup_result (rs);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ *
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  GNUNET_PQ_disconnect (plugin->dbh);
+  plugin->dbh = NULL;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the `struct GNUNET_NAMECACHE_PluginEnvironment *`
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_namecache_postgres_init (void *cls)
+{
+  static struct Plugin plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMECACHE_PluginFunctions *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  if (GNUNET_OK != database_setup (&plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMECACHE_PluginFunctions);
+  api->cls = &plugin;
+  api->cache_block = &namecache_postgres_cache_block;
+  api->lookup_block = &namecache_postgres_lookup_block;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Postgres namecache plugin running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namecache_postgres_done (void *cls)
+{
+  struct GNUNET_NAMECACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Postgres namecache plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namecache_postgres.c */
diff --git a/src/plugin/namecache/plugin_namecache_sqlite.c b/src/plugin/namecache/plugin_namecache_sqlite.c
new file mode 100644
index 000000000..d8b485381
--- /dev/null
+++ b/src/plugin/namecache/plugin_namecache_sqlite.c
@@ -0,0 +1,589 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2013 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file namecache/plugin_namecache_sqlite.c
+ * @brief sqlite-based namecache backend
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_sq_lib.h"
+#include "gnunet_namecache_plugin.h"
+#include "gnunet_namecache_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include <sqlite3.h>
+
+/**
+ * After how many ms "busy" should a DB operation fail for good?  A
+ * low value makes sure that we are more responsive to requests
+ * (especially PUTs).  A high value guarantees a higher success rate
+ * (SELECTs in iterate can take several seconds despite LIMIT=1).
+ *
+ * The default value of 1s should ensure that users do not experience
+ * huge latencies while at the same time allowing operations to
+ * succeed with reasonable probability.
+ */
+#define BUSY_TIMEOUT_MS 1000
+
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' on file 'filename'
+ * with the message given by strerror(errno).
+ */
+#define LOG_SQLITE(db, level, cmd) do { GNUNET_log_from (level, \
+                                                         "namecache-sqlite", _ ( \
+                                                           "`%s' failed at %s:%d with error: %s\n"), \
+                                                         cmd, \
+                                                         __FILE__, __LINE__, \
+                                                         sqlite3_errmsg ( \
+                                                           db->dbh)); \
+} while (0)
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "namecache-sqlite", __VA_ARGS__)
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * Native SQLite database handle.
+   */
+  sqlite3 *dbh;
+
+  /**
+   * Precompiled SQL for caching a block
+   */
+  sqlite3_stmt *cache_block;
+
+  /**
+   * Precompiled SQL for deleting an older block
+   */
+  sqlite3_stmt *delete_block;
+
+  /**
+   * Precompiled SQL for looking up a block
+   */
+  sqlite3_stmt *lookup_block;
+
+  /**
+   * Precompiled SQL for removing expired blocks
+   */
+  sqlite3_stmt *expire_blocks;
+};
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static int
+database_setup (struct Plugin *plugin)
+{
+  struct GNUNET_SQ_ExecuteStatement es[] = {
+    GNUNET_SQ_make_try_execute ("PRAGMA temp_store=MEMORY"),
+    GNUNET_SQ_make_try_execute ("PRAGMA synchronous=NORMAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA legacy_file_format=OFF"),
+    GNUNET_SQ_make_try_execute ("PRAGMA auto_vacuum=INCREMENTAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA encoding=\"UTF-8\""),
+    GNUNET_SQ_make_try_execute ("PRAGMA locking_mode=EXCLUSIVE"),
+    GNUNET_SQ_make_try_execute ("PRAGMA page_size=4092"),
+    GNUNET_SQ_make_try_execute ("PRAGMA journal_mode=WAL"),
+    GNUNET_SQ_make_execute ("CREATE TABLE IF NOT EXISTS ns096blocks ("
+                            " query BLOB NOT NULL,"
+                            " block BLOB NOT NULL,"
+                            " expiration_time INT8 NOT NULL"
+                            ")"),
+    GNUNET_SQ_make_execute ("CREATE INDEX IF NOT EXISTS ir_query_hash "
+                            "ON ns096blocks (query,expiration_time)"),
+    GNUNET_SQ_make_execute ("CREATE INDEX IF NOT EXISTS ir_block_expiration "
+                            "ON ns096blocks (expiration_time)"),
+    GNUNET_SQ_EXECUTE_STATEMENT_END
+  };
+  struct GNUNET_SQ_PrepareStatement ps[] = {
+    GNUNET_SQ_make_prepare (
+      "INSERT INTO ns096blocks (query,block,expiration_time) VALUES (?, ?, ?)",
+      &plugin->cache_block),
+    GNUNET_SQ_make_prepare ("DELETE FROM ns096blocks WHERE expiration_time<?",
+                            &plugin->expire_blocks),
+    GNUNET_SQ_make_prepare (
+      "DELETE FROM ns096blocks WHERE query=? AND expiration_time<=?",
+      &plugin->delete_block),
+    GNUNET_SQ_make_prepare ("SELECT block FROM ns096blocks WHERE query=? "
+                            "ORDER BY expiration_time DESC LIMIT 1",
+                            &plugin->lookup_block),
+    GNUNET_SQ_PREPARE_END
+  };
+  char *afsdir;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
+                                               "namecache-sqlite",
+                                               "FILENAME",
+                                               &afsdir))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "namecache-sqlite",
+                               "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_test (afsdir))
+  {
+    if (GNUNET_OK !=
+        GNUNET_DISK_directory_create_for_file (afsdir))
+    {
+      GNUNET_break (0);
+      GNUNET_free (afsdir);
+      return GNUNET_SYSERR;
+    }
+  }
+  /* afsdir should be UTF-8-encoded. If it isn't, it's a bug */
+  plugin->fn = afsdir;
+
+  /* Open database and precompile statements */
+  if (SQLITE_OK !=
+      sqlite3_open (plugin->fn, &plugin->dbh))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Unable to initialize SQLite: %s.\n"),
+         sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_SQ_exec_statements (plugin->dbh,
+                                 es))
+  {
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Failed to setup database at `%s'\n"),
+         plugin->fn);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_break (SQLITE_OK ==
+                sqlite3_busy_timeout (plugin->dbh,
+                                      BUSY_TIMEOUT_MS));
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_prepare (plugin->dbh,
+                         ps))
+  {
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Failed to setup database at `%s'\n"),
+         plugin->fn);
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  int result;
+  sqlite3_stmt *stmt;
+
+  if (NULL != plugin->cache_block)
+    sqlite3_finalize (plugin->cache_block);
+  if (NULL != plugin->lookup_block)
+    sqlite3_finalize (plugin->lookup_block);
+  if (NULL != plugin->expire_blocks)
+    sqlite3_finalize (plugin->expire_blocks);
+  if (NULL != plugin->delete_block)
+    sqlite3_finalize (plugin->delete_block);
+  result = sqlite3_close (plugin->dbh);
+  if (result == SQLITE_BUSY)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ (
+           "Tried to close sqlite without finalizing all prepared statements.\n"));
+    stmt = sqlite3_next_stmt (plugin->dbh,
+                              NULL);
+    while (stmt != NULL)
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "sqlite",
+                       "Closing statement %p\n",
+                       stmt);
+      result = sqlite3_finalize (stmt);
+      if (result != SQLITE_OK)
+        GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                         "sqlite",
+                         "Failed to close statement %p: %d\n",
+                         stmt,
+                         result);
+      stmt = sqlite3_next_stmt (plugin->dbh,
+                                NULL);
+    }
+    result = sqlite3_close (plugin->dbh);
+  }
+  if (SQLITE_OK != result)
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_close");
+
+  GNUNET_free (plugin->fn);
+}
+
+
+/**
+ * Removes any expired block.
+ *
+ * @param plugin the plugin
+ */
+static void
+namecache_sqlite_expire_blocks (struct Plugin *plugin)
+{
+  struct GNUNET_TIME_Absolute now;
+  now = GNUNET_TIME_absolute_get ();
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_end
+  };
+  int n;
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->expire_blocks,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->expire_blocks);
+    return;
+  }
+  n = sqlite3_step (plugin->expire_blocks);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->expire_blocks);
+  switch (n)
+  {
+  case SQLITE_DONE:
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Records expired\n");
+    return;
+
+  case SQLITE_BUSY:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return;
+
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return;
+  }
+}
+
+
+/**
+ * Cache a block in the datastore.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param block block to cache
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static int
+namecache_sqlite_cache_block (void *cls,
+                              const struct GNUNET_GNSRECORD_Block *block)
+{
+  static struct GNUNET_TIME_Absolute last_expire;
+  struct Plugin *plugin = cls;
+  struct GNUNET_HashCode query;
+  struct GNUNET_TIME_Absolute expiration;
+  size_t block_size = GNUNET_GNSRECORD_block_get_size (block);
+  struct GNUNET_SQ_QueryParam del_params[] = {
+    GNUNET_SQ_query_param_auto_from_type (&query),
+    GNUNET_SQ_query_param_absolute_time (&expiration),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_QueryParam ins_params[] = {
+    GNUNET_SQ_query_param_auto_from_type (&query),
+    GNUNET_SQ_query_param_fixed_size (block,
+                                      block_size),
+    GNUNET_SQ_query_param_absolute_time (&expiration),
+    GNUNET_SQ_query_param_end
+  };
+  int n;
+
+  /* run expiration of old cache entries once per hour */
+  if (GNUNET_TIME_absolute_get_duration (last_expire).rel_value_us >
+      GNUNET_TIME_UNIT_HOURS.rel_value_us)
+  {
+    last_expire = GNUNET_TIME_absolute_get ();
+    namecache_sqlite_expire_blocks (plugin);
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_query_from_block (block, &query));
+  expiration = GNUNET_GNSRECORD_block_get_expiration (block);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Caching new version of block %s (expires %s)\n",
+              GNUNET_h2s (&query),
+              GNUNET_STRINGS_absolute_time_to_string (expiration));
+  if (block_size > 64 * 65536)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  /* delete old version of the block */
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->delete_block,
+                      del_params))
+  {
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->delete_block);
+    return GNUNET_SYSERR;
+  }
+  n = sqlite3_step (plugin->delete_block);
+  switch (n)
+  {
+  case SQLITE_DONE:
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Old block deleted\n");
+    break;
+
+  case SQLITE_BUSY:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    break;
+
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    break;
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->delete_block);
+
+  /* insert new version of the block */
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->cache_block,
+                      ins_params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->cache_block);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Caching block under derived key `%s'\n",
+              GNUNET_h2s_full (&query));
+  n = sqlite3_step (plugin->cache_block);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->cache_block);
+  switch (n)
+  {
+  case SQLITE_DONE:
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Record stored\n");
+    return GNUNET_OK;
+
+  case SQLITE_BUSY:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_NO;
+
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Get the block for a particular zone and label in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param query hash of public key derived from the zone and the label
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static int
+namecache_sqlite_lookup_block (void *cls,
+                               const struct GNUNET_HashCode *query,
+                               GNUNET_NAMECACHE_BlockCallback iter,
+                               void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  int ret;
+  int sret;
+  size_t block_size;
+  const struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_auto_from_type (query),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size ((void **) &block,
+                                         &block_size),
+    GNUNET_SQ_result_spec_end
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->lookup_block,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->lookup_block);
+    return GNUNET_SYSERR;
+  }
+  ret = GNUNET_NO;
+  if (SQLITE_ROW ==
+      (sret = sqlite3_step (plugin->lookup_block)))
+  {
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->lookup_block,
+                                  rs))
+    {
+      GNUNET_break (0);
+      ret = GNUNET_SYSERR;
+    }
+    else if ((block_size < sizeof(struct GNUNET_GNSRECORD_Block)))
+    {
+      GNUNET_break (0);
+      GNUNET_SQ_cleanup_result (rs);
+      ret = GNUNET_SYSERR;
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Found block under derived key `%s'\n",
+                  GNUNET_h2s_full (query));
+      iter (iter_cls,
+            block);
+      GNUNET_SQ_cleanup_result (rs);
+      ret = GNUNET_YES;
+    }
+  }
+  else
+  {
+    if (SQLITE_DONE != sret)
+    {
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite_step");
+      ret = GNUNET_SYSERR;
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "No block found under derived key `%s'\n",
+                  GNUNET_h2s_full (query));
+    }
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->lookup_block);
+  return ret;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMECACHE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_namecache_sqlite_init (void *cls)
+{
+  static struct Plugin plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMECACHE_PluginFunctions *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  if (GNUNET_OK != database_setup (&plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMECACHE_PluginFunctions);
+  api->cls = &plugin;
+  api->cache_block = &namecache_sqlite_cache_block;
+  api->lookup_block = &namecache_sqlite_lookup_block;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       _ ("Sqlite database running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namecache_sqlite_done (void *cls)
+{
+  struct GNUNET_NAMECACHE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sqlite plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namecache_sqlite.c */
diff --git a/src/plugin/namecache/test_plugin_namecache.c b/src/plugin/namecache/test_plugin_namecache.c
new file mode 100644
index 000000000..141698a23
--- /dev/null
+++ b/src/plugin/namecache/test_plugin_namecache.c
@@ -0,0 +1,135 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/*
+ * @file namecache/test_plugin_namecache.c
+ * @brief Test for the namecache plugins
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_namecache_plugin.h"
+#include "gnunet_testing_lib.h"
+
+
+static int ok;
+
+/**
+ * Name of plugin under test.
+ */
+static const char *plugin_name;
+
+
+/**
+ * Function called when the service shuts down.  Unloads our namecache
+ * plugin.
+ *
+ * @param api api to unload
+ */
+static void
+unload_plugin (struct GNUNET_NAMECACHE_PluginFunctions *api)
+{
+  char *libname;
+
+  GNUNET_asprintf (&libname, "libgnunet_plugin_namecache_%s", plugin_name);
+  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_free (libname);
+}
+
+
+/**
+ * Load the namecache plugin.
+ *
+ * @param cfg configuration to pass
+ * @return NULL on error
+ */
+static struct GNUNET_NAMECACHE_PluginFunctions *
+load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_NAMECACHE_PluginFunctions *ret;
+  char *libname;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' namecache plugin\n"),
+              plugin_name);
+  GNUNET_asprintf (&libname, "libgnunet_plugin_namecache_%s", plugin_name);
+  if (NULL == (ret = GNUNET_PLUGIN_load (libname, (void *) cfg)))
+  {
+    fprintf (stderr, "Failed to load plugin `%s'!\n", plugin_name);
+    GNUNET_free (libname);
+    return NULL;
+  }
+  GNUNET_free (libname);
+  return ret;
+}
+
+
+static void
+run (void *cls, char *const *args, const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_NAMECACHE_PluginFunctions *nsp;
+
+  ok = 0;
+  nsp = load_plugin (cfg);
+  if (NULL == nsp)
+  {
+    fprintf (stderr,
+             "%s",
+             "Failed to initialize namecache.  Database likely not setup, skipping test.\n");
+    return;
+  }
+
+  unload_plugin (nsp);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  char cfg_name[PATH_MAX];
+  char *const xargv[] = {
+    "test-plugin-namecache",
+    "-c",
+    cfg_name,
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+  GNUNET_snprintf (cfg_name, sizeof(cfg_name), "test_plugin_namecache_%s.conf",
+                   plugin_name);
+
+  GNUNET_DISK_purge_cfg_dir (cfg_name, "GNUNET_TEST_HOME");
+
+  GNUNET_log_setup ("test-plugin-namecache",
+                    "WARNING",
+                    NULL);
+  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1, xargv,
+                      "test-plugin-namecache", "nohelp", options, &run, NULL);
+
+  if (ok != 0)
+    fprintf (stderr, "Missed some testcases: %d\n", ok);
+  GNUNET_DISK_purge_cfg_dir (cfg_name, "GNUNET_TEST_HOME");
+  return ok;
+}
+
+
+/* end of test_plugin_namecache.c */
diff --git a/src/plugin/namecache/test_plugin_namecache_flat.conf b/src/plugin/namecache/test_plugin_namecache_flat.conf
new file mode 100644
index 000000000..efe77e37a
--- /dev/null
+++ b/src/plugin/namecache/test_plugin_namecache_flat.conf
@@ -0,0 +1,2 @@
+[namecache-flat]
+FILENAME = $GNUNET_TMP/gnunet-test-plugin-namecache-flat/flatdb
diff --git a/src/plugin/namecache/test_plugin_namecache_postgres.conf b/src/plugin/namecache/test_plugin_namecache_postgres.conf
new file mode 100644
index 000000000..8473857d5
--- /dev/null
+++ b/src/plugin/namecache/test_plugin_namecache_postgres.conf
@@ -0,0 +1,3 @@
+[namestore-postgres]
+CONFIG = connect_timeout=10; dbname=gnunetcheck
+TEMPORARY_TABLE = YES
diff --git a/src/plugin/namecache/test_plugin_namecache_sqlite.conf b/src/plugin/namecache/test_plugin_namecache_sqlite.conf
new file mode 100644
index 000000000..24eecd286
--- /dev/null
+++ b/src/plugin/namecache/test_plugin_namecache_sqlite.conf
@@ -0,0 +1,2 @@
+[namestore-sqlite]
+FILENAME = $GNUNET_TMP/gnunet-test-plugin-namestore-sqlite/sqlite.db
diff --git a/src/plugin/namestore/Makefile.am b/src/plugin/namestore/Makefile.am
new file mode 100644
index 000000000..3db174225
--- /dev/null
+++ b/src/plugin/namestore/Makefile.am
@@ -0,0 +1,79 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include $(POSTGRESQL_CPPFLAGS)
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+sqldir = $(prefix)/share/gnunet/sql/
+
+sql_DATA = \
+  namestore-0001.sql \
+  namestore-drop.sql
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+
+
+
+plugin_LTLIBRARIES = \
+  $(SQLITE_PLUGIN) \
+  $(POSTGRES_PLUGIN)
+
+
+libgnunet_plugin_namestore_sqlite_la_SOURCES = \
+  plugin_namestore_sqlite.c
+libgnunet_plugin_namestore_sqlite_la_LIBADD = \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la  \
+  $(top_builddir)/src/lib/sq/libgnunetsq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
+  $(LTLIBINTL)
+libgnunet_plugin_namestore_sqlite_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+libgnunet_plugin_namestore_postgres_la_SOURCES = \
+  plugin_namestore_postgres.c
+libgnunet_plugin_namestore_postgres_la_LIBADD = \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la  \
+  $(top_builddir)/src/lib/pq/libgnunetpq.la  \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lpq \
+  $(LTLIBINTL)
+libgnunet_plugin_namestore_postgres_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
+
+if HAVE_SQLITE
+SQLITE_PLUGIN = libgnunet_plugin_namestore_sqlite.la
+SQLITE_TESTS = test_plugin_namestore_sqlite
+endif
+
+
+if HAVE_POSTGRESQL
+POSTGRES_PLUGIN = libgnunet_plugin_namestore_postgres.la
+POSTGRES_TESTS = test_plugin_namestore_postgres
+endif
+if HAVE_SQLITE
+check_PROGRAMS = \
+ $(SQLITE_TESTS) \
+ $(POSTGRES_TESTS)
+endif
+
+test_plugin_namestore_sqlite_SOURCES = \
+ test_plugin_namestore.c
+test_plugin_namestore_sqlite_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_plugin_namestore_postgres_SOURCES = \
+  test_plugin_namestore.c
+test_plugin_namestore_postgres_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_plugin_namestore_sqlite.conf \
+  test_plugin_namestore_postgres.conf \
+        $(sql_DATA)
+
diff --git a/src/plugin/namestore/meson.build b/src/plugin/namestore/meson.build
new file mode 100644
index 000000000..86eeb37c5
--- /dev/null
+++ b/src/plugin/namestore/meson.build
@@ -0,0 +1,63 @@
+libgnunetpluginnamestore_sqlite_src = ['plugin_namestore_sqlite.c']
+
+shared_module('gnunet_plugin_namestore_sqlite',
+        libgnunetpluginnamestore_sqlite_src,
+        dependencies: [libgnunetutil_dep,
+                       libgnunetgnsrecord_dep,
+                       libgnunetsq_dep,
+                       sqlite_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+configure_file(copy: true,
+               input: 'test_plugin_namestore_sqlite.conf',
+               output: 'test_plugin_namestore_sqlite.conf')
+
+configure_file(input : 'namestore-0001.sql',
+               output : 'namestore-0001.sql',
+               configuration : cdata,
+               install: true,
+               install_dir: get_option('datadir')/'gnunet'/'sql')
+
+configure_file(input : 'namestore-drop.sql',
+               output : 'namestore-drop.sql',
+               configuration : cdata,
+               install: true,
+               install_dir: get_option('datadir')/'gnunet'/'sql')
+
+if pq_dep.found()
+  shared_module('gnunet_plugin_namestore_postgres',
+          ['plugin_namestore_postgres.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunetgnsrecord_dep,
+                         libgnunetpq_dep,
+                         pq_dep],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+configure_file(copy: true,
+               input: 'test_plugin_namestore_postgres.conf',
+               output: 'test_plugin_namestore_postgres.conf')
+
+  testpluginnamestore_pq = executable ('test_plugin_namestore_postgres',
+              ['test_plugin_namestore.c'],
+              dependencies: [
+                libgnunetutil_dep
+              ],
+              include_directories: [incdir, configuration_inc],
+              install: false)
+  test('test_plugin_namestore_postgres', testpluginnamestore_pq, workdir: meson.current_build_dir(),
+     suite: 'namestore')
+endif
+
+testpluginnamestore_sq = executable ('test_plugin_namestore_sqlite',
+            ['test_plugin_namestore.c'],
+            dependencies: [
+              libgnunetutil_dep
+            ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+test('test_plugin_namestore_sqlite', testpluginnamestore_sq, workdir: meson.current_build_dir(),
+   suite: 'namestore')
+
diff --git a/src/plugin/namestore/namestore-0001.sql b/src/plugin/namestore/namestore-0001.sql
new file mode 100644
index 000000000..bd323e365
--- /dev/null
+++ b/src/plugin/namestore/namestore-0001.sql
@@ -0,0 +1,49 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+-- Check patch versioning is in place.
+SELECT _v.register_patch('namestore-0001', NULL, NULL);
+
+-------------------- Schema ----------------------------
+
+CREATE SCHEMA namestore;
+COMMENT ON SCHEMA namestore IS 'gnunet-namestore data';
+
+SET search_path TO namestore;
+
+CREATE TABLE ns098records (
+  seq BIGSERIAL PRIMARY KEY,
+  zone_private_key BYTEA NOT NULL DEFAULT '',
+  pkey BYTEA DEFAULT '',
+  rvalue BYTEA NOT NULL DEFAULT '',
+  record_count INTEGER NOT NULL DEFAULT 0,
+  record_data BYTEA NOT NULL DEFAULT '',
+  label TEXT NOT NULL DEFAULT '',
+  editor_hint TEXT NOT NULL DEFAULT '',
+  CONSTRAINT zl UNIQUE (zone_private_key,label));
+
+CREATE INDEX IF NOT EXISTS ir_pkey_reverse 
+  ON ns098records (zone_private_key,pkey);
+CREATE INDEX IF NOT EXISTS ir_pkey_iter 
+  ON ns098records (zone_private_key,seq);
+CREATE INDEX IF NOT EXISTS ir_label 
+  ON ns098records (label);
+
+
+COMMIT;
diff --git a/src/plugin/namestore/namestore-drop.sql b/src/plugin/namestore/namestore-drop.sql
new file mode 100644
index 000000000..231417af8
--- /dev/null
+++ b/src/plugin/namestore/namestore-drop.sql
@@ -0,0 +1,25 @@
+--
+-- This file is part of GNUnet
+-- Copyright (C) 2014--2022 GNUnet e.V.
+--
+-- GNUnet is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+
+SELECT _v.unregister_patch('namestore-0001');
+
+DROP SCHEMA namestore CASCADE;
+
+COMMIT;
diff --git a/src/plugin/namestore/plugin_namestore_flat.c b/src/plugin/namestore/plugin_namestore_flat.c
new file mode 100644
index 000000000..20019e1db
--- /dev/null
+++ b/src/plugin/namestore/plugin_namestore_flat.c
@@ -0,0 +1,816 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2015, 2018, 2019 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file namestore/plugin_namestore_flat.c
+ * @brief file-based namestore backend
+ * @author Martin Schanzenbach
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_namestore_plugin.h"
+#include "gnunet_gnsrecord_lib.h"
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * HashMap
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *hm;
+};
+
+
+struct FlatFileEntry
+{
+  /**
+   * Entry zone
+   */
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+
+  /**
+   * Record count.
+   */
+  uint32_t record_count;
+
+  /**
+   * Rvalue
+   */
+  uint64_t rvalue;
+
+  /**
+   * Record data
+   */
+  struct GNUNET_GNSRECORD_Data *record_data;
+
+  /**
+   * Label
+   */
+  char *label;
+};
+
+
+/**
+ * Hash contactenation of @a pkey and @a label into @a h
+ *
+ * @param pkey a key
+ * @param label a label
+ * @param[out] h initialized hash
+ */
+static void
+hash_pkey_and_label (const struct GNUNET_CRYPTO_PrivateKey *pkey,
+                     const char *label,
+                     struct GNUNET_HashCode *h)
+{
+  char *key;
+  size_t label_len;
+  size_t key_len;
+
+  label_len = strlen (label);
+  key_len = label_len + sizeof(struct GNUNET_CRYPTO_PrivateKey);
+  key = GNUNET_malloc (key_len);
+  GNUNET_memcpy (key,
+                 label,
+                 label_len);
+  GNUNET_memcpy (key + label_len,
+                 pkey,
+                 sizeof(struct GNUNET_CRYPTO_PrivateKey));
+  GNUNET_CRYPTO_hash (key,
+                      key_len,
+                      h);
+  GNUNET_free (key);
+}
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static int
+database_setup (struct Plugin *plugin)
+{
+  char *flatdbfile;
+  char *record_data;
+  char *zone_private_key;
+  char *record_data_b64;
+  char *buffer;
+  char *line;
+  char *label;
+  char *rvalue;
+  char *record_count;
+  size_t record_data_size;
+  uint64_t size;
+  struct GNUNET_HashCode hkey;
+  struct GNUNET_DISK_FileHandle *fh;
+  struct FlatFileEntry *entry;
+  struct GNUNET_DISK_MapHandle *mh;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
+                                               "namestore-flat",
+                                               "FILENAME",
+                                               &flatdbfile))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "namestore-flat",
+                               "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_test (flatdbfile))
+  {
+    if (GNUNET_OK !=
+        GNUNET_DISK_directory_create_for_file (flatdbfile))
+    {
+      GNUNET_break (0);
+      GNUNET_free (flatdbfile);
+      return GNUNET_SYSERR;
+    }
+  }
+  /* flatdbfile should be UTF-8-encoded. If it isn't, it's a bug */
+  plugin->fn = flatdbfile;
+
+  /* Load data from file into hashmap */
+  plugin->hm = GNUNET_CONTAINER_multihashmap_create (10,
+                                                     GNUNET_NO);
+  fh = GNUNET_DISK_file_open (flatdbfile,
+                              GNUNET_DISK_OPEN_CREATE
+                              | GNUNET_DISK_OPEN_READWRITE,
+                              GNUNET_DISK_PERM_USER_WRITE
+                              | GNUNET_DISK_PERM_USER_READ);
+  if (NULL == fh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to initialize file: %s.\n"),
+                flatdbfile);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_file_size (flatdbfile,
+                             &size,
+                             GNUNET_YES,
+                             GNUNET_YES))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to get filesize: %s.\n"),
+                flatdbfile);
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+  if (size > SIZE_MAX)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("File too big to map: %llu bytes.\n"),
+                (unsigned long long) size);
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+  if (0 == size)
+  {
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_OK;
+  }
+  buffer = GNUNET_DISK_file_map (fh,
+                                 &mh,
+                                 GNUNET_DISK_MAP_TYPE_READ,
+                                 size);
+  if (NULL == buffer)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                         "mmap");
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+  if ('\0' != buffer[size - 1])
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Namestore database file `%s' malformed\n"),
+                flatdbfile);
+    GNUNET_DISK_file_unmap (mh);
+    GNUNET_DISK_file_close (fh);
+    return GNUNET_SYSERR;
+  }
+
+  line = strtok (buffer, "\n");
+  while (NULL != line)
+  {
+    zone_private_key = strtok (line, ",");
+    if (NULL == zone_private_key)
+      break;
+    rvalue = strtok (NULL, ",");
+    if (NULL == rvalue)
+      break;
+    record_count = strtok (NULL, ",");
+    if (NULL == record_count)
+      break;
+    record_data_b64 = strtok (NULL, ",");
+    if (NULL == record_data_b64)
+      break;
+    label = strtok (NULL, ",");
+    if (NULL == label)
+      break;
+    line = strtok (NULL, "\n");
+    entry = GNUNET_new (struct FlatFileEntry);
+    {
+      unsigned long long ll;
+
+      if (1 != sscanf (rvalue,
+                       "%llu",
+                       &ll))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Error parsing entry\n");
+        GNUNET_free (entry);
+        break;
+      }
+      entry->rvalue = (uint64_t) ll;
+    }
+    {
+      unsigned int ui;
+
+      if (1 != sscanf (record_count,
+                       "%u",
+                       &ui))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Error parsing entry\n");
+        GNUNET_free (entry);
+        break;
+      }
+      entry->record_count = (uint32_t) ui;
+    }
+    entry->label = GNUNET_strdup (label);
+    record_data_size
+      = GNUNET_STRINGS_base64_decode (record_data_b64,
+                                      strlen (record_data_b64),
+                                      (void **) &record_data);
+    entry->record_data =
+      GNUNET_new_array (entry->record_count,
+                        struct GNUNET_GNSRECORD_Data);
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_records_deserialize (record_data_size,
+                                              record_data,
+                                              entry->record_count,
+                                              entry->record_data))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Unable to deserialize record %s\n",
+                  label);
+      GNUNET_free (entry->label);
+      GNUNET_free (entry);
+      GNUNET_free (record_data);
+      break;
+    }
+    GNUNET_free (record_data);
+
+    {
+      struct GNUNET_CRYPTO_PrivateKey *private_key;
+
+      GNUNET_STRINGS_base64_decode (zone_private_key,
+                                    strlen (zone_private_key),
+                                    (void **) &private_key);
+      entry->private_key = *private_key;
+      GNUNET_free (private_key);
+    }
+
+    hash_pkey_and_label (&entry->private_key,
+                         label,
+                         &hkey);
+    if (GNUNET_OK !=
+        GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                           &hkey,
+                                           entry,
+                                           GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+    {
+      GNUNET_free (entry);
+      GNUNET_break (0);
+    }
+  }
+  GNUNET_DISK_file_unmap (mh);
+  GNUNET_DISK_file_close (fh);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Store values in hashmap in file and free data
+ *
+ * @param plugin the plugin context
+ * @param key key in the map
+ * @param value a `struct FlatFileEntry`
+ */
+static int
+store_and_free_entries (void *cls,
+                        const struct GNUNET_HashCode *key,
+                        void *value)
+{
+  struct GNUNET_DISK_FileHandle *fh = cls;
+  struct FlatFileEntry *entry = value;
+  char *line;
+  char *zone_private_key;
+  char *record_data_b64;
+  ssize_t data_size;
+
+  (void) key;
+  GNUNET_STRINGS_base64_encode (&entry->private_key,
+                                sizeof(struct GNUNET_CRYPTO_PrivateKey),
+                                &zone_private_key);
+  data_size = GNUNET_GNSRECORD_records_get_size (entry->record_count,
+                                                 entry->record_data);
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_free (zone_private_key);
+    return GNUNET_SYSERR;
+  }
+  if (data_size >= UINT16_MAX)
+  {
+    GNUNET_break (0);
+    GNUNET_free (zone_private_key);
+    return GNUNET_SYSERR;
+  }
+  {
+    char data[data_size];
+    ssize_t ret;
+
+    ret = GNUNET_GNSRECORD_records_serialize (entry->record_count,
+                                              entry->record_data,
+                                              data_size,
+                                              data);
+    if ((ret < 0) ||
+        (data_size != ret))
+    {
+      GNUNET_break (0);
+      GNUNET_free (zone_private_key);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_STRINGS_base64_encode (data,
+                                  data_size,
+                                  &record_data_b64);
+  }
+  GNUNET_asprintf (&line,
+                   "%s,%llu,%u,%s,%s\n",
+                   zone_private_key,
+                   (unsigned long long) entry->rvalue,
+                   (unsigned int) entry->record_count,
+                   record_data_b64,
+                   entry->label);
+  GNUNET_free (record_data_b64);
+  GNUNET_free (zone_private_key);
+
+  GNUNET_DISK_file_write (fh,
+                          line,
+                          strlen (line));
+
+  GNUNET_free (line);
+  GNUNET_free (entry->label);
+  GNUNET_free (entry->record_data);
+  GNUNET_free (entry);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+
+  fh = GNUNET_DISK_file_open (plugin->fn,
+                              GNUNET_DISK_OPEN_CREATE
+                              | GNUNET_DISK_OPEN_TRUNCATE
+                              | GNUNET_DISK_OPEN_READWRITE,
+                              GNUNET_DISK_PERM_USER_WRITE
+                              | GNUNET_DISK_PERM_USER_READ);
+  if (NULL == fh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to initialize file: %s.\n"),
+                plugin->fn);
+    return;
+  }
+
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
+                                         &store_and_free_entries,
+                                         fh);
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->hm);
+  /* append 0-terminator */
+  GNUNET_DISK_file_write (fh,
+                          "",
+                          1);
+  GNUNET_DISK_file_close (fh);
+}
+
+
+/**
+ * Store a record in the datastore.  Removes any existing record in the
+ * same zone with the same name.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone_key private key of the zone
+ * @param label name that is being mapped (at most 255 characters long)
+ * @param rd_count number of entries in @a rd array
+ * @param rd array of records with data to store
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static int
+namestore_flat_store_records (void *cls,
+                              const struct
+                              GNUNET_CRYPTO_PrivateKey *zone_key,
+                              const char *label,
+                              unsigned int rd_count,
+                              const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct Plugin *plugin = cls;
+  uint64_t rvalue;
+  struct GNUNET_HashCode hkey;
+  struct FlatFileEntry *entry;
+
+  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                     UINT64_MAX);
+  hash_pkey_and_label (zone_key,
+                       label,
+                       &hkey);
+  GNUNET_CONTAINER_multihashmap_remove_all (plugin->hm,
+                                            &hkey);
+  if (0 == rd_count)
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Record deleted\n");
+    return GNUNET_OK;
+  }
+  entry = GNUNET_new (struct FlatFileEntry);
+  GNUNET_asprintf (&entry->label,
+                   label,
+                   strlen (label));
+  GNUNET_memcpy (&entry->private_key,
+                 zone_key,
+                 sizeof(struct GNUNET_CRYPTO_PrivateKey));
+  entry->rvalue = rvalue;
+  entry->record_count = rd_count;
+  entry->record_data = GNUNET_new_array (rd_count,
+                                         struct GNUNET_GNSRECORD_Data);
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    entry->record_data[i].expiration_time = rd[i].expiration_time;
+    entry->record_data[i].record_type = rd[i].record_type;
+    entry->record_data[i].flags = rd[i].flags;
+    entry->record_data[i].data_size = rd[i].data_size;
+    entry->record_data[i].data = GNUNET_malloc (rd[i].data_size);
+    GNUNET_memcpy ((char *) entry->record_data[i].data,
+                   rd[i].data,
+                   rd[i].data_size);
+  }
+  return GNUNET_CONTAINER_multihashmap_put (plugin->hm,
+                                            &hkey,
+                                            entry,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
+}
+
+
+/**
+ * Lookup records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static int
+namestore_flat_lookup_records (void *cls,
+                               const struct GNUNET_CRYPTO_PrivateKey *zone,
+                               const char *label,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct FlatFileEntry *entry;
+  struct GNUNET_HashCode hkey;
+
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  hash_pkey_and_label (zone,
+                       label,
+                       &hkey);
+  entry = GNUNET_CONTAINER_multihashmap_get (plugin->hm,
+                                             &hkey);
+
+  if (NULL == entry)
+    return GNUNET_NO;
+  if (NULL != iter)
+    iter (iter_cls,
+          1, /* zero is illegal */
+          &entry->private_key,
+          entry->label,
+          entry->record_count,
+          entry->record_data);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Closure for #iterate_zones.
+ */
+struct IterateContext
+{
+  /**
+   * How many more records should we skip before returning results?
+   */
+  uint64_t offset;
+
+  /**
+   * How many more records should we return?
+   */
+  uint64_t limit;
+
+  /**
+   * What is the position of the current entry, counting
+   * starts from 1.
+   */
+  uint64_t pos;
+
+  /**
+   * Target zone.
+   */
+  const struct GNUNET_CRYPTO_PrivateKey *zone;
+
+  /**
+   * Function to call on each record.
+   */
+  GNUNET_NAMESTORE_RecordIterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+};
+
+
+/**
+ * Helper function for #namestore_flat_iterate_records().
+ *
+ * @param cls a `struct IterateContext`
+ * @param key unused
+ * @param value a `struct FlatFileEntry`
+ * @return #GNUNET_YES to continue the iteration
+ */
+static int
+iterate_zones (void *cls,
+               const struct GNUNET_HashCode *key,
+               void *value)
+{
+  struct IterateContext *ic = cls;
+  struct FlatFileEntry *entry = value;
+
+  (void) key;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  if ((NULL != ic->zone) &&
+      (0 != GNUNET_memcmp (&entry->private_key,
+                           ic->zone)))
+    return GNUNET_YES;
+  ic->pos++;
+  if (ic->offset > 0)
+  {
+    ic->offset--;
+    return GNUNET_YES;
+  }
+  ic->iter (ic->iter_cls,
+            ic->pos,
+            (NULL == ic->zone)
+            ? &entry->private_key
+            : ic->zone,
+            entry->label,
+            entry->record_count,
+            entry->record_data);
+  ic->limit--;
+  if (0 == ic->limit)
+    return GNUNET_NO;
+  return GNUNET_YES;
+}
+
+
+/**
+ * Iterate over the results for a particular key and zone in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone hash of public key of the zone, NULL to iterate over all zones
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return to @a iter
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
+ */
+static int
+namestore_flat_iterate_records (void *cls,
+                                const struct
+                                GNUNET_CRYPTO_PrivateKey *zone,
+                                uint64_t serial,
+                                uint64_t limit,
+                                GNUNET_NAMESTORE_RecordIterator iter,
+                                void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct IterateContext ic;
+
+  ic.offset = serial;
+  ic.pos = 0;
+  ic.limit = limit;
+  ic.iter = iter;
+  ic.iter_cls = iter_cls;
+  ic.zone = zone;
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
+                                         &iterate_zones,
+                                         &ic);
+  return (0 == ic.limit) ? GNUNET_OK : GNUNET_NO;
+}
+
+
+/**
+ * Closure for #zone_to_name.
+ */
+struct ZoneToNameContext
+{
+  const struct GNUNET_CRYPTO_PrivateKey *zone;
+  const struct GNUNET_CRYPTO_PublicKey *value_zone;
+  GNUNET_NAMESTORE_RecordIterator iter;
+  void *iter_cls;
+
+  int result_found;
+};
+
+
+static int
+zone_to_name (void *cls,
+              const struct GNUNET_HashCode *key,
+              void *value)
+{
+  struct ZoneToNameContext *ztn = cls;
+  struct FlatFileEntry *entry = value;
+
+  (void) key;
+  if (0 != GNUNET_memcmp (&entry->private_key,
+                          ztn->zone))
+    return GNUNET_YES;
+
+  for (unsigned int i = 0; i < entry->record_count; i++)
+  {
+    if (GNUNET_NO ==
+        GNUNET_GNSRECORD_is_zonekey_type (entry->record_data[i].record_type))
+      continue;
+    if (ztn->value_zone->type != entry->record_data[i].record_type)
+      continue;
+    if (0 == memcmp (ztn->value_zone,
+                     entry->record_data[i].data,
+                     entry->record_data[i].data_size))
+    {
+      ztn->iter (ztn->iter_cls,
+                 i + 1,    /* zero is illegal! */
+                 &entry->private_key,
+                 entry->label,
+                 entry->record_count,
+                 entry->record_data);
+      ztn->result_found = GNUNET_YES;
+    }
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Look for an existing PKEY delegation record for a given public key.
+ * Returns at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone to look up in, never NULL
+ * @param value_zone public key of the target zone (value), never NULL
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static int
+namestore_flat_zone_to_name (void *cls,
+                             const struct GNUNET_CRYPTO_PrivateKey *zone,
+                             const struct
+                             GNUNET_CRYPTO_PublicKey *value_zone,
+                             GNUNET_NAMESTORE_RecordIterator iter,
+                             void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  struct ZoneToNameContext ztn = {
+    .iter = iter,
+    .iter_cls = iter_cls,
+    .zone = zone,
+    .value_zone = value_zone,
+    .result_found = GNUNET_NO
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Performing reverse lookup for `%s'\n",
+              GNUNET_GNSRECORD_z2s (value_zone));
+  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
+                                         &zone_to_name,
+                                         &ztn);
+  return ztn.result_found;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_namestore_flat_init (void *cls)
+{
+  static struct Plugin plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMESTORE_PluginFunctions *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin,
+          0,
+          sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  if (GNUNET_OK != database_setup (&plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMESTORE_PluginFunctions);
+  api->cls = &plugin;
+  api->store_records = &namestore_flat_store_records;
+  api->iterate_records = &namestore_flat_iterate_records;
+  api->zone_to_name = &namestore_flat_zone_to_name;
+  api->lookup_records = &namestore_flat_lookup_records;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("Flat file database running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namestore_flat_done (void *cls)
+{
+  struct GNUNET_NAMESTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Flat file plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namestore_flat.c */
diff --git a/src/plugin/namestore/plugin_namestore_postgres.c b/src/plugin/namestore/plugin_namestore_postgres.c
new file mode 100644
index 000000000..ccf84dfa6
--- /dev/null
+++ b/src/plugin/namestore/plugin_namestore_postgres.c
@@ -0,0 +1,786 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2013, 2016-2018 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+    SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file namestore/plugin_namestore_postgres.c
+ * @brief postgres-based namestore backend
+ * @author Christian Grothoff
+ */
+#include "gnunet_db_lib.h"
+#include "gnunet_namestore_plugin.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_pq_lib.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "namestore-postgres", __VA_ARGS__)
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Our configuration.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Postgres database handle.
+   */
+  struct GNUNET_PQ_Context *dbh;
+
+  /**
+   * Database is prepared and ready
+   */
+  bool ready;
+};
+
+
+/**
+ * Initialize the database connections and associated data structures (create
+ * tables and indices as needed as well).
+ *
+ * @param cls the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_create_tables (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_Context *dbh;
+
+  dbh = GNUNET_PQ_connect_with_cfg (plugin->cfg,
+                                    "namestore-postgres",
+                                    "namestore-",
+                                    NULL,
+                                    NULL);
+  if (NULL == dbh)
+    return GNUNET_SYSERR;
+  GNUNET_PQ_disconnect (dbh);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Drop existing namestore tables.
+ *
+ * @param cls the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_drop_tables (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_PQ_Context *dbh;
+  enum GNUNET_GenericReturnValue ret;
+
+  dbh = GNUNET_PQ_connect_with_cfg (plugin->cfg,
+                                    "namestore-postgres",
+                                    NULL,
+                                    NULL,
+                                    NULL);
+  if (NULL == dbh)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to connect to database\n");
+    return GNUNET_SYSERR;
+  }
+  ret = GNUNET_PQ_exec_sql (dbh,
+                            "namestore-drop");
+  GNUNET_PQ_disconnect (dbh);
+  return ret;
+}
+
+
+static enum GNUNET_GenericReturnValue
+database_prepare (struct Plugin *plugin)
+{
+  enum GNUNET_GenericReturnValue ret;
+
+  if (plugin->ready)
+    return GNUNET_OK;
+  {
+    struct GNUNET_PQ_PreparedStatement ps[] = {
+      GNUNET_PQ_make_prepare ("store_records",
+                              "INSERT INTO namestore.ns098records"
+                              " (zone_private_key, pkey, rvalue, record_count, record_data, label, editor_hint)"
+                              " VALUES ($1, $2, $3, $4, $5, $6, '')"
+                              " ON CONFLICT ON CONSTRAINT zl"
+                              " DO UPDATE"
+                              "    SET pkey=$2,rvalue=$3,record_count=$4,record_data=$5"
+                              "    WHERE ns098records.zone_private_key = $1"
+                              "          AND ns098records.label = $6"),
+      GNUNET_PQ_make_prepare ("delete_records",
+                              "DELETE FROM namestore.ns098records "
+                              "WHERE zone_private_key=$1 AND label=$2"),
+      GNUNET_PQ_make_prepare ("zone_to_name",
+                              "SELECT seq,record_count,record_data,label,editor_hint FROM namestore.ns098records"
+                              " WHERE zone_private_key=$1 AND pkey=$2"),
+      GNUNET_PQ_make_prepare ("iterate_zone",
+                              "SELECT seq,record_count,record_data,label,editor_hint FROM namestore.ns098records "
+                              "WHERE zone_private_key=$1 AND seq > $2 ORDER BY seq ASC LIMIT $3"),
+      GNUNET_PQ_make_prepare ("iterate_all_zones",
+                              "SELECT seq,record_count,record_data,label,editor_hint,zone_private_key"
+                              " FROM namestore.ns098records WHERE seq > $1 ORDER BY seq ASC LIMIT $2"),
+      GNUNET_PQ_make_prepare ("lookup_label",
+                              "SELECT seq,record_count,record_data,label,editor_hint "
+                              "FROM namestore.ns098records WHERE zone_private_key=$1 AND label=$2"),
+      GNUNET_PQ_make_prepare ("edit_set",
+                              "UPDATE namestore.ns098records"
+                              " SET editor_hint=$3"
+                              " FROM namestore.ns098records AS old_ns098records"
+                              " WHERE ns098records.zone_private_key=$1 AND ns098records.label=$2"
+                              " RETURNING ns098records.seq,ns098records.record_count,ns098records.record_data,ns098records.label,old_ns098records.editor_hint "),
+      GNUNET_PQ_make_prepare ("clear_editor_hint",
+                              "UPDATE namestore.ns098records"
+                              " SET editor_hint=$4"
+                              " WHERE zone_private_key=$1 AND label=$2 AND editor_hint=$3"),
+      GNUNET_PQ_PREPARED_STATEMENT_END
+    };
+
+    ret = GNUNET_PQ_prepare_statements (plugin->dbh,
+                                        ps);
+  }
+  if (GNUNET_OK != ret)
+    return ret;
+  plugin->ready = true;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+database_connect (struct Plugin *plugin)
+{
+  struct GNUNET_PQ_ExecuteStatement ess[] = {
+    GNUNET_PQ_make_try_execute ("SET synchronous_commit TO off"),
+    GNUNET_PQ_EXECUTE_STATEMENT_END
+  };
+  struct GNUNET_PQ_ExecuteStatement *es;
+
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (plugin->cfg,
+                                            "namestore-postgres",
+                                            "ASYNC_COMMIT"))
+    es = &ess[0];
+  else
+    es = &ess[1];
+
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (plugin->cfg,
+                                            "namestore-postgres",
+                                            "INIT_ON_CONNECT"))
+  {
+    if (GNUNET_OK !=
+        namestore_postgres_create_tables (plugin))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to create tables\n");
+      return GNUNET_SYSERR;
+    }
+  }
+  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->cfg,
+                                            "namestore-postgres",
+                                            NULL,
+                                            es,
+                                            NULL);
+  if (NULL == plugin->dbh)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Store a record in the datastore.  Removes any existing record in the
+ * same zone with the same name.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone_key private key of the zone
+ * @param label name that is being mapped (at most 255 characters long)
+ * @param rd_count number of entries in @a rd array
+ * @param rd array of records with data to store
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_store_records (void *cls,
+                                  const struct
+                                  GNUNET_CRYPTO_PrivateKey *zone_key,
+                                  const char *label,
+                                  unsigned int rd_count,
+                                  const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_CRYPTO_PublicKey pkey;
+  uint64_t rvalue;
+  uint32_t rd_count32 = (uint32_t) rd_count;
+  ssize_t data_size;
+
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  memset (&pkey,
+          0,
+          sizeof(pkey));
+  for (unsigned int i = 0; i < rd_count; i++)
+    if (GNUNET_YES ==
+        GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
+    {
+      GNUNET_break (GNUNET_OK ==
+                    GNUNET_GNSRECORD_identity_from_data (rd[i].data,
+                                                         rd[i].data_size,
+                                                         rd[i].record_type,
+                                                         &pkey));
+      break;
+    }
+  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                     UINT64_MAX);
+  data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                 rd);
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (data_size >= UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  /* if record set is empty, delete existing records */
+  if (0 == rd_count)
+  {
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone_key),
+      GNUNET_PQ_query_param_string (label),
+      GNUNET_PQ_query_param_end
+    };
+    enum GNUNET_DB_QueryStatus res;
+
+    res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "delete_records",
+                                              params);
+    if ((GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != res) &&
+        (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS != res))
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "postgres",
+                     "Record deleted\n");
+    return GNUNET_OK;
+  }
+  /* otherwise, UPSERT (i.e. UPDATE if exists, otherwise INSERT) */
+  {
+    char data[data_size];
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone_key),
+      GNUNET_PQ_query_param_auto_from_type (&pkey),
+      GNUNET_PQ_query_param_uint64 (&rvalue),
+      GNUNET_PQ_query_param_uint32 (&rd_count32),
+      GNUNET_PQ_query_param_fixed_size (data, data_size),
+      GNUNET_PQ_query_param_string (label),
+      GNUNET_PQ_query_param_end
+    };
+    enum GNUNET_DB_QueryStatus res;
+    ssize_t ret;
+
+    ret = GNUNET_GNSRECORD_records_serialize (rd_count,
+                                              rd,
+                                              data_size,
+                                              data);
+    if ((ret < 0) ||
+        (data_size != ret))
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+
+    res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "store_records",
+                                              params);
+    if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != res)
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Closure for #parse_result_call_iterator.
+ */
+struct ParserContext
+{
+  /**
+   * Function to call for each result.
+   */
+  GNUNET_NAMESTORE_RecordIterator iter;
+
+  /**
+   * Closure for @e iter.
+   */
+  void *iter_cls;
+
+  /**
+   * Zone key, NULL if part of record.
+   */
+  const struct GNUNET_CRYPTO_PrivateKey *zone_key;
+
+  /**
+   * Number of results still to return (counted down by
+   * number of results given to iterator).
+   */
+  uint64_t limit;
+};
+
+
+/**
+ * A statement has been run.  We should evaluate the result, and if possible
+ * call the @a iter in @a cls with the result.
+ *
+ * @param cls closure of type `struct ParserContext *`
+ * @param res the postgres result
+ * @param num_results the number of results in @a result
+ */
+static void
+parse_result_call_iterator (void *cls,
+                            PGresult *res,
+                            unsigned int num_results)
+{
+  struct ParserContext *pc = cls;
+
+  if (NULL == pc->iter)
+    return;   /* no need to do more work */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got %d results from PQ.\n", num_results);
+  for (unsigned int i = 0; i < num_results; i++)
+  {
+    uint64_t serial;
+    void *data;
+    size_t data_size;
+    uint32_t record_count;
+    char *label;
+    char *editor_hint;
+    struct GNUNET_CRYPTO_PrivateKey zk;
+    struct GNUNET_PQ_ResultSpec rs_with_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
+      GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
+      GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
+      GNUNET_PQ_result_spec_string ("label", &label),
+      GNUNET_PQ_result_spec_string ("editor_hint", &editor_hint),
+      GNUNET_PQ_result_spec_auto_from_type ("zone_private_key", &zk),
+      GNUNET_PQ_result_spec_end
+    };
+    struct GNUNET_PQ_ResultSpec rs_without_zone[] = {
+      GNUNET_PQ_result_spec_uint64 ("seq", &serial),
+      GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
+      GNUNET_PQ_result_spec_variable_size ("record_data", &data, &data_size),
+      GNUNET_PQ_result_spec_string ("label", &label),
+      GNUNET_PQ_result_spec_string ("editor_hint", &editor_hint),
+      GNUNET_PQ_result_spec_end
+    };
+    struct GNUNET_PQ_ResultSpec *rs;
+
+    rs = (NULL == pc->zone_key) ? rs_with_zone : rs_without_zone;
+    if (GNUNET_YES !=
+        GNUNET_PQ_extract_result (res,
+                                  rs,
+                                  i))
+    {
+      GNUNET_break (0);
+      return;
+    }
+
+    if (record_count > 64 * 1024)
+    {
+      /* sanity check, don't stack allocate far too much just
+         because database might contain a large value here */
+      GNUNET_break (0);
+      GNUNET_PQ_cleanup_result (rs);
+      return;
+    }
+
+    {
+      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (record_count)];
+
+      GNUNET_assert (0 != serial);
+      if (GNUNET_OK !=
+          GNUNET_GNSRECORD_records_deserialize (data_size,
+                                                data,
+                                                record_count,
+                                                rd))
+      {
+        GNUNET_break (0);
+        GNUNET_PQ_cleanup_result (rs);
+        return;
+      }
+      pc->iter (pc->iter_cls,
+                serial,
+                editor_hint,
+                (NULL == pc->zone_key) ? &zk : pc->zone_key,
+                label,
+                record_count,
+                rd);
+    }
+    GNUNET_PQ_cleanup_result (rs);
+  }
+  pc->limit -= num_results;
+}
+
+
+/**
+ * Lookup records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_lookup_records (void *cls,
+                                   const struct
+                                   GNUNET_CRYPTO_PrivateKey *zone,
+                                   const char *label,
+                                   GNUNET_NAMESTORE_RecordIterator iter,
+                                   void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (zone),
+    GNUNET_PQ_query_param_string (label),
+    GNUNET_PQ_query_param_end
+  };
+  struct ParserContext pc;
+  enum GNUNET_DB_QueryStatus res;
+
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  pc.iter = iter;
+  pc.iter_cls = iter_cls;
+  pc.zone_key = zone;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "lookup_label",
+                                              params,
+                                              &parse_result_call_iterator,
+                                              &pc);
+  if (res < 0)
+    return GNUNET_SYSERR;
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static int
+namestore_postgres_clear_editor_hint (void *cls,
+                                      const char *editor_hint,
+                                      const char *editor_hint_replacement,
+                                      const struct
+                                      GNUNET_CRYPTO_PrivateKey *zone,
+                                      const char *label)
+{
+
+  struct Plugin *plugin = cls;
+  struct GNUNET_CRYPTO_PublicKey pkey;
+
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  memset (&pkey,
+          0,
+          sizeof(pkey));
+  {
+    struct GNUNET_PQ_QueryParam params[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone),
+      GNUNET_PQ_query_param_string (label),
+      GNUNET_PQ_query_param_string (editor_hint),
+      GNUNET_PQ_query_param_string (editor_hint_replacement),
+      GNUNET_PQ_query_param_end
+    };
+    enum GNUNET_DB_QueryStatus res;
+
+    res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
+                                              "clear_editor_hint",
+                                              params);
+    if ((GNUNET_DB_STATUS_SUCCESS_NO_RESULTS != res) &&
+        (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != res))
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Edit records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static int
+namestore_postgres_edit_records (void *cls,
+                                 const char *editor_hint,
+                                 const struct
+                                 GNUNET_CRYPTO_PrivateKey *zone,
+                                 const char *label,
+                                 GNUNET_NAMESTORE_RecordIterator iter,
+                                 void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (zone),
+    GNUNET_PQ_query_param_string (label),
+    GNUNET_PQ_query_param_string (editor_hint),
+    GNUNET_PQ_query_param_end
+  };
+  struct ParserContext pc;
+  enum GNUNET_DB_QueryStatus res;
+
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  pc.iter = iter;
+  pc.iter_cls = iter_cls;
+  pc.zone_key = zone;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "edit_set",
+                                              params,
+                                              &parse_result_call_iterator,
+                                              &pc);
+  if (res < 0)
+    return GNUNET_SYSERR;
+  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over the results for a particular key and zone in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone hash of public key of the zone, NULL to iterate over all zones
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to fetch
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_iterate_records (void *cls,
+                                    const struct
+                                    GNUNET_CRYPTO_PrivateKey *zone,
+                                    uint64_t serial,
+                                    uint64_t limit,
+                                    GNUNET_NAMESTORE_RecordIterator iter,
+                                    void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  enum GNUNET_DB_QueryStatus res;
+  struct ParserContext pc;
+
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  pc.iter = iter;
+  pc.iter_cls = iter_cls;
+  pc.zone_key = zone;
+  pc.limit = limit;
+  if (NULL == zone)
+  {
+    struct GNUNET_PQ_QueryParam params_without_zone[] = {
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
+      GNUNET_PQ_query_param_end
+    };
+
+    res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                                "iterate_all_zones",
+                                                params_without_zone,
+                                                &parse_result_call_iterator,
+                                                &pc);
+  }
+  else
+  {
+    struct GNUNET_PQ_QueryParam params_with_zone[] = {
+      GNUNET_PQ_query_param_auto_from_type (zone),
+      GNUNET_PQ_query_param_uint64 (&serial),
+      GNUNET_PQ_query_param_uint64 (&limit),
+      GNUNET_PQ_query_param_end
+    };
+
+    res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                                "iterate_zone",
+                                                params_with_zone,
+                                                &parse_result_call_iterator,
+                                                &pc);
+  }
+  if (res < 0)
+    return GNUNET_SYSERR;
+
+  if ((GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res) ||
+      (pc.limit > 0))
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Look for an existing PKEY delegation record for a given public key.
+ * Returns at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone to look up in, never NULL
+ * @param value_zone public key of the target zone (value), never NULL
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+namestore_postgres_zone_to_name (void *cls,
+                                 const struct
+                                 GNUNET_CRYPTO_PrivateKey *zone,
+                                 const struct
+                                 GNUNET_CRYPTO_PublicKey *value_zone,
+                                 GNUNET_NAMESTORE_RecordIterator iter,
+                                 void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (zone),
+    GNUNET_PQ_query_param_auto_from_type (value_zone),
+    GNUNET_PQ_query_param_end
+  };
+  enum GNUNET_DB_QueryStatus res;
+  struct ParserContext pc;
+
+  pc.iter = iter;
+  pc.iter_cls = iter_cls;
+  pc.zone_key = zone;
+  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
+                                              "zone_to_name",
+                                              params,
+                                              &parse_result_call_iterator,
+                                              &pc);
+  if (res < 0)
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ *
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  GNUNET_PQ_disconnect (plugin->dbh);
+  plugin->dbh = NULL;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the `struct GNUNET_NAMESTORE_PluginEnvironment*`
+ * @return NULL on error, othrewise the plugin context
+ */
+void *
+libgnunet_plugin_namestore_postgres_init (void *cls)
+{
+  struct Plugin *plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMESTORE_PluginFunctions *api;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->cfg = cfg;
+  if (GNUNET_OK != database_connect (plugin))
+  {
+    database_shutdown (plugin);
+    GNUNET_free (plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMESTORE_PluginFunctions);
+  api->cls = plugin;
+  api->create_tables = &namestore_postgres_create_tables;
+  api->drop_tables = &namestore_postgres_drop_tables;
+  api->store_records = &namestore_postgres_store_records;
+  api->iterate_records = &namestore_postgres_iterate_records;
+  api->zone_to_name = &namestore_postgres_zone_to_name;
+  api->lookup_records = &namestore_postgres_lookup_records;
+  api->edit_records = &namestore_postgres_edit_records;
+  api->clear_editor_hint = &namestore_postgres_clear_editor_hint;
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Postgres namestore plugin running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namestore_postgres_done (void *cls)
+{
+  struct GNUNET_NAMESTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Postgres namestore plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namestore_postgres.c */
diff --git a/src/plugin/namestore/plugin_namestore_sqlite.c b/src/plugin/namestore/plugin_namestore_sqlite.c
new file mode 100644
index 000000000..50c2f5728
--- /dev/null
+++ b/src/plugin/namestore/plugin_namestore_sqlite.c
@@ -0,0 +1,1030 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2009-2017 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file namestore/plugin_namestore_sqlite.c
+ * @brief sqlite-based namestore backend
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_namestore_plugin.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_sq_lib.h"
+#include <sqlite3.h>
+
+/**
+ * After how many ms "busy" should a DB operation fail for good?  A
+ * low value makes sure that we are more responsive to requests
+ * (especially PUTs).  A high value guarantees a higher success rate
+ * (SELECTs in iterate can take several seconds despite LIMIT=1).
+ *
+ * The default value of 1s should ensure that users do not experience
+ * huge latencies while at the same time allowing operations to
+ * succeed with reasonable probability.
+ */
+#define BUSY_TIMEOUT_MS 1000
+
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' on file 'filename'
+ * with the message given by strerror(errno).
+ */
+#define LOG_SQLITE(db, level, cmd) do { \
+          GNUNET_log_from (level,                                             \
+                           "namestore-sqlite", _ (                            \
+                             "`%s' failed at %s:%d with error: %s\n"), \
+                           cmd,                                               \
+                           __FILE__, __LINE__,                                \
+                           sqlite3_errmsg (                                   \
+                             db->dbh));                         \
+} while (0)
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "namestore-sqlite", __VA_ARGS__)
+
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * Statements prepared, we are ready to go if true.
+   */
+  bool ready;
+
+  /**
+   * Native SQLite database handle.
+   */
+  sqlite3 *dbh;
+
+  /**
+   * Precompiled SQL to store records.
+   */
+  sqlite3_stmt *store_records;
+
+  /**
+   * Precompiled SQL to deltete existing records.
+   */
+  sqlite3_stmt *delete_records;
+
+  /**
+   * Precompiled SQL for iterate records within a zone.
+   */
+  sqlite3_stmt *iterate_zone;
+
+  /**
+   * Precompiled SQL for iterate all records within all zones.
+   */
+  sqlite3_stmt *iterate_all_zones;
+
+  /**
+   * Precompiled SQL to for reverse lookup based on PKEY.
+   */
+  sqlite3_stmt *zone_to_name;
+
+  /**
+   * Precompiled SQL to lookup records based on label.
+   */
+  sqlite3_stmt *lookup_label;
+
+  /**
+   * Precompiled SQL to clear editor hint.
+   */
+  sqlite3_stmt *editor_hint_clear;
+};
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+database_prepare (struct Plugin *plugin)
+{
+  if (plugin->ready)
+    return GNUNET_OK;
+  struct GNUNET_SQ_ExecuteStatement es[] = {
+    GNUNET_SQ_make_try_execute ("PRAGMA temp_store=MEMORY"),
+    GNUNET_SQ_make_try_execute ("PRAGMA synchronous=NORMAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA legacy_file_format=OFF"),
+    GNUNET_SQ_make_try_execute ("PRAGMA auto_vacuum=INCREMENTAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA encoding=\"UTF-8\""),
+    GNUNET_SQ_make_try_execute ("PRAGMA locking_mode=NORMAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA journal_mode=WAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA page_size=4092"),
+    GNUNET_SQ_EXECUTE_STATEMENT_END
+  };
+  struct GNUNET_SQ_PrepareStatement ps[] = {
+    GNUNET_SQ_make_prepare ("INSERT INTO ns098records "
+                            "(zone_private_key,pkey,rvalue,record_count,record_data,"
+                            "label,editor_hint)"
+                            " VALUES (?, ?, ?, ?, ?, ?, '')",
+                            &plugin->store_records),
+    GNUNET_SQ_make_prepare ("DELETE FROM ns098records "
+                            "WHERE zone_private_key=? AND label=?",
+                            &plugin->delete_records),
+    GNUNET_SQ_make_prepare (
+      "SELECT uid,record_count,record_data,label,editor_hint"
+      " FROM ns098records"
+      " WHERE zone_private_key=? AND pkey=?",
+      &plugin->zone_to_name),
+    GNUNET_SQ_make_prepare (
+      "SELECT uid,record_count,record_data,label,editor_hint"
+      " FROM ns098records"
+      " WHERE zone_private_key=? AND uid > ?"
+      " ORDER BY uid ASC"
+      " LIMIT ?",
+      &plugin->iterate_zone),
+    GNUNET_SQ_make_prepare (
+      "SELECT uid,record_count,record_data,label,editor_hint,zone_private_key"
+      " FROM ns098records"
+      " WHERE uid > ?"
+      " ORDER BY uid ASC"
+      " LIMIT ?",
+      &plugin->iterate_all_zones),
+    GNUNET_SQ_make_prepare ("UPDATE ns098records"
+                            " SET editor_hint=?"
+                            " FROM ns098records AS old_ns098records"
+                            " WHERE ns098records.zone_private_key=? AND ns098records.label=?"
+                            " RETURNING ns098records.uid,ns098records.record_count,ns098records.record_data,ns098records.label,editor_hint ",
+                            &plugin->lookup_label),
+    GNUNET_SQ_make_prepare ("UPDATE ns098records"
+                            " SET editor_hint=?"
+                            " FROM ns098records AS old_ns098records"
+                            " WHERE ns098records.zone_private_key=? AND ns098records.label=? AND ns098records.editor_hint=?",
+                            &plugin->editor_hint_clear),
+    GNUNET_SQ_PREPARE_END
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_exec_statements (plugin->dbh,
+                                 es))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Failed to setup database with: `%s'\n"),
+         sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_SQ_prepare (plugin->dbh,
+                         ps))
+  {
+    GNUNET_break (0);
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Failed to setup database with: `%s'\n"),
+         sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  plugin->ready = GNUNET_YES;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  int result;
+  sqlite3_stmt *stmt;
+
+  if (NULL != plugin->store_records)
+    sqlite3_finalize (plugin->store_records);
+  if (NULL != plugin->delete_records)
+    sqlite3_finalize (plugin->delete_records);
+  if (NULL != plugin->iterate_zone)
+    sqlite3_finalize (plugin->iterate_zone);
+  if (NULL != plugin->iterate_all_zones)
+    sqlite3_finalize (plugin->iterate_all_zones);
+  if (NULL != plugin->zone_to_name)
+    sqlite3_finalize (plugin->zone_to_name);
+  if (NULL != plugin->lookup_label)
+    sqlite3_finalize (plugin->lookup_label);
+  if (NULL != plugin->editor_hint_clear)
+    sqlite3_finalize (plugin->editor_hint_clear);
+  result = sqlite3_close (plugin->dbh);
+  if (result == SQLITE_BUSY)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _ (
+           "Tried to close sqlite without finalizing all prepared statements.\n"));
+    stmt = sqlite3_next_stmt (plugin->dbh,
+                              NULL);
+    while (NULL != stmt)
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "sqlite",
+                       "Closing statement %p\n",
+                       stmt);
+      result = sqlite3_finalize (stmt);
+      if (result != SQLITE_OK)
+        GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
+                         "sqlite",
+                         "Failed to close statement %p: %d\n",
+                         stmt,
+                         result);
+      stmt = sqlite3_next_stmt (plugin->dbh,
+                                NULL);
+    }
+    result = sqlite3_close (plugin->dbh);
+  }
+  if (SQLITE_OK != result)
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_close");
+
+}
+
+
+/**
+ * Store a record in the datastore.  Removes any existing record in the
+ * same zone with the same name.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone_key private key of the zone
+ * @param label name that is being mapped (at most 255 characters long)
+ * @param rd_count number of entries in @a rd array
+ * @param rd array of records with data to store
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_store_records (void *cls,
+                                const struct
+                                GNUNET_CRYPTO_PrivateKey *zone_key,
+                                const char *label,
+                                unsigned int rd_count,
+                                const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct Plugin *plugin = cls;
+  int n;
+  struct GNUNET_CRYPTO_PublicKey pkey;
+  uint64_t rvalue;
+  ssize_t data_size;
+
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  memset (&pkey,
+          0,
+          sizeof(pkey));
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Checking if `%d' is zonekey type\n",
+         rd[i].record_type);
+
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
+    {
+      GNUNET_break (GNUNET_YES ==
+                    GNUNET_GNSRECORD_identity_from_data (rd[i].data,
+                                                         rd[i].data_size,
+                                                         rd[i].record_type,
+                                                         &pkey));
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Storing delegation zone record value `%s'\n",
+           GNUNET_GNSRECORD_z2s (&pkey));
+
+      break;
+    }
+  }
+  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                     UINT64_MAX);
+  data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                 rd);
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (data_size > 64 * 65536)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  {
+    /* First delete 'old' records */
+    char data[data_size];
+    struct GNUNET_SQ_QueryParam dparams[] = {
+      GNUNET_SQ_query_param_auto_from_type (zone_key),
+      GNUNET_SQ_query_param_string (label),
+      GNUNET_SQ_query_param_end
+    };
+    ssize_t ret;
+
+    ret = GNUNET_GNSRECORD_records_serialize (rd_count,
+                                              rd,
+                                              data_size,
+                                              data);
+    if ((ret < 0) ||
+        (data_size != ret))
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    if (GNUNET_OK !=
+        GNUNET_SQ_bind (plugin->delete_records,
+                        dparams))
+    {
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                  "sqlite3_bind_XXXX");
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->delete_records);
+      return GNUNET_SYSERR;
+    }
+    n = sqlite3_step (plugin->delete_records);
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->delete_records);
+
+    if (0 != rd_count)
+    {
+      uint32_t rd_count32 = (uint32_t) rd_count;
+      struct GNUNET_SQ_QueryParam sparams[] = {
+        GNUNET_SQ_query_param_auto_from_type (zone_key),
+        GNUNET_SQ_query_param_auto_from_type (&pkey),
+        GNUNET_SQ_query_param_uint64 (&rvalue),
+        GNUNET_SQ_query_param_uint32 (&rd_count32),
+        GNUNET_SQ_query_param_fixed_size (data, data_size),
+        GNUNET_SQ_query_param_string (label),
+        GNUNET_SQ_query_param_end
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_SQ_bind (plugin->store_records,
+                          sparams))
+      {
+        LOG_SQLITE (plugin,
+                    GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                    "sqlite3_bind_XXXX");
+        GNUNET_SQ_reset (plugin->dbh,
+                         plugin->store_records);
+        return GNUNET_SYSERR;
+      }
+      n = sqlite3_step (plugin->store_records);
+      GNUNET_SQ_reset (plugin->dbh,
+                       plugin->store_records);
+    }
+  }
+  switch (n)
+  {
+  case SQLITE_DONE:
+    if (0 != rd_count)
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "sqlite",
+                       "Record stored\n");
+    else
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                       "sqlite",
+                       "Record deleted\n");
+    return GNUNET_OK;
+
+  case SQLITE_BUSY:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_NO;
+
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * The given 'sqlite' statement has been prepared to be run.
+ * It will return a record which should be given to the iterator.
+ * Runs the statement and parses the returned record.
+ *
+ * @param plugin plugin context
+ * @param stmt to run (and then clean up)
+ * @param zone_key private key of the zone
+ * @param limit maximum number of results to fetch
+ * @param iter iterator to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+get_records_and_call_iterator (struct Plugin *plugin,
+                               sqlite3_stmt *stmt,
+                               const struct
+                               GNUNET_CRYPTO_PrivateKey *zone_key,
+                               uint64_t limit,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
+{
+  int ret;
+  int sret;
+
+  ret = GNUNET_OK;
+  for (uint64_t i = 0; i < limit; i++)
+  {
+    sret = sqlite3_step (stmt);
+
+    if (SQLITE_DONE == sret)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Iteration done (no results)\n");
+      ret = GNUNET_NO;
+      break;
+    }
+    if (SQLITE_ROW != sret)
+    {
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite_step");
+      ret = GNUNET_SYSERR;
+      break;
+    }
+
+    {
+      uint64_t seq;
+      uint32_t record_count;
+      size_t data_size;
+      void *data;
+      char *label;
+      char *editor_hint;
+      struct GNUNET_CRYPTO_PrivateKey zk;
+      struct GNUNET_SQ_ResultSpec rs[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_string (&editor_hint),
+        GNUNET_SQ_result_spec_end
+      };
+      struct GNUNET_SQ_ResultSpec rsx[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_uint32 (&record_count),
+        GNUNET_SQ_result_spec_variable_size (&data,
+                                             &data_size),
+        GNUNET_SQ_result_spec_string (&label),
+        GNUNET_SQ_result_spec_string (&editor_hint),
+        GNUNET_SQ_result_spec_auto_from_type (&zk),
+        GNUNET_SQ_result_spec_end
+      };
+
+      ret = GNUNET_SQ_extract_result (stmt,
+                                      (NULL == zone_key)
+                                      ? rsx
+                                      : rs);
+      if ((GNUNET_OK != ret) ||
+          (record_count > 64 * 1024))
+      {
+        /* sanity check, don't stack allocate far too much just
+           because database might contain a large value here */
+        GNUNET_break (0);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+      else
+      {
+        struct GNUNET_GNSRECORD_Data rd[record_count];
+
+        GNUNET_assert (0 != seq);
+        if (GNUNET_OK !=
+            GNUNET_GNSRECORD_records_deserialize (data_size,
+                                                  data,
+                                                  record_count,
+                                                  rd))
+        {
+          GNUNET_break (0);
+          ret = GNUNET_SYSERR;
+          break;
+        }
+        else
+        {
+          if (NULL != zone_key)
+            zk = *zone_key;
+          if (NULL != iter)
+            iter (iter_cls,
+                  seq,
+                  editor_hint,
+                  &zk,
+                  label,
+                  record_count,
+                  rd);
+        }
+      }
+      GNUNET_SQ_cleanup_result (rs);
+    }
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   stmt);
+  return ret;
+}
+
+
+/**
+ * Lookup records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+lookup_records (void *cls,
+                const struct
+                GNUNET_CRYPTO_PrivateKey *zone,
+                const char *label,
+                GNUNET_NAMESTORE_RecordIterator iter,
+                void *iter_cls,
+                const char *editor_hint)
+{
+  struct Plugin *plugin = cls;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_string (editor_hint),
+    GNUNET_SQ_query_param_auto_from_type (zone),
+    GNUNET_SQ_query_param_string (label),
+    GNUNET_SQ_query_param_end
+  };
+
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->lookup_label,
+                      params))
+  {
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->lookup_label);
+    return GNUNET_SYSERR;
+  }
+  return get_records_and_call_iterator (plugin,
+                                        plugin->lookup_label,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
+}
+
+
+/**
+ * Lookup records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_lookup_records (void *cls,
+                                 const struct
+                                 GNUNET_CRYPTO_PrivateKey *zone,
+                                 const char *label,
+                                 GNUNET_NAMESTORE_RecordIterator iter,
+                                 void *iter_cls)
+{
+  return lookup_records (cls, zone, label, iter, iter_cls, "");
+}
+
+
+/**
+ * Clear editor hint.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param editor_hint editor hint to clear
+ * @param editor_hint_repl editor hint to replace the old with (optional)
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_editor_hint_clear (void *cls,
+                                    const char *editor_hint,
+                                    const char *editor_hint_replacement,
+                                    const struct
+                                    GNUNET_CRYPTO_PrivateKey *zone,
+                                    const char *label)
+{
+  struct Plugin *plugin = cls;
+  int n;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_string ((NULL == editor_hint_replacement) ? "":
+                                  editor_hint_replacement),
+    GNUNET_SQ_query_param_auto_from_type (zone),
+    GNUNET_SQ_query_param_string (label),
+    GNUNET_SQ_query_param_string (editor_hint),
+    GNUNET_SQ_query_param_end
+  };
+
+  if (NULL == zone)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->editor_hint_clear,
+                      params))
+  {
+    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->editor_hint_clear);
+    return GNUNET_SYSERR;
+  }
+  n = sqlite3_step (plugin->editor_hint_clear);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->store_records);
+  switch (n)
+  {
+  case SQLITE_DONE:
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                     "sqlite",
+                     "Editor hint cleared\n");
+    return GNUNET_OK;
+
+  case SQLITE_BUSY:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_NO;
+
+  default:
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Lookup records in the datastore for which we are the authority.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone
+ * @param label name of the record in the zone
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO for no results, else #GNUNET_SYSERR
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_edit_records (void *cls,
+                               const char *editor_hint,
+                               const struct
+                               GNUNET_CRYPTO_PrivateKey *zone,
+                               const char *label,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
+{
+  return lookup_records (cls, zone, label, iter, iter_cls, editor_hint);
+}
+
+
+/**
+ * Iterate over the results for a particular key and zone in the
+ * datastore.  Will return at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone hash of public key of the zone, NULL to iterate over all zones
+ * @param serial serial number to exclude in the list of all matching records
+ * @param limit maximum number of results to return
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no more results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_iterate_records (void *cls,
+                                  const struct
+                                  GNUNET_CRYPTO_PrivateKey *zone,
+                                  uint64_t serial,
+                                  uint64_t limit,
+                                  GNUNET_NAMESTORE_RecordIterator iter,
+                                  void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt;
+  int err;
+
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  if (NULL == zone)
+  {
+    struct GNUNET_SQ_QueryParam params[] = {
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
+      GNUNET_SQ_query_param_end
+    };
+
+    stmt = plugin->iterate_all_zones;
+    err = GNUNET_SQ_bind (stmt,
+                          params);
+  }
+  else
+  {
+    struct GNUNET_SQ_QueryParam params[] = {
+      GNUNET_SQ_query_param_auto_from_type (zone),
+      GNUNET_SQ_query_param_uint64 (&serial),
+      GNUNET_SQ_query_param_uint64 (&limit),
+      GNUNET_SQ_query_param_end
+    };
+
+    stmt = plugin->iterate_zone;
+    err = GNUNET_SQ_bind (stmt,
+                          params);
+  }
+  if (GNUNET_OK != err)
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     stmt);
+    return GNUNET_SYSERR;
+  }
+  return get_records_and_call_iterator (plugin,
+                                        stmt,
+                                        zone,
+                                        limit,
+                                        iter,
+                                        iter_cls);
+}
+
+
+/**
+ * Look for an existing PKEY delegation record for a given public key.
+ * Returns at most one result to the iterator.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param zone private key of the zone to look up in, never NULL
+ * @param value_zone public key of the target zone (value), never NULL
+ * @param iter function to call with the result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_NO if there were no results, #GNUNET_SYSERR on error
+ */
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_zone_to_name (void *cls,
+                               const struct GNUNET_CRYPTO_PrivateKey *zone,
+                               const struct
+                               GNUNET_CRYPTO_PublicKey *value_zone,
+                               GNUNET_NAMESTORE_RecordIterator iter,
+                               void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  GNUNET_assert (GNUNET_OK == database_prepare (plugin));
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_auto_from_type (zone),
+    GNUNET_SQ_query_param_auto_from_type (value_zone),
+    GNUNET_SQ_query_param_end
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->zone_to_name,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->zone_to_name);
+    return GNUNET_SYSERR;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Performing reverse lookup for `%s'\n",
+       GNUNET_GNSRECORD_z2s (value_zone));
+  return get_records_and_call_iterator (plugin,
+                                        plugin->zone_to_name,
+                                        zone,
+                                        1,
+                                        iter,
+                                        iter_cls);
+}
+
+
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_create_tables (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_SQ_ExecuteStatement es[] = {
+    GNUNET_SQ_make_try_execute ("PRAGMA temp_store=MEMORY"),
+    GNUNET_SQ_make_try_execute ("PRAGMA synchronous=NORMAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA legacy_file_format=OFF"),
+    GNUNET_SQ_make_try_execute ("PRAGMA auto_vacuum=INCREMENTAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA encoding=\"UTF-8\""),
+    GNUNET_SQ_make_try_execute ("PRAGMA locking_mode=NORMAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA journal_mode=WAL"),
+    GNUNET_SQ_make_try_execute ("PRAGMA page_size=4092"),
+    GNUNET_SQ_make_execute ("CREATE TABLE IF NOT EXISTS ns098records ("
+                            " uid INTEGER PRIMARY KEY,"
+                            " zone_private_key BLOB NOT NULL,"
+                            " pkey BLOB,"
+                            " rvalue INT8 NOT NULL,"
+                            " record_count INT NOT NULL,"
+                            " record_data BLOB NOT NULL,"
+                            " label TEXT NOT NULL,"
+                            " editor_hint TEXT NOT NULL"
+                            ")"),
+    GNUNET_SQ_make_try_execute ("CREATE INDEX ir_pkey_reverse "
+                                "ON ns098records (zone_private_key,pkey)"),
+    GNUNET_SQ_make_try_execute ("CREATE INDEX ir_pkey_iter "
+                                "ON ns098records (zone_private_key,uid)"),
+    GNUNET_SQ_EXECUTE_STATEMENT_END
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_exec_statements (plugin->dbh,
+                                 es))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to setup database with: `%s'\n",
+                sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static enum GNUNET_GenericReturnValue
+namestore_sqlite_drop_tables (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_SQ_ExecuteStatement es_drop[] = {
+    GNUNET_SQ_make_execute ("DROP TABLE IF EXISTS ns098records"),
+    GNUNET_SQ_EXECUTE_STATEMENT_END
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_exec_statements (plugin->dbh,
+                                 es_drop))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to drop database with: `%s'\n",
+                sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static enum GNUNET_GenericReturnValue
+database_connect (struct Plugin *plugin)
+{
+  char *sqlite_filename;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
+                                               "namestore-sqlite",
+                                               "FILENAME",
+                                               &sqlite_filename))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "namestore-sqlite",
+                               "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_DISK_file_test (sqlite_filename))
+  {
+    if (GNUNET_OK !=
+        GNUNET_DISK_directory_create_for_file (sqlite_filename))
+    {
+      GNUNET_break (0);
+      GNUNET_free (sqlite_filename);
+      return GNUNET_SYSERR;
+    }
+  }
+
+  /* Open database and precompile statements */
+  if ((NULL == plugin->dbh) &&
+      (SQLITE_OK != sqlite3_open (sqlite_filename,
+                                  &plugin->dbh)))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Unable to initialize SQLite: %s.\n"),
+         sqlite3_errmsg (plugin->dbh));
+    GNUNET_free (sqlite_filename);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (sqlite_filename);
+  GNUNET_break (SQLITE_OK ==
+                sqlite3_busy_timeout (plugin->dbh,
+                                      BUSY_TIMEOUT_MS));
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (plugin->cfg,
+                                            "namestore-sqlite",
+                                            "INIT_ON_CONNECT"))
+  {
+    if (GNUNET_OK !=
+        namestore_sqlite_create_tables (plugin))
+      return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_namestore_sqlite_init (void *cls)
+{
+  struct Plugin *plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_NAMESTORE_PluginFunctions *api;
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->cfg = cfg;
+  if (GNUNET_OK != database_connect (plugin))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Database could not be connected to.\n");
+    GNUNET_free (plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_NAMESTORE_PluginFunctions);
+  api->cls = plugin;
+  api->store_records = &namestore_sqlite_store_records;
+  api->iterate_records = &namestore_sqlite_iterate_records;
+  api->zone_to_name = &namestore_sqlite_zone_to_name;
+  api->lookup_records = &namestore_sqlite_lookup_records;
+  api->create_tables = &namestore_sqlite_create_tables;
+  api->drop_tables = &namestore_sqlite_drop_tables;
+  api->edit_records = &namestore_sqlite_edit_records;
+  api->clear_editor_hint = &namestore_sqlite_editor_hint_clear;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       _ ("SQlite database running\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_namestore_sqlite_done (void *cls)
+{
+  struct GNUNET_NAMESTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "SQlite plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_namestore_sqlite.c */
diff --git a/src/plugin/namestore/test_plugin_namestore.c b/src/plugin/namestore/test_plugin_namestore.c
new file mode 100644
index 000000000..db943ab9a
--- /dev/null
+++ b/src/plugin/namestore/test_plugin_namestore.c
@@ -0,0 +1,217 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/*
+ * @file namestore/test_plugin_namestore.c
+ * @brief Test for the namestore plugins
+ * @author Christian Grothoff
+ */
+#include "gnunet_util_lib.h"
+#include "gnunet_namestore_plugin.h"
+
+#define TEST_RECORD_TYPE GNUNET_DNSPARSER_TYPE_TXT
+
+static int ok;
+
+/**
+ * Name of plugin under test.
+ */
+static const char *plugin_name;
+
+#ifndef DARWIN // #5582
+/**
+ * Function called when the service shuts down.  Unloads our namestore
+ * plugin.
+ *
+ * @param api api to unload
+ */
+static void
+unload_plugin (struct GNUNET_NAMESTORE_PluginFunctions *api)
+{
+  char *libname;
+
+  GNUNET_asprintf (&libname, "libgnunet_plugin_namestore_%s", plugin_name);
+  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
+  GNUNET_free (libname);
+}
+#endif
+
+/**
+ * Load the namestore plugin.
+ *
+ * @param cfg configuration to pass
+ * @return NULL on error
+ */
+static struct GNUNET_NAMESTORE_PluginFunctions *
+load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_NAMESTORE_PluginFunctions *ret;
+  char *libname;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Loading `%s' namestore plugin\n",
+              plugin_name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_namestore_%s",
+                   plugin_name);
+  if (NULL == (ret = GNUNET_PLUGIN_load (libname, (void *) cfg)))
+  {
+    fprintf (stderr,
+             "Failed to load plugin `%s'!\n",
+             plugin_name);
+    GNUNET_free (libname);
+    return NULL;
+  }
+  GNUNET_free (libname);
+  if (GNUNET_OK != ret->drop_tables (ret->cls))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (GNUNET_OK != ret->create_tables (ret->cls))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  return ret;
+}
+
+
+static void
+test_record (void *cls,
+             uint64_t seq,
+             const char *editor_hint,
+             const struct GNUNET_CRYPTO_PrivateKey *private_key,
+             const char *label,
+             unsigned int rd_count,
+             const struct GNUNET_GNSRECORD_Data *rd)
+{
+  int *idp = cls;
+  int id = *idp;
+  struct GNUNET_CRYPTO_PrivateKey tzone_private_key;
+  char tname[64];
+  unsigned int trd_count = 1 + (id % 1024);
+
+  GNUNET_snprintf (tname, sizeof(tname), "a%u", (unsigned int) id);
+  GNUNET_assert (trd_count == rd_count);
+  for (unsigned int i = 0; i < trd_count; i++)
+  {
+    GNUNET_assert (rd[i].data_size == id % 10);
+    GNUNET_assert (0 == memcmp ("Hello World", rd[i].data, id % 10));
+    GNUNET_assert (rd[i].record_type == TEST_RECORD_TYPE);
+    GNUNET_assert (rd[i].flags == 0);
+  }
+  memset (&tzone_private_key, (id % 241), sizeof(tzone_private_key));
+  GNUNET_assert (0 == strcmp (label, tname));
+  GNUNET_assert (0 == GNUNET_memcmp (&tzone_private_key, private_key));
+}
+
+
+static void
+get_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+{
+  GNUNET_assert (
+    GNUNET_OK ==
+    nsp->iterate_records (nsp->cls, NULL, 0, 1, &test_record, &id));
+}
+
+
+static void
+put_record (struct GNUNET_NAMESTORE_PluginFunctions *nsp, int id)
+{
+  struct GNUNET_CRYPTO_PrivateKey zone_private_key;
+  char label[64];
+  unsigned int rd_count = 1 + (id % 1024);
+  struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
+  struct GNUNET_CRYPTO_EcdsaSignature signature;
+
+  GNUNET_snprintf (label, sizeof(label), "a%u", (unsigned int) id);
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    rd[i].data = "Hello World";
+    rd[i].data_size = id % 10;
+    rd[i].expiration_time =
+      GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_MINUTES).abs_value_us;
+    rd[i].record_type = TEST_RECORD_TYPE;
+    rd[i].flags = 0;
+  }
+  memset (&zone_private_key, (id % 241), sizeof(zone_private_key));
+  memset (&signature, (id % 243), sizeof(signature));
+  GNUNET_assert (
+    GNUNET_OK ==
+    nsp->store_records (nsp->cls, &zone_private_key, label, rd_count, rd));
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_NAMESTORE_PluginFunctions *nsp;
+
+  ok = 0;
+  nsp = load_plugin (cfg);
+  if (NULL == nsp)
+  {
+    fprintf (
+      stderr,
+      "%s",
+      "Failed to initialize namestore.  Database likely not setup, skipping test.\n");
+    return;
+  }
+  put_record (nsp, 1);
+  get_record (nsp, 1);
+#ifndef DARWIN // #5582
+  unload_plugin (nsp);
+#endif
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  char cfg_name[PATH_MAX];
+  char *const xargv[] = { "test-plugin-namestore", "-c", cfg_name, NULL };
+  struct GNUNET_GETOPT_CommandLineOption options[] =
+  { GNUNET_GETOPT_OPTION_END };
+
+  GNUNET_log_setup ("test-plugin-namestore", "WARNING", NULL);
+  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+  GNUNET_snprintf (cfg_name,
+                   sizeof(cfg_name),
+                   "test_plugin_namestore_%s.conf",
+                   plugin_name);
+  GNUNET_DISK_purge_cfg_dir (cfg_name, "GNUNET_TMP");
+  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1,
+                      xargv,
+                      "test-plugin-namestore",
+                      "nohelp",
+                      options,
+                      &run,
+                      NULL);
+  GNUNET_DISK_purge_cfg_dir (cfg_name, "GNUNET_TMP");
+  if (ok != 0)
+    fprintf (stderr, "Missed some testcases: %d\n", ok);
+  return ok;
+}
+
+
+/* end of test_plugin_namestore.c */
diff --git a/src/plugin/namestore/test_plugin_namestore_postgres.conf b/src/plugin/namestore/test_plugin_namestore_postgres.conf
new file mode 100644
index 000000000..140d54623
--- /dev/null
+++ b/src/plugin/namestore/test_plugin_namestore_postgres.conf
@@ -0,0 +1,4 @@
+[namestore-postgres]
+CONFIG = connect_timeout=10 dbname=gnunetcheck
+INIT_ON_CONNECT = YES
+#TEMPORARY_TABLE = YES
diff --git a/src/plugin/namestore/test_plugin_namestore_sqlite.conf b/src/plugin/namestore/test_plugin_namestore_sqlite.conf
new file mode 100644
index 000000000..365198db2
--- /dev/null
+++ b/src/plugin/namestore/test_plugin_namestore_sqlite.conf
@@ -0,0 +1,3 @@
+[namestore-sqlite]
+FILENAME = $GNUNET_TMP/gnunet-test-plugin-namestore-sqlite/sqlite.db
+INIT_ON_CONNECT = YES
diff --git a/src/plugin/namestore/test_plugin_rest_namestore.sh b/src/plugin/namestore/test_plugin_rest_namestore.sh
new file mode 100755
index 000000000..4f117db8b
--- /dev/null
+++ b/src/plugin/namestore/test_plugin_rest_namestore.sh
@@ -0,0 +1,131 @@
+#!/bin/sh
+trap "gnunet-arm -e -c test_gns_lookup.conf" SIGINT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+        exit 77
+fi
+
+rm -rf `gnunet-config -c test_namestore_api.conf -f -s paths -o GNUNET_TEST_HOME`
+
+namestore_link="http://localhost:7776/namestore"
+wrong_link="http://localhost:7776/namestoreandmore"
+
+curl_get () {
+  #$1 is link
+  #$2 is grep
+  resp=$(curl -v "$1" 2>&1)
+  cache="$(echo $resp | grep "$2")"
+  #echo $cache
+  if [ "" = "$cache" ]
+  then
+    echo "Error in get response: $resp, expected $2"
+    gnunet-arm -e -c test_namestore_api.conf
+    exit 1
+  fi
+}
+
+curl_post () {
+  #$1 is link
+  #$2 is data
+  #$3 is grep
+  resp=$(curl -v -X "POST" "$1" --data "$2" 2>&1)
+  cache="$(echo $resp | grep "$3")"
+  #echo $cache
+  if [ "" = "$cache" ]
+  then
+    echo "Error in post response: $resp ($2), expected $3"
+    gnunet-arm -e -c test_namestore_api.conf
+    exit 1
+  fi
+}
+
+curl_delete () {
+  #$1 is link
+  #$2 is grep
+  resp=$(curl -v -X "DELETE" "$1" 2>&1)
+  cache="$(echo $resp | grep "$2")"
+  #echo $cache
+  if [ "" = "$cache" ]
+  then
+    echo "Error in delete response: $resp, expected $2"
+    gnunet-arm -e -c test_namestore_api.conf
+    exit 1
+  fi
+}
+
+# curl_put () {
+#     #$1 is link
+#     #$2 is data
+#     #$3 is grep
+#     cache="$(curl -v -X "PUT" "$1" --data "$2" 2>&1 | grep "$3")"
+#     #echo $cache
+#     if [ "" == "$cache" ]
+#     then
+#         exit 1
+#     fi
+# }
+
+#Test subsystem default identity
+
+TEST_ID="test"
+gnunet-arm -s -c test_namestore_api.conf
+#Test GET
+gnunet-identity -C $TEST_ID -c test_namestore_api.conf
+test="$(gnunet-namestore -D -z $TEST_ID -c test_namestore_api.conf)"
+name=$TEST_ID
+public="$(gnunet-identity -d -c test_namestore_api.conf | grep $TEST_ID | awk 'NR==1{print $3}')"
+echo "$name $public"
+gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY" -c test_namestore_api.conf
+sleep 1
+gnunet-arm -i rest -c test_namestore_api.conf
+sleep 1
+curl_get "${namestore_link}/$name" "HTTP/1.1 200 OK"
+curl_get "${namestore_link}/$public" "error"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf
+
+#Test POST with NAME
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "relative_expiration": 86400000000, "is_relative_expiration": false, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":"test_entry"}' "HTTP/1.1 204 No Content"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+# invalid values
+curl_post "${namestore_link}/$name" '{"data": [{"value":"HVX38H2CB7WJM0WCPWT9CFX6GASMYJVR65RN75SJSSKAYVYXHMRGxxx", "record_type":"PKEY", "relative_expiration": 86400000000, "is_relative_expiration": false, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":"test_entry"}' "error"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+
+curl_post "${namestore_link}/$name" '{"data": [{"value":"", "record_type":"PKEY", "relative_expiration": 86400000000,"flag":0,"record_name"}]:"test_entry"}' "error"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+curl_post "${namestore_link}/$name" '{"data": [{"record_type":"PKEY", "relative_expiration": 86400000000,"flag":0}],"record_name":"test_entry"}' "error"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+#expirations
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "relative_expiration":0, "is_relative_expiration": true, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":"test_entry"}' "HTTP/1.1 204"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "relative_expiration":864000000000000, "is_relative_expiration": true, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":"test_entry"}' "HTTP/1.1 204"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "expiration_time_missing":"1d", "is_relative_expiration": false, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":"test_entry"}' "error"
+gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf > /dev/null 2>&1
+
+#record_name
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "relative_expiration":86400000000, "is_relative_expiration": false, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name":""}' "error"
+gnunet-namestore -z $name -d -n "test_entry"  -c test_namestore_api.conf > /dev/null 2>&1
+curl_post "${namestore_link}/$name" '{"data": [{"value":"000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8", "record_type":"PKEY", "relative_expiration":"1d", "is_relative_expiration": false, "is_supplemental": false, "is_shadow": false, "is_private": false}],"record_name_missing":"test_entry"}' "error"
+gnunet-namestore -z $name -d -n "test_entry"  -c test_namestore_api.conf > /dev/null 2>&1
+
+#Test DELETE
+gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY"  -c test_namestore_api.conf
+curl_delete "${namestore_link}/$name/test_entry" "HTTP/1.1 204" 
+
+gnunet-arm -e  -c test_namestore_api.conf
+exit 0;
+
diff --git a/src/plugin/peerstore/Makefile.am b/src/plugin/peerstore/Makefile.am
new file mode 100644
index 000000000..7202aef84
--- /dev/null
+++ b/src/plugin/peerstore/Makefile.am
@@ -0,0 +1,46 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+if USE_COVERAGE
+  AM_CFLAGS = -fprofile-arcs -ftest-coverage
+endif
+
+if HAVE_SQLITE
+SQLITE_PLUGIN = libgnunet_plugin_peerstore_sqlite.la
+SQLITE_TESTS = test_plugin_peerstore_sqlite
+libgnunet_plugin_peerstore_sqlite_la_SOURCES = \
+  plugin_peerstore_sqlite.c
+libgnunet_plugin_peerstore_sqlite_la_LIBADD = \
+  $(top_builddir)/src/lib/sq/libgnunetsq.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(XLIBS) -lsqlite3 \
+  $(LTLIBINTL)
+libgnunet_plugin_peerstore_sqlite_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+endif
+
+plugin_LTLIBRARIES = \
+  $(SQLITE_PLUGIN)
+
+test_plugin_peerstore_sqlite_SOURCES = \
+  test_plugin_peerstore.c
+test_plugin_peerstore_sqlite_LDADD = \
+        $(top_builddir)/src/service/testing/libgnunettesting.la \
+        $(top_builddir)/src/lib/util/libgnunetutil.la
+
+check_PROGRAMS = \
+ $(SQLITE_TESTS)
+
+EXTRA_DIST = \
+ test_plugin_peerstore_sqlite.conf
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
diff --git a/src/plugin/peerstore/meson.build b/src/plugin/peerstore/meson.build
new file mode 100644
index 000000000..1d22ca798
--- /dev/null
+++ b/src/plugin/peerstore/meson.build
@@ -0,0 +1,9 @@
+shared_module('gnunet_plugin_peerstore_sqlite',
+        ['plugin_peerstore_sqlite.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetsq_dep,
+                       sqlite_dep],
+        include_directories: [incdir,
+                              configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
diff --git a/src/plugin/peerstore/plugin_peerstore_sqlite.c b/src/plugin/peerstore/plugin_peerstore_sqlite.c
new file mode 100644
index 000000000..c7132bd85
--- /dev/null
+++ b/src/plugin/peerstore/plugin_peerstore_sqlite.c
@@ -0,0 +1,743 @@
+/*
+ * This file is part of GNUnet
+ * Copyright (C) 2013, 2017 GNUnet e.V.
+ *
+ * GNUnet is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License,
+ * or (at your option) any later version.
+ *
+ * GNUnet is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file peerstore/plugin_peerstore_sqlite.c
+ * @brief sqlite-based peerstore backend
+ * @author Omar Tarabai
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_peerstore_plugin.h"
+#include "gnunet_peerstore_service.h"
+#include "gnunet_sq_lib.h"
+#include "../../service/peerstore/peerstore.h"
+#include <sqlite3.h>
+
+/**
+ * After how many ms "busy" should a DB operation fail for good?  A
+ * low value makes sure that we are more responsive to requests
+ * (especially PUTs).  A high value guarantees a higher success rate
+ * (SELECTs in iterate can take several seconds despite LIMIT=1).
+ *
+ * The default value of 1s should ensure that users do not experience
+ * huge latencies while at the same time allowing operations to
+ * succeed with reasonable probability.
+ */
+#define BUSY_TIMEOUT_MS 1000
+
+/**
+ * Log an error message at log-level 'level' that indicates
+ * a failure of the command 'cmd' on file 'filename'
+ * with the message given by strerror(errno).
+ */
+#define LOG_SQLITE(db, level, cmd) do { GNUNET_log_from (level, \
+                                                         "peerstore-sqlite", _ ( \
+                                                           "`%s' failed at %s:%d with error: %s\n"), \
+                                                         cmd, \
+                                                         __FILE__, __LINE__, \
+                                                         sqlite3_errmsg ( \
+                                                           db->dbh)); \
+} while (0)
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "peerstore-sqlite", __VA_ARGS__)
+
+/**
+ * Context for all functions in this plugin.
+ */
+struct Plugin
+{
+  /**
+   * Configuration handle
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Database filename.
+   */
+  char *fn;
+
+  /**
+   * Native SQLite database handle.
+   */
+  sqlite3 *dbh;
+
+  /**
+   * Precompiled SQL for inserting into peerstoredata
+   */
+  sqlite3_stmt *insert_peerstoredata;
+
+  /**
+   * Precompiled SQL for selecting from peerstoredata
+   */
+  sqlite3_stmt *select_peerstoredata;
+
+  /**
+   * Precompiled SQL for selecting from peerstoredata
+   */
+  sqlite3_stmt *select_peerstoredata_by_pid;
+
+  /**
+   * Precompiled SQL for selecting from peerstoredata
+   */
+  sqlite3_stmt *select_peerstoredata_by_key;
+
+  /**
+   * Precompiled SQL for selecting from peerstoredata
+   */
+  sqlite3_stmt *select_peerstoredata_by_all;
+
+  /**
+   * Precompiled SQL for deleting expired
+   * records from peerstoredata
+   */
+  sqlite3_stmt *expire_peerstoredata;
+
+  /**
+   * Precompiled SQL for deleting records
+   * with given key
+   */
+  sqlite3_stmt *delete_peerstoredata;
+};
+
+
+/**
+ * Delete records with the given key
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param sub_system name of sub system
+ * @param peer Peer identity (can be NULL)
+ * @param key entry key string (can be NULL)
+ * @return number of deleted records, #GNUNE_SYSERR on error
+ */
+static int
+peerstore_sqlite_delete_records (void *cls,
+                                 const char *sub_system,
+                                 const struct GNUNET_PeerIdentity *peer,
+                                 const char *key)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt = plugin->delete_peerstoredata;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_string (sub_system),
+    GNUNET_SQ_query_param_auto_from_type (peer),
+    GNUNET_SQ_query_param_string (key),
+    GNUNET_SQ_query_param_end
+  };
+  int ret;
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind");
+    GNUNET_SQ_reset (plugin->dbh,
+                     stmt);
+    return GNUNET_SYSERR;
+  }
+  if (SQLITE_DONE !=
+      sqlite3_step (stmt))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    ret = GNUNET_SYSERR;
+  }
+  else
+  {
+    ret = sqlite3_changes (plugin->dbh);
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   stmt);
+  return ret;
+}
+
+
+/**
+ * Delete expired records (expiry < now)
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param now time to use as reference
+ * @param cont continuation called with the number of records expired
+ * @param cont_cls continuation closure
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and cont is not
+ * called
+ */
+static int
+peerstore_sqlite_expire_records (void *cls, struct GNUNET_TIME_Absolute now,
+                                 GNUNET_PEERSTORE_Continuation cont,
+                                 void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt = plugin->expire_peerstoredata;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_end
+  };
+
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind");
+    GNUNET_SQ_reset (plugin->dbh,
+                     stmt);
+    return GNUNET_SYSERR;
+  }
+  if (SQLITE_DONE != sqlite3_step (stmt))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+    GNUNET_SQ_reset (plugin->dbh,
+                     stmt);
+    return GNUNET_SYSERR;
+  }
+  if (NULL != cont)
+    cont (cont_cls,
+          sqlite3_changes (plugin->dbh));
+  GNUNET_SQ_reset (plugin->dbh,
+                   stmt);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over the records given an optional peer id
+ * and/or key.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param sub_system name of sub system
+ * @param peer Peer identity (can be NULL)
+ * @param key entry key string (can be NULL)
+ * @param iter function to call asynchronously with the results, terminated
+ * by a NULL result
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and iter is not
+ * called
+ */
+static int
+peerstore_sqlite_iterate_records (void *cls,
+                                  const char *sub_system,
+                                  const struct GNUNET_PeerIdentity *peer,
+                                  const char *key,
+                                  uint64_t serial,
+                                  uint64_t limit,
+                                  GNUNET_PEERSTORE_PluginProcessor iter,
+                                  void *iter_cls)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt;
+  int err = 0;
+  int sret;
+  int ret;
+  uint64_t seq;
+  struct GNUNET_PEERSTORE_Record rec;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Executing iterate request on sqlite db.\n");
+  if (NULL == peer)
+  {
+    if (NULL == key)
+    {
+      struct GNUNET_SQ_QueryParam params[] = {
+        GNUNET_SQ_query_param_string (sub_system),
+        GNUNET_SQ_query_param_uint64 (&serial),
+        GNUNET_SQ_query_param_uint64 (&limit),
+        GNUNET_SQ_query_param_end
+      };
+
+      stmt = plugin->select_peerstoredata;
+      err = GNUNET_SQ_bind (stmt,
+                            params);
+    }
+    else
+    {
+      struct GNUNET_SQ_QueryParam params[] = {
+        GNUNET_SQ_query_param_string (sub_system),
+        GNUNET_SQ_query_param_string (key),
+        GNUNET_SQ_query_param_uint64 (&serial),
+        GNUNET_SQ_query_param_uint64 (&limit),
+        GNUNET_SQ_query_param_end
+      };
+
+      stmt = plugin->select_peerstoredata_by_key;
+      err = GNUNET_SQ_bind (stmt,
+                            params);
+    }
+  }
+  else
+  {
+    if (NULL == key)
+    {
+      struct GNUNET_SQ_QueryParam params[] = {
+        GNUNET_SQ_query_param_string (sub_system),
+        GNUNET_SQ_query_param_auto_from_type (peer),
+        GNUNET_SQ_query_param_uint64 (&serial),
+        GNUNET_SQ_query_param_uint64 (&limit),
+        GNUNET_SQ_query_param_end
+      };
+
+      stmt = plugin->select_peerstoredata_by_pid;
+      err = GNUNET_SQ_bind (stmt,
+                            params);
+    }
+    else
+    {
+      struct GNUNET_SQ_QueryParam params[] = {
+        GNUNET_SQ_query_param_string (sub_system),
+        GNUNET_SQ_query_param_auto_from_type (peer),
+        GNUNET_SQ_query_param_string (key),
+        GNUNET_SQ_query_param_uint64 (&serial),
+        GNUNET_SQ_query_param_uint64 (&limit),
+        GNUNET_SQ_query_param_end
+      };
+
+      stmt = plugin->select_peerstoredata_by_all;
+      err = GNUNET_SQ_bind (stmt,
+                            params);
+    }
+  }
+
+  if (GNUNET_OK != err)
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind_XXXX");
+    GNUNET_SQ_reset (plugin->dbh,
+                     stmt);
+    return GNUNET_SYSERR;
+  }
+
+  err = 0;
+  ret = GNUNET_OK;
+  for (uint64_t i = 0; i < limit; i++)
+  {
+    sret = sqlite3_step (stmt);
+    if (SQLITE_DONE == sret)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Iteration done (no results)\n");
+      ret = GNUNET_NO;
+      break;
+    }
+    if (SQLITE_ROW != sret)
+    {
+      LOG_SQLITE (plugin,
+                  GNUNET_ERROR_TYPE_ERROR,
+                  "sqlite_step");
+      ret = GNUNET_SYSERR;
+      break;
+    }
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Returning a matched record.\n");
+      struct GNUNET_SQ_ResultSpec rs[] = {
+        GNUNET_SQ_result_spec_uint64 (&seq),
+        GNUNET_SQ_result_spec_string (&rec.sub_system),
+        GNUNET_SQ_result_spec_auto_from_type (&rec.peer),
+        GNUNET_SQ_result_spec_string (&rec.key),
+        GNUNET_SQ_result_spec_variable_size (&rec.value, &rec.value_size),
+        GNUNET_SQ_result_spec_absolute_time (&rec.expiry),
+        GNUNET_SQ_result_spec_end
+      };
+
+      if (GNUNET_OK !=
+          GNUNET_SQ_extract_result (stmt,
+                                    rs))
+      {
+        GNUNET_break (0);
+        break;
+      }
+      if (NULL != iter)
+        iter (iter_cls,
+              seq,
+              &rec,
+              NULL);
+      GNUNET_SQ_cleanup_result (rs);
+    }
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   stmt);
+  return ret;
+}
+
+
+/**
+ * Store a record in the peerstore.
+ * Key is the combination of sub system and peer identity.
+ * One key can store multiple values.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param sub_system name of the GNUnet sub system responsible
+ * @param peer peer identity
+ * @param key record key string
+ * @param value value to be stored
+ * @param size size of value to be stored
+ * @param expiry absolute time after which the record is (possibly) deleted
+ * @param options options related to the store operation
+ * @param cont continuation called when record is stored
+ * @param cont_cls continuation closure
+ * @return #GNUNET_OK on success, else #GNUNET_SYSERR and cont is not called
+ */
+static int
+peerstore_sqlite_store_record (void *cls,
+                               const char *sub_system,
+                               const struct GNUNET_PeerIdentity *peer,
+                               const char *key,
+                               const void *value,
+                               size_t size,
+                               struct GNUNET_TIME_Absolute expiry,
+                               enum GNUNET_PEERSTORE_StoreOption options,
+                               GNUNET_PEERSTORE_Continuation cont,
+                               void *cont_cls)
+{
+  struct Plugin *plugin = cls;
+  sqlite3_stmt *stmt;
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_string (sub_system),
+    GNUNET_SQ_query_param_auto_from_type (peer),
+    GNUNET_SQ_query_param_string (key),
+    GNUNET_SQ_query_param_fixed_size (value, size),
+    GNUNET_SQ_query_param_absolute_time (&expiry),
+    GNUNET_SQ_query_param_end
+  };
+
+  if (GNUNET_PEERSTORE_STOREOPTION_REPLACE == options)
+  {
+    peerstore_sqlite_delete_records (cls,
+                                     sub_system,
+                                     peer,
+                                     key);
+  }
+
+  stmt = plugin->insert_peerstoredata;
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (stmt,
+                      params))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_bind");
+    GNUNET_assert (0);
+  }
+  if (SQLITE_DONE != sqlite3_step (stmt))
+  {
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                "sqlite3_step");
+  }
+  GNUNET_SQ_reset (plugin->dbh,
+                   stmt);
+  if (NULL != cont)
+    cont (cont_cls,
+          GNUNET_OK);
+  return GNUNET_OK;
+}
+
+
+/**
+ * @brief Prepare a SQL statement
+ *
+ * @param dbh handle to the database
+ * @param sql SQL statement, UTF-8 encoded
+ * @return 0 on success
+ */
+static int
+sql_exec (sqlite3 *dbh,
+          const char *sql)
+{
+  int result;
+
+  result = sqlite3_exec (dbh,
+                         sql,
+                         NULL,
+                         NULL,
+                         NULL);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Executed `%s' / %d\n",
+       sql,
+       result);
+  if (SQLITE_OK != result)
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Error executing SQL query: %s\n  %s\n"),
+         sqlite3_errmsg (dbh),
+         sql);
+  return result;
+}
+
+
+/**
+ * @brief Prepare a SQL statement
+ *
+ * @param dbh handle to the database
+ * @param sql SQL statement, UTF-8 encoded
+ * @param stmt set to the prepared statement
+ * @return 0 on success
+ */
+static int
+sql_prepare (sqlite3 *dbh,
+             const char *sql,
+             sqlite3_stmt **stmt)
+{
+  char *tail;
+  int result;
+
+  result = sqlite3_prepare_v2 (dbh,
+                               sql,
+                               strlen (sql),
+                               stmt,
+                               (const char **) &tail);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Prepared `%s' / %p: %d\n",
+       sql,
+       *stmt,
+       result);
+  if (SQLITE_OK != result)
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Error preparing SQL query: %s\n  %s\n"),
+         sqlite3_errmsg (dbh),
+         sql);
+  return result;
+}
+
+
+/**
+ * Initialize the database connections and associated
+ * data structures (create tables and indices
+ * as needed as well).
+ *
+ * @param plugin the plugin context (state for this module)
+ * @return #GNUNET_OK on success
+ */
+static int
+database_setup (struct Plugin *plugin)
+{
+  char *filename;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
+                                               "peerstore-sqlite",
+                                               "FILENAME",
+                                               &filename))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "peerstore-sqlite",
+                               "FILENAME");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK != GNUNET_DISK_file_test (filename))
+  {
+    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (filename))
+    {
+      GNUNET_break (0);
+      GNUNET_free (filename);
+      return GNUNET_SYSERR;
+    }
+  }
+  /* filename should be UTF-8-encoded. If it isn't, it's a bug */
+  plugin->fn = filename;
+  /* Open database and precompile statements */
+  if (SQLITE_OK != sqlite3_open (plugin->fn,
+                                 &plugin->dbh))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Unable to initialize SQLite: %s.\n"),
+         sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  sql_exec (plugin->dbh,
+            "PRAGMA temp_store=MEMORY");
+  sql_exec (plugin->dbh,
+            "PRAGMA synchronous=OFF");
+  sql_exec (plugin->dbh,
+            "PRAGMA legacy_file_format=OFF");
+  sql_exec (plugin->dbh,
+            "PRAGMA auto_vacuum=INCREMENTAL");
+  sql_exec (plugin->dbh,
+            "PRAGMA encoding=\"UTF-8\"");
+  sql_exec (plugin->dbh,
+            "PRAGMA page_size=4096");
+  sqlite3_busy_timeout (plugin->dbh,
+                        BUSY_TIMEOUT_MS);
+  /* Create tables */
+  sql_exec (plugin->dbh,
+            "CREATE TABLE IF NOT EXISTS peerstoredata (\n"
+            "  uid INTEGER PRIMARY KEY,"
+            "  sub_system TEXT NOT NULL,\n"
+            "  peer_id BLOB NOT NULL,\n"
+            "  key TEXT NOT NULL,\n"
+            "  value BLOB NULL,\n"
+            "  expiry INT8 NOT NULL" ");");
+  /* Create Indices */
+  if (SQLITE_OK !=
+      sqlite3_exec (plugin->dbh,
+                    "CREATE INDEX IF NOT EXISTS peerstoredata_key_index ON peerstoredata (sub_system, peer_id, key, uid)",
+                    NULL,
+                    NULL,
+                    NULL))
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         _ ("Unable to create indices: %s.\n"),
+         sqlite3_errmsg (plugin->dbh));
+    return GNUNET_SYSERR;
+  }
+  /* Prepare statements */
+
+  sql_prepare (plugin->dbh,
+               "INSERT INTO peerstoredata (sub_system, peer_id, key, value, expiry)"
+               " VALUES (?,?,?,?,?);",
+               &plugin->insert_peerstoredata);
+  sql_prepare (plugin->dbh,
+               "SELECT uid,sub_system,peer_id,key,value,expiry FROM peerstoredata"
+               " WHERE sub_system = ?"
+               " AND uid > ?"
+               " ORDER BY uid ASC"
+               " LIMIT ?",
+               &plugin->select_peerstoredata);
+  sql_prepare (plugin->dbh,
+               "SELECT uid,sub_system,peer_id,key,value,expiry FROM peerstoredata"
+               " WHERE sub_system = ?"
+               " AND peer_id = ?"
+               " AND uid > ?"
+               " ORDER BY uid ASC"
+               " LIMIT ?",
+               &plugin->select_peerstoredata_by_pid);
+  sql_prepare (plugin->dbh,
+               "SELECT uid,sub_system,peer_id,key,value,expiry FROM peerstoredata"
+               " WHERE sub_system = ?"
+               " AND key = ?"
+               " AND uid > ?"
+               " ORDER BY uid ASC"
+               " LIMIT ?",
+               &plugin->select_peerstoredata_by_key);
+  sql_prepare (plugin->dbh,
+               "SELECT uid,sub_system,peer_id,key,value,expiry FROM peerstoredata"
+               " WHERE sub_system = ?"
+               " AND peer_id = ?"
+               " AND key = ?"
+               " AND uid > ?"
+               " ORDER BY uid ASC"
+               " LIMIT ?",
+               &plugin->select_peerstoredata_by_all);
+  sql_prepare (plugin->dbh,
+               "DELETE FROM peerstoredata"
+               " WHERE expiry < ?",
+               &plugin->expire_peerstoredata);
+  sql_prepare (plugin->dbh,
+               "DELETE FROM peerstoredata"
+               " WHERE sub_system = ?"
+               " AND peer_id = ?" " AND key = ?",
+               &plugin->delete_peerstoredata);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown database connection and associate data
+ * structures.
+ * @param plugin the plugin context (state for this module)
+ */
+static void
+database_shutdown (struct Plugin *plugin)
+{
+  int result;
+  sqlite3_stmt *stmt;
+
+  while (NULL != (stmt = sqlite3_next_stmt (plugin->dbh,
+                                            NULL)))
+  {
+    result = sqlite3_finalize (stmt);
+    if (SQLITE_OK != result)
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           "Failed to close statement %p: %d\n",
+           stmt,
+           result);
+  }
+  if (SQLITE_OK != sqlite3_close (plugin->dbh))
+    LOG_SQLITE (plugin,
+                GNUNET_ERROR_TYPE_ERROR,
+                "sqlite3_close");
+  GNUNET_free (plugin->fn);
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls The struct GNUNET_CONFIGURATION_Handle.
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_peerstore_sqlite_init (void *cls)
+{
+  static struct Plugin plugin;
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_PEERSTORE_PluginFunctions *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin,
+          0,
+          sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  if (GNUNET_OK != database_setup (&plugin))
+  {
+    database_shutdown (&plugin);
+    return NULL;
+  }
+  api = GNUNET_new (struct GNUNET_PEERSTORE_PluginFunctions);
+  api->cls = &plugin;
+  api->store_record = &peerstore_sqlite_store_record;
+  api->iterate_records = &peerstore_sqlite_iterate_records;
+  api->expire_records = &peerstore_sqlite_expire_records;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sqlite plugin is running\n");
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls The plugin context (as returned by "init")
+ * @return Always NULL
+ */
+void *
+libgnunet_plugin_peerstore_sqlite_done (void *cls)
+{
+  struct GNUNET_PEERSTORE_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  database_shutdown (plugin);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sqlite plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_peerstore_sqlite.c */
diff --git a/src/plugin/peerstore/test_plugin_peerstore.c b/src/plugin/peerstore/test_plugin_peerstore.c
new file mode 100644
index 000000000..1377845aa
--- /dev/null
+++ b/src/plugin/peerstore/test_plugin_peerstore.c
@@ -0,0 +1,226 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/*
+ * @file namestore/test_plugin_namestore.c
+ * @brief Test for the namestore plugins
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_peerstore_plugin.h"
+#include "gnunet_testing_lib.h"
+
+
+static int ok;
+
+/**
+ * Name of plugin under test.
+ */
+static const char *plugin_name;
+
+
+static struct GNUNET_PEERSTORE_PluginFunctions *psp;
+
+static struct GNUNET_PeerIdentity p1;
+
+
+/**
+ * Function called when the service shuts down.  Unloads our namestore
+ * plugin.
+ *
+ * @param api api to unload
+ */
+static void
+unload_plugin (struct GNUNET_PEERSTORE_PluginFunctions *api)
+{
+  char *libname;
+
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_peer_%s",
+                   plugin_name);
+  GNUNET_break (NULL ==
+                GNUNET_PLUGIN_unload (libname,
+                                      api));
+  GNUNET_free (libname);
+}
+
+
+/**
+ * Load the namestore plugin.
+ *
+ * @param cfg configuration to pass
+ * @return NULL on error
+ */
+static struct GNUNET_PEERSTORE_PluginFunctions *
+load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_PEERSTORE_PluginFunctions *ret;
+  char *libname;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("Loading `%s' peer plugin\n"),
+              plugin_name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_peerstore_%s",
+                   plugin_name);
+  if (NULL == (ret = GNUNET_PLUGIN_load (libname,
+                                         (void *) cfg)))
+  {
+    fprintf (stderr,
+             "Failed to load plugin `%s'!\n",
+             plugin_name);
+    GNUNET_free (libname);
+    return NULL;
+  }
+  GNUNET_free (libname);
+  return ret;
+}
+
+
+static void
+test_record (void *cls,
+             uint64_t seq,
+             const struct GNUNET_PEERSTORE_Record *record,
+             const char *error)
+{
+  const struct GNUNET_PeerIdentity *id = cls;
+  const char*testval = "test_val";
+
+  if (NULL == record)
+  {
+    unload_plugin (psp);
+    return;
+  }
+  GNUNET_assert (0 == memcmp (&record->peer,
+                              id,
+                              sizeof(struct GNUNET_PeerIdentity)));
+  GNUNET_assert (0 == strcmp ("subsys",
+                              record->sub_system));
+  GNUNET_assert (0 == strcmp ("key",
+                              record->key));
+  GNUNET_assert (0 == memcmp (testval,
+                              record->value,
+                              strlen (testval)));
+  ok = 0;
+}
+
+
+static void
+get_record (struct GNUNET_PEERSTORE_PluginFunctions *psp,
+            const struct GNUNET_PeerIdentity *identity)
+{
+  GNUNET_assert (GNUNET_OK ==
+                 psp->iterate_records (psp->cls,
+                                       "subsys",
+                                       identity,
+                                       "key",
+                                       0, 1,
+                                       &test_record,
+                                       (void *) identity));
+}
+
+
+static void
+store_cont (void *cls,
+            int status)
+{
+  GNUNET_assert (GNUNET_OK == status);
+  get_record (psp,
+              &p1);
+}
+
+
+static void
+put_record (struct GNUNET_PEERSTORE_PluginFunctions *psp,
+            const struct GNUNET_PeerIdentity *identity)
+{
+  GNUNET_assert (GNUNET_OK ==
+                 psp->store_record (psp->cls,
+                                    "subsys",
+                                    identity,
+                                    "key",
+                                    "test_value",
+                                    strlen ("test_value"),
+                                    GNUNET_TIME_absolute_get (),
+                                    GNUNET_PEERSTORE_STOREOPTION_REPLACE,
+                                    &store_cont,
+                                    NULL));
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  ok = 1;
+  psp = load_plugin (cfg);
+  if (NULL == psp)
+  {
+    fprintf (stderr,
+             "%s",
+             "Failed to initialize peerstore.  Database likely not setup, skipping test.\n");
+    return;
+  }
+  memset (&p1, 1, sizeof(p1));
+  put_record (psp,
+              &p1);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  char cfg_name[PATH_MAX];
+  char *const xargv[] = {
+    "test-plugin-peerstore",
+    "-c",
+    cfg_name,
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_log_setup ("test-plugin-peerstore",
+                    "WARNING",
+                    NULL);
+  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+  GNUNET_snprintf (cfg_name,
+                   sizeof(cfg_name),
+                   "test_plugin_peerstore_%s.conf",
+                   plugin_name);
+  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1,
+                      xargv,
+                      "test-plugin-peerstore",
+                      "nohelp",
+                      options,
+                      &run,
+                      NULL);
+  if (ok != 0)
+    fprintf (stderr,
+             "Missed some testcases: %d\n",
+             ok);
+  return ok;
+}
+
+
+/* end of test_plugin_peerstore.c */
diff --git a/src/plugin/peerstore/test_plugin_peerstore_sqlite.conf b/src/plugin/peerstore/test_plugin_peerstore_sqlite.conf
new file mode 100644
index 000000000..154491ff6
--- /dev/null
+++ b/src/plugin/peerstore/test_plugin_peerstore_sqlite.conf
@@ -0,0 +1,2 @@
+[peerstore-sqlite]
+FILENAME = $GNUNET_TMP/gnunet-test-plugin-peerstore-sqlite/sqlite-ng.db
diff --git a/src/plugin/reclaim/Makefile.am b/src/plugin/reclaim/Makefile.am
new file mode 100644
index 000000000..e8ac2f94d
--- /dev/null
+++ b/src/plugin/reclaim/Makefile.am
@@ -0,0 +1,70 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+ plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+
+CREDENTIAL_PLUGIN = \
+  libgnunet_plugin_reclaim_credential_jwt.la
+
+if HAVE_PABC
+  CREDENTIAL_PLUGIN += libgnunet_plugin_reclaim_credential_pabc.la
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_gnsrecord_reclaim.la \
+  libgnunet_plugin_reclaim_attribute_basic.la \
+  $(CREDENTIAL_PLUGIN)
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+libgnunet_plugin_gnsrecord_reclaim_la_SOURCES = \
+  plugin_gnsrecord_reclaim.c
+libgnunet_plugin_gnsrecord_reclaim_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_gnsrecord_reclaim_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+libgnunet_plugin_reclaim_attribute_basic_la_SOURCES = \
+  plugin_reclaim_attribute_basic.c
+libgnunet_plugin_reclaim_attribute_basic_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_reclaim_attribute_basic_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+if HAVE_PABC
+libgnunet_plugin_reclaim_credential_pabc_la_SOURCES = \
+  plugin_reclaim_credential_pabc.c \
+  pabc_helper.c \
+        pabc_helper.h
+libgnunet_plugin_reclaim_credential_pabc_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/reclaim/libgnunetreclaim.la \
+  -ljansson\
+  -lpabc \
+  $(LTLIBINTL)
+libgnunet_plugin_reclaim_credential_pabc_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+endif
+
+
+libgnunet_plugin_reclaim_credential_jwt_la_SOURCES = \
+  plugin_reclaim_credential_jwt.c \
+        $(top_builddir)/src/service/reclaim/reclaim_attribute.c \
+        $(top_builddir)/src/service/reclaim/reclaim_credential.c
+libgnunet_plugin_reclaim_credential_jwt_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  -ljansson\
+  $(LTLIBINTL)
+libgnunet_plugin_reclaim_credential_jwt_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/reclaim/meson.build b/src/plugin/reclaim/meson.build
new file mode 100644
index 000000000..cde9fc726
--- /dev/null
+++ b/src/plugin/reclaim/meson.build
@@ -0,0 +1,28 @@
+shared_module('gnunet_plugin_gnsrecord_reclaim',
+              ['plugin_gnsrecord_reclaim.c'],
+              dependencies: [libgnunetutil_dep, libgnunetgnsrecord_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir')/'gnunet')
+
+shared_module('gnunet_plugin_reclaim_attribute_basic',
+              ['plugin_reclaim_attribute_basic.c'],
+              dependencies: [
+                             libgnunetjson_dep,
+                             libgnunetutil_dep,
+                             json_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir') / 'gnunet')
+shared_module('gnunet_plugin_reclaim_credential_jwt',
+              ['plugin_reclaim_credential_jwt.c',
+                '../../service/reclaim/reclaim_attribute.c',
+                '../../service/reclaim/reclaim_credential.c'],
+              dependencies: [
+                             libgnunetjson_dep,
+                             libgnunetutil_dep,
+                             json_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir') / 'gnunet')
+
diff --git a/src/plugin/reclaim/pabc_helper.c b/src/plugin/reclaim/pabc_helper.c
new file mode 100644
index 000000000..d7688e9e1
--- /dev/null
+++ b/src/plugin/reclaim/pabc_helper.c
@@ -0,0 +1,374 @@
+// maximilian.kaul@aisec.fraunhofer.de
+
+// WIP implementation of
+// https://github.com/ontio/ontology-crypto/wiki/Anonymous-Credential
+// using the relic library https://github.com/relic-toolkit/relic/
+
+#include "platform.h"
+#include "pabc_helper.h"
+#include <pwd.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static char pabc_dir[PATH_MAX + 1];
+
+static const char *
+get_homedir ()
+{
+  const char *homedir;
+  if ((homedir = getenv ("HOME")) == NULL)
+  {
+    homedir = getpwuid (getuid ())->pw_dir;
+  }
+  return homedir;
+}
+
+
+static enum GNUNET_GenericReturnValue
+write_file (char const *const filename, const char *buffer)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  fh = GNUNET_DISK_file_open (filename,
+                              GNUNET_DISK_OPEN_WRITE
+                              | GNUNET_DISK_OPEN_TRUNCATE
+                              | GNUNET_DISK_OPEN_CREATE,
+                              GNUNET_DISK_PERM_USER_WRITE
+                              | GNUNET_DISK_PERM_USER_READ);
+  if (fh == NULL)
+    return GNUNET_SYSERR;
+  if (GNUNET_SYSERR == GNUNET_DISK_file_write (fh,
+                                               buffer, strlen (buffer) + 1))
+    goto fail;
+  GNUNET_DISK_file_close (fh);
+  return GNUNET_OK;
+
+fail:
+  GNUNET_DISK_file_close (fh);
+  return GNUNET_SYSERR;
+}
+
+
+static enum GNUNET_GenericReturnValue
+init_pabc_dir ()
+{
+  size_t filename_size = strlen (get_homedir ()) + 1 + strlen (".local") + 1
+                         + strlen ("pabc-reclaim") + 1;
+  snprintf (pabc_dir, filename_size, "%s/%s/%s",
+            get_homedir (), ".local", "pabc-reclaim");
+  return GNUNET_DISK_directory_create (pabc_dir);
+}
+
+
+static const char *
+get_pabcdir ()
+{
+  init_pabc_dir ();
+  return pabc_dir;
+}
+
+
+enum GNUNET_GenericReturnValue
+read_file (char const *const filename, char **buffer)
+{
+  struct GNUNET_DISK_FileHandle *fh;
+  if (GNUNET_YES != GNUNET_DISK_file_test (filename))
+    return GNUNET_SYSERR;
+
+  fh = GNUNET_DISK_file_open (filename,
+                              GNUNET_DISK_OPEN_READ,
+                              GNUNET_DISK_PERM_USER_READ);
+  if (fh == NULL)
+    return GNUNET_SYSERR;
+  long lSize = GNUNET_DISK_file_seek (fh, 0, GNUNET_DISK_SEEK_END);
+  if (lSize < 0)
+    goto fail;
+  GNUNET_DISK_file_seek (fh, 0, GNUNET_DISK_SEEK_SET);
+  *buffer = calloc ((size_t) lSize + 1, sizeof(char));
+  if (*buffer == NULL)
+    goto fail;
+
+  // copy the file into the buffer:
+  size_t r = GNUNET_DISK_file_read (fh, *buffer, (size_t) lSize);
+  if (r != (size_t) lSize)
+    goto fail;
+
+  GNUNET_DISK_file_close (fh);
+  return GNUNET_OK;
+
+fail:
+  GNUNET_DISK_file_close (fh);
+  GNUNET_free (*buffer);
+  return GNUNET_SYSERR;
+}
+
+
+struct pabc_public_parameters *
+PABC_read_issuer_ppfile (const char *f, struct pabc_context *const ctx)
+{
+  if (NULL == ctx)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No global context provided\n");
+    return NULL;
+  }
+  struct pabc_public_parameters *pp;
+  char *buffer;
+  int r;
+  r = read_file (f, &buffer);
+  if (GNUNET_OK != r)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Error reading file\n");
+    return NULL;
+  }
+  if (PABC_OK != pabc_decode_and_new_public_parameters (ctx, &pp, buffer))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to decode public parameters\n");
+    PABC_FREE_NULL (buffer);
+    return NULL;
+  }
+  PABC_FREE_NULL (buffer);
+  return pp;
+}
+
+
+enum GNUNET_GenericReturnValue
+PABC_load_public_parameters (struct pabc_context *const ctx,
+                             char const *const pp_name,
+                             struct pabc_public_parameters **pp)
+{
+  char fname[PATH_MAX];
+  char *pp_filename;
+  const char *pdir = get_pabcdir ();
+
+  if (ctx == NULL)
+    return GNUNET_SYSERR;
+  if (pp_name == NULL)
+    return GNUNET_SYSERR;
+
+  GNUNET_STRINGS_urlencode (strlen (pp_name),
+                            pp_name,
+                            &pp_filename);
+  if (GNUNET_YES != GNUNET_DISK_directory_test (pdir, GNUNET_YES))
+  {
+    GNUNET_free (pp_filename);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Error reading %s\n", pdir);
+    return GNUNET_SYSERR;
+  }
+  snprintf (fname, PATH_MAX, "%s/%s%s", pdir, pp_filename, PABC_PP_EXT);
+  if (GNUNET_YES != GNUNET_DISK_file_test (fname))
+  {
+    GNUNET_free (pp_filename);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Error testing %s\n", fname);
+    return GNUNET_SYSERR;
+  }
+  *pp = PABC_read_issuer_ppfile (fname, ctx);
+  if (*pp)
+    return GNUNET_OK;
+  else
+    return GNUNET_SYSERR;
+}
+
+
+enum GNUNET_GenericReturnValue
+PABC_write_public_parameters (char const *const pp_name,
+                              struct pabc_public_parameters *const pp)
+{
+  char *json;
+  char *filename;
+  char *pp_filename;
+  enum pabc_status status;
+  struct pabc_context *ctx = NULL;
+
+  GNUNET_STRINGS_urlencode (strlen (pp_name),
+                            pp_name,
+                            &pp_filename);
+  PABC_ASSERT (pabc_new_ctx (&ctx));
+  // store in json file
+  status = pabc_encode_public_parameters (ctx, pp, &json);
+  if (status != PABC_OK)
+  {
+    GNUNET_free (pp_filename);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to encode public parameters.\n");
+    pabc_free_ctx (&ctx);
+    return GNUNET_SYSERR;
+  }
+
+  size_t filename_size =
+    strlen (get_pabcdir ()) + 1 + strlen (pp_filename) + strlen (PABC_PP_EXT)
+    + 1;
+  filename = GNUNET_malloc (filename_size);
+  if (! filename)
+  {
+    GNUNET_free (pp_filename);
+    PABC_FREE_NULL (json);
+    pabc_free_ctx (&ctx);
+    return GNUNET_SYSERR;
+  }
+  snprintf (filename, filename_size, "%s/%s%s", get_pabcdir (), pp_filename,
+            PABC_PP_EXT);
+
+  GNUNET_free (pp_filename);
+  if (GNUNET_OK != write_file (filename, json))
+  {
+    PABC_FREE_NULL (filename);
+    PABC_FREE_NULL (json);
+    pabc_free_ctx (&ctx);
+    return GNUNET_SYSERR;
+  }
+  PABC_FREE_NULL (filename);
+  PABC_FREE_NULL (json);
+  pabc_free_ctx (&ctx);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+PABC_write_usr_ctx (char const *const usr_name,
+                    char const *const pp_name,
+                    struct pabc_context const *const ctx,
+                    struct pabc_public_parameters const *const pp,
+                    struct pabc_user_context *const usr_ctx)
+{
+
+  char *pp_filename;
+  char *json = NULL;
+  enum pabc_status status;
+  char *fname = NULL;
+
+  if (NULL == usr_name)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No issuer given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == pp_name)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No user given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == ctx)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No context given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == pp)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No public parameters given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == usr_ctx)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No user context given.\n");
+    return GNUNET_SYSERR;
+  }
+
+  GNUNET_STRINGS_urlencode (strlen (pp_name),
+                            pp_name,
+                            &pp_filename);
+  status = pabc_encode_user_ctx (ctx, pp, usr_ctx, &json);
+  if (PABC_OK != status)
+  {
+    GNUNET_free (pp_filename);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to encode user context.\n");
+    return status;
+  }
+
+  size_t fname_size = strlen (get_pabcdir ()) + 1 + strlen (usr_name) + 1
+                      + strlen (pp_filename) + strlen (PABC_USR_EXT) + 1;
+  fname = GNUNET_malloc (fname_size);
+
+  snprintf (fname, fname_size, "%s/%s_%s%s", get_pabcdir (), usr_name,
+            pp_filename,
+            PABC_USR_EXT);
+
+  GNUNET_free (pp_filename);
+  if (GNUNET_OK == write_file (fname, json))
+  {
+    GNUNET_free (fname);
+    GNUNET_free (json);
+    return GNUNET_OK;
+  }
+  else
+  {
+    GNUNET_free (fname);
+    GNUNET_free (json);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+PABC_read_usr_ctx (char const *const usr_name,
+                   char const *const pp_name,
+                   struct pabc_context const *const ctx,
+                   struct pabc_public_parameters const *const pp,
+                   struct pabc_user_context **usr_ctx)
+{
+  char *json = NULL;
+  char *pp_filename;
+  enum pabc_status status;
+
+  char *fname = NULL;
+
+  if (NULL == usr_name)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No issuer given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == pp_name)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No user given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == ctx)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No context given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == pp)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No public parameters given.\n");
+    return GNUNET_SYSERR;
+  }
+  if (NULL == usr_ctx)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No user context given.\n");
+    return GNUNET_SYSERR;
+  }
+  GNUNET_STRINGS_urlencode (strlen (pp_name),
+                            pp_name,
+                            &pp_filename);
+
+  size_t fname_size = strlen (get_pabcdir ()) + 1 + strlen (usr_name) + 1
+                      + strlen (pp_filename) + strlen (PABC_USR_EXT) + 1;
+  fname = GNUNET_malloc (fname_size);
+  snprintf (fname, fname_size, "%s/%s_%s%s", get_pabcdir (), usr_name,
+            pp_filename,
+            PABC_USR_EXT);
+  GNUNET_free (pp_filename);
+  if (GNUNET_OK != read_file (fname, &json))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read `%s'\n", fname);
+    PABC_FREE_NULL (fname);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (fname);
+
+  status = pabc_new_user_context (ctx, pp, usr_ctx);
+  if (PABC_OK != status)
+  {
+    GNUNET_free (json);
+    return GNUNET_SYSERR;
+  }
+  status = pabc_decode_user_ctx (ctx, pp, *usr_ctx, json);
+  GNUNET_free (json);
+  if (PABC_OK != status)
+  {
+    pabc_free_user_context (ctx, pp, usr_ctx);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to encode user context.\n");
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
diff --git a/src/plugin/reclaim/pabc_helper.h b/src/plugin/reclaim/pabc_helper.h
new file mode 100644
index 000000000..045ad5dda
--- /dev/null
+++ b/src/plugin/reclaim/pabc_helper.h
@@ -0,0 +1,41 @@
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include <pabc/pabc.h>
+
+#ifndef PATH_MAX
+#define PATH_MAX 4096
+#endif
+
+#define PABC_ISK_EXT ".isk"
+
+#define PABC_PP_EXT ".pp"
+
+#define PABC_USR_EXT ".usr"
+
+#define PABC_ATTR_DELIM "="
+
+enum GNUNET_GenericReturnValue
+PABC_write_public_parameters (char const *const pp_name,
+                              struct pabc_public_parameters *const pp);
+
+
+enum GNUNET_GenericReturnValue
+PABC_load_public_parameters (struct pabc_context *const ctx,
+                             char const *const pp_name,
+                             struct pabc_public_parameters **pp);
+
+enum GNUNET_GenericReturnValue
+PABC_write_usr_ctx (char const *const user_name,
+                    char const *const pp_name,
+                    struct pabc_context const *const ctx,
+                    struct pabc_public_parameters const *const
+                    pp,
+                    struct pabc_user_context *const usr_ctx);
+
+enum GNUNET_GenericReturnValue
+PABC_read_usr_ctx (char const *const user_name,
+                   char const *const pp_name,
+                   struct pabc_context const *const ctx,
+                   struct pabc_public_parameters const *const
+                   pp,
+                   struct pabc_user_context **usr_ctx);
diff --git a/src/plugin/reclaim/plugin_gnsrecord_reclaim.c b/src/plugin/reclaim/plugin_gnsrecord_reclaim.c
new file mode 100644
index 000000000..baf2fc37a
--- /dev/null
+++ b/src/plugin/reclaim/plugin_gnsrecord_reclaim.c
@@ -0,0 +1,195 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim/plugin_gnsrecord_reclaim.c
+ * @brief gnsrecord plugin to provide the API for identity records
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+
+#include "gnunet_util_lib.h"
+
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_gnsrecord_plugin.h"
+
+/**
+ * Convert the 'value' of a record to a string.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+static char *
+value_to_string (void *cls, uint32_t type, const void *data, size_t data_size)
+{
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_CLIENT:
+    return GNUNET_strndup (data, data_size);
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE_REF:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION:
+    return GNUNET_STRINGS_data_to_string_alloc (data, data_size);
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of a record to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the record
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+string_to_value (void *cls, uint32_t type, const char *s, void **data,
+                 size_t *data_size)
+{
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_CLIENT:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s);
+    return GNUNET_OK;
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE_REF:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL:
+  case GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION:
+    return GNUNET_STRINGS_string_to_data (s, strlen (s), *data, *data_size);
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of record type numbers to human-readable
+ * record type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} name_map[] = {
+  { "RECLAIM_ATTRIBUTE", GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE },
+  { "RECLAIM_ATTRIBUTE_REF", GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE_REF },
+  { "RECLAIM_CREDENTIAL", GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL },
+  { "RECLAIM_PRESENTATION", GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION },
+  { "RECLAIM_OIDC_CLIENT", GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_CLIENT },
+  { "RECLAIM_OIDC_REDIRECT", GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT },
+  { "RECLAIM_TICKET", GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET },
+  { NULL, UINT32_MAX }
+};
+
+
+/**
+ * Convert a type name (e.g. "AAAA") to the corresponding number.
+ *
+ * @param cls closure, unused
+ * @param dns_typename name to convert
+ * @return corresponding number, UINT32_MAX on error
+ */
+static uint32_t
+typename_to_number (void *cls, const char *dns_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != name_map[i].name) &&
+         (0 != strcasecmp (dns_typename, name_map[i].name)))
+    i++;
+  return name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+number_to_typename (void *cls, uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != name_map[i].name) && (type != name_map[i].number))
+    i++;
+  return name_map[i].name;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_gnsrecord_reclaim_init (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_GNSRECORD_PluginFunctions);
+  api->value_to_string = &value_to_string;
+  api->string_to_value = &string_to_value;
+  api->typename_to_number = &typename_to_number;
+  api->number_to_typename = &number_to_typename;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init
+ * @return NULL
+ */
+void *
+libgnunet_plugin_gnsrecord_reclaim_done (void *cls)
+{
+  struct GNUNET_GNSRECORD_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_gnsrecord_dns.c */
diff --git a/src/plugin/reclaim/plugin_reclaim_attribute_basic.c b/src/plugin/reclaim/plugin_reclaim_attribute_basic.c
new file mode 100644
index 000000000..66f59998a
--- /dev/null
+++ b/src/plugin/reclaim/plugin_reclaim_attribute_basic.c
@@ -0,0 +1,181 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim-attribute/plugin_reclaim_attribute_gnuid.c
+ * @brief reclaim-attribute-plugin-gnuid attribute plugin to provide the API for
+ *                                       fundamental
+ *                                       attribute types.
+ *
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_reclaim_plugin.h"
+#include <inttypes.h>
+
+
+/**
+ * Convert the 'value' of an attribute to a string.
+ *
+ * @param cls closure, unused
+ * @param type type of the attribute
+ * @param data value in binary encoding
+ * @param data_size number of bytes in @a data
+ * @return NULL on error, otherwise human-readable representation of the value
+ */
+static char *
+basic_value_to_string (void *cls,
+                       uint32_t type,
+                       const void *data,
+                       size_t data_size)
+{
+  switch (type)
+  {
+  case GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING:
+    return GNUNET_strndup (data, data_size);
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of an attribute to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the attribute
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+basic_string_to_value (void *cls,
+                       uint32_t type,
+                       const char *s,
+                       void **data,
+                       size_t *data_size)
+{
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s) + 1;
+    return GNUNET_OK;
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of attribute type numbers to human-readable
+ * attribute type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} basic_name_map[] = { { "STRING", GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING },
+                       { NULL, UINT32_MAX } };
+
+
+/**
+ * Convert a type name to the corresponding number.
+ *
+ * @param cls closure, unused
+ * @param basic_typename name to convert
+ * @return corresponding number, UINT32_MAX on error
+ */
+static uint32_t
+basic_typename_to_number (void *cls, const char *basic_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != basic_name_map[i].name) &&
+         (0 != strcasecmp (basic_typename, basic_name_map[i].name)))
+    i++;
+  return basic_name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+basic_number_to_typename (void *cls, uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != basic_name_map[i].name) && (type != basic_name_map[i].number))
+    i++;
+  return basic_name_map[i].name;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_reclaim_attribute_basic_init (void *cls)
+{
+  struct GNUNET_RECLAIM_AttributePluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_RECLAIM_AttributePluginFunctions);
+  api->value_to_string = &basic_value_to_string;
+  api->string_to_value = &basic_string_to_value;
+  api->typename_to_number = &basic_typename_to_number;
+  api->number_to_typename = &basic_number_to_typename;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init()
+ * @return NULL
+ */
+void *
+libgnunet_plugin_reclaim_attribute_basic_done (void *cls)
+{
+  struct GNUNET_RECLAIM_AttributePluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_reclaim_attribute_type_gnuid.c */
diff --git a/src/plugin/reclaim/plugin_reclaim_credential_jwt.c b/src/plugin/reclaim/plugin_reclaim_credential_jwt.c
new file mode 100644
index 000000000..3eb4bfebf
--- /dev/null
+++ b/src/plugin/reclaim/plugin_reclaim_credential_jwt.c
@@ -0,0 +1,512 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim/plugin_reclaim_credential_jwt.c
+ * @brief reclaim-credential-plugin-jwt attribute plugin to provide the API for
+ *                                      JWT credentials.
+ *
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_reclaim_plugin.h"
+#include <inttypes.h>
+#include <jansson.h>
+
+/**
+   * Convert the 'value' of an credential to a string.
+   *
+   * @param cls closure, unused
+   * @param type type of the credential
+   * @param data value in binary encoding
+   * @param data_size number of bytes in @a data
+   * @return NULL on error, otherwise human-readable representation of the value
+   */
+static char *
+jwt_value_to_string (void *cls,
+                     uint32_t type,
+                     const void *data,
+                     size_t data_size)
+{
+  switch (type)
+  {
+  case GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT:
+    return GNUNET_strndup (data, data_size);
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of an credential to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the credential
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+jwt_string_to_value (void *cls,
+                     uint32_t type,
+                     const char *s,
+                     void **data,
+                     size_t *data_size)
+{
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s) + 1;
+    return GNUNET_OK;
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of credential type numbers to human-readable
+ * credential type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} jwt_cred_name_map[] = { { "JWT", GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT },
+                          { NULL, UINT32_MAX } };
+
+/**
+   * Convert a type name to the corresponding number.
+   *
+   * @param cls closure, unused
+   * @param jwt_typename name to convert
+   * @return corresponding number, UINT32_MAX on error
+   */
+static uint32_t
+jwt_typename_to_number (void *cls, const char *jwt_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != jwt_cred_name_map[i].name) &&
+         (0 != strcasecmp (jwt_typename, jwt_cred_name_map[i].name)))
+    i++;
+  return jwt_cred_name_map[i].number;
+}
+
+
+/**
+ * Convert a type number to the corresponding type string (e.g. 1 to "A")
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+jwt_number_to_typename (void *cls, uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != jwt_cred_name_map[i].name) && (type !=
+                                                 jwt_cred_name_map[i].
+                                                 number))
+    i++;
+  return jwt_cred_name_map[i].name;
+}
+
+
+/**
+ * Parse a JWT and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+jwt_parse_attributes (void *cls,
+                      const char *data,
+                      size_t data_size)
+{
+  char *jwt_string;
+  struct GNUNET_RECLAIM_AttributeList *attrs;
+  char delim[] = ".";
+  char *val_str = NULL;
+  char *decoded_jwt;
+  char *tmp;
+  json_t *json_val;
+  json_error_t json_err;
+
+  attrs = GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+
+  jwt_string = GNUNET_strndup (data, data_size);
+  const char *jwt_body = strtok (jwt_string, delim);
+  if (NULL == jwt_body)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to parse JSON %s\n", jwt_string);
+    return attrs;
+  }
+  jwt_body = strtok (NULL, delim);
+  if (NULL == jwt_body)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to parse JSON %s\n", jwt_string);
+    GNUNET_free (jwt_string);
+    return attrs;
+  }
+  GNUNET_STRINGS_base64url_decode (jwt_body, strlen (jwt_body),
+                                   (void **) &decoded_jwt);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Decoded JWT: %s\n", decoded_jwt);
+  GNUNET_assert (NULL != decoded_jwt);
+  json_val = json_loads (decoded_jwt, JSON_DECODE_ANY, &json_err);
+  GNUNET_free (decoded_jwt);
+  const char *key;
+  const char *addr_key;
+  json_t *value;
+  json_t *addr_value;
+
+  json_object_foreach (json_val, key, value) {
+    if (0 == strcmp ("iss", key))
+      continue;
+    if (0 == strcmp ("jti", key))
+      continue;
+    if (0 == strcmp ("exp", key))
+      continue;
+    if (0 == strcmp ("iat", key))
+      continue;
+    if (0 == strcmp ("nbf", key))
+      continue;
+    if (0 == strcmp ("aud", key))
+      continue;
+    if (0 == strcmp ("address", key))
+    {
+      if (! json_is_object (value))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "address claim in wrong format!");
+        continue;
+      }
+      json_object_foreach (value, addr_key, addr_value) {
+        val_str = json_dumps (addr_value, JSON_ENCODE_ANY);
+        tmp = val_str;
+        // Remove leading " from jasson conversion
+        if (tmp[0] == '"')
+          tmp++;
+        // Remove trailing " from jansson conversion
+        if (tmp[strlen (tmp) - 1] == '"')
+          tmp[strlen (tmp) - 1] = '\0';
+        GNUNET_RECLAIM_attribute_list_add (attrs,
+                                           addr_key,
+                                           NULL,
+                                           GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING,
+                                           tmp,
+                                           strlen (val_str));
+        GNUNET_free (val_str);
+      }
+      continue;
+    }
+    val_str = json_dumps (value, JSON_ENCODE_ANY);
+    tmp = val_str;
+    // Remove leading " from jasson conversion
+    if (tmp[0] == '"')
+      tmp++;
+    // Remove trailing " from jansson conversion
+    if (tmp[strlen (tmp) - 1] == '"')
+      tmp[strlen (tmp) - 1] = '\0';
+    GNUNET_RECLAIM_attribute_list_add (attrs,
+                                       key,
+                                       NULL,
+                                       GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING,// FIXME
+                                       tmp,
+                                       strlen (val_str));
+    GNUNET_free (val_str);
+  }
+  json_decref (json_val);
+  GNUNET_free (jwt_string);
+  return attrs;
+}
+
+
+/**
+ * Parse a JWT and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+jwt_parse_attributes_c (void *cls,
+                        const struct GNUNET_RECLAIM_Credential *cred)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT)
+    return NULL;
+  return jwt_parse_attributes (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a JWT and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+jwt_parse_attributes_p (void *cls,
+                        const struct GNUNET_RECLAIM_Presentation *cred)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT)
+    return NULL;
+  return jwt_parse_attributes (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a JWT and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a string, containing the isser
+ */
+char *
+jwt_get_issuer (void *cls,
+                const char *data,
+                size_t data_size)
+{
+  const char *jwt_body;
+  char *jwt_string;
+  char delim[] = ".";
+  char *issuer = NULL;
+  char *decoded_jwt;
+  json_t *issuer_json;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Parsing JWT attributes.\n");
+  json_t *json_val;
+  json_error_t json_err;
+
+  jwt_string = GNUNET_strndup (data, data_size);
+  jwt_body = strtok (jwt_string, delim);
+  jwt_body = strtok (NULL, delim);
+  GNUNET_STRINGS_base64url_decode (jwt_body, strlen (jwt_body),
+                                   (void **) &decoded_jwt);
+  json_val = json_loads (decoded_jwt, JSON_DECODE_ANY, &json_err);
+  GNUNET_free (decoded_jwt);
+  GNUNET_free (jwt_string);
+  if (NULL == json_val)
+    return NULL;
+  issuer_json = json_object_get (json_val, "iss");
+  if ((NULL == issuer_json) || (! json_is_string (issuer_json)))
+  {
+    json_decref (json_val);
+    return NULL;
+  }
+  issuer = GNUNET_strdup (json_string_value (issuer_json));
+  json_decref (json_val);
+  return issuer;
+}
+
+
+/**
+ * Parse a JWT and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a string, containing the isser
+ */
+char *
+jwt_get_issuer_c (void *cls,
+                  const struct GNUNET_RECLAIM_Credential *cred)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT != cred->type)
+    return NULL;
+  return jwt_get_issuer (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a JWT and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a string, containing the isser
+ */
+char *
+jwt_get_issuer_p (void *cls,
+                  const struct GNUNET_RECLAIM_Presentation *cred)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT != cred->type)
+    return NULL;
+  return jwt_get_issuer (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a JWT and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a string, containing the isser
+ */
+enum GNUNET_GenericReturnValue
+jwt_get_expiration (void *cls,
+                    const char *data,
+                    size_t data_size,
+                    struct GNUNET_TIME_Absolute *exp)
+{
+  const char *jwt_body;
+  char *jwt_string;
+  char delim[] = ".";
+  char *decoded_jwt;
+  json_t *exp_json;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Parsing JWT attributes.\n");
+  json_t *json_val;
+  json_error_t json_err;
+
+  jwt_string = GNUNET_strndup (data, data_size);
+  jwt_body = strtok (jwt_string, delim);
+  jwt_body = strtok (NULL, delim);
+  GNUNET_STRINGS_base64url_decode (jwt_body, strlen (jwt_body),
+                                   (void **) &decoded_jwt);
+  json_val = json_loads (decoded_jwt, JSON_DECODE_ANY, &json_err);
+  GNUNET_free (decoded_jwt);
+  GNUNET_free (jwt_string);
+  if (NULL == json_val)
+    return GNUNET_SYSERR;
+  exp_json = json_object_get (json_val, "exp");
+  if ((NULL == exp_json) || (! json_is_integer (exp_json)))
+  {
+    json_decref (json_val);
+    return GNUNET_SYSERR;
+  }
+  exp->abs_value_us = json_integer_value (exp_json) * 1000 * 1000;
+  json_decref (json_val);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a JWT and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return the expirati
+ */
+enum GNUNET_GenericReturnValue
+jwt_get_expiration_c (void *cls,
+                      const struct GNUNET_RECLAIM_Credential *cred,
+                      struct GNUNET_TIME_Absolute *exp)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT != cred->type)
+    return GNUNET_NO;
+  return jwt_get_expiration (cls, cred->data, cred->data_size, exp);
+}
+
+
+/**
+ * Parse a JWT and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the jwt credential
+ * @return a string, containing the isser
+ */
+enum GNUNET_GenericReturnValue
+jwt_get_expiration_p (void *cls,
+                      const struct GNUNET_RECLAIM_Presentation *cred,
+                      struct GNUNET_TIME_Absolute *exp)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT != cred->type)
+    return GNUNET_NO;
+  return jwt_get_expiration (cls, cred->data, cred->data_size, exp);
+}
+
+
+enum GNUNET_GenericReturnValue
+jwt_create_presentation (void *cls,
+                         const struct GNUNET_RECLAIM_Credential *cred,
+                         const struct GNUNET_RECLAIM_AttributeList *attrs,
+                         struct GNUNET_RECLAIM_Presentation **presentation)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT != cred->type)
+    return GNUNET_NO;
+  *presentation = GNUNET_RECLAIM_presentation_new (
+    GNUNET_RECLAIM_CREDENTIAL_TYPE_JWT,
+    cred->data,
+    cred->data_size);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_reclaim_credential_jwt_init (void *cls)
+{
+  struct GNUNET_RECLAIM_CredentialPluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_RECLAIM_CredentialPluginFunctions);
+  api->value_to_string = &jwt_value_to_string;
+  api->string_to_value = &jwt_string_to_value;
+  api->typename_to_number = &jwt_typename_to_number;
+  api->number_to_typename = &jwt_number_to_typename;
+  api->get_attributes = &jwt_parse_attributes_c;
+  api->get_issuer = &jwt_get_issuer_c;
+  api->get_expiration = &jwt_get_expiration_c;
+  api->value_to_string_p = &jwt_value_to_string;
+  api->string_to_value_p = &jwt_string_to_value;
+  api->typename_to_number_p = &jwt_typename_to_number;
+  api->number_to_typename_p = &jwt_number_to_typename;
+  api->get_attributes_p = &jwt_parse_attributes_p;
+  api->get_issuer_p = &jwt_get_issuer_p;
+  api->get_expiration_p = &jwt_get_expiration_p;
+  api->create_presentation = &jwt_create_presentation;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init()
+ * @return NULL
+ */
+void *
+libgnunet_plugin_reclaim_credential_jwt_done (void *cls)
+{
+  struct GNUNET_RECLAIM_CredentialPluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_reclaim_credential_type_jwt.c */
diff --git a/src/plugin/reclaim/plugin_reclaim_credential_pabc.c b/src/plugin/reclaim/plugin_reclaim_credential_pabc.c
new file mode 100644
index 000000000..a906805fb
--- /dev/null
+++ b/src/plugin/reclaim/plugin_reclaim_credential_pabc.c
@@ -0,0 +1,572 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013, 2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim/plugin_reclaim_credential_pabc.c
+ * @brief reclaim-credential-plugin-pabc attribute plugin to provide the API for
+ *                                      pabc credentials.
+ *
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_reclaim_plugin.h"
+#include <inttypes.h>
+#include <jansson.h>
+#include <pabc/pabc.h>
+#include "pabc_helper.h"
+
+/**
+   * Convert the 'value' of an credential to a string.
+   *
+   * @param cls closure, unused
+   * @param type type of the credential
+   * @param data value in binary encoding
+   * @param data_size number of bytes in @a data
+   * @return NULL on error, otherwise human-readable representation of the value
+   */
+static char *
+pabc_value_to_string (void *cls,
+                      uint32_t type,
+                      const void *data,
+                      size_t data_size)
+{
+  switch (type)
+  {
+  case GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC:
+    return GNUNET_strndup (data, data_size);
+
+  default:
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert human-readable version of a 'value' of an credential to the binary
+ * representation.
+ *
+ * @param cls closure, unused
+ * @param type type of the credential
+ * @param s human-readable string
+ * @param data set to value in binary encoding (will be allocated)
+ * @param data_size set to number of bytes in @a data
+ * @return #GNUNET_OK on success
+ */
+static int
+pabc_string_to_value (void *cls,
+                      uint32_t type,
+                      const char *s,
+                      void **data,
+                      size_t *data_size)
+{
+  if (NULL == s)
+    return GNUNET_SYSERR;
+  switch (type)
+  {
+  case GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC:
+    *data = GNUNET_strdup (s);
+    *data_size = strlen (s) + 1;
+    return GNUNET_OK;
+
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Mapping of credential type numbers to human-readable
+ * credential type names.
+ */
+static struct
+{
+  const char *name;
+  uint32_t number;
+} pabc_cred_name_map[] = { { "PABC", GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC },
+                           { NULL, UINT32_MAX } };
+
+/**
+   * Convert a type name to the corresponding number.
+   *
+   * @param cls closure, unused
+   * @param pabc_typename name to convert
+   * @return corresponding number, UINT32_MAX on error
+   */
+static uint32_t
+pabc_typename_to_number (void *cls, const char *pabc_typename)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != pabc_cred_name_map[i].name) &&
+         (0 != strcasecmp (pabc_typename, pabc_cred_name_map[i].name)))
+    i++;
+  return pabc_cred_name_map[i].number;
+}
+
+
+/**
+ * Convert a type number (i.e. 1) to the corresponding type string
+ *
+ * @param cls closure, unused
+ * @param type number of a type to convert
+ * @return corresponding typestring, NULL on error
+ */
+static const char *
+pabc_number_to_typename (void *cls, uint32_t type)
+{
+  unsigned int i;
+
+  i = 0;
+  while ((NULL != pabc_cred_name_map[i].name) && (type !=
+                                                  pabc_cred_name_map[i].
+                                                  number))
+    i++;
+  return pabc_cred_name_map[i].name;
+}
+
+
+static void
+inspect_attrs (char const *const key,
+               char const *const value,
+               void *ctx)
+{
+  struct GNUNET_RECLAIM_AttributeList *attrs = ctx;
+
+  if (NULL == value)
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found attribute in PABC credential: `%s': `%s'\n",
+              key, value);
+  if (0 == strcmp (key, "expiration"))
+    return;
+  if (0 == strcmp (key, "issuer"))
+    return;
+  if (0 == strcmp (key, "subject"))
+    return;
+  GNUNET_RECLAIM_attribute_list_add (attrs,
+                                     key,
+                                     NULL,
+                                     GNUNET_RECLAIM_ATTRIBUTE_TYPE_STRING,
+                                     value,
+                                     strlen (value));
+}
+
+
+/**
+ * Parse a pabc and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+pabc_parse_attributes (void *cls,
+                       const char *data,
+                       size_t data_size)
+{
+  struct GNUNET_RECLAIM_AttributeList *attrs;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Collecting PABC attributes...\n");
+  attrs = GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+  GNUNET_assert (PABC_OK ==
+                 pabc_cred_inspect_credential (data,
+                                               &inspect_attrs, attrs));
+  return attrs;
+}
+
+
+/**
+ * Parse a pabc and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+pabc_parse_attributes_c (void *cls,
+                         const struct GNUNET_RECLAIM_Credential *cred)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC)
+    return NULL;
+  return pabc_parse_attributes (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a pabc and return the respective claim value as Attribute
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_AttributeList *
+pabc_parse_attributes_p (void *cls,
+                         const struct GNUNET_RECLAIM_Presentation *cred)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC)
+    return NULL;
+  return pabc_parse_attributes (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a pabc and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+char*
+pabc_get_issuer (void *cls,
+                 const char *data,
+                 size_t data_size)
+{
+  char *res;
+  if (PABC_OK != pabc_cred_get_attr_by_name_from_cred (data,
+                                                       "issuer",
+                                                       &res))
+    return NULL;
+  return res;
+}
+
+
+/**
+ * Parse a pabc and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+char *
+pabc_get_issuer_c (void *cls,
+                   const struct GNUNET_RECLAIM_Credential *cred)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC != cred->type)
+    return NULL;
+  return pabc_get_issuer (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a pabc and return the issuer
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+char *
+pabc_get_issuer_p (void *cls,
+                   const struct GNUNET_RECLAIM_Presentation *cred)
+{
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC != cred->type)
+    return NULL;
+  return pabc_get_issuer (cls, cred->data, cred->data_size);
+}
+
+
+/**
+ * Parse a pabc and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+enum GNUNET_GenericReturnValue
+pabc_get_expiration (void *cls,
+                     const char *data,
+                     size_t data_size,
+                     struct GNUNET_TIME_Absolute *exp)
+{
+  char *exp_str;
+  uint64_t exp_i;
+
+  if (PABC_OK != pabc_cred_get_attr_by_name_from_cred (data,
+                                                       "expiration",
+                                                       &exp_str))
+    return GNUNET_SYSERR;
+
+  if (1 != sscanf (exp_str, "%llu", &exp_i))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Invalid expiration `%s'\n", exp_str);
+    GNUNET_free (exp_str);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Converted expiration string `%s' to %llu",
+              exp_str, exp_i);
+
+  GNUNET_free (exp_str);
+  exp->abs_value_us = exp_i * 1000 * 1000;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a pabc and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+enum GNUNET_GenericReturnValue
+pabc_get_expiration_c (void *cls,
+                       const struct GNUNET_RECLAIM_Credential *cred,
+                       struct GNUNET_TIME_Absolute *exp)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC)
+    return GNUNET_NO;
+  return pabc_get_expiration (cls, cred->data, cred->data_size, exp);
+}
+
+
+/**
+ * Parse a pabc and return the expiration
+ *
+ * @param cls the plugin
+ * @param cred the pabc credential
+ * @return a string, containing the isser
+ */
+enum GNUNET_GenericReturnValue
+pabc_get_expiration_p (void *cls,
+                       const struct GNUNET_RECLAIM_Presentation *cred,
+                       struct GNUNET_TIME_Absolute *exp)
+{
+  if (cred->type != GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC)
+    return GNUNET_NO;
+  return pabc_get_expiration (cls, cred->data, cred->data_size, exp);
+}
+
+
+int
+pabc_create_presentation (void *cls,
+                          const struct GNUNET_RECLAIM_Credential *credential,
+                          const struct GNUNET_RECLAIM_AttributeList *attrs,
+                          struct GNUNET_RECLAIM_Presentation **presentation)
+{
+  struct pabc_context *ctx = NULL;
+  struct pabc_user_context *usr_ctx = NULL;
+  struct pabc_public_parameters *pp = NULL;
+  struct pabc_credential *cred = NULL;
+  struct pabc_blinded_proof *proof = NULL;
+  struct GNUNET_RECLAIM_AttributeListEntry *ale;
+  char *issuer;
+  char *subject;
+  enum pabc_status status;
+
+  if (GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC != credential->type)
+    return GNUNET_NO;
+
+
+  PABC_ASSERT (pabc_new_ctx (&ctx));
+  issuer = pabc_get_issuer_c (cls, credential);
+  if (NULL == issuer)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No issuer found in credential\n");
+    pabc_free_ctx (&ctx);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got issuer for credential: %s\n", issuer);
+  status = PABC_load_public_parameters (ctx, issuer, &pp);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read public parameters.\n");
+    pabc_free_ctx (&ctx);
+    GNUNET_free (issuer);
+    return GNUNET_SYSERR;
+  }
+  if (PABC_OK != pabc_cred_get_attr_by_name_from_cred (credential->data,
+                                                       "subject",
+                                                       &subject))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to get subject.\n");
+    pabc_free_ctx (&ctx);
+    GNUNET_free (issuer);
+    return GNUNET_SYSERR;
+  }
+  status = PABC_read_usr_ctx (subject, issuer, ctx, pp, &usr_ctx);
+  GNUNET_free (issuer);
+  GNUNET_free (subject);
+  if (PABC_OK != status)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read user context.\n");
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+
+  status = pabc_new_credential (ctx, pp, &cred);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to allocate credential.\n");
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+
+  status = pabc_decode_credential (ctx, pp, cred, credential->data);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to decode credential.\n");
+    pabc_free_credential (ctx, pp, &cred);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+
+  status = pabc_new_proof (ctx, pp, &proof);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to allocate proof.\n");
+    pabc_free_credential (ctx, pp, &cred);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+
+  // now we can parse the attributes to disclose and configure the proof
+  for (ale = attrs->list_head; NULL != ale; ale = ale->next)
+  {
+    status = pabc_set_disclosure_by_attribute_name (ctx, pp, proof,
+                                                    ale->attribute->name,
+                                                    PABC_DISCLOSED, cred);
+    if (status != PABC_OK)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to configure proof.\n");
+      pabc_free_credential (ctx, pp, &cred);
+      pabc_free_user_context (ctx, pp, &usr_ctx);
+      pabc_free_public_parameters (ctx, &pp);
+      return GNUNET_SYSERR;
+    }
+  }
+
+  // and finally -> sign the proof
+  status = pabc_gen_proof (ctx, usr_ctx, pp, proof, cred);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to sign proof.\n");
+    pabc_free_proof (ctx, pp, &proof);
+    pabc_free_credential (ctx, pp, &cred);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+  // print the result
+  char *json = NULL;
+  char *ppid = NULL;
+  char *userid = NULL;
+  GNUNET_assert (PABC_OK == pabc_cred_get_userid_from_cred (credential->data,
+                                                            &userid));
+  GNUNET_assert (PABC_OK == pabc_cred_get_ppid_from_cred (credential->data,
+                                                          &ppid));
+  pabc_cred_encode_proof (ctx, pp, proof, userid, ppid,  &json);
+  GNUNET_free (ppid);
+  GNUNET_free (userid);
+  if (PABC_OK != status)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to serialize proof.\n");
+    pabc_free_proof (ctx, pp, &proof);
+    pabc_free_credential (ctx, pp, &cred);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    return GNUNET_SYSERR;
+  }
+  char *json_enc;
+  GNUNET_STRINGS_base64_encode (json,
+                                strlen (json) + 1,
+                                &json_enc);
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Presentation: %s\n", json_enc);
+  // clean up
+  *presentation = GNUNET_RECLAIM_presentation_new (
+    GNUNET_RECLAIM_CREDENTIAL_TYPE_PABC,
+    json_enc,
+    strlen (json_enc) + 1);
+  GNUNET_free (json_enc);
+  PABC_FREE_NULL (json);
+  pabc_free_proof (ctx, pp, &proof);
+  pabc_free_credential (ctx, pp, &cred);
+  pabc_free_user_context (ctx, pp, &usr_ctx);
+  pabc_free_public_parameters (ctx, &pp);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_plugin_reclaim_credential_pabc_init (void *cls)
+{
+  struct GNUNET_RECLAIM_CredentialPluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_RECLAIM_CredentialPluginFunctions);
+  api->value_to_string = &pabc_value_to_string;
+  api->string_to_value = &pabc_string_to_value;
+  api->typename_to_number = &pabc_typename_to_number;
+  api->number_to_typename = &pabc_number_to_typename;
+  api->get_attributes = &pabc_parse_attributes_c;
+  api->get_issuer = &pabc_get_issuer_c;
+  api->get_expiration = &pabc_get_expiration_c;
+  api->value_to_string_p = &pabc_value_to_string;
+  api->string_to_value_p = &pabc_string_to_value;
+  api->typename_to_number_p = &pabc_typename_to_number;
+  api->number_to_typename_p = &pabc_number_to_typename;
+  api->get_attributes_p = &pabc_parse_attributes_p;
+  api->get_issuer_p = &pabc_get_issuer_p;
+  api->get_expiration_p = &pabc_get_expiration_p;
+  api->create_presentation = &pabc_create_presentation;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_plugin_block_test_init()
+ * @return NULL
+ */
+void *
+libgnunet_plugin_reclaim_credential_pabc_done (void *cls)
+{
+  struct GNUNET_RECLAIM_CredentialPluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_reclaim_credential_type_pabc.c */
diff --git a/src/plugin/regex/Makefile.am b/src/plugin/regex/Makefile.am
new file mode 100644
index 000000000..a39cfc927
--- /dev/null
+++ b/src/plugin/regex/Makefile.am
@@ -0,0 +1,40 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+lib_LTLIBRARIES = \
+  libgnunetregexblock.la
+
+libgnunetregexblock_la_SOURCES = \
+  regex_block_lib.c regex_block_lib.h
+libgnunetregexblock_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(XLIB) \
+  $(LTLIBINTL)
+libgnunetregexblock_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)  \
+  -version-info 1:0:0
+
+
+plugin_LTLIBRARIES = \
+ libgnunet_plugin_block_regex.la
+
+libgnunet_plugin_block_regex_la_SOURCES = \
+ plugin_block_regex.c
+libgnunet_plugin_block_regex_la_LIBADD = \
+ libgnunetregexblock.la \
+ $(top_builddir)/src/lib/block/libgnunetblock.la \
+ $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunet_plugin_block_regex_la_LDFLAGS = \
+ $(GN_LIBINTL) \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/regex/meson.build b/src/plugin/regex/meson.build
new file mode 100644
index 000000000..0e1b4b08d
--- /dev/null
+++ b/src/plugin/regex/meson.build
@@ -0,0 +1,23 @@
+libgnunetregexblock_src = ['regex_block_lib.c']
+
+libgnunetregexblock = library('gnunetregexblock',
+        libgnunetregexblock_src,
+        soversion: '1',
+        version: '1.0.0',
+        dependencies: libgnunetutil_dep,
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetregexblock_dep = declare_dependency(link_with : libgnunetregexblock)
+
+shared_module('gnunet_plugin_block_regex',
+        ['plugin_block_regex.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetregexblock_dep,
+                       libgnunetblock_dep,
+                       libgnunetblockgroup_dep],
+        include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
+
diff --git a/src/plugin/regex/plugin_block_regex.c b/src/plugin/regex/plugin_block_regex.c
new file mode 100644
index 000000000..5f23a32df
--- /dev/null
+++ b/src/plugin/regex/plugin_block_regex.c
@@ -0,0 +1,380 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file regex/plugin_block_regex.c
+ * @brief blocks used for regex storage and search
+ * @author Bartlomiej Polot
+ */
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+#include "block_regex.h"
+#include "regex_block_lib.h"
+#include "gnunet_signatures.h"
+
+
+/**
+ * Number of bits we set per entry in the bloomfilter.
+ * Do not change!
+ */
+#define BLOOMFILTER_K 16
+
+
+/**
+ * How big is the BF we use for REGEX blocks?
+ */
+#define REGEX_BF_SIZE 8
+
+
+/**
+ * Create a new block group.
+ *
+ * @param ctx block context in which the block group is created
+ * @param type type of the block for which we are creating the group
+ * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
+ * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
+ * @param va variable arguments specific to @a type
+ * @return block group handle, NULL if block groups are not supported
+ *         by this @a type of block (this is not an error)
+ */
+static struct GNUNET_BLOCK_Group *
+block_plugin_regex_create_group (void *cls,
+                                 enum GNUNET_BLOCK_Type type,
+                                 const void *raw_data,
+                                 size_t raw_data_size,
+                                 va_list va)
+{
+  unsigned int bf_size;
+  const char *guard;
+
+  guard = va_arg (va, const char *);
+  if (0 == strcmp (guard,
+                   "seen-set-size"))
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
+                                                                   int),
+                                                           BLOOMFILTER_K);
+  else if (0 == strcmp (guard,
+                        "filter-size"))
+    bf_size = va_arg (va, unsigned int);
+  else
+  {
+    GNUNET_break (0);
+    bf_size = REGEX_BF_SIZE;
+  }
+  GNUNET_break (NULL == va_arg (va, const char *));
+  return GNUNET_BLOCK_GROUP_bf_create (cls,
+                                       bf_size,
+                                       BLOOMFILTER_K,
+                                       type,
+                                       raw_data,
+                                       raw_data_size);
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_regex_check_query (void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                const struct GNUNET_HashCode *query,
+                                const void *xquery,
+                                size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (0 != xquery_size)
+    {
+      const char *s;
+
+      s = (const char *) xquery;
+      if ('\0' != s[xquery_size - 1])     /* must be valid 0-terminated string */
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+    }
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_regex_check_block (void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                const void *block,
+                                size_t block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (GNUNET_SYSERR ==
+        REGEX_BLOCK_check (block,
+                           block_size,
+                           NULL,
+                           NULL))
+      return GNUNET_NO;
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    {
+      const struct RegexAcceptBlock *rba;
+
+      if (sizeof(struct RegexAcceptBlock) != block_size)
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      rba = block;
+      if (ntohl (rba->purpose.size) !=
+          sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+          + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+          + sizeof(struct GNUNET_HashCode))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      if (GNUNET_TIME_absolute_is_past (GNUNET_TIME_absolute_ntoh (
+                                          rba->expiration_time)))
+      {
+        return GNUNET_NO;
+      }
+      if (GNUNET_OK !=
+          GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT,
+                                       &rba->purpose,
+                                       &rba->signature,
+                                       &rba->peer.public_key))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_regex_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  struct GNUNET_HashCode chash;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (0 != xquery_size)
+    {
+      const char *s;
+
+      s = (const char *) xquery;
+      GNUNET_assert ('\0' == s[xquery_size - 1]);
+    }
+    switch (REGEX_BLOCK_check (reply_block,
+                               reply_block_size,
+                               query,
+                               xquery))
+    {
+    case GNUNET_SYSERR:
+      GNUNET_assert (0);
+    case GNUNET_NO:
+      /* xquery mismatch, can happen */
+      return GNUNET_BLOCK_REPLY_IRRELEVANT;
+    default:
+      break;
+    }
+    GNUNET_CRYPTO_hash (reply_block,
+                        reply_block_size,
+                        &chash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                            &chash))
+      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    {
+      const struct RegexAcceptBlock *rba;
+
+      GNUNET_assert (sizeof(struct RegexAcceptBlock) == reply_block_size);
+      rba = reply_block;
+      GNUNET_assert (ntohl (rba->purpose.size) ==
+                     sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                     + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+                     + sizeof(struct GNUNET_HashCode));
+      GNUNET_CRYPTO_hash (reply_block,
+                          reply_block_size,
+                          &chash);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &chash))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in @a block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported,
+ *         #GNUNET_NO if extracting a key from a block of this type does not work
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_regex_get_key (void *cls,
+                            enum GNUNET_BLOCK_Type type,
+                            const void *block,
+                            size_t block_size,
+                            struct GNUNET_HashCode *key)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (GNUNET_OK !=
+        REGEX_BLOCK_get_key (block,
+                             block_size,
+                             key))
+    {
+      GNUNET_break_op (0);
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
+    }
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    if (sizeof(struct RegexAcceptBlock) != block_size)
+    {
+      GNUNET_break_op (0);
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
+    }
+    *key = ((struct RegexAcceptBlock *) block)->key;
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_regex_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_REGEX,
+    GNUNET_BLOCK_TYPE_REGEX_ACCEPT,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_regex_get_key;
+  api->check_query = &block_plugin_regex_check_query;
+  api->check_block = &block_plugin_regex_check_block;
+  api->check_reply = &block_plugin_regex_check_reply;
+  api->create_group = &block_plugin_regex_create_group;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_regex_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_regex.c */
diff --git a/src/plugin/regex/regex_block_lib.c b/src/plugin/regex/regex_block_lib.c
new file mode 100644
index 000000000..048d6d743
--- /dev/null
+++ b/src/plugin/regex/regex_block_lib.c
@@ -0,0 +1,431 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012,2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Bartlomiej Polot
+ * @file regex/regex_block_lib.c
+ * @brief functions for manipulating non-accept blocks stored for
+ *        regex in the DHT
+ */
+#include "platform.h"
+#include "regex_block_lib.h"
+#include "gnunet_constants.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "regex-bck", __VA_ARGS__)
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Information for each edge.
+ */
+struct EdgeInfo
+{
+  /**
+   * Index of the destination of this edge in the
+   * unique destinations array.
+   */
+  uint16_t destination_index GNUNET_PACKED;
+
+  /**
+   * Number of bytes the token for this edge takes in the
+   * token area.
+   */
+  uint16_t token_length GNUNET_PACKED;
+};
+
+
+/**
+ * @brief Block to announce a regex state.
+ */
+struct RegexBlock
+{
+  /**
+   * Length of the proof regex string.
+   */
+  uint16_t proof_len GNUNET_PACKED;
+
+  /**
+   * Is this state an accepting state?
+   */
+  int16_t is_accepting GNUNET_PACKED;
+
+  /**
+   * Number of edges parting from this state.
+   */
+  uint16_t num_edges GNUNET_PACKED;
+
+  /**
+   * Number of unique destinations reachable from this state.
+   */
+  uint16_t num_destinations GNUNET_PACKED;
+
+  /* followed by 'struct GNUNET_HashCode[num_destinations]' */
+
+  /* followed by 'struct EdgeInfo[edge_destination_indices]' */
+
+  /* followed by 'char proof[n_proof]', NOT 0-terminated */
+
+  /* followed by 'char tokens[num_edges][edge_info[k].token_length]';
+     essentially all of the tokens one after the other in the
+     order of the edges; tokens are NOT 0-terminated */
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Test if this block is marked as being an accept state.
+ *
+ * @param block block to test
+ * @param size number of bytes in block
+ * @return #GNUNET_YES if the block is accepting, #GNUNET_NO if not
+ */
+int
+GNUNET_BLOCK_is_accepting (const struct RegexBlock *block,
+                           size_t size)
+{
+  if (size < sizeof(struct RegexBlock))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return ntohs (block->is_accepting);
+}
+
+
+int
+REGEX_BLOCK_check_proof (const char *proof,
+                         size_t proof_len,
+                         const struct GNUNET_HashCode *key)
+{
+  struct GNUNET_HashCode key_check;
+
+  if ((NULL == proof) || (NULL == key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Proof check failed, was NULL.\n");
+    return GNUNET_NO;
+  }
+  GNUNET_CRYPTO_hash (proof, proof_len, &key_check);
+  return (0 ==
+          GNUNET_CRYPTO_hash_cmp (key, &key_check)) ? GNUNET_OK : GNUNET_NO;
+}
+
+
+/**
+ * Struct to keep track of the xquery while iterating all the edges in a block.
+ */
+struct CheckEdgeContext
+{
+  /**
+   * Xquery: string we are looking for.
+   */
+  const char *xquery;
+
+  /**
+   * Has any edge matched the xquery so far? (GNUNET_OK / GNUNET_NO)
+   */
+  int found;
+};
+
+
+/**
+ * Iterator over all edges in a block, checking for a presence of a given query.
+ *
+ * @param cls Closure, (xquery context).
+ * @param token Token that follows to next state.
+ * @param len Length of token.
+ * @param key Hash of next state.
+ *
+ * @return #GNUNET_YES, to keep iterating
+ */
+static int
+check_edge (void *cls,
+            const char *token,
+            size_t len,
+            const struct GNUNET_HashCode *key)
+{
+  struct CheckEdgeContext *ctx = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "edge %.*s [%u]: %s\n",
+              (int) len,
+              token,
+              (unsigned int) len,
+              GNUNET_h2s (key));
+  if (NULL == ctx->xquery)
+    return GNUNET_YES;
+  if (strlen (ctx->xquery) < len)
+    return GNUNET_YES; /* too long */
+  if (0 == strncmp (ctx->xquery, token, len))
+    ctx->found = GNUNET_OK;
+  return GNUNET_YES; /* keep checking for malformed data! */
+}
+
+
+int
+REGEX_BLOCK_check (const struct RegexBlock *block,
+                   size_t size,
+                   const struct GNUNET_HashCode *query,
+                   const char *xquery)
+{
+  struct GNUNET_HashCode key;
+  struct CheckEdgeContext ctx;
+  int res;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Block check\n");
+  if (GNUNET_OK !=
+      REGEX_BLOCK_get_key (block, size,
+                           &key))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if ((NULL != query) &&
+      (0 != GNUNET_memcmp (&key,
+                           query)) )
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if ((GNUNET_YES == ntohs (block->is_accepting)) &&
+      ((NULL == xquery) || ('\0' == xquery[0])))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "  out! Is accepting: %u, xquery %p\n",
+         ntohs (block->is_accepting),
+         xquery);
+    return GNUNET_OK;
+  }
+  ctx.xquery = xquery;
+  ctx.found = GNUNET_NO;
+  res = REGEX_BLOCK_iterate (block, size, &check_edge, &ctx);
+  if (GNUNET_SYSERR == res)
+    return GNUNET_SYSERR;
+  if (NULL == xquery)
+    return GNUNET_YES;
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Result %d\n", ctx.found);
+  return ctx.found;
+}
+
+
+int
+REGEX_BLOCK_get_key (const struct RegexBlock *block,
+                     size_t block_len,
+                     struct GNUNET_HashCode *key)
+{
+  uint16_t len;
+  const struct GNUNET_HashCode *destinations;
+  const struct EdgeInfo *edges;
+  uint16_t num_destinations;
+  uint16_t num_edges;
+  size_t total;
+
+  if (block_len < sizeof(struct RegexBlock))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  num_destinations = ntohs (block->num_destinations);
+  num_edges = ntohs (block->num_edges);
+  len = ntohs (block->proof_len);
+  destinations = (const struct GNUNET_HashCode *) &block[1];
+  edges = (const struct EdgeInfo *) &destinations[num_destinations];
+  total = sizeof(struct RegexBlock) + num_destinations * sizeof(struct
+                                                                GNUNET_HashCode)
+          + num_edges * sizeof(struct EdgeInfo) + len;
+  if (block_len < total)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CRYPTO_hash (&edges[num_edges], len, key);
+  return GNUNET_OK;
+}
+
+
+int
+REGEX_BLOCK_iterate (const struct RegexBlock *block,
+                     size_t size,
+                     REGEX_INTERNAL_EgdeIterator iterator,
+                     void *iter_cls)
+{
+  uint16_t len;
+  const struct GNUNET_HashCode *destinations;
+  const struct EdgeInfo *edges;
+  const char *aux;
+  uint16_t num_destinations;
+  uint16_t num_edges;
+  size_t total;
+  unsigned int n;
+  size_t off;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Block iterate\n");
+  if (size < sizeof(struct RegexBlock))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  num_destinations = ntohs (block->num_destinations);
+  num_edges = ntohs (block->num_edges);
+  len = ntohs (block->proof_len);
+  destinations = (const struct GNUNET_HashCode *) &block[1];
+  edges = (const struct EdgeInfo *) &destinations[num_destinations];
+  aux = (const char *) &edges[num_edges];
+  total = sizeof(struct RegexBlock) + num_destinations * sizeof(struct
+                                                                GNUNET_HashCode)
+          + num_edges * sizeof(struct EdgeInfo) + len;
+  if (size < total)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  for (n = 0; n < num_edges; n++)
+    total += ntohs (edges[n].token_length);
+  if (size != total)
+  {
+    fprintf (stderr, "Expected %u, got %u\n",
+             (unsigned int) size,
+             (unsigned int) total);
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  off = len;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Start iterating block of size %lu, proof %u, off %lu edges %u\n",
+       (unsigned long) size, len, (unsigned long) off, n);
+  /* &aux[off] always points to our token */
+  for (n = 0; n < num_edges; n++)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Edge %u/%u, off %lu tokenlen %u (%.*s)\n",
+         n + 1, num_edges, (unsigned long) off,
+         ntohs (edges[n].token_length), ntohs (edges[n].token_length),
+         &aux[off]);
+    if (NULL != iterator)
+      if (GNUNET_NO == iterator (iter_cls,
+                                 &aux[off],
+                                 ntohs (edges[n].token_length),
+                                 &destinations[ntohs (
+                                                 edges[n].destination_index)]))
+        return GNUNET_OK;
+    off += ntohs (edges[n].token_length);
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Construct a regex block to be stored in the DHT.
+ *
+ * @param proof proof string for the block
+ * @param num_edges number of edges in the block
+ * @param edges the edges of the block
+ * @param accepting is this an accepting state
+ * @param rsize set to the size of the returned block (OUT-only)
+ * @return the regex block, NULL on error
+ */
+struct RegexBlock *
+REGEX_BLOCK_create (const char *proof,
+                    unsigned int num_edges,
+                    const struct REGEX_BLOCK_Edge *edges,
+                    int accepting,
+                    size_t *rsize)
+{
+  struct RegexBlock *block;
+  struct GNUNET_HashCode destinations[1024]; /* 1024 = 64k/64 bytes/key == absolute MAX */
+  uint16_t destination_indices[num_edges];
+  struct GNUNET_HashCode *dests;
+  struct EdgeInfo *edgeinfos;
+  size_t off;
+  size_t len;
+  size_t total;
+  size_t slen;
+  unsigned int unique_destinations;
+  unsigned int j;
+  unsigned int i;
+  char *aux;
+
+  len = strlen (proof);
+  if (len > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  unique_destinations = 0;
+  total = sizeof(struct RegexBlock) + len;
+  for (i = 0; i < num_edges; i++)
+  {
+    slen = strlen (edges[i].label);
+    if (slen > UINT16_MAX)
+    {
+      GNUNET_break (0);
+      return NULL;
+    }
+    total += slen;
+    for (j = 0; j < unique_destinations; j++)
+      if (0 == memcmp (&destinations[j],
+                       &edges[i].destination,
+                       sizeof(struct GNUNET_HashCode)))
+        break;
+    if (j >= 1024)
+    {
+      GNUNET_break (0);
+      return NULL;
+    }
+    destination_indices[i] = j;
+    if (j == unique_destinations)
+      destinations[unique_destinations++] = edges[i].destination;
+  }
+  total += num_edges * sizeof(struct EdgeInfo) + unique_destinations
+           * sizeof(struct GNUNET_HashCode);
+  if (total >= GNUNET_CONSTANTS_MAX_BLOCK_SIZE)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  block = GNUNET_malloc (total);
+  block->proof_len = htons (len);
+  block->is_accepting = htons (accepting);
+  block->num_edges = htons (num_edges);
+  block->num_destinations = htons (unique_destinations);
+  dests = (struct GNUNET_HashCode *) &block[1];
+  GNUNET_memcpy (dests, destinations, sizeof(struct GNUNET_HashCode)
+                 * unique_destinations);
+  edgeinfos = (struct EdgeInfo *) &dests[unique_destinations];
+  aux = (char *) &edgeinfos[num_edges];
+  off = len;
+  GNUNET_memcpy (aux, proof, len);
+  for (i = 0; i < num_edges; i++)
+  {
+    slen = strlen (edges[i].label);
+    edgeinfos[i].token_length = htons ((uint16_t) slen);
+    edgeinfos[i].destination_index = htons (destination_indices[i]);
+    GNUNET_memcpy (&aux[off],
+                   edges[i].label,
+                   slen);
+    off += slen;
+  }
+  *rsize = total;
+  return block;
+}
+
+
+/* end of regex_block_lib.c */
diff --git a/src/plugin/regex/regex_block_lib.h b/src/plugin/regex/regex_block_lib.h
new file mode 100644
index 000000000..11029b9af
--- /dev/null
+++ b/src/plugin/regex/regex_block_lib.h
@@ -0,0 +1,193 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012,2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Bartlomiej Polot
+ * @file regex/regex_block_lib.h
+ * @brief common function to manipulate blocks stored by regex in the DHT
+ */
+
+#ifndef REGEX_BLOCK_LIB_H_
+#define REGEX_BLOCK_LIB_H_
+
+#ifdef __cplusplus
+extern "C"
+{
+#if 0
+/* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+#include "platform.h"
+#include "block_regex.h"
+
+
+/**
+ * Representation of a Regex node (and edges) in the DHT.
+ */
+struct RegexBlock;
+
+
+/**
+ * Edge representation.
+ */
+struct REGEX_BLOCK_Edge
+{
+  /**
+   * Label of the edge.  FIXME: might want to not consume exactly
+   * multiples of 8 bits, need length!
+   */
+  const char *label;
+
+  /**
+   * Destination of the edge.
+   */
+  struct GNUNET_HashCode destination;
+};
+
+
+/**
+ * Check if the given 'proof' matches the given 'key'.
+ *
+ * @param proof partial regex of a state
+ * @param proof_len number of bytes in @a proof
+ * @param key hash of a state.
+ * @return #GNUNET_OK if the proof is valid for the given key.
+ */
+int
+REGEX_BLOCK_check_proof (const char *proof,
+                         size_t proof_len,
+                         const struct GNUNET_HashCode *key);
+
+
+/**
+ * Check if the regex block is well formed, including all edges.
+ *
+ * @param block The start of the block.
+ * @param size The size of the @a block.
+ * @param query the query for the @a block
+ * @param xquery String describing the edge we are looking for.
+ *               Can be NULL in case this is a put block.
+ * @return #GNUNET_OK in case it's fine.
+ *         #GNUNET_NO in case the xquery exists and is not found (IRRELEVANT).
+ *         #GNUNET_SYSERR if the block is invalid.
+ */
+int
+REGEX_BLOCK_check (const struct RegexBlock *block,
+                   size_t size,
+                   const struct GNUNET_HashCode *query,
+                   const char *xquery);
+
+
+/* FIXME: might want to use 'struct REGEX_BLOCK_Edge' here instead of 3 arguments! */
+
+/**
+ * Iterator over edges in a block.
+ *
+ * @param cls Closure.
+ * @param token Token that follows to next state.
+ * @param len Length of token.
+ * @param key Hash of next state.
+ * @return #GNUNET_YES if should keep iterating, #GNUNET_NO otherwise.
+ */
+typedef int
+(*REGEX_INTERNAL_EgdeIterator)(void *cls,
+                               const char *token,
+                               size_t len,
+                               const struct GNUNET_HashCode *key);
+
+
+/**
+ * Iterate over all edges of a block of a regex state.
+ *
+ * @param block Block to iterate over.
+ * @param size Size of block.
+ * @param iterator Function to call on each edge in the block.
+ * @param iter_cls Closure for the @a iterator.
+ * @return #GNUNET_SYSERR if an error has been encountered.
+ *         #GNUNET_OK if no error has been encountered.
+ *           Note that if the iterator stops the iteration by returning
+ *         #GNUNET_NO, the block will no longer be checked for further errors.
+ *           The return value will be #GNUNET_OK meaning that no errors were
+ *         found until the edge last notified to the iterator, but there might
+ *         be errors in further edges.
+ */
+int
+REGEX_BLOCK_iterate (const struct RegexBlock *block,
+                     size_t size,
+                     REGEX_INTERNAL_EgdeIterator iterator,
+                     void *iter_cls);
+
+
+/**
+ * Obtain the key that a particular block is to be stored under.
+ *
+ * @param block block to get the key from
+ * @param block_len number of bytes in @a block
+ * @param key where to store the key
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the block is malformed
+ */
+int
+REGEX_BLOCK_get_key (const struct RegexBlock *block,
+                     size_t block_len,
+                     struct GNUNET_HashCode *key);
+
+
+/**
+ * Test if this block is marked as being an accept state.
+ *
+ * @param block block to test
+ * @param size number of bytes in block
+ * @return #GNUNET_YES if the block is accepting, #GNUNET_NO if not
+ */
+int
+GNUNET_BLOCK_is_accepting (const struct RegexBlock *block,
+                           size_t block_len);
+
+
+/**
+ * Construct a regex block to be stored in the DHT.
+ *
+ * @param proof proof string for the block
+ * @param num_edges number of edges in the block
+ * @param edges the edges of the block
+ * @param accepting is this an accepting state
+ * @param rsize set to the size of the returned block (OUT-only)
+ * @return the regex block, NULL on error
+ */
+struct RegexBlock *
+REGEX_BLOCK_create (const char *proof,
+                    unsigned int num_edges,
+                    const struct REGEX_BLOCK_Edge *edges,
+                    int accepting,
+                    size_t *rsize);
+
+
+#if 0                           /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+/* ifndef REGEX_BLOCK_LIB_H */
+#endif
+/* end of regex_block_lib.h */
diff --git a/src/plugin/revocation/Makefile.am b/src/plugin/revocation/Makefile.am
new file mode 100644
index 000000000..99373f8d7
--- /dev/null
+++ b/src/plugin/revocation/Makefile.am
@@ -0,0 +1,27 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_revocation.la
+
+libgnunet_plugin_block_revocation_la_SOURCES = \
+  plugin_block_revocation.c
+libgnunet_plugin_block_revocation_la_LIBADD = \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la  \
+  $(LTLIBINTL)
+libgnunet_plugin_block_revocation_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/revocation/meson.build b/src/plugin/revocation/meson.build
new file mode 100644
index 000000000..0ac8df28d
--- /dev/null
+++ b/src/plugin/revocation/meson.build
@@ -0,0 +1,9 @@
+shared_module('gnunet_plugin_block_revocation',
+              ['plugin_block_revocation.c'],
+              dependencies: [libgnunetutil_dep,
+                             libgnunetgnsrecord_dep,
+                             libgnunetblock_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/revocation/plugin_block_revocation.c b/src/plugin/revocation/plugin_block_revocation.c
new file mode 100644
index 000000000..c4332184e
--- /dev/null
+++ b/src/plugin/revocation/plugin_block_revocation.c
@@ -0,0 +1,309 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file block/plugin_block_revocation.c
+ * @brief revocation for a block plugin
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_block_group_lib.h"
+#include "../../service/revocation/revocation.h"
+#include "gnunet_revocation_service.h"
+
+#define DEBUG_REVOCATION GNUNET_EXTRA_LOGGING
+
+/**
+ * Context used inside the plugin.
+ */
+struct InternalContext
+{
+  unsigned int matching_bits;
+  struct GNUNET_TIME_Relative epoch_duration;
+};
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_revocation_check_query (void *cls,
+                                     enum GNUNET_BLOCK_Type type,
+                                     const struct GNUNET_HashCode *query,
+                                     const void *xquery,
+                                     size_t xquery_size)
+{
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_revocation_check_block (void *cls,
+                                     enum GNUNET_BLOCK_Type type,
+                                     const void *block,
+                                     size_t block_size)
+{
+  struct InternalContext *ic = cls;
+  const struct RevokeMessage *rm = block;
+  const struct GNUNET_GNSRECORD_PowP *pow
+    = (const struct GNUNET_GNSRECORD_PowP *) &rm[1];
+  struct GNUNET_CRYPTO_PublicKey pk;
+  size_t pklen;
+  size_t left;
+
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (block_size < sizeof(*rm) + sizeof(*pow))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (block_size != sizeof(*rm) + ntohl (rm->pow_size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  left = block_size - sizeof (*rm) - sizeof (*pow);
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_read_public_key_from_buffer (&pow[1],
+                                                 left,
+                                                 &pk,
+                                                 &pklen))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (0 == pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (GNUNET_YES !=
+      GNUNET_GNSRECORD_check_pow (pow,
+                                  ic->matching_bits,
+                                  ic->epoch_duration))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_revocation_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  (void) cls;
+  (void) group;
+  (void) query;
+  (void) xquery;
+  (void) xquery_size;
+  (void) reply_block;
+  (void) reply_block_size;
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  return GNUNET_BLOCK_REPLY_OK_LAST;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_revocation_get_key (void *cls,
+                                 enum GNUNET_BLOCK_Type type,
+                                 const void *block,
+                                 size_t block_size,
+                                 struct GNUNET_HashCode *key)
+{
+  const struct RevokeMessage *rm = block;
+  const struct GNUNET_GNSRECORD_PowP *pow
+    = (const struct GNUNET_GNSRECORD_PowP *) &rm[1];
+  struct GNUNET_CRYPTO_PublicKey pk;
+  size_t pklen;
+  size_t left;
+
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (block_size < sizeof(*rm) + sizeof(*pow))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (block_size != sizeof(*rm) + ntohl (rm->pow_size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  left = block_size - sizeof (*rm) - sizeof (*pow);
+  if (GNUNET_SYSERR == GNUNET_CRYPTO_read_public_key_from_buffer (&pow[1],
+                                                                  left,
+                                                                  &pk,
+                                                                  &pklen))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (0 == pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  GNUNET_CRYPTO_hash (&pow[1],
+                      pklen,
+                      key);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the configuration to use
+ */
+void *
+libgnunet_plugin_block_revocation_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_REVOCATION,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_BLOCK_PluginFunctions *api;
+  struct InternalContext *ic;
+  unsigned long long matching_bits;
+  struct GNUNET_TIME_Relative epoch_duration;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (cfg,
+                                             "REVOCATION",
+                                             "WORKBITS",
+                                             &matching_bits))
+    return NULL;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_time (cfg,
+                                           "REVOCATION",
+                                           "EPOCH_DURATION",
+                                           &epoch_duration))
+    return NULL;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_revocation_get_key;
+  api->check_query = &block_plugin_revocation_check_query;
+  api->check_block = &block_plugin_revocation_check_block;
+  api->check_reply = &block_plugin_revocation_check_reply;
+  api->create_group = NULL;
+  api->types = types;
+  ic = GNUNET_new (struct InternalContext);
+  ic->matching_bits = (unsigned int) matching_bits;
+  ic->epoch_duration = epoch_duration;
+  api->cls = ic;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_revocation_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+  struct InternalContext *ic = api->cls;
+
+  GNUNET_free (ic);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_revocation.c */
diff --git a/src/plugin/seti/Makefile.am b/src/plugin/seti/Makefile.am
new file mode 100644
index 000000000..e6f579a65
--- /dev/null
+++ b/src/plugin/seti/Makefile.am
@@ -0,0 +1,25 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = -fprofile-arcs -ftest-coverage
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_seti_test.la
+
+libgnunet_plugin_block_seti_test_la_SOURCES = \
+  plugin_block_seti_test.c
+libgnunet_plugin_block_seti_test_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_seti_test_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/seti/meson.build b/src/plugin/seti/meson.build
new file mode 100644
index 000000000..880936164
--- /dev/null
+++ b/src/plugin/seti/meson.build
@@ -0,0 +1,7 @@
+shared_module('gnunet_plugin_block_seti_test',
+              ['plugin_block_seti_test.c'],
+              dependencies: libgnunetutil_dep,
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/seti/plugin_block_seti_test.c b/src/plugin/seti/plugin_block_seti_test.c
new file mode 100644
index 000000000..5b9196cef
--- /dev/null
+++ b/src/plugin/seti/plugin_block_seti_test.c
@@ -0,0 +1,197 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file seti/plugin_block_seti_test.c
+ * @brief set test block, recognizes elements with non-zero first byte as invalid
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_seti_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_seti_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const void *block,
+                                    size_t block_size)
+{
+  (void) cls;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if ((NULL == block) ||
+      (0 == block_size) ||
+      (0 != ((char *) block)[0]))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_seti_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  if ( (NULL == reply_block) ||
+       (0 == reply_block_size) ||
+       (0 != ((char *) reply_block)[0]) )
+    GNUNET_assert (0);
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_seti_test_get_key (void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                const void *block,
+                                size_t block_size,
+                                struct GNUNET_HashCode *key)
+{
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_seti_test_init (void *cls)
+{
+  static enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_SETI_TEST,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_seti_test_get_key;
+  api->check_query = &block_plugin_seti_test_check_query;
+  api->check_block = &block_plugin_seti_test_check_block;
+  api->check_reply = &block_plugin_seti_test_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_seti_test_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_seti_test.c */
diff --git a/src/plugin/setu/Makefile.am b/src/plugin/setu/Makefile.am
new file mode 100644
index 000000000..90a14cce0
--- /dev/null
+++ b/src/plugin/setu/Makefile.am
@@ -0,0 +1,21 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_setu_test.la
+
+libgnunet_plugin_block_setu_test_la_SOURCES = \
+  plugin_block_setu_test.c
+libgnunet_plugin_block_setu_test_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_setu_test_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
diff --git a/src/plugin/setu/meson.build b/src/plugin/setu/meson.build
new file mode 100644
index 000000000..e22738ab6
--- /dev/null
+++ b/src/plugin/setu/meson.build
@@ -0,0 +1,7 @@
+shared_module('gnunet_plugin_block_setu_test',
+              ['plugin_block_setu_test.c'],
+              dependencies: libgnunetutil_dep,
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
diff --git a/src/plugin/setu/plugin_block_setu_test.c b/src/plugin/setu/plugin_block_setu_test.c
new file mode 100644
index 000000000..178ad3314
--- /dev/null
+++ b/src/plugin/setu/plugin_block_setu_test.c
@@ -0,0 +1,195 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file setu/plugin_block_setu_test.c
+ * @brief set test block, recognizes elements with non-zero first byte as invalid
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_setu_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_setu_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if ( (NULL == block) ||
+       (0 == block_size) ||
+       (0 != ((char *) block)[0]) )
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_setu_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  if ( (NULL == reply_block) ||
+       (0 == reply_block_size) ||
+       (0 != ((char *) reply_block)[0]) )
+    GNUNET_assert (0);
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_setu_test_get_key (void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                const void *block,
+                                size_t block_size,
+                                struct GNUNET_HashCode *key)
+{
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_setu_test_init (void *cls)
+{
+  static enum GNUNET_BLOCK_Type types[] = {
+                                           GNUNET_BLOCK_TYPE_SETU_TEST,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_setu_test_get_key;
+  api->check_query = &block_plugin_setu_test_check_query;
+  api->check_block = &block_plugin_setu_test_check_block;
+  api->check_reply = &block_plugin_setu_test_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_setu_test_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_setu_test.c */