70 files changed, 20202 insertions, 1 deletions

diff --git a/src/service/Makefile.am b/src/service/Makefile.am
index d94046cde..737a4fd4d 100644
--- a/src/service/Makefile.am
+++ b/src/service/Makefile.am
@@ -1,2 +1,6 @@
 SUBDIRS = \
-        util
+        util \
+        arm \
+        core \
+        identity \
+        rest
diff --git a/src/service/arm/.gitignore b/src/service/arm/.gitignore
new file mode 100644
index 000000000..b1d66852b
--- /dev/null
+++ b/src/service/arm/.gitignore
@@ -0,0 +1,7 @@
+arm.conf
+mockup-service
+gnunet-service-arm
+test_arm_api
+test_exponential_backoff
+test_gnunet_arm.py
+test_gnunet_service_arm
diff --git a/src/service/arm/Makefile.am b/src/service/arm/Makefile.am
new file mode 100644
index 000000000..32addeef1
--- /dev/null
+++ b/src/service/arm/Makefile.am
@@ -0,0 +1,77 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfg_DATA = \
+  arm.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+lib_LTLIBRARIES = libgnunetarm.la
+
+libgnunetarm_la_SOURCES = \
+  arm_api.c arm_monitor_api.c arm.h
+libgnunetarm_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL) $(XLIB)
+libgnunetarm_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)   \
+  -version-info 2:0:0
+
+
+noinst_PROGRAMS = \
+ mockup-service
+
+libexec_PROGRAMS = \
+ gnunet-service-arm
+
+gnunet_service_arm_SOURCES = \
+ gnunet-service-arm.c
+gnunet_service_arm_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL)
+
+mockup_service_SOURCES = \
+  mockup-service.c
+ mockup_service_LDADD = \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+mockup_service_LDFLAGS = \
+ $(GN_LIBINTL)
+
+
+check_PROGRAMS = \
+ test_arm_api \
+ test_exponential_backoff \
+ test_gnunet_service_arm
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)  $(check_SCRIPTS)
+endif
+
+test_arm_api_SOURCES = \
+ test_arm_api.c
+test_arm_api_LDADD = \
+  libgnunetarm.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_exponential_backoff_SOURCES = \
+ test_exponential_backoff.c
+test_exponential_backoff_LDADD = \
+  libgnunetarm.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_gnunet_service_arm_SOURCES = \
+ test_gnunet_service_arm.c
+ test_gnunet_service_arm_LDADD = \
+  libgnunetarm.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_arm_api_data.conf
diff --git a/src/service/arm/arm.conf.in b/src/service/arm/arm.conf.in
new file mode 100644
index 000000000..8015e0e15
--- /dev/null
+++ b/src/service/arm/arm.conf.in
@@ -0,0 +1,60 @@
+[arm]
+@UNIXONLY@ PORT = 2087
+HOSTNAME = localhost
+BINARY = gnunet-service-arm
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+
+# Special case, uses user runtime dir even for per-system service.
+UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-arm.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
+
+# In the "-l" option, format characters from 'strftime' are allowed;
+# In the GLOBAL_POSTFIX, "{}" stands for the name of the respective
+# service.  Thus the following option would introduce per-service
+# logging with a new log file each day.  Note that only the last 3
+# log files are preserved.
+# GLOBAL_POSTFIX = -l $GNUNET_CACHE_HOME/{}-%Y-%m-%d.log
+GLOBAL_PREFIX =
+
+# By default, when launching GNUnet via gnunet-arm, log
+# everything to a simple flat log file.
+OPTIONS = -l $GNUNET_CACHE_HOME/gnunet-%Y-%m-%d.log
+
+# If set to YES, ARM will only start services that are marked as
+# system-level services (and we'll expect a second ARM to be
+# run per-user to run user-level services).  Note that in this
+# case you must have manually created a different configuration
+# file with the user where at least this and the START_USER_SERVICES
+# options differ.
+# START_SYSTEM_SERVICES = YES
+
+# If set to YES, ARM will only start services that are marked as
+# per-user services (and we'll expect a system user to run ARM to
+# provide system-level services).  Per-user services enable
+# better personalization and  privilege separation and in particular
+# ensures that personal data is stored under $HOME, which might
+# be important in a multi-user system (or if $HOME is encrypted
+# and /var/ is not).
+#
+# Note that if you have different ARM services for SYSTEM and USER,
+# and you are not on UNIX, you need to change the PORT option for the
+# USER ARM instances to some free port (counting down from 2085 should
+# be sane).
+#
+# START_USER_SERVICES = YES
+
+# File where we should log per-service resource consumption on exit.
+# RESOURCE_DIAGNOSTICS = resource.log
+
+
+# Name of the user that will be used to provide the service
+# USERNAME =
+# MAXBUF =
+# TIMEOUT =
+# DISABLEV6 =
+# BINDTO =
+# REJECT_FROM =
+# REJECT_FROM6 =
+# PREFIX =
diff --git a/src/service/arm/arm.h b/src/service/arm/arm.h
new file mode 100644
index 000000000..8888e0105
--- /dev/null
+++ b/src/service/arm/arm.h
@@ -0,0 +1,164 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file arm/arm.h
+ */
+#ifndef ARM_H
+#define ARM_H
+
+#include "gnunet_common.h"
+
+/**
+ * This option will turn on the DEBUG loglevel for
+ * all processes controlled by this ARM!
+ */
+#define DEBUG_ARM GNUNET_EXTRA_LOGGING
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Status update from ARM to client.
+ */
+struct GNUNET_ARM_StatusMessage
+{
+  /**
+   * Reply to client, of type is #GNUNET_MESSAGE_TYPE_ARM_STATUS.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Status from the 'enum GNUNET_ARM_ServiceStatus'
+   */
+  uint32_t status;
+
+  /* followed by a 0-terminated service name */
+};
+
+struct GNUNET_ARM_Message
+{
+  /**
+   * Reply to client, type is #GNUNET_MESSAGE_TYPE_ARM_RESULT or
+   * #GNUNET_MESSAGE_TYPE_ARM_LIST_RESULT.
+   * OR
+   * Request from client, type is #GNUNET_MESSAGE_TYPE_ARM_START or
+   * #GNUNET_MESSAGE_TYPE_ARM_STOP.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * For alignment.
+   */
+  uint32_t reserved;
+
+  /**
+   * ID of a request that is being replied to.
+   * OR
+   * ID of a request that is being sent.
+   */
+  uint64_t request_id;
+
+  /* For requests - followed by a 0-terminated service name */
+};
+
+
+/**
+ * Reply from ARM to client.
+ */
+struct GNUNET_ARM_ResultMessage
+{
+  /**
+   * Reply to client, of type is #GNUNET_MESSAGE_TYPE_ARM_RESULT, with an ID.
+   */
+  struct GNUNET_ARM_Message arm_msg;
+
+  /**
+   * Result from the `enum GNUNET_ARM_Result`
+   */
+  uint32_t result;
+};
+
+struct GNUNET_ARM_ServiceInfoMessage
+{
+  /**
+   * String pool index for the service's name.
+   */
+  uint16_t name_index;
+
+  /**
+   * String pool index for the service's binary.
+   */
+  uint16_t binary_index;
+
+  /**
+   * Last process exit status.
+   */
+  int16_t last_exit_status;
+
+  /**
+   * Padding.
+   */
+  uint16_t padding;
+
+  /**
+   * Status from the 'enum GNUNET_ARM_ServiceStatus'
+   */
+  uint32_t status;
+
+  /**
+   * Time when the service will be restarted, if applicable
+   * to the current status.
+   */
+  struct GNUNET_TIME_AbsoluteNBO restart_at;
+
+  /**
+   * Time when the service was first started, if applicable.
+   */
+  struct GNUNET_TIME_AbsoluteNBO last_started_at;
+};
+
+/**
+ * Reply from ARM to client for the
+ * #GNUNET_MESSAGE_TYPE_ARM_LIST request followed by count
+ * '\0' terminated strings. header->size contains the
+ * total size (including all strings).
+ */
+struct GNUNET_ARM_ListResultMessage
+{
+  /**
+   * Reply to client, of type is #GNUNET_MESSAGE_TYPE_ARM_LIST_RESULT,
+   * with an ID.
+   */
+  struct GNUNET_ARM_Message arm_msg;
+
+  /**
+   * Number of 'struct GNUNET_ARM_ServiceInfoMessage' that
+   * are at the end of this message.
+   */
+  uint16_t count;
+
+  /* struct GNUNET_ARM_ServiceInfoMessage[count]; */
+  /* pool of 0-terminated strings */
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/service/arm/arm_api.c b/src/service/arm/arm_api.c
new file mode 100644
index 000000000..1360ecf14
--- /dev/null
+++ b/src/service/arm/arm_api.c
@@ -0,0 +1,1102 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2012, 2013, 2016, 2019 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file arm/arm_api.c
+ * @brief API for accessing the ARM service
+ * @author Christian Grothoff
+ * @author LRN
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_protocols.h"
+#include "arm.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "arm-api", __VA_ARGS__)
+
+
+/**
+ * Entry in a doubly-linked list of operations awaiting for replies
+ * (in-order) from the ARM service.
+ */
+struct GNUNET_ARM_Operation
+{
+  /**
+   * This is a doubly-linked list.
+   */
+  struct GNUNET_ARM_Operation *next;
+
+  /**
+   * This is a doubly-linked list.
+   */
+  struct GNUNET_ARM_Operation *prev;
+
+  /**
+   * ARM handle.
+   */
+  struct GNUNET_ARM_Handle *h;
+
+  /**
+   * Callback for service state change requests.
+   */
+  GNUNET_ARM_ResultCallback result_cont;
+
+  /**
+   * Callback for service list requests.
+   */
+  GNUNET_ARM_ServiceListCallback list_cont;
+
+  /**
+   * Closure for @e result_cont or @e list_cont.
+   */
+  void *cont_cls;
+
+  /**
+   * Task for async completion.
+   */
+  struct GNUNET_SCHEDULER_Task *async;
+
+  /**
+   * Unique ID for the request.
+   */
+  uint64_t id;
+
+  /**
+   * Result of this operation for #notify_starting().
+   */
+  enum GNUNET_ARM_Result starting_ret;
+
+  /**
+   * File descriptor to close on operation stop, if not NULL.
+   */
+  struct GNUNET_DISK_FileHandle *rfd;
+
+  /**
+   * Is this an operation to stop the ARM service?
+   */
+  int is_arm_stop;
+};
+
+
+/**
+ * Handle for interacting with ARM.
+ */
+struct GNUNET_ARM_Handle
+{
+  /**
+   * Our connection to the ARM service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * The configuration that we are using.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Head of doubly-linked list of pending operations.
+   */
+  struct GNUNET_ARM_Operation *operation_pending_head;
+
+  /**
+   * Tail of doubly-linked list of pending operations.
+   */
+  struct GNUNET_ARM_Operation *operation_pending_tail;
+
+  /**
+   * Callback to invoke on connection/disconnection.
+   */
+  GNUNET_ARM_ConnectionStatusCallback conn_status;
+
+  /**
+   * Closure for @e conn_status.
+   */
+  void *conn_status_cls;
+
+  /**
+   * ARM operation where the goal is to wait for ARM shutdown to
+   * complete.  This operation is special in that it waits for an
+   * error on the @e mq.  So we complete it by calling the
+   * continuation in the #mq_error_handler().  Note that the operation
+   * is no longer in the @e operation_pending_head DLL once it is
+   * referenced from this field.
+   */
+  struct GNUNET_ARM_Operation *thm;
+
+  /**
+   * ID of the reconnect task (if any).
+   */
+  struct GNUNET_SCHEDULER_Task *reconnect_task;
+
+  /**
+   * Current delay we use for re-trying to connect to core.
+   */
+  struct GNUNET_TIME_Relative retry_backoff;
+
+  /**
+   * Counter for request identifiers.  They are used to match replies
+   * from ARM to operations in the @e operation_pending_head DLL.
+   */
+  uint64_t request_id_counter;
+
+  /**
+   * Have we detected that ARM is up?
+   */
+  int currently_up;
+};
+
+
+/**
+ * Connect to arm.
+ *
+ * @param h arm handle
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+reconnect_arm (struct GNUNET_ARM_Handle *h);
+
+
+/**
+ * Task scheduled to try to re-connect to arm.
+ *
+ * @param cls the `struct GNUNET_ARM_Handle`
+ */
+static void
+reconnect_arm_task (void *cls)
+{
+  struct GNUNET_ARM_Handle *h = cls;
+
+  h->reconnect_task = NULL;
+  reconnect_arm (h);
+}
+
+
+/**
+ * Close down any existing connection to the ARM service and
+ * try re-establishing it later.
+ *
+ * @param h our handle
+ */
+static void
+reconnect_arm_later (struct GNUNET_ARM_Handle *h)
+{
+  struct GNUNET_ARM_Operation *op;
+
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  h->currently_up = GNUNET_NO;
+  GNUNET_assert (NULL == h->reconnect_task);
+  h->reconnect_task =
+    GNUNET_SCHEDULER_add_delayed (h->retry_backoff,
+                                  &reconnect_arm_task,
+                                  h);
+  while (NULL != (op = h->operation_pending_head))
+  {
+    if (NULL != op->result_cont)
+      op->result_cont (op->cont_cls,
+                       GNUNET_ARM_REQUEST_DISCONNECTED,
+                       0);
+    if (NULL != op->list_cont)
+      op->list_cont (op->cont_cls,
+                     GNUNET_ARM_REQUEST_DISCONNECTED,
+                     0,
+                     NULL);
+    GNUNET_ARM_operation_cancel (op);
+  }
+  GNUNET_assert (NULL == h->operation_pending_head);
+  h->retry_backoff = GNUNET_TIME_STD_BACKOFF (h->retry_backoff);
+  if (NULL != h->conn_status)
+    h->conn_status (h->conn_status_cls,
+                    GNUNET_NO);
+}
+
+
+/**
+ * Find a control message by its unique ID.
+ *
+ * @param h ARM handle
+ * @param id unique message ID to use for the lookup
+ * @return NULL if not found
+ */
+static struct GNUNET_ARM_Operation *
+find_op_by_id (struct GNUNET_ARM_Handle *h,
+               uint64_t id)
+{
+  for (struct GNUNET_ARM_Operation *result = h->operation_pending_head;
+       NULL != result;
+       result = result->next)
+    if (id == result->id)
+      return result;
+  return NULL;
+}
+
+
+/**
+ * Handler for ARM replies.
+ *
+ * @param cls our `struct GNUNET_ARM_Handle`
+ * @param res the message received from the arm service
+ */
+static void
+handle_arm_result (void *cls,
+                   const struct GNUNET_ARM_ResultMessage *res)
+{
+  struct GNUNET_ARM_Handle *h = cls;
+  struct GNUNET_ARM_Operation *op;
+  uint64_t id;
+  enum GNUNET_ARM_Result result;
+  GNUNET_ARM_ResultCallback result_cont;
+  void *result_cont_cls;
+
+  id = GNUNET_ntohll (res->arm_msg.request_id);
+  op = find_op_by_id (h,
+                      id);
+  if (NULL == op)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Message with unknown id %llu\n",
+         (unsigned long long) id);
+    return;
+  }
+
+  result = (enum GNUNET_ARM_Result) ntohl (res->result);
+  if ( (GNUNET_YES == op->is_arm_stop) &&
+       (GNUNET_ARM_RESULT_STOPPING == result) )
+  {
+    /* special case: if we are stopping 'gnunet-service-arm', we do not just
+       wait for the result message, but also wait for the service to close
+       the connection (and then we have to close our client handle as well);
+       this is done by installing a different receive handler, waiting for
+       the connection to go down */if (NULL != h->thm)
+    {
+      GNUNET_break (0);
+      op->result_cont (h->thm->cont_cls,
+                       GNUNET_ARM_REQUEST_SENT_OK,
+                       GNUNET_ARM_RESULT_IS_NOT_KNOWN);
+      GNUNET_free (h->thm);
+    }
+    GNUNET_CONTAINER_DLL_remove (h->operation_pending_head,
+                                 h->operation_pending_tail,
+                                 op);
+    h->thm = op;
+    return;
+  }
+  result_cont = op->result_cont;
+  result_cont_cls = op->cont_cls;
+  GNUNET_ARM_operation_cancel (op);
+  if (NULL != result_cont)
+    result_cont (result_cont_cls,
+                 GNUNET_ARM_REQUEST_SENT_OK,
+                 result);
+}
+
+
+/**
+ * Read from a string pool.
+ *
+ * @param pool_start start of the string pool
+ * @param pool_size size of the string pool
+ * @param str_index index into the string pool
+ * @returns an index into the string pool, or
+ *          NULL if the index is out of bounds
+ */
+static const char *
+pool_get (const char *pool_start,
+          size_t pool_size,
+          size_t str_index)
+{
+  const char *str_start;
+  const char *end;
+
+  if (str_index >= pool_size)
+    return NULL;
+  str_start = pool_start + str_index;
+  end = memchr (str_start, 0, pool_size - str_index);
+  if (NULL == end)
+    return NULL;
+  return str_start;
+}
+
+
+/**
+ * Check that list result message is well-formed.
+ *
+ * @param cls our `struct GNUNET_ARM_Handle`
+ * @param lres the message received from the arm service
+ * @return #GNUNET_OK if message is well-formed
+ */
+static int
+check_arm_list_result (void *cls,
+                       const struct GNUNET_ARM_ListResultMessage *lres)
+{
+  uint16_t rcount = ntohs (lres->count);
+  uint16_t msize = ntohs (lres->arm_msg.header.size) - sizeof(*lres);
+  struct GNUNET_ARM_ServiceInfoMessage *ssm;
+  size_t pool_size;
+  char *pool_start;
+
+  (void) cls;
+  if ((rcount * sizeof (struct GNUNET_ARM_ServiceInfoMessage) > msize))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  ssm = (struct GNUNET_ARM_ServiceInfoMessage *) &lres[1];
+  pool_start = (char *) (ssm + rcount);
+  pool_size = msize - (rcount * sizeof (struct GNUNET_ARM_ServiceInfoMessage));
+  for (unsigned int i = 0; i < rcount; i++)
+  {
+    uint16_t name_index = ntohs (ssm->name_index);
+    uint16_t binary_index = ntohs (ssm->binary_index);
+    if (NULL == pool_get (pool_start,
+                          pool_size,
+                          name_index))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    if (NULL == pool_get (pool_start,
+                          pool_size,
+                          binary_index))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    ssm++;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for ARM list replies.
+ *
+ * @param cls our `struct GNUNET_ARM_Handle`
+ * @param lres the message received from the arm service
+ */
+static void
+handle_arm_list_result (void *cls,
+                        const struct GNUNET_ARM_ListResultMessage *lres)
+{
+  struct GNUNET_ARM_Handle *h = cls;
+  uint16_t rcount = ntohs (lres->count);
+  uint16_t msize = ntohs (lres->arm_msg.header.size) - sizeof(*lres);
+  struct GNUNET_ARM_ServiceInfo list[rcount];
+  struct GNUNET_ARM_ServiceInfoMessage *ssm;
+  struct GNUNET_ARM_Operation *op;
+  uint64_t id;
+  size_t pool_size;
+  char *pool_start;
+
+  id = GNUNET_ntohll (lres->arm_msg.request_id);
+  op = find_op_by_id (h, id);
+  if (NULL == op)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Message with unknown id %llu\n",
+         (unsigned long long) id);
+    return;
+  }
+
+  GNUNET_assert ((rcount * sizeof (struct GNUNET_ARM_ServiceInfoMessage) <=
+                  msize));
+
+  ssm = (struct GNUNET_ARM_ServiceInfoMessage *) &lres[1];
+  pool_start = (char *) (ssm + rcount);
+  pool_size = msize - (rcount * sizeof (struct GNUNET_ARM_ServiceInfoMessage));
+
+  for (unsigned int i = 0; i < rcount; i++)
+  {
+    uint16_t name_index = ntohs (ssm->name_index);
+    uint16_t binary_index = ntohs (ssm->binary_index);
+    const char *name;
+    const char *binary;
+
+    name = pool_get (pool_start, pool_size, name_index);
+    binary = pool_get (pool_start, pool_size, binary_index);
+    GNUNET_assert (NULL != name);
+    GNUNET_assert (NULL != binary);
+    list[i] = (struct GNUNET_ARM_ServiceInfo) {
+      .name = name,
+      .binary = binary,
+      .status = ntohl (ssm->status),
+      .last_started_at = GNUNET_TIME_absolute_ntoh (ssm->last_started_at),
+      .restart_at = GNUNET_TIME_absolute_ntoh (ssm->restart_at),
+      .last_exit_status = ntohs (ssm->last_exit_status),
+    };
+    ssm++;
+  }
+  if (NULL != op->list_cont)
+    op->list_cont (op->cont_cls,
+                   GNUNET_ARM_REQUEST_SENT_OK,
+                   rcount,
+                   list);
+  GNUNET_ARM_operation_cancel (op);
+}
+
+
+/**
+ * Receive confirmation from test, ARM service is up.
+ *
+ * @param cls closure with the `struct GNUNET_ARM_Handle`
+ * @param msg message received
+ */
+static void
+handle_confirm (void *cls,
+                const struct GNUNET_MessageHeader *msg)
+{
+  struct GNUNET_ARM_Handle *h = cls;
+
+  (void) msg;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got confirmation from ARM that we are up!\n");
+  if (GNUNET_NO == h->currently_up)
+  {
+    h->currently_up = GNUNET_YES;
+    if (NULL != h->conn_status)
+      h->conn_status (h->conn_status_cls, GNUNET_YES);
+  }
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_ARM_Handle *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_ARM_Handle *h = cls;
+  struct GNUNET_ARM_Operation *op;
+
+  (void) error;
+  h->currently_up = GNUNET_NO;
+  if (NULL != (op = h->thm))
+  {
+    h->thm = NULL;
+    op->result_cont (op->cont_cls,
+                     GNUNET_ARM_REQUEST_SENT_OK,
+                     GNUNET_ARM_RESULT_STOPPED);
+    GNUNET_free (op);
+  }
+  reconnect_arm_later (h);
+}
+
+
+/**
+ * Connect to arm.
+ *
+ * @param h arm handle
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+reconnect_arm (struct GNUNET_ARM_Handle *h)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (arm_result,
+                             GNUNET_MESSAGE_TYPE_ARM_RESULT,
+                             struct GNUNET_ARM_ResultMessage,
+                             h),
+    GNUNET_MQ_hd_var_size (arm_list_result,
+                           GNUNET_MESSAGE_TYPE_ARM_LIST_RESULT,
+                           struct GNUNET_ARM_ListResultMessage,
+                           h),
+    GNUNET_MQ_hd_fixed_size (confirm,
+                             GNUNET_MESSAGE_TYPE_ARM_TEST,
+                             struct GNUNET_MessageHeader,
+                             h),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MessageHeader *test;
+  struct GNUNET_MQ_Envelope *env;
+
+  if (NULL != h->mq)
+    return GNUNET_OK;
+  GNUNET_assert (GNUNET_NO == h->currently_up);
+  h->mq = GNUNET_CLIENT_connect (h->cfg,
+                                 "arm",
+                                 handlers,
+                                 &mq_error_handler,
+                                 h);
+  if (NULL == h->mq)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "GNUNET_CLIENT_connect returned NULL\n");
+    if (NULL != h->conn_status)
+      h->conn_status (h->conn_status_cls,
+                      GNUNET_SYSERR);
+    return GNUNET_SYSERR;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sending TEST message to ARM\n");
+  env = GNUNET_MQ_msg (test,
+                       GNUNET_MESSAGE_TYPE_ARM_TEST);
+  GNUNET_MQ_send (h->mq, env);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Set up a context for communicating with ARM, then
+ * start connecting to the ARM service using that context.
+ *
+ * @param cfg configuration to use (needed to contact ARM;
+ *        the ARM service may internally use a different
+ *        configuration to determine how to start the service).
+ * @param conn_status will be called when connecting/disconnecting
+ * @param conn_status_cls closure for @a conn_status
+ * @return context to use for further ARM operations, NULL on error.
+ */
+struct GNUNET_ARM_Handle *
+GNUNET_ARM_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                    GNUNET_ARM_ConnectionStatusCallback conn_status,
+                    void *conn_status_cls)
+{
+  struct GNUNET_ARM_Handle *h;
+
+  h = GNUNET_new (struct GNUNET_ARM_Handle);
+  h->cfg = cfg;
+  h->conn_status = conn_status;
+  h->conn_status_cls = conn_status_cls;
+  if (GNUNET_OK != reconnect_arm (h))
+  {
+    GNUNET_free (h);
+    return NULL;
+  }
+  return h;
+}
+
+
+/**
+ * Disconnect from the ARM service (if connected) and destroy the context.
+ *
+ * @param h the handle that was being used
+ */
+void
+GNUNET_ARM_disconnect (struct GNUNET_ARM_Handle *h)
+{
+  struct GNUNET_ARM_Operation *op;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Disconnecting from ARM service\n");
+  while (NULL != (op = h->operation_pending_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->operation_pending_head,
+                                 h->operation_pending_tail,
+                                 op);
+    if (NULL != op->result_cont)
+      op->result_cont (op->cont_cls,
+                       GNUNET_ARM_REQUEST_DISCONNECTED,
+                       0);
+    if (NULL != op->list_cont)
+      op->list_cont (op->cont_cls,
+                     GNUNET_ARM_REQUEST_DISCONNECTED,
+                     0,
+                     NULL);
+    if (NULL != op->async)
+    {
+      GNUNET_SCHEDULER_cancel (op->async);
+      op->async = NULL;
+    }
+    GNUNET_free (op);
+  }
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  if (NULL != h->reconnect_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->reconnect_task);
+    h->reconnect_task = NULL;
+  }
+  GNUNET_free (h);
+}
+
+
+/**
+ * A client specifically requested starting of ARM itself.
+ * Starts the ARM service.
+ *
+ * @param h the handle with configuration details
+ * @param std_inheritance inheritance of std streams
+ * @param sigfd socket to pass to ARM for signalling
+ * @return operation status code
+ */
+static enum GNUNET_ARM_Result
+start_arm_service (struct GNUNET_ARM_Handle *h,
+                   enum GNUNET_OS_InheritStdioFlags std_inheritance,
+                   struct GNUNET_DISK_FileHandle *sigfd)
+{
+  struct GNUNET_OS_Process *proc;
+  char *cbinary;
+  char *binary;
+  char *quotedbinary;
+  char *config;
+  char *loprefix;
+  char *lopostfix;
+  int ld[2];
+  int *lsocks;
+
+  if (NULL == sigfd)
+  {
+    lsocks = NULL;
+  }
+  else
+  {
+    ld[0] = sigfd->fd;
+    ld[1] = -1;
+    lsocks = ld;
+  }
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (h->cfg,
+                                                          "arm",
+                                                          "PREFIX",
+                                                          &loprefix))
+    loprefix = GNUNET_strdup ("");
+  else
+    loprefix = GNUNET_CONFIGURATION_expand_dollar (h->cfg, loprefix);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (h->cfg,
+                                                          "arm",
+                                                          "OPTIONS",
+                                                          &lopostfix))
+    lopostfix = GNUNET_strdup ("");
+  else
+    lopostfix = GNUNET_CONFIGURATION_expand_dollar (h->cfg,
+                                                    lopostfix);
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (h->cfg,
+                                             "arm",
+                                             "BINARY",
+                                             &cbinary))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_WARNING,
+                               "arm",
+                               "BINARY");
+    GNUNET_free (loprefix);
+    GNUNET_free (lopostfix);
+    return GNUNET_ARM_RESULT_IS_NOT_KNOWN;
+  }
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (h->cfg,
+                                                            "arm",
+                                                            "CONFIG",
+                                                            &config))
+    config = NULL;
+  binary = GNUNET_OS_get_libexec_binary_path (cbinary);
+  GNUNET_asprintf (&quotedbinary,
+                   "\"%s\"",
+                   binary);
+  GNUNET_free (cbinary);
+  if ( (GNUNET_YES ==
+        GNUNET_CONFIGURATION_have_value (h->cfg,
+                                         "TESTING",
+                                         "WEAKRANDOM")) &&
+       (GNUNET_YES ==
+        GNUNET_CONFIGURATION_get_value_yesno (h->cfg,
+                                              "TESTING",
+                                              "WEAKRANDOM")) &&
+       (GNUNET_NO ==
+        GNUNET_CONFIGURATION_have_value (h->cfg,
+                                         "TESTING",
+                                         "HOSTFILE")) )
+  {
+    /* Means we are ONLY running locally */
+    /* we're clearly running a test, don't daemonize */
+    if (NULL == config)
+      proc = GNUNET_OS_start_process_s (std_inheritance,
+                                        lsocks,
+                                        loprefix,
+                                        quotedbinary,
+                                        /* no daemonization! */
+                                        lopostfix,
+                                        NULL);
+    else
+      proc = GNUNET_OS_start_process_s (std_inheritance,
+                                        lsocks,
+                                        loprefix,
+                                        quotedbinary,
+                                        "-c",
+                                        config,
+                                        /* no daemonization! */
+                                        lopostfix,
+                                        NULL);
+  }
+  else
+  {
+    if (NULL == config)
+      proc = GNUNET_OS_start_process_s (std_inheritance,
+                                        lsocks,
+                                        loprefix,
+                                        quotedbinary,
+                                        "-d",  /* do daemonize */
+                                        lopostfix,
+                                        NULL);
+    else
+      proc = GNUNET_OS_start_process_s (std_inheritance,
+                                        lsocks,
+                                        loprefix,
+                                        quotedbinary,
+                                        "-c",
+                                        config,
+                                        "-d",  /* do daemonize */
+                                        lopostfix,
+                                        NULL);
+  }
+  GNUNET_free (binary);
+  GNUNET_free (quotedbinary);
+  if (NULL != config)
+    GNUNET_free (config);
+  GNUNET_free (loprefix);
+  GNUNET_free (lopostfix);
+  if (NULL == proc)
+    return GNUNET_ARM_RESULT_START_FAILED;
+  GNUNET_OS_process_destroy (proc);
+  return GNUNET_ARM_RESULT_STARTING;
+}
+
+
+/**
+ * Abort an operation.  Only prevents the callback from being
+ * called, the operation may still complete.
+ *
+ * @param op operation to cancel
+ */
+void
+GNUNET_ARM_operation_cancel (struct GNUNET_ARM_Operation *op)
+{
+  struct GNUNET_ARM_Handle *h = op->h;
+
+  if (NULL != op->async)
+  {
+    GNUNET_SCHEDULER_cancel (op->async);
+    op->async = NULL;
+  }
+  if (NULL != op->rfd)
+  {
+    GNUNET_DISK_file_close (op->rfd);
+    op->rfd = NULL;
+  }
+  if (h->thm == op)
+  {
+    op->result_cont = NULL;
+    return;
+  }
+  GNUNET_CONTAINER_DLL_remove (h->operation_pending_head,
+                               h->operation_pending_tail,
+                               op);
+  GNUNET_free (op);
+}
+
+
+/**
+ * Start or stop a service.
+ *
+ * @param h handle to ARM
+ * @param service_name name of the service
+ * @param cb callback to invoke when service is ready
+ * @param cb_cls closure for @a cb
+ * @param type type of the request
+ * @return handle to queue, NULL on error
+ */
+static struct GNUNET_ARM_Operation *
+change_service (struct GNUNET_ARM_Handle *h,
+                const char *service_name,
+                GNUNET_ARM_ResultCallback cb,
+                void *cb_cls,
+                uint16_t type)
+{
+  struct GNUNET_ARM_Operation *op;
+  size_t slen;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_ARM_Message *msg;
+
+  slen = strlen (service_name) + 1;
+  if (slen + sizeof(struct GNUNET_ARM_Message) >= GNUNET_MAX_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (0 == h->request_id_counter)
+    h->request_id_counter++;
+  op = GNUNET_new (struct GNUNET_ARM_Operation);
+  op->h = h;
+  op->result_cont = cb;
+  op->cont_cls = cb_cls;
+  op->id = h->request_id_counter++;
+  GNUNET_CONTAINER_DLL_insert_tail (h->operation_pending_head,
+                                    h->operation_pending_tail,
+                                    op);
+  env = GNUNET_MQ_msg_extra (msg, slen, type);
+  msg->reserved = htonl (0);
+  msg->request_id = GNUNET_htonll (op->id);
+  GNUNET_memcpy (&msg[1], service_name, slen);
+  GNUNET_MQ_send (h->mq, env);
+  return op;
+}
+
+
+/**
+ * Task run to notify application that ARM is already up.
+ *
+ * @param cls the operation that asked ARM to be started
+ */
+static void
+notify_running (void *cls)
+{
+  struct GNUNET_ARM_Operation *op = cls;
+  struct GNUNET_ARM_Handle *h = op->h;
+
+  op->async = NULL;
+  GNUNET_CONTAINER_DLL_remove (h->operation_pending_head,
+                               h->operation_pending_tail,
+                               op);
+  if (NULL != op->result_cont)
+    op->result_cont (op->cont_cls,
+                     GNUNET_ARM_REQUEST_SENT_OK,
+                     GNUNET_ARM_RESULT_IS_STARTED_ALREADY);
+  if ( (GNUNET_YES == h->currently_up) &&
+       (NULL != h->conn_status) )
+    h->conn_status (h->conn_status_cls,
+                    GNUNET_YES);
+  GNUNET_free (op);
+}
+
+
+/**
+ * Task run to notify application that ARM is being started.
+ *
+ * @param cls the operation that asked ARM to be started
+ */
+static void
+notify_starting (void *cls)
+{
+  struct GNUNET_ARM_Operation *op = cls;
+  struct GNUNET_ARM_Handle *h = op->h;
+
+  op->async = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Notifying client that we started the ARM service\n");
+  GNUNET_CONTAINER_DLL_remove (h->operation_pending_head,
+                               h->operation_pending_tail,
+                               op);
+  if (NULL != op->result_cont)
+    op->result_cont (op->cont_cls,
+                     GNUNET_ARM_REQUEST_SENT_OK,
+                     op->starting_ret);
+  GNUNET_DISK_file_close(op->rfd);
+  GNUNET_free (op);
+}
+
+
+/**
+ * Request for a service to be started.
+ *
+ * @param h handle to ARM
+ * @param service_name name of the service
+ * @param std_inheritance inheritance of std streams
+ * @param cont callback to invoke after request is sent or not sent
+ * @param cont_cls closure for @a cont
+ * @return handle for the operation, NULL on error
+ */
+struct GNUNET_ARM_Operation *
+GNUNET_ARM_request_service_start (struct GNUNET_ARM_Handle *h,
+                                  const char *service_name,
+                                  enum GNUNET_OS_InheritStdioFlags
+                                  std_inheritance,
+                                  GNUNET_ARM_ResultCallback cont,
+                                  void *cont_cls)
+{
+  struct GNUNET_ARM_Operation *op;
+  enum GNUNET_ARM_Result ret;
+  struct GNUNET_DISK_PipeHandle *sig;
+  struct GNUNET_DISK_FileHandle *wsig;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Starting service `%s'\n",
+       service_name);
+  if (0 != strcasecmp ("arm",
+                       service_name))
+    return change_service (h,
+                           service_name,
+                           cont,
+                           cont_cls,
+                           GNUNET_MESSAGE_TYPE_ARM_START);
+
+  /* Possible cases:
+   * 1) We're connected to ARM already. Invoke the callback immediately.
+   * 2) We're not connected to ARM.
+   *    Cancel any reconnection attempts temporarily, then perform
+   *    a service test.
+   */
+  if (GNUNET_YES == h->currently_up)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "ARM is already running\n");
+    op = GNUNET_new (struct GNUNET_ARM_Operation);
+    op->h = h;
+    op->result_cont = cont;
+    op->cont_cls = cont_cls;
+    GNUNET_CONTAINER_DLL_insert_tail (h->operation_pending_head,
+                                      h->operation_pending_tail,
+                                      op);
+    op->async = GNUNET_SCHEDULER_add_now (&notify_running, op);
+    return op;
+  }
+  /* This is an inherently uncertain choice, as it is of course
+     theoretically possible that ARM is up and we just did not
+     yet complete the MQ handshake.  However, given that users
+     are unlikely to hammer 'gnunet-arm -s' on a busy system,
+     the above check should catch 99.99% of the cases where ARM
+     is already running. */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Starting ARM service\n");
+  if (NULL == (sig = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE)))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "pipe");
+    ret = GNUNET_ARM_RESULT_START_FAILED;
+  }
+  else
+  {
+    wsig = GNUNET_DISK_pipe_detach_end (sig,
+                                        GNUNET_DISK_PIPE_END_WRITE);
+    ret = start_arm_service (h,
+                             std_inheritance,
+                             wsig);
+    GNUNET_DISK_file_close (wsig);
+    if (GNUNET_ARM_RESULT_STARTING == ret)
+      reconnect_arm (h);
+  }
+  op = GNUNET_new (struct GNUNET_ARM_Operation);
+  op->h = h;
+  op->result_cont = cont;
+  op->cont_cls = cont_cls;
+  GNUNET_CONTAINER_DLL_insert_tail (h->operation_pending_head,
+                                    h->operation_pending_tail,
+                                    op);
+  op->starting_ret = ret;
+  if (NULL != sig)
+  {
+    op->rfd = GNUNET_DISK_pipe_detach_end (sig,
+                                           GNUNET_DISK_PIPE_END_READ);
+    /* Wait at most a minute for gnunet-service-arm to be up, as beyond
+       that something clearly just went wrong */
+    op->async = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_MINUTES,
+                                                op->rfd,
+                                                &notify_starting,
+                                                op);
+    GNUNET_DISK_pipe_close (sig);
+  }
+  else
+  {
+    op->async = GNUNET_SCHEDULER_add_now (&notify_starting,
+                                          op);
+  }
+  return op;
+}
+
+
+/**
+ * Request a service to be stopped.  Stopping arm itself will not
+ * invalidate its handle, and ARM API will try to restore connection
+ * to the ARM service, even if ARM connection was lost because you
+ * asked for ARM to be stopped.  Call
+ * #GNUNET_ARM_disconnect() to free the handle and prevent
+ * further connection attempts.
+ *
+ * @param h handle to ARM
+ * @param service_name name of the service
+ * @param cont callback to invoke after request is sent or is not sent
+ * @param cont_cls closure for @a cont
+ * @return handle for the operation, NULL on error
+ */
+struct GNUNET_ARM_Operation *
+GNUNET_ARM_request_service_stop (struct GNUNET_ARM_Handle *h,
+                                 const char *service_name,
+                                 GNUNET_ARM_ResultCallback cont,
+                                 void *cont_cls)
+{
+  struct GNUNET_ARM_Operation *op;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Stopping service `%s'\n",
+       service_name);
+  op = change_service (h,
+                       service_name,
+                       cont,
+                       cont_cls,
+                       GNUNET_MESSAGE_TYPE_ARM_STOP);
+  if (NULL == op)
+    return NULL;
+  /* If the service is ARM, set a flag as we will use MQ errors
+     to detect that the process is really gone. */
+  if (0 == strcasecmp (service_name,
+                       "arm"))
+    op->is_arm_stop = GNUNET_YES;
+  return op;
+}
+
+
+/**
+ * Request a list of running services.
+ *
+ * @param h handle to ARM
+ * @param cont callback to invoke after request is sent or is not sent
+ * @param cont_cls closure for @a cont
+ * @return handle for the operation, NULL on error
+ */
+struct GNUNET_ARM_Operation *
+GNUNET_ARM_request_service_list (struct GNUNET_ARM_Handle *h,
+                                 GNUNET_ARM_ServiceListCallback cont,
+                                 void *cont_cls)
+{
+  struct GNUNET_ARM_Operation *op;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_ARM_Message *msg;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Requesting LIST from ARM service\n");
+  if (0 == h->request_id_counter)
+    h->request_id_counter++;
+  op = GNUNET_new (struct GNUNET_ARM_Operation);
+  op->h = h;
+  op->list_cont = cont;
+  op->cont_cls = cont_cls;
+  op->id = h->request_id_counter++;
+  GNUNET_CONTAINER_DLL_insert_tail (h->operation_pending_head,
+                                    h->operation_pending_tail,
+                                    op);
+  env = GNUNET_MQ_msg (msg,
+                       GNUNET_MESSAGE_TYPE_ARM_LIST);
+  msg->reserved = htonl (0);
+  msg->request_id = GNUNET_htonll (op->id);
+  GNUNET_MQ_send (h->mq, env);
+  return op;
+}
+
+
+/* end of arm_api.c */
diff --git a/src/service/arm/arm_monitor_api.c b/src/service/arm/arm_monitor_api.c
new file mode 100644
index 000000000..2c418d0ce
--- /dev/null
+++ b/src/service/arm/arm_monitor_api.c
@@ -0,0 +1,274 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2012, 2013, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file arm/arm_monitor_api.c
+ * @brief API for monitoring the ARM service
+ * @author Christian Grothoff
+ * @author LRN
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "arm.h"
+
+#define INIT_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "arm-monitor-api", __VA_ARGS__)
+
+/**
+ * Handle for interacting with ARM.
+ */
+struct GNUNET_ARM_MonitorHandle
+{
+  /**
+   * Our control connection to the ARM service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * The configuration that we are using.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * ID of the reconnect task (if any).
+   */
+  struct GNUNET_SCHEDULER_Task *reconnect_task;
+
+  /**
+   * Current delay we use for re-trying to connect to core.
+   */
+  struct GNUNET_TIME_Relative retry_backoff;
+
+  /**
+   * Callback to invoke on status updates.
+   */
+  GNUNET_ARM_ServiceMonitorCallback service_status;
+
+  /**
+   * Closure for @e service_status.
+   */
+  void *service_status_cls;
+};
+
+
+/**
+ * Connect to the ARM service for monitoring.
+ *
+ * @param h handle to connect
+ * @return #GNUNET_OK on success
+ */
+static int
+reconnect_arm_monitor (struct GNUNET_ARM_MonitorHandle *h);
+
+
+/**
+ * Task scheduled to try to re-connect to arm.
+ *
+ * @param cls the `struct GNUNET_ARM_MonitorHandle`
+ */
+static void
+reconnect_arm_monitor_task (void *cls)
+{
+  struct GNUNET_ARM_MonitorHandle *h = cls;
+
+  h->reconnect_task = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Connecting to ARM service for monitoring after delay\n");
+  GNUNET_break (GNUNET_OK == reconnect_arm_monitor (h));
+}
+
+
+/**
+ * Close down any existing connection to the ARM service and
+ * try re-establishing it later.
+ *
+ * @param h our handle
+ */
+static void
+reconnect_arm_monitor_later (struct GNUNET_ARM_MonitorHandle *h)
+{
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  GNUNET_assert (NULL == h->reconnect_task);
+  h->reconnect_task = GNUNET_SCHEDULER_add_delayed (h->retry_backoff,
+                                                    &reconnect_arm_monitor_task,
+                                                    h);
+  h->retry_backoff = GNUNET_TIME_STD_BACKOFF (h->retry_backoff);
+}
+
+
+/**
+ * Check notification messages received from ARM is well-formed.
+ *
+ * @param cls our `struct GNUNET_ARM_MonitorHandle`
+ * @param msg the message received from the arm service
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_monitor_notify (void *cls, const struct GNUNET_ARM_StatusMessage *msg)
+{
+  size_t sl =
+    ntohs (msg->header.size) - sizeof(struct GNUNET_ARM_StatusMessage);
+  const char *name = (const char *) &msg[1];
+
+  (void) cls;
+  if ((0 == sl) || ('\0' != name[sl - 1]))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for notification messages received from ARM.
+ *
+ * @param cls our `struct GNUNET_ARM_MonitorHandle`
+ * @param res the message received from the arm service
+ */
+static void
+handle_monitor_notify (void *cls, const struct GNUNET_ARM_StatusMessage *res)
+{
+  struct GNUNET_ARM_MonitorHandle *h = cls;
+  enum GNUNET_ARM_ServiceMonitorStatus status;
+
+  status = (enum GNUNET_ARM_ServiceMonitorStatus) ntohl (res->status);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received notification from ARM for service `%s' with status %d\n",
+       (const char *) &res[1],
+       (int) status);
+  if (NULL != h->service_status)
+    h->service_status (h->service_status_cls, (const char *) &res[1], status);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_ARM_MonitorHandle *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls, enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_ARM_MonitorHandle *h = cls;
+
+  (void) error;
+  reconnect_arm_monitor_later (h);
+}
+
+
+/**
+ * Connect to the ARM service for monitoring.
+ *
+ * @param h handle to connect
+ * @return #GNUNET_OK on success
+ */
+static int
+reconnect_arm_monitor (struct GNUNET_ARM_MonitorHandle *h)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] =
+  { GNUNET_MQ_hd_var_size (monitor_notify,
+                           GNUNET_MESSAGE_TYPE_ARM_STATUS,
+                           struct GNUNET_ARM_StatusMessage,
+                           h),
+    GNUNET_MQ_handler_end () };
+  struct GNUNET_MessageHeader *msg;
+  struct GNUNET_MQ_Envelope *env;
+
+  GNUNET_assert (NULL == h->mq);
+  h->mq = GNUNET_CLIENT_connect (h->cfg, "arm", handlers, &mq_error_handler, h);
+  if (NULL == h->mq)
+  {
+    if (NULL != h->service_status)
+      h->service_status (h->service_status_cls,
+                         NULL,
+                         GNUNET_ARM_SERVICE_STOPPED);
+    return GNUNET_SYSERR;
+  }
+  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_ARM_MONITOR);
+  GNUNET_MQ_send (h->mq, env);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Setup a context for monitoring ARM, then
+ * start connecting to the ARM service for monitoring using that context.
+ *
+ * @param cfg configuration to use (needed to contact ARM;
+ *        the ARM service may internally use a different
+ *        configuration to determine how to start the service).
+ * @param cont callback to invoke on status updates
+ * @param cont_cls closure for @a cont
+ * @return context to use for further ARM monitor operations, NULL on error.
+ */
+struct GNUNET_ARM_MonitorHandle *
+GNUNET_ARM_monitor_start (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                          GNUNET_ARM_ServiceMonitorCallback cont,
+                          void *cont_cls)
+{
+  struct GNUNET_ARM_MonitorHandle *h;
+
+  h = GNUNET_new (struct GNUNET_ARM_MonitorHandle);
+  h->cfg = cfg;
+  h->service_status = cont;
+  h->service_status_cls = cont_cls;
+  if (GNUNET_OK != reconnect_arm_monitor (h))
+  {
+    GNUNET_free (h);
+    return NULL;
+  }
+  return h;
+}
+
+
+/**
+ * Disconnect from the ARM service (if connected) and destroy the context.
+ *
+ * @param h the handle that was being used
+ */
+void
+GNUNET_ARM_monitor_stop (struct GNUNET_ARM_MonitorHandle *h)
+{
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  if (NULL != h->reconnect_task)
+  {
+    GNUNET_SCHEDULER_cancel (h->reconnect_task);
+    h->reconnect_task = NULL;
+  }
+  GNUNET_free (h);
+}
+
+
+/* end of arm_api.c */
diff --git a/src/service/arm/gnunet-service-arm.c b/src/service/arm/gnunet-service-arm.c
new file mode 100644
index 000000000..da94efdd8
--- /dev/null
+++ b/src/service/arm/gnunet-service-arm.c
@@ -0,0 +1,2227 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2011, 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file arm/gnunet-service-arm.c
+ * @brief the automated restart manager service
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_protocols.h"
+#include "arm.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "util", __VA_ARGS__)
+
+#define LOG_STRERROR(kind, syscall) \
+  GNUNET_log_from_strerror (kind, "util", syscall)
+
+
+#if HAVE_WAIT4
+/**
+ * Name of the file for writing resource utilization summaries to.
+ */
+static char *wait_filename;
+
+/**
+ * Handle for the file for writing resource summaries.
+ */
+static FILE *wait_file;
+#endif
+
+
+/**
+ * How many messages do we queue up at most for optional
+ * notifications to a client?  (this can cause notifications
+ * about outgoing messages to be dropped).
+ */
+#define MAX_NOTIFY_QUEUE 1024
+
+
+/**
+ * List of our services.
+ */
+struct ServiceList;
+
+
+/**
+ * Record with information about a listen socket we have open.
+ */
+struct ServiceListeningInfo
+{
+  /**
+   * This is a linked list.
+   */
+  struct ServiceListeningInfo *next;
+
+  /**
+   * This is a linked list.
+   */
+  struct ServiceListeningInfo *prev;
+
+  /**
+   * Address this socket is listening on.
+   */
+  struct sockaddr *service_addr;
+
+  /**
+   * Service this listen socket is for.
+   */
+  struct ServiceList *sl;
+
+  /**
+   * Number of bytes in @e service_addr
+   */
+  socklen_t service_addr_len;
+
+  /**
+   * Our listening socket.
+   */
+  struct GNUNET_NETWORK_Handle *listen_socket;
+
+  /**
+   * Task doing the accepting.
+   */
+  struct GNUNET_SCHEDULER_Task *accept_task;
+};
+
+
+/**
+ * List of our services.
+ */
+struct ServiceList
+{
+  /**
+   * This is a doubly-linked list.
+   */
+  struct ServiceList *next;
+
+  /**
+   * This is a doubly-linked list.
+   */
+  struct ServiceList *prev;
+
+  /**
+   * Linked list of listen sockets associated with this service.
+   */
+  struct ServiceListeningInfo *listen_head;
+
+  /**
+   * Linked list of listen sockets associated with this service.
+   */
+  struct ServiceListeningInfo *listen_tail;
+
+  /**
+   * Name of the service.
+   */
+  char *name;
+
+  /**
+   * Name of the binary used.
+   */
+  char *binary;
+
+  /**
+   * Name of the configuration file used.
+   */
+  char *config;
+
+  /**
+   * Client to notify upon kill completion (waitpid), NULL
+   * if we should simply restart the process.
+   */
+  struct GNUNET_SERVICE_Client *killing_client;
+
+  /**
+   * ID of the request that killed the service (for reporting back).
+   */
+  uint64_t killing_client_request_id;
+
+  /**
+   * Process structure pointer of the child.
+   */
+  struct GNUNET_OS_Process *proc;
+
+  /**
+   * Process exponential backoff time
+   */
+  struct GNUNET_TIME_Relative backoff;
+
+  /**
+   * Absolute time at which the process was (re-)started last.
+   */
+  struct GNUNET_TIME_Absolute last_started_at;
+
+  /**
+   * Absolute time at which the process is scheduled to restart in case of death
+   */
+  struct GNUNET_TIME_Absolute restart_at;
+
+  /**
+   * Time we asked the service to shut down (used to calculate time it took
+   * the service to terminate).
+   */
+  struct GNUNET_TIME_Absolute killed_at;
+
+  /**
+   * Is this service to be started by default (or did a client tell us explicitly
+   * to start it)?  #GNUNET_NO if the service is started only upon 'accept' on a
+   * listen socket or possibly explicitly by a client changing the value.
+   */
+  int force_start;
+
+  /**
+   * Should we use pipes to signal this process? (YES for Java binaries and if we
+   * are on Windoze).
+   */
+  int pipe_control;
+
+  /**
+   * Last exit status of the process.
+   */
+  int last_exit_status;
+};
+
+/**
+ * List of running services.
+ */
+static struct ServiceList *running_head;
+
+/**
+ * List of running services.
+ */
+static struct ServiceList *running_tail;
+
+/**
+ * Our configuration
+ */
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+/**
+ * Command to prepend to each actual command.
+ */
+static char *prefix_command;
+
+/**
+ * Option to append to each actual command.
+ */
+static char *final_option;
+
+/**
+ * ID of task called whenever we get a SIGCHILD.
+ */
+static struct GNUNET_SCHEDULER_Task *child_death_task;
+
+/**
+ * ID of task called whenever the timeout for restarting a child
+ * expires.
+ */
+static struct GNUNET_SCHEDULER_Task *child_restart_task;
+
+/**
+ * Pipe used to communicate shutdown via signal.
+ */
+static struct GNUNET_DISK_PipeHandle *sigpipe;
+
+/**
+ * Are we in shutdown mode?
+ */
+static int in_shutdown;
+
+/**
+ * Return value from main
+ */
+static int global_ret;
+
+/**
+ * Are we starting user services?
+ */
+static int start_user = GNUNET_YES;
+
+/**
+ * Are we starting system services?
+ */
+static int start_system = GNUNET_YES;
+
+/**
+ * Handle to our service instance.  Our service is a bit special in that
+ * its service is not immediately stopped once we get a shutdown
+ * request (since we need to continue service until all of our child
+ * processes are dead).  This handle is used to shut down the service
+ * (and thus trigger process termination) once all child processes are
+ * also dead.  A special option in the ARM configuration modifies the
+ * behaviour of the service implementation to not do the shutdown
+ * immediately.
+ */
+static struct GNUNET_SERVICE_Handle *service;
+
+/**
+ * Context for notifications we need to send to our clients.
+ */
+static struct GNUNET_NotificationContext *notifier;
+
+
+/**
+ * Add the given UNIX domain path as an address to the
+ * list (as the first entry).
+ *
+ * @param saddrs array to update
+ * @param saddrlens where to store the address length
+ * @param unixpath path to add
+ * @param abstract #GNUNET_YES to add an abstract UNIX domain socket.  This
+ *          parameter is ignore on systems other than LINUX
+ */
+static void
+add_unixpath (struct sockaddr **saddrs,
+              socklen_t *saddrlens,
+              const char *unixpath,
+              int abstract)
+{
+#ifdef AF_UNIX
+  struct sockaddr_un *un;
+
+  un = GNUNET_new (struct sockaddr_un);
+  un->sun_family = AF_UNIX;
+  GNUNET_strlcpy (un->sun_path, unixpath, sizeof(un->sun_path));
+#ifdef __linux__
+  if (GNUNET_YES == abstract)
+    un->sun_path[0] = '\0';
+#endif
+#if HAVE_SOCKADDR_UN_SUN_LEN
+  un->sun_len = (u_char) sizeof(struct sockaddr_un);
+#endif
+  *saddrs = (struct sockaddr *) un;
+  *saddrlens = sizeof(struct sockaddr_un);
+#else
+  /* this function should never be called
+   * unless AF_UNIX is defined! */
+  GNUNET_assert (0);
+#endif
+}
+
+
+/**
+ * Get the list of addresses that a server for the given service
+ * should bind to.
+ *
+ * @param service_name name of the service
+ * @param cfg configuration (which specifies the addresses)
+ * @param addrs set (call by reference) to an array of pointers to the
+ *              addresses the server should bind to and listen on; the
+ *              array will be NULL-terminated (on success)
+ * @param addr_lens set (call by reference) to an array of the lengths
+ *              of the respective `struct sockaddr` struct in the @a addrs
+ *              array (on success)
+ * @return number of addresses found on success,
+ *              #GNUNET_SYSERR if the configuration
+ *              did not specify reasonable finding information or
+ *              if it specified a hostname that could not be resolved;
+ *              #GNUNET_NO if the number of addresses configured is
+ *              zero (in this case, `*addrs` and `*addr_lens` will be
+ *              set to NULL).
+ */
+static int
+get_server_addresses (const char *service_name,
+                      const struct GNUNET_CONFIGURATION_Handle *cfg,
+                      struct sockaddr ***addrs,
+                      socklen_t **addr_lens)
+{
+  int disablev6;
+  struct GNUNET_NETWORK_Handle *desc;
+  unsigned long long port;
+  char *unixpath;
+  struct addrinfo hints;
+  struct addrinfo *res;
+  struct addrinfo *pos;
+  struct addrinfo *next;
+  unsigned int i;
+  int resi;
+  int ret;
+  int abstract;
+  struct sockaddr **saddrs;
+  socklen_t *saddrlens;
+  char *hostname;
+
+  *addrs = NULL;
+  *addr_lens = NULL;
+  desc = NULL;
+  if (GNUNET_CONFIGURATION_have_value (cfg, service_name, "DISABLEV6"))
+  {
+    if (GNUNET_SYSERR ==
+        (disablev6 = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                           service_name,
+                                                           "DISABLEV6")))
+      return GNUNET_SYSERR;
+  }
+  else
+    disablev6 = GNUNET_NO;
+
+  if (! disablev6)
+  {
+    /* probe IPv6 support */
+    desc = GNUNET_NETWORK_socket_create (PF_INET6, SOCK_STREAM, 0);
+    if (NULL == desc)
+    {
+      if ((ENOBUFS == errno) || (ENOMEM == errno) || (ENFILE == errno) ||
+          (EACCES == errno))
+      {
+        LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "socket");
+        return GNUNET_SYSERR;
+      }
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ (
+             "Disabling IPv6 support for service `%s', failed to create IPv6 socket: %s\n"),
+           service_name,
+           strerror (errno));
+      disablev6 = GNUNET_YES;
+    }
+    else
+    {
+      GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (desc));
+      desc = NULL;
+    }
+  }
+
+  port = 0;
+  if (GNUNET_CONFIGURATION_have_value (cfg, service_name, "PORT"))
+  {
+    if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                            service_name,
+                                                            "PORT",
+                                                            &port))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Require valid port number for service `%s' in configuration!\n"),
+           service_name);
+    }
+    if (port > 65535)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Require valid port number for service `%s' in configuration!\n"),
+           service_name);
+      return GNUNET_SYSERR;
+    }
+  }
+
+  if (GNUNET_CONFIGURATION_have_value (cfg, service_name, "BINDTO"))
+  {
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                         service_name,
+                                                         "BINDTO",
+                                                         &hostname));
+  }
+  else
+    hostname = NULL;
+
+  unixpath = NULL;
+  abstract = GNUNET_NO;
+#ifdef AF_UNIX
+  if ((GNUNET_YES ==
+       GNUNET_CONFIGURATION_have_value (cfg, service_name, "UNIXPATH")) &&
+      (GNUNET_OK == GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                             service_name,
+                                                             "UNIXPATH",
+                                                             &unixpath)) &&
+      (0 < strlen (unixpath)))
+  {
+    /* probe UNIX support */
+    struct sockaddr_un s_un;
+
+    if (strlen (unixpath) >= sizeof(s_un.sun_path))
+    {
+      LOG (GNUNET_ERROR_TYPE_WARNING,
+           _ ("UNIXPATH `%s' too long, maximum length is %llu\n"),
+           unixpath,
+           (unsigned long long) sizeof(s_un.sun_path));
+      unixpath = GNUNET_NETWORK_shorten_unixpath (unixpath);
+      LOG (GNUNET_ERROR_TYPE_INFO, _ ("Using `%s' instead\n"), unixpath);
+    }
+#ifdef __linux__
+    abstract = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                     "TESTING",
+                                                     "USE_ABSTRACT_SOCKETS");
+    if (GNUNET_SYSERR == abstract)
+      abstract = GNUNET_NO;
+#endif
+    if ((GNUNET_YES != abstract) &&
+        (GNUNET_OK != GNUNET_DISK_directory_create_for_file (unixpath)))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "mkdir", unixpath);
+  }
+  if (NULL != unixpath)
+  {
+    desc = GNUNET_NETWORK_socket_create (AF_UNIX, SOCK_STREAM, 0);
+    if (NULL == desc)
+    {
+      if ((ENOBUFS == errno) || (ENOMEM == errno) || (ENFILE == errno) ||
+          (EACCES == errno))
+      {
+        LOG_STRERROR (GNUNET_ERROR_TYPE_ERROR, "socket");
+        GNUNET_free (hostname);
+        GNUNET_free (unixpath);
+        return GNUNET_SYSERR;
+      }
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           _ (
+             "Disabling UNIX domain socket support for service `%s', failed to create UNIX domain socket: %s\n"),
+           service_name,
+           strerror (errno));
+      GNUNET_free (unixpath);
+      unixpath = NULL;
+    }
+    else
+    {
+      GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (desc));
+      desc = NULL;
+    }
+  }
+#endif
+
+  if ((0 == port) && (NULL == unixpath))
+  {
+    if (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                            service_name,
+                                                            "START_ON_DEMAND"))
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ (
+             "Have neither PORT nor UNIXPATH for service `%s', but one is required\n"),
+           service_name);
+    GNUNET_free (hostname);
+    return GNUNET_SYSERR;
+  }
+  if (0 == port)
+  {
+    saddrs = GNUNET_new_array (2, struct sockaddr *);
+    saddrlens = GNUNET_new_array (2, socklen_t);
+    add_unixpath (saddrs, saddrlens, unixpath, abstract);
+    GNUNET_free (unixpath);
+    GNUNET_free (hostname);
+    *addrs = saddrs;
+    *addr_lens = saddrlens;
+    return 1;
+  }
+
+  if (NULL != hostname)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Resolving `%s' since that is where `%s' will bind to.\n",
+         hostname,
+         service_name);
+    memset (&hints, 0, sizeof(struct addrinfo));
+    if (disablev6)
+      hints.ai_family = AF_INET;
+    hints.ai_protocol = IPPROTO_TCP;
+    if ((0 != (ret = getaddrinfo (hostname, NULL, &hints, &res))) ||
+        (NULL == res))
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Failed to resolve `%s': %s\n"),
+           hostname,
+           gai_strerror (ret));
+      GNUNET_free (hostname);
+      GNUNET_free (unixpath);
+      return GNUNET_SYSERR;
+    }
+    next = res;
+    i = 0;
+    while (NULL != (pos = next))
+    {
+      next = pos->ai_next;
+      if ((disablev6) && (pos->ai_family == AF_INET6))
+        continue;
+      i++;
+    }
+    if (0 == i)
+    {
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           _ ("Failed to find %saddress for `%s'.\n"),
+           disablev6 ? "IPv4 " : "",
+           hostname);
+      freeaddrinfo (res);
+      GNUNET_free (hostname);
+      GNUNET_free (unixpath);
+      return GNUNET_SYSERR;
+    }
+    resi = i;
+    if (NULL != unixpath)
+      resi++;
+    saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+    saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+    i = 0;
+    if (NULL != unixpath)
+    {
+      add_unixpath (saddrs, saddrlens, unixpath, abstract);
+      i++;
+    }
+    next = res;
+    while (NULL != (pos = next))
+    {
+      next = pos->ai_next;
+      if ((disablev6) && (AF_INET6 == pos->ai_family))
+        continue;
+      if ((IPPROTO_TCP != pos->ai_protocol) && (0 != pos->ai_protocol))
+        continue;     /* not TCP */
+      if ((SOCK_STREAM != pos->ai_socktype) && (0 != pos->ai_socktype))
+        continue;     /* huh? */
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Service `%s' will bind to `%s'\n",
+           service_name,
+           GNUNET_a2s (pos->ai_addr, pos->ai_addrlen));
+      if (AF_INET == pos->ai_family)
+      {
+        GNUNET_assert (sizeof(struct sockaddr_in) == pos->ai_addrlen);
+        saddrlens[i] = pos->ai_addrlen;
+        saddrs[i] = GNUNET_malloc (saddrlens[i]);
+        GNUNET_memcpy (saddrs[i], pos->ai_addr, saddrlens[i]);
+        ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+      }
+      else
+      {
+        GNUNET_assert (AF_INET6 == pos->ai_family);
+        GNUNET_assert (sizeof(struct sockaddr_in6) == pos->ai_addrlen);
+        saddrlens[i] = pos->ai_addrlen;
+        saddrs[i] = GNUNET_malloc (saddrlens[i]);
+        GNUNET_memcpy (saddrs[i], pos->ai_addr, saddrlens[i]);
+        ((struct sockaddr_in6 *) saddrs[i])->sin6_port = htons (port);
+      }
+      i++;
+    }
+    GNUNET_free (hostname);
+    freeaddrinfo (res);
+    resi = i;
+  }
+  else
+  {
+    /* will bind against everything, just set port */
+    if (disablev6)
+    {
+      /* V4-only */
+      resi = 1;
+      if (NULL != unixpath)
+        resi++;
+      i = 0;
+      saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+      saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+      if (NULL != unixpath)
+      {
+        add_unixpath (saddrs, saddrlens, unixpath, abstract);
+        i++;
+      }
+      saddrlens[i] = sizeof(struct sockaddr_in);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[i];
+#endif
+      ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+      ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+    }
+    else
+    {
+      /* dual stack */
+      resi = 2;
+      if (NULL != unixpath)
+        resi++;
+      saddrs = GNUNET_new_array (resi + 1, struct sockaddr *);
+      saddrlens = GNUNET_new_array (resi + 1, socklen_t);
+      i = 0;
+      if (NULL != unixpath)
+      {
+        add_unixpath (saddrs, saddrlens, unixpath, abstract);
+        i++;
+      }
+      saddrlens[i] = sizeof(struct sockaddr_in6);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_len = saddrlens[0];
+#endif
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_family = AF_INET6;
+      ((struct sockaddr_in6 *) saddrs[i])->sin6_port = htons (port);
+      i++;
+      saddrlens[i] = sizeof(struct sockaddr_in);
+      saddrs[i] = GNUNET_malloc (saddrlens[i]);
+#if HAVE_SOCKADDR_IN_SIN_LEN
+      ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[1];
+#endif
+      ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+      ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
+    }
+  }
+  GNUNET_free (unixpath);
+  *addrs = saddrs;
+  *addr_lens = saddrlens;
+  return resi;
+}
+
+
+/**
+ * Signal our client that we will start or stop the
+ * service.
+ *
+ * @param client who is being signalled
+ * @param name name of the service
+ * @param request_id id of the request that is being responded to.
+ * @param result message type to send
+ * @return NULL if it was not found
+ */
+static void
+signal_result (struct GNUNET_SERVICE_Client *client,
+               const char *name,
+               uint64_t request_id,
+               enum GNUNET_ARM_Result result)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_ARM_ResultMessage *msg;
+
+  (void) name;
+  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_ARM_RESULT);
+  msg->result = htonl (result);
+  msg->arm_msg.request_id = GNUNET_htonll (request_id);
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+}
+
+
+/**
+ * Tell all clients about status change of a service.
+ *
+ * @param name name of the service
+ * @param status message type to send
+ * @param unicast if not NULL, send to this client only.
+ *                otherwise, send to all clients in the notifier
+ */
+static void
+broadcast_status (const char *name,
+                  enum GNUNET_ARM_ServiceMonitorStatus status,
+                  struct GNUNET_SERVICE_Client *unicast)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_ARM_StatusMessage *msg;
+  size_t namelen;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending status %u of service `%s' to client\n",
+              (unsigned int) status,
+              name);
+  namelen = strlen (name) + 1;
+  env = GNUNET_MQ_msg_extra (msg, namelen, GNUNET_MESSAGE_TYPE_ARM_STATUS);
+  msg->status = htonl ((uint32_t) (status));
+  GNUNET_memcpy ((char *) &msg[1], name, namelen);
+  if (NULL == unicast)
+  {
+    if (NULL != notifier)
+      GNUNET_notification_context_broadcast (notifier,
+                                             &msg->header,
+                                             GNUNET_YES);
+    GNUNET_MQ_discard (env);
+  }
+  else
+  {
+    GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (unicast), env);
+  }
+}
+
+
+/**
+ * Actually start the process for the given service.
+ *
+ * @param sl identifies service to start
+ * @param client that asked to start the service (may be NULL)
+ * @param request_id id of the request in response to which the process is
+ *                   being started. 0 if starting was not requested.
+ */
+static void
+start_process (struct ServiceList *sl,
+               struct GNUNET_SERVICE_Client *client,
+               uint64_t request_id)
+{
+  char *loprefix;
+  char *options;
+  int use_debug;
+  int is_simple_service;
+  struct ServiceListeningInfo *sli;
+  int *lsocks;
+  unsigned int ls;
+  char *binary;
+  char *quotedbinary;
+
+  /* calculate listen socket list */
+  lsocks = NULL;
+  ls = 0;
+  for (sli = sl->listen_head; NULL != sli; sli = sli->next)
+  {
+    GNUNET_array_append (lsocks,
+                         ls,
+                         GNUNET_NETWORK_get_fd (sli->listen_socket));
+    if (NULL != sli->accept_task)
+    {
+      GNUNET_SCHEDULER_cancel (sli->accept_task);
+      sli->accept_task = NULL;
+    }
+  }
+
+  GNUNET_array_append (lsocks, ls, -1);
+
+  /* obtain configuration */
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          sl->name,
+                                                          "PREFIX",
+                                                          &loprefix))
+    loprefix = GNUNET_strdup (prefix_command);
+  else
+    loprefix = GNUNET_CONFIGURATION_expand_dollar (cfg, loprefix);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          sl->name,
+                                                          "OPTIONS",
+                                                          &options))
+    options = NULL;
+  else
+    options = GNUNET_CONFIGURATION_expand_dollar (cfg, options);
+  {
+    char *new_options;
+    char *optpos;
+    char *fin_options;
+
+    fin_options = GNUNET_strdup (final_option);
+    /* replace '{}' with service name */
+    while (NULL != (optpos = strstr (fin_options, "{}")))
+    {
+      /* terminate string at opening parenthesis */
+      *optpos = 0;
+      GNUNET_asprintf (&new_options,
+                       "%s%s%s",
+                       fin_options,
+                       sl->name,
+                       optpos + 2);
+      GNUNET_free (fin_options);
+      fin_options = new_options;
+    }
+    if (NULL != options)
+    {
+      /* combine "fin_options" with "options" */
+      optpos = options;
+      GNUNET_asprintf (&options, "%s %s", fin_options, optpos);
+      GNUNET_free (fin_options);
+      GNUNET_free (optpos);
+    }
+    else
+    {
+      /* only have "fin_options", use that */
+      options = fin_options;
+    }
+  }
+  options = GNUNET_CONFIGURATION_expand_dollar (cfg, options);
+  use_debug = GNUNET_CONFIGURATION_get_value_yesno (cfg, sl->name, "DEBUG");
+  {
+    const char *service_type = NULL;
+    const char *choices[] = { "GNUNET", "SIMPLE", NULL };
+
+    is_simple_service = GNUNET_NO;
+    if ((GNUNET_OK == GNUNET_CONFIGURATION_get_value_choice (cfg,
+                                                             sl->name,
+                                                             "TYPE",
+                                                             choices,
+                                                             &service_type)) &&
+        (0 == strcasecmp (service_type, "SIMPLE")))
+      is_simple_service = GNUNET_YES;
+  }
+
+  GNUNET_assert (NULL == sl->proc);
+  if (GNUNET_YES == is_simple_service)
+  {
+    /* A simple service will receive no GNUnet specific
+       command line options. */
+    binary = GNUNET_strdup (sl->binary);
+    binary = GNUNET_CONFIGURATION_expand_dollar (cfg, binary);
+    GNUNET_asprintf (&quotedbinary, "\"%s\"", sl->binary);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Starting simple service `%s' using binary `%s'\n",
+                sl->name,
+                sl->binary);
+    /* FIXME: dollar expansion should only be done outside
+     * of ''-quoted strings, escaping should be considered. */
+    if (NULL != options)
+      options = GNUNET_CONFIGURATION_expand_dollar (cfg, options);
+    sl->proc = GNUNET_OS_start_process_s (sl->pipe_control
+                                          ? GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                          | GNUNET_OS_USE_PIPE_CONTROL
+                                          : GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                          lsocks,
+                                          loprefix,
+                                          quotedbinary,
+                                          options,
+                                          NULL);
+  }
+  else
+  {
+    /* actually start process */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Starting service `%s' using binary `%s' and configuration `%s'\n",
+                sl->name,
+                sl->binary,
+                sl->config);
+    binary = GNUNET_OS_get_libexec_binary_path (sl->binary);
+    GNUNET_asprintf (&quotedbinary, "\"%s\"", binary);
+
+    if (GNUNET_YES == use_debug)
+    {
+      if (NULL == sl->config)
+        sl->proc = GNUNET_OS_start_process_s (sl->pipe_control
+                                              ?
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                              | GNUNET_OS_USE_PIPE_CONTROL
+                                              :
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                              lsocks,
+                                              loprefix,
+                                              quotedbinary,
+                                              "-L",
+                                              "DEBUG",
+                                              options,
+                                              NULL);
+      else
+        sl->proc = GNUNET_OS_start_process_s (sl->pipe_control
+                                              ?
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                              | GNUNET_OS_USE_PIPE_CONTROL
+                                              :
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                              lsocks,
+                                              loprefix,
+                                              quotedbinary,
+                                              "-c",
+                                              sl->config,
+                                              "-L",
+                                              "DEBUG",
+                                              options,
+                                              NULL);
+    }
+    else
+    {
+      if (NULL == sl->config)
+        sl->proc = GNUNET_OS_start_process_s (sl->pipe_control
+                                              ?
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                              | GNUNET_OS_USE_PIPE_CONTROL
+                                              :
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                              lsocks,
+                                              loprefix,
+                                              quotedbinary,
+                                              options,
+                                              NULL);
+      else
+        sl->proc = GNUNET_OS_start_process_s (sl->pipe_control
+                                              ?
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                              | GNUNET_OS_USE_PIPE_CONTROL
+                                              :
+                                              GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                              lsocks,
+                                              loprefix,
+                                              quotedbinary,
+                                              "-c",
+                                              sl->config,
+                                              options,
+                                              NULL);
+    }
+  }
+  GNUNET_free (binary);
+  GNUNET_free (quotedbinary);
+  sl->last_started_at = GNUNET_TIME_absolute_get ();
+  if (NULL == sl->proc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Failed to start service `%s'\n"),
+                sl->name);
+    if (client)
+      signal_result (client,
+                     sl->name,
+                     request_id,
+                     GNUNET_ARM_RESULT_START_FAILED);
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                _ ("Starting service `%s'\n"),
+                sl->name);
+    broadcast_status (sl->name, GNUNET_ARM_SERVICE_STARTING, NULL);
+    if (client)
+      signal_result (client, sl->name, request_id, GNUNET_ARM_RESULT_STARTING);
+  }
+  /* clean up */
+  GNUNET_free (loprefix);
+  GNUNET_free (options);
+  GNUNET_array_grow (lsocks, ls, 0);
+}
+
+
+/**
+ * Find the process with the given service
+ * name in the given list and return it.
+ *
+ * @param name which service entry to look up
+ * @return NULL if it was not found
+ */
+static struct ServiceList *
+find_service (const char *name)
+{
+  struct ServiceList *sl;
+
+  sl = running_head;
+  while (sl != NULL)
+  {
+    if (0 == strcasecmp (sl->name, name))
+      return sl;
+    sl = sl->next;
+  }
+  return NULL;
+}
+
+
+/**
+ * First connection has come to the listening socket associated with the service,
+ * create the service in order to relay the incoming connection to it
+ *
+ * @param cls callback data, `struct ServiceListeningInfo` describing a listen socket
+ */
+static void
+accept_connection (void *cls)
+{
+  struct ServiceListeningInfo *sli = cls;
+  struct ServiceList *sl = sli->sl;
+
+  sli->accept_task = NULL;
+  GNUNET_assert (GNUNET_NO == in_shutdown);
+  start_process (sl, NULL, 0);
+}
+
+
+/**
+ * Creating a listening socket for each of the service's addresses and
+ * wait for the first incoming connection to it
+ *
+ * @param sa address associated with the service
+ * @param addr_len length of @a sa
+ * @param sl service entry for the service in question
+ */
+static void
+create_listen_socket (struct sockaddr *sa,
+                      socklen_t addr_len,
+                      struct ServiceList *sl)
+{
+  static int on = 1;
+  struct GNUNET_NETWORK_Handle *sock;
+  struct ServiceListeningInfo *sli;
+
+  int match_uid;
+  int match_gid;
+
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    sock = GNUNET_NETWORK_socket_create (PF_INET, SOCK_STREAM, 0);
+    break;
+
+  case AF_INET6:
+    sock = GNUNET_NETWORK_socket_create (PF_INET6, SOCK_STREAM, 0);
+    break;
+
+  case AF_UNIX:
+    if (0 == strcmp (GNUNET_a2s (sa, addr_len),
+                     "@"))  /* Do not bind to blank UNIX path! */
+      return;
+    sock = GNUNET_NETWORK_socket_create (PF_UNIX, SOCK_STREAM, 0);
+    break;
+
+  default:
+    GNUNET_break (0);
+    sock = NULL;
+    errno = EAFNOSUPPORT;
+    break;
+  }
+  if (NULL == sock)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Unable to create socket for service `%s': %s\n"),
+                sl->name,
+                strerror (errno));
+    GNUNET_free (sa);
+    return;
+  }
+  if (GNUNET_OK != GNUNET_NETWORK_socket_setsockopt (sock,
+                                                     SOL_SOCKET,
+                                                     SO_REUSEADDR,
+                                                     &on,
+                                                     sizeof(on)))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                         "setsockopt");
+#ifdef IPV6_V6ONLY
+  if ((sa->sa_family == AF_INET6) &&
+      (GNUNET_OK != GNUNET_NETWORK_socket_setsockopt (sock,
+                                                      IPPROTO_IPV6,
+                                                      IPV6_V6ONLY,
+                                                      &on,
+                                                      sizeof(on))))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
+                         "setsockopt");
+#endif
+  if (AF_UNIX == sa->sa_family)
+    GNUNET_NETWORK_unix_precheck ((struct sockaddr_un *) sa);
+  if (GNUNET_OK !=
+      GNUNET_NETWORK_socket_bind (sock, (const struct sockaddr *) sa, addr_len))
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_WARNING,
+      _ (
+        "Unable to bind listening socket for service `%s' to address `%s': %s\n"),
+      sl->name,
+      GNUNET_a2s (sa, addr_len),
+      strerror (errno));
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (sock));
+    GNUNET_free (sa);
+    return;
+  }
+  if ((AF_UNIX == sa->sa_family)
+#ifdef __linux__
+      /* Permission settings are not required when abstract sockets are used */
+      && ('\0' != ((const struct sockaddr_un *) sa)->sun_path[0])
+#endif
+      )
+  {
+    match_uid =
+      GNUNET_CONFIGURATION_get_value_yesno (cfg, sl->name, "UNIX_MATCH_UID");
+    match_gid =
+      GNUNET_CONFIGURATION_get_value_yesno (cfg, sl->name, "UNIX_MATCH_GID");
+    GNUNET_DISK_fix_permissions (((const struct sockaddr_un *) sa)->sun_path,
+                                 match_uid,
+                                 match_gid);
+  }
+  if (GNUNET_OK != GNUNET_NETWORK_socket_listen (sock, 5))
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "listen");
+    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (sock));
+    GNUNET_free (sa);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("ARM now monitors connections to service `%s' at `%s'\n"),
+              sl->name,
+              GNUNET_a2s (sa, addr_len));
+  sli = GNUNET_new (struct ServiceListeningInfo);
+  sli->service_addr = sa;
+  sli->service_addr_len = addr_len;
+  sli->listen_socket = sock;
+  sli->sl = sl;
+  sli->accept_task =
+    GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                   sock,
+                                   &accept_connection,
+                                   sli);
+  GNUNET_CONTAINER_DLL_insert (sl->listen_head, sl->listen_tail, sli);
+}
+
+
+/**
+ * Remove and free an entry in the service list.  Listen sockets
+ * must have already been cleaned up.  Only to be called during shutdown.
+ *
+ * @param sl entry to free
+ */
+static void
+free_service (struct ServiceList *sl)
+{
+  GNUNET_assert (GNUNET_YES == in_shutdown);
+  GNUNET_CONTAINER_DLL_remove (running_head, running_tail, sl);
+  GNUNET_assert (NULL == sl->listen_head);
+  GNUNET_free (sl->config);
+  GNUNET_free (sl->binary);
+  GNUNET_free (sl->name);
+  GNUNET_free (sl);
+}
+
+
+/**
+ * Check START-message.
+ *
+ * @param cls identification of the client
+ * @param amsg the actual message
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
+static int
+check_start (void *cls, const struct GNUNET_ARM_Message *amsg)
+{
+  (void) cls;
+  GNUNET_MQ_check_zero_termination (amsg);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle START-message.
+ *
+ * @param cls identification of the client
+ * @param amsg the actual message
+ */
+static void
+handle_start (void *cls, const struct GNUNET_ARM_Message *amsg)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  const char *servicename;
+  struct ServiceList *sl;
+  uint64_t request_id;
+
+  request_id = GNUNET_ntohll (amsg->request_id);
+  servicename = (const char *) &amsg[1];
+  GNUNET_SERVICE_client_continue (client);
+  if (GNUNET_YES == in_shutdown)
+  {
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IN_SHUTDOWN);
+    return;
+  }
+  sl = find_service (servicename);
+  if (NULL == sl)
+  {
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IS_NOT_KNOWN);
+    return;
+  }
+  sl->force_start = GNUNET_YES;
+  if (NULL != sl->proc)
+  {
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IS_STARTED_ALREADY);
+    return;
+  }
+  start_process (sl, client, request_id);
+}
+
+
+/**
+ * Start a shutdown sequence.
+ *
+ * @param cls closure (refers to service)
+ */
+static void
+trigger_shutdown (void *cls)
+{
+  (void) cls;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Triggering shutdown\n");
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Check STOP-message.
+ *
+ * @param cls identification of the client
+ * @param amsg the actual message
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
+static int
+check_stop (void *cls, const struct GNUNET_ARM_Message *amsg)
+{
+  (void) cls;
+  GNUNET_MQ_check_zero_termination (amsg);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle STOP-message.
+ *
+ * @param cls identification of the client
+ * @param amsg the actual message
+ */
+static void
+handle_stop (void *cls, const struct GNUNET_ARM_Message *amsg)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct ServiceList *sl;
+  const char *servicename;
+  uint64_t request_id;
+
+  request_id = GNUNET_ntohll (amsg->request_id);
+  servicename = (const char *) &amsg[1];
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("Preparing to stop `%s'\n"),
+              servicename);
+  GNUNET_SERVICE_client_continue (client);
+  if (0 == strcasecmp (servicename, "arm"))
+  {
+    broadcast_status (servicename, GNUNET_ARM_SERVICE_STOPPING, NULL);
+    signal_result (client, servicename, request_id, GNUNET_ARM_RESULT_STOPPING);
+    GNUNET_SERVICE_client_persist (client);
+    GNUNET_SCHEDULER_add_now (&trigger_shutdown, NULL);
+    return;
+  }
+  sl = find_service (servicename);
+  if (NULL == sl)
+  {
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IS_NOT_KNOWN);
+    return;
+  }
+  sl->force_start = GNUNET_NO;
+  if (GNUNET_YES == in_shutdown)
+  {
+    /* shutdown in progress */
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IN_SHUTDOWN);
+    return;
+  }
+  if (NULL != sl->killing_client)
+  {
+    /* killing already in progress */
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IS_STOPPING_ALREADY);
+    return;
+  }
+  if (NULL == sl->proc)
+  {
+    /* process is down */
+    signal_result (client,
+                   servicename,
+                   request_id,
+                   GNUNET_ARM_RESULT_IS_STOPPED_ALREADY);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending kill signal to service `%s', waiting for process to die.\n",
+              servicename);
+  broadcast_status (servicename, GNUNET_ARM_SERVICE_STOPPING, NULL);
+  /* no signal_start - only when it's STOPPED */
+  sl->killed_at = GNUNET_TIME_absolute_get ();
+  if (0 != GNUNET_OS_process_kill (sl->proc, GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+  sl->killing_client = client;
+  sl->killing_client_request_id = request_id;
+}
+
+
+/**
+ * Write a string to a string pool.
+ *
+ * @param pool_start pointer to the start of the string pool
+ * @param pool_size size of the string pool
+ * @param[in,out] pool_pos current position index in the string pool,
+ *                will be updated
+ * @param str string to write to the string pool
+ * @returns GNUNET_OK if the string fits into the pool,
+ *          GNUNET_SYSERR otherwise
+ */
+static int
+pool_write (char *pool_start, size_t pool_size, size_t *pool_pos, char *str)
+{
+  size_t next_pos = (*pool_pos) + strlen (str) + 1;
+
+  if (next_pos > pool_size)
+    return GNUNET_SYSERR;
+  memcpy (pool_start + *pool_pos, str, strlen (str) + 1);
+  *pool_pos = next_pos;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle LIST-message.
+ *
+ * @param cls identification of the client
+ * @param request the actual message
+ */
+static void
+handle_list (void *cls, const struct GNUNET_ARM_Message *request)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_ARM_ListResultMessage *msg;
+  size_t extra_size;
+  struct ServiceList *sl;
+  uint16_t count;
+  size_t pool_size;
+  size_t pool_pos;
+  char *pool_start;
+  struct GNUNET_ARM_ServiceInfoMessage *ssm;
+
+  GNUNET_break_op (0 == ntohl (request->reserved));
+  count = 0;
+  pool_size = 0;
+
+  /* Do one pass over the list to compute the number of services
+   * and the string pool size */
+  for (sl = running_head; NULL != sl; sl = sl->next)
+  {
+    pool_size += strlen (sl->name) + 1;
+    pool_size += strlen (sl->binary) + 1;
+    count++;
+  }
+
+  extra_size = pool_size + (count * sizeof (struct
+                                            GNUNET_ARM_ServiceInfoMessage));
+  env = GNUNET_MQ_msg_extra (msg,
+                             extra_size,
+                             GNUNET_MESSAGE_TYPE_ARM_LIST_RESULT);
+  msg->arm_msg.request_id = request->request_id;
+  msg->count = htons (count);
+
+  ssm = (struct GNUNET_ARM_ServiceInfoMessage *) &msg[1];
+  pool_start = (char *) (ssm + count);
+  pool_pos = 0;
+
+  for (sl = running_head; NULL != sl; sl = sl->next)
+  {
+    ssm->name_index = htons ((uint16_t) pool_pos);
+    GNUNET_assert (GNUNET_OK == pool_write (pool_start, pool_size, &pool_pos,
+                                            sl->name));
+    ssm->binary_index = htons ((uint16_t) pool_pos);
+    GNUNET_assert (GNUNET_OK == pool_write (pool_start, pool_size, &pool_pos,
+                                            sl->binary));
+    if (NULL == sl->proc)
+    {
+      if (0 == sl->last_started_at.abs_value_us)
+      {
+        /* Process never started */
+        ssm->status = htonl (GNUNET_ARM_SERVICE_STATUS_STOPPED);
+      }
+      else if (0 == sl->last_exit_status)
+      {
+        ssm->status = htonl (GNUNET_ARM_SERVICE_STATUS_FINISHED);
+      }
+      else
+      {
+        ssm->status = htonl (GNUNET_ARM_SERVICE_STATUS_FAILED);
+        ssm->last_exit_status = htons (sl->last_exit_status);
+      }
+    }
+    else if ((NULL != sl->killing_client) || (GNUNET_YES == in_shutdown))
+    {
+      ssm->status = htonl (GNUNET_ARM_SERVICE_STATUS_STOPPING);
+    }
+    else
+    {
+      ssm->status = htonl (GNUNET_ARM_SERVICE_STATUS_STARTED);
+    }
+    ssm->last_started_at = GNUNET_TIME_absolute_hton (sl->last_started_at);
+    ssm->restart_at = GNUNET_TIME_absolute_hton (sl->restart_at);
+    ssm++;
+  }
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Handle TEST-message by sending back TEST.
+ *
+ * @param cls identification of the client
+ * @param message the actual message
+ */
+static void
+handle_test (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  (void) message;
+  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_ARM_TEST);
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * We are done with everything.  Stop remaining
+ * tasks, signal handler and the server.
+ */
+static void
+do_shutdown ()
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Last shutdown phase\n");
+  if (NULL != notifier)
+  {
+    GNUNET_notification_context_destroy (notifier);
+    notifier = NULL;
+  }
+  if (NULL != service)
+  {
+    GNUNET_SERVICE_shutdown (service);
+    service = NULL;
+  }
+  if (NULL != child_death_task)
+  {
+    GNUNET_SCHEDULER_cancel (child_death_task);
+    child_death_task = NULL;
+  }
+}
+
+
+/**
+ * Count how many services are still active.
+ *
+ * @param running_head list of services
+ * @return number of active services found
+ */
+static unsigned int
+list_count (struct ServiceList *running_head)
+{
+  struct ServiceList *i;
+  unsigned int res;
+
+  for (res = 0, i = running_head; NULL != i; i = i->next, res++)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "%s\n", i->name);
+  return res;
+}
+
+
+/**
+ * Task run for shutdown.
+ *
+ * @param cls closure, NULL if we need to self-restart
+ */
+static void
+shutdown_task (void *cls)
+{
+  struct ServiceList *pos;
+  struct ServiceList *nxt;
+  struct ServiceListeningInfo *sli;
+
+  (void) cls;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "First shutdown phase\n");
+  if (NULL != child_restart_task)
+  {
+    GNUNET_SCHEDULER_cancel (child_restart_task);
+    child_restart_task = NULL;
+  }
+  in_shutdown = GNUNET_YES;
+  /* first, stop listening */
+  for (pos = running_head; NULL != pos; pos = pos->next)
+  {
+    while (NULL != (sli = pos->listen_head))
+    {
+      GNUNET_CONTAINER_DLL_remove (pos->listen_head, pos->listen_tail, sli);
+      if (NULL != sli->accept_task)
+      {
+        GNUNET_SCHEDULER_cancel (sli->accept_task);
+        sli->accept_task = NULL;
+      }
+      GNUNET_break (GNUNET_OK ==
+                    GNUNET_NETWORK_socket_close (sli->listen_socket));
+      GNUNET_free (sli->service_addr);
+      GNUNET_free (sli);
+    }
+  }
+  /* then, shutdown all existing service processes */
+  nxt = running_head;
+  while (NULL != (pos = nxt))
+  {
+    nxt = pos->next;
+    if (NULL != pos->proc)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Stopping service `%s'\n", pos->name);
+      pos->killed_at = GNUNET_TIME_absolute_get ();
+      if (0 != GNUNET_OS_process_kill (pos->proc, GNUNET_TERM_SIG))
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+    }
+    else
+    {
+      free_service (pos);
+    }
+  }
+  /* finally, should all service processes be already gone, terminate for real */
+  if (NULL == running_head)
+    do_shutdown ();
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Delaying shutdown, have %u children still running\n",
+                list_count (running_head));
+}
+
+
+/**
+ * Task run whenever it is time to restart a child that died.
+ *
+ * @param cls closure, always NULL
+ */
+static void
+delayed_restart_task (void *cls)
+
+{
+  struct ServiceList *sl;
+  struct GNUNET_TIME_Relative lowestRestartDelay;
+  struct ServiceListeningInfo *sli;
+
+  (void) cls;
+  child_restart_task = NULL;
+  GNUNET_assert (GNUNET_NO == in_shutdown);
+  lowestRestartDelay = GNUNET_TIME_UNIT_FOREVER_REL;
+
+  /* check for services that need to be restarted due to
+   * configuration changes or because the last restart failed */
+  for (sl = running_head; NULL != sl; sl = sl->next)
+  {
+    if (NULL != sl->proc)
+      continue;
+    /* service is currently not running */
+    if (0 == GNUNET_TIME_absolute_get_remaining (sl->restart_at).rel_value_us)
+    {
+      /* restart is now allowed */
+      if (sl->force_start)
+      {
+        /* process should run by default, start immediately */
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    _ ("Restarting service `%s'.\n"),
+                    sl->name);
+        start_process (sl, NULL, 0);
+      }
+      else
+      {
+        /* process is run on-demand, ensure it is re-started if there is demand */
+        for (sli = sl->listen_head; NULL != sli; sli = sli->next)
+          if (NULL == sli->accept_task)
+          {
+            /* accept was actually paused, so start it again */
+            sli->accept_task =
+              GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                             sli->listen_socket,
+                                             &accept_connection,
+                                             sli);
+          }
+      }
+    }
+    else
+    {
+      /* update calculation for earliest time to reactivate a service */
+      lowestRestartDelay =
+        GNUNET_TIME_relative_min (lowestRestartDelay,
+                                  GNUNET_TIME_absolute_get_remaining (
+                                    sl->restart_at));
+    }
+  }
+  if (lowestRestartDelay.rel_value_us !=
+      GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Will restart process in %s\n",
+                GNUNET_STRINGS_relative_time_to_string (lowestRestartDelay,
+                                                        GNUNET_YES));
+    child_restart_task =
+      GNUNET_SCHEDULER_add_delayed_with_priority (lowestRestartDelay,
+                                                  GNUNET_SCHEDULER_PRIORITY_IDLE,
+                                                  &delayed_restart_task,
+                                                  NULL);
+  }
+}
+
+
+/**
+ * Task triggered whenever we receive a SIGCHLD (child
+ * process died).
+ *
+ * @param cls closure, NULL
+ */
+static void
+maint_child_death (void *cls)
+{
+  struct ServiceList *pos;
+  struct ServiceList *next;
+  struct ServiceListeningInfo *sli;
+  const char *statstr;
+  int statcode;
+  int ret;
+  char c[16];
+  enum GNUNET_OS_ProcessStatusType statusType;
+  unsigned long statusCode;
+  const struct GNUNET_DISK_FileHandle *pr;
+
+  (void) cls;
+  pr = GNUNET_DISK_pipe_handle (sigpipe, GNUNET_DISK_PIPE_END_READ);
+  child_death_task = NULL;
+  /* consume the signal */
+  GNUNET_break (0 < GNUNET_DISK_file_read (pr, &c, sizeof(c)));
+
+  /* check for services that died (WAITPID) */
+  next = running_head;
+  while (NULL != (pos = next))
+  {
+    next = pos->next;
+
+    if (NULL == pos->proc)
+    {
+      if (GNUNET_YES == in_shutdown)
+        free_service (pos);
+      continue;
+    }
+#if HAVE_WAIT4
+    if (NULL != wait_file)
+    {
+      /* need to use 'wait4()' to obtain and log performance data */
+      struct rusage ru;
+      int status;
+      pid_t pid;
+
+      pid = GNUNET_OS_process_get_pid (pos->proc);
+      ret = wait4 (pid, &status, WNOHANG, &ru);
+      if (ret <= 0)
+        continue;     /* no process done */
+      if (WIFEXITED (status))
+      {
+        statusType = GNUNET_OS_PROCESS_EXITED;
+        statusCode = WEXITSTATUS (status);
+      }
+      else if (WIFSIGNALED (status))
+      {
+        statusType = GNUNET_OS_PROCESS_SIGNALED;
+        statusCode = WTERMSIG (status);
+      }
+      else if (WIFSTOPPED (status))
+      {
+        statusType = GNUNET_OS_PROCESS_SIGNALED;
+        statusCode = WSTOPSIG (status);
+      }
+#ifdef WIFCONTINUED
+      else if (WIFCONTINUED (status))
+      {
+        statusType = GNUNET_OS_PROCESS_RUNNING;
+        statusCode = 0;
+      }
+#endif
+      else
+      {
+        statusType = GNUNET_OS_PROCESS_UNKNOWN;
+        statusCode = 0;
+      }
+      if ((GNUNET_OS_PROCESS_EXITED == statusType) ||
+          (GNUNET_OS_PROCESS_SIGNALED == statusType))
+      {
+        double utime = ru.ru_utime.tv_sec + (ru.ru_utime.tv_usec / 10e6);
+        double stime = ru.ru_stime.tv_sec + (ru.ru_stime.tv_usec / 10e6);
+        fprintf (wait_file,
+                 "%s(%u) %.3f %.3f %llu %llu %llu %llu %llu\n",
+                 pos->binary,
+                 (unsigned int) pid,
+                 utime,
+                 stime,
+                 (unsigned long long) ru.ru_maxrss,
+                 (unsigned long long) ru.ru_inblock,
+                 (unsigned long long) ru.ru_oublock,
+                 (unsigned long long) ru.ru_nvcsw,
+                 (unsigned long long) ru.ru_nivcsw);
+      }
+    }
+    else   /* continue with JUST this "if" as "else" (intentionally no brackets!) */
+#endif
+    if ((GNUNET_SYSERR == (ret = GNUNET_OS_process_status (pos->proc,
+                                                           &statusType,
+                                                           &statusCode))) ||
+        (ret == GNUNET_NO) || (statusType == GNUNET_OS_PROCESS_STOPPED) ||
+        (statusType == GNUNET_OS_PROCESS_UNKNOWN) ||
+        (statusType == GNUNET_OS_PROCESS_RUNNING))
+      continue;
+
+    if (statusType == GNUNET_OS_PROCESS_EXITED)
+    {
+      statstr = _ (/* process termination method */ "exit");
+      statcode = statusCode;
+    }
+    else if (statusType == GNUNET_OS_PROCESS_SIGNALED)
+    {
+      statstr = _ (/* process termination method */ "signal");
+      statcode = statusCode;
+    }
+    else
+    {
+      statstr = _ (/* process termination method */ "unknown");
+      statcode = 0;
+    }
+    if (0 != pos->killed_at.abs_value_us)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  _ ("Service `%s' took %s to terminate\n"),
+                  pos->name,
+                  GNUNET_STRINGS_relative_time_to_string (
+                    GNUNET_TIME_absolute_get_duration (pos->killed_at),
+                    GNUNET_YES));
+    }
+    GNUNET_OS_process_destroy (pos->proc);
+    pos->proc = NULL;
+    broadcast_status (pos->name, GNUNET_ARM_SERVICE_STOPPED, NULL);
+    if (NULL != pos->killing_client)
+    {
+      signal_result (pos->killing_client,
+                     pos->name,
+                     pos->killing_client_request_id,
+                     GNUNET_ARM_RESULT_STOPPED);
+      pos->killing_client = NULL;
+      pos->killing_client_request_id = 0;
+    }
+    if (GNUNET_YES != in_shutdown)
+    {
+      pos->last_exit_status = statcode;
+      if ((statusType == GNUNET_OS_PROCESS_EXITED) && (statcode == 0))
+      {
+        /* process terminated normally, allow restart at any time */
+        pos->restart_at.abs_value_us = 0;
+        GNUNET_log (
+          GNUNET_ERROR_TYPE_INFO,
+          _ ("Service `%s' terminated normally, will restart at any time\n"),
+          pos->name);
+        /* process can still be re-started on-demand, ensure it is re-started if there is demand */
+        for (sli = pos->listen_head; NULL != sli; sli = sli->next)
+        {
+          GNUNET_break (NULL == sli->accept_task);
+          sli->accept_task =
+            GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                           sli->listen_socket,
+                                           &accept_connection,
+                                           sli);
+        }
+      }
+      else
+      {
+        GNUNET_log (
+          GNUNET_ERROR_TYPE_WARNING,
+          _ ("Service `%s' terminated with status %s/%d, will restart in %s\n"),
+          pos->name,
+          statstr,
+          statcode,
+          GNUNET_STRINGS_relative_time_to_string (pos->backoff, GNUNET_YES));
+        {
+          /* Reduce backoff based on runtime of the process,
+             so that there is a cool-down if a process actually
+             runs for a while. */
+          struct GNUNET_TIME_Relative runtime;
+          unsigned int minutes;
+
+          runtime = GNUNET_TIME_absolute_get_duration (pos->restart_at);
+          minutes =
+            runtime.rel_value_us / GNUNET_TIME_UNIT_MINUTES.rel_value_us;
+          if (minutes > 31)
+            pos->backoff = GNUNET_TIME_UNIT_ZERO;
+          else
+            pos->backoff.rel_value_us <<= minutes;
+        }
+        /* schedule restart */
+        pos->restart_at = GNUNET_TIME_relative_to_absolute (pos->backoff);
+        pos->backoff = GNUNET_TIME_STD_BACKOFF (pos->backoff);
+        if (NULL != child_restart_task)
+          GNUNET_SCHEDULER_cancel (child_restart_task);
+        child_restart_task =
+          GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_IDLE,
+                                              &delayed_restart_task,
+                                              NULL);
+      }
+    }
+    else
+    {
+      free_service (pos);
+    }
+  }
+  child_death_task =
+    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
+                                    pr,
+                                    &maint_child_death,
+                                    NULL);
+  if ((NULL == running_head) && (GNUNET_YES == in_shutdown))
+    do_shutdown ();
+  else if (GNUNET_YES == in_shutdown)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Delaying shutdown after child's death, still have %u children\n",
+                list_count (running_head));
+}
+
+
+/**
+ * Signal handler called for SIGCHLD.  Triggers the
+ * respective handler by writing to the trigger pipe.
+ */
+static void
+sighandler_child_death ()
+{
+  static char c;
+  int old_errno = errno; /* back-up errno */
+
+  GNUNET_break (
+    1 ==
+    GNUNET_DISK_file_write (GNUNET_DISK_pipe_handle (sigpipe,
+                                                     GNUNET_DISK_PIPE_END_WRITE),
+                            &c,
+                            sizeof(c)));
+  errno = old_errno; /* restore errno */
+}
+
+
+/**
+ * Setup our service record for the given section in the configuration file
+ * (assuming the section is for a service).
+ *
+ * @param cls unused
+ * @param section a section in the configuration file
+ * @return #GNUNET_OK (continue)
+ */
+static void
+setup_service (void *cls, const char *section)
+{
+  struct ServiceList *sl;
+  char *binary;
+  char *config;
+  struct stat sbuf;
+  struct sockaddr **addrs;
+  socklen_t *addr_lens;
+  int ret;
+
+  (void) cls;
+  if (0 == strcasecmp (section, "arm"))
+    return;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, section, "BINARY", &binary))
+  {
+    /* not a service section */
+    return;
+  }
+  if ((GNUNET_YES ==
+       GNUNET_CONFIGURATION_have_value (cfg, section, "RUN_PER_USER")) &&
+      (GNUNET_YES ==
+       GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "RUN_PER_USER")))
+  {
+    if (GNUNET_NO == start_user)
+    {
+      GNUNET_free (binary);
+      return;     /* user service, and we don't deal with those */
+    }
+  }
+  else
+  {
+    if (GNUNET_NO == start_system)
+    {
+      GNUNET_free (binary);
+      return;     /* system service, and we don't deal with those */
+    }
+  }
+  sl = find_service (section);
+  if (NULL != sl)
+  {
+    /* got the same section twice!? */
+    GNUNET_break (0);
+    GNUNET_free (binary);
+    return;
+  }
+  config = NULL;
+  if (((GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                              section,
+                                                              "CONFIG",
+                                                              &config)) &&
+       (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                              "PATHS",
+                                                              "DEFAULTCONFIG",
+                                                              &config))) ||
+      (0 != stat (config, &sbuf)))
+  {
+    if (NULL != config)
+    {
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_WARNING,
+                                 section,
+                                 "CONFIG",
+                                 strerror (errno));
+      GNUNET_free (config);
+      config = NULL;
+    }
+  }
+  sl = GNUNET_new (struct ServiceList);
+  sl->name = GNUNET_strdup (section);
+  sl->binary = binary;
+  sl->config = config;
+  sl->backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+  sl->restart_at = GNUNET_TIME_UNIT_FOREVER_ABS;
+  if (GNUNET_CONFIGURATION_have_value (cfg, section, "PIPECONTROL"))
+    sl->pipe_control =
+      GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "PIPECONTROL");
+  GNUNET_CONTAINER_DLL_insert (running_head, running_tail, sl);
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "IMMEDIATE_START"))
+  {
+    sl->force_start = GNUNET_YES;
+    if (GNUNET_YES ==
+        GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "NOARMBIND"))
+      return;
+  }
+  else
+  {
+    if (GNUNET_YES !=
+        GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "START_ON_DEMAND"))
+      return;
+  }
+  if (0 >= (ret = get_server_addresses (section, cfg, &addrs, &addr_lens)))
+    return;
+  /* this will free (or capture) addrs[i] */
+  for (unsigned int i = 0; i < (unsigned int) ret; i++)
+    create_listen_socket (addrs[i], addr_lens[i], sl);
+  GNUNET_free (addrs);
+  GNUNET_free (addr_lens);
+}
+
+
+/**
+ * A client connected, mark as a monitoring client.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ * @param mq queue to talk to @a client
+ * @return @a client
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *client,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  /* All clients are considered to be of the "monitor" kind
+   * (that is, they don't affect ARM shutdown).
+   */
+  (void) cls;
+  (void) mq;
+  GNUNET_SERVICE_client_mark_monitor (client);
+  return client;
+}
+
+
+/**
+ * A client disconnected, clean up associated state.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ * @param app_ctx must match @a client
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *client,
+                      void *app_ctx)
+{
+  (void) cls;
+  GNUNET_assert (client == app_ctx);
+  for (struct ServiceList *sl = running_head; NULL != sl; sl = sl->next)
+    if (sl->killing_client == client)
+      sl->killing_client = NULL;
+}
+
+
+/**
+ * Handle MONITOR-message.
+ *
+ * @param cls identification of the client
+ * @param message the actual message
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
+static void
+handle_monitor (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  (void) message;
+  /* FIXME: might want to start by letting monitor know about
+     services that are already running */
+  /* Removal is handled by the server implementation, internally. */
+  GNUNET_notification_context_add (notifier,
+                                   GNUNET_SERVICE_client_get_mq (client));
+  broadcast_status ("arm", GNUNET_ARM_SERVICE_MONITORING_STARTED, client);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Process arm requests.
+ *
+ * @param cls closure, NULL
+ * @param serv the initialized service
+ * @param c configuration to use
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *c,
+     struct GNUNET_SERVICE_Handle *serv)
+{
+  struct ServiceList *sl;
+
+  (void) cls;
+  cfg = c;
+  service = serv;
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+  child_death_task = GNUNET_SCHEDULER_add_read_file (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    GNUNET_DISK_pipe_handle (sigpipe, GNUNET_DISK_PIPE_END_READ),
+    &maint_child_death,
+    NULL);
+#if HAVE_WAIT4
+  if (GNUNET_OK ==
+      GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                               "ARM",
+                                               "RESOURCE_DIAGNOSTICS",
+                                               &wait_filename))
+  {
+    wait_file = fopen (wait_filename, "w");
+    if (NULL == wait_file)
+    {
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "fopen",
+                                wait_filename);
+    }
+  }
+#endif
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          "ARM",
+                                                          "GLOBAL_PREFIX",
+                                                          &prefix_command))
+    prefix_command = GNUNET_strdup ("");
+  else
+    prefix_command = GNUNET_CONFIGURATION_expand_dollar (cfg, prefix_command);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          "ARM",
+                                                          "GLOBAL_POSTFIX",
+                                                          &final_option))
+    final_option = GNUNET_strdup ("");
+  else
+    final_option = GNUNET_CONFIGURATION_expand_dollar (cfg, final_option);
+  start_user =
+    GNUNET_CONFIGURATION_get_value_yesno (cfg, "ARM", "START_USER_SERVICES");
+  start_system =
+    GNUNET_CONFIGURATION_get_value_yesno (cfg, "ARM", "START_SYSTEM_SERVICES");
+  if ((GNUNET_NO == start_user) && (GNUNET_NO == start_system))
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_ERROR,
+      "Please configure either START_USER_SERVICES or START_SYSTEM_SERVICES or both.\n");
+    GNUNET_SCHEDULER_shutdown ();
+    global_ret = 1;
+    return;
+  }
+  GNUNET_CONFIGURATION_iterate_sections (cfg, &setup_service, NULL);
+
+  /* start default services... */
+  for (sl = running_head; NULL != sl; sl = sl->next)
+    if (GNUNET_YES == sl->force_start)
+      start_process (sl, NULL, 0);
+  notifier = GNUNET_notification_context_create (MAX_NOTIFY_QUEUE);
+}
+
+
+/**
+ * The main function for the arm service.
+ *
+ * @param argc number of arguments from the command line
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ */
+int
+main (int argc, char *const *argv)
+{
+  struct GNUNET_SIGNAL_Context *shc_chld;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (start,
+                           GNUNET_MESSAGE_TYPE_ARM_START,
+                           struct GNUNET_ARM_Message,
+                           NULL),
+    GNUNET_MQ_hd_var_size (stop,
+                           GNUNET_MESSAGE_TYPE_ARM_STOP,
+                           struct GNUNET_ARM_Message,
+                           NULL),
+    GNUNET_MQ_hd_fixed_size (monitor,
+                             GNUNET_MESSAGE_TYPE_ARM_MONITOR,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (list,
+                             GNUNET_MESSAGE_TYPE_ARM_LIST,
+                             struct GNUNET_ARM_Message,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (test,
+                             GNUNET_MESSAGE_TYPE_ARM_TEST,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  sigpipe = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE);
+  GNUNET_assert (NULL != sigpipe);
+  shc_chld =
+    GNUNET_SIGNAL_handler_install (GNUNET_SIGCHLD,
+                                   &sighandler_child_death);
+  if (0 != GNUNET_SERVICE_run_ (argc,
+                                argv,
+                                "arm",
+                                GNUNET_SERVICE_OPTION_MANUAL_SHUTDOWN
+                                | GNUNET_SERVICE_OPTION_CLOSE_LSOCKS,
+                                &run,
+                                &client_connect_cb,
+                                &client_disconnect_cb,
+                                NULL,
+                                handlers))
+    global_ret = 2;
+#if HAVE_WAIT4
+  if (NULL != wait_file)
+  {
+    fclose (wait_file);
+    wait_file = NULL;
+  }
+  if (NULL != wait_filename)
+  {
+    GNUNET_free (wait_filename);
+    wait_filename = NULL;
+  }
+#endif
+  GNUNET_SIGNAL_handler_uninstall (shc_chld);
+  shc_chld = NULL;
+  GNUNET_DISK_pipe_close (sigpipe);
+  sigpipe = NULL;
+  return global_ret;
+}
+
+
+#if defined(__linux__) && defined(__GLIBC__)
+#include <malloc.h>
+
+/**
+ * MINIMIZE heap size (way below 128k) since this process doesn't need much.
+ */
+void __attribute__ ((constructor))
+GNUNET_ARM_memory_init ()
+{
+  mallopt (M_TRIM_THRESHOLD, 4 * 1024);
+  mallopt (M_TOP_PAD, 1 * 1024);
+  malloc_trim (0);
+}
+
+
+#endif
+
+
+/* end of gnunet-service-arm.c */
diff --git a/src/service/arm/meson.build b/src/service/arm/meson.build
new file mode 100644
index 000000000..bfeb0b31f
--- /dev/null
+++ b/src/service/arm/meson.build
@@ -0,0 +1,86 @@
+libgnunetarm_src = ['arm_api.c',
+                    'arm_monitor_api.c']
+
+gnunetservicearm_src = ['gnunet-service-arm.c']
+
+gnunetarm_src = ['gnunet-arm.c']
+
+testarmapi_src = ['test_arm_api.c']
+testexpbo_src = ['test_exponential_backoff.c']
+testgnunetservice_src = ['test_gnunet_service_arm.c']
+
+configure_file(input : 'arm.conf.in',
+               output : 'arm.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+if get_option('monolith')
+  foreach p : libgnunetarm_src + gnunetservicearm_src
+    gnunet_src += 'arm/' + p
+  endforeach
+  subdir_done()
+endif
+
+libgnunetarm = library('gnunetarm',
+        libgnunetarm_src,
+        dependencies: libgnunetutil_dep,
+        version: '2.0.0',
+        soversion: '2',
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+pkg.generate(libgnunetarm, url: 'https://www.gnunet.org',
+             description : 'Provides API for accessing the Automated Restart Manager service')
+libgnunetarm_dep = declare_dependency(link_with : libgnunetarm)
+executable ('gnunet-arm',
+            gnunetarm_src,
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('bindir'))
+
+executable ('gnunet-service-arm',
+            gnunetservicearm_src,
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir') / 'gnunet' / 'libexec')
+
+mockservice = executable ('mockup-service',
+            ['mockup-service.c'],
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+testarmapi = executable ('test_arm_api',
+            testarmapi_src,
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+testexpbo = executable ('test_exponential_backoff',
+            testexpbo_src,
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+testgnunetservice = executable ('test_gnunet_service',
+            testgnunetservice_src,
+            dependencies: [libgnunetarm_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+configure_file(copy: true,
+               input: 'test_arm_api_data.conf',
+               output: 'test_arm_api_data.conf')
+
+# FIXME: We need to convert the convoluted awk script from Makefile.am here
+#configure_file(copy: true,
+#               input: 'test_gnunet_arm.py.in',
+#               output: 'test_gnunet_arm.py')
+
+test('test_arm_api', testarmapi, workdir: meson.current_build_dir(),
+     suite: 'arm')
+test('test_exponential_backoff', testexpbo, workdir: meson.current_build_dir(),
+  depends: mockservice,
+  timeout: 60, suite: 'arm')
+test('test_gnunet_service_arm', testgnunetservice, workdir: meson.current_build_dir(),
+     suite: 'arm')
diff --git a/src/service/arm/mockup-service.c b/src/service/arm/mockup-service.c
new file mode 100644
index 000000000..3d3f79d35
--- /dev/null
+++ b/src/service/arm/mockup-service.c
@@ -0,0 +1,123 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2007, 2008, 2009, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+#include "platform.h"
+#include <stdlib.h>
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+
+
+static int special_ret = 0;
+
+/**
+ * Handler for STOP message.
+ *
+ * @param cls client identification of the client
+ * @param message the actual message
+ */
+static void
+handle_stop (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  (void) message;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("Initiating shutdown as requested by client.\n"));
+  GNUNET_SERVICE_client_persist (client);
+  GNUNET_SCHEDULER_shutdown ();
+  /* ARM won't exponentially increase restart delay if we
+   * terminate normally. This changes the return code.
+   */
+  special_ret = 1;
+}
+
+
+/**
+ * Callback called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return @a c
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *c,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  (void) cls;
+  (void) mq;
+  return c;
+}
+
+
+/**
+ * Callback called when a client disconnected from the service
+ *
+ * @param cls closure for the service
+ * @param c the client that disconnected
+ * @param internal_cls should be equal to @a c
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *c,
+                      void *internal_cls)
+{
+  (void) cls;
+  GNUNET_assert (c == internal_cls);
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  (void) cls;
+  (void) cfg;
+  (void) service;
+  /* nothing to do */
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN ("do-nothing",
+                     GNUNET_SERVICE_OPTION_NONE,
+                     &run,
+                     &client_connect_cb,
+                     &client_disconnect_cb,
+                     NULL,
+                     GNUNET_MQ_hd_fixed_size (stop,
+                                              GNUNET_MESSAGE_TYPE_ARM_STOP,
+                                              struct GNUNET_MessageHeader,
+                                              NULL),
+                     GNUNET_MQ_handler_end ());
+
+
+/**
+ * MINIMIZE heap size (way below 128k) since this process doesn't need much.
+ */
+void __attribute__ ((destructor))
+GNUNET_mockup_done ()
+{
+  _exit (special_ret);
+}
diff --git a/src/service/arm/mockup_service b/src/service/arm/mockup_service
new file mode 100755
index 000000000..32f4ccc14
--- /dev/null
+++ b/src/service/arm/mockup_service
@@ -0,0 +1,130 @@
+#! /bin/sh
+
+# mockup_service - temporary wrapper script for .libs/mockup_service
+# Generated by ltmain.sh (GNU libtool) 2.2.6
+#
+# The mockup_service program cannot be directly executed until all the libtool
+# libraries that it depends on are installed.
+#
+# This wrapper script should never be moved out of the build directory.
+# If it is, it will not operate correctly.
+
+# Sed substitution that helps us do robust quoting.  It backslashifies
+# metacharacters that are still active within double-quoted strings.
+Xsed='/usr/bin/sed -e 1s/^X//'
+sed_quote_subst='s/\([`"$\\]\)/\\\1/g'
+
+# Be Bourne compatible
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
+  emulate sh
+  NULLCMD=:
+  # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
+  # is contrary to our usage.  Disable this feature.
+  alias -g '${1+"$@"}'='"$@"'
+  setopt NO_GLOB_SUBST
+else
+  case `(set -o) 2>/dev/null` in *posix*) set -o posix;; esac
+fi
+BIN_SH=xpg4; export BIN_SH # for Tru64
+DUALCASE=1; export DUALCASE # for MKS sh
+
+# The HP-UX ksh and POSIX shell print the target directory to stdout
+# if CDPATH is set.
+(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+
+relink_command=""
+
+# This environment variable determines our operation mode.
+if test "$libtool_install_magic" = "%%%MAGIC variable%%%"; then
+  # install mode needs the following variables:
+  generated_by_libtool_version='2.2.6'
+  notinst_deplibs=' ../../src/util/libgnunetutil.la'
+else
+  # When we are sourced in execute mode, $file and $ECHO are already set.
+  if test "$libtool_execute_magic" != "%%%MAGIC variable%%%"; then
+    ECHO="echo"
+    file="$0"
+    # Make sure echo works.
+    if test "X$1" = X--no-reexec; then
+      # Discard the --no-reexec flag, and continue.
+      shift
+    elif test "X`{ $ECHO '\t'; } 2>/dev/null`" = 'X\t'; then
+      # Yippee, $ECHO works!
+      :
+    else
+      # Restart under the correct shell, and then maybe $ECHO will work.
+      exec /bin/sh "$0" --no-reexec ${1+"$@"}
+    fi
+  fi
+
+  # Find the directory that this script lives in.
+  thisdir=`$ECHO "X$file" | $Xsed -e 's%/[^/]*$%%'`
+  test "x$thisdir" = "x$file" && thisdir=.
+
+  # Follow symbolic links until we get to the real thisdir.
+  file=`ls -ld "$file" | /usr/bin/sed -n 's/.*-> //p'`
+  while test -n "$file"; do
+    destdir=`$ECHO "X$file" | $Xsed -e 's%/[^/]*$%%'`
+
+    # If there was a directory component, then change thisdir.
+    if test "x$destdir" != "x$file"; then
+      case "$destdir" in
+      [\\/]* | [A-Za-z]:[\\/]*) thisdir="$destdir" ;;
+      *) thisdir="$thisdir/$destdir" ;;
+      esac
+    fi
+
+    file=`$ECHO "X$file" | $Xsed -e 's%^.*/%%'`
+    file=`ls -ld "$thisdir/$file" | /usr/bin/sed -n 's/.*-> //p'`
+  done
+
+
+  # Usually 'no', except on cygwin/mingw when embedded into
+  # the cwrapper.
+  WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=no
+  if test "$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR" = "yes"; then
+    # special case for '.'
+    if test "$thisdir" = "."; then
+      thisdir=`pwd`
+    fi
+    # remove .libs from thisdir
+    case "$thisdir" in
+    *[\\/].libs ) thisdir=`$ECHO "X$thisdir" | $Xsed -e 's%[\\/][^\\/]*$%%'` ;;
+    .libs )   thisdir=. ;;
+    esac
+  fi
+
+  # Try to get the absolute directory name.
+  absdir=`cd "$thisdir" && pwd`
+  test -n "$absdir" && thisdir="$absdir"
+
+  program='mockup_service'
+  progdir="$thisdir/.libs"
+
+
+  if test -f "$progdir/$program"; then
+    # Add our own library path to DYLD_LIBRARY_PATH
+    DYLD_LIBRARY_PATH="/Users/soufi/Career/Munich/TUM/MasterOfScience/Research/GNUnet/EclipseWorkspaceGNUnet/gnunet/src/util/.libs:$DYLD_LIBRARY_PATH"
+
+    # Some systems cannot cope with colon-terminated DYLD_LIBRARY_PATH
+    # The second colon is a workaround for a bug in BeOS R4 sed
+    DYLD_LIBRARY_PATH=`$ECHO "X$DYLD_LIBRARY_PATH" | $Xsed -e 's/::*$//'`
+
+    export DYLD_LIBRARY_PATH
+
+    if test "$libtool_execute_magic" != "%%%MAGIC variable%%%"; then
+      # Run the actual program with our arguments.
+
+      exec "$progdir/$program" ${1+"$@"}
+
+      $ECHO "$0: cannot exec $program $*" 1>&2
+      exit 1
+    fi
+  else
+    # The program doesn't exist.
+    $ECHO "$0: error: \`$progdir/$program' does not exist" 1>&2
+    $ECHO "This script is just a wrapper for $program." 1>&2
+    echo "See the libtool documentation for more information." 1>&2
+    exit 1
+  fi
+fi
diff --git a/src/service/arm/test_arm_api.c b/src/service/arm/test_arm_api.c
new file mode 100644
index 000000000..56a0abbd2
--- /dev/null
+++ b/src/service/arm/test_arm_api.c
@@ -0,0 +1,258 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2011, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file arm/test_arm_api.c
+ * @brief testcase for arm_api.c
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_resolver_service.h"
+
+#define LOG(...) GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, __VA_ARGS__)
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 15)
+
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+static struct GNUNET_ARM_Handle *arm;
+
+static struct GNUNET_ARM_Operation *op;
+
+static int ok = 1;
+
+static int phase = 0;
+
+
+static void
+arm_stop_cb (void *cls,
+             enum GNUNET_ARM_RequestStatus status,
+             enum GNUNET_ARM_Result result)
+{
+  op = NULL;
+  /* (6), a stop request should be sent to ARM successfully */
+  /* ARM should report that it is stopping */
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STOPPED);
+  GNUNET_break (phase == 6);
+  phase++;
+  LOG ("Sent 'STOP' request for arm to ARM %s\n",
+       (status == GNUNET_ARM_REQUEST_SENT_OK) ? "successfully" :
+       "unsuccessfully");
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+resolver_stop_cb (void *cls,
+                  enum GNUNET_ARM_RequestStatus status,
+                  enum GNUNET_ARM_Result result)
+{
+  op = NULL;
+  /* (5), a stop request should be sent to ARM successfully.
+   * ARM should report that resolver is stopped.
+   */
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STOPPED);
+  GNUNET_break (phase == 5);
+  LOG ("Sent 'STOP' request for resolver to ARM %s\n",
+       (status == GNUNET_ARM_REQUEST_SENT_OK) ? "successfully" :
+       "unsuccessfully");
+  phase++;
+  GNUNET_assert (NULL == op);
+  op = GNUNET_ARM_request_service_stop (arm,
+                                        "arm",
+                                        &arm_stop_cb,
+                                        NULL);
+}
+
+
+static void
+dns_notify (void *cls,
+            const struct sockaddr *addr,
+            socklen_t addrlen)
+{
+  if (addr == NULL)
+  {
+    /* (4), resolver should finish resolving localhost */
+    GNUNET_break (phase == 4);
+    phase++;
+    LOG ("Finished resolving localhost\n");
+    if (ok != 0)
+      ok = 2;
+    GNUNET_assert (NULL == op);
+    op = GNUNET_ARM_request_service_stop (arm,
+                                          "resolver",
+                                          &resolver_stop_cb,
+                                          NULL);
+    return;
+  }
+  /* (3), resolver should resolve localhost */
+  GNUNET_break (phase == 3);
+  LOG ("Resolved localhost\n");
+  phase++;
+  GNUNET_break (addr != NULL);
+  ok = 0;
+}
+
+
+static void
+resolver_start_cb (void *cls,
+                   enum GNUNET_ARM_RequestStatus status,
+                   enum GNUNET_ARM_Result result)
+{
+  op = NULL;
+  /* (2), the start request for resolver should be sent successfully
+   * ARM should report that resolver service is starting.
+   */
+  GNUNET_assert (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (phase == 2);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STARTING);
+  LOG ("Sent 'START' request for resolver to ARM %s\n",
+       (status == GNUNET_ARM_REQUEST_SENT_OK) ? "successfully" :
+       "unsuccessfully");
+  phase++;
+  GNUNET_RESOLVER_ip_get ("localhost",
+                          AF_INET,
+                          TIMEOUT,
+                          &dns_notify, NULL);
+}
+
+
+static void
+arm_conn (void *cls,
+          int connected)
+{
+  if (GNUNET_SYSERR == connected)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Fatal error initializing ARM API.\n"));
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_assert (0);
+    return;
+  }
+  if (GNUNET_YES == connected)
+  {
+    /* (1), arm connection should be established */
+    LOG ("Connected to ARM\n");
+    GNUNET_break (phase == 1);
+    phase++;
+    GNUNET_assert (NULL == op);
+    op = GNUNET_ARM_request_service_start (arm,
+                                           "resolver",
+                                           GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                           &resolver_start_cb,
+                                           NULL);
+  }
+  else
+  {
+    /* (7), ARM should stop (we disconnect from it) */
+    LOG ("Disconnected from ARM\n");
+    GNUNET_break (phase == 7);
+    if (phase != 7)
+      ok = 3;
+    else if (ok == 1)
+      ok = 0;
+  }
+}
+
+
+static void
+arm_start_cb (void *cls,
+              enum GNUNET_ARM_RequestStatus status,
+              enum GNUNET_ARM_Result result)
+{
+  op = NULL;
+  /* (0) The request should be "sent" successfully
+   * ("sent", because it isn't going anywhere, ARM API starts ARM service
+   * by itself).
+   * ARM API should report that ARM service is starting.
+   */GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (phase == 0);
+  LOG ("Sent 'START' request for arm to ARM %s\n",
+       (status == GNUNET_ARM_REQUEST_SENT_OK) ? "successfully" :
+       "unsuccessfully");
+  GNUNET_break (result == GNUNET_ARM_RESULT_STARTING);
+  phase++;
+}
+
+
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != op)
+  {
+    GNUNET_ARM_operation_cancel (op);
+    op = NULL;
+  }
+  if (NULL != arm)
+  {
+    GNUNET_ARM_disconnect (arm);
+    arm = NULL;
+  }
+}
+
+
+static void
+task (void *cls,
+      char *const *args,
+      const char *cfgfile,
+      const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  cfg = c;
+  arm = GNUNET_ARM_connect (cfg,
+                            &arm_conn,
+                            NULL);
+  if (NULL == arm)
+    return;
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  op = GNUNET_ARM_request_service_start (arm,
+                                         "arm",
+                                         GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                         &arm_start_cb,
+                                         NULL);
+}
+
+
+int
+main (int argc, char *argvx[])
+{
+  char *const argv[] = {
+    "test-arm-api",
+    "-c", "test_arm_api_data.conf",
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_log_setup ("test-arm-api",
+                    "WARNING",
+                    NULL);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                                     argv, "test-arm-api", "nohelp", options,
+                                     &task, NULL));
+  return ok;
+}
+
+
+/* end of test_arm_api.c */
diff --git a/src/service/arm/test_arm_api_data.conf b/src/service/arm/test_arm_api_data.conf
new file mode 100644
index 000000000..fef6cfb40
--- /dev/null
+++ b/src/service/arm/test_arm_api_data.conf
@@ -0,0 +1,38 @@
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
+
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-arm/
+
+[arm]
+BINARY = gnunet-service-arm
+OPTIONS = -L ERROR
+#PREFIX = valgrind --tool=memcheck --leak-check=yes
+
+[resolver]
+START_ON_DEMAND = YES
+PORT = 23355
+# PREFIX = valgrind
+
+[do-nothing]
+START_ON_DEMAND = NO
+PORT = 48223
+HOSTNAME = localhost
+BINARY = /will/be/overwritten/by/test_exponential_backoff
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+
+[statistics]
+START_ON_DEMAND = YES
+
+[core]
+START_ON_DEMAND = NO
+
+[transport]
+START_ON_DEMAND = NO
+
+[ats]
+START_ON_DEMAND = NO
+
+[peerinfo]
+START_ON_DEMAND = NO
diff --git a/src/service/arm/test_exponential_backoff.c b/src/service/arm/test_exponential_backoff.c
new file mode 100644
index 000000000..e3eed8568
--- /dev/null
+++ b/src/service/arm/test_exponential_backoff.c
@@ -0,0 +1,416 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file arm/test_exponential_backoff.c
+ * @brief testcase for gnunet-service-arm.c
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+
+#define LOG(...) GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, __VA_ARGS__)
+
+#define LOG_BACKOFF GNUNET_NO
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
+
+#define SERVICE_TEST_TIMEOUT GNUNET_TIME_UNIT_FOREVER_REL
+
+#define FIVE_MILLISECONDS GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MILLISECONDS, 5)
+
+#define SERVICE "do-nothing"
+
+#define BINARY "mockup-service"
+
+#define CFGFILENAME "test_arm_api_data2.conf"
+
+
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+static struct GNUNET_ARM_Handle *arm;
+
+static struct GNUNET_ARM_MonitorHandle *mon;
+
+static struct GNUNET_SCHEDULER_Task *kt;
+
+static int ok = 1;
+
+static int phase = 0;
+
+static int trialCount;
+
+static struct GNUNET_TIME_Absolute startedWaitingAt;
+
+struct GNUNET_TIME_Relative waitedFor;
+
+struct GNUNET_TIME_Relative waitedFor_prev;
+
+#if LOG_BACKOFF
+static FILE *killLogFilePtr;
+
+static char *killLogFileName;
+#endif
+
+
+/**
+ * Context for handling the shutdown of a service.
+ */
+struct ShutdownContext
+{
+  /**
+   * Connection to the service that is being shutdown.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Task set up to cancel the shutdown request on timeout.
+   */
+  struct GNUNET_SCHEDULER_Task *cancel_task;
+};
+
+
+static void
+kill_task (void *cbData);
+
+
+/**
+ * Shutting down took too long, cancel receive and return error.
+ *
+ * @param cls closure
+ */
+static void
+service_shutdown_timeout (void *cls)
+{
+  GNUNET_assert (0);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct ShutdownContext *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  struct ShutdownContext *shutdown_ctx = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Service shutdown complete (MQ error).\n");
+  GNUNET_SCHEDULER_cancel (shutdown_ctx->cancel_task);
+  GNUNET_MQ_destroy (shutdown_ctx->mq);
+  GNUNET_free (shutdown_ctx);
+}
+
+
+static void
+kill_task (void *cbData)
+{
+  struct ShutdownContext *shutdown_ctx
+    = GNUNET_new (struct ShutdownContext);
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_handler_end ()
+  };
+
+  kt = NULL;
+  if (trialCount == 13)
+  {
+    LOG ("Saw enough kills, asking ARM to stop mock service for good\n");
+    GNUNET_ARM_request_service_stop (arm,
+                                     SERVICE,
+                                     NULL,
+                                     NULL);
+    ok = 0;
+    trialCount++;
+    GNUNET_free (shutdown_ctx);
+    return;
+  }
+  shutdown_ctx->mq = GNUNET_CLIENT_connect (cfg,
+                                            SERVICE,
+                                            handlers,
+                                            &mq_error_handler,
+                                            shutdown_ctx);
+  GNUNET_assert (NULL != shutdown_ctx->mq);
+  trialCount++;
+  LOG ("Sending a shutdown request to the mock service\n");
+  env = GNUNET_MQ_msg (msg,
+                       GNUNET_MESSAGE_TYPE_ARM_STOP); /* FIXME: abuse of message type */
+  GNUNET_MQ_send (shutdown_ctx->mq,
+                  env);
+  shutdown_ctx->cancel_task
+    = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                    &service_shutdown_timeout,
+                                    shutdown_ctx);
+}
+
+
+static void
+trigger_disconnect (void *cls)
+{
+  GNUNET_ARM_disconnect (arm);
+  GNUNET_ARM_monitor_stop (mon);
+  if (NULL != kt)
+  {
+    GNUNET_SCHEDULER_cancel (kt);
+    kt = NULL;
+  }
+}
+
+
+static void
+arm_stop_cb (void *cls,
+             enum GNUNET_ARM_RequestStatus status,
+             enum GNUNET_ARM_Result result)
+{
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STOPPED);
+  LOG ("ARM service stopped\n");
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+srv_status (void *cls,
+            const char *service,
+            enum GNUNET_ARM_ServiceMonitorStatus status)
+{
+  if (status == GNUNET_ARM_SERVICE_MONITORING_STARTED)
+  {
+    LOG ("ARM monitor started, starting mock service\n");
+    phase++;
+    GNUNET_ARM_request_service_start (arm,
+                                      SERVICE,
+                                      GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                      NULL,
+                                      NULL);
+    return;
+  }
+  if (0 != strcasecmp (service, SERVICE))
+    return; /* not what we care about */
+  if (phase == 1)
+  {
+    GNUNET_break (status == GNUNET_ARM_SERVICE_STARTING);
+    GNUNET_break (phase == 1);
+    LOG ("do-nothing is starting\n");
+    phase++;
+    ok = 1;
+    GNUNET_assert (NULL == kt);
+    startedWaitingAt = GNUNET_TIME_absolute_get ();
+    kt = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                       &kill_task,
+                                       NULL);
+  }
+  else if (phase == 2)
+  {
+    /* We passively monitor ARM for status updates. ARM should tell us
+     * when do-nothing dies (no need to run a service upness test ourselves).
+     */
+    if (status == GNUNET_ARM_SERVICE_STARTING)
+    {
+      waitedFor = GNUNET_TIME_absolute_get_duration (startedWaitingAt);
+      LOG ("Waited for: %s\n",
+           GNUNET_STRINGS_relative_time_to_string (waitedFor,
+                                                   GNUNET_YES));
+
+      LOG ("do-nothing is starting, killing it...\n");
+      GNUNET_assert (NULL == kt);
+      kt = GNUNET_SCHEDULER_add_now (&kill_task, &ok);
+    }
+    else if ((status == GNUNET_ARM_SERVICE_STOPPED) && (trialCount == 14))
+    {
+      phase++;
+      LOG ("do-nothing stopped working %u times, we are done here\n",
+           (unsigned int) trialCount);
+      GNUNET_ARM_request_service_stop (arm,
+                                       "arm",
+                                       &arm_stop_cb,
+                                       NULL);
+    }
+  }
+}
+
+
+static void
+arm_start_cb (void *cls,
+              enum GNUNET_ARM_RequestStatus status,
+              enum GNUNET_ARM_Result result)
+{
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STARTING);
+  GNUNET_break (phase == 0);
+  LOG ("Sent 'START' request for arm to ARM %s\n",
+       (status == GNUNET_ARM_REQUEST_SENT_OK) ? "successfully" :
+       "unsuccessfully");
+}
+
+
+static void
+task (void *cls,
+      char *const *args,
+      const char *cfgfile,
+      const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  cfg = c;
+  arm = GNUNET_ARM_connect (cfg, NULL, NULL);
+  if (NULL == arm)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  mon = GNUNET_ARM_monitor_start (cfg,
+                                  &srv_status,
+                                  NULL);
+  if (NULL == mon)
+  {
+    GNUNET_break (0);
+    GNUNET_ARM_disconnect (arm);
+    arm = NULL;
+    return;
+  }
+  GNUNET_ARM_request_service_start (arm,
+                                    "arm",
+                                    GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                    &arm_start_cb,
+                                    NULL);
+  GNUNET_SCHEDULER_add_shutdown (&trigger_disconnect,
+                                 NULL);
+}
+
+
+static int
+check ()
+{
+  char *const argv[] = {
+    "test-exponential-backoff",
+    "-c", CFGFILENAME,
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  /* Running ARM  and running the do_nothing task */
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                                     argv,
+                                     "test-exponential-backoff",
+                                     "nohelp",
+                                     options,
+                                     &task,
+                                     NULL));
+  return ok;
+}
+
+
+#ifndef PATH_MAX
+/**
+ * Assumed maximum path length (for the log file name).
+ */
+#define PATH_MAX 4096
+#endif
+
+
+static int
+init ()
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  char pwd[PATH_MAX];
+  char *binary;
+
+  cfg = GNUNET_CONFIGURATION_create ();
+  if (GNUNET_OK != GNUNET_CONFIGURATION_parse (cfg,
+                                               "test_arm_api_data.conf"))
+  {
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return GNUNET_SYSERR;
+  }
+  if (NULL == getcwd (pwd, PATH_MAX))
+    return GNUNET_SYSERR;
+  GNUNET_assert (0 < GNUNET_asprintf (&binary,
+                                      "%s/%s",
+                                      pwd,
+                                      BINARY));
+  GNUNET_CONFIGURATION_set_value_string (cfg,
+                                         SERVICE,
+                                         "BINARY",
+                                         binary);
+  GNUNET_free (binary);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_write (cfg,
+                                               CFGFILENAME))
+  {
+    GNUNET_CONFIGURATION_destroy (cfg);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONFIGURATION_destroy (cfg);
+
+#if LOG_BACKOFF
+  killLogFileName = GNUNET_DISK_mktemp ("exponential-backoff-waiting.log");
+  if (NULL == (killLogFilePtr = fopen (killLogFileName,
+                                       "w")))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "fopen",
+                              killLogFileName);
+    GNUNET_free (killLogFileName);
+    return GNUNET_SYSERR;
+  }
+#endif
+  return GNUNET_OK;
+}
+
+
+static void
+houseKeep ()
+{
+#if LOG_BACKOFF
+  GNUNET_assert (0 == fclose (killLogFilePtr));
+  GNUNET_free (killLogFileName);
+#endif
+  (void) unlink (CFGFILENAME);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int ret;
+
+  GNUNET_log_setup ("test-exponential-backoff",
+                    "WARNING",
+                    NULL);
+
+  if (GNUNET_OK != init ())
+    return 1;
+  ret = check ();
+  houseKeep ();
+  return ret;
+}
+
+
+/* end of test_exponential_backoff.c */
diff --git a/src/service/arm/test_gnunet_arm.py.in b/src/service/arm/test_gnunet_arm.py.in
new file mode 100644
index 000000000..2b30b6b97
--- /dev/null
+++ b/src/service/arm/test_gnunet_arm.py.in
@@ -0,0 +1,129 @@
+#!@PYTHONEXE@
+
+import os
+import sys
+import shutil
+import re
+import subprocess
+import time
+
+# FIXME: There's too much repetition, move generally used parts into reusable modules.
+if os.name == "nt":
+    tmp = os.getenv("TEMP")
+else:
+    tmp = "/tmp"
+
+if os.name == 'nt':
+    st = 'gnunet-statistics.exe'
+    arm = './gnunet-arm.exe'
+else:
+    st = 'gnunet-statistics'
+    arm = './gnunet-arm'
+
+run_arm = [arm, '-c', 'test_arm_api_data.conf', '--no-stdout', '--no-stderr']
+debug = os.getenv('DEBUG')
+if debug:
+    run_arm += [debug.split(' ')]
+
+
+def cleanup():
+    shutil.rmtree(os.path.join(tmp, "test-gnunetd-arm"), True)
+
+
+def sub_run(args, want_stdo=True, want_stde=False, nofail=False):
+    if want_stdo:
+        stdo = subprocess.PIPE
+    else:
+        stdo = None
+    if want_stde:
+        stde = subprocess.PIPE
+    else:
+        stde = None
+    p = subprocess.Popen(args, stdout=stdo, stderr=stde)
+    stdo, stde = p.communicate()
+    if not nofail:
+        if p.returncode != 0:
+            sys.exit(p.returncode)
+    return (p.returncode, stdo, stde)
+
+
+def fail(result):
+    print(result)
+    r_arm(['-e'], want_stdo=False)
+    sys.exit(1)
+
+
+def end_arm_failure(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            fail(
+                "FAIL: error running {}\nCommand output was:\n{}\n{}".format(
+                    command, stdo, stde
+                )
+            )
+    else:
+        if rc == 0:
+            fail(
+                "FAIL: expected error while running {}\nCommand output was:\n{}\n{}"
+                .format(command, stdo, stde)
+            )
+
+
+def print_only_failure(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            print(
+                "FAIL: error running {}\nCommand output was:\n{}\n{}".format(
+                    command, stdo, stde
+                )
+            )
+            sys.exit(1)
+    else:
+        if rc == 0:
+            print(
+                "FAIL: expected error while running {}\nCommand output was:\n{}\n{}"
+                .format(command, stdo, stde)
+            )
+            sys.exit(1)
+
+
+def r_something(to_run, extra_args, failure=None, normal=True, **kw):
+    rc, stdo, stde = sub_run(
+        to_run + extra_args, nofail=True, want_stde=True, **kw
+    )
+    if failure is not None:
+        failure(to_run + extra_args, rc, stdo, stde, normal)
+    return (rc, stdo, stde)
+
+
+def r_arm(extra_args, **kw):
+    return r_something(run_arm, extra_args, **kw)
+
+
+cleanup()
+
+print("TEST: Bad argument checking...", end='')
+r_arm(['-x'], normal=False, failure=print_only_failure)
+print("PASS")
+
+print("TEST: Start ARM...", end='')
+r_arm(['-s'], failure=print_only_failure)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Start another service...", end='')
+r_arm(['-i', 'resolver'], failure=end_arm_failure)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Stop a service...", end='')
+r_arm(['-k', 'resolver'], failure=end_arm_failure)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Stop ARM...", end='')
+r_arm(['-e'], failure=print_only_failure)
+time.sleep(1)
+print("PASS")
+
+cleanup()
diff --git a/src/service/arm/test_gnunet_service_arm.c b/src/service/arm/test_gnunet_service_arm.c
new file mode 100644
index 000000000..df4ad95c2
--- /dev/null
+++ b/src/service/arm/test_gnunet_service_arm.c
@@ -0,0 +1,266 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file arm/test_gnunet_service_arm.c
+ * @brief testcase for gnunet-service-arm.c; tests ARM by making it start the resolver
+ * @author Safey
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_resolver_service.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Timeout for starting services, very short because of the strange way start works
+ * (by checking if running before starting, so really this time is always waited on
+ * startup (annoying)).
+ */
+#define START_TIMEOUT GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MILLISECONDS, 50)
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
+
+
+static int ret = 1;
+
+static int resolved_ok;
+
+static int asked_for_a_list;
+
+static struct GNUNET_ARM_Handle *arm;
+
+static const char hostname[] = "www.gnu.org"; /* any domain should do */
+
+
+static void
+trigger_disconnect (void *cls)
+{
+  GNUNET_ARM_disconnect (arm);
+  arm = NULL;
+}
+
+
+static void
+arm_stop_cb (void *cls,
+             enum GNUNET_ARM_RequestStatus status,
+             enum GNUNET_ARM_Result result)
+{
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STOPPED);
+  if (result != GNUNET_ARM_RESULT_STOPPED)
+  {
+    GNUNET_break (0);
+    ret = 4;
+  }
+  GNUNET_SCHEDULER_add_now (&trigger_disconnect, NULL);
+}
+
+
+static void
+service_list (void *cls,
+              enum GNUNET_ARM_RequestStatus rs,
+              unsigned int count,
+              const struct GNUNET_ARM_ServiceInfo *list)
+{
+  unsigned int i;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "%u services are are currently running\n",
+              count);
+  if (GNUNET_ARM_REQUEST_SENT_OK != rs)
+    goto stop_arm;
+  for (i = 0; i < count; i++)
+  {
+    if ((0 == strcasecmp (list[i].name, "resolver")) &&
+        (0 == strcasecmp (list[i].binary, "gnunet-service-resolver")))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Got service list, now stopping arm\n");
+      ret = 0;
+    }
+  }
+
+stop_arm:
+  GNUNET_ARM_request_service_stop (arm,
+                                   "arm",
+                                   &arm_stop_cb,
+                                   NULL);
+}
+
+
+static void
+hostname_resolve_cb (void *cls,
+                     const struct sockaddr *addr,
+                     socklen_t addrlen)
+{
+  if ((0 == ret) || (4 == ret) || (1 == resolved_ok))
+    return;
+  if (NULL == addr)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to resolve hostname!\n");
+    GNUNET_break (0);
+    ret = 3;
+    GNUNET_ARM_request_service_stop (arm,
+                                     "arm",
+                                     &arm_stop_cb,
+                                     NULL);
+    return;
+  }
+  if (0 == asked_for_a_list)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Resolved hostname, now checking the service list\n");
+    GNUNET_ARM_request_service_list (arm,
+                                     &service_list,
+                                     NULL);
+    asked_for_a_list = 1;
+    resolved_ok = 1;
+  }
+}
+
+
+static void
+arm_start_cb (void *cls,
+              enum GNUNET_ARM_RequestStatus status,
+              enum GNUNET_ARM_Result result)
+{
+  GNUNET_break (status == GNUNET_ARM_REQUEST_SENT_OK);
+  GNUNET_break (result == GNUNET_ARM_RESULT_STARTING);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Trying to resolve a hostname via the resolver service!\n");
+  /* connect to the resolver service */
+  if (NULL ==
+      GNUNET_RESOLVER_ip_get (hostname,
+                              AF_UNSPEC,
+                              TIMEOUT,
+                              &hostname_resolve_cb,
+                              NULL))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable initiate connection to resolver service\n");
+    GNUNET_break (0);
+    ret = 2;
+    GNUNET_ARM_request_service_stop (arm,
+                                     "arm",
+                                     &arm_stop_cb,
+                                     NULL);
+  }
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  arm = GNUNET_ARM_connect (c,
+                            NULL,
+                            NULL);
+  GNUNET_ARM_request_service_start (arm,
+                                    "arm",
+                                    GNUNET_OS_INHERIT_STD_OUT_AND_ERR,
+                                    &arm_start_cb,
+                                    NULL);
+}
+
+
+int
+main (int argc, char *av[])
+{
+  static char *const argv[] = {
+    "test-gnunet-service-arm",
+    "-c",
+    "test_arm_api_data.conf",
+    NULL
+  };
+  static struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  /* trigger DNS lookup */
+#if HAVE_GETADDRINFO
+  {
+    struct addrinfo *ai;
+    int ret;
+
+    if (0 != (ret = getaddrinfo (hostname, NULL, NULL, &ai)))
+    {
+      fprintf (stderr,
+               "Failed to resolve `%s', testcase not run.\n",
+               hostname);
+      return 77;
+    }
+    freeaddrinfo (ai);
+  }
+#elif HAVE_GETHOSTBYNAME2
+  {
+    struct hostent *host;
+
+    host = gethostbyname2 (hostname, AF_INET);
+    if (NULL == host)
+      host = gethostbyname2 (hostname, AF_INET6);
+    if (NULL == host)
+    {
+      fprintf (stderr,
+               "Failed to resolve `%s', testcase not run.\n",
+               hostname);
+      return 77;
+    }
+  }
+#elif HAVE_GETHOSTBYNAME
+  {
+    struct hostent *host;
+
+    host = gethostbyname (hostname);
+    if (NULL == host)
+    {
+      fprintf (stderr,
+               "Failed to resolve `%s', testcase not run.\n",
+               hostname);
+      return 77;
+    }
+  }
+#else
+  fprintf (stderr,
+           "libc fails to have resolver function, testcase not run.\n");
+  return 77;
+#endif
+  GNUNET_log_setup ("test-gnunet-service-arm",
+                    "WARNING",
+                    NULL);
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                                    argv, "test-gnunet-service-arm",
+                                    "nohelp", options,
+                                    &run, NULL));
+  if (0 != ret)
+  {
+    fprintf (stderr,
+             "Test failed with error code %d\n",
+             ret);
+  }
+  return ret;
+}
+
+
+/* end of test_gnunet_service_arm.c */
diff --git a/src/service/core/.gitignore b/src/service/core/.gitignore
new file mode 100644
index 000000000..e985f5ff4
--- /dev/null
+++ b/src/service/core/.gitignore
@@ -0,0 +1,9 @@
+gnunet-service-core
+core.conf
+test_core_api
+test_core_api_reliability
+test_core_api_send_to_self
+test_core_api_start_only
+test_core_quota_compliance_asymmetric_recv_limited
+test_core_quota_compliance_asymmetric_send_limited
+test_core_quota_compliance_symmetric
diff --git a/src/service/core/Makefile.am b/src/service/core/Makefile.am
new file mode 100644
index 000000000..9ce8cf8b5
--- /dev/null
+++ b/src/service/core/Makefile.am
@@ -0,0 +1,127 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+plugindir = $(libdir)/gnunet
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfg_DATA = \
+  core.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+plugin_LTLIBRARIES = \
+  libgnunet_test_core_plugin_cmd_just_run.la
+
+TESTING_LIBS = \
+  libgnunetcoretesting.la
+
+lib_LTLIBRARIES = \
+  libgnunetcore.la \
+  $(TESTING_LIBS)
+
+libgnunetcore_la_SOURCES = \
+  core_api.c core.h \
+  core_api_monitor_peers.c
+libgnunetcore_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL) $(XLIB)
+libgnunetcore_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)  \
+  -version-info 0:1:0
+
+libgnunet_test_core_plugin_cmd_just_run_la_SOURCES = \
+ test_core_plugin_cmd_just_run.c
+libgnunet_test_core_plugin_cmd_just_run_la_LIBADD = \
+  libgnunetcoretesting.la \
+  $(top_builddir)/src/transport/libgnunettransportapplication.la \
+  $(top_builddir)/src/transport/libgnunettransportcore.la \
+  $(top_builddir)/src/lib/testing/libgnunettesting.la \
+  $(top_builddir)/src/peerstore/libgnunetpeerstore.la \
+  $(top_builddir)/src/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/lib/hello/libgnunethello.la \
+  $(top_builddir)/src/service/arm/libgnunetarm.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_test_core_plugin_cmd_just_run_la_LDFLAGS = \
+  $(GN_PLUGIN_LDFLAGS)
+
+libgnunetcoretesting_la_SOURCES = \
+  core_api_cmd_connecting_peers.c 
+libgnunetcoretesting_la_LIBADD = \
+  $(top_builddir)/src/lib/testing/libgnunettesting.la \
+  $(top_builddir)/src/service/arm/libgnunetarm.la \
+  $(top_builddir)/src/transport/libgnunettransportapplication.la \
+  $(top_builddir)/src/transport/libgnunettransportcore.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+libgnunetcoretesting_la_LDFLAGS = \
+  $(GN_LIBINTL) \
+  $(GN_LIB_LDFLAGS) \
+  -version-info 0:0:0
+
+
+libexec_PROGRAMS = \
+ gnunet-service-core
+
+gnunet_service_core_SOURCES = \
+ gnunet-service-core.c gnunet-service-core.h \
+ gnunet-service-core_kx.c gnunet-service-core_kx.h \
+ gnunet-service-core_sessions.c gnunet-service-core_sessions.h \
+ gnunet-service-core_typemap.c gnunet-service-core_typemap.h
+gnunet_service_core_LDADD = \
+  $(top_builddir)/src/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/transport/libgnunettransportapplication.la \
+  $(top_builddir)/src/transport/libgnunettransportcore.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL) $(Z_LIBS)
+
+
+TESTING_TESTS = \
+  test_core_api_send_to_self
+
+check_PROGRAMS = \
+ test_core_api_start_only \
+ $(TESTING_TESTS)
+
+# Only test TNG if we run experimental
+check_SCRIPTS= \
+  test_core_start_testcase.sh
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS) \
+ $(check_SCRIPTS)
+endif
+
+test_core_api_send_to_self_SOURCES = \
+ test_core_api_send_to_self.c
+test_core_api_send_to_self_LDADD = \
+ libgnunetcore.la \
+ $(top_builddir)/src/lib/testing/libgnunettesting.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+test_core_api_start_only_SOURCES = \
+ test_core_api_start_only.c
+test_core_api_start_only_LDADD = \
+ $(top_builddir)/src/lib/testing/libgnunettesting.la \
+ libgnunetcore.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_core_start_testcase.sh \
+  test_core_defaults.conf \
+  test_core_api_data.conf \
+  test_core_api_peer1.conf \
+  test_core_api_peer2.conf \
+  test_core_api_send_to_self.conf \
+  test_core_quota_asymmetric_recv_limited_peer1.conf \
+  test_core_quota_asymmetric_recv_limited_peer2.conf \
+  test_core_quota_asymmetric_send_limit_peer1.conf \
+  test_core_quota_asymmetric_send_limit_peer2.conf \
+  test_core_quota_peer1.conf \
+  test_core_quota_peer2.conf
diff --git a/src/service/core/core.conf.in b/src/service/core/core.conf.in
new file mode 100644
index 000000000..00faf6079
--- /dev/null
+++ b/src/service/core/core.conf.in
@@ -0,0 +1,23 @@
+[core]
+START_ON_DEMAND = @START_ON_DEMAND@
+@JAVAPORT@PORT = 2092
+HOSTNAME = localhost
+BINARY = gnunet-service-core
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-core.sock
+UNIX_MATCH_UID = NO
+UNIX_MATCH_GID = YES
+# DISABLE_SOCKET_FORWARDING = NO
+# USERNAME =
+# MAXBUF =
+# TIMEOUT =
+# DISABLEV6 =
+# BINDTO =
+# REJECT_FROM =
+# REJECT_FROM6 =
+# PREFIX =
+
+# Note: this MUST be set to YES in production, only set to NO for testing
+# for performance (testbed/cluster-scale use!).
+USE_EPHEMERAL_KEYS = YES
diff --git a/src/service/core/core.h b/src/service/core/core.h
new file mode 100644
index 000000000..d4596f038
--- /dev/null
+++ b/src/service/core/core.h
@@ -0,0 +1,326 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/core.h
+ * @brief common internal definitions for core service
+ * @author Christian Grothoff
+ */
+#ifndef CORE_H
+#define CORE_H
+
+#include "gnunet_util_lib.h"
+#include "gnunet_time_lib.h"
+
+/**
+ * General core debugging.
+ */
+#define DEBUG_CORE GNUNET_EXTRA_LOGGING
+
+/**
+ * Definition of bits in the InitMessage's options field that specify
+ * which events this client cares about.  Note that inbound messages
+ * for handlers that were specifically registered are always
+ * transmitted to the client.
+ */
+#define GNUNET_CORE_OPTION_NOTHING 0
+
+/**
+ * Client cares about connectivity changes.
+ */
+#define GNUNET_CORE_OPTION_SEND_STATUS_CHANGE 4
+
+/**
+ * Client wants all inbound messages in full.
+ */
+#define GNUNET_CORE_OPTION_SEND_FULL_INBOUND 8
+
+/**
+ * Client just wants the 4-byte message headers of
+ * all inbound messages.
+ */
+#define GNUNET_CORE_OPTION_SEND_HDR_INBOUND 16
+
+/**
+ * Client wants all outbound messages in full.
+ */
+#define GNUNET_CORE_OPTION_SEND_FULL_OUTBOUND 32
+
+/**
+ * Client just wants the 4-byte message headers of
+ * all outbound messages.
+ */
+#define GNUNET_CORE_OPTION_SEND_HDR_OUTBOUND 64
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Message transmitted core clients to gnunet-service-core
+ * to start the interaction.  This header is followed by
+ * uint16_t type values specifying which messages this
+ * client is interested in.
+ */
+struct InitMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_INIT.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Options, see GNUNET_CORE_OPTION_ values.
+   */
+  uint32_t options GNUNET_PACKED;
+};
+
+
+/**
+ * Message transmitted by the gnunet-service-core process
+ * to its clients in response to an INIT message.
+ */
+struct InitReplyMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_INIT_REPLY
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * Public key of the local peer.
+   */
+  struct GNUNET_PeerIdentity my_identity;
+};
+
+
+/**
+ * Message sent by the service to clients to notify them
+ * about a peer connecting.
+ */
+struct ConnectNotifyMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_NOTIFY_CONNECT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * Identity of the connecting peer.
+   */
+  struct GNUNET_PeerIdentity peer;
+};
+
+
+/**
+ * Message sent by the service to clients to notify them
+ * about a peer disconnecting.
+ */
+struct DisconnectNotifyMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_NOTIFY_DISCONNECT.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * Identity of the connecting peer.
+   */
+  struct GNUNET_PeerIdentity peer;
+};
+
+
+/**
+ * Message sent by the service to clients to notify them about
+ * messages being received or transmitted.  This overall message is
+ * followed by the real message, or just the header of the real
+ * message (depending on the client's preferences).  The receiver can
+ * tell if it got the full message or only a partial message by
+ * looking at the size field in the header of NotifyTrafficMessage and
+ * checking it with the size field in the message that follows.
+ */
+struct NotifyTrafficMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_NOTIFY_INBOUND
+   * or #GNUNET_MESSAGE_TYPE_CORE_NOTIFY_OUTBOUND.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Identity of the receiver or sender.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /* Followed by payload (message or just header), variable size */
+};
+
+
+/**
+ * Client notifying core about the maximum-priority
+ * message it has in the queue for a particular target.
+ */
+struct SendMessageRequest
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * How important is this message?
+   */
+  uint32_t priority GNUNET_PACKED;
+
+  /**
+   * By what time would the sender really like to see this
+   * message transmitted?
+   */
+  struct GNUNET_TIME_AbsoluteNBO deadline;
+
+  /**
+   * Identity of the intended target.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * Always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * How large is the message?
+   */
+  uint16_t size GNUNET_PACKED;
+
+  /**
+   * Counter for this peer to match SMRs to replies.
+   */
+  uint16_t smr_id GNUNET_PACKED;
+};
+
+
+/**
+ * Core notifying client that it is allowed to now
+ * transmit a message to the given target
+ * (response to #GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST).
+ */
+struct SendMessageReady
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_SEND_READY
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * How many bytes are allowed for transmission?
+   * Guaranteed to be at least as big as the requested size,
+   * or ZERO if the request is rejected (will timeout,
+   * peer disconnected, queue full, etc.).
+   */
+  uint16_t size GNUNET_PACKED;
+
+  /**
+   * smr_id from the request.
+   */
+  uint16_t smr_id GNUNET_PACKED;
+
+  /**
+   * Identity of the intended target.
+   */
+  struct GNUNET_PeerIdentity peer;
+};
+
+
+/**
+ * Client asking core to transmit a particular message to a particular
+ * target (response to #GNUNET_MESSAGE_TYPE_CORE_SEND_READY).
+ */
+struct SendMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_SEND
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * How important is this message? Contains a
+   * `enum GNUNET_MQ_PriorityPreferences` in NBO.
+   */
+  uint32_t priority GNUNET_PACKED;
+
+  /**
+   * By what time would the sender really like to see this
+   * message transmitted?
+   */
+  struct GNUNET_TIME_AbsoluteNBO deadline;
+
+  /**
+   * Identity of the intended receiver.
+   */
+  struct GNUNET_PeerIdentity peer;
+};
+
+
+/**
+ * Message sent by the service to monitor clients to notify them
+ * about a peer changing status.
+ */
+struct MonitorNotifyMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * New peer state, an `enum GNUNET_CORE_KxState` in NBO.
+   */
+  uint32_t state GNUNET_PACKED;
+
+  /**
+   * Identity of the peer.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * How long will we stay in this state (if nothing else happens)?
+   */
+  struct GNUNET_TIME_AbsoluteNBO timeout;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+#endif
+/* end of core.h */
diff --git a/src/service/core/core_api.c b/src/service/core/core_api.c
new file mode 100644
index 000000000..2e0bb1785
--- /dev/null
+++ b/src/service/core/core_api.c
@@ -0,0 +1,772 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file core/core_api.c
+ * @brief core service; this is the main API for encrypted P2P
+ *        communications
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_core_service.h"
+#include "core.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "core-api", __VA_ARGS__)
+
+
+/**
+ * Information we track for each peer.
+ */
+struct PeerRecord
+{
+  /**
+   * Corresponding CORE handle.
+   */
+  struct GNUNET_CORE_Handle *h;
+
+  /**
+   * Message queue for the peer.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Message we are currently trying to pass to the CORE service
+   * for this peer (from @e mq).
+   */
+  struct GNUNET_MQ_Envelope *env;
+
+  /**
+   * Value the client returned when we connected, used
+   * as the closure in various places.
+   */
+  void *client_cls;
+
+  /**
+   * Peer the record is about.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * SendMessageRequest ID generator for this peer.
+   */
+  uint16_t smr_id_gen;
+};
+
+
+/**
+ * Context for the core service connection.
+ */
+struct GNUNET_CORE_Handle
+{
+  /**
+   * Configuration we're using.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Closure for the various callbacks.
+   */
+  void *cls;
+
+  /**
+   * Function to call once we've handshaked with the core service.
+   */
+  GNUNET_CORE_StartupCallback init;
+
+  /**
+   * Function to call whenever we're notified about a peer connecting.
+   */
+  GNUNET_CORE_ConnectEventHandler connects;
+
+  /**
+   * Function to call whenever we're notified about a peer disconnecting.
+   */
+  GNUNET_CORE_DisconnectEventHandler disconnects;
+
+  /**
+   * Function handlers for messages of particular type.
+   */
+  struct GNUNET_MQ_MessageHandler *handlers;
+
+  /**
+   * Our message queue for transmissions to the service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Hash map listing all of the peers that we are currently
+   * connected to.
+   */
+  struct GNUNET_CONTAINER_MultiPeerMap *peers;
+
+  /**
+   * Identity of this peer.
+   */
+  struct GNUNET_PeerIdentity me;
+
+  /**
+   * ID of reconnect task (if any).
+   */
+  struct GNUNET_SCHEDULER_Task *reconnect_task;
+
+  /**
+   * Current delay we use for re-trying to connect to core.
+   */
+  struct GNUNET_TIME_Relative retry_backoff;
+
+  /**
+   * Number of entries in the handlers array.
+   */
+  unsigned int hcnt;
+
+  /**
+   * Did we ever get INIT?
+   */
+  int have_init;
+};
+
+
+/**
+ * Our current client connection went down.  Clean it up
+ * and try to reconnect!
+ *
+ * @param h our handle to the core service
+ */
+static void
+reconnect (struct GNUNET_CORE_Handle *h);
+
+
+/**
+ * Task schedule to try to re-connect to core.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ */
+static void
+reconnect_task (void *cls)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+
+  h->reconnect_task = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Connecting to CORE service after delay\n");
+  reconnect (h);
+}
+
+
+/**
+ * Notify clients about disconnect and free the entry for connected
+ * peer.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle *`
+ * @param key the peer identity (not used)
+ * @param value the `struct PeerRecord` to free.
+ * @return #GNUNET_YES (continue)
+ */
+static int
+disconnect_and_free_peer_entry (void *cls,
+                                const struct GNUNET_PeerIdentity *key,
+                                void *value)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  struct PeerRecord *pr = value;
+
+  GNUNET_assert (pr->h == h);
+  if (NULL != h->disconnects)
+    h->disconnects (h->cls, &pr->peer, pr->client_cls);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multipeermap_remove (h->peers, key, pr));
+  GNUNET_MQ_destroy (pr->mq);
+  GNUNET_assert (NULL == pr->mq);
+  if (NULL != pr->env)
+  {
+    GNUNET_MQ_discard (pr->env);
+    pr->env = NULL;
+  }
+  GNUNET_free (pr);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Close down any existing connection to the CORE service and
+ * try re-establishing it later.
+ *
+ * @param h our handle
+ */
+static void
+reconnect_later (struct GNUNET_CORE_Handle *h)
+{
+  GNUNET_assert (NULL == h->reconnect_task);
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  GNUNET_assert (NULL == h->reconnect_task);
+  h->reconnect_task =
+    GNUNET_SCHEDULER_add_delayed (h->retry_backoff, &reconnect_task, h);
+  GNUNET_CONTAINER_multipeermap_iterate (h->peers,
+                                         &disconnect_and_free_peer_entry,
+                                         h);
+  h->retry_backoff = GNUNET_TIME_STD_BACKOFF (h->retry_backoff);
+}
+
+
+/**
+ * Error handler for the message queue to the CORE service.
+ * On errors, we reconnect.
+ *
+ * @param cls closure, a `struct GNUNET_CORE_Handle *`
+ * @param error error code
+ */
+static void
+handle_mq_error (void *cls, enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "MQ ERROR: %d\n", error);
+  reconnect_later (h);
+}
+
+
+/**
+ * Implement sending functionality of a message queue for
+ * us sending messages to a peer.
+ *
+ * @param mq the message queue
+ * @param msg the message to send
+ * @param impl_state state of the implementation
+ */
+static void
+core_mq_send_impl (struct GNUNET_MQ_Handle *mq,
+                   const struct GNUNET_MessageHeader *msg,
+                   void *impl_state)
+{
+  struct PeerRecord *pr = impl_state;
+  struct GNUNET_CORE_Handle *h = pr->h;
+  struct SendMessageRequest *smr;
+  struct SendMessage *sm;
+  struct GNUNET_MQ_Envelope *env;
+  uint16_t msize;
+  enum GNUNET_MQ_PriorityPreferences flags;
+
+  if (NULL == h->mq)
+  {
+    /* We're currently reconnecting, pretend this worked */
+    GNUNET_MQ_impl_send_continue (mq);
+    return;
+  }
+  GNUNET_assert (NULL == pr->env);
+  /* extract options from envelope */
+  env = GNUNET_MQ_get_current_envelope (mq);
+  flags = GNUNET_MQ_env_get_options (env);
+
+  /* check message size for sanity */
+  msize = ntohs (msg->size);
+  if (msize >= GNUNET_MAX_MESSAGE_SIZE - sizeof(struct SendMessage))
+  {
+    GNUNET_break (0);
+    GNUNET_MQ_impl_send_continue (mq);
+    return;
+  }
+
+  /* ask core for transmission */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Asking core for transmission of %u bytes to `%s'\n",
+       (unsigned int) msize,
+       GNUNET_i2s (&pr->peer));
+  env = GNUNET_MQ_msg (smr, GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST);
+  smr->priority = htonl ((uint32_t) flags);
+  smr->peer = pr->peer;
+  smr->size = htons (msize);
+  smr->smr_id = htons (++pr->smr_id_gen);
+  GNUNET_MQ_send (h->mq, env);
+
+  /* prepare message with actual transmission data */
+  pr->env = GNUNET_MQ_msg_nested_mh (sm, GNUNET_MESSAGE_TYPE_CORE_SEND, msg);
+  sm->priority = htonl ((uint32_t) flags);
+  sm->peer = pr->peer;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Calling get_message with buffer of %u bytes\n",
+       (unsigned int) msize);
+}
+
+
+/**
+ * Handle destruction of a message queue.  Implementations must not
+ * free @a mq, but should take care of @a impl_state.
+ *
+ * @param mq the message queue to destroy
+ * @param impl_state state of the implementation
+ */
+static void
+core_mq_destroy_impl (struct GNUNET_MQ_Handle *mq, void *impl_state)
+{
+  struct PeerRecord *pr = impl_state;
+
+  GNUNET_assert (mq == pr->mq);
+  pr->mq = NULL;
+}
+
+
+/**
+ * Implementation function that cancels the currently sent message.
+ * Should basically undo whatever #mq_send_impl() did.
+ *
+ * @param mq message queue
+ * @param impl_state state specific to the implementation
+ */
+static void
+core_mq_cancel_impl (struct GNUNET_MQ_Handle *mq, void *impl_state)
+{
+  struct PeerRecord *pr = impl_state;
+
+  (void) mq;
+  GNUNET_assert (NULL != pr->env);
+  GNUNET_MQ_discard (pr->env);
+  pr->env = NULL;
+}
+
+
+/**
+ * We had an error processing a message we forwarded from a peer to
+ * the CORE service.  We should just complain about it but otherwise
+ * continue processing.
+ *
+ * @param cls closure
+ * @param error error code
+ */
+static void
+core_mq_error_handler (void *cls, enum GNUNET_MQ_Error error)
+{
+  /* struct PeerRecord *pr = cls; */
+  (void) cls;
+  (void) error;
+  GNUNET_break_op (0);
+}
+
+
+/**
+ * Add the given peer to the list of our connected peers
+ * and create the respective data structures and notify
+ * the application.
+ *
+ * @param h the core handle
+ * @param peer the peer that is connecting to us
+ */
+static void
+connect_peer (struct GNUNET_CORE_Handle *h,
+              const struct GNUNET_PeerIdentity *peer)
+{
+  struct PeerRecord *pr;
+
+  pr = GNUNET_new (struct PeerRecord);
+  pr->peer = *peer;
+  pr->h = h;
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multipeermap_put (
+                   h->peers,
+                   &pr->peer,
+                   pr,
+                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  pr->mq = GNUNET_MQ_queue_for_callbacks (&core_mq_send_impl,
+                                          &core_mq_destroy_impl,
+                                          &core_mq_cancel_impl,
+                                          pr,
+                                          h->handlers,
+                                          &core_mq_error_handler,
+                                          pr);
+  if (NULL != h->connects)
+  {
+    pr->client_cls = h->connects (h->cls, &pr->peer, pr->mq);
+    GNUNET_MQ_set_handlers_closure (pr->mq, pr->client_cls);
+  }
+}
+
+
+/**
+ * Handle  init  reply message  received  from  CORE service.   Notify
+ * application  that we  are now  connected  to the  CORE.  Also  fake
+ * loopback connection.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param m the init reply
+ */
+static void
+handle_init_reply (void *cls, const struct InitReplyMessage *m)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  GNUNET_CORE_StartupCallback init;
+
+  GNUNET_break (0 == ntohl (m->reserved));
+  h->retry_backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+  if (NULL != (init = h->init))
+  {
+    /* mark so we don't call init on reconnect */
+    h->init = NULL;
+    h->me = m->my_identity;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Connected to core service of peer `%s'.\n",
+         GNUNET_i2s (&h->me));
+    h->have_init = GNUNET_YES;
+    init (h->cls, &h->me);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Successfully reconnected to core service.\n");
+    if (GNUNET_NO == h->have_init)
+    {
+      h->me = m->my_identity;
+      h->have_init = GNUNET_YES;
+    }
+    else
+    {
+      GNUNET_break (0 == memcmp (&h->me,
+                                 &m->my_identity,
+                                 sizeof(struct GNUNET_PeerIdentity)));
+    }
+  }
+  /* fake 'connect to self' */
+  connect_peer (h, &h->me);
+}
+
+
+/**
+ * Handle connect message received from CORE service.
+ * Notify the application about the new connection.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param cnm the connect message
+ */
+static void
+handle_connect_notify (void *cls, const struct ConnectNotifyMessage *cnm)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  struct PeerRecord *pr;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received notification about connection from `%s'.\n",
+       GNUNET_i2s (&cnm->peer));
+  if (0 == memcmp (&h->me, &cnm->peer, sizeof(struct GNUNET_PeerIdentity)))
+  {
+    /* connect to self!? */
+    GNUNET_break (0);
+    return;
+  }
+  pr = GNUNET_CONTAINER_multipeermap_get (h->peers, &cnm->peer);
+  if (NULL != pr)
+  {
+    GNUNET_break (0);
+    reconnect_later (h);
+    return;
+  }
+  connect_peer (h, &cnm->peer);
+}
+
+
+/**
+ * Handle disconnect message received from CORE service.
+ * Notify the application about the lost connection.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param dnm message about the disconnect event
+ */
+static void
+handle_disconnect_notify (void *cls, const struct DisconnectNotifyMessage *dnm)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  struct PeerRecord *pr;
+
+  if (0 == memcmp (&h->me, &dnm->peer, sizeof(struct GNUNET_PeerIdentity)))
+  {
+    /* disconnect from self!? */
+    GNUNET_break (0);
+    return;
+  }
+  GNUNET_break (0 == ntohl (dnm->reserved));
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received notification about disconnect from `%s'.\n",
+       GNUNET_i2s (&dnm->peer));
+  pr = GNUNET_CONTAINER_multipeermap_get (h->peers, &dnm->peer);
+  if (NULL == pr)
+  {
+    GNUNET_break (0);
+    reconnect_later (h);
+    return;
+  }
+  disconnect_and_free_peer_entry (h, &pr->peer, pr);
+}
+
+
+/**
+ * Check that message received from CORE service is well-formed.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param ntm the message we got
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_notify_inbound (void *cls, const struct NotifyTrafficMessage *ntm)
+{
+  uint16_t msize;
+  const struct GNUNET_MessageHeader *em;
+
+  (void) cls;
+  msize = ntohs (ntm->header.size) - sizeof(struct NotifyTrafficMessage);
+  if (msize < sizeof(struct GNUNET_MessageHeader))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  em = (const struct GNUNET_MessageHeader *) &ntm[1];
+  if (msize != ntohs (em->size))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle inbound message received from CORE service.  If applicable,
+ * notify the application.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param ntm the message we got from CORE.
+ */
+static void
+handle_notify_inbound (void *cls, const struct NotifyTrafficMessage *ntm)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  const struct GNUNET_MessageHeader *em;
+  struct PeerRecord *pr;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received inbound message from `%s'.\n",
+       GNUNET_i2s (&ntm->peer));
+  em = (const struct GNUNET_MessageHeader *) &ntm[1];
+  pr = GNUNET_CONTAINER_multipeermap_get (h->peers, &ntm->peer);
+  if (NULL == pr)
+  {
+    GNUNET_break (0);
+    reconnect_later (h);
+    return;
+  }
+  GNUNET_MQ_inject_message (pr->mq, em);
+}
+
+
+/**
+ * Handle message received from CORE service notifying us that we are
+ * now allowed to send a message to a peer.  If that message is still
+ * pending, put it into the queue to be transmitted.
+ *
+ * @param cls the `struct GNUNET_CORE_Handle`
+ * @param smr the message we got
+ */
+static void
+handle_send_ready (void *cls, const struct SendMessageReady *smr)
+{
+  struct GNUNET_CORE_Handle *h = cls;
+  struct PeerRecord *pr;
+
+  pr = GNUNET_CONTAINER_multipeermap_get (h->peers, &smr->peer);
+  if (NULL == pr)
+  {
+    GNUNET_break (0);
+    reconnect_later (h);
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received notification about transmission readiness to `%s'.\n",
+       GNUNET_i2s (&smr->peer));
+  if (NULL == pr->env)
+  {
+    /* request must have been cancelled between the original request
+     * and the response from CORE, ignore CORE's readiness */
+    return;
+  }
+  if (ntohs (smr->smr_id) != pr->smr_id_gen)
+  {
+    /* READY message is for expired or cancelled message,
+     * ignore! (we should have already sent another request) */
+    return;
+  }
+
+  /* ok, all good, send message out! */
+  GNUNET_MQ_send (h->mq, pr->env);
+  pr->env = NULL;
+  GNUNET_MQ_impl_send_continue (pr->mq);
+}
+
+
+/**
+ * Our current client connection went down.  Clean it up and try to
+ * reconnect!
+ *
+ * @param h our handle to the core service
+ */
+static void
+reconnect (struct GNUNET_CORE_Handle *h)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] =
+  { GNUNET_MQ_hd_fixed_size (init_reply,
+                             GNUNET_MESSAGE_TYPE_CORE_INIT_REPLY,
+                             struct InitReplyMessage,
+                             h),
+    GNUNET_MQ_hd_fixed_size (connect_notify,
+                             GNUNET_MESSAGE_TYPE_CORE_NOTIFY_CONNECT,
+                             struct ConnectNotifyMessage,
+                             h),
+    GNUNET_MQ_hd_fixed_size (disconnect_notify,
+                             GNUNET_MESSAGE_TYPE_CORE_NOTIFY_DISCONNECT,
+                             struct DisconnectNotifyMessage,
+                             h),
+    GNUNET_MQ_hd_var_size (notify_inbound,
+                           GNUNET_MESSAGE_TYPE_CORE_NOTIFY_INBOUND,
+                           struct NotifyTrafficMessage,
+                           h),
+    GNUNET_MQ_hd_fixed_size (send_ready,
+                             GNUNET_MESSAGE_TYPE_CORE_SEND_READY,
+                             struct SendMessageReady,
+                             h),
+    GNUNET_MQ_handler_end () };
+  struct InitMessage *init;
+  struct GNUNET_MQ_Envelope *env;
+  uint16_t *ts;
+
+  GNUNET_assert (NULL == h->mq);
+  h->mq = GNUNET_CLIENT_connect (h->cfg, "core", handlers, &handle_mq_error, h);
+  if (NULL == h->mq)
+  {
+    reconnect_later (h);
+    return;
+  }
+  env = GNUNET_MQ_msg_extra (init,
+                             sizeof(uint16_t) * h->hcnt,
+                             GNUNET_MESSAGE_TYPE_CORE_INIT);
+  LOG (GNUNET_ERROR_TYPE_INFO, "(Re)connecting to CORE service\n");
+  init->options = htonl (0);
+  ts = (uint16_t *) &init[1];
+  for (unsigned int hpos = 0; hpos < h->hcnt; hpos++)
+    ts[hpos] = htons (h->handlers[hpos].type);
+  GNUNET_MQ_send (h->mq, env);
+}
+
+
+/**
+ * Connect to the core service.  Note that the connection may complete
+ * (or fail) asynchronously.
+ *
+ * @param cfg configuration to use
+ * @param cls closure for the various callbacks that follow (including handlers in the handlers array)
+ * @param init callback to call once we have successfully
+ *        connected to the core service
+ * @param connects function to call on peer connect, can be NULL
+ * @param disconnects function to call on peer disconnect / timeout, can be NULL
+ * @param handlers callbacks for messages we care about, NULL-terminated
+ * @return handle to the core service (only useful for disconnect until @a init is called);
+ *                NULL on error (in this case, init is never called)
+ */
+struct GNUNET_CORE_Handle *
+GNUNET_CORE_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                     void *cls,
+                     GNUNET_CORE_StartupCallback init,
+                     GNUNET_CORE_ConnectEventHandler connects,
+                     GNUNET_CORE_DisconnectEventHandler disconnects,
+                     const struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct GNUNET_CORE_Handle *h;
+
+  h = GNUNET_new (struct GNUNET_CORE_Handle);
+  h->cfg = cfg;
+  h->cls = cls;
+  h->init = init;
+  h->connects = connects;
+  h->disconnects = disconnects;
+  h->peers = GNUNET_CONTAINER_multipeermap_create (128, GNUNET_NO);
+  h->handlers = GNUNET_MQ_copy_handlers (handlers);
+  h->hcnt = GNUNET_MQ_count_handlers (handlers);
+  GNUNET_assert (h->hcnt <
+                 (GNUNET_MAX_MESSAGE_SIZE - sizeof(struct InitMessage))
+                 / sizeof(uint16_t));
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Connecting to CORE service\n");
+  reconnect (h);
+  if (NULL == h->mq)
+  {
+    GNUNET_CORE_disconnect (h);
+    return NULL;
+  }
+  return h;
+}
+
+
+/**
+ * Disconnect from the core service.
+ *
+ * @param handle connection to core to disconnect
+ */
+void
+GNUNET_CORE_disconnect (struct GNUNET_CORE_Handle *handle)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Disconnecting from CORE service\n");
+  GNUNET_CONTAINER_multipeermap_iterate (handle->peers,
+                                         &disconnect_and_free_peer_entry,
+                                         handle);
+  GNUNET_CONTAINER_multipeermap_destroy (handle->peers);
+  handle->peers = NULL;
+  if (NULL != handle->reconnect_task)
+  {
+    GNUNET_SCHEDULER_cancel (handle->reconnect_task);
+    handle->reconnect_task = NULL;
+  }
+  if (NULL != handle->mq)
+  {
+    GNUNET_MQ_destroy (handle->mq);
+    handle->mq = NULL;
+  }
+  GNUNET_free (handle->handlers);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Obtain the message queue for a connected peer.
+ *
+ * @param h the core handle
+ * @param pid the identity of the peer to check if it has been connected to us
+ * @return NULL if peer is not connected
+ */
+struct GNUNET_MQ_Handle *
+GNUNET_CORE_get_mq (const struct GNUNET_CORE_Handle *h,
+                    const struct GNUNET_PeerIdentity *pid)
+{
+  struct PeerRecord *pr;
+
+  pr = GNUNET_CONTAINER_multipeermap_get (h->peers, pid);
+  if (NULL == pr)
+    return NULL;
+  return pr->mq;
+}
+
+
+/* end of core_api.c */
diff --git a/src/service/core/core_api_cmd_connecting_peers.c b/src/service/core/core_api_cmd_connecting_peers.c
new file mode 100644
index 000000000..ce2184a3c
--- /dev/null
+++ b/src/service/core/core_api_cmd_connecting_peers.c
@@ -0,0 +1,275 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing_api_cmd_start_peer.c
+ * @brief cmd to start a peer.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_ng_lib.h"
+#include "gnunet_testing_netjail_lib.h"
+#include "gnunet_transport_application_service.h"
+#include "gnunet_hello_lib.h"
+#include "gnunet_transport_core_service.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+ * The run method of this cmd will connect to peers.
+ *
+ */
+static void
+connect_peers_run (void *cls,
+                   struct GNUNET_TESTING_Interpreter *is)
+{
+  struct GNUNET_TESTING_ConnectPeersState *cps = cls;
+  const struct GNUNET_TESTING_StartPeerState *sps;
+  const struct GNUNET_TESTING_Command *system_cmd;
+  const struct GNUNET_TESTING_System *tl_system;
+  const struct GNUNET_TESTING_Command *peer1_cmd;
+  struct GNUNET_PeerIdentity *peer;
+  enum GNUNET_NetworkType nt = 0;
+  struct GNUNET_TESTING_NodeConnection *pos_connection;
+  struct GNUNET_TESTING_AddressPrefix *pos_prefix;
+  const enum GNUNET_GenericReturnValue *broadcast;
+  unsigned int con_num = 0;
+  uint32_t num;
+  char *addr;
+  char *addr_and_port;
+  char *emsg = NULL;
+
+  cps->is = is;
+  peer1_cmd = GNUNET_TESTING_interpreter_lookup_command (is,
+                                                         cps->start_peer_label);
+  GNUNET_TESTING_get_trait_broadcast (peer1_cmd,
+                                        &broadcast);
+  GNUNET_TESTING_get_trait_state (peer1_cmd,
+                                    &sps);
+
+  system_cmd = GNUNET_TESTING_interpreter_lookup_command (is,
+                                                          cps->create_label);
+  GNUNET_TESTING_get_trait_test_system (system_cmd,
+                                        &tl_system);
+
+  cps->tl_system = tl_system;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "cps->num: %u \n",
+       cps->num);
+  
+
+  cps->ah = GNUNET_TRANSPORT_application_init (sps->cfg);
+  if (NULL == cps->ah)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Failed to initialize the TRANSPORT application suggestion client handle for peer `%s': `%s'\n",
+         sps->cfgname,
+         emsg);
+    GNUNET_free (emsg);
+    GNUNET_TESTING_interpreter_fail (is);
+    return;
+  }
+
+  cps->node_connections_head = GNUNET_TESTING_get_connections (cps->num,
+                                                               cps->topology);
+
+  for (pos_connection = cps->node_connections_head; NULL != pos_connection;
+       pos_connection = pos_connection->next)
+  {
+    con_num++;
+    num = GNUNET_TESTING_calculate_num (pos_connection, cps->topology);
+    for (pos_prefix = pos_connection->address_prefixes_head; NULL != pos_prefix;
+         pos_prefix =
+           pos_prefix->next)
+    {
+      addr = GNUNET_TESTING_get_address (pos_connection,
+                                         pos_prefix->address_prefix);
+      if (NULL != addr)
+      {
+        char *natted_p = strstr (pos_prefix->address_prefix, "_");
+
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "0 validating peer number %s %s %s\n",
+                    natted_p,
+                    pos_prefix->address_prefix,
+                    addr);
+        if (0 == GNUNET_memcmp (pos_prefix->address_prefix, "udp"))
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "validating memcmp\n");
+        if (GNUNET_YES == *broadcast)
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "validating broadcast\n");
+        if ((0 == GNUNET_memcmp (pos_prefix->address_prefix, "udp")) &&
+            (GNUNET_YES == *broadcast) )
+          GNUNET_asprintf (&addr_and_port,
+                           "%s:2086",
+                           addr);
+        else if (NULL == natted_p)
+          GNUNET_asprintf (&addr_and_port,
+                           "%s:60002",
+                           addr);
+        else if (NULL != natted_p)
+        {
+          char *prefix;
+          char *rest;
+          char *rest2;
+          char *address;
+
+          prefix = strtok (addr, "_");
+          rest = strtok (NULL, "_");
+          rest2 = strtok (rest, "-");
+          address = strtok (NULL, "-");
+
+          GNUNET_asprintf (&addr_and_port,
+                           "%s-%s:0",
+                           prefix,
+                           address);
+
+        }
+        peer = GNUNET_TESTING_get_peer (num, tl_system);
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "validating peer number %u with identity %s and address %s %u %s and handle %p\n",
+                    num,
+                    GNUNET_i2s (peer),
+                    addr_and_port,
+                    *broadcast,
+                    pos_prefix->address_prefix,
+                    cps->ah);
+        GNUNET_TRANSPORT_application_validate ((struct
+                                                GNUNET_TRANSPORT_ApplicationHandle
+                                                *) cps->ah,
+                                               peer,
+                                               nt,
+                                               addr_and_port);
+        GNUNET_free (peer);
+        GNUNET_free (addr);
+        GNUNET_free (addr_and_port);
+      }
+    }
+  }
+  cps->con_num = con_num;
+}
+
+
+/**
+ * The cleanup function of this cmd frees resources the cmd allocated.
+ *
+ */
+static void
+connect_peers_cleanup (void *cls)
+{
+  struct GNUNET_TESTING_ConnectPeersState *cps = cls;
+
+  GNUNET_free (cps->connected_peers_map);
+  GNUNET_free (cps);
+}
+
+
+/**
+ * This function prepares an array with traits.
+ *
+ */
+enum GNUNET_GenericReturnValue
+connect_peers_traits (void *cls,
+                      const void **ret,
+                      const char *trait,
+                      unsigned int index)
+{
+  struct GNUNET_TESTING_ConnectPeersState *cps = cls;
+  struct GNUNET_TESTING_Trait traits[] = {
+    GNUNET_TESTING_make_trait_connect_peer_state ((const void *) cps),
+    GNUNET_TESTING_trait_end ()
+  };
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_CORE_cmd_connect_peers (const char *label,
+                                    const char *start_peer_label,
+                                    const char *create_label,
+                                    uint32_t num,
+                                    struct GNUNET_TESTING_NetjailTopology *
+                                    topology,
+                                    unsigned int additional_connects,
+                                    unsigned int wait_for_connect,
+                                    struct GNUNET_MQ_MessageHandler *handlers)
+{
+  struct GNUNET_TESTING_ConnectPeersState *cps;
+  unsigned int node_additional_connects;
+  struct GNUNET_CONTAINER_MultiShortmap *connected_peers_map =
+    GNUNET_CONTAINER_multishortmap_create (1,GNUNET_NO);
+  unsigned int i;
+  
+  node_additional_connects = GNUNET_TESTING_get_additional_connects (num,
+                                                                     topology);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "global: %u and local: %u additional_connects\n",
+       additional_connects,
+       node_additional_connects);
+
+  if (0 != node_additional_connects)
+    additional_connects = node_additional_connects;
+
+  cps = GNUNET_new (struct GNUNET_TESTING_ConnectPeersState);
+  cps->start_peer_label = start_peer_label;
+  cps->num = num;
+  cps->create_label = create_label;
+  cps->topology = topology;
+  cps->additional_connects = additional_connects;
+  cps->wait_for_connect = wait_for_connect;
+  cps->connected_peers_map = connected_peers_map;
+
+  if (NULL != handlers)
+  {
+    for (i = 0; NULL != handlers[i].cb; i++)
+      ;
+    cps->handlers = GNUNET_new_array (i + 1,
+                                      struct GNUNET_MQ_MessageHandler);
+    GNUNET_memcpy (cps->handlers,
+                   handlers,
+                   i * sizeof(struct GNUNET_MQ_MessageHandler));
+  }
+
+  if (GNUNET_YES == wait_for_connect)
+    return GNUNET_TESTING_command_new (cps,
+                                       label,
+                                       &connect_peers_run,
+                                       &connect_peers_cleanup,
+                                       &connect_peers_traits,
+                                       &cps->ac);
+  else
+    return GNUNET_TESTING_command_new (cps,
+                                       label,
+                                       &connect_peers_run,
+                                       &connect_peers_cleanup,
+                                       &connect_peers_traits,
+                                       NULL);
+}
diff --git a/src/service/core/core_api_monitor_peers.c b/src/service/core/core_api_monitor_peers.c
new file mode 100644
index 000000000..3be8e3859
--- /dev/null
+++ b/src/service/core/core_api_monitor_peers.c
@@ -0,0 +1,196 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/core_api_monitor_peers.c
+ * @brief implementation of the peer_iterate function
+ * @author Christian Grothoff
+ * @author Nathan Evans
+ */
+#include "platform.h"
+#include "gnunet_core_service.h"
+#include "core.h"
+
+
+/**
+ * Handle to a CORE monitoring operation.
+ */
+struct GNUNET_CORE_MonitorHandle
+{
+  /**
+   * Our configuration.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Our connection to the service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Function called with the peer.
+   */
+  GNUNET_CORE_MonitorCallback peer_cb;
+
+  /**
+   * Closure for @e peer_cb.
+   */
+  void *peer_cb_cls;
+};
+
+
+/**
+ * Protocol error, reconnect to CORE service and notify
+ * client.
+ *
+ * @param mh monitoring session to reconnect to CORE
+ */
+static void
+reconnect (struct GNUNET_CORE_MonitorHandle *mh);
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure, a `struct GNUNET_CORE_MonitorHandle *`
+ * @param error error code
+ */
+static void
+handle_mq_error (void *cls, enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_CORE_MonitorHandle *mh = cls;
+
+  (void) error;
+  reconnect (mh);
+}
+
+
+/**
+ * Receive reply from CORE service with information about a peer.
+ *
+ * @param cls our `struct  GNUNET_CORE_MonitorHandle *`
+ * @param mon_message monitor message
+ */
+static void
+handle_receive_info (void *cls, const struct MonitorNotifyMessage *mon_message)
+{
+  struct GNUNET_CORE_MonitorHandle *mh = cls;
+
+  mh->peer_cb (mh->peer_cb_cls,
+               &mon_message->peer,
+               (enum GNUNET_CORE_KxState) ntohl (mon_message->state),
+               GNUNET_TIME_absolute_ntoh (mon_message->timeout));
+}
+
+
+/**
+ * Protocol error, reconnect to CORE service and notify
+ * client.
+ *
+ * @param mh monitoring session to reconnect to CORE
+ */
+static void
+reconnect (struct GNUNET_CORE_MonitorHandle *mh)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] =
+  { GNUNET_MQ_hd_fixed_size (receive_info,
+                             GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY,
+                             struct MonitorNotifyMessage,
+                             mh),
+    GNUNET_MQ_handler_end () };
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  if (NULL != mh->mq)
+    GNUNET_MQ_destroy (mh->mq);
+  /* FIXME: use backoff? */
+  mh->mq =
+    GNUNET_CLIENT_connect (mh->cfg, "core", handlers, &handle_mq_error, mh);
+  if (NULL == mh->mq)
+    return;
+  /* notify callback about reconnect */
+  if (NULL != mh->peer_cb)
+    mh->peer_cb (mh->peer_cb_cls,
+                 NULL,
+                 GNUNET_CORE_KX_CORE_DISCONNECT,
+                 GNUNET_TIME_UNIT_FOREVER_ABS);
+  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_CORE_MONITOR_PEERS);
+  GNUNET_MQ_send (mh->mq, env);
+}
+
+
+/**
+ * Monitor connectivity and KX status of all peers known to CORE.
+ * Calls @a peer_cb with the current status for each connected peer,
+ * and then once with NULL to indicate that all peers that are
+ * currently active have been handled.  After that, the iteration
+ * continues until it is cancelled.  Normal users of the CORE API are
+ * not expected to use this function.  It is different in that it
+ * truly lists all connections (including those where the KX is in
+ * progress), not just those relevant to the application.  This
+ * function is used by special applications for diagnostics.
+ *
+ * @param cfg configuration handle
+ * @param peer_cb function to call with the peer information
+ * @param peer_cb_cls closure for @a peer_cb
+ * @return NULL on error
+ */
+struct GNUNET_CORE_MonitorHandle *
+GNUNET_CORE_monitor_start (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                           GNUNET_CORE_MonitorCallback peer_cb,
+                           void *peer_cb_cls)
+{
+  struct GNUNET_CORE_MonitorHandle *mh;
+
+  GNUNET_assert (NULL != peer_cb);
+  mh = GNUNET_new (struct GNUNET_CORE_MonitorHandle);
+  mh->cfg = cfg;
+  reconnect (mh);
+  mh->peer_cb = peer_cb;
+  mh->peer_cb_cls = peer_cb_cls;
+  if (NULL == mh->mq)
+  {
+    GNUNET_free (mh);
+    return NULL;
+  }
+  return mh;
+}
+
+
+/**
+ * Stop monitoring CORE activity.
+ *
+ * @param mh monitor to stop
+ */
+void
+GNUNET_CORE_monitor_stop (struct GNUNET_CORE_MonitorHandle *mh)
+{
+  if (NULL != mh->mq)
+  {
+    GNUNET_MQ_destroy (mh->mq);
+    mh->mq = NULL;
+  }
+  GNUNET_free (mh);
+}
+
+
+/* end of core_api_monitor_peers.c */
diff --git a/src/service/core/gnunet-service-core.c b/src/service/core/gnunet-service-core.c
new file mode 100644
index 000000000..e387fecc9
--- /dev/null
+++ b/src/service/core/gnunet-service-core.c
@@ -0,0 +1,988 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2011, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core.c
+ * @brief high-level P2P messaging
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include <gcrypt.h>
+#include "gnunet_util_lib.h"
+#include "gnunet-service-core.h"
+#include "gnunet-service-core_kx.h"
+#include "gnunet-service-core_sessions.h"
+#include "gnunet-service-core_typemap.h"
+#include "gnunet_constants.h"
+
+/**
+ * How many messages do we queue up at most for any client? This can
+ * cause messages to be dropped if clients do not process them fast
+ * enough!  Note that this is a soft limit; we try
+ * to keep a few larger messages above the limit.
+ */
+#define SOFT_MAX_QUEUE 128
+
+/**
+ * How many messages do we queue up at most for any client? This can
+ * cause messages to be dropped if clients do not process them fast
+ * enough!  Note that this is the hard limit.
+ */
+#define HARD_MAX_QUEUE 256
+
+
+/**
+ * Data structure for each client connected to the CORE service.
+ */
+struct GSC_Client
+{
+  /**
+   * Clients are kept in a linked list.
+   */
+  struct GSC_Client *next;
+
+  /**
+   * Clients are kept in a linked list.
+   */
+  struct GSC_Client *prev;
+
+  /**
+   * Handle for the client with the server API.
+   */
+  struct GNUNET_SERVICE_Client *client;
+
+  /**
+   * Message queue to talk to @e client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Array of the types of messages this peer cares
+   * about (with @e tcnt entries).  Allocated as part
+   * of this client struct, do not free!
+   */
+  uint16_t *types;
+
+  /**
+   * Map of peer identities to active transmission requests of this
+   * client to the peer (of type `struct GSC_ClientActiveRequest`).
+   */
+  struct GNUNET_CONTAINER_MultiPeerMap *requests;
+
+  /**
+   * Map containing all peers that this client knows we're connected to.
+   */
+  struct GNUNET_CONTAINER_MultiPeerMap *connectmap;
+
+  /**
+   * Options for messages this client cares about,
+   * see GNUNET_CORE_OPTION_ values.
+   */
+  uint32_t options;
+
+  /**
+   * Have we gotten the #GNUNET_MESSAGE_TYPE_CORE_INIT message
+   * from this client already?
+   */
+  int got_init;
+
+  /**
+   * Number of types of incoming messages this client
+   * specifically cares about.  Size of the @e types array.
+   */
+  unsigned int tcnt;
+};
+
+
+/**
+ * Our identity.
+ */
+struct GNUNET_PeerIdentity GSC_my_identity;
+
+/**
+ * Our configuration.
+ */
+const struct GNUNET_CONFIGURATION_Handle *GSC_cfg;
+
+/**
+ * For creating statistics.
+ */
+struct GNUNET_STATISTICS_Handle *GSC_stats;
+
+/**
+ * Big "or" of all client options.
+ */
+static uint32_t all_client_options;
+
+/**
+ * Head of linked list of our clients.
+ */
+static struct GSC_Client *client_head;
+
+/**
+ * Tail of linked list of our clients.
+ */
+static struct GSC_Client *client_tail;
+
+
+/**
+ * Test if the client is interested in messages of the given type.
+ *
+ * @param type message type
+ * @param c client to test
+ * @return #GNUNET_YES if @a c is interested, #GNUNET_NO if not.
+ */
+static int
+type_match (uint16_t type, struct GSC_Client *c)
+{
+  if ((0 == c->tcnt) && (0 != c->options))
+    return GNUNET_YES; /* peer without handlers and inbound/outbond
+                                   callbacks matches ALL */
+  if (NULL == c->types)
+    return GNUNET_NO;
+  for (unsigned int i = 0; i < c->tcnt; i++)
+    if (type == c->types[i])
+      return GNUNET_YES;
+  return GNUNET_NO;
+}
+
+
+/**
+ * Check #GNUNET_MESSAGE_TYPE_CORE_INIT request.
+ *
+ * @param cls client that sent #GNUNET_MESSAGE_TYPE_CORE_INIT
+ * @param im the `struct InitMessage`
+ * @return #GNUNET_OK if @a im is well-formed
+ */
+static int
+check_client_init (void *cls, const struct InitMessage *im)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_INIT request.
+ *
+ * @param cls client that sent #GNUNET_MESSAGE_TYPE_CORE_INIT
+ * @param im the `struct InitMessage`
+ */
+static void
+handle_client_init (void *cls, const struct InitMessage *im)
+{
+  struct GSC_Client *c = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct InitReplyMessage *irm;
+  uint16_t msize;
+  const uint16_t *types;
+
+  /* check that we don't have an entry already */
+  msize = ntohs (im->header.size) - sizeof(struct InitMessage);
+  types = (const uint16_t *) &im[1];
+  c->tcnt = msize / sizeof(uint16_t);
+  c->options = ntohl (im->options);
+  c->got_init = GNUNET_YES;
+  all_client_options |= c->options;
+  c->types = GNUNET_malloc (msize);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multipeermap_put (
+                   c->connectmap,
+                   &GSC_my_identity,
+                   NULL,
+                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  for (unsigned int i = 0; i < c->tcnt; i++)
+    c->types[i] = ntohs (types[i]);
+  GSC_TYPEMAP_add (c->types, c->tcnt);
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "Client connecting to core service is interested in %u message types\n",
+    (unsigned int) c->tcnt);
+  /* send init reply message */
+  env = GNUNET_MQ_msg (irm, GNUNET_MESSAGE_TYPE_CORE_INIT_REPLY);
+  irm->reserved = htonl (0);
+  irm->my_identity = GSC_my_identity;
+  GNUNET_MQ_send (c->mq, env);
+  GSC_SESSIONS_notify_client_about_sessions (c);
+  GNUNET_SERVICE_client_continue (c->client);
+}
+
+
+/**
+ * We will never be ready to transmit the given message in (disconnect
+ * or invalid request).  Frees resources associated with @a car.  We
+ * don't explicitly tell the client, it'll learn with the disconnect
+ * (or violated the protocol).
+ *
+ * @param car request that now permanently failed; the
+ *        responsibility for the handle is now returned
+ *        to CLIENTS (SESSIONS is done with it).
+ * @param drop_client #GNUNET_YES if the client violated the protocol
+ *        and we should thus drop the connection
+ */
+void
+GSC_CLIENTS_reject_request (struct GSC_ClientActiveRequest *car,
+                            int drop_client)
+{
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CONTAINER_multipeermap_remove (car->client_handle->requests,
+                                          &car->target,
+                                          car));
+  if (GNUNET_YES == drop_client)
+    GNUNET_SERVICE_client_drop (car->client_handle->client);
+  GNUNET_free (car);
+}
+
+
+/**
+ * Tell a client that we are ready to receive the message.
+ *
+ * @param car request that is now ready; the responsibility
+ *        for the handle remains shared between CLIENTS
+ *        and SESSIONS after this call.
+ */
+void
+GSC_CLIENTS_solicit_request (struct GSC_ClientActiveRequest *car)
+{
+  struct GSC_Client *c;
+  struct GNUNET_MQ_Envelope *env;
+  struct SendMessageReady *smr;
+  struct GNUNET_TIME_Relative delay;
+  struct GNUNET_TIME_Relative left;
+
+  c = car->client_handle;
+  if (GNUNET_YES !=
+      GNUNET_CONTAINER_multipeermap_contains (c->connectmap, &car->target))
+  {
+    /* connection has gone down since, drop request */
+    GNUNET_assert (0 !=
+                   GNUNET_memcmp (&car->target,
+                                  &GSC_my_identity));
+    GSC_SESSIONS_dequeue_request (car);
+    GSC_CLIENTS_reject_request (car, GNUNET_NO);
+    return;
+  }
+  delay = GNUNET_TIME_absolute_get_duration (car->received_time);
+  left = GNUNET_TIME_absolute_get_duration (car->deadline);
+  if (delay.rel_value_us > GNUNET_CONSTANTS_LATENCY_WARN.rel_value_us)
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_WARNING,
+      "Client waited %s for permission to transmit to `%s'%s (priority %u)\n",
+      GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_YES),
+      GNUNET_i2s (&car->target),
+      (0 == left.rel_value_us) ? " (past deadline)" : "",
+      car->priority);
+  env = GNUNET_MQ_msg (smr, GNUNET_MESSAGE_TYPE_CORE_SEND_READY);
+  smr->size = htons (car->msize);
+  smr->smr_id = car->smr_id;
+  smr->peer = car->target;
+  GNUNET_MQ_send (c->mq, env);
+}
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST message.
+ *
+ * @param cls client that sent a #GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST
+ * @param req the `struct SendMessageRequest`
+ */
+static void
+handle_client_send_request (void *cls, const struct SendMessageRequest *req)
+{
+  struct GSC_Client *c = cls;
+  struct GSC_ClientActiveRequest *car;
+  int is_loopback;
+
+  if (NULL == c->requests)
+    c->requests = GNUNET_CONTAINER_multipeermap_create (16, GNUNET_NO);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client asked for transmission to `%s'\n",
+              GNUNET_i2s (&req->peer));
+  is_loopback = (0 == GNUNET_memcmp (&req->peer,
+                                     &GSC_my_identity));
+  if ((! is_loopback) &&
+      (GNUNET_YES !=
+       GNUNET_CONTAINER_multipeermap_contains (c->connectmap, &req->peer)))
+  {
+    /* neighbour must have disconnected since request was issued,
+     * ignore (client will realize it once it processes the
+     * disconnect notification) */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# send requests dropped (disconnected)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_SERVICE_client_continue (c->client);
+    return;
+  }
+
+  car = GNUNET_CONTAINER_multipeermap_get (c->requests, &req->peer);
+  if (NULL == car)
+  {
+    /* create new entry */
+    car = GNUNET_new (struct GSC_ClientActiveRequest);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multipeermap_put (
+                     c->requests,
+                     &req->peer,
+                     car,
+                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST));
+    car->client_handle = c;
+  }
+  else
+  {
+    /* dequeue and recycle memory from pending request, there can only
+       be at most one per client and peer */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# dequeuing CAR (duplicate request)"),
+                              1,
+                              GNUNET_NO);
+    GSC_SESSIONS_dequeue_request (car);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Transmission request to `%s' was a duplicate!\n",
+                GNUNET_i2s (&req->peer));
+  }
+  car->target = req->peer;
+  car->received_time = GNUNET_TIME_absolute_get ();
+  car->deadline = GNUNET_TIME_absolute_ntoh (req->deadline);
+  car->priority = (enum GNUNET_MQ_PriorityPreferences) ntohl (req->priority);
+  car->msize = ntohs (req->size);
+  car->smr_id = req->smr_id;
+  car->was_solicited = GNUNET_NO;
+  GNUNET_SERVICE_client_continue (c->client);
+  if (is_loopback)
+  {
+    /* loopback, satisfy immediately */
+    GSC_CLIENTS_solicit_request (car);
+    return;
+  }
+  GSC_SESSIONS_queue_request (car);
+}
+
+
+/**
+ * Closure for the #client_tokenizer_callback().
+ */
+struct TokenizerContext
+{
+  /**
+   * Active request handle for the message.
+   */
+  struct GSC_ClientActiveRequest *car;
+
+  /**
+   * How important is this message.
+   */
+  enum GNUNET_MQ_PriorityPreferences priority;
+};
+
+
+/**
+ * Functions with this signature are called whenever a complete
+ * message is received by the tokenizer.  Used by
+ * #handle_client_send() for dispatching messages from clients to
+ * either the SESSION subsystem or other CLIENT (for loopback).
+ *
+ * @param cls reservation request (`struct TokenizerContext`)
+ * @param message the actual message
+ * @return #GNUNET_OK on success,
+ *    #GNUNET_NO to stop further processing (no error)
+ *    #GNUNET_SYSERR to stop further processing with error
+ */
+static int
+tokenized_cb (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  struct TokenizerContext *tc = cls;
+  struct GSC_ClientActiveRequest *car = tc->car;
+  char buf[92];
+
+  GNUNET_snprintf (buf,
+                   sizeof(buf),
+                   gettext_noop ("# bytes of messages of type %u received"),
+                   (unsigned int) ntohs (message->type));
+  GNUNET_STATISTICS_update (GSC_stats, buf, ntohs (message->size), GNUNET_NO);
+  if (0 == GNUNET_memcmp (&car->target,
+                          &GSC_my_identity))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Delivering message of type %u to myself\n",
+                ntohs (message->type));
+    GSC_CLIENTS_deliver_message (&GSC_my_identity,
+                                 message,
+                                 ntohs (message->size),
+                                 GNUNET_CORE_OPTION_SEND_FULL_OUTBOUND);
+    GSC_CLIENTS_deliver_message (&GSC_my_identity,
+                                 message,
+                                 sizeof(struct GNUNET_MessageHeader),
+                                 GNUNET_CORE_OPTION_SEND_HDR_OUTBOUND);
+    GSC_CLIENTS_deliver_message (&GSC_my_identity,
+                                 message,
+                                 ntohs (message->size),
+                                 GNUNET_CORE_OPTION_SEND_FULL_INBOUND);
+    GSC_CLIENTS_deliver_message (&GSC_my_identity,
+                                 message,
+                                 sizeof(struct GNUNET_MessageHeader),
+                                 GNUNET_CORE_OPTION_SEND_HDR_INBOUND);
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Delivering message of type %u and size %u to %s\n",
+                ntohs (message->type),
+                ntohs (message->size),
+                GNUNET_i2s (&car->target));
+    GSC_CLIENTS_deliver_message (&car->target,
+                                 message,
+                                 ntohs (message->size),
+                                 GNUNET_CORE_OPTION_SEND_FULL_OUTBOUND);
+    GSC_CLIENTS_deliver_message (&car->target,
+                                 message,
+                                 sizeof(struct GNUNET_MessageHeader),
+                                 GNUNET_CORE_OPTION_SEND_HDR_OUTBOUND);
+    GSC_SESSIONS_transmit (car, message, tc->priority);
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Check #GNUNET_MESSAGE_TYPE_CORE_SEND request.
+ *
+ * @param cls the `struct GSC_Client`
+ * @param sm the `struct SendMessage`
+ * @return #GNUNET_OK if @a sm is well-formed
+ */
+static int
+check_client_send (void *cls, const struct SendMessage *sm)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_SEND request.
+ *
+ * @param cls the `struct GSC_Client`
+ * @param sm the `struct SendMessage`
+ */
+static void
+handle_client_send (void *cls, const struct SendMessage *sm)
+{
+  struct GSC_Client *c = cls;
+  struct TokenizerContext tc;
+  uint16_t msize;
+  struct GNUNET_TIME_Relative delay;
+  struct GNUNET_MessageStreamTokenizer *mst;
+
+  msize = ntohs (sm->header.size) - sizeof(struct SendMessage);
+  tc.car = GNUNET_CONTAINER_multipeermap_get (c->requests, &sm->peer);
+  if (NULL == tc.car)
+  {
+    /* Must have been that we first approved the request, then got disconnected
+     * (which triggered removal of the 'car') and now the client gives us a message
+     * just *before* the client learns about the disconnect.  Theoretically, we
+     * might also now be *again* connected.  So this can happen (but should be
+     * rare).  If it does happen, the message is discarded. */GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# messages discarded (session disconnected)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_SERVICE_client_continue (c->client);
+    return;
+  }
+  delay = GNUNET_TIME_absolute_get_duration (tc.car->received_time);
+  tc.priority = (enum GNUNET_MQ_PriorityPreferences) ntohl (sm->priority);
+  if (delay.rel_value_us > GNUNET_CONSTANTS_LATENCY_WARN.rel_value_us)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Client waited %s for transmission of %u bytes to `%s'\n",
+                GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_YES),
+                msize,
+                GNUNET_i2s (&sm->peer));
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client waited %s for transmission of %u bytes to `%s'\n",
+                GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_YES),
+                msize,
+                GNUNET_i2s (&sm->peer));
+
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CONTAINER_multipeermap_remove (c->requests, &sm->peer, tc.car));
+  mst = GNUNET_MST_create (&tokenized_cb, &tc);
+  GNUNET_MST_from_buffer (mst,
+                          (const char *) &sm[1],
+                          msize,
+                          GNUNET_YES,
+                          GNUNET_NO);
+  GNUNET_MST_destroy (mst);
+  GSC_SESSIONS_dequeue_request (tc.car);
+  GNUNET_free (tc.car);
+  GNUNET_SERVICE_client_continue (c->client);
+}
+
+
+/**
+ * Free client request records.
+ *
+ * @param cls NULL
+ * @param key identity of peer for which this is an active request
+ * @param value the `struct GSC_ClientActiveRequest` to free
+ * @return #GNUNET_YES (continue iteration)
+ */
+static int
+destroy_active_client_request (void *cls,
+                               const struct GNUNET_PeerIdentity *key,
+                               void *value)
+{
+  struct GSC_ClientActiveRequest *car = value;
+
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CONTAINER_multipeermap_remove (car->client_handle->requests,
+                                          &car->target,
+                                          car));
+  GSC_SESSIONS_dequeue_request (car);
+  GNUNET_free (car);
+  return GNUNET_YES;
+}
+
+
+/**
+ * A client connected, set up.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ * @param mq message queue to talk to @a client
+ * @return our client handle
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *client,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  struct GSC_Client *c;
+
+  c = GNUNET_new (struct GSC_Client);
+  c->client = client;
+  c->mq = mq;
+  c->connectmap = GNUNET_CONTAINER_multipeermap_create (16, GNUNET_NO);
+  GNUNET_CONTAINER_DLL_insert (client_head, client_tail, c);
+  return c;
+}
+
+
+/**
+ * A client disconnected, clean up.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ * @param app_ctx our `struct GST_Client` for @a client
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *client,
+                      void *app_ctx)
+{
+  struct GSC_Client *c = app_ctx;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client %p has disconnected from core service.\n",
+              client);
+  GNUNET_CONTAINER_DLL_remove (client_head, client_tail, c);
+  if (NULL != c->requests)
+  {
+    GNUNET_CONTAINER_multipeermap_iterate (c->requests,
+                                           &destroy_active_client_request,
+                                           NULL);
+    GNUNET_CONTAINER_multipeermap_destroy (c->requests);
+  }
+  GNUNET_CONTAINER_multipeermap_destroy (c->connectmap);
+  c->connectmap = NULL;
+  if (NULL != c->types)
+  {
+    GSC_TYPEMAP_remove (c->types, c->tcnt);
+    GNUNET_free (c->types);
+  }
+  GNUNET_free (c);
+
+  /* recalculate 'all_client_options' */
+  all_client_options = 0;
+  for (c = client_head; NULL != c; c = c->next)
+    all_client_options |= c->options;
+}
+
+
+/**
+ * Notify a particular client about a change to existing connection to
+ * one of our neighbours (check if the client is interested).  Called
+ * from #GSC_SESSIONS_notify_client_about_sessions().
+ *
+ * @param client client to notify
+ * @param neighbour identity of the neighbour that changed status
+ * @param tmap_old previous type map for the neighbour, NULL for connect
+ * @param tmap_new updated type map for the neighbour, NULL for disconnect
+ */
+void
+GSC_CLIENTS_notify_client_about_neighbour (
+  struct GSC_Client *client,
+  const struct GNUNET_PeerIdentity *neighbour,
+  const struct GSC_TypeMap *tmap_old,
+  const struct GSC_TypeMap *tmap_new)
+{
+  struct GNUNET_MQ_Envelope *env;
+  int old_match;
+  int new_match;
+
+  if (GNUNET_YES != client->got_init)
+    return;
+  old_match = GSC_TYPEMAP_test_match (tmap_old, client->types, client->tcnt);
+  new_match = GSC_TYPEMAP_test_match (tmap_new, client->types, client->tcnt);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Notifying client about neighbour %s (%d/%d)\n",
+              GNUNET_i2s (neighbour),
+              old_match,
+              new_match);
+  if (old_match == new_match)
+  {
+    GNUNET_assert (
+      old_match ==
+      GNUNET_CONTAINER_multipeermap_contains (client->connectmap, neighbour));
+    return;   /* no change */
+  }
+  if (GNUNET_NO == old_match)
+  {
+    struct ConnectNotifyMessage *cnm;
+
+    /* send connect */
+    GNUNET_assert (
+      GNUNET_NO ==
+      GNUNET_CONTAINER_multipeermap_contains (client->connectmap, neighbour));
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multipeermap_put (
+                     client->connectmap,
+                     neighbour,
+                     NULL,
+                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    env = GNUNET_MQ_msg (cnm, GNUNET_MESSAGE_TYPE_CORE_NOTIFY_CONNECT);
+    cnm->reserved = htonl (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sending NOTIFY_CONNECT message about peer %s to client.\n",
+                GNUNET_i2s (neighbour));
+    cnm->peer = *neighbour;
+    GNUNET_MQ_send (client->mq, env);
+  }
+  else
+  {
+    struct DisconnectNotifyMessage *dcm;
+
+    /* send disconnect */
+    GNUNET_assert (
+      GNUNET_YES ==
+      GNUNET_CONTAINER_multipeermap_contains (client->connectmap, neighbour));
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multipeermap_remove (client->connectmap,
+                                                         neighbour,
+                                                         NULL));
+    env = GNUNET_MQ_msg (dcm, GNUNET_MESSAGE_TYPE_CORE_NOTIFY_DISCONNECT);
+    dcm->reserved = htonl (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sending NOTIFY_DISCONNECT message about peer %s to client.\n",
+                GNUNET_i2s (neighbour));
+    dcm->peer = *neighbour;
+    GNUNET_MQ_send (client->mq, env);
+  }
+}
+
+
+/**
+ * Notify all clients about a change to existing session.
+ * Called from SESSIONS whenever there is a change in sessions
+ * or types processed by the respective peer.
+ *
+ * @param neighbour identity of the neighbour that changed status
+ * @param tmap_old previous type map for the neighbour, NULL for connect
+ * @param tmap_new updated type map for the neighbour, NULL for disconnect
+ */
+void
+GSC_CLIENTS_notify_clients_about_neighbour (
+  const struct GNUNET_PeerIdentity *neighbour,
+  const struct GSC_TypeMap *tmap_old,
+  const struct GSC_TypeMap *tmap_new)
+{
+  struct GSC_Client *c;
+
+  for (c = client_head; NULL != c; c = c->next)
+    GSC_CLIENTS_notify_client_about_neighbour (c,
+                                               neighbour,
+                                               tmap_old,
+                                               tmap_new);
+}
+
+
+/**
+ * Deliver P2P message to interested clients.  Caller must have checked
+ * that the sending peer actually lists the given message type as one
+ * of its types.
+ *
+ * @param sender peer who sent us the message
+ * @param msg the message
+ * @param msize number of bytes to transmit
+ * @param options options for checking which clients should
+ *        receive the message
+ */
+void
+GSC_CLIENTS_deliver_message (const struct GNUNET_PeerIdentity *sender,
+                             const struct GNUNET_MessageHeader *msg,
+                             uint16_t msize,
+                             uint32_t options)
+{
+  size_t size = msize + sizeof(struct NotifyTrafficMessage);
+
+  if (size >= GNUNET_MAX_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  if (! ((0 != (all_client_options & options)) ||
+         (0 != (options & GNUNET_CORE_OPTION_SEND_FULL_INBOUND))))
+    return; /* no client cares about this message notification */
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Core service passes message from `%s' of type %u to client.\n",
+              GNUNET_i2s (sender),
+              (unsigned int) ntohs (msg->type));
+  GSC_SESSIONS_add_to_typemap (sender, ntohs (msg->type));
+
+  for (struct GSC_Client *c = client_head; NULL != c; c = c->next)
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct NotifyTrafficMessage *ntm;
+    uint16_t mtype;
+    unsigned int qlen;
+    int tm;
+
+    tm = type_match (ntohs (msg->type), c);
+    if (! ((0 != (c->options & options)) ||
+           ((0 != (options & GNUNET_CORE_OPTION_SEND_FULL_INBOUND)) &&
+            (GNUNET_YES == tm))))
+      continue;   /* neither options nor type match permit the message */
+    if ((0 != (options & GNUNET_CORE_OPTION_SEND_HDR_INBOUND)) &&
+        ((0 != (c->options & GNUNET_CORE_OPTION_SEND_FULL_INBOUND)) ||
+         (GNUNET_YES == tm)))
+      continue;
+    if ((0 != (options & GNUNET_CORE_OPTION_SEND_HDR_OUTBOUND)) &&
+        (0 != (c->options & GNUNET_CORE_OPTION_SEND_FULL_OUTBOUND)))
+      continue;
+
+    /* Drop messages if:
+       1) We are above the hard limit, or
+       2) We are above the soft limit, and a coin toss limited
+          to the message size (giving larger messages a
+          proportionally higher chance of being queued) falls
+          below the threshold. The threshold is based on where
+          we are between the soft and the hard limit, scaled
+          to match the range of message sizes we usually encounter
+          (i.e. up to 32k); so a 64k message has a 50% chance of
+          being kept if we are just barely below the hard max,
+          and a 99% chance of being kept if we are at the soft max.
+       The reason is to make it more likely to drop control traffic
+       (ACK, queries) which may be cumulative or highly redundant,
+       and cheap to drop than data traffic.  */qlen = GNUNET_MQ_get_length (c->mq);
+    if ((qlen >= HARD_MAX_QUEUE) ||
+        ((qlen > SOFT_MAX_QUEUE) &&
+         ((GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                     ntohs (msg->size))) <
+          (qlen - SOFT_MAX_QUEUE) * 0x8000
+          / (HARD_MAX_QUEUE - SOFT_MAX_QUEUE))))
+    {
+      char buf[1024];
+
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_INFO | GNUNET_ERROR_TYPE_BULK,
+        "Dropping decrypted message of type %u as client is too busy (queue full)\n",
+        (unsigned int) ntohs (msg->type));
+      GNUNET_snprintf (buf,
+                       sizeof(buf),
+                       gettext_noop (
+                         "# messages of type %u discarded (client busy)"),
+                       (unsigned int) ntohs (msg->type));
+      GNUNET_STATISTICS_update (GSC_stats, buf, 1, GNUNET_NO);
+      continue;
+    }
+
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_DEBUG,
+      "Sending %u message with %u bytes to client interested in messages of type %u.\n",
+      options,
+      ntohs (msg->size),
+      (unsigned int) ntohs (msg->type));
+
+    if (0 != (options & (GNUNET_CORE_OPTION_SEND_FULL_INBOUND
+                         | GNUNET_CORE_OPTION_SEND_HDR_INBOUND)))
+      mtype = GNUNET_MESSAGE_TYPE_CORE_NOTIFY_INBOUND;
+    else
+      mtype = GNUNET_MESSAGE_TYPE_CORE_NOTIFY_OUTBOUND;
+    env = GNUNET_MQ_msg_extra (ntm, msize, mtype);
+    ntm->peer = *sender;
+    GNUNET_memcpy (&ntm[1], msg, msize);
+
+    GNUNET_assert (
+      (0 == (c->options & GNUNET_CORE_OPTION_SEND_FULL_INBOUND)) ||
+      (GNUNET_YES != tm) ||
+      (GNUNET_YES ==
+       GNUNET_CONTAINER_multipeermap_contains (c->connectmap, sender)));
+    GNUNET_MQ_send (c->mq, env);
+  }
+}
+
+
+/**
+ * Last task run during shutdown.  Disconnects us from
+ * the transport.
+ *
+ * @param cls NULL, unused
+ */
+static void
+shutdown_task (void *cls)
+{
+  struct GSC_Client *c;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Core service shutting down.\n");
+  while (NULL != (c = client_head))
+    GNUNET_SERVICE_client_drop (c->client);
+  GSC_SESSIONS_done ();
+  GSC_KX_done ();
+  GSC_TYPEMAP_done ();
+  if (NULL != GSC_stats)
+  {
+    GNUNET_STATISTICS_destroy (GSC_stats, GNUNET_NO);
+    GSC_stats = NULL;
+  }
+  GSC_cfg = NULL;
+}
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_MONITOR_PEERS request.  For this
+ * request type, the client does not have to have transmitted an INIT
+ * request.  All current peers are returned, regardless of which
+ * message types they accept.
+ *
+ * @param cls client sending the iteration request
+ * @param message iteration request message
+ */
+static void
+handle_client_monitor_peers (void *cls,
+                             const struct GNUNET_MessageHeader *message)
+{
+  struct GSC_Client *c = cls;
+
+  GNUNET_SERVICE_client_continue (c->client);
+  GSC_KX_handle_client_monitor_peers (c->mq);
+}
+
+
+/**
+ * Initiate core service.
+ *
+ * @param cls closure
+ * @param c configuration to use
+ * @param service the initialized service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *c,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
+  char *keyfile;
+
+  GSC_cfg = c;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (GSC_cfg,
+                                               "PEER",
+                                               "PRIVATE_KEY",
+                                               &keyfile))
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_ERROR,
+      _ ("Core service is lacking HOSTKEY configuration setting.  Exiting.\n"));
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GSC_stats = GNUNET_STATISTICS_create ("core", GSC_cfg);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+  GNUNET_SERVICE_suspend (service);
+  GSC_TYPEMAP_init ();
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                         GNUNET_YES,
+                                         &pk))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to setup peer's private key\n");
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (keyfile);
+    return;
+  }
+  GNUNET_free (keyfile);
+  if (GNUNET_OK != GSC_KX_init (&pk))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GSC_SESSIONS_init ();
+  GNUNET_SERVICE_resume (service);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("Core service of `%s' ready.\n"),
+              GNUNET_i2s (&GSC_my_identity));
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN (
+  "core",
+  GNUNET_SERVICE_OPTION_NONE,
+  &run,
+  &client_connect_cb,
+  &client_disconnect_cb,
+  NULL,
+  GNUNET_MQ_hd_var_size (client_init,
+                         GNUNET_MESSAGE_TYPE_CORE_INIT,
+                         struct InitMessage,
+                         NULL),
+  GNUNET_MQ_hd_fixed_size (client_monitor_peers,
+                           GNUNET_MESSAGE_TYPE_CORE_MONITOR_PEERS,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_send_request,
+                           GNUNET_MESSAGE_TYPE_CORE_SEND_REQUEST,
+                           struct SendMessageRequest,
+                           NULL),
+  GNUNET_MQ_hd_var_size (client_send,
+                         GNUNET_MESSAGE_TYPE_CORE_SEND,
+                         struct SendMessage,
+                         NULL),
+  GNUNET_MQ_handler_end ());
+
+
+/* end of gnunet-service-core.c */
diff --git a/src/service/core/gnunet-service-core.h b/src/service/core/gnunet-service-core.h
new file mode 100644
index 000000000..0f71f221a
--- /dev/null
+++ b/src/service/core/gnunet-service-core.h
@@ -0,0 +1,198 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core.h
+ * @brief Globals for gnunet-service-core
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_CORE_H
+#define GNUNET_SERVICE_CORE_H
+
+#include "gnunet_statistics_service.h"
+#include "gnunet_core_service.h"
+#include "core.h"
+#include "gnunet-service-core_typemap.h"
+
+
+/**
+ * Opaque handle to a client.
+ */
+struct GSC_Client;
+
+
+/**
+ * Record kept for each request for transmission issued by a
+ * client that is still pending. (This struct is used by
+ * both the 'CLIENTS' and 'SESSIONS' subsystems.)
+ */
+struct GSC_ClientActiveRequest
+{
+  /**
+   * Active requests are kept in a doubly-linked list of
+   * the respective target peer.
+   */
+  struct GSC_ClientActiveRequest *next;
+
+  /**
+   * Active requests are kept in a doubly-linked list of
+   * the respective target peer.
+   */
+  struct GSC_ClientActiveRequest *prev;
+
+  /**
+   * Handle to the client.
+   */
+  struct GSC_Client *client_handle;
+
+  /**
+   * Which peer is the message going to be for?
+   */
+  struct GNUNET_PeerIdentity target;
+
+  /**
+   * At what time did we first see this request?
+   */
+  struct GNUNET_TIME_Absolute received_time;
+
+  /**
+   * By what time would the client want to see this message out?
+   */
+  struct GNUNET_TIME_Absolute deadline;
+
+  /**
+   * How important is this request.
+   */
+  enum GNUNET_MQ_PriorityPreferences priority;
+
+  /**
+   * Has this request been solicited yet?
+   */
+  int was_solicited;
+
+  /**
+   * How many bytes does the client intend to send?
+   */
+  uint16_t msize;
+
+  /**
+   * Unique request ID (in big endian).
+   */
+  uint16_t smr_id;
+};
+
+
+/**
+ * Tell a client that we are ready to receive the message.
+ *
+ * @param car request that is now ready; the responsibility
+ *        for the handle remains shared between CLIENTS
+ *        and SESSIONS after this call.
+ */
+void
+GSC_CLIENTS_solicit_request (struct GSC_ClientActiveRequest *car);
+
+
+/**
+ * We will never be ready to transmit the given message in (disconnect
+ * or invalid request).  Frees resources associated with @a car.  We
+ * don't explicitly tell the client, it'll learn with the disconnect
+ * (or violated the protocol).
+ *
+ * @param car request that now permanently failed; the
+ *        responsibility for the handle is now returned
+ *        to CLIENTS (SESSIONS is done with it).
+ * @param drop_client #GNUNET_YES if the client violated the protocol
+ *        and we should thus drop the connection
+ */
+void
+GSC_CLIENTS_reject_request (struct GSC_ClientActiveRequest *car,
+                            int drop_client);
+
+
+/**
+ * Notify a particular client about a change to existing connection to
+ * one of our neighbours (check if the client is interested).  Called
+ * from #GSC_SESSIONS_notify_client_about_sessions().
+ *
+ * @param client client to notify
+ * @param neighbour identity of the neighbour that changed status
+ * @param tmap_old previous type map for the neighbour, NULL for connect
+ * @param tmap_new updated type map for the neighbour, NULL for disconnect
+ */
+void
+GSC_CLIENTS_notify_client_about_neighbour (
+  struct GSC_Client *client,
+  const struct GNUNET_PeerIdentity *neighbour,
+  const struct GSC_TypeMap *tmap_old,
+  const struct GSC_TypeMap *tmap_new);
+
+
+/**
+ * Deliver P2P message to interested clients.  Caller must have checked
+ * that the sending peer actually lists the given message type as one
+ * of its types.
+ *
+ * @param sender peer who sent us the message
+ * @param msg the message
+ * @param msize number of bytes to transmit
+ * @param options options for checking which clients should
+ *        receive the message
+ */
+void
+GSC_CLIENTS_deliver_message (const struct GNUNET_PeerIdentity *sender,
+                             const struct GNUNET_MessageHeader *msg,
+                             uint16_t msize,
+                             uint32_t options);
+
+
+/**
+ * Notify all clients about a change to existing session.
+ * Called from SESSIONS whenever there is a change in sessions
+ * or types processed by the respective peer.
+ *
+ * @param neighbour identity of the neighbour that changed status
+ * @param tmap_old previous type map for the neighbour, NULL for connect
+ * @param tmap_new updated type map for the neighbour, NULL for disconnect
+ */
+void
+GSC_CLIENTS_notify_clients_about_neighbour (
+  const struct GNUNET_PeerIdentity *neighbour,
+  const struct GSC_TypeMap *tmap_old,
+  const struct GSC_TypeMap *tmap_new);
+
+
+/**
+ * Our configuration.
+ */
+extern const struct GNUNET_CONFIGURATION_Handle *GSC_cfg;
+
+/**
+ * For creating statistics.
+ */
+extern struct GNUNET_STATISTICS_Handle *GSC_stats;
+
+/**
+ * Our identity.
+ */
+extern struct GNUNET_PeerIdentity GSC_my_identity;
+
+
+#endif
diff --git a/src/service/core/gnunet-service-core_kx.c b/src/service/core/gnunet-service-core_kx.c
new file mode 100644
index 000000000..ca7bccbd9
--- /dev/null
+++ b/src/service/core/gnunet-service-core_kx.c
@@ -0,0 +1,1934 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2013, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_kx.c
+ * @brief code for managing the key exchange (SET_KEY, PING, PONG) with other
+ * peers
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet-service-core_kx.h"
+#include "gnunet_transport_core_service.h"
+#include "gnunet-service-core_sessions.h"
+#include "gnunet-service-core.h"
+#include "gnunet_constants.h"
+#include "gnunet_signatures.h"
+#include "gnunet_protocols.h"
+
+/**
+ * Enable expensive (and possibly problematic for privacy!) logging of KX.
+ */
+#define DEBUG_KX 0
+
+/**
+ * How long do we wait for SET_KEY confirmation initially?
+ */
+#define INITIAL_SET_KEY_RETRY_FREQUENCY \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
+
+/**
+ * What is the minimum frequency for a PING message?
+ */
+#define MIN_PING_FREQUENCY \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
+
+/**
+ * How often do we rekey?
+ */
+#define REKEY_FREQUENCY \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 12)
+
+/**
+ * What time difference do we tolerate?
+ */
+#define REKEY_TOLERANCE \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
+
+/**
+ * What is the maximum age of a message for us to consider processing
+ * it?  Note that this looks at the timestamp used by the other peer,
+ * so clock skew between machines does come into play here.  So this
+ * should be picked high enough so that a little bit of clock skew
+ * does not prevent peers from connecting to us.
+ */
+#define MAX_MESSAGE_AGE GNUNET_TIME_UNIT_DAYS
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Encapsulation for encrypted messages exchanged between
+ * peers.  Followed by the actual encrypted data.
+ */
+struct EncryptedMessage
+{
+  /**
+   * Message type is #GNUNET_MESSAGE_TYPE_CORE_ENCRYPTED_MESSAGE.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Random value used for IV generation.
+   */
+  uint32_t iv_seed GNUNET_PACKED;
+
+  /**
+   * MAC of the encrypted message (starting at @e sequence_number),
+   * used to verify message integrity. Everything after this value
+   * (excluding this value itself) will be encrypted and
+   * authenticated.  #ENCRYPTED_HEADER_SIZE must be set to the offset
+   * of the *next* field.
+   */
+  struct GNUNET_HashCode hmac;
+
+  /**
+   * Sequence number, in network byte order.  This field
+   * must be the first encrypted/decrypted field
+   */
+  uint32_t sequence_number GNUNET_PACKED;
+
+  /**
+   * Reserved, always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * Timestamp.  Used to prevent replay of ancient messages
+   * (recent messages are caught with the sequence number).
+   */
+  struct GNUNET_TIME_AbsoluteNBO timestamp;
+};
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Number of bytes (at the beginning) of `struct EncryptedMessage`
+ * that are NOT encrypted.
+ */
+#define ENCRYPTED_HEADER_SIZE \
+  (offsetof (struct EncryptedMessage, sequence_number))
+
+
+/**
+ * Information about the status of a key exchange with another peer.
+ */
+struct GSC_KeyExchangeInfo
+{
+  /**
+   * DLL.
+   */
+  struct GSC_KeyExchangeInfo *next;
+
+  /**
+   * DLL.
+   */
+  struct GSC_KeyExchangeInfo *prev;
+
+  /**
+   * Identity of the peer.
+   */
+  const struct GNUNET_PeerIdentity *peer;
+
+  /**
+   * Message queue for sending messages to @a peer.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Our message stream tokenizer (for encrypted payload).
+   */
+  struct GNUNET_MessageStreamTokenizer *mst;
+
+  /**
+   * PING message we transmit to the other peer.
+   */
+  struct PingMessage ping;
+
+  /**
+   * Ephemeral public ECC key of the other peer.
+   */
+  struct GNUNET_CRYPTO_EcdhePublicKey other_ephemeral_key;
+
+  /**
+   * Key we use to encrypt our messages for the other peer
+   * (initialized by us when we do the handshake).
+   */
+  struct GNUNET_CRYPTO_SymmetricSessionKey encrypt_key;
+
+  /**
+   * Key we use to decrypt messages from the other peer
+   * (given to us by the other peer during the handshake).
+   */
+  struct GNUNET_CRYPTO_SymmetricSessionKey decrypt_key;
+
+  /**
+   * At what time did the other peer generate the decryption key?
+   */
+  struct GNUNET_TIME_Absolute foreign_key_expires;
+
+  /**
+   * When should the session time out (if there are no PONGs)?
+   */
+  struct GNUNET_TIME_Absolute timeout;
+
+  /**
+   * What was the last timeout we informed our monitors about?
+   */
+  struct GNUNET_TIME_Absolute last_notify_timeout;
+
+  /**
+   * At what frequency are we currently re-trying SET_KEY messages?
+   */
+  struct GNUNET_TIME_Relative set_key_retry_frequency;
+
+  /**
+   * ID of task used for re-trying SET_KEY and PING message.
+   */
+  struct GNUNET_SCHEDULER_Task *retry_set_key_task;
+
+  /**
+   * ID of task used for sending keep-alive pings.
+   */
+  struct GNUNET_SCHEDULER_Task *keep_alive_task;
+
+  /**
+   * Bit map indicating which of the 32 sequence numbers before the
+   * last were received (good for accepting out-of-order packets and
+   * estimating reliability of the connection)
+   */
+  uint32_t last_packets_bitmap;
+
+  /**
+   * last sequence number received on this connection (highest)
+   */
+  uint32_t last_sequence_number_received;
+
+  /**
+   * last sequence number transmitted
+   */
+  uint32_t last_sequence_number_sent;
+
+  /**
+   * What was our PING challenge number (for this peer)?
+   */
+  uint32_t ping_challenge;
+
+  /**
+   * #GNUNET_YES if this peer currently has excess bandwidth.
+   */
+  int has_excess_bandwidth;
+
+  /**
+   * What is our connection status?
+   */
+  enum GNUNET_CORE_KxState status;
+};
+
+
+/**
+ * Transport service.
+ */
+static struct GNUNET_TRANSPORT_CoreHandle *transport;
+
+/**
+ * Our private key.
+ */
+static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
+
+/**
+ * Our ephemeral private key.
+ */
+static struct GNUNET_CRYPTO_EcdhePrivateKey my_ephemeral_key;
+
+/**
+ * Current message we send for a key exchange.
+ */
+static struct EphemeralKeyMessage current_ekm;
+
+/**
+ * DLL head.
+ */
+static struct GSC_KeyExchangeInfo *kx_head;
+
+/**
+ * DLL tail.
+ */
+static struct GSC_KeyExchangeInfo *kx_tail;
+
+/**
+ * Task scheduled for periodic re-generation (and thus rekeying) of our
+ * ephemeral key.
+ */
+static struct GNUNET_SCHEDULER_Task *rekey_task;
+
+/**
+ * Notification context for broadcasting to monitors.
+ */
+static struct GNUNET_NotificationContext *nc;
+
+
+/**
+ * Calculate seed value we should use for a message.
+ *
+ * @param kx key exchange context
+ */
+static uint32_t
+calculate_seed (struct GSC_KeyExchangeInfo *kx)
+{
+  /* Note: may want to make this non-random and instead
+     derive from key material to avoid having an undetectable
+     side-channel */
+  return htonl (
+    GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, UINT32_MAX));
+}
+
+
+/**
+ * Inform all monitors about the KX state of the given peer.
+ *
+ * @param kx key exchange state to inform about
+ */
+static void
+monitor_notify_all (struct GSC_KeyExchangeInfo *kx)
+{
+  struct MonitorNotifyMessage msg;
+
+  msg.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
+  msg.header.size = htons (sizeof(msg));
+  msg.state = htonl ((uint32_t) kx->status);
+  msg.peer = *kx->peer;
+  msg.timeout = GNUNET_TIME_absolute_hton (kx->timeout);
+  GNUNET_notification_context_broadcast (nc, &msg.header, GNUNET_NO);
+  kx->last_notify_timeout = kx->timeout;
+}
+
+
+/**
+ * Derive an authentication key from "set key" information
+ *
+ * @param akey authentication key to derive
+ * @param skey session key to use
+ * @param seed seed to use
+ */
+static void
+derive_auth_key (struct GNUNET_CRYPTO_AuthKey *akey,
+                 const struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+                 uint32_t seed)
+{
+  static const char ctx[] = "authentication key";
+
+#if DEBUG_KX
+  struct GNUNET_HashCode sh;
+
+  GNUNET_CRYPTO_hash (skey, sizeof(*skey), &sh);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Deriving Auth key from SKEY %s and seed %u\n",
+              GNUNET_h2s (&sh),
+              (unsigned int) seed);
+#endif
+  GNUNET_CRYPTO_hmac_derive_key (akey,
+                                 skey,
+                                 &seed,
+                                 sizeof(seed),
+                                 skey,
+                                 sizeof(
+                                   struct GNUNET_CRYPTO_SymmetricSessionKey),
+                                 ctx,
+                                 sizeof(ctx),
+                                 NULL);
+}
+
+
+/**
+ * Derive an IV from packet information
+ *
+ * @param iv initialization vector to initialize
+ * @param skey session key to use
+ * @param seed seed to use
+ * @param identity identity of the other peer to use
+ */
+static void
+derive_iv (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+           const struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+           uint32_t seed,
+           const struct GNUNET_PeerIdentity *identity)
+{
+  static const char ctx[] = "initialization vector";
+
+#if DEBUG_KX
+  struct GNUNET_HashCode sh;
+
+  GNUNET_CRYPTO_hash (skey, sizeof(*skey), &sh);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Deriving IV from SKEY %s and seed %u for peer %s\n",
+              GNUNET_h2s (&sh),
+              (unsigned int) seed,
+              GNUNET_i2s (identity));
+#endif
+  GNUNET_CRYPTO_symmetric_derive_iv (iv,
+                                     skey,
+                                     &seed,
+                                     sizeof(seed),
+                                     identity,
+                                     sizeof(struct GNUNET_PeerIdentity),
+                                     ctx,
+                                     sizeof(ctx),
+                                     NULL);
+}
+
+
+/**
+ * Derive an IV from pong packet information
+ *
+ * @param iv initialization vector to initialize
+ * @param skey session key to use
+ * @param seed seed to use
+ * @param challenge nonce to use
+ * @param identity identity of the other peer to use
+ */
+static void
+derive_pong_iv (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+                const struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+                uint32_t seed,
+                uint32_t challenge,
+                const struct GNUNET_PeerIdentity *identity)
+{
+  static const char ctx[] = "pong initialization vector";
+
+#if DEBUG_KX
+  struct GNUNET_HashCode sh;
+
+  GNUNET_CRYPTO_hash (skey, sizeof(*skey), &sh);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Deriving PONG IV from SKEY %s and seed %u/%u for %s\n",
+              GNUNET_h2s (&sh),
+              (unsigned int) seed,
+              (unsigned int) challenge,
+              GNUNET_i2s (identity));
+#endif
+  GNUNET_CRYPTO_symmetric_derive_iv (iv,
+                                     skey,
+                                     &seed,
+                                     sizeof(seed),
+                                     identity,
+                                     sizeof(struct GNUNET_PeerIdentity),
+                                     &challenge,
+                                     sizeof(challenge),
+                                     ctx,
+                                     sizeof(ctx),
+                                     NULL);
+}
+
+
+/**
+ * Derive an AES key from key material
+ *
+ * @param sender peer identity of the sender
+ * @param receiver peer identity of the sender
+ * @param key_material high entropy key material to use
+ * @param skey set to derived session key
+ */
+static void
+derive_aes_key (const struct GNUNET_PeerIdentity *sender,
+                const struct GNUNET_PeerIdentity *receiver,
+                const struct GNUNET_HashCode *key_material,
+                struct GNUNET_CRYPTO_SymmetricSessionKey *skey)
+{
+  static const char ctx[] = "aes key generation vector";
+
+#if DEBUG_KX
+  struct GNUNET_HashCode sh;
+
+  GNUNET_CRYPTO_hash (skey, sizeof(*skey), &sh);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Deriving AES Keys for %s to %s from %s\n",
+              GNUNET_i2s (sender),
+              GNUNET_i2s2 (receiver),
+              GNUNET_h2s (key_material));
+#endif
+  GNUNET_CRYPTO_kdf (skey,
+                     sizeof(struct GNUNET_CRYPTO_SymmetricSessionKey),
+                     ctx,
+                     sizeof(ctx),
+                     key_material,
+                     sizeof(struct GNUNET_HashCode),
+                     sender,
+                     sizeof(struct GNUNET_PeerIdentity),
+                     receiver,
+                     sizeof(struct GNUNET_PeerIdentity),
+                     NULL);
+}
+
+
+/**
+ * Encrypt size bytes from @a in and write the result to @a out.  Use the
+ * @a kx key for outbound traffic of the given neighbour.
+ *
+ * @param kx key information context
+ * @param iv initialization vector to use
+ * @param in ciphertext
+ * @param out plaintext
+ * @param size size of @a in / @a out
+ *
+ * @return #GNUNET_OK on success
+ */
+static int
+do_encrypt (struct GSC_KeyExchangeInfo *kx,
+            const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+            const void *in,
+            void *out,
+            size_t size)
+{
+  if (size != (uint16_t) size)
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+  GNUNET_assert (size == GNUNET_CRYPTO_symmetric_encrypt (in,
+                                                          (uint16_t) size,
+                                                          &kx->encrypt_key,
+                                                          iv,
+                                                          out));
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# bytes encrypted"),
+                            size,
+                            GNUNET_NO);
+  /* the following is too sensitive to write to log files by accident,
+     so we require manual intervention to get this one... */
+#if DEBUG_KX
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Encrypted %u bytes for `%s' using key %s, IV %u\n",
+              (unsigned int) size,
+              GNUNET_i2s (kx->peer),
+              kx->encrypt_key.aes_key,
+              GNUNET_CRYPTO_crc32_n (iv, sizeof(iv)));
+#endif
+  return GNUNET_OK;
+}
+
+
+/**
+ * Decrypt size bytes from @a in and write the result to @a out.  Use
+ * the @a kx key for inbound traffic of the given neighbour.  This
+ * function does NOT do any integrity-checks on the result.
+ *
+ * @param kx key information context
+ * @param iv initialization vector to use
+ * @param in ciphertext
+ * @param out plaintext
+ * @param size size of @a in / @a out
+ * @return #GNUNET_OK on success
+ */
+static int
+do_decrypt (struct GSC_KeyExchangeInfo *kx,
+            const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv,
+            const void *in,
+            void *out,
+            size_t size)
+{
+  if (size != (uint16_t) size)
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+  if ((kx->status != GNUNET_CORE_KX_STATE_KEY_RECEIVED) &&
+      (kx->status != GNUNET_CORE_KX_STATE_UP) &&
+      (kx->status != GNUNET_CORE_KX_STATE_REKEY_SENT))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (size != GNUNET_CRYPTO_symmetric_decrypt (in,
+                                               (uint16_t) size,
+                                               &kx->decrypt_key,
+                                               iv,
+                                               out))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# bytes decrypted"),
+                            size,
+                            GNUNET_NO);
+  /* the following is too sensitive to write to log files by accident,
+     so we require manual intervention to get this one... */
+#if DEBUG_KX
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Decrypted %u bytes from `%s' using key %s, IV %u\n",
+              (unsigned int) size,
+              GNUNET_i2s (kx->peer),
+              kx->decrypt_key.aes_key,
+              GNUNET_CRYPTO_crc32_n (iv, sizeof(*iv)));
+#endif
+  return GNUNET_OK;
+}
+
+
+/**
+ * Send our key (and encrypted PING) to the other peer.
+ *
+ * @param kx key exchange context
+ */
+static void
+send_key (struct GSC_KeyExchangeInfo *kx);
+
+
+/**
+ * Task that will retry #send_key() if our previous attempt failed.
+ *
+ * @param cls our `struct GSC_KeyExchangeInfo`
+ */
+static void
+set_key_retry_task (void *cls)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+
+  kx->retry_set_key_task = NULL;
+  kx->set_key_retry_frequency =
+    GNUNET_TIME_STD_BACKOFF (kx->set_key_retry_frequency);
+  GNUNET_assert (GNUNET_CORE_KX_STATE_DOWN != kx->status);
+  send_key (kx);
+}
+
+
+/**
+ * Create a fresh PING message for transmission to the other peer.
+ *
+ * @param kx key exchange context to create PING for
+ */
+static void
+setup_fresh_ping (struct GSC_KeyExchangeInfo *kx)
+{
+  struct PingMessage pp;
+  struct PingMessage *pm;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+
+  pm = &kx->ping;
+  kx->ping_challenge =
+    GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, UINT32_MAX);
+  pm->header.size = htons (sizeof(struct PingMessage));
+  pm->header.type = htons (GNUNET_MESSAGE_TYPE_CORE_PING);
+  pm->iv_seed = calculate_seed (kx);
+  derive_iv (&iv, &kx->encrypt_key, pm->iv_seed, kx->peer);
+  pp.challenge = kx->ping_challenge;
+  pp.target = *kx->peer;
+  do_encrypt (kx,
+              &iv,
+              &pp.target,
+              &pm->target,
+              sizeof(struct PingMessage)
+              - ((void *) &pm->target - (void *) pm));
+}
+
+
+/**
+ * Deliver P2P message to interested clients.  Invokes send twice,
+ * once for clients that want the full message, and once for clients
+ * that only want the header
+ *
+ * @param cls the `struct GSC_KeyExchangeInfo`
+ * @param m the message
+ * @return #GNUNET_OK on success,
+ *    #GNUNET_NO to stop further processing (no error)
+ *    #GNUNET_SYSERR to stop further processing with error
+ */
+static int
+deliver_message (void *cls, const struct GNUNET_MessageHeader *m)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Decrypted message of type %d from %s\n",
+              ntohs (m->type),
+              GNUNET_i2s (kx->peer));
+  if (GNUNET_CORE_KX_STATE_UP != kx->status)
+  {
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# PAYLOAD dropped (out of order)"),
+                              1,
+                              GNUNET_NO);
+    return GNUNET_OK;
+  }
+  switch (ntohs (m->type))
+  {
+  case GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP:
+  case GNUNET_MESSAGE_TYPE_CORE_COMPRESSED_TYPE_MAP:
+    GSC_SESSIONS_set_typemap (kx->peer, m);
+    return GNUNET_OK;
+
+  case GNUNET_MESSAGE_TYPE_CORE_CONFIRM_TYPE_MAP:
+    GSC_SESSIONS_confirm_typemap (kx->peer, m);
+    return GNUNET_OK;
+
+  default:
+    GSC_CLIENTS_deliver_message (kx->peer,
+                                 m,
+                                 ntohs (m->size),
+                                 GNUNET_CORE_OPTION_SEND_FULL_INBOUND);
+    GSC_CLIENTS_deliver_message (kx->peer,
+                                 m,
+                                 sizeof(struct GNUNET_MessageHeader),
+                                 GNUNET_CORE_OPTION_SEND_HDR_INBOUND);
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called by transport to notify us that
+ * a peer connected to us (on the network level).
+ * Starts the key exchange with the given peer.
+ *
+ * @param cls closure (NULL)
+ * @param pid identity of the peer to do a key exchange with
+ * @return key exchange information context
+ */
+static void *
+handle_transport_notify_connect (void *cls,
+                                 const struct GNUNET_PeerIdentity *pid,
+                                 struct GNUNET_MQ_Handle *mq)
+{
+  struct GSC_KeyExchangeInfo *kx;
+  struct GNUNET_HashCode h1;
+  struct GNUNET_HashCode h2;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Initiating key exchange with `%s'\n",
+              GNUNET_i2s (pid));
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# key exchanges initiated"),
+                            1,
+                            GNUNET_NO);
+  kx = GNUNET_new (struct GSC_KeyExchangeInfo);
+  kx->mst = GNUNET_MST_create (&deliver_message, kx);
+  kx->mq = mq;
+  kx->peer = pid;
+  kx->set_key_retry_frequency = INITIAL_SET_KEY_RETRY_FREQUENCY;
+  GNUNET_CONTAINER_DLL_insert (kx_head, kx_tail, kx);
+  kx->status = GNUNET_CORE_KX_STATE_KEY_SENT;
+  monitor_notify_all (kx);
+  GNUNET_CRYPTO_hash (pid, sizeof(struct GNUNET_PeerIdentity), &h1);
+  GNUNET_CRYPTO_hash (&GSC_my_identity,
+                      sizeof(struct GNUNET_PeerIdentity),
+                      &h2);
+  if (0 < GNUNET_CRYPTO_hash_cmp (&h1, &h2))
+  {
+    /* peer with "lower" identity starts KX, otherwise we typically end up
+       with both peers starting the exchange and transmit the 'set key'
+       message twice */
+    send_key (kx);
+  }
+  else
+  {
+    /* peer with "higher" identity starts a delayed KX, if the "lower" peer
+     * does not start a KX since it sees no reasons to do so  */
+    kx->retry_set_key_task =
+      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                    &set_key_retry_task,
+                                    kx);
+  }
+  return kx;
+}
+
+
+/**
+ * Function called by transport telling us that a peer
+ * disconnected.
+ * Stop key exchange with the given peer.  Clean up key material.
+ *
+ * @param cls closure
+ * @param peer the peer that disconnected
+ * @param handler_cls the `struct GSC_KeyExchangeInfo` of the peer
+ */
+static void
+handle_transport_notify_disconnect (void *cls,
+                                    const struct GNUNET_PeerIdentity *peer,
+                                    void *handler_cls)
+{
+  struct GSC_KeyExchangeInfo *kx = handler_cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Peer `%s' disconnected from us.\n",
+              GNUNET_i2s (peer));
+  GSC_SESSIONS_end (kx->peer);
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# key exchanges stopped"),
+                            1,
+                            GNUNET_NO);
+  if (NULL != kx->retry_set_key_task)
+  {
+    GNUNET_SCHEDULER_cancel (kx->retry_set_key_task);
+    kx->retry_set_key_task = NULL;
+  }
+  if (NULL != kx->keep_alive_task)
+  {
+    GNUNET_SCHEDULER_cancel (kx->keep_alive_task);
+    kx->keep_alive_task = NULL;
+  }
+  kx->status = GNUNET_CORE_KX_PEER_DISCONNECT;
+  monitor_notify_all (kx);
+  GNUNET_CONTAINER_DLL_remove (kx_head, kx_tail, kx);
+  GNUNET_MST_destroy (kx->mst);
+  GNUNET_free (kx);
+}
+
+
+/**
+ * Send our PING to the other peer.
+ *
+ * @param kx key exchange context
+ */
+static void
+send_ping (struct GSC_KeyExchangeInfo *kx)
+{
+  struct GNUNET_MQ_Envelope *env;
+
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# PING messages transmitted"),
+                            1,
+                            GNUNET_NO);
+  env = GNUNET_MQ_msg_copy (&kx->ping.header);
+  GNUNET_MQ_send (kx->mq, env);
+}
+
+
+/**
+ * Derive fresh session keys from the current ephemeral keys.
+ *
+ * @param kx session to derive keys for
+ */
+static void
+derive_session_keys (struct GSC_KeyExchangeInfo *kx)
+{
+  struct GNUNET_HashCode key_material;
+
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecc_ecdh (&my_ephemeral_key,
+                              &kx->other_ephemeral_key,
+                              &key_material))
+  {
+    GNUNET_break (0);
+    return;
+  }
+  derive_aes_key (&GSC_my_identity, kx->peer, &key_material, &kx->encrypt_key);
+  derive_aes_key (kx->peer, &GSC_my_identity, &key_material, &kx->decrypt_key);
+  memset (&key_material, 0, sizeof(key_material));
+  /* fresh key, reset sequence numbers */
+  kx->last_sequence_number_received = 0;
+  kx->last_packets_bitmap = 0;
+  setup_fresh_ping (kx);
+}
+
+
+/**
+ * We received a #GNUNET_MESSAGE_TYPE_CORE_EPHEMERAL_KEY message.
+ * Validate and update our key material and status.
+ *
+ * @param cls key exchange status for the corresponding peer
+ * @param m the set key message we received
+ */
+static void
+handle_ephemeral_key (void *cls, const struct EphemeralKeyMessage *m)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+  struct GNUNET_TIME_Absolute start_t;
+  struct GNUNET_TIME_Absolute end_t;
+  struct GNUNET_TIME_Absolute now;
+  enum GNUNET_CORE_KxState sender_status;
+
+  end_t = GNUNET_TIME_absolute_ntoh (m->expiration_time);
+  if (((GNUNET_CORE_KX_STATE_KEY_RECEIVED == kx->status) ||
+       (GNUNET_CORE_KX_STATE_UP == kx->status) ||
+       (GNUNET_CORE_KX_STATE_REKEY_SENT == kx->status)) &&
+      (end_t.abs_value_us < kx->foreign_key_expires.abs_value_us))
+  {
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# old ephemeral keys ignored"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Received expired EPHEMERAL_KEY from %s\n",
+                GNUNET_i2s (&m->origin_identity));
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if (0 == memcmp (&m->ephemeral_key,
+                   &kx->other_ephemeral_key,
+                   sizeof(m->ephemeral_key)))
+  {
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# duplicate ephemeral keys ignored"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Ignoring duplicate EPHEMERAL_KEY from %s\n",
+                GNUNET_i2s (&m->origin_identity));
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if (0 != memcmp (&m->origin_identity,
+                   kx->peer,
+                   sizeof(struct GNUNET_PeerIdentity)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Received EPHEMERAL_KEY from %s, but expected %s\n",
+                GNUNET_i2s (&m->origin_identity),
+                GNUNET_i2s_full (kx->peer));
+    GNUNET_break_op (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if ((ntohl (m->purpose.size) !=
+       sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+       + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+       + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+       + sizeof(struct GNUNET_CRYPTO_EddsaPublicKey)
+       + sizeof(struct GNUNET_CRYPTO_EddsaPublicKey)) ||
+      (GNUNET_OK !=
+       GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_SET_ECC_KEY,
+                                    &m->purpose,
+                                    &m->signature,
+                                    &m->origin_identity.public_key)))
+  {
+    /* invalid signature */
+    GNUNET_break_op (0);
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# EPHEMERAL_KEYs rejected (bad signature)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Received EPHEMERAL_KEY from %s with bad signature\n",
+                GNUNET_i2s (&m->origin_identity));
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  now = GNUNET_TIME_absolute_get ();
+  start_t = GNUNET_TIME_absolute_ntoh (m->creation_time);
+  if ((end_t.abs_value_us <
+       GNUNET_TIME_absolute_subtract (now, REKEY_TOLERANCE).abs_value_us) ||
+      (start_t.abs_value_us >
+       GNUNET_TIME_absolute_add (now, REKEY_TOLERANCE).abs_value_us))
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_WARNING,
+      _ (
+        "EPHEMERAL_KEY from peer `%s' rejected as its validity range does not match our system time (%llu not in [%llu,%llu]).\n"),
+      GNUNET_i2s (kx->peer),
+      (unsigned long long) now.abs_value_us,
+      (unsigned long long) start_t.abs_value_us,
+      (unsigned long long) end_t.abs_value_us);
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# EPHEMERAL_KEY messages rejected due to time"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode eh;
+
+    GNUNET_CRYPTO_hash (&m->ephemeral_key, sizeof(m->ephemeral_key), &eh);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received valid EPHEMERAL_KEY `%s' from `%s' in state %d.\n",
+                GNUNET_h2s (&eh),
+                GNUNET_i2s (kx->peer),
+                kx->status);
+  }
+#endif
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# valid ephemeral keys received"),
+                            1,
+                            GNUNET_NO);
+  kx->other_ephemeral_key = m->ephemeral_key;
+  kx->foreign_key_expires = end_t;
+  derive_session_keys (kx);
+
+  /* check if we still need to send the sender our key */
+  sender_status = (enum GNUNET_CORE_KxState) ntohl (m->sender_status);
+  switch (sender_status)
+  {
+  case GNUNET_CORE_KX_STATE_DOWN:
+    GNUNET_break_op (0);
+    break;
+
+  case GNUNET_CORE_KX_STATE_KEY_SENT:
+    /* fine, need to send our key after updating our status, see below */
+    GSC_SESSIONS_reinit (kx->peer);
+    break;
+
+  case GNUNET_CORE_KX_STATE_KEY_RECEIVED:
+    /* other peer already got our key, but typemap did go down */
+    GSC_SESSIONS_reinit (kx->peer);
+    break;
+
+  case GNUNET_CORE_KX_STATE_UP:
+    /* other peer already got our key, typemap NOT down */
+    break;
+
+  case GNUNET_CORE_KX_STATE_REKEY_SENT:
+    /* other peer already got our key, typemap NOT down */
+    break;
+
+  default:
+    GNUNET_break (0);
+    break;
+  }
+  /* check if we need to confirm everything is fine via PING + PONG */
+  switch (kx->status)
+  {
+  case GNUNET_CORE_KX_STATE_DOWN:
+    GNUNET_assert (NULL == kx->keep_alive_task);
+    kx->status = GNUNET_CORE_KX_STATE_KEY_RECEIVED;
+    monitor_notify_all (kx);
+    if (GNUNET_CORE_KX_STATE_KEY_SENT == sender_status)
+      send_key (kx);
+    else
+      send_ping (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_KEY_SENT:
+    GNUNET_assert (NULL == kx->keep_alive_task);
+    kx->status = GNUNET_CORE_KX_STATE_KEY_RECEIVED;
+    monitor_notify_all (kx);
+    if (GNUNET_CORE_KX_STATE_KEY_SENT == sender_status)
+      send_key (kx);
+    else
+      send_ping (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_KEY_RECEIVED:
+    GNUNET_assert (NULL == kx->keep_alive_task);
+    if (GNUNET_CORE_KX_STATE_KEY_SENT == sender_status)
+      send_key (kx);
+    else
+      send_ping (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_UP:
+    kx->status = GNUNET_CORE_KX_STATE_REKEY_SENT;
+    monitor_notify_all (kx);
+    if (GNUNET_CORE_KX_STATE_KEY_SENT == sender_status)
+      send_key (kx);
+    else
+      send_ping (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_REKEY_SENT:
+    if (GNUNET_CORE_KX_STATE_KEY_SENT == sender_status)
+      send_key (kx);
+    else
+      send_ping (kx);
+    break;
+
+  default:
+    GNUNET_break (0);
+    break;
+  }
+  GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+}
+
+
+/**
+ * We received a PING message.  Validate and transmit
+ * a PONG message.
+ *
+ * @param cls key exchange status for the corresponding peer
+ * @param m the encrypted PING message itself
+ */
+static void
+handle_ping (void *cls, const struct PingMessage *m)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+  struct PingMessage t;
+  struct PongMessage tx;
+  struct PongMessage *tp;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# PING messages received"),
+                            1,
+                            GNUNET_NO);
+  if ((kx->status != GNUNET_CORE_KX_STATE_KEY_RECEIVED) &&
+      (kx->status != GNUNET_CORE_KX_STATE_UP) &&
+      (kx->status != GNUNET_CORE_KX_STATE_REKEY_SENT))
+  {
+    /* ignore */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# PING messages dropped (out of order)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Core service receives PING request from `%s'.\n",
+              GNUNET_i2s (kx->peer));
+  derive_iv (&iv, &kx->decrypt_key, m->iv_seed, &GSC_my_identity);
+  if (GNUNET_OK != do_decrypt (kx,
+                               &iv,
+                               &m->target,
+                               &t.target,
+                               sizeof(struct PingMessage)
+                               - ((void *) &m->target - (void *) m)))
+  {
+    GNUNET_break_op (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if (0 !=
+      memcmp (&t.target, &GSC_my_identity, sizeof(struct GNUNET_PeerIdentity)))
+  {
+    if (GNUNET_CORE_KX_STATE_REKEY_SENT != kx->status)
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Decryption of PING from peer `%s' failed, PING for `%s'?\n",
+                  GNUNET_i2s (kx->peer),
+                  GNUNET_i2s2 (&t.target));
+    else
+      GNUNET_log (
+        GNUNET_ERROR_TYPE_DEBUG,
+        "Decryption of PING from peer `%s' failed after rekey (harmless)\n",
+        GNUNET_i2s (kx->peer));
+    GNUNET_break_op (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  /* construct PONG */
+  tx.reserved = 0;
+  tx.challenge = t.challenge;
+  tx.target = t.target;
+  env = GNUNET_MQ_msg (tp, GNUNET_MESSAGE_TYPE_CORE_PONG);
+  tp->iv_seed = calculate_seed (kx);
+  derive_pong_iv (&iv, &kx->encrypt_key, tp->iv_seed, t.challenge, kx->peer);
+  do_encrypt (kx,
+              &iv,
+              &tx.challenge,
+              &tp->challenge,
+              sizeof(struct PongMessage)
+              - ((void *) &tp->challenge - (void *) tp));
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# PONG messages created"),
+                            1,
+                            GNUNET_NO);
+  GNUNET_MQ_send (kx->mq, env);
+}
+
+
+/**
+ * Task triggered when a neighbour entry is about to time out
+ * (and we should prevent this by sending a PING).
+ *
+ * @param cls the `struct GSC_KeyExchangeInfo`
+ */
+static void
+send_keep_alive (void *cls)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+  struct GNUNET_TIME_Relative retry;
+  struct GNUNET_TIME_Relative left;
+
+  kx->keep_alive_task = NULL;
+  left = GNUNET_TIME_absolute_get_remaining (kx->timeout);
+  if (0 == left.rel_value_us)
+  {
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# sessions terminated by timeout"),
+                              1,
+                              GNUNET_NO);
+    GSC_SESSIONS_end (kx->peer);
+    kx->status = GNUNET_CORE_KX_STATE_KEY_SENT;
+    monitor_notify_all (kx);
+    send_key (kx);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending KEEPALIVE to `%s'\n",
+              GNUNET_i2s (kx->peer));
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# keepalive messages sent"),
+                            1,
+                            GNUNET_NO);
+  setup_fresh_ping (kx);
+  send_ping (kx);
+  retry = GNUNET_TIME_relative_max (GNUNET_TIME_relative_divide (left, 2),
+                                    MIN_PING_FREQUENCY);
+  kx->keep_alive_task =
+    GNUNET_SCHEDULER_add_delayed (retry, &send_keep_alive, kx);
+}
+
+
+/**
+ * We've seen a valid message from the other peer.
+ * Update the time when the session would time out
+ * and delay sending our keep alive message further.
+ *
+ * @param kx key exchange where we saw activity
+ */
+static void
+update_timeout (struct GSC_KeyExchangeInfo *kx)
+{
+  struct GNUNET_TIME_Relative delta;
+
+  kx->timeout =
+    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
+  delta =
+    GNUNET_TIME_absolute_get_difference (kx->last_notify_timeout, kx->timeout);
+  if (delta.rel_value_us > 5LL * 1000LL * 1000LL)
+  {
+    /* we only notify monitors about timeout changes if those
+       are bigger than the threshold (5s) */
+    monitor_notify_all (kx);
+  }
+  if (NULL != kx->keep_alive_task)
+    GNUNET_SCHEDULER_cancel (kx->keep_alive_task);
+  kx->keep_alive_task = GNUNET_SCHEDULER_add_delayed (
+    GNUNET_TIME_relative_divide (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT, 2),
+    &send_keep_alive,
+    kx);
+}
+
+
+/**
+ * We received a PONG message.  Validate and update our status.
+ *
+ * @param kx key exchange context for the the PONG
+ * @param m the encrypted PONG message itself
+ */
+static void
+handle_pong (void *cls, const struct PongMessage *m)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+  struct PongMessage t;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# PONG messages received"),
+                            1,
+                            GNUNET_NO);
+  switch (kx->status)
+  {
+  case GNUNET_CORE_KX_STATE_DOWN:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# PONG messages dropped (connection down)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+
+  case GNUNET_CORE_KX_STATE_KEY_SENT:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# PONG messages dropped (out of order)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+
+  case GNUNET_CORE_KX_STATE_KEY_RECEIVED:
+    break;
+
+  case GNUNET_CORE_KX_STATE_UP:
+    break;
+
+  case GNUNET_CORE_KX_STATE_REKEY_SENT:
+    break;
+
+  default:
+    GNUNET_break (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Core service receives PONG response from `%s'.\n",
+              GNUNET_i2s (kx->peer));
+  /* mark as garbage, just to be sure */
+  memset (&t, 255, sizeof(t));
+  derive_pong_iv (&iv,
+                  &kx->decrypt_key,
+                  m->iv_seed,
+                  kx->ping_challenge,
+                  &GSC_my_identity);
+  if (GNUNET_OK != do_decrypt (kx,
+                               &iv,
+                               &m->challenge,
+                               &t.challenge,
+                               sizeof(struct PongMessage)
+                               - ((void *) &m->challenge - (void *) m)))
+  {
+    GNUNET_break_op (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# PONG messages decrypted"),
+                            1,
+                            GNUNET_NO);
+  if ((0 !=
+       memcmp (&t.target, kx->peer, sizeof(struct GNUNET_PeerIdentity))) ||
+      (kx->ping_challenge != t.challenge))
+  {
+    /* PONG malformed */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received malformed PONG wanted sender `%s' with challenge %u\n",
+                GNUNET_i2s (kx->peer),
+                (unsigned int) kx->ping_challenge);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received malformed PONG received from `%s' with challenge %u\n",
+                GNUNET_i2s (&t.target),
+                (unsigned int) t.challenge);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received valid PONG from `%s'\n",
+              GNUNET_i2s (kx->peer));
+  /* no need to resend key any longer */
+  if (NULL != kx->retry_set_key_task)
+  {
+    GNUNET_SCHEDULER_cancel (kx->retry_set_key_task);
+    kx->retry_set_key_task = NULL;
+  }
+  switch (kx->status)
+  {
+  case GNUNET_CORE_KX_STATE_DOWN:
+    GNUNET_assert (0);  /* should be impossible */
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+
+  case GNUNET_CORE_KX_STATE_KEY_SENT:
+    GNUNET_assert (0);  /* should be impossible */
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+
+  case GNUNET_CORE_KX_STATE_KEY_RECEIVED:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# session keys confirmed via PONG"),
+                              1,
+                              GNUNET_NO);
+    kx->status = GNUNET_CORE_KX_STATE_UP;
+    monitor_notify_all (kx);
+    GSC_SESSIONS_create (kx->peer, kx);
+    GNUNET_assert (NULL == kx->keep_alive_task);
+    update_timeout (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_UP:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# timeouts prevented via PONG"),
+                              1,
+                              GNUNET_NO);
+    update_timeout (kx);
+    break;
+
+  case GNUNET_CORE_KX_STATE_REKEY_SENT:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# rekey operations confirmed via PONG"),
+                              1,
+                              GNUNET_NO);
+    kx->status = GNUNET_CORE_KX_STATE_UP;
+    monitor_notify_all (kx);
+    update_timeout (kx);
+    break;
+
+  default:
+    GNUNET_break (0);
+    break;
+  }
+}
+
+
+/**
+ * Send our key to the other peer.
+ *
+ * @param kx key exchange context
+ */
+static void
+send_key (struct GSC_KeyExchangeInfo *kx)
+{
+  struct GNUNET_MQ_Envelope *env;
+
+  GNUNET_assert (GNUNET_CORE_KX_STATE_DOWN != kx->status);
+  if (NULL != kx->retry_set_key_task)
+  {
+    GNUNET_SCHEDULER_cancel (kx->retry_set_key_task);
+    kx->retry_set_key_task = NULL;
+  }
+  /* always update sender status in SET KEY message */
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode hc;
+
+    GNUNET_CRYPTO_hash (&current_ekm.ephemeral_key,
+                        sizeof(current_ekm.ephemeral_key),
+                        &hc);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sending EPHEMERAL_KEY %s to `%s' (my status: %d)\n",
+                GNUNET_h2s (&hc),
+                GNUNET_i2s (kx->peer),
+                kx->status);
+  }
+#endif
+  current_ekm.sender_status = htonl ((int32_t) (kx->status));
+  env = GNUNET_MQ_msg_copy (&current_ekm.header);
+  GNUNET_MQ_send (kx->mq, env);
+  if (GNUNET_CORE_KX_STATE_KEY_SENT != kx->status)
+    send_ping (kx);
+  kx->retry_set_key_task =
+    GNUNET_SCHEDULER_add_delayed (kx->set_key_retry_frequency,
+                                  &set_key_retry_task,
+                                  kx);
+}
+
+
+void
+GSC_KX_encrypt_and_transmit (struct GSC_KeyExchangeInfo *kx,
+                             const void *payload,
+                             size_t payload_size)
+{
+  size_t used = payload_size + sizeof(struct EncryptedMessage);
+  char pbuf[used]; /* plaintext */
+  struct EncryptedMessage *em; /* encrypted message */
+  struct EncryptedMessage *ph; /* plaintext header */
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+  struct GNUNET_CRYPTO_AuthKey auth_key;
+
+  ph = (struct EncryptedMessage *) pbuf;
+  ph->sequence_number = htonl (++kx->last_sequence_number_sent);
+  ph->iv_seed = calculate_seed (kx);
+  ph->reserved = 0;
+  ph->timestamp = GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get ());
+  GNUNET_memcpy (&ph[1], payload, payload_size);
+  env = GNUNET_MQ_msg_extra (em,
+                             payload_size,
+                             GNUNET_MESSAGE_TYPE_CORE_ENCRYPTED_MESSAGE);
+  em->iv_seed = ph->iv_seed;
+  derive_iv (&iv, &kx->encrypt_key, ph->iv_seed, kx->peer);
+  GNUNET_assert (GNUNET_OK == do_encrypt (kx,
+                                          &iv,
+                                          &ph->sequence_number,
+                                          &em->sequence_number,
+                                          used - ENCRYPTED_HEADER_SIZE));
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode hc;
+
+    GNUNET_CRYPTO_hash (&ph->sequence_number,
+                        used - ENCRYPTED_HEADER_SIZE,
+                        &hc);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Encrypted payload `%s' of %u bytes for %s\n",
+                GNUNET_h2s (&hc),
+                (unsigned int) (used - ENCRYPTED_HEADER_SIZE),
+                GNUNET_i2s (kx->peer));
+  }
+#endif
+  derive_auth_key (&auth_key, &kx->encrypt_key, ph->iv_seed);
+  GNUNET_CRYPTO_hmac (&auth_key,
+                      &em->sequence_number,
+                      used - ENCRYPTED_HEADER_SIZE,
+                      &em->hmac);
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode hc;
+
+    GNUNET_CRYPTO_hash (&auth_key, sizeof(auth_key), &hc);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "For peer %s, used AC %s to create hmac %s\n",
+                GNUNET_i2s (kx->peer),
+                GNUNET_h2s (&hc),
+                GNUNET_h2s2 (&em->hmac));
+  }
+#endif
+  kx->has_excess_bandwidth = GNUNET_NO;
+  GNUNET_MQ_send (kx->mq, env);
+}
+
+
+/**
+ * We received an encrypted message.  Check that it is
+ * well-formed (size-wise).
+ *
+ * @param cls key exchange context for encrypting the message
+ * @param m encrypted message
+ * @return #GNUNET_OK if @a msg is well-formed (size-wise)
+ */
+static int
+check_encrypted (void *cls, const struct EncryptedMessage *m)
+{
+  uint16_t size = ntohs (m->header.size) - sizeof(*m);
+
+  if (size < sizeof(struct GNUNET_MessageHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * We received an encrypted message.  Decrypt, validate and
+ * pass on to the appropriate clients.
+ *
+ * @param cls key exchange context for encrypting the message
+ * @param m encrypted message
+ */
+static void
+handle_encrypted (void *cls, const struct EncryptedMessage *m)
+{
+  struct GSC_KeyExchangeInfo *kx = cls;
+  struct EncryptedMessage *pt; /* plaintext */
+  struct GNUNET_HashCode ph;
+  uint32_t snum;
+  struct GNUNET_TIME_Absolute t;
+  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
+  struct GNUNET_CRYPTO_AuthKey auth_key;
+  uint16_t size = ntohs (m->header.size);
+  char buf[size] GNUNET_ALIGN;
+
+  if (GNUNET_CORE_KX_STATE_UP != kx->status)
+  {
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# DATA message dropped (out of order)"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if (0 ==
+      GNUNET_TIME_absolute_get_remaining (kx->foreign_key_expires).rel_value_us)
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_WARNING,
+      _ (
+        "Session to peer `%s' went down due to key expiration (should not happen)\n"),
+      GNUNET_i2s (kx->peer));
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# sessions terminated by key expiration"),
+                              1,
+                              GNUNET_NO);
+    GSC_SESSIONS_end (kx->peer);
+    if (NULL != kx->keep_alive_task)
+    {
+      GNUNET_SCHEDULER_cancel (kx->keep_alive_task);
+      kx->keep_alive_task = NULL;
+    }
+    kx->status = GNUNET_CORE_KX_STATE_KEY_SENT;
+    monitor_notify_all (kx);
+    send_key (kx);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+
+  /* validate hash */
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode hc;
+
+    GNUNET_CRYPTO_hash (&m->sequence_number, size - ENCRYPTED_HEADER_SIZE, &hc);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received encrypted payload `%s' of %u bytes from %s\n",
+                GNUNET_h2s (&hc),
+                (unsigned int) (size - ENCRYPTED_HEADER_SIZE),
+                GNUNET_i2s (kx->peer));
+  }
+#endif
+  derive_auth_key (&auth_key, &kx->decrypt_key, m->iv_seed);
+  GNUNET_CRYPTO_hmac (&auth_key,
+                      &m->sequence_number,
+                      size - ENCRYPTED_HEADER_SIZE,
+                      &ph);
+#if DEBUG_KX
+  {
+    struct GNUNET_HashCode hc;
+
+    GNUNET_CRYPTO_hash (&auth_key, sizeof(auth_key), &hc);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "For peer %s, used AC %s to verify hmac %s\n",
+                GNUNET_i2s (kx->peer),
+                GNUNET_h2s (&hc),
+                GNUNET_h2s2 (&m->hmac));
+  }
+#endif
+  if (0 != memcmp (&ph, &m->hmac, sizeof(struct GNUNET_HashCode)))
+  {
+    /* checksum failed */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Failed checksum validation for a message from `%s'\n",
+                GNUNET_i2s (kx->peer));
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  derive_iv (&iv, &kx->decrypt_key, m->iv_seed, &GSC_my_identity);
+  /* decrypt */
+  if (GNUNET_OK != do_decrypt (kx,
+                               &iv,
+                               &m->sequence_number,
+                               &buf[ENCRYPTED_HEADER_SIZE],
+                               size - ENCRYPTED_HEADER_SIZE))
+  {
+    GNUNET_break_op (0);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Decrypted %u bytes from %s\n",
+              (unsigned int) (size - ENCRYPTED_HEADER_SIZE),
+              GNUNET_i2s (kx->peer));
+  pt = (struct EncryptedMessage *) buf;
+
+  /* validate sequence number */
+  snum = ntohl (pt->sequence_number);
+  if (kx->last_sequence_number_received == snum)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received duplicate message, ignoring.\n");
+    /* duplicate, ignore */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# bytes dropped (duplicates)"),
+                              size,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if ((kx->last_sequence_number_received > snum) &&
+      (kx->last_sequence_number_received - snum > 32))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received ancient out of sequence message, ignoring.\n");
+    /* ancient out of sequence, ignore */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# bytes dropped (out of sequence)"),
+                              size,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+  if (kx->last_sequence_number_received > snum)
+  {
+    uint32_t rotbit = 1U << (kx->last_sequence_number_received - snum - 1);
+
+    if ((kx->last_packets_bitmap & rotbit) != 0)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Received duplicate message, ignoring.\n");
+      GNUNET_STATISTICS_update (GSC_stats,
+                                gettext_noop ("# bytes dropped (duplicates)"),
+                                size,
+                                GNUNET_NO);
+      /* duplicate, ignore */
+      GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+      return;
+    }
+    kx->last_packets_bitmap |= rotbit;
+  }
+  if (kx->last_sequence_number_received < snum)
+  {
+    unsigned int shift = (snum - kx->last_sequence_number_received);
+
+    if (shift >= 8 * sizeof(kx->last_packets_bitmap))
+      kx->last_packets_bitmap = 0;
+    else
+      kx->last_packets_bitmap <<= shift;
+    kx->last_sequence_number_received = snum;
+  }
+
+  /* check timestamp */
+  t = GNUNET_TIME_absolute_ntoh (pt->timestamp);
+  if (GNUNET_TIME_absolute_get_duration (t).rel_value_us >
+      MAX_MESSAGE_AGE.rel_value_us)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Message received far too old (%s). Content ignored.\n",
+                GNUNET_STRINGS_relative_time_to_string (
+                  GNUNET_TIME_absolute_get_duration (t),
+                  GNUNET_YES));
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# bytes dropped (ancient message)"),
+                              size,
+                              GNUNET_NO);
+    GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+    return;
+  }
+
+  /* process decrypted message(s) */
+  update_timeout (kx);
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# bytes of payload decrypted"),
+                            size - sizeof(struct EncryptedMessage),
+                            GNUNET_NO);
+  if (GNUNET_OK !=
+      GNUNET_MST_from_buffer (kx->mst,
+                              &buf[sizeof(struct EncryptedMessage)],
+                              size - sizeof(struct EncryptedMessage),
+                              GNUNET_YES,
+                              GNUNET_NO))
+    GNUNET_break_op (0);
+  
+  GNUNET_TRANSPORT_core_receive_continue (transport, kx->peer);
+}
+
+
+/**
+ * Setup the message that links the ephemeral key to our persistent
+ * public key and generate the appropriate signature.
+ */
+static void
+sign_ephemeral_key ()
+{
+  current_ekm.header.size = htons (sizeof(struct EphemeralKeyMessage));
+  current_ekm.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_EPHEMERAL_KEY);
+  current_ekm.sender_status = 0; /* to be set later */
+  current_ekm.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_SET_ECC_KEY);
+  current_ekm.purpose.size =
+    htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+           + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+           + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+           + sizeof(struct GNUNET_CRYPTO_EcdhePublicKey)
+           + sizeof(struct GNUNET_PeerIdentity));
+  current_ekm.creation_time =
+    GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get ());
+  if (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno (GSC_cfg,
+                                                          "core",
+                                                          "USE_EPHEMERAL_KEYS"))
+  {
+    current_ekm.expiration_time =
+      GNUNET_TIME_absolute_hton (GNUNET_TIME_relative_to_absolute (
+                                   GNUNET_TIME_relative_add (REKEY_FREQUENCY,
+                                                             REKEY_TOLERANCE)));
+  }
+  else
+  {
+    current_ekm.expiration_time =
+      GNUNET_TIME_absolute_hton (GNUNET_TIME_UNIT_FOREVER_ABS);
+  }
+  GNUNET_CRYPTO_ecdhe_key_get_public (&my_ephemeral_key,
+                                      &current_ekm.ephemeral_key);
+  current_ekm.origin_identity = GSC_my_identity;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_sign_ (&my_private_key,
+                                            &current_ekm.purpose,
+                                            &current_ekm.signature));
+}
+
+
+/**
+ * Task run to trigger rekeying.
+ *
+ * @param cls closure, NULL
+ */
+static void
+do_rekey (void *cls)
+{
+  struct GSC_KeyExchangeInfo *pos;
+
+  rekey_task = GNUNET_SCHEDULER_add_delayed (REKEY_FREQUENCY, &do_rekey, NULL);
+  GNUNET_CRYPTO_ecdhe_key_create (&my_ephemeral_key);
+  sign_ephemeral_key ();
+  {
+    struct GNUNET_HashCode eh;
+
+    GNUNET_CRYPTO_hash (&current_ekm.ephemeral_key,
+                        sizeof(current_ekm.ephemeral_key),
+                        &eh);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Rekeying to %s\n", GNUNET_h2s (&eh));
+  }
+  for (pos = kx_head; NULL != pos; pos = pos->next)
+  {
+    if (GNUNET_CORE_KX_STATE_UP == pos->status)
+    {
+      pos->status = GNUNET_CORE_KX_STATE_REKEY_SENT;
+      monitor_notify_all (pos);
+      derive_session_keys (pos);
+    }
+    if (GNUNET_CORE_KX_STATE_DOWN == pos->status)
+    {
+      pos->status = GNUNET_CORE_KX_STATE_KEY_SENT;
+      monitor_notify_all (pos);
+    }
+    monitor_notify_all (pos);
+    send_key (pos);
+  }
+}
+
+
+/**
+ * Initialize KX subsystem.
+ *
+ * @param pk private key to use for the peer
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+int
+GSC_KX_init (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (ephemeral_key,
+                             GNUNET_MESSAGE_TYPE_CORE_EPHEMERAL_KEY,
+                             struct EphemeralKeyMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (ping,
+                             GNUNET_MESSAGE_TYPE_CORE_PING,
+                             struct PingMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (pong,
+                             GNUNET_MESSAGE_TYPE_CORE_PONG,
+                             struct PongMessage,
+                             NULL),
+    GNUNET_MQ_hd_var_size (encrypted,
+                           GNUNET_MESSAGE_TYPE_CORE_ENCRYPTED_MESSAGE,
+                           struct EncryptedMessage,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  my_private_key = *pk;
+  GNUNET_CRYPTO_eddsa_key_get_public (&my_private_key,
+                                      &GSC_my_identity.public_key);
+  GNUNET_CRYPTO_ecdhe_key_create (&my_ephemeral_key);
+  sign_ephemeral_key ();
+  {
+    struct GNUNET_HashCode eh;
+
+    GNUNET_CRYPTO_hash (&current_ekm.ephemeral_key,
+                        sizeof(current_ekm.ephemeral_key),
+                        &eh);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Starting with ephemeral key %s\n",
+                GNUNET_h2s (&eh));
+  }
+
+  nc = GNUNET_notification_context_create (1);
+  rekey_task = GNUNET_SCHEDULER_add_delayed (REKEY_FREQUENCY, &do_rekey, NULL);
+  transport =
+    GNUNET_TRANSPORT_core_connect (GSC_cfg,
+                                   &GSC_my_identity,
+                                   handlers,
+                                   NULL,
+                                   &handle_transport_notify_connect,
+                                   &handle_transport_notify_disconnect);
+  if (NULL == transport)
+  {
+    GSC_KX_done ();
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown KX subsystem.
+ */
+void
+GSC_KX_done ()
+{
+  if (NULL != transport)
+  {
+    GNUNET_TRANSPORT_core_disconnect (transport);
+    transport = NULL;
+  }
+  if (NULL != rekey_task)
+  {
+    GNUNET_SCHEDULER_cancel (rekey_task);
+    rekey_task = NULL;
+  }
+  memset (&my_ephemeral_key,
+          0,
+          sizeof (my_ephemeral_key));
+  memset (&my_private_key,
+          0,
+          sizeof (my_private_key));
+  if (NULL != nc)
+  {
+    GNUNET_notification_context_destroy (nc);
+    nc = NULL;
+  }
+}
+
+
+/**
+ * Check how many messages are queued for the given neighbour.
+ *
+ * @param kxinfo data about neighbour to check
+ * @return number of items in the message queue
+ */
+unsigned int
+GSC_NEIGHBOURS_get_queue_length (const struct GSC_KeyExchangeInfo *kxinfo)
+{
+  return GNUNET_MQ_get_length (kxinfo->mq);
+}
+
+
+int
+GSC_NEIGHBOURS_check_excess_bandwidth (const struct GSC_KeyExchangeInfo *kxinfo)
+{
+  return kxinfo->has_excess_bandwidth;
+}
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_MONITOR_PEERS request.  For this
+ * request type, the client does not have to have transmitted an INIT
+ * request.  All current peers are returned, regardless of which
+ * message types they accept.
+ *
+ * @param mq message queue to add for monitoring
+ */
+void
+GSC_KX_handle_client_monitor_peers (struct GNUNET_MQ_Handle *mq)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct MonitorNotifyMessage *done_msg;
+  struct GSC_KeyExchangeInfo *kx;
+
+  GNUNET_notification_context_add (nc, mq);
+  for (kx = kx_head; NULL != kx; kx = kx->next)
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct MonitorNotifyMessage *msg;
+
+    env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
+    msg->state = htonl ((uint32_t) kx->status);
+    msg->peer = *kx->peer;
+    msg->timeout = GNUNET_TIME_absolute_hton (kx->timeout);
+    GNUNET_MQ_send (mq, env);
+  }
+  env = GNUNET_MQ_msg (done_msg, GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
+  done_msg->state = htonl ((uint32_t) GNUNET_CORE_KX_ITERATION_FINISHED);
+  done_msg->timeout = GNUNET_TIME_absolute_hton (GNUNET_TIME_UNIT_FOREVER_ABS);
+  GNUNET_MQ_send (mq, env);
+}
+
+
+/* end of gnunet-service-core_kx.c */
diff --git a/src/service/core/gnunet-service-core_kx.h b/src/service/core/gnunet-service-core_kx.h
new file mode 100644
index 000000000..8bcac3f68
--- /dev/null
+++ b/src/service/core/gnunet-service-core_kx.h
@@ -0,0 +1,102 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_kx.h
+ * @brief code for managing the key exchange (SET_KEY, PING, PONG) with other peers
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_CORE_KX_H
+#define GNUNET_SERVICE_CORE_KX_H
+
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Information about the status of a key exchange with another peer.
+ */
+struct GSC_KeyExchangeInfo;
+
+
+/**
+ * Encrypt and transmit a message with the given payload.
+ *
+ * @param kx key exchange context
+ * @param payload payload of the message
+ * @param payload_size number of bytes in 'payload'
+ */
+void
+GSC_KX_encrypt_and_transmit (struct GSC_KeyExchangeInfo *kx,
+                             const void *payload,
+                             size_t payload_size);
+
+
+/**
+ * Initialize KX subsystem.
+ *
+ * @param pk private key to use for the peer
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+int
+GSC_KX_init (struct GNUNET_CRYPTO_EddsaPrivateKey *pk);
+
+
+/**
+ * Shutdown KX subsystem.
+ */
+void
+GSC_KX_done (void);
+
+
+/**
+ * Check if the given neighbour has excess bandwidth available.
+ *
+ * @param target neighbour to check
+ * @return #GNUNET_YES if excess bandwidth is available, #GNUNET_NO if not
+ */
+int
+GSC_NEIGHBOURS_check_excess_bandwidth (const struct
+                                       GSC_KeyExchangeInfo *target);
+
+
+/**
+ * Check how many messages are queued for the given neighbour.
+ *
+ * @param target neighbour to check
+ * @return number of items in the message queue
+ */
+unsigned int
+GSC_NEIGHBOURS_get_queue_length (const struct GSC_KeyExchangeInfo *target);
+
+
+/**
+ * Handle #GNUNET_MESSAGE_TYPE_CORE_MONITOR_PEERS request.  For this
+ * request type, the client does not have to have transmitted an INIT
+ * request.  All current peers are returned, regardless of which
+ * message types they accept.
+ *
+ * @param mq message queue to add for monitoring
+ */
+void
+GSC_KX_handle_client_monitor_peers (struct GNUNET_MQ_Handle *mq);
+
+
+#endif
+/* end of gnunet-service-core_kx.h */
diff --git a/src/service/core/gnunet-service-core_sessions.c b/src/service/core/gnunet-service-core_sessions.c
new file mode 100644
index 000000000..e103c89f5
--- /dev/null
+++ b/src/service/core/gnunet-service-core_sessions.c
@@ -0,0 +1,1028 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2014, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_sessions.c
+ * @brief code for managing of 'encrypted' sessions (key exchange done)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet-service-core.h"
+#include "gnunet-service-core_kx.h"
+#include "gnunet-service-core_typemap.h"
+#include "gnunet-service-core_sessions.h"
+#include "gnunet_constants.h"
+#include "core.h"
+
+
+/**
+ * How many encrypted messages do we queue at most?
+ * Needed to bound memory consumption.
+ */
+#define MAX_ENCRYPTED_MESSAGE_QUEUE_SIZE 4
+
+
+/**
+ * Message ready for encryption.  This struct is followed by the
+ * actual content of the message.
+ */
+struct SessionMessageEntry
+{
+  /**
+   * We keep messages in a doubly linked list.
+   */
+  struct SessionMessageEntry *next;
+
+  /**
+   * We keep messages in a doubly linked list.
+   */
+  struct SessionMessageEntry *prev;
+
+  /**
+   * How important is this message.
+   */
+  enum GNUNET_MQ_PriorityPreferences priority;
+
+  /**
+   * Flag set to #GNUNET_YES if this is a typemap message.
+   */
+  int is_typemap;
+
+  /**
+   * Flag set to #GNUNET_YES if this is a typemap confirmation message.
+   */
+  int is_typemap_confirm;
+
+  /**
+   * Deadline for transmission, 1s after we received it (if we
+   * are not corking), otherwise "now".  Note that this message
+   * does NOT expire past its deadline.
+   */
+  struct GNUNET_TIME_Absolute deadline;
+
+  /**
+   * How long is the message? (number of bytes following the `struct
+   * MessageEntry`, but not including the size of `struct
+   * MessageEntry` itself!)
+   */
+  size_t size;
+};
+
+
+/**
+ * Data kept per session.
+ */
+struct Session
+{
+  /**
+   * Identity of the other peer.
+   */
+  const struct GNUNET_PeerIdentity *peer;
+
+  /**
+   * Key exchange state for this peer.
+   */
+  struct GSC_KeyExchangeInfo *kx;
+
+  /**
+   * Head of list of requests from clients for transmission to
+   * this peer.
+   */
+  struct GSC_ClientActiveRequest *active_client_request_head;
+
+  /**
+   * Tail of list of requests from clients for transmission to
+   * this peer.
+   */
+  struct GSC_ClientActiveRequest *active_client_request_tail;
+
+  /**
+   * Head of list of messages ready for encryption.
+   */
+  struct SessionMessageEntry *sme_head;
+
+  /**
+   * Tail of list of messages ready for encryption.
+   */
+  struct SessionMessageEntry *sme_tail;
+
+  /**
+   * Current type map for this peer.
+   */
+  struct GSC_TypeMap *tmap;
+
+  /**
+   * Task to transmit corked messages with a delay.
+   */
+  struct GNUNET_SCHEDULER_Task *cork_task;
+
+  /**
+   * Task to transmit our type map.
+   */
+  struct GNUNET_SCHEDULER_Task *typemap_task;
+
+  /**
+   * Retransmission delay we currently use for the typemap
+   * transmissions (if not confirmed).
+   */
+  struct GNUNET_TIME_Relative typemap_delay;
+
+  /**
+   * Is this the first time we're sending the typemap? If so,
+   * we want to send it a bit faster the second time.  0 if
+   * we are sending for the first time, 1 if not.
+   */
+  int first_typemap;
+};
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Message sent to confirm that a typemap was received.
+ */
+struct TypeMapConfirmationMessage
+{
+  /**
+   * Header with type #GNUNET_MESSAGE_TYPE_CORE_CONFIRM_TYPE_MAP.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Reserved, always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /**
+   * Hash of the (decompressed) type map that was received.
+   */
+  struct GNUNET_HashCode tm_hash;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Map of peer identities to `struct Session`.
+ */
+static struct GNUNET_CONTAINER_MultiPeerMap *sessions;
+
+
+/**
+ * Find the session for the given peer.
+ *
+ * @param peer identity of the peer
+ * @return NULL if we are not connected, otherwise the
+ *         session handle
+ */
+static struct Session *
+find_session (const struct GNUNET_PeerIdentity *peer)
+{
+  if (NULL == sessions)
+    return NULL;
+  return GNUNET_CONTAINER_multipeermap_get (sessions, peer);
+}
+
+
+/**
+ * End the session with the given peer (we are no longer
+ * connected).
+ *
+ * @param pid identity of peer to kill session with
+ */
+void
+GSC_SESSIONS_end (const struct GNUNET_PeerIdentity *pid)
+{
+  struct Session *session;
+  struct GSC_ClientActiveRequest *car;
+  struct SessionMessageEntry *sme;
+
+  session = find_session (pid);
+  if (NULL == session)
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Destroying session for peer `%s'\n",
+              GNUNET_i2s (session->peer));
+  if (NULL != session->cork_task)
+  {
+    GNUNET_SCHEDULER_cancel (session->cork_task);
+    session->cork_task = NULL;
+  }
+  while (NULL != (car = session->active_client_request_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (session->active_client_request_head,
+                                 session->active_client_request_tail,
+                                 car);
+    GSC_CLIENTS_reject_request (car, GNUNET_NO);
+  }
+  while (NULL != (sme = session->sme_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (session->sme_head, session->sme_tail, sme);
+    GNUNET_free (sme);
+  }
+  if (NULL != session->typemap_task)
+  {
+    GNUNET_SCHEDULER_cancel (session->typemap_task);
+    session->typemap_task = NULL;
+  }
+  GSC_CLIENTS_notify_clients_about_neighbour (session->peer,
+                                              session->tmap,
+                                              NULL);
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CONTAINER_multipeermap_remove (sessions, session->peer, session));
+  GNUNET_STATISTICS_set (GSC_stats,
+                         gettext_noop ("# peers connected"),
+                         GNUNET_CONTAINER_multipeermap_size (sessions),
+                         GNUNET_NO);
+  GSC_TYPEMAP_destroy (session->tmap);
+  session->tmap = NULL;
+  GNUNET_free (session);
+}
+
+
+/**
+ * Transmit our current typemap message to the other peer.
+ * (Done periodically until the typemap is confirmed).
+ *
+ * @param cls the `struct Session *`
+ */
+static void
+transmit_typemap_task (void *cls)
+{
+  struct Session *session = cls;
+  struct GNUNET_MessageHeader *hdr;
+  struct GNUNET_TIME_Relative delay;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending TYPEMAP to %s\n",
+              GNUNET_i2s (session->peer));
+  session->typemap_delay = GNUNET_TIME_STD_BACKOFF (session->typemap_delay);
+  delay = session->typemap_delay;
+  /* randomize a bit to avoid spont. sync */
+  delay.rel_value_us +=
+    GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 1000 * 1000);
+  session->typemap_task =
+    GNUNET_SCHEDULER_add_delayed (delay, &transmit_typemap_task, session);
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# type map refreshes sent"),
+                            1,
+                            GNUNET_NO);
+  hdr = GSC_TYPEMAP_compute_type_map_message ();
+  GSC_KX_encrypt_and_transmit (session->kx, hdr, ntohs (hdr->size));
+  GNUNET_free (hdr);
+}
+
+
+/**
+ * Restart the typemap task for the given session.
+ *
+ * @param session session to restart typemap transmission for
+ */
+static void
+start_typemap_task (struct Session *session)
+{
+  if (NULL != session->typemap_task)
+    GNUNET_SCHEDULER_cancel (session->typemap_task);
+  session->typemap_delay = GNUNET_TIME_UNIT_SECONDS;
+  session->typemap_task = GNUNET_SCHEDULER_add_delayed (session->typemap_delay,
+                                                        &transmit_typemap_task,
+                                                        session);
+}
+
+
+/**
+ * Create a session, a key exchange was just completed.
+ *
+ * @param peer peer that is now connected
+ * @param kx key exchange that completed
+ */
+void
+GSC_SESSIONS_create (const struct GNUNET_PeerIdentity *peer,
+                     struct GSC_KeyExchangeInfo *kx)
+{
+  struct Session *session;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Creating session for peer `%s'\n",
+              GNUNET_i2s (peer));
+  session = GNUNET_new (struct Session);
+  session->tmap = GSC_TYPEMAP_create ();
+  session->peer = peer;
+  session->kx = kx;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multipeermap_put (
+                   sessions,
+                   session->peer,
+                   session,
+                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  GNUNET_STATISTICS_set (GSC_stats,
+                         gettext_noop ("# peers connected"),
+                         GNUNET_CONTAINER_multipeermap_size (sessions),
+                         GNUNET_NO);
+  GSC_CLIENTS_notify_clients_about_neighbour (peer, NULL, session->tmap);
+  start_typemap_task (session);
+}
+
+
+/**
+ * The other peer has indicated that it 'lost' the session
+ * (KX down), reinitialize the session on our end, in particular
+ * this means to restart the typemap transmission.
+ *
+ * @param peer peer that is now connected
+ */
+void
+GSC_SESSIONS_reinit (const struct GNUNET_PeerIdentity *peer)
+{
+  struct Session *session;
+
+  session = find_session (peer);
+  if (NULL == session)
+  {
+    /* KX/session is new for both sides; thus no need to restart what
+       has not yet begun */
+    return;
+  }
+  start_typemap_task (session);
+}
+
+
+/**
+ * The other peer has confirmed receiving our type map,
+ * check if it is current and if so, stop retransmitting it.
+ *
+ * @param peer peer that confirmed the type map
+ * @param msg confirmation message we received
+ */
+void
+GSC_SESSIONS_confirm_typemap (const struct GNUNET_PeerIdentity *peer,
+                              const struct GNUNET_MessageHeader *msg)
+{
+  const struct TypeMapConfirmationMessage *cmsg;
+  struct Session *session;
+
+  session = find_session (peer);
+  if (NULL == session)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  if (ntohs (msg->size) != sizeof(struct TypeMapConfirmationMessage))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  cmsg = (const struct TypeMapConfirmationMessage *) msg;
+  if (GNUNET_YES != GSC_TYPEMAP_check_hash (&cmsg->tm_hash))
+  {
+    /* our typemap has changed in the meantime, do not
+       accept confirmation */
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop (
+                                "# outdated typemap confirmations received"),
+                              1,
+                              GNUNET_NO);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got outdated typemap confirmated from peer `%s'\n",
+                GNUNET_i2s (session->peer));
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got typemap confirmation from peer `%s'\n",
+              GNUNET_i2s (session->peer));
+  if (NULL != session->typemap_task)
+  {
+    GNUNET_SCHEDULER_cancel (session->typemap_task);
+    session->typemap_task = NULL;
+  }
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop (
+                              "# valid typemap confirmations received"),
+                            1,
+                            GNUNET_NO);
+}
+
+
+/**
+ * Notify the given client about the session (client is new).
+ *
+ * @param cls the `struct GSC_Client`
+ * @param key peer identity
+ * @param value the `struct Session`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+notify_client_about_session (void *cls,
+                             const struct GNUNET_PeerIdentity *key,
+                             void *value)
+{
+  struct GSC_Client *client = cls;
+  struct Session *session = value;
+
+  GSC_CLIENTS_notify_client_about_neighbour (client,
+                                             session->peer,
+                                             NULL, /* old TMAP: none */
+                                             session->tmap);
+  return GNUNET_OK;
+}
+
+
+/**
+ * We have a new client, notify it about all current sessions.
+ *
+ * @param client the new client
+ */
+void
+GSC_SESSIONS_notify_client_about_sessions (struct GSC_Client *client)
+{
+  /* notify new client about existing sessions */
+  GNUNET_CONTAINER_multipeermap_iterate (sessions,
+                                         &notify_client_about_session,
+                                         client);
+}
+
+
+/**
+ * Try to perform a transmission on the given session.  Will solicit
+ * additional messages if the 'sme' queue is not full enough.
+ *
+ * @param session session to transmit messages from
+ */
+static void
+try_transmission (struct Session *session);
+
+
+/**
+ * Queue a request from a client for transmission to a particular peer.
+ *
+ * @param car request to queue; this handle is then shared between
+ *         the caller (CLIENTS subsystem) and SESSIONS and must not
+ *         be released by either until either #GSC_SESSIONS_dequeue(),
+ *         #GSC_SESSIONS_transmit() or #GSC_CLIENTS_failed()
+ *         have been invoked on it
+ */
+void
+GSC_SESSIONS_queue_request (struct GSC_ClientActiveRequest *car)
+{
+  struct Session *session;
+
+  session = find_session (&car->target);
+  if (NULL == session)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Dropped client request for transmission (am disconnected)\n");
+    GNUNET_break (0);  /* should have been rejected earlier */
+    GSC_CLIENTS_reject_request (car, GNUNET_NO);
+    return;
+  }
+  if (car->msize > GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    GSC_CLIENTS_reject_request (car, GNUNET_YES);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received client transmission request. queueing\n");
+  GNUNET_CONTAINER_DLL_insert_tail (session->active_client_request_head,
+                                    session->active_client_request_tail,
+                                    car);
+  try_transmission (session);
+}
+
+
+/**
+ * Dequeue a request from a client from transmission to a particular peer.
+ *
+ * @param car request to dequeue; this handle will then be 'owned' by
+ *        the caller (CLIENTS sysbsystem)
+ */
+void
+GSC_SESSIONS_dequeue_request (struct GSC_ClientActiveRequest *car)
+{
+  struct Session *session;
+
+  if (0 == memcmp (&car->target,
+                   &GSC_my_identity,
+                   sizeof(struct GNUNET_PeerIdentity)))
+    return;
+  session = find_session (&car->target);
+  GNUNET_assert (NULL != session);
+  GNUNET_CONTAINER_DLL_remove (session->active_client_request_head,
+                               session->active_client_request_tail,
+                               car);
+  /* dequeueing of 'high' priority messages may unblock
+     transmission for lower-priority messages, so we also
+     need to try in this case. */
+  try_transmission (session);
+}
+
+
+/**
+ * Solicit messages for transmission, starting with those of the highest
+ * priority.
+ *
+ * @param session session to solict messages for
+ * @param msize how many bytes do we have already
+ */
+static void
+solicit_messages (struct Session *session, size_t msize)
+{
+  struct GSC_ClientActiveRequest *car;
+  struct GSC_ClientActiveRequest *nxt;
+  size_t so_size;
+  enum GNUNET_MQ_PriorityPreferences pmax;
+
+  so_size = msize;
+  pmax = GNUNET_MQ_PRIO_BACKGROUND;
+  for (car = session->active_client_request_head; NULL != car; car = car->next)
+  {
+    if (GNUNET_YES == car->was_solicited)
+      continue;
+    pmax = GNUNET_MAX (pmax, car->priority & GNUNET_MQ_PRIORITY_MASK);
+  }
+  nxt = session->active_client_request_head;
+  while (NULL != (car = nxt))
+  {
+    nxt = car->next;
+    if (car->priority < pmax)
+      continue;
+    if (so_size + car->msize > GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE)
+      break;
+    so_size += car->msize;
+    if (GNUNET_YES == car->was_solicited)
+      continue;
+    car->was_solicited = GNUNET_YES;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Soliciting message with priority %u\n",
+                car->priority);
+    GSC_CLIENTS_solicit_request (car);
+    /* The above call may *dequeue* requests and thereby
+       clobber 'nxt'. Hence we need to restart from the
+       head of the list. */
+    nxt = session->active_client_request_head;
+    so_size = msize;
+  }
+}
+
+
+/**
+ * Some messages were delayed (corked), but the timeout has now expired.
+ * Send them now.
+ *
+ * @param cls `struct Session` with the messages to transmit now
+ */
+static void
+pop_cork_task (void *cls)
+{
+  struct Session *session = cls;
+
+  session->cork_task = NULL;
+  try_transmission (session);
+}
+
+
+/**
+ * Try to perform a transmission on the given session. Will solicit
+ * additional messages if the 'sme' queue is not full enough or has
+ * only low-priority messages.
+ *
+ * @param session session to transmit messages from
+ */
+static void
+try_transmission (struct Session *session)
+{
+  struct SessionMessageEntry *pos;
+  size_t msize;
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute min_deadline;
+  enum GNUNET_MQ_PriorityPreferences maxp;
+  enum GNUNET_MQ_PriorityPreferences maxpc;
+  struct GSC_ClientActiveRequest *car;
+  int excess;
+
+  msize = 0;
+  min_deadline = GNUNET_TIME_UNIT_FOREVER_ABS;
+  /* if the peer has excess bandwidth, background traffic is allowed,
+     otherwise not */
+  if (MAX_ENCRYPTED_MESSAGE_QUEUE_SIZE <=
+      GSC_NEIGHBOURS_get_queue_length (session->kx))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Transmission queue already very long, waiting...\n");
+    return;   /* queue already too long */
+  }
+  excess = GSC_NEIGHBOURS_check_excess_bandwidth (session->kx);
+  if (GNUNET_YES == excess)
+    maxp = GNUNET_MQ_PRIO_BACKGROUND;
+  else
+    maxp = GNUNET_MQ_PRIO_BEST_EFFORT;
+  /* determine highest priority of 'ready' messages we already solicited from clients */
+  pos = session->sme_head;
+  while ((NULL != pos) &&
+         (msize + pos->size <= GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE))
+  {
+    GNUNET_assert (pos->size < GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE);
+    msize += pos->size;
+    maxp = GNUNET_MAX (maxp, pos->priority & GNUNET_MQ_PRIORITY_MASK);
+    min_deadline = GNUNET_TIME_absolute_min (min_deadline, pos->deadline);
+    pos = pos->next;
+  }
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "Calculating transmission set with %u priority (%s) and %s earliest deadline\n",
+    maxp,
+    (GNUNET_YES == excess) ? "excess bandwidth" : "limited bandwidth",
+    GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_remaining (
+                                              min_deadline),
+                                            GNUNET_YES));
+
+  if (maxp < GNUNET_MQ_PRIO_CRITICAL_CONTROL)
+  {
+    /* if highest already solicited priority from clients is not critical,
+       check if there are higher-priority messages to be solicited from clients */
+    if (GNUNET_YES == excess)
+      maxpc = GNUNET_MQ_PRIO_BACKGROUND;
+    else
+      maxpc = GNUNET_MQ_PRIO_BEST_EFFORT;
+    for (car = session->active_client_request_head; NULL != car;
+         car = car->next)
+    {
+      if (GNUNET_YES == car->was_solicited)
+        continue;
+      maxpc = GNUNET_MAX (maxpc, car->priority & GNUNET_MQ_PRIORITY_MASK);
+    }
+    if (maxpc > maxp)
+    {
+      /* we have messages waiting for solicitation that have a higher
+         priority than those that we already accepted; solicit the
+         high-priority messages first */
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Soliciting messages based on priority (%u > %u)\n",
+                  maxpc,
+                  maxp);
+      solicit_messages (session, 0);
+      return;
+    }
+  }
+  else
+  {
+    /* never solicit more, we have critical messages to process */
+    excess = GNUNET_NO;
+    maxpc = GNUNET_MQ_PRIO_BACKGROUND;
+  }
+  now = GNUNET_TIME_absolute_get ();
+  if (((GNUNET_YES == excess) || (maxpc >= GNUNET_MQ_PRIO_BEST_EFFORT)) &&
+      ((0 == msize) ||
+       ((msize < GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE / 2) &&
+        (min_deadline.abs_value_us > now.abs_value_us))))
+  {
+    /* not enough ready yet (tiny message & cork possible), or no messages at all,
+       and either excess bandwidth or best-effort or higher message waiting at
+       client; in this case, we try to solicit more */
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_DEBUG,
+      "Soliciting messages (excess %d, maxpc %d, message size %u, deadline %s)\n",
+      excess,
+      maxpc,
+      (unsigned int) msize,
+      GNUNET_STRINGS_relative_time_to_string (
+        GNUNET_TIME_absolute_get_remaining (
+          min_deadline),
+        GNUNET_YES));
+    solicit_messages (session, msize);
+    if (msize > 0)
+    {
+      /* if there is data to send, just not yet, make sure we do transmit
+       * it once the deadline is reached */
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Corking until %s\n",
+                  GNUNET_STRINGS_relative_time_to_string (
+                    GNUNET_TIME_absolute_get_remaining (min_deadline),
+                    GNUNET_YES));
+      if (NULL != session->cork_task)
+        GNUNET_SCHEDULER_cancel (session->cork_task);
+      session->cork_task =
+        GNUNET_SCHEDULER_add_at (min_deadline, &pop_cork_task, session);
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Queue empty, waiting for solicitations\n");
+    }
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Building combined plaintext buffer to transmit message!\n");
+  /* create plaintext buffer of all messages (that fit), encrypt and
+     transmit */
+  {
+    static unsigned long long total_bytes;
+    static unsigned int total_msgs;
+    char pbuf[msize]; /* plaintext */
+    size_t used;
+
+    used = 0;
+    while ((NULL != (pos = session->sme_head)) && (used + pos->size <= msize))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Adding message of type %d (%d/%d) to payload for %s\n",
+                  ntohs (((const struct GNUNET_MessageHeader *) &pos[1])->type),
+                  pos->is_typemap,
+                  pos->is_typemap_confirm,
+                  GNUNET_i2s (session->peer));
+      GNUNET_memcpy (&pbuf[used], &pos[1], pos->size);
+      used += pos->size;
+      GNUNET_CONTAINER_DLL_remove (session->sme_head, session->sme_tail, pos);
+      GNUNET_free (pos);
+    }
+    /* compute average payload size */
+    total_bytes += used;
+    total_msgs++;
+    if (0 == total_msgs)
+    {
+      /* 2^32 messages, wrap around... */
+      total_msgs = 1;
+      total_bytes = used;
+    }
+    GNUNET_STATISTICS_set (GSC_stats,
+                           "# avg payload per encrypted message",
+                           total_bytes / total_msgs,
+                           GNUNET_NO);
+    /* now actually transmit... */
+    GSC_KX_encrypt_and_transmit (session->kx, pbuf, used);
+  }
+}
+
+
+/**
+ * Send an updated typemap message to the neighbour now,
+ * and restart typemap transmissions.
+ *
+ * @param cls the message
+ * @param key neighbour's identity
+ * @param value `struct Neighbour` of the target
+ * @return always #GNUNET_OK
+ */
+static int
+do_restart_typemap_message (void *cls,
+                            const struct GNUNET_PeerIdentity *key,
+                            void *value)
+{
+  const struct GNUNET_MessageHeader *hdr = cls;
+  struct Session *session = value;
+  struct SessionMessageEntry *sme;
+  uint16_t size;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Restarting sending TYPEMAP to %s\n",
+              GNUNET_i2s (session->peer));
+  size = ntohs (hdr->size);
+  for (sme = session->sme_head; NULL != sme; sme = sme->next)
+  {
+    if (GNUNET_YES == sme->is_typemap)
+    {
+      GNUNET_CONTAINER_DLL_remove (session->sme_head, session->sme_tail, sme);
+      GNUNET_free (sme);
+      break;
+    }
+  }
+  sme = GNUNET_malloc (sizeof(struct SessionMessageEntry) + size);
+  sme->is_typemap = GNUNET_YES;
+  GNUNET_memcpy (&sme[1], hdr, size);
+  sme->size = size;
+  sme->priority = GNUNET_MQ_PRIO_CRITICAL_CONTROL;
+  GNUNET_CONTAINER_DLL_insert (session->sme_head, session->sme_tail, sme);
+  try_transmission (session);
+  start_typemap_task (session);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Broadcast an updated typemap message to all neighbours.
+ * Restarts the retransmissions until the typemaps are confirmed.
+ *
+ * @param msg message to transmit
+ */
+void
+GSC_SESSIONS_broadcast_typemap (const struct GNUNET_MessageHeader *msg)
+{
+  if (NULL == sessions)
+    return;
+  GNUNET_CONTAINER_multipeermap_iterate (sessions,
+                                         &do_restart_typemap_message,
+                                         (void *) msg);
+}
+
+
+/**
+ * Traffic is being solicited for the given peer.  This means that the
+ * message queue on the transport-level (NEIGHBOURS subsystem) is now
+ * empty and it is now OK to transmit another (non-control) message.
+ *
+ * @param pid identity of peer ready to receive data
+ */
+void
+GSC_SESSIONS_solicit (const struct GNUNET_PeerIdentity *pid)
+{
+  struct Session *session;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Transport solicits for %s\n",
+              GNUNET_i2s (pid));
+  session = find_session (pid);
+  if (NULL == session)
+    return;
+  try_transmission (session);
+}
+
+
+void
+GSC_SESSIONS_transmit (struct GSC_ClientActiveRequest *car,
+                       const struct GNUNET_MessageHeader *msg,
+                       enum GNUNET_MQ_PriorityPreferences priority)
+{
+  struct Session *session;
+  struct SessionMessageEntry *sme;
+  struct SessionMessageEntry *pos;
+  size_t msize;
+
+  session = find_session (&car->target);
+  if (NULL == session)
+    return;
+  msize = ntohs (msg->size);
+  sme = GNUNET_malloc (sizeof(struct SessionMessageEntry) + msize);
+  GNUNET_memcpy (&sme[1], msg, msize);
+  sme->size = msize;
+  sme->priority = priority;
+  if (0 != (GNUNET_MQ_PREF_CORK_ALLOWED & priority))
+  {
+    sme->deadline =
+      GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_MAX_CORK_DELAY);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Message corked, delaying transmission\n");
+  }
+  pos = session->sme_head;
+  while ((NULL != pos) && (pos->priority >= sme->priority))
+    pos = pos->next;
+  if (NULL == pos)
+    GNUNET_CONTAINER_DLL_insert_tail (session->sme_head,
+                                      session->sme_tail,
+                                      sme);
+  else
+    GNUNET_CONTAINER_DLL_insert_after (session->sme_head,
+                                       session->sme_tail,
+                                       pos->prev,
+                                       sme);
+  try_transmission (session);
+}
+
+
+void
+GSC_SESSIONS_set_typemap (const struct GNUNET_PeerIdentity *peer,
+                          const struct GNUNET_MessageHeader *msg)
+{
+  struct Session *session;
+  struct GSC_TypeMap *nmap;
+  struct SessionMessageEntry *sme;
+  struct TypeMapConfirmationMessage *tmc;
+
+  nmap = GSC_TYPEMAP_get_from_message (msg);
+  if (NULL == nmap)
+  {
+    GNUNET_break_op (0);
+    return;   /* malformed */
+  }
+  session = find_session (peer);
+  if (NULL == session)
+  {
+    GSC_TYPEMAP_destroy (nmap);
+    GNUNET_break (0);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received TYPEMAP from %s\n",
+              GNUNET_i2s (session->peer));
+  for (sme = session->sme_head; NULL != sme; sme = sme->next)
+  {
+    if (GNUNET_YES == sme->is_typemap_confirm)
+    {
+      GNUNET_CONTAINER_DLL_remove (session->sme_head, session->sme_tail, sme);
+      GNUNET_free (sme);
+      break;
+    }
+  }
+  sme = GNUNET_malloc (sizeof(struct SessionMessageEntry)
+                       + sizeof(struct TypeMapConfirmationMessage));
+  sme->deadline = GNUNET_TIME_absolute_get ();
+  sme->size = sizeof(struct TypeMapConfirmationMessage);
+  sme->priority = GNUNET_MQ_PRIO_CRITICAL_CONTROL;
+  sme->is_typemap_confirm = GNUNET_YES;
+  tmc = (struct TypeMapConfirmationMessage *) &sme[1];
+  tmc->header.size = htons (sizeof(struct TypeMapConfirmationMessage));
+  tmc->header.type = htons (GNUNET_MESSAGE_TYPE_CORE_CONFIRM_TYPE_MAP);
+  tmc->reserved = htonl (0);
+  GSC_TYPEMAP_hash (nmap, &tmc->tm_hash);
+  GNUNET_CONTAINER_DLL_insert (session->sme_head, session->sme_tail, sme);
+  try_transmission (session);
+  GSC_CLIENTS_notify_clients_about_neighbour (peer, session->tmap, nmap);
+  GSC_TYPEMAP_destroy (session->tmap);
+  session->tmap = nmap;
+}
+
+
+/**
+ * The given peer send a message of the specified type.  Make sure the
+ * respective bit is set in its type-map and that clients are notified
+ * about the session.
+ *
+ * @param peer peer this is about
+ * @param type type of the message
+ */
+void
+GSC_SESSIONS_add_to_typemap (const struct GNUNET_PeerIdentity *peer,
+                             uint16_t type)
+{
+  struct Session *session;
+  struct GSC_TypeMap *nmap;
+
+  if (0 == memcmp (peer, &GSC_my_identity, sizeof(struct GNUNET_PeerIdentity)))
+    return;
+  session = find_session (peer);
+  GNUNET_assert (NULL != session);
+  if (GNUNET_YES == GSC_TYPEMAP_test_match (session->tmap, &type, 1))
+    return; /* already in it */
+  nmap = GSC_TYPEMAP_extend (session->tmap, &type, 1);
+  GSC_CLIENTS_notify_clients_about_neighbour (peer, session->tmap, nmap);
+  GSC_TYPEMAP_destroy (session->tmap);
+  session->tmap = nmap;
+}
+
+
+/**
+ * Initialize sessions subsystem.
+ */
+void
+GSC_SESSIONS_init ()
+{
+  sessions = GNUNET_CONTAINER_multipeermap_create (128, GNUNET_YES);
+}
+
+
+/**
+ * Helper function for #GSC_SESSIONS_done() to free all
+ * active sessions.
+ *
+ * @param cls NULL
+ * @param key identity of the connected peer
+ * @param value the `struct Session` for the peer
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+free_session_helper (void *cls,
+                     const struct GNUNET_PeerIdentity *key,
+                     void *value)
+{
+  /* struct Session *session = value; */
+
+  GSC_SESSIONS_end (key);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Shutdown sessions subsystem.
+ */
+void
+GSC_SESSIONS_done ()
+{
+  if (NULL != sessions)
+  {
+    GNUNET_CONTAINER_multipeermap_iterate (sessions,
+                                           &free_session_helper,
+                                           NULL);
+    GNUNET_CONTAINER_multipeermap_destroy (sessions);
+    sessions = NULL;
+  }
+}
+
+
+/* end of gnunet-service-core_sessions.c */
diff --git a/src/service/core/gnunet-service-core_sessions.h b/src/service/core/gnunet-service-core_sessions.h
new file mode 100644
index 000000000..fda2cc32c
--- /dev/null
+++ b/src/service/core/gnunet-service-core_sessions.h
@@ -0,0 +1,183 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009-2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_neighbours.h
+ * @brief code for managing of 'encrypted' sessions (key exchange done)
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_CORE_SESSIONS_H
+#define GNUNET_SERVICE_CORE_SESSIONS_H
+
+#include "gnunet-service-core.h"
+#include "gnunet-service-core_kx.h"
+
+
+/**
+ * Create a session, a key exchange was just completed.
+ *
+ * @param peer peer that is now connected
+ * @param kx key exchange that completed
+ */
+void
+GSC_SESSIONS_create (const struct GNUNET_PeerIdentity *peer,
+                     struct GSC_KeyExchangeInfo *kx);
+
+
+/**
+ * The other peer has indicated that it 'lost' the session
+ * (KX down), reinitialize the session on our end, in particular
+ * this means to restart the typemap transmission.
+ *
+ * @param peer peer that is now connected
+ */
+void
+GSC_SESSIONS_reinit (const struct GNUNET_PeerIdentity *peer);
+
+
+/**
+ * The other peer has confirmed receiving our type map,
+ * check if it is current and if so, stop retransmitting it.
+ *
+ * @param peer peer that confirmed the type map
+ * @param msg confirmation message we received
+ */
+void
+GSC_SESSIONS_confirm_typemap (const struct GNUNET_PeerIdentity *peer,
+                              const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * End the session with the given peer (we are no longer
+ * connected).
+ *
+ * @param pid identity of peer to kill session with
+ */
+void
+GSC_SESSIONS_end (const struct GNUNET_PeerIdentity *pid);
+
+
+/**
+ * Traffic is being solicited for the given peer.  This means that the
+ * message queue on the transport-level (NEIGHBOURS subsystem) is now
+ * empty and it is now OK to transmit another (non-control) message.
+ *
+ * @param pid identity of peer ready to receive data
+ */
+void
+GSC_SESSIONS_solicit (const struct GNUNET_PeerIdentity *pid);
+
+
+/**
+ * Queue a request from a client for transmission to a particular peer.
+ *
+ * @param car request to queue; this handle is then shared between
+ *         the caller (CLIENTS subsystem) and SESSIONS and must not
+ *         be released by either until either 'GNUNET_SESSIONS_dequeue',
+ *         or 'GNUNET_CLIENTS_failed'
+ *         have been invoked on it
+ */
+void
+GSC_SESSIONS_queue_request (struct GSC_ClientActiveRequest *car);
+
+
+/**
+ * Dequeue a request from a client from transmission to a particular peer.
+ *
+ * @param car request to dequeue; this handle will then be 'owned' by
+ *        the caller (CLIENTS sysbsystem)
+ */
+void
+GSC_SESSIONS_dequeue_request (struct GSC_ClientActiveRequest *car);
+
+
+/**
+ * Transmit a message to a particular peer.
+ *
+ * @param car original request that was queued and then solicited,
+ *            ownership does not change (dequeue will be called soon).
+ * @param msg message to transmit
+ * @param priority how important is this message
+ */
+void
+GSC_SESSIONS_transmit (struct GSC_ClientActiveRequest *car,
+                       const struct GNUNET_MessageHeader *msg,
+                       enum GNUNET_MQ_PriorityPreferences priority);
+
+
+/**
+ * Broadcast an updated typemap message to all neighbours.
+ * Restarts the retransmissions until the typemaps are confirmed.
+ *
+ * @param msg message to transmit
+ */
+void
+GSC_SESSIONS_broadcast_typemap (const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * We have a new client, notify it about all current sessions.
+ *
+ * @param client the new client
+ */
+void
+GSC_SESSIONS_notify_client_about_sessions (struct GSC_Client *client);
+
+
+/**
+ * We've received a typemap message from a peer, update ours.
+ * Notifies clients about the session.
+ *
+ * @param peer peer this is about
+ * @param msg typemap update message
+ */
+void
+GSC_SESSIONS_set_typemap (const struct GNUNET_PeerIdentity *peer,
+                          const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * The given peer send a message of the specified type.  Make sure the
+ * respective bit is set in its type-map and that clients are notified
+ * about the session.
+ *
+ * @param peer peer this is about
+ * @param type type of the message
+ */
+void
+GSC_SESSIONS_add_to_typemap (const struct GNUNET_PeerIdentity *peer,
+                             uint16_t type);
+
+
+/**
+ * Initialize sessions subsystem.
+ */
+void
+GSC_SESSIONS_init (void);
+
+
+/**
+ * Shutdown sessions subsystem.
+ */
+void
+GSC_SESSIONS_done (void);
+
+
+#endif
diff --git a/src/service/core/gnunet-service-core_typemap.c b/src/service/core/gnunet-service-core_typemap.c
new file mode 100644
index 000000000..200a84b23
--- /dev/null
+++ b/src/service/core/gnunet-service-core_typemap.c
@@ -0,0 +1,370 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011-2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_typemap.c
+ * @brief management of map that specifies which message types this peer supports
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet-service-core.h"
+#include "gnunet-service-core_sessions.h"
+#include "gnunet-service-core_typemap.h"
+#include <zlib.h>
+
+
+/**
+ * A type map describing which messages a given neighbour is able
+ * to process.
+ */
+struct GSC_TypeMap
+{
+  uint32_t bits[(UINT16_MAX + 1) / 32];
+};
+
+/**
+ * Bitmap of message types this peer is able to handle.
+ */
+static struct GSC_TypeMap my_type_map;
+
+/**
+ * Counters for message types this peer is able to handle.
+ */
+static uint8_t map_counters[UINT16_MAX + 1];
+
+/**
+ * Current hash of our (uncompressed) type map.
+ * Lazily computed when needed.
+ */
+static struct GNUNET_HashCode my_tm_hash;
+
+/**
+ * Is #my_tm_hash() current with respect to our type map?
+ */
+static int hash_current;
+
+
+/**
+ * Our type map changed, recompute its hash.
+ */
+static void
+rehash_typemap ()
+{
+  hash_current = GNUNET_NO;
+}
+
+
+/**
+ * Hash the contents of a type map.
+ *
+ * @param tm map to hash
+ * @param hc where to store the hash code
+ */
+void
+GSC_TYPEMAP_hash (const struct GSC_TypeMap *tm, struct GNUNET_HashCode *hc)
+{
+  GNUNET_CRYPTO_hash (tm, sizeof(struct GSC_TypeMap), hc);
+}
+
+
+/**
+ * Check if the given hash matches our current type map.
+ *
+ * @param hc hash code to check if it matches our type map
+ * @return #GNUNET_YES if the hash matches, #GNUNET_NO if not
+ */
+int
+GSC_TYPEMAP_check_hash (const struct GNUNET_HashCode *hc)
+{
+  if (GNUNET_NO == hash_current)
+  {
+    GSC_TYPEMAP_hash (&my_type_map, &my_tm_hash);
+    hash_current = GNUNET_YES;
+  }
+  return (0 == memcmp (hc, &my_tm_hash, sizeof(struct GNUNET_HashCode)))
+         ? GNUNET_YES
+         : GNUNET_NO;
+}
+
+
+/**
+ * Compute a type map message for this peer.
+ *
+ * @return this peers current type map message.
+ */
+struct GNUNET_MessageHeader *
+GSC_TYPEMAP_compute_type_map_message ()
+{
+  char *tmp;
+  uLongf dlen;
+  struct GNUNET_MessageHeader *hdr;
+
+#ifdef compressBound
+  dlen = compressBound (sizeof(my_type_map));
+#else
+  dlen = sizeof(my_type_map) + (sizeof(my_type_map) / 100) + 20;
+  /* documentation says 100.1% oldSize + 12 bytes, but we
+   * should be able to overshoot by more to be safe */
+#endif
+  hdr = GNUNET_malloc (dlen + sizeof(struct GNUNET_MessageHeader));
+  tmp = (char *) &hdr[1];
+  if ((Z_OK != compress2 ((Bytef *) tmp,
+                          &dlen,
+                          (const Bytef *) &my_type_map,
+                          sizeof(my_type_map),
+                          9)) ||
+      (dlen >= sizeof(my_type_map)))
+  {
+    /* compression failed, use uncompressed map */
+    dlen = sizeof(my_type_map);
+    GNUNET_memcpy (tmp, &my_type_map, sizeof(my_type_map));
+    hdr->type = htons (GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP);
+  }
+  else
+  {
+    /* compression worked, use compressed map */
+    hdr->type = htons (GNUNET_MESSAGE_TYPE_CORE_COMPRESSED_TYPE_MAP);
+  }
+  hdr->size = htons ((uint16_t) dlen + sizeof(struct GNUNET_MessageHeader));
+  return hdr;
+}
+
+
+/**
+ * Extract a type map from a TYPE_MAP message.
+ *
+ * @param msg a type map message
+ * @return NULL on error
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_get_from_message (const struct GNUNET_MessageHeader *msg)
+{
+  struct GSC_TypeMap *ret;
+  uint16_t size;
+  uLongf dlen;
+
+  size = ntohs (msg->size);
+  switch (ntohs (msg->type))
+  {
+  case GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# type maps received"),
+                              1,
+                              GNUNET_NO);
+    if (size != sizeof(struct GSC_TypeMap))
+    {
+      GNUNET_break_op (0);
+      return NULL;
+    }
+    ret = GNUNET_new (struct GSC_TypeMap);
+    GNUNET_memcpy (ret, &msg[1], sizeof(struct GSC_TypeMap));
+    return ret;
+
+  case GNUNET_MESSAGE_TYPE_CORE_COMPRESSED_TYPE_MAP:
+    GNUNET_STATISTICS_update (GSC_stats,
+                              gettext_noop ("# type maps received"),
+                              1,
+                              GNUNET_NO);
+    ret = GNUNET_new (struct GSC_TypeMap);
+    dlen = sizeof(struct GSC_TypeMap);
+    if ((Z_OK != uncompress ((Bytef *) ret,
+                             &dlen,
+                             (const Bytef *) &msg[1],
+                             (uLong) size)) ||
+        (dlen != sizeof(struct GSC_TypeMap)))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (ret);
+      return NULL;
+    }
+    return ret;
+
+  default:
+    GNUNET_break (0);
+    return NULL;
+  }
+}
+
+
+/**
+ * Send my type map to all connected peers (it got changed).
+ */
+static void
+broadcast_my_type_map ()
+{
+  struct GNUNET_MessageHeader *hdr;
+
+  hdr = GSC_TYPEMAP_compute_type_map_message ();
+  GNUNET_STATISTICS_update (GSC_stats,
+                            gettext_noop ("# updates to my type map"),
+                            1,
+                            GNUNET_NO);
+  GSC_SESSIONS_broadcast_typemap (hdr);
+  GNUNET_free (hdr);
+}
+
+
+/**
+ * Add a set of types to our type map.
+ *
+ * @param types array of message types supported by this peer
+ * @param tlen number of entries in @a types
+ */
+void
+GSC_TYPEMAP_add (const uint16_t *types, unsigned int tlen)
+{
+  unsigned int i;
+  int changed;
+
+  changed = GNUNET_NO;
+  for (i = 0; i < tlen; i++)
+  {
+    if (0 == map_counters[types[i]]++)
+    {
+      my_type_map.bits[types[i] / 32] |= (1 << (types[i] % 32));
+      changed = GNUNET_YES;
+    }
+  }
+  if (GNUNET_YES == changed)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Typemap changed, broadcasting!\n");
+    rehash_typemap ();
+    broadcast_my_type_map ();
+  }
+}
+
+
+void
+GSC_TYPEMAP_remove (const uint16_t *types, unsigned int tlen)
+{
+  int changed;
+
+  changed = GNUNET_NO;
+  for (unsigned int i = 0; i < tlen; i++)
+  {
+    if (0 == --map_counters[types[i]])
+    {
+      my_type_map.bits[types[i] / 32] &= ~(1 << (types[i] % 32));
+      changed = GNUNET_YES;
+    }
+  }
+  if (GNUNET_YES == changed)
+  {
+    rehash_typemap ();
+    broadcast_my_type_map ();
+  }
+}
+
+
+/**
+ * Test if any of the types from the types array is in the
+ * given type map.
+ *
+ * @param tmap map to test
+ * @param types array of types
+ * @param tcnt number of entries in @a types
+ * @return #GNUNET_YES if a type is in the map, #GNUNET_NO if not
+ */
+int
+GSC_TYPEMAP_test_match (const struct GSC_TypeMap *tmap,
+                        const uint16_t *types,
+                        unsigned int tcnt)
+{
+  if (NULL == tmap)
+    return GNUNET_NO;
+  if (0 == tcnt)
+    return GNUNET_YES; /* matches all */
+  for (unsigned int i = 0; i < tcnt; i++)
+    if (0 != (tmap->bits[types[i] / 32] & (1 << (types[i] % 32))))
+      return GNUNET_YES;
+  return GNUNET_NO;
+}
+
+
+/**
+ * Add additional types to a given typemap.
+ *
+ * @param tmap map to extend (not changed)
+ * @param types array of types to add
+ * @param tcnt number of entries in @a types
+ * @return updated type map (fresh copy)
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_extend (const struct GSC_TypeMap *tmap,
+                    const uint16_t *types,
+                    unsigned int tcnt)
+{
+  struct GSC_TypeMap *ret;
+
+  ret = GNUNET_new (struct GSC_TypeMap);
+  if (NULL != tmap)
+    GNUNET_memcpy (ret, tmap, sizeof(struct GSC_TypeMap));
+  for (unsigned int i = 0; i < tcnt; i++)
+    ret->bits[types[i] / 32] |= (1 << (types[i] % 32));
+  return ret;
+}
+
+
+/**
+ * Create an empty type map.
+ *
+ * @return an empty type map
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_create ()
+{
+  return GNUNET_new (struct GSC_TypeMap);
+}
+
+
+/**
+ * Free the given type map.
+ *
+ * @param tmap a type map
+ */
+void
+GSC_TYPEMAP_destroy (struct GSC_TypeMap *tmap)
+{
+  GNUNET_free (tmap);
+}
+
+
+/**
+ * Initialize typemap subsystem.
+ */
+void
+GSC_TYPEMAP_init ()
+{
+  /* nothing to do */
+}
+
+
+/**
+ * Shutdown typemap subsystem.
+ */
+void
+GSC_TYPEMAP_done ()
+{
+  /* nothing to do */
+}
+
+
+/* end of gnunet-service-core_typemap.c */
diff --git a/src/service/core/gnunet-service-core_typemap.h b/src/service/core/gnunet-service-core_typemap.h
new file mode 100644
index 000000000..de41f4220
--- /dev/null
+++ b/src/service/core/gnunet-service-core_typemap.h
@@ -0,0 +1,162 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/gnunet-service-core_typemap.h
+ * @brief management of map that specifies which message types this peer supports
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_CORE_TYPEMAP_H
+#define GNUNET_SERVICE_CORE_TYPEMAP_H
+
+#include "gnunet_util_lib.h"
+
+/**
+ * Map specifying which message types a peer supports.
+ */
+struct GSC_TypeMap;
+
+
+/**
+ * Add a set of types to our type map.
+ *
+ * @param types array of message types supported by this peer
+ * @param tlen number of entries in @a types
+ */
+void
+GSC_TYPEMAP_add (const uint16_t *types,
+                 unsigned int tlen);
+
+
+/**
+ * Remove a set of message types from our type map.
+ *
+ * @param types array of message types no longer supported by this peer
+ * @param tlen number of entries in @a types
+ */
+void
+GSC_TYPEMAP_remove (const uint16_t *types,
+                    unsigned int tlen);
+
+
+/**
+ * Compute a type map message for this peer.
+ *
+ * @return this peers current type map message.
+ */
+struct GNUNET_MessageHeader *
+GSC_TYPEMAP_compute_type_map_message (void);
+
+
+/**
+ * Check if the given hash matches our current type map.
+ *
+ * @param hc hash code to check if it matches our type map
+ * @return #GNUNET_YES if the hash matches, #GNUNET_NO if not
+ */
+int
+GSC_TYPEMAP_check_hash (const struct GNUNET_HashCode *hc);
+
+
+/**
+ * Hash the contents of a type map.
+ *
+ * @param tm map to hash
+ * @param hc where to store the hash code
+ */
+void
+GSC_TYPEMAP_hash (const struct GSC_TypeMap *tm,
+                  struct GNUNET_HashCode *hc);
+
+
+/**
+ * Extract a type map from a
+ * #GNUNET_MESSAGE_TYPE_CORE_COMRESSED_TYPE_MAP or
+ * #GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP message.
+ *
+ * @param msg a type map message
+ * @return NULL on error
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_get_from_message (const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * Test if any of the types from the types array is in the
+ * given type map.
+ *
+ * @param tmap map to test
+ * @param types array of types
+ * @param tcnt number of entries in @a types
+ * @return #GNUNET_YES if a type is in the map, #GNUNET_NO if not
+ */
+int
+GSC_TYPEMAP_test_match (const struct GSC_TypeMap *tmap,
+                        const uint16_t *types,
+                        unsigned int tcnt);
+
+
+/**
+ * Add additional types to a given typemap.
+ *
+ * @param tmap map to extend (not changed)
+ * @param types array of types to add
+ * @param tcnt number of entries in @a types
+ * @return updated type map (fresh copy)
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_extend (const struct GSC_TypeMap *tmap,
+                    const uint16_t *types,
+                    unsigned int tcnt);
+
+
+/**
+ * Create an empty type map.
+ *
+ * @return an empty type map
+ */
+struct GSC_TypeMap *
+GSC_TYPEMAP_create (void);
+
+
+/**
+ * Free the given type map.
+ *
+ * @param tmap a type map
+ */
+void
+GSC_TYPEMAP_destroy (struct GSC_TypeMap *tmap);
+
+
+/**
+ * Initialize typemap subsystem.
+ */
+void
+GSC_TYPEMAP_init (void);
+
+
+/**
+ * Shutdown typemap subsystem.
+ */
+void
+GSC_TYPEMAP_done (void);
+
+#endif
+/* end of gnunet-service-core_typemap.h */
diff --git a/src/service/core/meson.build b/src/service/core/meson.build
new file mode 100644
index 000000000..2e3e958af
--- /dev/null
+++ b/src/service/core/meson.build
@@ -0,0 +1,119 @@
+libgnunetcore_src = ['core_api.c',
+                    'core_api_monitor_peers.c']
+
+gnunetservicecore_src = ['gnunet-service-core.c',
+                        'gnunet-service-core_kx.c',
+                        'gnunet-service-core_sessions.c',
+                        'gnunet-service-core_typemap.c']
+
+configure_file(input : 'core.conf.in',
+               output : 'core.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+
+if get_option('monolith')
+  foreach p : libgnunetcore_src + gnunetservicecore_src
+    gnunet_src += 'core/' + p
+  endforeach
+  subdir_done()
+endif
+
+libgnunetcore = library('gnunetcore',
+          libgnunetcore_src,
+          dependencies: libgnunetutil_dep,
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          soversion: '0',
+          version: '0.0.1',
+          install_dir: get_option('libdir'))
+libgnunetcore_dep = declare_dependency(link_with : libgnunetcore)
+pkg.generate(libgnunetcore, url: 'https://www.gnunet.org',
+             description : 'Provides API for (encrypted) P2P communication')
+
+libgnunetcoretesting = library('gnunetcoretesting',
+          ['core_api_cmd_connecting_peers.c'],
+          dependencies: [
+            libgnunetutil_dep,
+            libgnunettesting_dep,
+            libgnunetarm_dep,
+            libgnunettransportapplication_dep,
+            libgnunettransportcore_dep,
+          ],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          soversion: '0',
+          version: '0.0.0',
+          install_dir: get_option('libdir'))
+libgnunetcoretesting_dep = declare_dependency(link_with : libgnunetcoretesting)
+
+shared_module('gnunet_test_core_plugin_cmd_just_run',
+        ['test_core_plugin_cmd_just_run.c'],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetcoretesting_dep,
+                       libgnunettransportcore_dep,
+                       libgnunettransportapplication_dep,
+                       libgnunettesting_dep,
+                       libgnunetpeerstore_dep,
+                       libgnunetstatistics_dep,
+                       libgnunethello_dep,
+                       libgnunetarm_dep
+                       ],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir')/'gnunet')
+
+executable ('gnunet-core',
+            ['gnunet-core.c'],
+            dependencies: [libgnunetcore_dep, libgnunetutil_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('bindir'))
+
+executable ('gnunet-service-core',
+            gnunetservicecore_src,
+            dependencies: [libgnunetcore_dep, libgnunetutil_dep,
+                           libgnunetstatistics_dep,
+                           libgnunettransportcore_dep,
+                           zlib_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir') / 'gnunet' / 'libexec')
+
+configure_file(input : 'test_core_defaults.conf',
+               output : 'test_core_defaults.conf',
+               copy: true)
+
+configure_file(input : 'test_core_api_send_to_self.conf',
+               output : 'test_core_api_send_to_self.conf',
+               copy: true)
+
+configure_file(input : 'test_core_api_peer1.conf',
+               output : 'test_core_api_peer1.conf',
+               copy: true)
+
+testcore_api_send_self = executable ('test_core_api_send_to_self',
+            ['test_core_api_send_to_self.c'],
+            dependencies: [
+              libgnunetcore_dep,
+              libgnunetutil_dep,
+              libgnunettesting_dep
+              ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+testcore_api_start = executable ('test_core_api_start_only',
+            ['test_core_api_send_to_self.c'],
+            dependencies: [
+              libgnunetcore_dep,
+              libgnunetutil_dep,
+              libgnunettesting_dep
+              ],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+test('test_core_api_send_to_self', testcore_api_send_self,
+  suite: 'core', workdir: meson.current_build_dir())
+test('test_core_api_start_only', testcore_api_start,
+  suite: 'core', workdir: meson.current_build_dir())
diff --git a/src/service/core/test_core_api.c b/src/service/core/test_core_api.c
new file mode 100644
index 000000000..653ce1aa0
--- /dev/null
+++ b/src/service/core/test_core_api.c
@@ -0,0 +1,348 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file core/test_core_api.c
+ * @brief testcase for core_api.c
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_core_service.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_transport_service.h"
+#include "gnunet_transport_hello_service.h"
+#include "gnunet_ats_service.h"
+
+#define MTYPE 12345
+
+struct PeerContext
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CORE_Handle *ch;
+  struct GNUNET_PeerIdentity id;
+  struct GNUNET_TRANSPORT_OfferHelloHandle *oh;
+  struct GNUNET_TRANSPORT_HelloGetHandle *ghh;
+  struct GNUNET_ATS_ConnectivityHandle *ats;
+  struct GNUNET_ATS_ConnectivitySuggestHandle *ats_sh;
+  struct GNUNET_MessageHeader *hello;
+  int connect_status;
+  struct GNUNET_OS_Process *arm_proc;
+};
+
+static struct PeerContext p1;
+
+static struct PeerContext p2;
+
+static struct GNUNET_SCHEDULER_Task *err_task;
+
+static int ok;
+
+#define OKPP                                  \
+  do                                          \
+  {                                           \
+    ok++;                                     \
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,      \
+                "Now at stage %u at %s:%u\n", \
+                ok,                           \
+                __FILE__,                     \
+                __LINE__);                    \
+  } while (0)
+
+
+static void
+offer_hello_done (void *cls)
+{
+  struct PeerContext *p = cls;
+
+  p->oh = NULL;
+}
+
+
+static void
+process_hello (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  struct PeerContext *p = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received (my) HELLO from transport service\n");
+  GNUNET_assert (message != NULL);
+  if ((p == &p1) && (NULL == p2.oh))
+    p2.oh =
+      GNUNET_TRANSPORT_offer_hello (p2.cfg, message, &offer_hello_done, &p2);
+  if ((p == &p2) && (NULL == p1.oh))
+    p1.oh =
+      GNUNET_TRANSPORT_offer_hello (p1.cfg, message, &offer_hello_done, &p1);
+}
+
+
+static void
+terminate_peer (struct PeerContext *p)
+{
+  if (NULL != p->ch)
+  {
+    GNUNET_CORE_disconnect (p->ch);
+    p->ch = NULL;
+  }
+  if (NULL != p->ghh)
+  {
+    GNUNET_TRANSPORT_hello_get_cancel (p->ghh);
+    p->ghh = NULL;
+  }
+  if (NULL != p->oh)
+  {
+    GNUNET_TRANSPORT_offer_hello_cancel (p->oh);
+    p->oh = NULL;
+  }
+  if (NULL != p->ats_sh)
+  {
+    GNUNET_ATS_connectivity_suggest_cancel (p->ats_sh);
+    p->ats_sh = NULL;
+  }
+  if (NULL != p->ats)
+  {
+    GNUNET_ATS_connectivity_done (p->ats);
+    p->ats = NULL;
+  }
+}
+
+
+static void
+terminate_task (void *cls)
+{
+  GNUNET_assert (ok == 6);
+  terminate_peer (&p1);
+  terminate_peer (&p2);
+  ok = 0;
+}
+
+
+static void
+terminate_task_error (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "ENDING ANGRILY %u\n", ok);
+  GNUNET_break (0);
+  terminate_peer (&p1);
+  terminate_peer (&p2);
+  ok = 42;
+}
+
+
+static void *
+connect_notify (void *cls,
+                const struct GNUNET_PeerIdentity *peer,
+                struct GNUNET_MQ_Handle *mq)
+{
+  struct PeerContext *pc = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  if (0 == memcmp (&pc->id, peer, sizeof(struct GNUNET_PeerIdentity)))
+    return (void *) peer;
+  GNUNET_assert (pc->connect_status == 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Encrypted connection established to peer `%s'\n",
+              GNUNET_i2s (peer));
+  pc->connect_status = 1;
+  if (pc == &p1)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Asking core (1) for transmission to peer `%s'\n",
+                GNUNET_i2s (&p2.id));
+    env = GNUNET_MQ_msg (msg, MTYPE);
+    /* enable corking for this test */
+    GNUNET_MQ_env_set_options (env,
+                               GNUNET_MQ_PRIO_BEST_EFFORT
+                               | GNUNET_MQ_PREF_CORK_ALLOWED);
+    /* now actually transmit message */
+    GNUNET_assert (ok == 4);
+    OKPP;
+    GNUNET_MQ_send (mq, env);
+  }
+  return (void *) peer;
+}
+
+
+static void
+disconnect_notify (void *cls,
+                   const struct GNUNET_PeerIdentity *peer,
+                   void *internal_cls)
+{
+  struct PeerContext *pc = cls;
+
+  if (0 == memcmp (&pc->id, peer, sizeof(struct GNUNET_PeerIdentity)))
+    return;
+  pc->connect_status = 0;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Encrypted connection to `%s' cut\n",
+              GNUNET_i2s (peer));
+}
+
+
+static void
+handle_test (void *cls, const struct GNUNET_MessageHeader *message)
+{
+  const struct GNUNET_PeerIdentity *peer = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving message from `%s'.\n",
+              GNUNET_i2s (peer));
+  GNUNET_assert (ok == 5);
+  OKPP;
+  GNUNET_SCHEDULER_cancel (err_task);
+  err_task = GNUNET_SCHEDULER_add_now (&terminate_task, NULL);
+}
+
+
+static void
+init_notify (void *cls, const struct GNUNET_PeerIdentity *my_identity)
+{
+  struct PeerContext *p = cls;
+  struct GNUNET_MQ_MessageHandler handlers[] =
+  { GNUNET_MQ_hd_fixed_size (test, MTYPE, struct GNUNET_MessageHeader, NULL),
+    GNUNET_MQ_handler_end () };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Core connection to `%s' established\n",
+              GNUNET_i2s (my_identity));
+  p->id = *my_identity;
+  if (cls == &p1)
+  {
+    GNUNET_assert (ok == 2);
+    OKPP;
+    /* connect p2 */
+    p2.ch = GNUNET_CORE_connect (p2.cfg,
+                                 &p2,
+                                 &init_notify,
+                                 &connect_notify,
+                                 &disconnect_notify,
+                                 handlers);
+  }
+  else
+  {
+    GNUNET_assert (ok == 3);
+    OKPP;
+    GNUNET_assert (cls == &p2);
+    p1.ats_sh = GNUNET_ATS_connectivity_suggest (p1.ats, &p2.id, 1);
+  }
+}
+
+
+static void
+setup_peer (struct PeerContext *p, const char *cfgname)
+{
+  char *binary;
+
+  binary = GNUNET_OS_get_libexec_binary_path ("gnunet-service-arm");
+  p->cfg = GNUNET_CONFIGURATION_create ();
+  p->arm_proc = GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                                         | GNUNET_OS_USE_PIPE_CONTROL,
+                                         NULL,
+                                         NULL,
+                                         NULL,
+                                         binary,
+                                         "gnunet-service-arm",
+                                         "-c",
+                                         cfgname,
+                                         NULL);
+  GNUNET_assert (GNUNET_OK == GNUNET_CONFIGURATION_load (p->cfg, cfgname));
+  p->ats = GNUNET_ATS_connectivity_init (p->cfg);
+  GNUNET_assert (NULL != p->ats);
+  p->ghh = GNUNET_TRANSPORT_hello_get (p->cfg,
+                                       GNUNET_TRANSPORT_AC_ANY,
+                                       &process_hello,
+                                       p);
+  GNUNET_free (binary);
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] =
+  { GNUNET_MQ_hd_fixed_size (test, MTYPE, struct GNUNET_MessageHeader, NULL),
+    GNUNET_MQ_handler_end () };
+
+  GNUNET_assert (ok == 1);
+  OKPP;
+  setup_peer (&p1, "test_core_api_peer1.conf");
+  setup_peer (&p2, "test_core_api_peer2.conf");
+  err_task = GNUNET_SCHEDULER_add_delayed (
+    GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 300),
+    &terminate_task_error,
+    NULL);
+  p1.ch = GNUNET_CORE_connect (p1.cfg,
+                               &p1,
+                               &init_notify,
+                               &connect_notify,
+                               &disconnect_notify,
+                               handlers);
+}
+
+
+static void
+stop_arm (struct PeerContext *p)
+{
+  if (0 != GNUNET_OS_process_kill (p->arm_proc, GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
+  if (GNUNET_OK != GNUNET_OS_process_wait (p->arm_proc))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "waitpid");
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "ARM process %u stopped\n",
+              GNUNET_OS_process_get_pid (p->arm_proc));
+  GNUNET_OS_process_destroy (p->arm_proc);
+  p->arm_proc = NULL;
+  GNUNET_CONFIGURATION_destroy (p->cfg);
+}
+
+
+int
+main (int argc, char *argv1[])
+{
+  char *const argv[] = { "test-core-api", "-c", "test_core_api_data.conf",
+                         NULL };
+  struct GNUNET_GETOPT_CommandLineOption options[] =
+  { GNUNET_GETOPT_OPTION_END };
+
+  ok = 1;
+  GNUNET_log_setup ("test-core-api", "WARNING", NULL);
+  GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                      argv,
+                      "test-core-api",
+                      "nohelp",
+                      options,
+                      &run,
+                      &ok);
+  stop_arm (&p1);
+  stop_arm (&p2);
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer1.conf", 
+       "GNUNET_TEST_HOME");
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer2.conf", 
+       "GNUNET_TEST_HOME");
+
+  return ok;
+}
+
+
+/* end of test_core_api.c */
diff --git a/src/service/core/test_core_api_data.conf b/src/service/core/test_core_api_data.conf
new file mode 100644
index 000000000..420849ba9
--- /dev/null
+++ b/src/service/core/test_core_api_data.conf
@@ -0,0 +1,11 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+
+[ats]
+WAN_QUOTA_IN = 64 kiB
+WAN_QUOTA_OUT = 64 kiB
+
+[core]
+PORT = 52092
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-core.sock
+
diff --git a/src/service/core/test_core_api_peer1.conf b/src/service/core/test_core_api_peer1.conf
new file mode 100644
index 000000000..28463effe
--- /dev/null
+++ b/src/service/core/test_core_api_peer1.conf
@@ -0,0 +1,42 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-peer-1/
+
+[arm]
+PORT = 12460
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-arm.sock
+
+[statistics]
+PORT = 12461
+
+[resolver]
+PORT = 12462
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-resolver.sock
+
+[peerinfo]
+PORT = 12463
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-peerinfo.sock
+
+[transport]
+PORT = 12464
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-transport.sock
+
+[core]
+PORT = 12475
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-core.sock
+
+[ats]
+PORT = 12476
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-ats.sock
+
+[transport-tcp]
+PORT = 12467
+
+[transport-udp]
+PORT = 12468
+
+[transport-unix]
+PORT = 12469
+
+[transport-http]
+PORT = 12470
diff --git a/src/service/core/test_core_api_peer2.conf b/src/service/core/test_core_api_peer2.conf
new file mode 100644
index 000000000..819d58d17
--- /dev/null
+++ b/src/service/core/test_core_api_peer2.conf
@@ -0,0 +1,43 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-peer-2/
+
+[arm]
+PORT = 22460
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-arm.sock
+
+[statistics]
+PORT = 22461
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-statistics.sock
+
+[resolver]
+PORT = 22462
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-resolver.sock
+
+[peerinfo]
+PORT = 22463
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-peerinfo.sock
+
+[transport]
+PORT = 22464
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-transport.sock
+
+[core]
+PORT = 22475
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-core.sock
+
+[ats]
+PORT = 22476
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-ats.sock
+
+[transport-tcp]
+PORT = 22467
+
+[transport-udp]
+PORT = 22468
+
+[transport-unix]
+PORT = 22469
+
+[transport-http]
+PORT = 22470
diff --git a/src/service/core/test_core_api_reliability.c b/src/service/core/test_core_api_reliability.c
new file mode 100644
index 000000000..d4b55a6b8
--- /dev/null
+++ b/src/service/core/test_core_api_reliability.c
@@ -0,0 +1,537 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file core/test_core_api_reliability.c
+ * @brief testcase for core_api.c focusing on reliable transmission (with TCP)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_core_service.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_ats_service.h"
+#include "gnunet_transport_service.h"
+#include "gnunet_transport_hello_service.h"
+#include <gauger.h>
+
+/**
+ * Note that this value must not significantly exceed
+ * 'MAX_PENDING' in 'gnunet-service-transport.c', otherwise
+ * messages may be dropped even for a reliable transport.
+ */
+#define TOTAL_MSGS (600 * 10)
+
+/**
+ * How long until we give up on transmitting the message?
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 600)
+
+#define MTYPE 12345
+
+
+static unsigned long long total_bytes;
+
+static struct GNUNET_TIME_Absolute start_time;
+
+static struct GNUNET_SCHEDULER_Task *err_task;
+
+
+struct PeerContext
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CORE_Handle *ch;
+  struct GNUNET_MQ_Handle *mq;
+  struct GNUNET_PeerIdentity id;
+  struct GNUNET_TRANSPORT_OfferHelloHandle *oh;
+  struct GNUNET_MessageHeader *hello;
+  struct GNUNET_TRANSPORT_HelloGetHandle *ghh;
+  struct GNUNET_ATS_ConnectivityHandle *ats;
+  struct GNUNET_ATS_ConnectivitySuggestHandle *ats_sh;
+  int connect_status;
+  struct GNUNET_OS_Process *arm_proc;
+};
+
+static struct PeerContext p1;
+
+static struct PeerContext p2;
+
+static int ok;
+
+static int32_t tr_n;
+
+
+#define OKPP do { ok++; GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, \
+                                    "Now at stage %u at %s:%u\n", ok, __FILE__, \
+                                    __LINE__); } while (0)
+
+struct TestMessage
+{
+  struct GNUNET_MessageHeader header;
+  uint32_t num GNUNET_PACKED;
+};
+
+
+static unsigned int
+get_size (unsigned int iter)
+{
+  unsigned int ret;
+
+  if (iter < 60000)
+    return iter + sizeof(struct TestMessage);
+  ret = (iter * iter * iter);
+  return sizeof(struct TestMessage) + (ret % 60000);
+}
+
+
+static void
+terminate_peer (struct PeerContext *p)
+{
+  if (NULL != p->ch)
+  {
+    GNUNET_CORE_disconnect (p->ch);
+    p->ch = NULL;
+  }
+  if (NULL != p->ghh)
+  {
+    GNUNET_TRANSPORT_hello_get_cancel (p->ghh);
+    p->ghh = NULL;
+  }
+  if (NULL != p->oh)
+  {
+    GNUNET_TRANSPORT_offer_hello_cancel (p->oh);
+    p->oh = NULL;
+  }
+  if (NULL != p->ats_sh)
+  {
+    GNUNET_ATS_connectivity_suggest_cancel (p->ats_sh);
+    p->ats_sh = NULL;
+  }
+  if (NULL != p->ats)
+  {
+    GNUNET_ATS_connectivity_done (p->ats);
+    p->ats = NULL;
+  }
+}
+
+
+static void
+terminate_task_error (void *cls)
+{
+  err_task = NULL;
+  GNUNET_break (0);
+  GNUNET_SCHEDULER_shutdown ();
+  ok = 42;
+}
+
+
+static void
+do_shutdown (void *cls)
+{
+  unsigned long long delta;
+
+  delta = GNUNET_TIME_absolute_get_duration (start_time).rel_value_us;
+  if (0 == delta)
+    delta = 1;
+  fprintf (stderr,
+           "\nThroughput was %llu kb/s\n",
+           total_bytes * 1000000LL / 1024 / delta);
+  GAUGER ("CORE",
+          "Core throughput/s",
+          total_bytes * 1000000LL / 1024 / delta,
+          "kb/s");
+  if (NULL != err_task)
+  {
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task = NULL;
+  }
+  terminate_peer (&p1);
+  terminate_peer (&p2);
+}
+
+
+static void
+send_message (struct GNUNET_MQ_Handle *mq,
+              int32_t num)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct TestMessage *hdr;
+  unsigned int s;
+
+  GNUNET_assert (NULL != mq);
+  GNUNET_assert (tr_n < TOTAL_MSGS);
+  s = get_size (tr_n);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending message %u of size %u\n",
+              tr_n,
+              s);
+  env = GNUNET_MQ_msg_extra (hdr,
+                             s - sizeof(struct TestMessage),
+                             MTYPE);
+  hdr->num = htonl (tr_n);
+  memset (&hdr[1],
+          tr_n,
+          s - sizeof(struct TestMessage));
+  tr_n++;
+  GNUNET_SCHEDULER_cancel (err_task);
+  err_task =
+    GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                  &terminate_task_error,
+                                  NULL);
+  total_bytes += s;
+  GNUNET_MQ_send (mq,
+                  env);
+}
+
+
+static void *
+connect_notify (void *cls,
+                const struct GNUNET_PeerIdentity *peer,
+                struct GNUNET_MQ_Handle *mq)
+{
+  struct PeerContext *pc = cls;
+
+  if (0 == memcmp (&pc->id,
+                   peer,
+                   sizeof(struct GNUNET_PeerIdentity)))
+    return (void *) peer;
+  pc->mq = mq;
+  GNUNET_assert (0 == pc->connect_status);
+  pc->connect_status = 1;
+  if (pc == &p1)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Encrypted connection established to peer `%s'\n",
+                GNUNET_i2s (peer));
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Asking core (1) for transmission to peer `%s'\n",
+                GNUNET_i2s (&p2.id));
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task =
+      GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                    &terminate_task_error,
+                                    NULL);
+    start_time = GNUNET_TIME_absolute_get ();
+    send_message (mq,
+                  0);
+  }
+  return (void *) peer;
+}
+
+
+static void
+disconnect_notify (void *cls,
+                   const struct GNUNET_PeerIdentity *peer,
+                   void *internal_cls)
+{
+  struct PeerContext *pc = cls;
+
+  if (0 == memcmp (&pc->id,
+                   peer,
+                   sizeof(struct GNUNET_PeerIdentity)))
+    return;
+  pc->mq = NULL;
+  pc->connect_status = 0;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Encrypted connection to `%s' cut\n",
+              GNUNET_i2s (peer));
+}
+
+
+static int
+check_test (void *cls,
+            const struct TestMessage *hdr)
+{
+  return GNUNET_OK; /* accept all */
+}
+
+
+static void
+handle_test (void *cls,
+             const struct TestMessage *hdr)
+{
+  static int n;
+  unsigned int s;
+
+  s = get_size (n);
+  if (ntohs (hdr->header.size) != s)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected message %u of size %u, got %u bytes of message %u\n",
+                n,
+                s,
+                ntohs (hdr->header.size),
+                ntohl (hdr->num));
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task = GNUNET_SCHEDULER_add_now (&terminate_task_error,
+                                         NULL);
+    return;
+  }
+  if (ntohl (hdr->num) != n)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected message %u of size %u, got %u bytes of message %u\n",
+                n,
+                s,
+                (unsigned int) ntohs (hdr->header.size),
+                (unsigned int) ntohl (hdr->num));
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task = GNUNET_SCHEDULER_add_now (&terminate_task_error,
+                                         NULL);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got message %u of size %u\n",
+              (unsigned int) ntohl (hdr->num),
+              (unsigned int) ntohs (hdr->header.size));
+  n++;
+  if (0 == (n % (TOTAL_MSGS / 100)))
+    fprintf (stderr,
+             "%s",
+             ".");
+  if (n == TOTAL_MSGS)
+  {
+    ok = 0;
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  else
+  {
+    if (n == tr_n)
+    {
+      send_message (p1.mq,
+                    tr_n);
+    }
+  }
+}
+
+
+static void
+init_notify (void *cls,
+             const struct GNUNET_PeerIdentity *my_identity)
+{
+  struct PeerContext *p = cls;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (test,
+                           MTYPE,
+                           struct TestMessage,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Connection to CORE service of `%s' established\n",
+              GNUNET_i2s (my_identity));
+  p->id = *my_identity;
+  if (cls == &p1)
+  {
+    GNUNET_assert (ok == 2);
+    OKPP;
+    /* connect p2 */
+    GNUNET_assert (NULL !=
+                   (p2.ch = GNUNET_CORE_connect (p2.cfg,
+                                                 &p2,
+                                                 &init_notify,
+                                                 &connect_notify,
+                                                 &disconnect_notify,
+                                                 handlers)));
+  }
+  else
+  {
+    GNUNET_assert (ok == 3);
+    OKPP;
+    GNUNET_assert (cls == &p2);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Asking transport (1) to connect to peer `%s'\n",
+                GNUNET_i2s (&p2.id));
+    p1.ats_sh = GNUNET_ATS_connectivity_suggest (p1.ats,
+                                                 &p2.id,
+                                                 1);
+  }
+}
+
+
+static void
+offer_hello_done (void *cls)
+{
+  struct PeerContext *p = cls;
+
+  p->oh = NULL;
+}
+
+
+static void
+process_hello (void *cls,
+               const struct GNUNET_MessageHeader *message)
+{
+  struct PeerContext *p = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received (my) `%s' from transport service\n", "HELLO");
+  GNUNET_assert (message != NULL);
+  GNUNET_free (p->hello);
+  p->hello = GNUNET_copy_message (message);
+  if ((p == &p1) && (NULL == p2.oh))
+    p2.oh = GNUNET_TRANSPORT_offer_hello (p2.cfg,
+                                          message,
+                                          &offer_hello_done,
+                                          &p2);
+  if ((p == &p2) && (NULL == p1.oh))
+    p1.oh = GNUNET_TRANSPORT_offer_hello (p1.cfg,
+                                          message,
+                                          &offer_hello_done,
+                                          &p1);
+
+  if ((p == &p1) && (p2.hello != NULL) && (NULL == p1.oh))
+    p1.oh = GNUNET_TRANSPORT_offer_hello (p1.cfg,
+                                          p2.hello,
+                                          &offer_hello_done,
+                                          &p1);
+  if ((p == &p2) && (p1.hello != NULL) && (NULL == p2.oh))
+    p2.oh = GNUNET_TRANSPORT_offer_hello (p2.cfg,
+                                          p1.hello,
+                                          &offer_hello_done,
+                                          &p2);
+}
+
+
+static void
+setup_peer (struct PeerContext *p,
+            const char *cfgname)
+{
+  char *binary;
+
+  binary = GNUNET_OS_get_libexec_binary_path ("gnunet-service-arm");
+  p->cfg = GNUNET_CONFIGURATION_create ();
+  p->arm_proc
+    = GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                               | GNUNET_OS_USE_PIPE_CONTROL,
+                               NULL, NULL, NULL,
+                               binary,
+                               "gnunet-service-arm",
+                               "-c",
+                               cfgname,
+                               NULL);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_load (p->cfg,
+                                            cfgname));
+  p->ats = GNUNET_ATS_connectivity_init (p->cfg);
+  GNUNET_assert (NULL != p->ats);
+  p->ghh = GNUNET_TRANSPORT_hello_get (p->cfg,
+                                       GNUNET_TRANSPORT_AC_ANY,
+                                       &process_hello,
+                                       p);
+  GNUNET_free (binary);
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (test,
+                             MTYPE,
+                             struct TestMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  GNUNET_assert (ok == 1);
+  OKPP;
+  setup_peer (&p1,
+              "test_core_api_peer1.conf");
+  setup_peer (&p2,
+              "test_core_api_peer2.conf");
+  err_task =
+    GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                  &terminate_task_error,
+                                  NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+
+  GNUNET_assert (NULL !=
+                 (p1.ch = GNUNET_CORE_connect (p1.cfg,
+                                               &p1,
+                                               &init_notify,
+                                               &connect_notify,
+                                               &disconnect_notify,
+                                               handlers)));
+}
+
+
+static void
+stop_arm (struct PeerContext *p)
+{
+  if (0 != GNUNET_OS_process_kill (p->arm_proc,
+                                   GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "kill");
+  if (GNUNET_OK != GNUNET_OS_process_wait (p->arm_proc))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "waitpid");
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "ARM process %u stopped\n",
+              GNUNET_OS_process_get_pid (p->arm_proc));
+  GNUNET_OS_process_destroy (p->arm_proc);
+  p->arm_proc = NULL;
+  GNUNET_CONFIGURATION_destroy (p->cfg);
+}
+
+
+int
+main (int argc,
+      char *argv1[])
+{
+  char *const argv[] = {
+    "test-core-api-reliability",
+    "-c",
+    "test_core_api_data.conf",
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  ok = 1;
+  GNUNET_log_setup ("test-core-api-reliability",
+                    "WARNING",
+                    NULL);
+  GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                      argv,
+                      "test-core-api-reliability",
+                      "nohelp",
+                      options,
+                      &run,
+                      &ok);
+  stop_arm (&p1);
+  stop_arm (&p2);
+  GNUNET_free (p1.hello);
+  GNUNET_free (p2.hello);
+  GNUNET_DISK_purge_cfg_dir ("test_core_api_peer1.conf",
+                             "GNUNET_TEST_HOME");
+  GNUNET_DISK_purge_cfg_dir ("test_core_api_peer2.conf",
+                             "GNUNET_TEST_HOME");
+
+  return ok;
+}
+
+
+/* end of test_core_api_reliability.c */
diff --git a/src/service/core/test_core_api_send_to_self.c b/src/service/core/test_core_api_send_to_self.c
new file mode 100644
index 000000000..c2e39cd26
--- /dev/null
+++ b/src/service/core/test_core_api_send_to_self.c
@@ -0,0 +1,195 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file core/test_core_api_send_to_self.c
+ * @brief test that sending a message to ourselves via CORE works
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_core_service.h"
+#include "gnunet_constants.h"
+
+/**
+ * Final status code.
+ */
+static int ret;
+
+/**
+ * Handle to the cleanup task.
+ */
+static struct GNUNET_SCHEDULER_Task *die_task;
+
+/**
+ * Identity of this peer.
+ */
+static struct GNUNET_PeerIdentity myself;
+
+/**
+ * The handle to core
+ */
+static struct GNUNET_CORE_Handle *core;
+
+
+/**
+ * Function scheduled as very last function, cleans up after us
+ */
+static void
+cleanup (void *cls)
+{
+  if (NULL != die_task)
+  {
+    GNUNET_SCHEDULER_cancel (die_task);
+    die_task = NULL;
+  }
+  if (NULL != core)
+  {
+    GNUNET_CORE_disconnect (core);
+    core = NULL;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Ending test.\n");
+}
+
+
+/**
+ * Function scheduled as very last function, cleans up after us
+ */
+static void
+do_timeout (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+              "Test timeout.\n");
+  die_task = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+handle_test (void *cls,
+             const struct GNUNET_MessageHeader *message)
+{
+  GNUNET_SCHEDULER_shutdown ();
+  ret = 0;
+}
+
+
+static void
+init (void *cls,
+      const struct GNUNET_PeerIdentity *my_identity)
+{
+  if (NULL == my_identity)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Correctly connected to CORE; we are the peer %s.\n",
+              GNUNET_i2s (my_identity));
+  GNUNET_memcpy (&myself,
+                 my_identity,
+                 sizeof(struct GNUNET_PeerIdentity));
+}
+
+
+static void *
+connect_cb (void *cls,
+            const struct GNUNET_PeerIdentity *peer,
+            struct GNUNET_MQ_Handle *mq)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Connected to peer %s.\n",
+              GNUNET_i2s (peer));
+  if (0 == memcmp (peer,
+                   &myself,
+                   sizeof(struct GNUNET_PeerIdentity)))
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct GNUNET_MessageHeader *msg;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Connected to myself; sending message!\n");
+    env = GNUNET_MQ_msg (msg,
+                         GNUNET_MESSAGE_TYPE_DUMMY);
+    GNUNET_MQ_send (mq,
+                    env);
+  }
+  return NULL;
+}
+
+
+/**
+ * Main function that will be run by the scheduler.
+ *
+ * @param cls closure
+ * @param cfg configuration
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (test,
+                             GNUNET_MESSAGE_TYPE_DUMMY,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  core =
+    GNUNET_CORE_connect (cfg,
+                         NULL,
+                         &init,
+                         &connect_cb,
+                         NULL,
+                         handlers);
+  GNUNET_SCHEDULER_add_shutdown (&cleanup,
+                                 NULL);
+  die_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MINUTES,
+                                           &do_timeout,
+                                           NULL);
+}
+
+
+/**
+ * The main function to test sending a message to the local peer via core
+ *
+ * @param argc number of arguments from the command line
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ */
+int
+main (int argc, char *argv[])
+{
+  ret = 1;
+  if (0 != GNUNET_TESTING_peer_run ("test-core-api-send-to-self",
+                                    "test_core_api_peer1.conf",
+                                    &run, NULL))
+    return 1;
+  return ret;
+}
+
+
+/* end of test_core_api_send_to_self.c */
diff --git a/src/service/core/test_core_api_send_to_self.conf b/src/service/core/test_core_api_send_to_self.conf
new file mode 100644
index 000000000..fe8e69999
--- /dev/null
+++ b/src/service/core/test_core_api_send_to_self.conf
@@ -0,0 +1,19 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-core-api-send-to-self/
+
+[ats]
+WAN_QUOTA_IN = 104857600
+WAN_QUOTA_OUT = 104757600
+
+[test-sts]
+IMMEDIATE_START = YES
+PORT = 59252
+HOSTNAME = localhost
+BINARY = test_core_api_send_to_self
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+TOTAL_QUOTA_IN = 65536
+TOTAL_QUOTA_OUT = 65536
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-sts.sock
+
diff --git a/src/service/core/test_core_api_start_only.c b/src/service/core/test_core_api_start_only.c
new file mode 100644
index 000000000..e50d3b2ec
--- /dev/null
+++ b/src/service/core/test_core_api_start_only.c
@@ -0,0 +1,258 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file transport/test_core_api_start_only.c
+ * @brief testcase for core_api.c that only starts two peers,
+ *        connects to the core service and shuts down again
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_core_service.h"
+#include "gnunet_util_lib.h"
+
+#define TIMEOUT 5
+
+#define MTYPE 12345
+
+struct PeerContext
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CORE_Handle *ch;
+  struct GNUNET_PeerIdentity id;
+  struct GNUNET_OS_Process *arm_proc;
+};
+
+static struct PeerContext p1;
+
+static struct PeerContext p2;
+
+static struct GNUNET_SCHEDULER_Task *timeout_task_id;
+
+static int ok;
+
+
+static void *
+connect_notify (void *cls,
+                const struct GNUNET_PeerIdentity *peer,
+                struct GNUNET_MQ_Handle *mq)
+{
+  return NULL;
+}
+
+
+static void
+disconnect_notify (void *cls,
+                   const struct GNUNET_PeerIdentity *peer,
+                   void *internal_cls)
+{
+}
+
+
+static struct GNUNET_MQ_MessageHandler handlers[] = {
+  GNUNET_MQ_handler_end ()
+};
+
+
+static void
+shutdown_task (void *cls)
+{
+  GNUNET_CORE_disconnect (p1.ch);
+  p1.ch = NULL;
+  GNUNET_CORE_disconnect (p2.ch);
+  p2.ch = NULL;
+  ok = 0;
+}
+
+
+static void
+init_notify (void *cls,
+             const struct GNUNET_PeerIdentity *my_identity)
+{
+  struct PeerContext *p = cls;
+
+  if (p == &p1)
+  {
+    /* connect p2 */
+    p2.ch = GNUNET_CORE_connect (p2.cfg,
+                                 &p2,
+                                 &init_notify,
+                                 &connect_notify,
+                                 &disconnect_notify,
+                                 handlers);
+  }
+  else
+  {
+    GNUNET_assert (p == &p2);
+    GNUNET_SCHEDULER_cancel (timeout_task_id);
+    timeout_task_id = NULL;
+    GNUNET_SCHEDULER_add_now (&shutdown_task,
+                              NULL);
+  }
+}
+
+
+static void
+setup_peer (struct PeerContext *p,
+            const char *cfgname)
+{
+  char *binary;
+
+  binary = GNUNET_OS_get_libexec_binary_path ("gnunet-service-arm");
+  p->cfg = GNUNET_CONFIGURATION_create ();
+  p->arm_proc =
+    GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                             | GNUNET_OS_USE_PIPE_CONTROL,
+                             NULL, NULL, NULL,
+                             binary,
+                             "gnunet-service-arm",
+                             "-c", cfgname,
+                             NULL);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_load (p->cfg,
+                                            cfgname));
+  GNUNET_free (binary);
+}
+
+
+static void
+timeout_task (void *cls)
+{
+  fprintf (stderr,
+           "%s",
+           "Timeout.\n");
+  if (NULL != p1.ch)
+  {
+    GNUNET_CORE_disconnect (p1.ch);
+    p1.ch = NULL;
+  }
+  if (NULL != p2.ch)
+  {
+    GNUNET_CORE_disconnect (p2.ch);
+    p2.ch = NULL;
+  }
+  ok = 42;
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  GNUNET_assert (ok == 1);
+  ok++;
+  setup_peer (&p1, "test_core_api_peer1.conf");
+  setup_peer (&p2, "test_core_api_peer2.conf");
+  timeout_task_id =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                    (GNUNET_TIME_UNIT_MINUTES,
+                                    TIMEOUT),
+                                  &timeout_task,
+                                  NULL);
+  p1.ch = GNUNET_CORE_connect (p1.cfg,
+                               &p1,
+                               &init_notify,
+                               &connect_notify,
+                               &disconnect_notify,
+                               handlers);
+}
+
+
+static void
+stop_arm (struct PeerContext *p)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Stopping peer\n");
+  if (0 != GNUNET_OS_process_kill (p->arm_proc,
+                                   GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "kill");
+  if (GNUNET_OK !=
+      GNUNET_OS_process_wait (p->arm_proc))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "waitpid");
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "ARM process %u stopped\n",
+              (unsigned int) GNUNET_OS_process_get_pid (p->arm_proc));
+  GNUNET_OS_process_destroy (p->arm_proc);
+  p->arm_proc = NULL;
+  GNUNET_CONFIGURATION_destroy (p->cfg);
+}
+
+
+static int
+check ()
+{
+  char *const argv[] = {
+    "test-core-api-start-only",
+    "-c",
+    "test_core_api_data.conf",
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+  
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer1.conf", 
+       "GNUNET_TEST_HOME");
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer2.conf", 
+       "GNUNET_TEST_HOME");
+
+  ok = 1;
+  GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                      argv,
+                      "test-core-api-start-only",
+                      "nohelp",
+                      options,
+                      &run,
+                      &ok);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Test finished\n");
+  stop_arm (&p1);
+  stop_arm (&p2);
+  return ok;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int ret;
+
+  GNUNET_log_setup ("test-core-api-start-only",
+                    "WARNING",
+                    NULL);
+  ret = check ();
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer1.conf", 
+       "GNUNET_TEST_HOME");
+  GNUNET_DISK_purge_cfg_dir 
+      ("test_core_api_peer2.conf", 
+       "GNUNET_TEST_HOME");
+  return ret;
+}
+
+
+/* end of test_core_api_start_only.c */
diff --git a/src/service/core/test_core_defaults.conf b/src/service/core/test_core_defaults.conf
new file mode 100644
index 000000000..7c7dad99e
--- /dev/null
+++ b/src/service/core/test_core_defaults.conf
@@ -0,0 +1,22 @@
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
+
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core/
+
+[nat]
+ENABLE_UPNP = NO
+
+[ats]
+WAN_QUOTA_IN = 1 GB
+WAN_QUOTA_OUT = 1 GB
+
+[transport-tcp]
+BINDTO = 127.0.0.1
+
+[transport-udp]
+BROADCAST = NO
+
+[peerinfo]
+NO_IO = YES
+
diff --git a/src/service/core/test_core_plugin_cmd_just_run.c b/src/service/core/test_core_plugin_cmd_just_run.c
new file mode 100644
index 000000000..04b65607d
--- /dev/null
+++ b/src/service/core/test_core_plugin_cmd_just_run.c
@@ -0,0 +1,524 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testbed/plugin_cmd_simple_send.c
+ * @brief a plugin to provide the API for running test cases.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_testing_barrier.h"
+#include "gnunet_testing_netjail_lib.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_transport_application_service.h"
+#include "gnunet_transport_core_service.h"
+#include "gnunet_testing_barrier.h"
+#include "gnunet_core_service.h"
+#include "gnunet_transport_testing_ng_lib.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...) GNUNET_log (kind, __VA_ARGS__)
+
+#define BASE_DIR "testdir"
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 600)
+
+#define MAX_RECEIVED 1000
+
+#define MESSAGE_SIZE 65000
+
+static struct GNUNET_TESTING_Command block_script;
+
+static struct GNUNET_TESTING_Command connect_peers;
+
+static struct GNUNET_TESTING_Command local_prepared;
+
+static struct GNUNET_TESTING_Command start_peer;
+
+static struct GNUNET_TESTING_Interpreter *is;
+
+static struct GNUNET_CONTAINER_MultiPeerMap *senders;
+
+struct TestState
+{
+  /**
+   * Callback to write messages to the master loop.
+   *
+   */
+  GNUNET_TESTING_cmd_helper_write_cb write_message;
+
+  /**
+   * Callback to notify the helper test case has finished.
+   */
+  GNUNET_TESTING_cmd_helper_finish_cb finished_cb;
+
+  /**
+   * The name for a specific test environment directory.
+   *
+   */
+  char *testdir;
+
+  /**
+   * The name for the configuration file of the specific node.
+   *
+   */
+  char *cfgname;
+
+  /**
+   * The complete topology information.
+   */
+  struct GNUNET_TESTING_NetjailTopology *topology;
+};
+
+struct Sender
+{
+  /**
+   * Number of received messages from sender.
+   */
+  unsigned long long num_received;
+
+  /**
+   * Sample mean time the message traveled.
+   */
+  struct GNUNET_TIME_Relative mean_time;
+
+  /**
+   * Time the first message was send.
+   */
+  struct GNUNET_TIME_Absolute time_first;
+};
+
+
+struct GNUNET_TESTING_BarrierList*
+get_waiting_for_barriers ()
+{
+  struct GNUNET_TESTING_BarrierList*barriers;
+  struct GNUNET_TESTING_BarrierListEntry *ble;
+
+  barriers = GNUNET_new (struct GNUNET_TESTING_BarrierList);
+  ble = GNUNET_new (struct GNUNET_TESTING_BarrierListEntry);
+  ble->barrier_name = "ready-to-connect";
+  ble->expected_reaches = 1;
+  GNUNET_CONTAINER_DLL_insert (barriers->head,
+                               barriers->tail,
+                               ble);
+
+  ble = GNUNET_new (struct GNUNET_TESTING_BarrierListEntry);
+  ble->barrier_name = "test-case-finished";
+  ble->expected_reaches = 1;
+  GNUNET_CONTAINER_DLL_insert (barriers->head,
+                               barriers->tail,
+                               ble);
+  return barriers;
+}
+
+
+/**
+ * Callback to set the flag indicating all peers started. Will be called via the plugin api.
+ *
+ */
+static void
+all_peers_started ()
+{
+}
+
+
+/**
+ * Function called with the final result of the test.
+ *
+ * @param cls the `struct MainParams`
+ * @param rv #GNUNET_OK if the test passed
+ */
+static void
+handle_result (void *cls,
+               enum GNUNET_GenericReturnValue rv)
+{
+  struct TestState *ts = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Local test exits with status %d\n",
+              rv);
+
+  ts->finished_cb (rv);
+  GNUNET_free (ts->testdir);
+  GNUNET_free (ts->cfgname);
+  GNUNET_TESTING_free_topology (ts->topology);
+  GNUNET_free (ts);
+}
+
+
+/**
+ * Callback from start peer cmd for signaling a peer got connected.
+ *
+ *
+static void *
+notify_connect (struct GNUNET_TESTING_Interpreter *is,
+                const struct GNUNET_PeerIdentity *peer)
+{
+  const struct ConnectPeersState *cps;
+  const struct GNUNET_TESTING_Command *cmd;
+
+  cmd = GNUNET_TESTING_interpreter_lookup_command (is,
+                                                   "connect-peers");
+  GNUNET_TRANSPORT_get_trait_connect_peer_state (cmd,
+                                                 &cps);
+  void *ret = NULL;
+
+  cps->notify_connect (is,
+                       peer);
+  return ret;
+  }*/
+
+
+/**
+ * Callback to set the flag indicating all peers are prepared to finish. Will be called via the plugin api.
+ */
+static void
+all_local_tests_prepared ()
+{
+  const struct GNUNET_TESTING_LocalPreparedState *lfs;
+
+  GNUNET_TESTING_get_trait_local_prepared_state (&local_prepared,
+                                                 &lfs);
+  GNUNET_assert (NULL != &lfs->ac);
+  if (NULL == lfs->ac.cont)
+    GNUNET_TESTING_async_fail ((struct GNUNET_TESTING_AsyncContext *) &lfs->ac);
+  else
+    GNUNET_TESTING_async_finish ((struct
+                                  GNUNET_TESTING_AsyncContext *) &lfs->ac);
+}
+
+
+static void
+child_completed_callback (void *cls,
+                          enum GNUNET_OS_ProcessStatusType type,
+                          long unsigned int exit_code)
+{
+
+}
+
+
+/**
+ * Function called to check a message being
+ * received.
+ *
+ */
+static int
+check_encrypted (void *cls, struct GNUNET_MessageHeader *header)
+{
+  return GNUNET_OK;
+}
+
+
+static void
+core_receive_continue (struct GNUNET_PeerIdentity *peer)
+{
+  const struct GNUNET_TESTING_StartPeerState *sps;
+
+  GNUNET_TESTING_get_trait_state (&start_peer,
+                                    &sps);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Executing core receive continue\n");
+
+  GNUNET_TRANSPORT_core_receive_continue (sps->th, peer);
+}
+
+
+/*static void
+handle_core (void *cls, struct GNUNET_MessageHeader *header)
+{
+  struct GNUNET_PeerIdentity *peer = cls;
+
+  core_receive_continue (peer);
+  }*/
+
+
+/**
+ * Function called to handle a message being received.
+ *
+ */
+static void
+handle_encrypted (void *cls, struct GNUNET_MessageHeader *header)
+{
+  struct GNUNET_PeerIdentity *peer = cls;
+
+  core_receive_continue (peer);
+}
+
+
+static void
+handle_ephemeral_key (void *cls, struct GNUNET_MessageHeader *header)
+{
+  struct GNUNET_PeerIdentity *peer = cls;
+
+  core_receive_continue (peer);
+}
+
+
+static void
+handle_ping (void *cls, struct GNUNET_MessageHeader *header)
+{
+  struct GNUNET_PeerIdentity *peer = cls;
+
+  core_receive_continue (peer);
+}
+
+
+static void
+handle_pong (void *cls, struct GNUNET_MessageHeader *header)
+{
+  struct GNUNET_PeerIdentity *peer = cls;
+
+  core_receive_continue (peer);
+}
+
+
+/**
+ * Function to start a local test case.
+ *
+ * @param write_message Callback to send a message to the master loop.
+ * @param router_ip Global address of the network namespace.
+ * @param node_ip The IP address of the node.
+ * @param m The number of the node in a network namespace.
+ * @param n The number of the network namespace.
+ * @param local_m The number of nodes in a network namespace.
+ * @param topology_data A file name for the file containing the topology configuration, or a string containing
+ *        the topology configuration.
+ * @param read_file If read_file is GNUNET_YES this string is the filename for the topology configuration,
+ *        if read_file is GNUNET_NO the string contains the topology configuration.
+ * @param finish_cb Callback function which writes a message from the helper process running on a netjail
+ *                  node to the master process * signaling that the test case running on the netjail node finished.
+ * @return Returns the struct GNUNET_TESTING_Interpreter of the command loop running on this netjail node.
+ */
+static struct GNUNET_TESTING_Interpreter *
+start_testcase (GNUNET_TESTING_cmd_helper_write_cb write_message,
+                const char *router_ip,
+                const char *node_ip,
+                const char *m,
+                const char *n,
+                const char *local_m,
+                const char *topology_data,
+                unsigned int *read_file,
+                GNUNET_TESTING_cmd_helper_finish_cb finished_cb)
+{
+
+  unsigned int n_int;
+  unsigned int m_int;
+  unsigned int local_m_int;
+  unsigned int num;
+  struct TestState *ts = GNUNET_new (struct TestState);
+  struct GNUNET_TESTING_NetjailTopology *topology;
+  unsigned int sscanf_ret = 0;
+  char **argv = NULL;
+  int argc = 0;
+
+  ts->finished_cb = finished_cb;
+  LOG (GNUNET_ERROR_TYPE_ERROR,
+       "n %s m %s\n",
+       n,
+       m);
+
+  if (GNUNET_YES == *read_file)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "read from file\n");
+    topology = GNUNET_TESTING_get_topo_from_file (topology_data);
+  }
+  else
+    topology = GNUNET_TESTING_get_topo_from_string (topology_data);
+
+  ts->topology = topology;
+
+  errno = 0;
+  sscanf_ret = sscanf (m, "%u", &m_int);
+  if (errno != 0)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+  }
+  GNUNET_assert (0 < sscanf_ret);
+  errno = 0;
+  sscanf_ret = sscanf (n, "%u", &n_int);
+  if (errno != 0)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+  }
+  GNUNET_assert (0 < sscanf_ret);
+  errno = 0;
+  sscanf_ret = sscanf (local_m, "%u", &local_m_int);
+  if (errno != 0)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "sscanf");
+  }
+  GNUNET_assert (0 < sscanf_ret);
+
+  if (0 == n_int)
+    num = m_int;
+  else
+    num = (n_int - 1) * local_m_int + m_int + topology->nodes_x;
+
+  block_script = GNUNET_TESTING_cmd_block_until_external_trigger (
+    "block-script");
+  connect_peers = GNUNET_CORE_cmd_connect_peers ("connect-peers",
+                                                      "start-peer",
+                                                      "system-create",
+                                                      num,
+                                                      topology,
+                                                      0,
+                                                 GNUNET_NO,
+                                                 NULL);
+  local_prepared = GNUNET_TESTING_cmd_local_test_prepared (
+    "local-test-prepared",
+    write_message);
+
+
+  if (1 == m_int)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "m_int %u should be 1\n");
+    GNUNET_asprintf (&ts->cfgname,
+                     "test_core_just_run_host.conf");
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "m_int %u should not be 1\n");
+    GNUNET_asprintf (&ts->cfgname,
+                   "test_core_just_run.conf");
+  }
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "plugin cfgname: %s\n",
+       ts->cfgname);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "node ip: %s\n",
+       node_ip);
+
+  GNUNET_asprintf (&ts->testdir,
+                   "%s%s%s",
+                   BASE_DIR,
+                   m,
+                   n);
+
+  /*struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (ephemeral_key,
+                             GNUNET_MESSAGE_TYPE_CORE_EPHEMERAL_KEY,
+                             struct EphemeralKeyMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (ping,
+                             GNUNET_MESSAGE_TYPE_CORE_PING,
+                             struct PingMessage,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (pong,
+                             GNUNET_MESSAGE_TYPE_CORE_PONG,
+                             struct PongMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };*/
+
+  start_peer = GNUNET_TESTING_cmd_start_peer ("start-peer",
+                                              "system-create",
+                                              num,
+                                              node_ip,
+                                              ts->cfgname,
+                                              GNUNET_NO);
+
+  struct GNUNET_TESTING_Command commands[] = {
+    GNUNET_TESTING_cmd_system_create ("system-create",
+                                      ts->testdir),
+    start_peer,
+    GNUNET_TESTING_cmd_barrier_reached ("ready-to-connect-reached",
+                                        "ready-to-connect",
+                                        GNUNET_NO,
+                                        num,
+                                        GNUNET_NO,
+                                        write_message),
+    connect_peers,
+    GNUNET_TESTING_cmd_exec_bash_script ("script",
+                                         "block.sh",
+                                         argv,
+                                         argc,
+                                         &child_completed_callback),
+    block_script,
+    GNUNET_TESTING_cmd_barrier_reached ("test-case-finished-reached",
+                                        "test-case-finished",
+                                        GNUNET_NO,
+                                        num,
+                                        GNUNET_NO,
+                                        write_message),
+    GNUNET_TESTING_cmd_stop_peer ("stop-peer",
+                                    "start-peer"),
+    GNUNET_TESTING_cmd_system_destroy ("system-destroy",
+                                       "system-create"),
+    GNUNET_TESTING_cmd_end ()
+  };
+
+  ts->write_message = write_message;
+
+  is = GNUNET_TESTING_run (commands,
+                           TIMEOUT,
+                           &handle_result,
+                           ts);
+  return is;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls NULL
+ * @return the exported block API
+ */
+void *
+libgnunet_test_core_plugin_cmd_just_run_init (void *cls)
+{
+  struct GNUNET_TESTING_PluginFunctions *api;
+
+  GNUNET_log_setup ("simple-send",
+                    "DEBUG",
+                    NULL);
+
+  api = GNUNET_new (struct GNUNET_TESTING_PluginFunctions);
+  api->start_testcase = &start_testcase;
+  api->get_waiting_for_barriers = get_waiting_for_barriers;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the return value from #libgnunet_test_transport_plugin_just_run_init
+ * @return NULL
+ */
+void *
+libgnunet_test_core_plugin_cmd_just_run_done (void *cls)
+{
+  struct GNUNET_TESTING_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_cmd_simple_send.c */
diff --git a/src/service/core/test_core_quota_asymmetric_recv_limited_peer1.conf b/src/service/core/test_core_quota_asymmetric_recv_limited_peer1.conf
new file mode 100644
index 000000000..766a2e73b
--- /dev/null
+++ b/src/service/core/test_core_quota_asymmetric_recv_limited_peer1.conf
@@ -0,0 +1,54 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-quota-asym-recv-lim-peer-1/
+
+[transport-tcp]
+PORT = 12488
+
+[arm]
+PORT = 12486
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-arm.sock
+
+[statistics]
+PORT = 12487
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-statistics.sock
+
+[resolver]
+PORT = 12484
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-1-service-resolver.sock
+
+[peerinfo]
+PORT = 12489
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-peerinfo.sock
+
+[transport]
+PORT = 12485
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-transport.sock
+
+[transport-udp]
+PORT = 12489
+
+[ats]
+PORT = 12491
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN =  100 MiB
+UNSPECIFIED_QUOTA_OUT =  100 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN =  100 MiB
+LOOPBACK_QUOTA_OUT =  100 MiB
+# LAN
+LAN_QUOTA_IN =  100 MiB
+LAN_QUOTA_OUT =  100 MiB
+# WAN
+WAN_QUOTA_IN = 100 MiB
+WAN_QUOTA_OUT = 100 MiB
+# WLAN
+WLAN_QUOTA_IN =  100 MiB
+WLAN_QUOTA_OUT =  100 MiB
+
+
+[core]
+PORT = 12490
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p1-service-core.sock
+
diff --git a/src/service/core/test_core_quota_asymmetric_recv_limited_peer2.conf b/src/service/core/test_core_quota_asymmetric_recv_limited_peer2.conf
new file mode 100644
index 000000000..30c0bb81f
--- /dev/null
+++ b/src/service/core/test_core_quota_asymmetric_recv_limited_peer2.conf
@@ -0,0 +1,57 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-quota-asym-recv-lim-peer-2/
+
+
+[arm]
+PORT = 22486
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-arm.sock
+
+[statistics]
+PORT = 22487
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-statistics.sock
+
+[resolver]
+PORT = 22484
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-resolver.sock
+
+[peerinfo]
+PORT = 22489
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-peerinfo.sock
+
+[transport]
+PORT = 22485
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-transport.sock
+
+[core]
+PORT = 22490
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-core.sock
+
+[ats]
+PORT = 22491
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-recv-p2-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN = 10 MiB
+UNSPECIFIED_QUOTA_OUT = 10 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN = 10 MiB
+LOOPBACK_QUOTA_OUT = 10 MiB
+# LAN
+LAN_QUOTA_IN = 10 MiB
+LAN_QUOTA_OUT = 10 MiB
+# WAN
+WAN_QUOTA_IN = 10 MiB
+WAN_QUOTA_OUT = 10 MiB
+# WLAN
+WLAN_QUOTA_IN = 10 MiB
+WLAN_QUOTA_OUT = 10 MiB
+
+[transport-tcp]
+PORT = 22467
+
+[transport-http]
+PORT = 22469
+
+[transport-tcp]
+PORT = 22468
+
diff --git a/src/service/core/test_core_quota_asymmetric_send_limit_peer1.conf b/src/service/core/test_core_quota_asymmetric_send_limit_peer1.conf
new file mode 100644
index 000000000..4a9f483d6
--- /dev/null
+++ b/src/service/core/test_core_quota_asymmetric_send_limit_peer1.conf
@@ -0,0 +1,52 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-quota-asym-send-lim-peer-1/
+
+[transport-tcp]
+PORT = 12488
+
+[transport-udp]
+PORT = 12492
+
+[arm]
+PORT = 12486
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-arm.sock
+
+[statistics]
+PORT = 12487
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-statistics.sock
+
+[resolver]
+PORT = 12484
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-1-service-resolver.sock
+
+[peerinfo]
+PORT = 12489
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-peerinfo.sock
+
+[transport]
+PORT = 12485
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-transport.sock
+
+[ats]
+PORT = 12491
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN = 10 MiB
+UNSPECIFIED_QUOTA_OUT = 10 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN = 10 MiB
+LOOPBACK_QUOTA_OUT = 10 MiB
+# LAN
+LAN_QUOTA_IN = 10 MiB
+LAN_QUOTA_OUT = 10 MiB
+# WAN
+WAN_QUOTA_IN = 10 MiB
+WAN_QUOTA_OUT = 10 MiB
+# WLAN
+WLAN_QUOTA_IN = 10 MiB
+WLAN_QUOTA_OUT = 10 MiB
+
+[core]
+PORT = 12490
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p1-service-core.sock
diff --git a/src/service/core/test_core_quota_asymmetric_send_limit_peer2.conf b/src/service/core/test_core_quota_asymmetric_send_limit_peer2.conf
new file mode 100644
index 000000000..36434461c
--- /dev/null
+++ b/src/service/core/test_core_quota_asymmetric_send_limit_peer2.conf
@@ -0,0 +1,61 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-quota-asym-send-lim-peer-2/
+
+[arm]
+PORT = 22486
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-arm.sock
+
+[statistics]
+PORT = 22487
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-statistics.sock
+
+[resolver]
+PORT = 22484
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-resolver.sock
+
+[peerinfo]
+PORT = 22489
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-peerinfo.sock
+
+[transport]
+PORT = 22485
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-transport.sock
+
+[core]
+PORT = 22490
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-core.sock
+
+[ats]
+PORT = 22491
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-asym-send-p2-service-ats.sock
+WAN_QUOTA_IN = 100 MiB
+WAN_QUOTA_OUT = 100 MiB
+
+[ats]
+PORT = 12471
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-core-sym-p1-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN =  100 MiB
+UNSPECIFIED_QUOTA_OUT =  100 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN =  100 MiB
+LOOPBACK_QUOTA_OUT =  100 MiB
+# LAN
+LAN_QUOTA_IN =  100 MiB
+LAN_QUOTA_OUT =  100 MiB
+# WAN
+WAN_QUOTA_IN = 100 MiB
+WAN_QUOTA_OUT = 100 MiB
+# WLAN
+WLAN_QUOTA_IN =  100 MiB
+WLAN_QUOTA_OUT =  100 MiB
+
+[transport-tcp]
+PORT = 22467
+
+[transport-udp]
+PORT = 22468
+
+[transport-http]
+PORT = 22469
diff --git a/src/service/core/test_core_quota_compliance.c b/src/service/core/test_core_quota_compliance.c
new file mode 100644
index 000000000..099c6fa3b
--- /dev/null
+++ b/src/service/core/test_core_quota_compliance.c
@@ -0,0 +1,788 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2009, 2010, 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file core/test_core_quota_compliance.c
+ * @brief testcase for core_api.c focusing quota compliance on core level
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_arm_service.h"
+#include "gnunet_core_service.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_ats_service.h"
+#include "gnunet_transport_service.h"
+#include "gnunet_transport_hello_service.h"
+#include "gnunet_statistics_service.h"
+
+
+#define SYMMETRIC 0
+#define ASYMMETRIC_SEND_LIMITED 1
+#define ASYMMETRIC_RECV_LIMITED 2
+
+/**
+ * Note that this value must not significantly exceed
+ * 'MAX_PENDING' in 'gnunet-service-transport.c', otherwise
+ * messages may be dropped even for a reliable transport.
+ */
+#define TOTAL_MSGS (60000 * 10)
+
+/**
+ * How long until we give up on transmitting the message?
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 300)
+
+/**
+ * What delay do we request from the core service for transmission?
+ */
+#define FAST_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, \
+                                                    150)
+
+#define MTYPE 12345
+#define MESSAGESIZE (1024 - 8)
+#define MEASUREMENT_LENGTH GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_SECONDS, 30)
+
+static unsigned long long total_bytes_sent;
+static unsigned long long total_bytes_recv;
+
+static struct GNUNET_TIME_Absolute start_time;
+
+static struct GNUNET_SCHEDULER_Task *err_task;
+
+static struct GNUNET_SCHEDULER_Task *measure_task;
+
+
+struct PeerContext
+{
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+  struct GNUNET_CORE_Handle *ch;
+  struct GNUNET_MQ_Handle *mq;
+  struct GNUNET_TRANSPORT_OfferHelloHandle *oh;
+  struct GNUNET_PeerIdentity id;
+  struct GNUNET_MessageHeader *hello;
+  struct GNUNET_STATISTICS_Handle *stats;
+  struct GNUNET_TRANSPORT_HelloGetHandle *ghh;
+  struct GNUNET_ATS_ConnectivityHandle *ats;
+  struct GNUNET_ATS_ConnectivitySuggestHandle *ats_sh;
+  int connect_status;
+  struct GNUNET_OS_Process *arm_proc;
+};
+
+static struct PeerContext p1;
+static struct PeerContext p2;
+
+static unsigned long long current_quota_p1_in;
+static unsigned long long current_quota_p1_out;
+static unsigned long long current_quota_p2_in;
+static unsigned long long current_quota_p2_out;
+
+static int ok;
+static int test;
+static int32_t tr_n;
+
+static int running;
+
+
+#if VERBOSE
+#define OKPP do { ok++; GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, \
+                                    "Now at stage %u at %s:%u\n", ok, __FILE__, \
+                                    __LINE__); } while (0)
+#else
+#define OKPP do { ok++; } while (0)
+#endif
+
+struct TestMessage
+{
+  struct GNUNET_MessageHeader header;
+  uint32_t num GNUNET_PACKED;
+  uint8_t pad[MESSAGESIZE];
+};
+
+
+static void
+terminate_peer (struct PeerContext *p)
+{
+  if (NULL != p->ch)
+  {
+    GNUNET_CORE_disconnect (p->ch);
+    p->ch = NULL;
+  }
+  if (NULL != p->ghh)
+  {
+    GNUNET_TRANSPORT_hello_get_cancel (p->ghh);
+    p->ghh = NULL;
+  }
+  if (NULL != p->oh)
+  {
+    GNUNET_TRANSPORT_offer_hello_cancel (p->oh);
+    p->oh = NULL;
+  }
+  if (NULL != p->ats_sh)
+  {
+    GNUNET_ATS_connectivity_suggest_cancel (p->ats_sh);
+    p->ats_sh = NULL;
+  }
+  if (NULL != p->ats)
+  {
+    GNUNET_ATS_connectivity_done (p->ats);
+    p->ats = NULL;
+  }
+  if (NULL != p->stats)
+  {
+    GNUNET_STATISTICS_destroy (p->stats, GNUNET_NO);
+    p->stats = NULL;
+  }
+  if (NULL != p->hello)
+  {
+    GNUNET_free (p->hello);
+    p->hello = NULL;
+  }
+}
+
+
+static void
+shutdown_task (void *cls)
+{
+  if (NULL != err_task)
+  {
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task = NULL;
+  }
+  if (NULL != measure_task)
+  {
+    GNUNET_SCHEDULER_cancel (measure_task);
+    measure_task = NULL;
+  }
+  terminate_peer (&p1);
+  terminate_peer (&p2);
+}
+
+
+static void
+terminate_task_error (void *cls)
+{
+  err_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Testcase failed (timeout)!\n");
+  GNUNET_SCHEDULER_shutdown ();
+  ok = 42;
+}
+
+
+/**
+ * Callback function to process statistic values.
+ *
+ * @param cls closure
+ * @param subsystem name of subsystem that created the statistic
+ * @param name the name of the datum
+ * @param value the current value
+ * @param is_persistent #GNUNET_YES if the value is persistent, #GNUNET_NO if not
+ * @return #GNUNET_OK to continue, #GNUNET_SYSERR to abort iteration
+ */
+static int
+print_stat (void *cls,
+            const char *subsystem,
+            const char *name,
+            uint64_t value,
+            int is_persistent)
+{
+  if (cls == &p1)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Peer1 %50s = %12llu\n",
+                name,
+                (unsigned long long) value);
+  if (cls == &p2)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Peer2 %50s = %12llu\n",
+                name,
+                (unsigned long long) value);
+  return GNUNET_OK;
+}
+
+
+static void
+measurement_stop (void *cls)
+{
+  unsigned long long delta;
+  unsigned long long throughput_out;
+  unsigned long long throughput_in;
+  unsigned long long max_quota_in;
+  unsigned long long max_quota_out;
+  unsigned long long quota_delta;
+  enum GNUNET_ErrorType kind = GNUNET_ERROR_TYPE_DEBUG;
+
+  measure_task = NULL;
+  fprintf (stdout, "%s", "\n");
+  running = GNUNET_NO;
+
+  delta = GNUNET_TIME_absolute_get_duration (start_time).rel_value_us;
+  if (0 == delta)
+    delta = 1;
+  throughput_out = total_bytes_sent * 1000000LL / delta;     /* convert to bytes/s */
+  throughput_in = total_bytes_recv * 1000000LL / delta;      /* convert to bytes/s */
+
+  max_quota_in = GNUNET_MIN (current_quota_p1_in, current_quota_p2_in);
+  max_quota_out = GNUNET_MIN (current_quota_p1_out, current_quota_p2_out);
+  if (max_quota_out < max_quota_in)
+    quota_delta = max_quota_in / 3;
+  else
+    quota_delta = max_quota_out / 3;
+
+  if ((throughput_out > (max_quota_out + quota_delta)) ||
+      (throughput_in > (max_quota_in + quota_delta)))
+    ok = 1; /* fail */
+  else
+    ok = 0; /* pass */
+  GNUNET_STATISTICS_get (p1.stats,
+                         "core",
+                         "# discarded CORE_SEND requests",
+                         NULL,
+                         &print_stat,
+                         &p1);
+  GNUNET_STATISTICS_get (p1.stats,
+                         "core",
+                         "# discarded CORE_SEND request bytes",
+                         NULL,
+                         &print_stat,
+                         &p1);
+  GNUNET_STATISTICS_get (p1.stats,
+                         "core",
+                         "# discarded lower priority CORE_SEND requests",
+                         NULL,
+                         &print_stat,
+                         NULL);
+  GNUNET_STATISTICS_get (p1.stats,
+                         "core",
+                         "# discarded lower priority CORE_SEND request bytes",
+                         NULL,
+                         &print_stat,
+                         &p1);
+  GNUNET_STATISTICS_get (p2.stats,
+                         "core",
+                         "# discarded CORE_SEND requests",
+                         NULL,
+                         &print_stat,
+                         &p2);
+
+  GNUNET_STATISTICS_get (p2.stats,
+                         "core",
+                         "# discarded CORE_SEND request bytes",
+                         NULL,
+                         &print_stat,
+                         &p2);
+  GNUNET_STATISTICS_get (p2.stats,
+                         "core",
+                         "# discarded lower priority CORE_SEND requests",
+                         NULL,
+                         &print_stat,
+                         &p2);
+  GNUNET_STATISTICS_get (p2.stats,
+                         "core",
+                         "# discarded lower priority CORE_SEND request bytes",
+                         NULL,
+                         &print_stat,
+                         &p2);
+
+  if (ok != 0)
+    kind = GNUNET_ERROR_TYPE_ERROR;
+  switch (test)
+  {
+  case SYMMETRIC:
+    GNUNET_log (kind,
+                "Core quota compliance test with symmetric quotas: %s\n",
+                (0 == ok) ? "PASSED" : "FAILED");
+    break;
+
+  case ASYMMETRIC_SEND_LIMITED:
+    GNUNET_log (kind,
+                "Core quota compliance test with limited sender quota: %s\n",
+                (0 == ok) ? "PASSED" : "FAILED");
+    break;
+
+  case ASYMMETRIC_RECV_LIMITED:
+    GNUNET_log (kind,
+                "Core quota compliance test with limited receiver quota: %s\n",
+                (0 == ok) ? "PASSED" : "FAILED");
+    break;
+  }
+  ;
+  GNUNET_log (kind,
+              "Peer 1 send  rate: %llu b/s (%llu bytes in %llu ms)\n",
+              throughput_out,
+              total_bytes_sent,
+              delta);
+  GNUNET_log (kind,
+              "Peer 1 send quota: %llu b/s\n",
+              current_quota_p1_out);
+  GNUNET_log (kind,
+              "Peer 2 receive  rate: %llu b/s (%llu bytes in %llu ms)\n",
+              throughput_in,
+              total_bytes_recv,
+              delta);
+  GNUNET_log (kind,
+              "Peer 2 receive quota: %llu b/s\n",
+              current_quota_p2_in);
+/*
+   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"Max. inbound  quota allowed: %llu b/s\n",max_quota_in );
+   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"Max. outbound quota allowed: %llu b/s\n",max_quota_out);
+ */
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+do_transmit (void *cls)
+{
+  struct TestMessage *hdr;
+  struct GNUNET_MQ_Envelope *env;
+
+  env = GNUNET_MQ_msg (hdr,
+                       MTYPE);
+  hdr->num = htonl (tr_n);
+  memset (&hdr->pad,
+          tr_n,
+          MESSAGESIZE);
+  tr_n++;
+  GNUNET_SCHEDULER_cancel (err_task);
+  err_task =
+    GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                  &terminate_task_error,
+                                  NULL);
+  total_bytes_sent += sizeof(struct TestMessage);
+  GNUNET_MQ_send (p1.mq,
+                  env);
+}
+
+
+static void *
+connect_notify (void *cls,
+                const struct GNUNET_PeerIdentity *peer,
+                struct GNUNET_MQ_Handle *mq)
+{
+  struct PeerContext *pc = cls;
+
+  if (0 == memcmp (&pc->id,
+                   peer,
+                   sizeof(struct GNUNET_PeerIdentity)))
+    return NULL;                     /* loopback */
+  GNUNET_assert (0 == pc->connect_status);
+  pc->connect_status = 1;
+  pc->mq = mq;
+  if (pc == &p1)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Encrypted connection established to peer `%s'\n",
+                GNUNET_i2s (peer));
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Asking core (1) for transmission to peer `%s'\n",
+                GNUNET_i2s (&p2.id));
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task =
+      GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                    &terminate_task_error,
+                                    NULL);
+    start_time = GNUNET_TIME_absolute_get ();
+    running = GNUNET_YES;
+    measure_task =
+      GNUNET_SCHEDULER_add_delayed (MEASUREMENT_LENGTH,
+                                    &measurement_stop,
+                                    NULL);
+    do_transmit (NULL);
+  }
+  return pc;
+}
+
+
+static void
+disconnect_notify (void *cls,
+                   const struct GNUNET_PeerIdentity *peer,
+                   void *internal_cls)
+{
+  struct PeerContext *pc = cls;
+
+  if (NULL == internal_cls)
+    return;                     /* loopback */
+  pc->connect_status = 0;
+  pc->mq = NULL;
+  if (NULL != measure_task)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Measurement aborted due to disconnect!\n");
+    GNUNET_SCHEDULER_cancel (measure_task);
+    measure_task = NULL;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Encrypted connection to `%s' cut\n",
+              GNUNET_i2s (peer));
+}
+
+
+static void
+handle_test (void *cls,
+             const struct TestMessage *hdr)
+{
+  static int n;
+
+  total_bytes_recv += sizeof(struct TestMessage);
+  if (ntohl (hdr->num) != n)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected message %u, got message %u\n",
+                n,
+                ntohl (hdr->num));
+    GNUNET_SCHEDULER_cancel (err_task);
+    err_task = GNUNET_SCHEDULER_add_now (&terminate_task_error,
+                                         NULL);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got message %u\n",
+              ntohl (hdr->num));
+  n++;
+  if (0 == (n % 10))
+    fprintf (stderr, "%s", ".");
+
+  if (GNUNET_YES == running)
+    do_transmit (NULL);
+}
+
+
+static void
+init_notify (void *cls,
+             const struct GNUNET_PeerIdentity *my_identity)
+{
+  struct PeerContext *p = cls;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (test,
+                             MTYPE,
+                             struct TestMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Connection to CORE service of `%s' established\n",
+              GNUNET_i2s (my_identity));
+  GNUNET_assert (NULL != my_identity);
+  p->id = *my_identity;
+  if (cls == &p1)
+  {
+    GNUNET_assert (ok == 2);
+    OKPP;
+    /* connect p2 */
+    p2.ch = GNUNET_CORE_connect (p2.cfg,
+                                 &p2,
+                                 &init_notify,
+                                 &connect_notify,
+                                 &disconnect_notify,
+                                 handlers);
+  }
+  else
+  {
+    GNUNET_assert (ok == 3);
+    OKPP;
+    GNUNET_assert (cls == &p2);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Asking core (1) to connect to peer `%s' and vice-versa\n",
+                GNUNET_i2s (&p2.id));
+    p1.ats_sh = GNUNET_ATS_connectivity_suggest (p1.ats,
+                                                 &p2.id,
+                                                 1);
+    p2.ats_sh = GNUNET_ATS_connectivity_suggest (p2.ats,
+                                                 &p1.id,
+                                                 1);
+  }
+}
+
+
+static void
+offer_hello_done (void *cls)
+{
+  struct PeerContext *p = cls;
+
+  p->oh = NULL;
+}
+
+
+static void
+process_hello (void *cls,
+               const struct GNUNET_MessageHeader *message)
+{
+  struct PeerContext *p = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received (my) HELLO from transport service\n");
+  GNUNET_assert (message != NULL);
+  if (NULL != p->hello) GNUNET_free (p->hello);
+  p->hello = GNUNET_malloc (ntohs (message->size));
+  GNUNET_memcpy (p->hello, message, ntohs (message->size));
+  if ((p == &p1) &&
+      (NULL == p2.oh))
+    p2.oh = GNUNET_TRANSPORT_offer_hello (p2.cfg,
+                                          message,
+                                          &offer_hello_done,
+                                          &p2);
+  if ((p == &p2) &&
+      (NULL == p1.oh))
+    p1.oh = GNUNET_TRANSPORT_offer_hello (p1.cfg, message,
+                                          &offer_hello_done,
+                                          &p1);
+
+  if ((p == &p1) &&
+      (NULL != p2.hello) &&
+      (NULL == p1.oh))
+    p1.oh = GNUNET_TRANSPORT_offer_hello (p1.cfg,
+                                          p2.hello,
+                                          &offer_hello_done,
+                                          &p1);
+  if ((p == &p2) &&
+      (NULL != p1.hello) &&
+      (NULL == p2.oh))
+    p2.oh = GNUNET_TRANSPORT_offer_hello (p2.cfg,
+                                          p1.hello,
+                                          &offer_hello_done,
+                                          &p2);
+}
+
+
+static void
+setup_peer (struct PeerContext *p,
+            const char *cfgname)
+{
+  char *binary;
+
+  binary = GNUNET_OS_get_libexec_binary_path ("gnunet-service-arm");
+  p->cfg = GNUNET_CONFIGURATION_create ();
+  p->arm_proc =
+    GNUNET_OS_start_process (GNUNET_OS_INHERIT_STD_OUT_AND_ERR
+                             | GNUNET_OS_USE_PIPE_CONTROL,
+                             NULL, NULL, NULL,
+                             binary,
+                             "gnunet-service-arm",
+                             "-c",
+                             cfgname,
+                             NULL);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONFIGURATION_load (p->cfg,
+                                            cfgname));
+  p->stats = GNUNET_STATISTICS_create ("core",
+                                       p->cfg);
+  GNUNET_assert (NULL != p->stats);
+  p->ats = GNUNET_ATS_connectivity_init (p->cfg);
+  GNUNET_assert (NULL != p->ats);
+  p->ghh = GNUNET_TRANSPORT_hello_get (p->cfg,
+                                       GNUNET_TRANSPORT_AC_ANY,
+                                       &process_hello,
+                                       p);
+  GNUNET_free (binary);
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (test,
+                             MTYPE,
+                             struct TestMessage,
+                             NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  GNUNET_assert (ok == 1);
+  OKPP;
+  err_task =
+    GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                  &terminate_task_error,
+                                  NULL);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
+  if (test == SYMMETRIC)
+  {
+    setup_peer (&p1,
+                "test_core_quota_peer1.conf");
+    setup_peer (&p2,
+                "test_core_quota_peer2.conf");
+  }
+  else if (test == ASYMMETRIC_SEND_LIMITED)
+  {
+    setup_peer (&p1,
+                "test_core_quota_asymmetric_send_limit_peer1.conf");
+    setup_peer (&p2,
+                "test_core_quota_asymmetric_send_limit_peer2.conf");
+  }
+  else if (test == ASYMMETRIC_RECV_LIMITED)
+  {
+    setup_peer (&p1,
+                "test_core_quota_asymmetric_recv_limited_peer1.conf");
+    setup_peer (&p2,
+                "test_core_quota_asymmetric_recv_limited_peer2.conf");
+  }
+
+  GNUNET_assert (test != -1);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CONFIGURATION_get_value_size (p1.cfg,
+                                                      "ATS",
+                                                      "WAN_QUOTA_IN",
+                                                      &current_quota_p1_in));
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CONFIGURATION_get_value_size (p2.cfg,
+                                                      "ATS",
+                                                      "WAN_QUOTA_IN",
+                                                      &current_quota_p2_in));
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CONFIGURATION_get_value_size (p1.cfg,
+                                                      "ATS",
+                                                      "WAN_QUOTA_OUT",
+                                                      &current_quota_p1_out));
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CONFIGURATION_get_value_size (p2.cfg,
+                                                      "ATS",
+                                                      "WAN_QUOTA_OUT",
+                                                      &current_quota_p2_out));
+
+  p1.ch = GNUNET_CORE_connect (p1.cfg,
+                               &p1,
+                               &init_notify,
+                               &connect_notify,
+                               &disconnect_notify,
+                               handlers);
+}
+
+
+static void
+stop_arm (struct PeerContext *p)
+{
+  if (0 != GNUNET_OS_process_kill (p->arm_proc,
+                                   GNUNET_TERM_SIG))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "kill");
+  if (GNUNET_OK !=
+      GNUNET_OS_process_wait (p->arm_proc))
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "waitpid");
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "ARM process %u stopped\n",
+              GNUNET_OS_process_get_pid (p->arm_proc));
+  GNUNET_OS_process_destroy (p->arm_proc);
+  p->arm_proc = NULL;
+  GNUNET_CONFIGURATION_destroy (p->cfg);
+}
+
+
+static int
+check ()
+{
+  char *const argv[] = {
+    "test-core-quota-compliance",
+    "-c",
+    "test_core_api_data.conf",
+    NULL
+  };
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  ok = 1;
+  GNUNET_PROGRAM_run ((sizeof(argv) / sizeof(char *)) - 1,
+                      argv,
+                      "test-core-quota-compliance",
+                      "nohelp",
+                      options,
+                      &run,
+                      &ok);
+  stop_arm (&p1);
+  stop_arm (&p2);
+  return ok;
+}
+
+
+static void
+cleanup_directory (int test)
+{
+  switch (test)
+  {
+  case SYMMETRIC:
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_peer1.conf", 
+       "GNUNET_TEST_HOME");
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_peer2.conf", 
+       "GNUNET_TEST_HOME");
+    break;
+
+  case ASYMMETRIC_SEND_LIMITED:
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_asymmetric_send_limit_peer1.conf", 
+       "GNUNET_TEST_HOME");
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_asymmetric_send_limit_peer2.conf", 
+       "GNUNET_TEST_HOME");
+    break;
+
+  case ASYMMETRIC_RECV_LIMITED:
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_asymmetric_recv_limited_peer1.conf", 
+       "GNUNET_TEST_HOME");
+    GNUNET_DISK_purge_cfg_dir 
+      ("test_core_quota_asymmetric_recv_limited_peer2.conf", 
+       "GNUNET_TEST_HOME");
+    break;
+  }
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int ret;
+
+  test = -1;
+  if (NULL != strstr (argv[0],
+                      "_symmetric"))
+  {
+    test = SYMMETRIC;
+  }
+  else if (NULL != strstr (argv[0],
+                           "_asymmetric_send"))
+  {
+    test = ASYMMETRIC_SEND_LIMITED;
+  }
+  else if (NULL != strstr (argv[0],
+                           "_asymmetric_recv"))
+  {
+    test = ASYMMETRIC_RECV_LIMITED;
+  }
+  GNUNET_assert (test != -1);
+  cleanup_directory (test);
+  GNUNET_log_setup ("test-core-quota-compliance",
+                    "WARNING",
+                    NULL);
+  ret = check ();
+  cleanup_directory (test);
+  return ret;
+}
+
+
+/* end of test_core_quota_compliance.c */
diff --git a/src/service/core/test_core_quota_peer1.conf b/src/service/core/test_core_quota_peer1.conf
new file mode 100644
index 000000000..ec592f778
--- /dev/null
+++ b/src/service/core/test_core_quota_peer1.conf
@@ -0,0 +1,58 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-peer-1/
+
+[arm]
+PORT = 12460
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-arm.sock
+
+[statistics]
+PORT = 12461
+
+[resolver]
+PORT = 12462
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-resolver.sock
+
+[peerinfo]
+PORT = 12463
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-peerinfo.sock
+
+[transport]
+PORT = 12464
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-transport.sock
+
+[core]
+PORT = 12475
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-core.sock
+
+[ats]
+PORT = 12476
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN = 10 MiB
+UNSPECIFIED_QUOTA_OUT = 10 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN = 10 MiB
+LOOPBACK_QUOTA_OUT = 10 MiB
+# LAN
+LAN_QUOTA_IN = 10 MiB
+LAN_QUOTA_OUT = 10 MiB
+# WAN
+WAN_QUOTA_IN = 10 MiB
+WAN_QUOTA_OUT = 10 MiB
+# WLAN
+WLAN_QUOTA_IN = 10 MiB
+WLAN_QUOTA_OUT = 10 MiB
+
+
+[transport-tcp]
+PORT = 12467
+
+[transport-udp]
+PORT = 12468
+
+[transport-unix]
+PORT = 12469
+
+[transport-http]
+PORT = 12470
diff --git a/src/service/core/test_core_quota_peer2.conf b/src/service/core/test_core_quota_peer2.conf
new file mode 100644
index 000000000..65d0710bb
--- /dev/null
+++ b/src/service/core/test_core_quota_peer2.conf
@@ -0,0 +1,59 @@
+@INLINE@ test_core_defaults.conf
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core-peer-2/
+
+[arm]
+PORT = 22460
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-arm.sock
+
+[statistics]
+PORT = 22461
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-statistics.sock
+
+[resolver]
+PORT = 22462
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-resolver.sock
+
+[peerinfo]
+PORT = 22463
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-peerinfo.sock
+
+[transport]
+PORT = 22464
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-transport.sock
+
+[core]
+PORT = 22475
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-core.sock
+
+[ats]
+PORT = 22476
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p2-service-ats.sock
+# UNSPECIFIED
+UNSPECIFIED_QUOTA_IN = 10 MiB
+UNSPECIFIED_QUOTA_OUT = 10 MiB
+# LOOPBACK
+LOOPBACK_QUOTA_IN = 10 MiB
+LOOPBACK_QUOTA_OUT = 10 MiB
+# LAN
+LAN_QUOTA_IN = 10 MiB
+LAN_QUOTA_OUT = 10 MiB
+# WAN
+WAN_QUOTA_IN = 10 MiB
+WAN_QUOTA_OUT = 10 MiB
+# WLAN
+WLAN_QUOTA_IN = 10 MiB
+WLAN_QUOTA_OUT = 10 MiB
+
+
+[transport-tcp]
+PORT = 22467
+
+[transport-udp]
+PORT = 22468
+
+[transport-unix]
+PORT = 22469
+
+[transport-http]
+PORT = 22470
diff --git a/src/service/core/test_core_start_testcase.sh b/src/service/core/test_core_start_testcase.sh
new file mode 100755
index 000000000..78e67dbf5
--- /dev/null
+++ b/src/service/core/test_core_start_testcase.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+echo gaga1 > gaga.txt
+read -p "Test case configuration to use:" conf
+if ! [ -d "/run/netns" ]; then
+    echo You have to create the directory /run/netns.
+fi
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
+    echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
+    exit 78
+  fi
+fi
+echo gaga2 >> gaga.txt
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; /usr/local/lib/gnunet/libexec/test_testing_start_with_config $conf"
+echo gaga3 >> gaga.txt
diff --git a/src/service/identity/.gitignore b/src/service/identity/.gitignore
new file mode 100644
index 000000000..634a0bdd6
--- /dev/null
+++ b/src/service/identity/.gitignore
@@ -0,0 +1,4 @@
+gnunet-service-identity
+gnunet-identity
+test_identity
+test_identity_defaults
diff --git a/src/service/identity/Makefile.am b/src/service/identity/Makefile.am
new file mode 100644
index 000000000..079a9af2e
--- /dev/null
+++ b/src/service/identity/Makefile.am
@@ -0,0 +1,67 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIB = -lgcov
+endif
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfg_DATA = \
+  identity.conf
+
+lib_LTLIBRARIES = \
+  libgnunetidentity.la
+
+
+libgnunetidentity_la_SOURCES = \
+  identity_api.c \
+  identity_api_lookup.c \
+  identity_api_suffix_lookup.c \
+  identity.h
+libgnunetidentity_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL) $(XLIB)
+libgnunetidentity_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)   \
+  -lsodium \
+  -version-info 1:0:0
+
+libexec_PROGRAMS = \
+ gnunet-service-identity
+
+gnunet_service_identity_SOURCES = \
+ gnunet-service-identity.c
+gnunet_service_identity_LDADD = \
+  libgnunetidentity.la \
+  $(top_builddir)/src/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL)
+
+
+check_PROGRAMS = \
+ test_identity
+
+# if ENABLE_TEST_RUN
+# AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+# TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
+# endif
+
+
+test_identity_SOURCES = \
+ test_identity.c
+test_identity_LDADD = \
+  libgnunetidentity.la \
+  $(top_builddir)/src/lib/testing/libgnunettesting.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_identity.conf \
+  test_identity_messages.sh
+
+
diff --git a/src/service/identity/gnunet-service-identity.c b/src/service/identity/gnunet-service-identity.c
new file mode 100644
index 000000000..7ac4bf2b9
--- /dev/null
+++ b/src/service/identity/gnunet-service-identity.c
@@ -0,0 +1,1035 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2013 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file identity/gnunet-service-identity.c
+ * @brief identity management service
+ * @author Christian Grothoff
+ *
+ * The purpose of this service is to manage private keys that
+ * represent the various egos/pseudonyms/identities of a GNUnet user.
+ *
+ * Todo:
+ * - auto-initialze default egos; maybe trigger default
+ *   initializations (such as gnunet-gns-import.sh?)
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_protocols.h"
+#include "gnunet_statistics_service.h"
+#include "gnunet_identity_service.h"
+#include "identity.h"
+
+
+/**
+ * Information we keep about each ego.
+ */
+struct Ego
+{
+  /**
+   * We keep egos in a DLL.
+   */
+  struct Ego *next;
+
+  /**
+   * We keep egos in a DLL.
+   */
+  struct Ego *prev;
+
+  /**
+   * Private key of the ego.
+   */
+  struct GNUNET_CRYPTO_PrivateKey pk;
+
+  /**
+   * String identifier for the ego.
+   */
+  char *identifier;
+};
+
+
+/**
+ * Handle to our current configuration.
+ */
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+/**
+ * Handle to subsystem configuration which for each subsystem contains
+ * the name of the default ego.
+ */
+static struct GNUNET_CONFIGURATION_Handle *subsystem_cfg;
+
+/**
+ * Handle to the statistics service.
+ */
+static struct GNUNET_STATISTICS_Handle *stats;
+
+/**
+ * Notification context, simplifies client broadcasts.
+ */
+static struct GNUNET_NotificationContext *nc;
+
+/**
+ * Directory where we store the identities.
+ */
+static char *ego_directory;
+
+/**
+ * Configuration file name where subsystem information is kept.
+ */
+static char *subsystem_cfg_file;
+
+/**
+ * Head of DLL of all egos.
+ */
+static struct Ego *ego_head;
+
+/**
+ * Tail of DLL of all egos.
+ */
+static struct Ego *ego_tail;
+
+
+/**
+ * Get the name of the file we use to store a given ego.
+ *
+ * @param ego ego for which we need the filename
+ * @return full filename for the given ego
+ */
+static char *
+get_ego_filename (struct Ego *ego)
+{
+  char *filename;
+
+  GNUNET_asprintf (&filename,
+                   "%s%s%s",
+                   ego_directory,
+                   DIR_SEPARATOR_STR,
+                   ego->identifier);
+  return filename;
+}
+
+
+/**
+ * Called whenever a client is disconnected.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ * @param app_ctx @a client
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *client,
+                      void *app_ctx)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client %p disconnected\n",
+              client);
+}
+
+
+/**
+ * Add a client to our list of active clients.
+ *
+ * @param cls NULL
+ * @param client client to add
+ * @param mq message queue for @a client
+ * @return internal namestore client structure for this client
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *client,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  return client;
+}
+
+
+/**
+ * Task run during shutdown.
+ *
+ * @param cls unused
+ */
+static void
+shutdown_task (void *cls)
+{
+  struct Ego *e;
+
+  if (NULL != nc)
+  {
+    GNUNET_notification_context_destroy (nc);
+    nc = NULL;
+  }
+  if (NULL != stats)
+  {
+    GNUNET_STATISTICS_destroy (stats, GNUNET_NO);
+    stats = NULL;
+  }
+  GNUNET_CONFIGURATION_destroy (subsystem_cfg);
+  subsystem_cfg = NULL;
+  GNUNET_free (subsystem_cfg_file);
+  subsystem_cfg_file = NULL;
+  GNUNET_free (ego_directory);
+  ego_directory = NULL;
+  while (NULL != (e = ego_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 e);
+    GNUNET_free (e->identifier);
+    GNUNET_free (e);
+  }
+}
+
+
+/**
+ * Send a result code back to the client.
+ *
+ * @param client client that should receive the result code
+ * @param result_code code to transmit
+ */
+static void
+send_result_code (struct GNUNET_SERVICE_Client *client,
+                  uint32_t result_code)
+{
+  struct ResultCodeMessage *rcm;
+  struct GNUNET_MQ_Envelope *env;
+
+  env =
+    GNUNET_MQ_msg (rcm, GNUNET_MESSAGE_TYPE_IDENTITY_RESULT_CODE);
+  rcm->result_code = htonl (result_code);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending result %d (%s) to client\n",
+              (int) result_code,
+              GNUNET_ErrorCode_get_hint (result_code));
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+}
+
+
+/**
+ * Create an update message with information about the current state of an ego.
+ *
+ * @param ego ego to create message for
+ * @return corresponding update message
+ */
+static struct GNUNET_MQ_Envelope *
+create_update_message (struct Ego *ego)
+{
+  struct UpdateMessage *um;
+  struct GNUNET_MQ_Envelope *env;
+  size_t name_len;
+  ssize_t key_len;
+
+  key_len = GNUNET_CRYPTO_private_key_get_length (&ego->pk);
+  name_len = (NULL == ego->identifier) ? 0 : (strlen (ego->identifier) + 1);
+  env = GNUNET_MQ_msg_extra (um, name_len + key_len,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
+  um->name_len = htons (name_len);
+  um->end_of_list = htons (GNUNET_NO);
+  um->key_len = htons (key_len);
+  GNUNET_memcpy (&um[1], ego->identifier, name_len);
+  GNUNET_CRYPTO_write_private_key_to_buffer (&ego->pk,
+                                               ((char*) &um[1]) + name_len,
+                                               key_len);
+  return env;
+}
+
+
+/**
+ * Handler for START message from client, sends information
+ * about all identities to the client immediately and
+ * adds the client to the notification context for future
+ * updates.
+ *
+ * @param cls a `struct GNUNET_SERVICE_Client *`
+ * @param message the message received
+ */
+static void
+handle_start_message (void *cls,
+                      const struct GNUNET_MessageHeader *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received START message from client\n");
+  GNUNET_SERVICE_client_mark_monitor (client);
+  GNUNET_SERVICE_client_disable_continue_warning (client);
+  GNUNET_notification_context_add (nc,
+                                   GNUNET_SERVICE_client_get_mq (client));
+  for (struct Ego *ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client),
+                    create_update_message (ego));
+  }
+  {
+    struct UpdateMessage *ume;
+    struct GNUNET_MQ_Envelope *env;
+
+    env = GNUNET_MQ_msg_extra (ume,
+                               0,
+                               GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
+    ume->end_of_list = htons (GNUNET_YES);
+    ume->name_len = htons (0);
+    ume->key_len = htons (0);
+    GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client),
+                    env);
+  }
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Handler for LOOKUP message from client, sends information
+ * about ONE identity to the client immediately.
+ *
+ * @param cls unused
+ * @param message the message received
+ * @return #GNUNET_SYSERR if message was ill-formed
+ */
+static int
+check_lookup_message (void *cls,
+                      const struct LookupMessage *message)
+{
+  GNUNET_MQ_check_zero_termination (message);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for LOOKUP message from client, sends information
+ * about ONE identity to the client immediately.
+ *
+ * @param cls a `struct GNUNET_SERVICE_Client *`
+ * @param message the message received
+ */
+static void
+handle_lookup_message (void *cls,
+                       const struct LookupMessage *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  const char *name;
+  struct GNUNET_MQ_Envelope *env;
+  struct Ego *ego;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received LOOKUP message from client\n");
+  name = (const char *) &message[1];
+  for (ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if (0 != strcasecmp (name, ego->identifier))
+      continue;
+    env = create_update_message (ego);
+    GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+    GNUNET_SERVICE_client_continue (client);
+    return;
+  }
+  send_result_code (client, GNUNET_EC_IDENTITY_NOT_FOUND);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Handler for LOOKUP message from client, sends information
+ * about ONE identity to the client immediately.
+ *
+ * @param cls unused
+ * @param message the message received
+ * @return #GNUNET_SYSERR if message was ill-formed
+ */
+static int
+check_lookup_by_suffix_message (void *cls,
+                                const struct LookupMessage *message)
+{
+  GNUNET_MQ_check_zero_termination (message);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for LOOKUP_BY_SUFFIX message from client, sends information
+ * about ONE identity to the client immediately.
+ *
+ * @param cls a `struct GNUNET_SERVICE_Client *`
+ * @param message the message received
+ */
+static void
+handle_lookup_by_suffix_message (void *cls,
+                                 const struct LookupMessage *message)
+{
+  struct GNUNET_SERVICE_Client *client = cls;
+  const char *name;
+  struct GNUNET_MQ_Envelope *env;
+  struct Ego *lprefix;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received LOOKUP_BY_SUFFIX message from client\n");
+  name = (const char *) &message[1];
+  lprefix = NULL;
+  for (struct Ego *ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if ((strlen (ego->identifier) <= strlen (name)) &&
+        (0 == strcmp (ego->identifier,
+                      &name[strlen (name) - strlen (ego->identifier)])) &&
+        ((strlen (name) == strlen (ego->identifier)) ||
+         ('.' == name[strlen (name) - strlen (ego->identifier) - 1])) &&
+        ((NULL == lprefix) ||
+         (strlen (ego->identifier) > strlen (lprefix->identifier))))
+    {
+      /* found better match, update! */
+      lprefix = ego;
+    }
+  }
+  if (NULL != lprefix)
+  {
+    env = create_update_message (lprefix);
+    GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client), env);
+    GNUNET_SERVICE_client_continue (client);
+    return;
+  }
+  send_result_code (client, GNUNET_EC_IDENTITY_NOT_FOUND);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Send an updated message for the given ego to all listeners.
+ *
+ * @param ego ego to send the update for
+ */
+static void
+notify_listeners (struct Ego *ego)
+{
+  struct UpdateMessage *um;
+  size_t name_len;
+  ssize_t key_len;
+
+  name_len = (NULL == ego->identifier) ? 0 : (strlen (ego->identifier) + 1);
+  key_len = GNUNET_CRYPTO_private_key_get_length (&ego->pk);
+  um = GNUNET_malloc (sizeof(struct UpdateMessage) + name_len + key_len);
+  um->header.type = htons (GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
+  um->header.size = htons (sizeof(struct UpdateMessage) + name_len + key_len);
+  um->name_len = htons (name_len);
+  um->end_of_list = htons (GNUNET_NO);
+  um->key_len = htons (key_len);
+  GNUNET_memcpy (&um[1], ego->identifier, name_len);
+  GNUNET_CRYPTO_write_private_key_to_buffer (&ego->pk,
+                                               ((char*) &um[1]) + name_len,
+                                               key_len);
+  GNUNET_notification_context_broadcast (nc, &um->header, GNUNET_NO);
+  GNUNET_free (um);
+}
+
+
+/**
+ * Checks a #GNUNET_MESSAGE_TYPE_IDENTITY_CREATE message
+ *
+ * @param cls client sending the message
+ * @param msg message of type `struct CreateRequestMessage`
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+static int
+check_create_message (void *cls,
+                      const struct CreateRequestMessage *msg)
+{
+  uint16_t size;
+  uint16_t name_len;
+  size_t key_len;
+  const char *str;
+
+  size = ntohs (msg->header.size);
+  if (size <= sizeof(struct CreateRequestMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  name_len = ntohs (msg->name_len);
+  key_len = ntohs (msg->key_len);
+  if (name_len + key_len + sizeof(struct CreateRequestMessage) != size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  str = (const char *) &msg[1] + key_len;
+  if ('\0' != str[name_len - 1])
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for CREATE message from client, creates new identity.
+ *
+ * @param cls unused
+ * @param crm the message received
+ */
+static void
+handle_create_message (void *cls,
+                       const struct CreateRequestMessage *crm)
+{
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+  struct GNUNET_SERVICE_Client *client = cls;
+  struct Ego *ego;
+  char *str;
+  char *fn;
+  size_t key_len;
+  size_t kb_read;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREATE message from client\n");
+  key_len = ntohs (crm->key_len);
+  if ((GNUNET_SYSERR ==
+      GNUNET_CRYPTO_read_private_key_from_buffer (&crm[1],
+                                                    key_len,
+                                                    &private_key,
+                                                    &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_SERVICE_client_drop (client);
+    return;
+  }
+  str = GNUNET_strdup ((const char *) &crm[1] + key_len);
+  GNUNET_STRINGS_utf8_tolower ((const char *) &crm[1] + key_len, str);
+  for (ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if (0 == strcmp (ego->identifier, str))
+    {
+      send_result_code (client,
+                        GNUNET_EC_IDENTITY_NAME_CONFLICT);
+      GNUNET_SERVICE_client_continue (client);
+      GNUNET_free (str);
+      return;
+    }
+  }
+  ego = GNUNET_new (struct Ego);
+  ego->pk = private_key;
+  ego->identifier = GNUNET_strdup (str);
+  GNUNET_CONTAINER_DLL_insert (ego_head,
+                               ego_tail,
+                               ego);
+  send_result_code (client, GNUNET_EC_NONE);
+  fn = get_ego_filename (ego);
+  if (GNUNET_OK !=
+      GNUNET_DISK_fn_write (fn,
+                            &private_key,
+                            sizeof(struct GNUNET_CRYPTO_PrivateKey),
+                            GNUNET_DISK_PERM_USER_READ
+                            | GNUNET_DISK_PERM_USER_WRITE))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "write", fn);
+  GNUNET_free (fn);
+  GNUNET_free (str);
+  notify_listeners (ego);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * Closure for 'handle_ego_rename'.
+ */
+struct RenameContext
+{
+  /**
+   * Old name.
+   */
+  const char *old_name;
+
+  /**
+   * New name.
+   */
+  const char *new_name;
+};
+
+/**
+ * An ego was renamed; rename it in all subsystems where it is
+ * currently set as the default.
+ *
+ * @param cls the 'struct RenameContext'
+ * @param section a section in the configuration to process
+ */
+static void
+handle_ego_rename (void *cls, const char *section)
+{
+  struct RenameContext *rc = cls;
+  char *id;
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (subsystem_cfg,
+                                                          section,
+                                                          "DEFAULT_IDENTIFIER",
+                                                          &id))
+    return;
+  if (0 != strcmp (id, rc->old_name))
+  {
+    GNUNET_free (id);
+    return;
+  }
+  GNUNET_CONFIGURATION_set_value_string (subsystem_cfg,
+                                         section,
+                                         "DEFAULT_IDENTIFIER",
+                                         rc->new_name);
+  GNUNET_free (id);
+}
+
+
+/**
+ * Checks a #GNUNET_MESSAGE_TYPE_IDENTITY_RENAME message
+ *
+ * @param cls client sending the message
+ * @param msg message of type `struct RenameMessage`
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+static int
+check_rename_message (void *cls, const struct RenameMessage *msg)
+{
+  uint16_t size;
+  uint16_t old_name_len;
+  uint16_t new_name_len;
+  const char *old_name;
+  const char *new_name;
+
+  size = ntohs (msg->header.size);
+  if (size <= sizeof(struct RenameMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  old_name_len = ntohs (msg->old_name_len);
+  new_name_len = ntohs (msg->new_name_len);
+  old_name = (const char *) &msg[1];
+  new_name = &old_name[old_name_len];
+  if ((old_name_len + new_name_len + sizeof(struct RenameMessage) != size) ||
+      ('\0' != old_name[old_name_len - 1]) ||
+      ('\0' != new_name[new_name_len - 1]))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for RENAME message from client, creates
+ * new identity.
+ *
+ * @param cls unused
+ * @param rm the message received
+ */
+static void
+handle_rename_message (void *cls, const struct RenameMessage *rm)
+{
+  uint16_t old_name_len;
+  struct Ego *ego;
+  char *old_name;
+  char *new_name;
+  struct RenameContext rename_ctx;
+  struct GNUNET_SERVICE_Client *client = cls;
+  char *fn_old;
+  char *fn_new;
+  const char *old_name_tmp;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received RENAME message from client\n");
+  old_name_len = ntohs (rm->old_name_len);
+  old_name_tmp = (const char *) &rm[1];
+  old_name = GNUNET_strdup (old_name_tmp);
+  GNUNET_STRINGS_utf8_tolower (old_name_tmp, old_name);
+  new_name = GNUNET_strdup (&old_name_tmp[old_name_len]);
+  GNUNET_STRINGS_utf8_tolower (&old_name_tmp[old_name_len], new_name);
+
+  /* check if new name is already in use */
+  for (ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if (0 == strcmp (ego->identifier, new_name))
+    {
+      send_result_code (client, GNUNET_EC_IDENTITY_NAME_CONFLICT);
+      GNUNET_SERVICE_client_continue (client);
+      GNUNET_free (old_name);
+      GNUNET_free (new_name);
+      return;
+    }
+  }
+
+  /* locate old name and, if found, perform rename */
+  for (ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if (0 == strcmp (ego->identifier, old_name))
+    {
+      fn_old = get_ego_filename (ego);
+      GNUNET_free (ego->identifier);
+      rename_ctx.old_name = old_name;
+      rename_ctx.new_name = new_name;
+      GNUNET_CONFIGURATION_iterate_sections (subsystem_cfg,
+                                             &handle_ego_rename,
+                                             &rename_ctx);
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_write (subsystem_cfg, subsystem_cfg_file))
+        GNUNET_log (
+          GNUNET_ERROR_TYPE_ERROR,
+          _ ("Failed to write subsystem default identifier map to `%s'.\n"),
+          subsystem_cfg_file);
+      ego->identifier = GNUNET_strdup (new_name);
+      fn_new = get_ego_filename (ego);
+      if (0 != rename (fn_old, fn_new))
+        GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "rename", fn_old);
+      GNUNET_free (fn_old);
+      GNUNET_free (fn_new);
+      GNUNET_free (old_name);
+      GNUNET_free (new_name);
+      notify_listeners (ego);
+      send_result_code (client, GNUNET_EC_NONE);
+      GNUNET_SERVICE_client_continue (client);
+      return;
+    }
+  }
+
+  /* failed to locate old name */
+  send_result_code (client, GNUNET_EC_IDENTITY_NOT_FOUND);
+  GNUNET_free (old_name);
+  GNUNET_free (new_name);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+/**
+ * An ego was removed, remove it from all subsystems where it is
+ * currently set as the default.
+ *
+ * @param cls name of the removed ego (const char *)
+ * @param section a section in the configuration to process
+ */
+static void
+handle_ego_delete (void *cls, const char *section)
+{
+  const char *identifier = cls;
+  char *id;
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (subsystem_cfg,
+                                                          section,
+                                                          "DEFAULT_IDENTIFIER",
+                                                          &id))
+    return;
+  if (0 != strcmp (id, identifier))
+  {
+    GNUNET_free (id);
+    return;
+  }
+  GNUNET_CONFIGURATION_set_value_string (subsystem_cfg,
+                                         section,
+                                         "DEFAULT_IDENTIFIER",
+                                         NULL);
+  GNUNET_free (id);
+}
+
+
+/**
+ * Checks a #GNUNET_MESSAGE_TYPE_IDENTITY_DELETE message
+ *
+ * @param cls client sending the message
+ * @param msg message of type `struct DeleteMessage`
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+static int
+check_delete_message (void *cls, const struct DeleteMessage *msg)
+{
+  uint16_t size;
+  uint16_t name_len;
+  const char *name;
+
+  size = ntohs (msg->header.size);
+  if (size <= sizeof(struct DeleteMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  name = (const char *) &msg[1];
+  name_len = ntohs (msg->name_len);
+  if ((name_len + sizeof(struct DeleteMessage) != size) ||
+      (0 != ntohs (msg->reserved)) || ('\0' != name[name_len - 1]))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for DELETE message from client, creates
+ * new identity.
+ *
+ * @param cls unused
+ * @param dm the message received
+ */
+static void
+handle_delete_message (void *cls, const struct DeleteMessage *dm)
+{
+  struct Ego *ego;
+  char *name;
+  char *fn;
+  struct GNUNET_SERVICE_Client *client = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received DELETE message from client\n");
+  name = GNUNET_strdup ((const char *) &dm[1]);
+  GNUNET_STRINGS_utf8_tolower ((const char *) &dm[1], name);
+
+  for (ego = ego_head; NULL != ego; ego = ego->next)
+  {
+    if (0 == strcmp (ego->identifier, name))
+    {
+      GNUNET_CONTAINER_DLL_remove (ego_head, ego_tail, ego);
+      GNUNET_CONFIGURATION_iterate_sections (subsystem_cfg,
+                                             &handle_ego_delete,
+                                             ego->identifier);
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_write (subsystem_cfg, subsystem_cfg_file))
+        GNUNET_log (
+          GNUNET_ERROR_TYPE_ERROR,
+          _ ("Failed to write subsystem default identifier map to `%s'.\n"),
+          subsystem_cfg_file);
+      fn = get_ego_filename (ego);
+      if (0 != unlink (fn))
+        GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "unlink", fn);
+      GNUNET_free (fn);
+      GNUNET_free (ego->identifier);
+      ego->identifier = NULL;
+      notify_listeners (ego);
+      GNUNET_free (ego);
+      GNUNET_free (name);
+      send_result_code (client, GNUNET_EC_NONE);
+      GNUNET_SERVICE_client_continue (client);
+      return;
+    }
+  }
+
+  send_result_code (client, GNUNET_EC_IDENTITY_NOT_FOUND);
+  GNUNET_free (name);
+  GNUNET_SERVICE_client_continue (client);
+}
+
+
+static int
+read_from_file (const char *filename,
+                void *buf,
+                size_t buf_size)
+{
+  int fd;
+  struct stat sb;
+
+  fd = open (filename,
+             O_RDONLY);
+  if (-1 == fd)
+  {
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (0 != fstat (fd,
+                  &sb))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "stat",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (sb.st_size != buf_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "File `%s' has wrong size (%llu), expected %llu bytes\n",
+                filename,
+                (unsigned long long) sb.st_size,
+                (unsigned long long) buf_size);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (buf_size !=
+      read (fd,
+            buf,
+            buf_size))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "read",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 == close (fd));
+  return GNUNET_OK;
+}
+
+
+/**
+ * Process the given file from the "EGODIR".  Parses the file
+ * and creates the respective 'struct Ego' in memory.
+ *
+ * @param cls NULL
+ * @param filename name of the file to parse
+ * @return #GNUNET_OK to continue to iterate,
+ *  #GNUNET_NO to stop iteration with no error,
+ *  #GNUNET_SYSERR to abort iteration with error!
+ */
+static int
+process_ego_file (void *cls,
+                  const char *filename)
+{
+  struct Ego *ego;
+  const char *fn;
+
+  fn = strrchr (filename, (int) DIR_SEPARATOR);
+  if (NULL == fn)
+  {
+    GNUNET_break (0);
+    return GNUNET_OK;
+  }
+  ego = GNUNET_new (struct Ego);
+  if (GNUNET_OK !=
+      read_from_file (filename,
+                      &ego->pk,
+                      sizeof (ego->pk)))
+  {
+    GNUNET_free (ego);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Failed to parse ego information in `%s'\n"),
+                filename);
+    return GNUNET_OK;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Loaded ego `%s'\n",
+              fn + 1);
+  ego->identifier = GNUNET_strdup (fn + 1);
+  GNUNET_CONTAINER_DLL_insert (ego_head, ego_tail, ego);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle network size estimate clients.
+ *
+ * @param cls closure
+ * @param server the initialized server
+ * @param c configuration to use
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *c,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  cfg = c;
+  nc = GNUNET_notification_context_create (1);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                            "identity",
+                                                            "EGODIR",
+                                                            &ego_directory))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "identity", "EGODIR");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                               "identity",
+                                               "SUBSYSTEM_CFG",
+                                               &subsystem_cfg_file))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "identity",
+                               "SUBSYSTEM_CFG");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Loading subsystem configuration `%s'\n",
+              subsystem_cfg_file);
+  subsystem_cfg = GNUNET_CONFIGURATION_create ();
+  if ((GNUNET_YES == GNUNET_DISK_file_test (subsystem_cfg_file)) &&
+      (GNUNET_OK !=
+       GNUNET_CONFIGURATION_parse (subsystem_cfg, subsystem_cfg_file)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ (
+                  "Failed to parse subsystem identity configuration file `%s'\n"),
+                subsystem_cfg_file);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  stats = GNUNET_STATISTICS_create ("identity", cfg);
+  if (GNUNET_OK != GNUNET_DISK_directory_create (ego_directory))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Failed to create directory `%s' for storing egos\n"),
+                ego_directory);
+  }
+  GNUNET_DISK_directory_scan (ego_directory,
+                              &process_ego_file,
+                              NULL);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN (
+  "identity",
+  GNUNET_SERVICE_OPTION_NONE,
+  &run,
+  &client_connect_cb,
+  &client_disconnect_cb,
+  NULL,
+  GNUNET_MQ_hd_fixed_size (start_message,
+                           GNUNET_MESSAGE_TYPE_IDENTITY_START,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+  GNUNET_MQ_hd_var_size (lookup_message,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP,
+                         struct LookupMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (lookup_by_suffix_message,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP_BY_SUFFIX,
+                         struct LookupMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (create_message,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_CREATE,
+                         struct CreateRequestMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (rename_message,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_RENAME,
+                         struct RenameMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (delete_message,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_DELETE,
+                         struct DeleteMessage,
+                         NULL),
+  GNUNET_MQ_handler_end ());
+
+
+/* end of gnunet-service-identity.c */
diff --git a/src/service/identity/identity.conf.in b/src/service/identity/identity.conf.in
new file mode 100644
index 000000000..f5d454323
--- /dev/null
+++ b/src/service/identity/identity.conf.in
@@ -0,0 +1,17 @@
+[identity]
+START_ON_DEMAND = @START_ON_DEMAND@
+RUN_PER_USER = YES
+@JAVAPORT@PORT = 2108
+HOSTNAME = localhost
+BINARY = gnunet-service-identity
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-identity.sock
+UNIX_MATCH_UID = NO
+UNIX_MATCH_GID = YES
+
+# Directory where we store information about our egos
+EGODIR = $GNUNET_DATA_HOME/identity/egos/
+
+# File where we store default identities for subsystems
+SUBSYSTEM_CFG = $GNUNET_CONFIG_HOME/identity/subsystem_defaults.conf
diff --git a/src/service/identity/identity.h b/src/service/identity/identity.h
new file mode 100644
index 000000000..acb403736
--- /dev/null
+++ b/src/service/identity/identity.h
@@ -0,0 +1,226 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file identity/identity.h
+ *
+ * @brief Common type definitions for the identity
+ *        service and API.
+ */
+#ifndef IDENTITY_H
+#define IDENTITY_H
+
+#include "gnunet_common.h"
+
+/**
+ * Handle for an ego.
+ */
+struct GNUNET_IDENTITY_Ego
+{
+  /**
+   * Hash of the private key of this ego.
+   */
+  struct GNUNET_HashCode id;
+
+  /**
+   * The identity key pair
+   */
+  struct GNUNET_CRYPTO_PublicKey pub;
+
+  /**
+   * The identity key pair
+   */
+  struct GNUNET_CRYPTO_PrivateKey pk;
+
+  /**
+   * Current name associated with this ego.
+   */
+  char *name;
+
+  /**
+   * Client context associated with this ego.
+   */
+  void *ctx;
+
+  /**
+   * Set to true once @e pub was initialized
+   */
+  bool pub_initialized;
+};
+
+
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+
+/**
+ * Answer from service to client about last operation;
+ * GET_DEFAULT maybe answered with this message on failure;
+ * CREATE and RENAME will always be answered with this message.
+ */
+struct ResultCodeMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_RESULT_CODE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Status code for the last operation, in NBO.
+   * (currently not used).
+   */
+  uint32_t result_code GNUNET_PACKED;
+};
+
+
+/**
+ * Client informs service about desire to lookup a (single) pseudonym.
+ */
+struct LookupMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP or
+   * #GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP_BY_SUFFIX
+   */
+  struct GNUNET_MessageHeader header;
+
+  /* followed by 0-terminated ego name */
+};
+
+
+/**
+ * Service informs client about status of a pseudonym.
+ */
+struct UpdateMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of bytes in ego name string including 0-termination, in NBO;
+   * 0 if the ego was deleted.
+   */
+  uint16_t name_len GNUNET_PACKED;
+
+  /**
+   * Usually #GNUNET_NO, #GNUNET_YES to signal end of list.
+   */
+  uint16_t end_of_list GNUNET_PACKED;
+
+  /**
+   * Key length
+   */
+  uint16_t key_len GNUNET_PACKED;
+
+  /**
+   * Reserved (alignment)
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /* followed by 0-terminated ego name */
+  /* followed by the private key */
+};
+
+
+/**
+ * Client requests creation of an identity.  Service
+ * will respond with a result code.
+ */
+struct CreateRequestMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_CREATE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of bytes in identity name string including 0-termination, in NBO.
+   */
+  uint16_t name_len GNUNET_PACKED;
+
+  /**
+   * Key length
+   */
+  uint16_t key_len GNUNET_PACKED;
+
+  /*
+   * Followed by the private key
+   * followed by 0-terminated identity name */
+};
+
+
+/**
+ * Client requests renaming of an identity.  Service
+ * will respond with a result code.
+ */
+struct RenameMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_RENAME
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of characters in the old name including 0-termination, in NBO.
+   */
+  uint16_t old_name_len GNUNET_PACKED;
+
+  /**
+   * Number of characters in the new name including 0-termination, in NBO.
+   */
+  uint16_t new_name_len GNUNET_PACKED;
+
+  /* followed by 0-terminated old name */
+  /* followed by 0-terminated new name */
+};
+
+
+/**
+ * Client requests deletion of an identity.  Service
+ * will respond with a result code.
+ */
+struct DeleteMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_IDENTITY_DELETE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of characters in the name including 0-termination, in NBO.
+   */
+  uint16_t name_len GNUNET_PACKED;
+
+  /**
+   * Always zero.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /* followed by 0-terminated name */
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+
+#endif
diff --git a/src/service/identity/identity_api.c b/src/service/identity/identity_api.c
new file mode 100644
index 000000000..fe789d643
--- /dev/null
+++ b/src/service/identity/identity_api.c
@@ -0,0 +1,768 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2016, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file identity/identity_api.c
+ * @brief api to interact with the identity service
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
+#include "gnunet_error_codes.h"
+#include "gnunet_protocols.h"
+#include "gnunet_identity_service.h"
+#include "identity.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "identity-api", __VA_ARGS__)
+
+
+/**
+ * Handle for an operation with the identity service.
+ */
+struct GNUNET_IDENTITY_Operation
+{
+  /**
+   * Main identity handle.
+   */
+  struct GNUNET_IDENTITY_Handle *h;
+
+  /**
+   * We keep operations in a DLL.
+   */
+  struct GNUNET_IDENTITY_Operation *next;
+
+  /**
+   * We keep operations in a DLL.
+   */
+  struct GNUNET_IDENTITY_Operation *prev;
+
+  /**
+   * Message to send to the identity service.
+   * Allocated at the end of this struct.
+   */
+  const struct GNUNET_MessageHeader *msg;
+
+  /**
+   * Continuation to invoke with the result of the transmission; @e cb
+   * and @e create_cont will be NULL in this case.
+   */
+  GNUNET_IDENTITY_Continuation cont;
+
+  /**
+   * Continuation to invoke with the result of the transmission; @e cb
+   * and @a cb will be NULL in this case.
+   */
+  GNUNET_IDENTITY_CreateContinuation create_cont;
+
+  /**
+   * Private key to return to @e create_cont, or NULL.
+   */
+  struct GNUNET_CRYPTO_PrivateKey pk;
+
+  /**
+   * Continuation to invoke with the result of the transmission for
+   * 'get' operations (@e cont and @a create_cont will be NULL in this case).
+   */
+  GNUNET_IDENTITY_Callback cb;
+
+  /**
+   * Closure for @e cont or @e cb.
+   */
+  void *cls;
+};
+
+
+/**
+ * Handle for the service.
+ */
+struct GNUNET_IDENTITY_Handle
+{
+  /**
+   * Configuration to use.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Connection to service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Hash map from the hash of the private key to the
+   * respective `GNUNET_IDENTITY_Ego` handle.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *egos;
+
+  /**
+   * Function to call when we receive updates.
+   */
+  GNUNET_IDENTITY_Callback cb;
+
+  /**
+   * Closure for @e cb.
+   */
+  void *cb_cls;
+
+  /**
+   * Head of active operations.
+   */
+  struct GNUNET_IDENTITY_Operation *op_head;
+
+  /**
+   * Tail of active operations.
+   */
+  struct GNUNET_IDENTITY_Operation *op_tail;
+
+  /**
+   * Task doing exponential back-off trying to reconnect.
+   */
+  struct GNUNET_SCHEDULER_Task *reconnect_task;
+
+  /**
+   * Time for next connect retry.
+   */
+  struct GNUNET_TIME_Relative reconnect_delay;
+
+  /**
+   * Are we polling for incoming messages right now?
+   */
+  int in_receive;
+};
+
+
+/**
+ * Obtain the ego representing 'anonymous' users.
+ *
+ * @return handle for the anonymous user, MUST NOT be freed
+ */
+struct GNUNET_IDENTITY_Ego *
+GNUNET_IDENTITY_ego_get_anonymous ()
+{
+  static struct GNUNET_IDENTITY_Ego anon;
+  static int setup;
+  ssize_t key_len;
+
+  if (setup)
+    return &anon;
+  anon.pk.type = htonl (GNUNET_PUBLIC_KEY_TYPE_ECDSA);
+  anon.pub.type = htonl (GNUNET_PUBLIC_KEY_TYPE_ECDSA);
+  anon.pk.ecdsa_key = *GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
+  key_len = GNUNET_CRYPTO_private_key_get_length (&anon.pk);
+  GNUNET_assert (0 < key_len);
+  GNUNET_CRYPTO_hash (&anon.pk,
+                      key_len,
+                      &anon.id);
+  setup = 1;
+  return &anon;
+}
+
+
+
+/**
+ * Try again to connect to the identity service.
+ *
+ * @param cls handle to the identity service.
+ */
+static void
+reconnect (void *cls);
+
+
+/**
+ * Free ego from hash map.
+ *
+ * @param cls identity service handle
+ * @param key unused
+ * @param value ego to free
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+free_ego (void *cls,
+          const struct GNUNET_HashCode *key,
+          void *value)
+{
+  struct GNUNET_IDENTITY_Handle *h = cls;
+  struct GNUNET_IDENTITY_Ego *ego = value;
+
+  if (NULL != h->cb)
+    h->cb (h->cb_cls, ego,
+           &ego->ctx,
+           NULL);
+  GNUNET_free (ego->name);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (h->egos,
+                                                       key,
+                                                       value));
+  GNUNET_free (ego);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Reschedule a connect attempt to the service.
+ *
+ * @param h transport service to reconnect
+ */
+static void
+reschedule_connect (struct GNUNET_IDENTITY_Handle *h)
+{
+  struct GNUNET_IDENTITY_Operation *op;
+
+  GNUNET_assert (NULL == h->reconnect_task);
+
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  while (NULL != (op = h->op_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (h->op_head,
+                                 h->op_tail,
+                                 op);
+    if (NULL != op->cont)
+      op->cont (op->cls,
+                GNUNET_EC_SERVICE_COMMUNICATION_FAILED);
+    else if (NULL != op->cb)
+      op->cb (op->cls, NULL, NULL, NULL);
+    else if (NULL != op->create_cont)
+      op->create_cont (op->cls,
+                       NULL,
+                       GNUNET_EC_SERVICE_COMMUNICATION_FAILED);
+    GNUNET_free (op);
+  }
+  GNUNET_CONTAINER_multihashmap_iterate (h->egos,
+                                         &free_ego,
+                                         h);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Scheduling task to reconnect to identity service in %s.\n",
+       GNUNET_STRINGS_relative_time_to_string (h->reconnect_delay,
+                                               GNUNET_YES));
+  h->reconnect_task =
+    GNUNET_SCHEDULER_add_delayed (h->reconnect_delay,
+                                  &reconnect,
+                                  h);
+  h->reconnect_delay = GNUNET_TIME_STD_BACKOFF (h->reconnect_delay);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_IDENTITY_Handle *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_IDENTITY_Handle *h = cls;
+
+  reschedule_connect (h);
+}
+
+
+/**
+ * We received a result code from the service.
+ *
+ * @param cls closure
+ * @param rcm result message received
+ */
+static void
+handle_identity_result_code (void *cls,
+                             const struct ResultCodeMessage *rcm)
+{
+  struct GNUNET_IDENTITY_Handle *h = cls;
+  struct GNUNET_IDENTITY_Operation *op;
+  enum GNUNET_ErrorCode ec = ntohl (rcm->result_code);
+
+  op = h->op_head;
+  if (NULL == op)
+  {
+    GNUNET_break (0);
+    reschedule_connect (h);
+    return;
+  }
+  GNUNET_CONTAINER_DLL_remove (h->op_head, h->op_tail, op);
+  if (NULL != op->cont)
+    op->cont (op->cls, ec);
+  else if (NULL != op->cb)
+    op->cb (op->cls, NULL, NULL, NULL);
+  else if (NULL != op->create_cont)
+    op->create_cont (op->cls, (GNUNET_EC_NONE == ec) ? &op->pk : NULL, ec);
+  GNUNET_free (op);
+}
+
+
+/**
+ * Check validity of identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_identity_update (void *cls,
+                       const struct UpdateMessage *um)
+{
+  uint16_t size = ntohs (um->header.size);
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str = (const char *) &um[1];
+
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
+      ((0 != name_len) && ('\0' != str[name_len - 1])))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ */
+static void
+handle_identity_update (void *cls,
+                        const struct UpdateMessage *um)
+{
+  struct GNUNET_IDENTITY_Handle *h = cls;
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
+  struct GNUNET_HashCode id;
+  struct GNUNET_IDENTITY_Ego *ego;
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+  const char *tmp;
+
+  if (GNUNET_YES == ntohs (um->end_of_list))
+  {
+    /* end of initial list of data */
+    if (NULL != h->cb)
+      h->cb (h->cb_cls, NULL, NULL, NULL);
+    return;
+  }
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->key_len);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_read_private_key_from_buffer (tmp + name_len,
+                                                               key_len,
+                                                               &private_key,
+                                                               &kb_read));
+  GNUNET_assert (0 <= GNUNET_CRYPTO_private_key_get_length (&private_key));
+  GNUNET_CRYPTO_hash (&private_key,
+                      GNUNET_CRYPTO_private_key_get_length (&private_key),
+                      &id);
+  ego = GNUNET_CONTAINER_multihashmap_get (h->egos,
+                                           &id);
+  if (NULL == ego)
+  {
+    /* ego was created */
+    if (NULL == str)
+    {
+      /* deletion of unknown ego? not allowed */
+      GNUNET_break (0);
+      reschedule_connect (h);
+      return;
+    }
+    ego = GNUNET_new (struct GNUNET_IDENTITY_Ego);
+    ego->pub_initialized = GNUNET_NO;
+    ego->pk = private_key;
+    ego->name = GNUNET_strdup (str);
+    ego->id = id;
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_put (
+                     h->egos,
+                     &ego->id,
+                     ego,
+                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  }
+  if (NULL == str)
+  {
+    /* ego was deleted */
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_remove (h->egos,
+                                                         &ego->id,
+                                                         ego));
+  }
+  else
+  {
+    /* ego changed name */
+    GNUNET_free (ego->name);
+    ego->name = GNUNET_strdup (str);
+  }
+  /* inform application about change */
+  if (NULL != h->cb)
+    h->cb (h->cb_cls,
+           ego,
+           &ego->ctx,
+           str);
+  /* complete deletion */
+  if (NULL == str)
+  {
+    GNUNET_free (ego->name);
+    GNUNET_free (ego);
+  }
+}
+
+
+/**
+ * Try again to connect to the identity service.
+ *
+ * @param cls handle to the identity service.
+ */
+static void
+reconnect (void *cls)
+{
+  struct GNUNET_IDENTITY_Handle *h = cls;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_fixed_size (identity_result_code,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_RESULT_CODE,
+                             struct ResultCodeMessage,
+                             h),
+    GNUNET_MQ_hd_var_size (identity_update,
+                           GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE,
+                           struct UpdateMessage,
+                           h),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+
+  h->reconnect_task = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Connecting to identity service.\n");
+  GNUNET_assert (NULL == h->mq);
+  h->mq = GNUNET_CLIENT_connect (h->cfg,
+                                 "identity",
+                                 handlers,
+                                 &mq_error_handler,
+                                 h);
+  if (NULL == h->mq)
+    return;
+  if (NULL != h->cb)
+  {
+    env = GNUNET_MQ_msg (msg,
+                         GNUNET_MESSAGE_TYPE_IDENTITY_START);
+    GNUNET_MQ_send (h->mq,
+                    env);
+  }
+}
+
+
+/**
+ * Connect to the identity service.
+ *
+ * @param cfg the configuration to use
+ * @param cb function to call on all identity events, can be NULL
+ * @param cb_cls closure for @a cb
+ * @return handle to use
+ */
+struct GNUNET_IDENTITY_Handle *
+GNUNET_IDENTITY_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                         GNUNET_IDENTITY_Callback cb,
+                         void *cb_cls)
+{
+  struct GNUNET_IDENTITY_Handle *h;
+
+  h = GNUNET_new (struct GNUNET_IDENTITY_Handle);
+  h->cfg = cfg;
+  h->cb = cb;
+  h->cb_cls = cb_cls;
+  h->egos = GNUNET_CONTAINER_multihashmap_create (16,
+                                                  GNUNET_YES);
+  reconnect (h);
+  if (NULL == h->mq)
+  {
+    GNUNET_free (h);
+    return NULL;
+  }
+  return h;
+}
+
+
+
+/**
+ * Obtain the ECC key associated with a ego.
+ *
+ * @param ego the ego
+ * @return associated ECC key, valid as long as the ego is valid
+ */
+const struct GNUNET_CRYPTO_PrivateKey *
+GNUNET_IDENTITY_ego_get_private_key (const struct GNUNET_IDENTITY_Ego *ego)
+{
+  return &ego->pk;
+}
+
+/**
+ * Get the identifier (public key) of an ego.
+ *
+ * @param ego identity handle with the private key
+ * @param pk set to ego's public key
+ */
+void
+GNUNET_IDENTITY_ego_get_public_key (struct GNUNET_IDENTITY_Ego *ego,
+                                    struct GNUNET_CRYPTO_PublicKey *pk)
+{
+  if (GNUNET_NO == ego->pub_initialized)
+  {
+    GNUNET_CRYPTO_key_get_public (&ego->pk, &ego->pub);
+    ego->pub_initialized = GNUNET_YES;
+  }
+  *pk = ego->pub;
+}
+
+static enum GNUNET_GenericReturnValue
+private_key_create (enum GNUNET_CRYPTO_KeyType ktype,
+                    struct GNUNET_CRYPTO_PrivateKey *key)
+{
+  key->type = htonl (ktype);
+  switch (ktype)
+  {
+  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
+    GNUNET_CRYPTO_ecdsa_key_create (&key->ecdsa_key);
+    break;
+  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
+    GNUNET_CRYPTO_eddsa_key_create (&key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+struct GNUNET_IDENTITY_Operation *
+GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
+                        const char *name,
+                        const struct GNUNET_CRYPTO_PrivateKey *privkey,
+                        enum GNUNET_CRYPTO_KeyType ktype,
+                        GNUNET_IDENTITY_CreateContinuation cont,
+                        void *cont_cls)
+{
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+  struct GNUNET_IDENTITY_Operation *op;
+  struct GNUNET_MQ_Envelope *env;
+  struct CreateRequestMessage *crm;
+  size_t slen;
+  size_t key_len;
+
+  if (NULL == h->mq)
+    return NULL;
+  slen = strlen (name) + 1;
+  if (slen >= GNUNET_MAX_MESSAGE_SIZE - sizeof(struct CreateRequestMessage))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  op = GNUNET_new (struct GNUNET_IDENTITY_Operation);
+  op->h = h;
+  op->create_cont = cont;
+  op->cls = cont_cls;
+  GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  if (NULL == privkey)
+  {
+    GNUNET_assert (GNUNET_OK ==
+                   private_key_create (ktype, &private_key));
+  }
+  else
+    private_key = *privkey;
+  key_len = GNUNET_CRYPTO_private_key_get_length (&private_key);
+  env = GNUNET_MQ_msg_extra (crm, slen + key_len,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_CREATE);
+  crm->name_len = htons (slen);
+  GNUNET_CRYPTO_write_private_key_to_buffer (&private_key,
+                                               &crm[1],
+                                               key_len);
+  crm->key_len = htons (key_len);
+  op->pk = private_key;
+  GNUNET_memcpy ((char*) &crm[1] + key_len, name, slen);
+  GNUNET_MQ_send (h->mq, env);
+  return op;
+}
+
+
+/**
+ * Renames an existing identity.
+ *
+ * @param h identity service to use
+ * @param old_name old name
+ * @param new_name desired new name
+ * @param cb function to call with the result (will only be called once)
+ * @param cb_cls closure for @a cb
+ * @return handle to abort the operation
+ */
+struct GNUNET_IDENTITY_Operation *
+GNUNET_IDENTITY_rename (struct GNUNET_IDENTITY_Handle *h,
+                        const char *old_name,
+                        const char *new_name,
+                        GNUNET_IDENTITY_Continuation cb,
+                        void *cb_cls)
+{
+  struct GNUNET_IDENTITY_Operation *op;
+  struct GNUNET_MQ_Envelope *env;
+  struct RenameMessage *grm;
+  size_t slen_old;
+  size_t slen_new;
+  char *dst;
+
+  if (NULL == h->mq)
+    return NULL;
+  slen_old = strlen (old_name) + 1;
+  slen_new = strlen (new_name) + 1;
+  if ((slen_old >= GNUNET_MAX_MESSAGE_SIZE) ||
+      (slen_new >= GNUNET_MAX_MESSAGE_SIZE) ||
+      (slen_old + slen_new >=
+       GNUNET_MAX_MESSAGE_SIZE - sizeof(struct RenameMessage)))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  op = GNUNET_new (struct GNUNET_IDENTITY_Operation);
+  op->h = h;
+  op->cont = cb;
+  op->cls = cb_cls;
+  GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  env = GNUNET_MQ_msg_extra (grm,
+                             slen_old + slen_new,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_RENAME);
+  grm->old_name_len = htons (slen_old);
+  grm->new_name_len = htons (slen_new);
+  dst = (char *) &grm[1];
+  GNUNET_memcpy (dst, old_name, slen_old);
+  GNUNET_memcpy (&dst[slen_old], new_name, slen_new);
+  GNUNET_MQ_send (h->mq, env);
+  return op;
+}
+
+
+/**
+ * Delete an existing identity.
+ *
+ * @param h identity service to use
+ * @param name name of the identity to delete
+ * @param cb function to call with the result (will only be called once)
+ * @param cb_cls closure for @a cb
+ * @return handle to abort the operation
+ */
+struct GNUNET_IDENTITY_Operation *
+GNUNET_IDENTITY_delete (struct GNUNET_IDENTITY_Handle *h,
+                        const char *name,
+                        GNUNET_IDENTITY_Continuation cb,
+                        void *cb_cls)
+{
+  struct GNUNET_IDENTITY_Operation *op;
+  struct GNUNET_MQ_Envelope *env;
+  struct DeleteMessage *gdm;
+  size_t slen;
+
+  if (NULL == h->mq)
+    return NULL;
+  slen = strlen (name) + 1;
+  if (slen >= GNUNET_MAX_MESSAGE_SIZE - sizeof(struct DeleteMessage))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  op = GNUNET_new (struct GNUNET_IDENTITY_Operation);
+  op->h = h;
+  op->cont = cb;
+  op->cls = cb_cls;
+  GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  env = GNUNET_MQ_msg_extra (gdm, slen, GNUNET_MESSAGE_TYPE_IDENTITY_DELETE);
+  gdm->name_len = htons (slen);
+  gdm->reserved = htons (0);
+  GNUNET_memcpy (&gdm[1], name, slen);
+  GNUNET_MQ_send (h->mq, env);
+  return op;
+}
+
+
+/**
+ * Cancel an identity operation. Note that the operation MAY still
+ * be executed; this merely cancels the continuation; if the request
+ * was already transmitted, the service may still choose to complete
+ * the operation.
+ *
+ * @param op operation to cancel
+ */
+void
+GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation *op)
+{
+  op->cont = NULL;
+  op->cb = NULL;
+  op->create_cont = NULL;
+  memset (&op->pk,
+          0,
+          sizeof (op->pk));
+}
+
+
+/**
+ * Disconnect from identity service
+ *
+ * @param h handle to destroy
+ */
+void
+GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle *h)
+{
+  struct GNUNET_IDENTITY_Operation *op;
+
+  GNUNET_assert (NULL != h);
+  if (h->reconnect_task != NULL)
+  {
+    GNUNET_SCHEDULER_cancel (h->reconnect_task);
+    h->reconnect_task = NULL;
+  }
+  if (NULL != h->egos)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (h->egos,
+                                           &free_ego,
+                                           h);
+    GNUNET_CONTAINER_multihashmap_destroy (h->egos);
+    h->egos = NULL;
+  }
+  while (NULL != (op = h->op_head))
+  {
+    GNUNET_break (NULL == op->cont);
+    GNUNET_CONTAINER_DLL_remove (h->op_head, h->op_tail, op);
+    memset (&op->pk,
+            0,
+            sizeof (op->pk));
+    GNUNET_free (op);
+  }
+  if (NULL != h->mq)
+  {
+    GNUNET_MQ_destroy (h->mq);
+    h->mq = NULL;
+  }
+  GNUNET_free (h);
+}
+
+
+/* end of identity_api.c */
diff --git a/src/service/identity/identity_api_lookup.c b/src/service/identity/identity_api_lookup.c
new file mode 100644
index 000000000..03b229e08
--- /dev/null
+++ b/src/service/identity/identity_api_lookup.c
@@ -0,0 +1,244 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file identity/identity_api_lookup.c
+ * @brief api to lookup an ego
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_identity_service.h"
+#include "identity.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "identity-api", __VA_ARGS__)
+
+
+/**
+ * Handle for ego lookup.
+ */
+struct GNUNET_IDENTITY_EgoLookup
+{
+  /**
+   * Connection to service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Name of the ego we are looking up.
+   */
+  char *name;
+
+  /**
+   * Function to call with the result.
+   */
+  GNUNET_IDENTITY_EgoCallback cb;
+
+  /**
+   * Closure for @e cb
+   */
+  void *cb_cls;
+};
+
+
+/**
+ * We received a result code from the service.  Check the message
+ * is well-formed.
+ *
+ * @param cls closure
+ * @param rcm result message received
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_identity_result_code (void *cls, const struct ResultCodeMessage *rcm)
+{
+  if (sizeof(*rcm) != htons (rcm->header.size))
+    GNUNET_MQ_check_zero_termination (rcm);
+  return GNUNET_OK;
+}
+
+
+/**
+ * We received a result code from the service.
+ *
+ * @param cls closure
+ * @param rcm result message received
+ */
+static void
+handle_identity_result_code (void *cls, const struct ResultCodeMessage *rcm)
+{
+  struct GNUNET_IDENTITY_EgoLookup *el = cls;
+
+  el->cb (el->cb_cls, NULL);
+  GNUNET_IDENTITY_ego_lookup_cancel (el);
+}
+
+
+/**
+ * Check validity of identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_identity_update (void *cls, const struct UpdateMessage *um)
+{
+  uint16_t size = ntohs (um->header.size);
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str = (const char *) &um[1];
+
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
+      ((0 != name_len) && ('\0' != str[name_len - 1])))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ */
+static void
+handle_identity_update (void *cls, const struct UpdateMessage *um)
+{
+  struct GNUNET_IDENTITY_EgoLookup *el = cls;
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
+  struct GNUNET_HashCode id;
+  struct GNUNET_IDENTITY_Ego ego;
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+  const char *tmp;
+
+  memset (&ego, 0, sizeof (ego));
+
+  GNUNET_break (GNUNET_YES != ntohs (um->end_of_list));
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->header.size) - sizeof (*um) - name_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CRYPTO_read_private_key_from_buffer (tmp + name_len,
+                                                               key_len,
+                                                               &private_key,
+                                                               &kb_read));
+  GNUNET_assert (key_len == kb_read);
+  GNUNET_CRYPTO_hash (&private_key, sizeof (private_key), &id);
+  ego.pk = private_key;
+  ego.name = (char *) str;
+  ego.id = id;
+  el->cb (el->cb_cls, &ego);
+  GNUNET_IDENTITY_ego_lookup_cancel (el);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_IDENTITY_EgoLookup *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls, enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_IDENTITY_EgoLookup *el = cls;
+
+  el->cb (el->cb_cls, NULL);
+}
+
+
+/**
+ * Lookup an ego by name.
+ *
+ * @param cfg configuration to use
+ * @param name name to look up
+ * @param cb callback to invoke with the result
+ * @param cb_cls closure for @a cb
+ * @return NULL on error
+ */
+struct GNUNET_IDENTITY_EgoLookup *
+GNUNET_IDENTITY_ego_lookup (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                            const char *name,
+                            GNUNET_IDENTITY_EgoCallback cb,
+                            void *cb_cls)
+{
+  struct GNUNET_IDENTITY_EgoLookup *el;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *req;
+  size_t nlen;
+
+  GNUNET_assert (NULL != cb);
+  el = GNUNET_new (struct GNUNET_IDENTITY_EgoLookup);
+  el->cb = cb;
+  el->cb_cls = cb_cls;
+  {
+    struct GNUNET_MQ_MessageHandler handlers[] =
+    { GNUNET_MQ_hd_var_size (identity_result_code,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_RESULT_CODE,
+                             struct ResultCodeMessage,
+                             el),
+      GNUNET_MQ_hd_var_size (identity_update,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE,
+                             struct UpdateMessage,
+                             el),
+      GNUNET_MQ_handler_end () };
+
+    el->mq =
+      GNUNET_CLIENT_connect (cfg, "identity", handlers, &mq_error_handler, el);
+  }
+  if (NULL == el->mq)
+  {
+    GNUNET_break (0);
+    GNUNET_free (el);
+    return NULL;
+  }
+  el->name = GNUNET_strdup (name);
+  nlen = strlen (name) + 1;
+  env = GNUNET_MQ_msg_extra (req, nlen, GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP);
+  memcpy (&req[1], name, nlen);
+  GNUNET_MQ_send (el->mq, env);
+  return el;
+}
+
+
+/**
+ * Abort ego lookup attempt.
+ *
+ * @param el handle for lookup to abort
+ */
+void
+GNUNET_IDENTITY_ego_lookup_cancel (struct GNUNET_IDENTITY_EgoLookup *el)
+{
+  GNUNET_MQ_destroy (el->mq);
+  GNUNET_free (el->name);
+  GNUNET_free (el);
+}
+
+
+/* end of identity_api_lookup.c */
diff --git a/src/service/identity/identity_api_suffix_lookup.c b/src/service/identity/identity_api_suffix_lookup.c
new file mode 100644
index 000000000..7bc0d18f3
--- /dev/null
+++ b/src/service/identity/identity_api_suffix_lookup.c
@@ -0,0 +1,246 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file identity/identity_api_suffix_lookup.c
+ * @brief api to lookup an ego
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_identity_service.h"
+#include "identity.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "identity-api", __VA_ARGS__)
+
+
+/**
+ * Handle for ego lookup.
+ */
+struct GNUNET_IDENTITY_EgoSuffixLookup
+{
+  /**
+   * Connection to service.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Suffix we are looking up.
+   */
+  char *suffix;
+
+  /**
+   * Function to call with the result.
+   */
+  GNUNET_IDENTITY_EgoSuffixCallback cb;
+
+  /**
+   * Closure for @e cb
+   */
+  void *cb_cls;
+};
+
+
+/**
+ * We received a result code from the service.  Check the message
+ * is well-formed.
+ *
+ * @param cls closure
+ * @param rcm result message received
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_identity_result_code (void *cls, const struct ResultCodeMessage *rcm)
+{
+  (void) cls;
+  if (sizeof(*rcm) != htons (rcm->header.size))
+    GNUNET_MQ_check_zero_termination (rcm);
+  return GNUNET_OK;
+}
+
+
+/**
+ * We received a result code from the service.
+ *
+ * @param cls closure
+ * @param rcm result message received
+ */
+static void
+handle_identity_result_code (void *cls, const struct ResultCodeMessage *rcm)
+{
+  struct GNUNET_IDENTITY_EgoSuffixLookup *el = cls;
+
+  (void) rcm;
+  el->cb (el->cb_cls, NULL, NULL);
+  GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (el);
+}
+
+
+/**
+ * Check validity of identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_identity_update (void *cls, const struct UpdateMessage *um)
+{
+  uint16_t size = ntohs (um->header.size);
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str = (const char *) &um[1];
+
+  (void) cls;
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
+      ((0 != name_len) && ('\0' != str[name_len - 1])))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle identity update message.
+ *
+ * @param cls closure
+ * @param um message received
+ */
+static void
+handle_identity_update (void *cls, const struct UpdateMessage *um)
+{
+  struct GNUNET_IDENTITY_EgoSuffixLookup *el = cls;
+  uint16_t name_len = ntohs (um->name_len);
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
+  struct GNUNET_CRYPTO_PrivateKey private_key;
+  const char *tmp;
+
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->header.size) - name_len - sizeof (*um);
+  if (0 < key_len)
+  {
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_CRYPTO_read_private_key_from_buffer (tmp + name_len,
+                                                                 key_len,
+                                                                 &private_key,
+                                                                 &kb_read));
+    GNUNET_assert (key_len == kb_read);
+  }
+  el->cb (el->cb_cls, &private_key, str);
+  GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (el);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate error code and
+ * the same closure specified at the creation of the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure with the `struct GNUNET_IDENTITY_EgoSuffixLookup *`
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls, enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_IDENTITY_EgoSuffixLookup *el = cls;
+
+  (void) error;
+  el->cb (el->cb_cls, NULL, NULL);
+  GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (el);
+}
+
+
+/**
+ * Lookup an ego by name.
+ *
+ * @param cfg configuration to use
+ * @param name name to look up
+ * @param cb callback to invoke with the result
+ * @param cb_cls closure for @a cb
+ * @return NULL on error
+ */
+struct GNUNET_IDENTITY_EgoSuffixLookup *
+GNUNET_IDENTITY_ego_lookup_by_suffix (const struct
+                                      GNUNET_CONFIGURATION_Handle *cfg,
+                                      const char *suffix,
+                                      GNUNET_IDENTITY_EgoSuffixCallback cb,
+                                      void *cb_cls)
+{
+  struct GNUNET_IDENTITY_EgoSuffixLookup *el;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *req;
+  size_t nlen;
+
+  GNUNET_assert (NULL != cb);
+  el = GNUNET_new (struct GNUNET_IDENTITY_EgoSuffixLookup);
+  el->cb = cb;
+  el->cb_cls = cb_cls;
+  {
+    struct GNUNET_MQ_MessageHandler handlers[] =
+    { GNUNET_MQ_hd_var_size (identity_result_code,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_RESULT_CODE,
+                             struct ResultCodeMessage,
+                             el),
+      GNUNET_MQ_hd_var_size (identity_update,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE,
+                             struct UpdateMessage,
+                             el),
+      GNUNET_MQ_handler_end () };
+
+    el->mq =
+      GNUNET_CLIENT_connect (cfg, "identity", handlers, &mq_error_handler, el);
+  }
+  if (NULL == el->mq)
+  {
+    GNUNET_break (0);
+    GNUNET_free (el);
+    return NULL;
+  }
+  el->suffix = GNUNET_strdup (suffix);
+  nlen = strlen (suffix) + 1;
+  env = GNUNET_MQ_msg_extra (req, nlen,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_LOOKUP_BY_SUFFIX);
+  memcpy (&req[1], suffix, nlen);
+  GNUNET_MQ_send (el->mq, env);
+  return el;
+}
+
+
+/**
+ * Abort ego lookup attempt.
+ *
+ * @param el handle for lookup to abort
+ */
+void
+GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (struct
+                                             GNUNET_IDENTITY_EgoSuffixLookup *el)
+{
+  GNUNET_MQ_destroy (el->mq);
+  GNUNET_free (el->suffix);
+  GNUNET_free (el);
+}
+
+
+/* end of identity_api_suffix_lookup.c */
diff --git a/src/service/identity/meson.build b/src/service/identity/meson.build
new file mode 100644
index 000000000..c9e4f9bb4
--- /dev/null
+++ b/src/service/identity/meson.build
@@ -0,0 +1,60 @@
+libgnunetidentity_src = ['identity_api.c',
+                         'identity_api_lookup.c',
+                         'identity_api_suffix_lookup.c']
+
+gnunetserviceidentity_src = ['gnunet-service-identity.c']
+
+configure_file(input : 'identity.conf.in',
+               output : 'identity.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+
+if get_option('monolith')
+  foreach p : libgnunetidentity_src + gnunetserviceidentity_src
+    gnunet_src += 'identity/' + p
+  endforeach
+  subdir_done()
+endif
+
+libgnunetidentity = library('gnunetidentity',
+        libgnunetidentity_src,
+        soversion: '1',
+        version: '1.0.0',
+        dependencies: [libgnunetutil_dep, sodium_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetidentity_dep = declare_dependency(link_with : libgnunetidentity)
+pkg.generate(libgnunetidentity, url: 'https://www.gnunet.org',
+             description : 'API to access and organize private keys of the user egos')
+shared_module('gnunet_plugin_rest_identity',
+              ['plugin_rest_identity.c'],
+              dependencies: [libgnunetrest_dep,
+                             libgnunetidentity_dep,
+                             libgnunetutil_dep,
+                             json_dep,
+                             mhd_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir') / 'gnunet')
+
+
+executable ('gnunet-identity',
+            ['gnunet-identity.c'],
+            dependencies: [libgnunetidentity_dep,
+                           libgnunetutil_dep,
+                           libgnunetstatistics_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('bindir'))
+executable ('gnunet-service-identity',
+            gnunetserviceidentity_src,
+            dependencies: [libgnunetidentity_dep,
+                           libgnunetutil_dep,
+                           libgnunetstatistics_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir')/'gnunet'/'libexec')
+
diff --git a/src/service/identity/test_identity.c b/src/service/identity/test_identity.c
new file mode 100644
index 000000000..d133e3ee4
--- /dev/null
+++ b/src/service/identity/test_identity.c
@@ -0,0 +1,324 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file identity/test_identity.c
+ * @brief testcase for identity service
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_identity_service.h"
+#include "gnunet_testing_lib.h"
+
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
+
+
+/**
+ * Return value from 'main'.
+ */
+static int res;
+
+/**
+ * Handle to identity service.
+ */
+static struct GNUNET_IDENTITY_Handle *h;
+
+/**
+ * Handle to identity operation.
+ */
+static struct GNUNET_IDENTITY_Operation *op;
+
+/**
+ * Handle for task for timeout termination.
+ */
+static struct GNUNET_SCHEDULER_Task *endbadly_task;
+
+#define CHECK(cond)     \
+        do                    \
+        {                     \
+          if (! (cond))       \
+          {                   \
+            GNUNET_break (0); \
+            end ();           \
+            return;           \
+          }                   \
+        } while (0)
+
+
+/**
+ * Clean up all resources used.
+ */
+static void
+cleanup (void *cls)
+{
+  (void) cls;
+  if (NULL != op)
+  {
+    GNUNET_IDENTITY_cancel (op);
+    op = NULL;
+  }
+  if (NULL != h)
+  {
+    GNUNET_IDENTITY_disconnect (h);
+    h = NULL;
+  }
+}
+
+
+/**
+ * Termiante the testcase (failure).
+ *
+ * @param cls NULL
+ */
+static void
+endbadly (void *cls)
+{
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Finish the testcase (successfully).
+ */
+static void
+end ()
+{
+  if (NULL != endbadly_task)
+  {
+    GNUNET_SCHEDULER_cancel (endbadly_task);
+    endbadly_task = NULL;
+  }
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Called with events about egos.
+ *
+ * @param cls NULL
+ * @param ego ego handle
+ * @param ego_ctx context for application to store data for this ego
+ *                 (during the lifetime of this process, initially NULL)
+ * @param identifier identifier assigned by the user for this ego,
+ *                   NULL if the user just deleted the ego and it
+ *                   must thus no longer be used
+ */
+static void
+notification_cb (void *cls,
+                 struct GNUNET_IDENTITY_Ego *ego,
+                 void **ctx,
+                 const char *identifier)
+{
+  static struct GNUNET_IDENTITY_Ego *my_ego;
+  static int round;
+
+  switch (round)
+  {
+  case 0:   /* end of initial iteration */
+    CHECK (NULL == ego);
+    CHECK (NULL == identifier);
+    break;
+
+  case 1:   /* create */
+    CHECK (NULL != ego);
+    CHECK (NULL != identifier);
+    CHECK (0 == strcmp (identifier, "test-id"));
+    my_ego = ego;
+    *ctx = &round;
+    break;
+
+  case 2:   /* rename */
+    CHECK (my_ego == ego);
+    CHECK (NULL != identifier);
+    CHECK (0 == strcmp (identifier, "test"));
+    CHECK (*ctx == &round);
+    break;
+
+  case 3:   /* reconnect-down */
+    CHECK (my_ego == ego);
+    CHECK (NULL == identifier);
+    CHECK (*ctx == &round);
+    *ctx = NULL;
+    break;
+
+  case 4:   /* reconnect-up */
+    CHECK (NULL != identifier);
+    CHECK (0 == strcmp (identifier, "test"));
+    my_ego = ego;
+    *ctx = &round;
+    break;
+
+  case 5:   /* end of iteration after reconnect */
+    CHECK (NULL == ego);
+    CHECK (NULL == identifier);
+    break;
+
+  case 6:   /* delete */
+    CHECK (my_ego == ego);
+    CHECK (*ctx == &round);
+    *ctx = NULL;
+    break;
+
+  default:
+    CHECK (0);
+  }
+  round++;
+}
+
+
+/**
+ * Continuation called from successful delete operation.
+ *
+ * @param cls NULL
+ * @param ec
+ */
+static void
+delete_cont (void *cls, enum GNUNET_ErrorCode ec)
+{
+  op = NULL;
+  CHECK (GNUNET_EC_NONE == ec);
+  res = 0;
+  end ();
+}
+
+
+/**
+ * Continue by deleting the "test" identity.
+ *
+ * @param cls NULL
+ */
+static void
+finally_delete (void *cls)
+{
+  op = GNUNET_IDENTITY_delete (h, "test", &delete_cont, NULL);
+}
+
+
+/**
+ * Continuation called from expected-to-fail rename operation.
+ *
+ * @param cls NULL
+ * @param ec
+ */
+static void
+fail_rename_cont (void *cls, enum GNUNET_ErrorCode ec)
+{
+  CHECK (GNUNET_EC_NONE != ec);
+  op = NULL;
+  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                &finally_delete,
+                                NULL);
+}
+
+
+/**
+ * Continuation called from successful rename operation.
+ *
+ * @param cls NULL
+ * @param ec
+ */
+static void
+success_rename_cont (void *cls, enum GNUNET_ErrorCode ec)
+{
+  CHECK (GNUNET_EC_NONE == ec);
+  op = GNUNET_IDENTITY_rename (h, "test-id", "test", &fail_rename_cont, NULL);
+}
+
+
+/**
+ * Called with events about created ego.
+ *
+ * @param cls NULL
+ * @param pk private key of the ego, or NULL on error
+ * @param ec
+ */
+static void
+create_cb (void *cls,
+           const struct GNUNET_CRYPTO_PrivateKey *pk,
+           enum GNUNET_ErrorCode ec)
+{
+  CHECK (NULL != pk);
+  CHECK (GNUNET_EC_NONE == ec);
+  struct GNUNET_CRYPTO_PublicKey pub;
+  size_t pt_len = strlen ("test") + 1;
+  unsigned char ct[pt_len + GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES];
+  char pt[pt_len];
+  enum GNUNET_GenericReturnValue res;
+
+  GNUNET_CRYPTO_key_get_public (pk, &pub);
+  res = GNUNET_CRYPTO_encrypt ("test", pt_len, &pub, ct,
+                                 pt_len
+                                 + GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES);
+  CHECK (GNUNET_OK == res);
+  res = GNUNET_CRYPTO_decrypt (ct, pt_len
+                                 + GNUNET_CRYPTO_ENCRYPT_OVERHEAD_BYTES,
+                                 pk, pt, pt_len);
+  CHECK (GNUNET_OK == res);
+  CHECK (0 == strcmp (pt, "test"));
+  op =
+    GNUNET_IDENTITY_rename (h, "test-id", "test", &success_rename_cont, NULL);
+}
+
+
+/**
+ * Main function of the test, run from scheduler.
+ *
+ * @param cls NULL
+ * @param cfg configuration we use (also to connect to identity service)
+ * @param peer handle to access more of the peer (not used)
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT, &endbadly, NULL);
+  GNUNET_SCHEDULER_add_shutdown (&cleanup, NULL);
+  h = GNUNET_IDENTITY_connect (cfg, &notification_cb, NULL);
+  CHECK (NULL != h);
+  op = GNUNET_IDENTITY_create (h,
+                               "test-id",
+                               NULL,
+                               GNUNET_PUBLIC_KEY_TYPE_ECDSA,
+                               &create_cb, NULL);
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  GNUNET_DISK_purge_cfg_dir ("test_identity.conf",
+                             "GNUNET_TEST_HOME");
+  res = 1;
+  if (0 != GNUNET_TESTING_service_run ("test-identity",
+                                       "identity",
+                                       "test_identity.conf",
+                                       &run,
+                                       NULL))
+    return 1;
+  GNUNET_DISK_purge_cfg_dir ("test_identity.conf",
+                             "GNUNET_TEST_HOME");
+  return res;
+}
+
+
+/* end of test_identity.c */
diff --git a/src/service/identity/test_identity.conf b/src/service/identity/test_identity.conf
new file mode 100644
index 000000000..14b915732
--- /dev/null
+++ b/src/service/identity/test_identity.conf
@@ -0,0 +1,11 @@
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-identity-service/
+
+[arm]
+PORT = 12000
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-arm.sock
+
+[identity]
+# need to overwrite paths to ensure they stay the same between runs...
+EGODIR = $GNUNET_TMP/test-identity-service/egos/
+SUBSYSTEM_CFG = $GNUNET_TMP/test-identity-service/s.conf
diff --git a/src/service/identity/test_identity_messages.sh b/src/service/identity/test_identity_messages.sh
new file mode 100755
index 000000000..edb4d5805
--- /dev/null
+++ b/src/service/identity/test_identity_messages.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+trap "gnunet-arm -e -c test_identity.conf" SIGINT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+  echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+  exit 77
+fi
+
+rm -rf `gnunet-config -c test_identity.conf -s PATHS -o GNUNET_HOME -f`
+
+which timeout >/dev/null 2>&1 && DO_TIMEOUT="timeout 30"
+
+TEST_MSG="This is a test message. 123"
+gnunet-arm -s -c test_identity.conf
+gnunet-identity -C recipientego -c test_identity.conf
+gnunet-identity -C recipientegoed -X -c test_identity.conf
+RECIPIENT_KEY=`gnunet-identity -d -e recipientego -q -c test_identity.conf`
+MSG_ENC=`gnunet-identity -W "$TEST_MSG" -k $RECIPIENT_KEY -c test_identity.conf`
+if [ $? == 0 ]
+then
+  MSG_DEC=`gnunet-identity -R "$MSG_ENC" -e recipientego -c test_identity.conf`
+fi
+RECIPIENT_KEY_ED=`gnunet-identity -d -e recipientegoed -q -c test_identity.conf`
+MSG_ENC_ED=`gnunet-identity -W "$TEST_MSG" -k $RECIPIENT_KEY_ED -c test_identity.conf`
+if [ $? == 0 ]
+then
+  MSG_DEC_ED=`gnunet-identity -R "$MSG_ENC_ED" -e recipientegoed -c test_identity.conf`
+fi
+gnunet-identity -D recipientego -c test_identity.conf
+gnunet-identity -D recipientegoed -c test_identity.conf
+gnunet-arm -e -c test_identity.conf
+if [ "$TEST_MSG" != "$MSG_DEC" ]
+then
+  diff  <(echo "$TEST_MSG" ) <(echo "$MSG_DEC")
+  echo "Failed - \"$TEST_MSG\" != \"$MSG_DEC\""
+  exit 1
+fi
+if [ "$TEST_MSG" != "$MSG_DEC_ED" ]
+then
+  diff  <(echo "$TEST_MSG" ) <(echo "$MSG_DEC_ED")
+  echo "Failed - \"$TEST_MSG\" != \"$MSG_DEC_ED\""
+  exit 1
+fi
diff --git a/src/service/identity/test_plugin_rest_identity.sh b/src/service/identity/test_plugin_rest_identity.sh
new file mode 100755
index 000000000..a5879dd7e
--- /dev/null
+++ b/src/service/identity/test_plugin_rest_identity.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/bash
+
+#First, start gnunet-arm and the rest-service.
+#Exit 0 means success, exit 1 means failed test
+
+identity_link="http://localhost:7776/identity"
+wrong_link="http://localhost:7776/identityandmore"
+
+
+curl_get () {
+    #$1 is link
+    #$2 is grep
+    cache="$(curl -v "$1" 2>&1 | grep "$2")"
+    #echo $cache
+    if [ "" == "$cache" ]
+    then
+        exit 1
+    fi
+}
+
+curl_post () {
+    #$1 is link
+    #$2 is data
+    #$3 is grep
+    cache="$(curl -v -X "POST" "$1" --data "$2" 2>&1 | grep "$3")"
+    #echo $cache
+    if [ "" == "$cache" ]
+    then
+        exit 1
+    fi
+}
+
+curl_delete () {
+    #$1 is link
+    #$2 is grep
+    cache="$(curl -v -X "DELETE" "$1" 2>&1 | grep "$2")"
+    #echo $cache
+    if [ "" == "$cache" ]
+    then
+        exit 1
+    fi
+}
+
+curl_put () {
+    #$1 is link
+    #$2 is data
+    #$3 is grep
+    cache="$(curl -v -X "PUT" "$1" --data "$2" 2>&1 | grep "$3")"
+    #echo $cache
+    if [ "" == "$cache" ]
+    then
+        exit 1
+    fi
+}
+
+#Test GET
+test="$(gnunet-identity -d)"
+#if no identity exists
+if [ "" == "$test" ]
+then
+    curl_get "$identity_link/all" "error"
+    gnunet-identity -C "test_plugin_rest_identity"
+    name="$(gnunet-identity -d | awk 'NR==1{print $1}')"
+    public="$(gnunet-identity -d | awk 'NR==1{print $3}')"
+    
+    curl_get "${identity_link}/name/$name" "$public"
+    curl_get "${identity_link}/name/$public" "error"
+    curl_get "${identity_link}/name/" "error"
+    
+    curl_get "${identity_link}/pubkey/$public" "$name"
+    curl_get "${identity_link}/pubkey/$name" "error"
+    curl_get "${identity_link}/pubkey/" "error"
+    
+    gnunet-identity -D "test_plugin_rest_identity"
+else
+    name="$(gnunet-identity -d | awk 'NR==1{print $1}')"
+    public="$(gnunet-identity -d | awk 'NR==1{print $3}')"
+    
+    curl_get "${identity_link}/name/$name" "$public"
+    curl_get "${identity_link}/name/$public" "error"
+    curl_get "${identity_link}/name/" "error"
+    
+    curl_get "${identity_link}/pubkey/$public" "$name"
+    curl_get "${identity_link}/pubkey/$name" "error"
+    curl_get "${identity_link}/pubkey/" "error"
+fi
+
+#Test POST
+gnunet-identity -D "test_plugin_rest_identity" > /dev/null 2>&1
+gnunet-identity -D "test_plugin_rest_identity1" > /dev/null 2>&1
+
+curl_post "${identity_link}" '{"name":"test_plugin_rest_identity"}' "HTTP/1.1 201 Created"
+curl_post "${identity_link}" '{"name":"test_plugin_rest_identity"}' "HTTP/1.1 409"
+curl_post "${identity_link}" '{"name":"Test_plugin_rest_identity"}' "HTTP/1.1 409"
+curl_post "${identity_link}" '{}' "error"
+curl_post "${identity_link}" '' "error"
+curl_post "${identity_link}" '{"name":""}' "error"
+curl_post "${identity_link}" '{"name":123}' "error"
+curl_post "${identity_link}" '{"name":[]}' "error"
+curl_post "${identity_link}" '{"name1":"test_plugin_rest_identity"}' "error"
+curl_post "${identity_link}" '{"other":""}' "error"
+curl_post "${identity_link}" '{"name":"test_plugin_rest_identity1", "other":"test_plugin_rest_identity2"}' "error"
+
+#Test PUT
+name="$(gnunet-identity -d | grep "test_plugin_rest_identity" | awk 'NR==1{print $1}')"
+public="$(gnunet-identity -d | grep "test_plugin_rest_identity" | awk 'NR==1{print $3}')"
+
+curl_put "${identity_link}/pubkey/$public" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 204"
+curl_put "${identity_link}/pubkey/$public" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 409"
+curl_put "${identity_link}/pubkey/${public}xx" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 404"
+curl_put "${identity_link}/pubkey/" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 404"
+curl_put "${identity_link}/pubke" '{"newname":"test_plugin_rest_identity1"}' "error"
+curl_put "${identity_link}" '{"newname":"test_plugin_rest_identity1","other":"sdfdsf"}' "error"
+curl_put "${identity_link}/pubkey/$name" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 404"
+curl_put "${identity_link}/name/test_plugin_rest_identity1" '{"newname":"test_plugin_rest_identity"}' "HTTP/1.1 204"
+curl_put "${identity_link}/pubkey/$public" '{"newnam":"test_plugin_rest_identity"}' "error"
+curl_put "${identity_link}/name/test_plugin_rest_identity" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 204"
+curl_put "${identity_link}/name/test_plugin_rest_identity1" '{"newname":"TEST_plugin_rest_identity1"}' "HTTP/1.1 409"
+curl_put "${identity_link}/name/test_plugin_rest_identity1" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 409"
+curl_put "${identity_link}/name/test_plugin_rest_identityxxx" '{"newname":"test_plugin_rest_identity"}' "HTTP/1.1 404"
+curl_put "${identity_link}/name/test_plugin_rest_identity1" '{"newname":"test_plugin_rest_identity"}' "HTTP/1.1 204"
+curl_put "${identity_link}/name/test_plugin_rest_identity" '{"newnam":"test_plugin_rest_identityfail"}' "error"
+
+#Test subsystem
+curl_put "${identity_link}/subsystem/test_plugin_rest_identity" '{"subsystem":"namestore"}' "HTTP/1.1 204"
+curl_put "${identity_link}/subsystem/test_plugin_rest_identity" '{"subsystem":"namestore"}' "HTTP/1.1 204"
+curl_get "${identity_link}/subsystem/namestore" "test_plugin_rest_identity"
+public="$(gnunet-identity -d | grep "test_plugin_rest_identity" | awk 'NR==1{print $3}')"
+curl_put "${identity_link}/subsystem/$public" '{"subsystem":"namestore"}' "HTTP/1.1 404"
+curl_post "${identity_link}" '{"name":"test_plugin_rest_identity1"}' "HTTP/1.1 201 Created"
+curl_get "${identity_link}/subsystem/test_plugin_rest_identity_no_subsystem" "error"
+curl_put "${identity_link}/subsystem/test_plugin_rest_identity1" '{"subsystem":"test_plugin_rest_identity_no_subsystem"}' "HTTP/1.1 204"
+curl_get "${identity_link}/subsystem/test_plugin_rest_identity_no_subsystem" "test_plugin_rest_identity1"
+
+curl_put "${identity_link}/subsystem/test_plugin_rest_identity1" '{"subsyste":"test_plugin_rest_identity_no_subsystem"}' "error"
+curl_put "${identity_link}/subsystem/test_plugin_rest_identity1" '{"subsystem":"test_plugin_rest_identity_no_subsystem"}' "HTTP/1.1 204"
+
+#Test DELETE
+curl_delete "${identity_link}/name/test_plugin_rest_identity" "HTTP/1.1 204"
+curl_get "${identity_link}/name/test_plugin_rest_identity" "error"
+curl_delete "${identity_link}/name/TEST_plugin_rest_identity1" "HTTP/1.1 204"
+curl_delete "${identity_link}/name/test_plugin_rest_identity1" "HTTP/1.1 404"
+curl_get "${identity_link}/name/test_plugin_rest_identity1" "error"
+curl_delete "${identity_link}/name/test_plugin_rest_identity_not_found" "HTTP/1.1 404"
+curl_post "${identity_link}" '{"name":"test_plugin_rest_identity1"}' "HTTP/1.1 201 Created"
+public="$(gnunet-identity -d | grep "test_plugin_rest_identity1" | awk 'NR==1{print $3}')"
+curl_delete "${identity_link}/pubkey/$public" "HTTP/1.1 204"
+curl_delete "${identity_link}/pubke/$public" "error"
+curl_delete "${identity_link}/pubkey/${public}other=232" "HTTP/1.1 404"
+
+#Test wrong_link
+curl_get "$wrong_link" "HTTP/1.1 404"
+curl_post "$wrong_link" '{"name":"test_plugin_rest_identity"}' "HTTP/1.1 404"
+curl_put "$wrong_link/name/test_plugin_rest_identity" '{"newname":"test_plugin_rest_identity1"}' "HTTP/1.1 404"
+curl_delete "$wrong_link/name/test_plugin_rest_identity1" "HTTP/1.1 404"
+
+exit 0;
diff --git a/src/service/identity/test_plugin_rest_identity_signature.sh b/src/service/identity/test_plugin_rest_identity_signature.sh
new file mode 100755
index 000000000..a4d5fa5d7
--- /dev/null
+++ b/src/service/identity/test_plugin_rest_identity_signature.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/bash
+
+# https://www.rfc-editor.org/rfc/rfc7515#appendix-A.3
+
+header='{"alg":"EdDSA"}'
+payload='Example of Ed25519 signing'
+key='{  "kty":"OKP",
+        "crv":"Ed25519",
+        "d":"nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A",
+        "x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+    }'
+
+header_payload_test="eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc"
+signature_test="hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg"
+
+base64url_add_padding() {
+    for i in $( seq 1 $(( 4 - ${#1} % 4 )) ); do padding+="="; done
+    echo "$1""$padding"
+}
+
+base64url_encode () {
+    echo -n -e "$1" | base64 -w0 | tr '+/' '-_' | tr -d '='
+}
+
+base64url_decode () {
+    padded_input=$(base64url_add_padding "$1")
+    echo -n "$padded_input" | basenc --base64url -d
+}
+
+base32crockford_encode () {
+    echo -n -e "$1" | basenc --base32hex | tr 'IJKLMNOPQRSTUV' 'JKMNPQRSTVWXYZ'
+}
+
+echo -n "jwk: "
+echo $key | jq
+
+# Create Header
+# 65556 (decimal)
+# = 00000000-00000001-00000000-00010100 (binary little endian)
+# = 00-01-00-14 (hex little endian)
+header_hex=("00" "01" "00" "14")
+
+# Convert secret JWK to HEX array
+key_hex=( $( base64url_decode $( echo -n "$key" | jq -r '.d' ) | xxd -p | tr -d '\n' | fold -w 2 | tr '\n' ' ' ) )
+
+# Concat header and key
+header_key_hex=(${header_hex[@]} ${key_hex[@]})
+
+# Encode with Base32Crogford
+key_gnunet=$(echo -n "${header_key_hex[*]}" | tr -d " " | xxd -p -r | basenc --base32hex | tr 'IJKLMNOPQRSTUV' 'JKMNPQRSTVWXYZ' | tr -d "=")
+echo "gnunet skey: $key_gnunet"
+
+# Create ego
+gnunet-identity -C ego9696595726 -X -P "$key_gnunet"
+
+# Test base64url encoding and header.payload generation
+header_payload_enc="$(base64url_encode "$header").$(base64url_encode "$payload")"
+if [ $header_payload_enc != $header_payload_test ] ; 
+then 
+    exit 1
+fi
+echo "header.payload: $header_payload_enc"
+
+# Sign JWT
+signature_enc=$(curl -s "localhost:7776/sign?user=ego9696595726&data=$header_payload_enc" | jq -r '.signature')
+jwt="$header_payload_enc.$signature_enc"
+echo "header.payload.signature: $jwt"
+
+gnunet-identity -D ego9696595726
+
+if [ $signature_enc !=  $signature_test ]
+then
+    echo "Signature does not check out:"
+    echo "$signature_enc"
+    echo "$signature_test"
+    exit 1
+else 
+    echo "Signature does check out!"
+    exit 1
+fi
+
diff --git a/src/service/rest/.gitignore b/src/service/rest/.gitignore
new file mode 100644
index 000000000..07e69218e
--- /dev/null
+++ b/src/service/rest/.gitignore
@@ -0,0 +1 @@
+gnunet-rest-server
diff --git a/src/service/rest/Makefile.am b/src/service/rest/Makefile.am
new file mode 100644
index 000000000..401be36f4
--- /dev/null
+++ b/src/service/rest/Makefile.am
@@ -0,0 +1,42 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfg_DATA = \
+   rest.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+lib_LTLIBRARIES = \
+  libgnunetrest.la 
+
+libexec_PROGRAMS = \
+  gnunet-rest-server
+
+EXTRA_DIST = \
+ rest.conf
+
+gnunet_rest_server_SOURCES = \
+ gnunet-rest-server.c
+gnunet_rest_server_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL) $(MHD_LIBS)
+gnunet_rest_server_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
+
+libgnunetrest_la_SOURCES = \
+  rest.c
+libgnunetrest_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIB) \
+  $(GN_LIBINTL) $(MHD_LIBS)
+libgnunetrest_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS) \
+  -version-info 0:0:0
+libgnunetrest_la_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
diff --git a/src/service/rest/gnunet-rest-server.c b/src/service/rest/gnunet-rest-server.c
new file mode 100644
index 000000000..5163c2271
--- /dev/null
+++ b/src/service/rest/gnunet-rest-server.c
@@ -0,0 +1,1381 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @file src/rest/gnunet-rest-server.c
+ * @brief REST service for GNUnet services
+ *
+ */
+#include "platform.h"
+#include <microhttpd.h>
+#include "gnunet_util_lib.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_mhd_compat.h"
+
+/**
+ * Default Socks5 listen port.
+ */
+#define GNUNET_REST_SERVICE_PORT 7776
+
+/**
+ * Maximum supported length for a URI.
+ * Should die. @deprecated
+ */
+#define MAX_HTTP_URI_LENGTH 2048
+
+/**
+ * Port for plaintext HTTP.
+ */
+#define HTTP_PORT 80
+
+/**
+ * Port for HTTPS.
+ */
+#define HTTPS_PORT 443
+
+/**
+ * After how long do we clean up unused MHD SSL/TLS instances?
+ */
+#define MHD_CACHE_TIMEOUT \
+  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
+
+#define GN_REST_STATE_INIT 0
+#define GN_REST_STATE_PROCESSING 1
+
+/**
+ * The task ID
+ */
+static struct GNUNET_SCHEDULER_Task *httpd_task;
+
+/**
+ * The address to bind to
+ */
+static in_addr_t address;
+
+/**
+ * The IPv6 address to bind to
+ */
+static struct in6_addr address6;
+
+/**
+ * The port the service is running on (default 7776)
+ */
+static unsigned long long port = GNUNET_REST_SERVICE_PORT;
+
+/**
+ * The listen socket of the service for IPv4
+ */
+static struct GNUNET_NETWORK_Handle *lsock4;
+
+/**
+ * The listen socket of the service for IPv6
+ */
+static struct GNUNET_NETWORK_Handle *lsock6;
+
+/**
+ * The listen task ID for IPv4
+ */
+static struct GNUNET_SCHEDULER_Task *ltask4;
+
+/**
+ * The listen task ID for IPv6
+ */
+static struct GNUNET_SCHEDULER_Task *ltask6;
+
+/**
+ * Daemon for HTTP
+ */
+static struct MHD_Daemon *httpd;
+
+/**
+ * Response we return on failures.
+ */
+static struct MHD_Response *failure_response;
+
+/**
+ * Our configuration.
+ */
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+/**
+ * Echo request Origin in CORS
+ */
+static int echo_origin;
+
+/**
+ * Do basic auth of user
+ */
+static int basic_auth_enabled;
+
+/**
+ * Basic auth secret
+ */
+static char *basic_auth_secret;
+
+/**
+ * User of the service
+ */
+char cuser[_POSIX_LOGIN_NAME_MAX];
+
+/**
+ * Allowed Origins (CORS)
+ */
+static char *allow_origins;
+
+/**
+ * Allowed Headers (CORS)
+ */
+static char *allow_headers;
+
+/**
+ * Allowed Credentials (CORS)
+ */
+static char *allow_credentials;
+
+/**
+ * Plugin list head
+ */
+static struct PluginListEntry *plugins_head;
+
+/**
+ * Plugin list tail
+ */
+static struct PluginListEntry *plugins_tail;
+
+/**
+ * A plugin list entry
+ */
+struct PluginListEntry
+{
+  /* DLL */
+  struct PluginListEntry *next;
+
+  /* DLL */
+  struct PluginListEntry *prev;
+
+  /**
+   * libname (to cleanup)
+   */
+  char *libname;
+
+  /**
+   * The plugin
+   */
+  struct GNUNET_REST_Plugin *plugin;
+};
+
+/**
+ * MHD Connection handle
+ */
+struct MhdConnectionHandle
+{
+  struct MHD_Connection *con;
+
+  struct MHD_Response *response;
+
+  struct GNUNET_REST_RequestHandle *data_handle;
+
+  struct MHD_PostProcessor *pp;
+
+  int status;
+
+  int state;
+};
+
+/**
+ * Accepted requests
+ */
+struct AcceptedRequest
+{
+  /**
+   * DLL
+   */
+  struct AcceptedRequest *next;
+
+  /**
+   * DLL
+   */
+  struct AcceptedRequest *prev;
+
+  /**
+   * Socket
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * Connection
+   */
+  struct MhdConnectionHandle *con_handle;
+
+  /**
+   * State
+   */
+  int socket_with_mhd;
+};
+
+/**
+ * AcceptedRequest list head
+ */
+static struct AcceptedRequest *req_list_head;
+
+/**
+ * AcceptedRequest list tail
+ */
+static struct AcceptedRequest *req_list_tail;
+
+/* ************************* Global helpers ********************* */
+
+
+/**
+ * Task run whenever HTTP server operations are pending.
+ *
+ * @param cls NULL
+ */
+static void
+do_httpd (void *cls);
+
+
+/**
+ * Run MHD now, we have extra data ready for the callback.
+ */
+static void
+run_mhd_now ()
+{
+  if (NULL != httpd_task)
+  {
+    GNUNET_SCHEDULER_cancel (httpd_task);
+    httpd_task = NULL;
+  }
+  httpd_task = GNUNET_SCHEDULER_add_now (&do_httpd, NULL);
+}
+
+
+/**
+ * Plugin result callback
+ *
+ * @param cls closure (MHD connection handle)
+ * @param data the data to return to the caller
+ * @param len length of the data
+ * @param status #GNUNET_OK if successful
+ */
+static void
+plugin_callback (void *cls, struct MHD_Response *resp, int status)
+{
+  struct MhdConnectionHandle *handle = cls;
+
+  handle->status = status;
+  handle->response = resp;
+  MHD_resume_connection (handle->con);
+  run_mhd_now ();
+}
+
+
+static int
+cleanup_url_map (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  GNUNET_free (value);
+  return GNUNET_YES;
+}
+
+static void
+cleanup_handle (struct MhdConnectionHandle *handle)
+{
+  if (NULL != handle->response)
+    MHD_destroy_response (handle->response);
+  if (NULL != handle->data_handle)
+  {
+    if (NULL != handle->data_handle->header_param_map)
+    {
+      GNUNET_CONTAINER_multihashmap_iterate (handle->data_handle
+                                             ->header_param_map,
+                                             &cleanup_url_map,
+                                             NULL);
+      GNUNET_CONTAINER_multihashmap_destroy (
+        handle->data_handle->header_param_map);
+    }
+    if (NULL != handle->data_handle->url_param_map)
+    {
+      GNUNET_CONTAINER_multihashmap_iterate (handle->data_handle->url_param_map,
+                                             &cleanup_url_map,
+                                             NULL);
+      GNUNET_CONTAINER_multihashmap_destroy (
+        handle->data_handle->url_param_map);
+    }
+    GNUNET_free (handle->data_handle);
+  }
+  GNUNET_free (handle);
+}
+
+static void
+cleanup_ar (struct AcceptedRequest *ar)
+{
+  if (NULL != ar->con_handle)
+  {
+    cleanup_handle (ar->con_handle);
+  }
+  if (GNUNET_YES == ar->socket_with_mhd)
+  {
+    GNUNET_NETWORK_socket_free_memory_only_ (ar->sock);
+  }
+  else {
+    GNUNET_NETWORK_socket_close (ar->sock);
+  }
+  ar->sock = NULL;
+  GNUNET_CONTAINER_DLL_remove (req_list_head,
+                               req_list_tail,
+                               ar);
+  GNUNET_free (ar);
+}
+
+static int
+header_iterator (void *cls,
+                 enum MHD_ValueKind kind,
+                 const char *key,
+                 const char *value)
+{
+  struct GNUNET_REST_RequestHandle *handle = cls;
+  struct GNUNET_HashCode hkey;
+  char *val;
+  char *lowerkey;
+
+  lowerkey = GNUNET_strdup (key);
+  GNUNET_STRINGS_utf8_tolower (key, lowerkey);
+  GNUNET_CRYPTO_hash (lowerkey, strlen (lowerkey), &hkey);
+  GNUNET_asprintf (&val, "%s", value);
+  if (GNUNET_OK != GNUNET_CONTAINER_multihashmap_put (
+        handle->header_param_map,
+        &hkey,
+        val,
+        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Could not load add header `%s'=%s\n",
+                lowerkey,
+                value);
+  }
+  GNUNET_free (lowerkey);
+  return MHD_YES;
+}
+
+
+static int
+url_iterator (void *cls,
+              enum MHD_ValueKind kind,
+              const char *key,
+              const char *value)
+{
+  struct GNUNET_REST_RequestHandle *handle = cls;
+  struct GNUNET_HashCode hkey;
+  char *val;
+
+  GNUNET_CRYPTO_hash (key, strlen (key), &hkey);
+  GNUNET_asprintf (&val, "%s", value);
+  if (GNUNET_OK != GNUNET_CONTAINER_multihashmap_put (
+        handle->url_param_map,
+        &hkey,
+        val,
+        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Could not load add url param `%s'=%s\n",
+                key,
+                value);
+  }
+  return MHD_YES;
+}
+
+
+static MHD_RESULT
+post_data_iter (void *cls,
+                enum MHD_ValueKind kind,
+                const char *key,
+                const char *filename,
+                const char *content_type,
+                const char *transfer_encoding,
+                const char *data,
+                uint64_t off,
+                size_t size)
+{
+  struct GNUNET_REST_RequestHandle *handle = cls;
+  struct GNUNET_HashCode hkey;
+  char *val;
+
+  if (MHD_POSTDATA_KIND != kind)
+    return MHD_YES;
+
+  GNUNET_CRYPTO_hash (key, strlen (key), &hkey);
+  val = GNUNET_CONTAINER_multihashmap_get (handle->url_param_map,
+                                           &hkey);
+  if (NULL == val)
+  {
+    val = GNUNET_malloc (65536);
+    if (GNUNET_OK != GNUNET_CONTAINER_multihashmap_put (
+          handle->url_param_map,
+          &hkey,
+          val,
+          GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Could not add url param '%s'\n",
+                  key);
+      GNUNET_free (val);
+    }
+  }
+  memcpy (val + off, data, size);
+  return MHD_YES;
+}
+
+
+/* ********************************* MHD response generation ******************* */
+
+/**
+ * Main MHD callback for handling requests.
+ *
+ * @param cls unused
+ * @param con MHD connection handle
+ * @param url the url in the request
+ * @param meth the HTTP method used ("GET", "PUT", etc.)
+ * @param ver the HTTP version string ("HTTP/1.1" for version 1.1, etc.)
+ * @param upload_data the data being uploaded (excluding HEADERS,
+ *        for a POST that fits into memory and that is encoded
+ *        with a supported encoding, the POST data will NOT be
+ *        given in upload_data and is instead available as
+ *        part of MHD_get_connection_values; very large POST
+ *        data *will* be made available incrementally in
+ *        upload_data)
+ * @param upload_data_size set initially to the size of the
+ *        @a upload_data provided; the method must update this
+ *        value to the number of bytes NOT processed;
+ * @param con_cls pointer to location where we store the 'struct Request'
+ * @return #MHD_YES if the connection was handled successfully,
+ *         #MHD_NO if the socket must be closed due to a serious
+ *         error while handling the request
+ */
+static MHD_RESULT
+create_response (void *cls,
+                 struct MHD_Connection *con,
+                 const char *url,
+                 const char *meth,
+                 const char *ver,
+                 const char *upload_data,
+                 size_t *upload_data_size,
+                 void **con_cls)
+{
+  char *origin;
+  char *pw;
+  char *user;
+  struct AcceptedRequest *ar;
+  struct GNUNET_HashCode key;
+  struct MhdConnectionHandle *con_handle;
+  struct GNUNET_REST_RequestHandle *rest_conndata_handle;
+  struct PluginListEntry *ple;
+
+  ar = *con_cls;
+  if (NULL == ar)
+  {
+    GNUNET_break (0);
+    return MHD_NO;
+  }
+
+  if (NULL == ar->con_handle)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "New connection %s\n", url);
+    con_handle = GNUNET_new (struct MhdConnectionHandle);
+    con_handle->con = con;
+    con_handle->state = GN_REST_STATE_INIT;
+    ar->con_handle = con_handle;
+    return MHD_YES;
+  }
+  con_handle = ar->con_handle;
+  if (GN_REST_STATE_INIT == con_handle->state)
+  {
+    rest_conndata_handle = GNUNET_new (struct GNUNET_REST_RequestHandle);
+    rest_conndata_handle->method = meth;
+    rest_conndata_handle->url = url;
+    rest_conndata_handle->data = upload_data;
+    rest_conndata_handle->data_size = *upload_data_size;
+    rest_conndata_handle->url_param_map =
+      GNUNET_CONTAINER_multihashmap_create (16, GNUNET_NO);
+    rest_conndata_handle->header_param_map =
+      GNUNET_CONTAINER_multihashmap_create (16, GNUNET_NO);
+    con_handle->data_handle = rest_conndata_handle;
+    MHD_get_connection_values (con,
+                               MHD_GET_ARGUMENT_KIND,
+                               (MHD_KeyValueIterator) & url_iterator,
+                               rest_conndata_handle);
+    MHD_get_connection_values (con,
+                               MHD_HEADER_KIND,
+                               (MHD_KeyValueIterator) & header_iterator,
+                               rest_conndata_handle);
+    if (GNUNET_YES == basic_auth_enabled)
+    {
+      pw = NULL;
+      user = MHD_basic_auth_get_username_password (con, &pw);
+      if ((NULL == user) ||
+          (0 != strcmp (user, cuser)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Unknown user %s\n", user);
+        MHD_queue_basic_auth_fail_response (con, "gnunet", failure_response);
+        return MHD_YES;
+      }
+      if ((NULL == pw) ||
+          (0 != strcmp (pw, basic_auth_secret)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Password incorrect\n");
+        MHD_queue_basic_auth_fail_response (con, "gnunet", failure_response);
+        GNUNET_free (pw);
+        return MHD_YES;
+      }
+      GNUNET_free (pw);
+    }
+
+    con_handle->pp = MHD_create_post_processor (con,
+                                                65536,
+                                                &post_data_iter,
+                                                rest_conndata_handle);
+    if (*upload_data_size)
+    {
+      MHD_post_process (con_handle->pp, upload_data, *upload_data_size);
+    }
+    MHD_destroy_post_processor (con_handle->pp);
+
+    con_handle->state = GN_REST_STATE_PROCESSING;
+    for (ple = plugins_head; NULL != ple; ple = ple->next)
+    {
+      if (GNUNET_YES == ple->plugin->process_request (rest_conndata_handle,
+                                                      &plugin_callback,
+                                                      con_handle))
+        break; /* Request handled */
+    }
+    if (NULL == ple)
+    {
+      /** Request not handled **/
+      MHD_queue_response (con, MHD_HTTP_NOT_FOUND, failure_response);
+    }
+    *upload_data_size = 0;
+    run_mhd_now ();
+    return MHD_YES;
+  }
+  if (NULL == con_handle->response)
+  {
+    // Suspend connection until plugin is done
+    MHD_suspend_connection (con_handle->con);
+    return MHD_YES;
+  }
+  // MHD_resume_connection (con_handle->con);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Queueing response from plugin with MHD\n");
+  // Handle Preflights for extensions
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Checking origin\n");
+  GNUNET_CRYPTO_hash ("origin", strlen ("origin"), &key);
+  origin = GNUNET_CONTAINER_multihashmap_get (con_handle->data_handle
+                                              ->header_param_map,
+                                              &key);
+  if (NULL != origin)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Origin: %s\n", origin);
+    // Only echo for browser plugins
+    if (GNUNET_YES == echo_origin)
+    {
+      if ((0 ==
+           strncmp ("moz-extension://", origin, strlen ("moz-extension://"))) ||
+          (0 == strncmp ("chrome-extension://",
+                         origin,
+                         strlen ("chrome-extension://"))))
+      {
+        GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
+                                 MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
+                                 origin));
+      }
+    }
+    if (NULL != allow_origins)
+    {
+      char *tmp = GNUNET_strdup (allow_origins);
+      char *allow_origin = strtok (tmp, ",");
+      while (NULL != allow_origin)
+      {
+        if (0 == strncmp (allow_origin, origin, strlen (allow_origin)))
+        {
+          GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
+                                   MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
+                                   allow_origin));
+          break;
+        }
+        allow_origin = strtok (NULL, ",");
+      }
+      GNUNET_free (tmp);
+    }
+  }
+  if (NULL != allow_credentials)
+  {
+    GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
+                             "Access-Control-Allow-Credentials",
+                             allow_credentials));
+  }
+  if (NULL != allow_headers)
+  {
+    GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
+                             "Access-Control-Allow-Headers",
+                             allow_headers));
+  }
+  run_mhd_now ();
+  {
+    MHD_RESULT ret = MHD_queue_response (con,
+                                         con_handle->status,
+                                         con_handle->response);
+    // cleanup_handle (con_handle);
+    return ret;
+  }
+}
+
+
+/* ******************** MHD HTTP setup and event loop ******************** */
+
+
+/**
+ * Kill the MHD daemon.
+ */
+static void
+kill_httpd ()
+{
+  if (NULL != httpd)
+  {
+    MHD_stop_daemon (httpd);
+    httpd = NULL;
+  }
+  if (NULL != httpd_task)
+  {
+    GNUNET_SCHEDULER_cancel (httpd_task);
+    httpd_task = NULL;
+  }
+  if (NULL != ltask4)
+  {
+    GNUNET_SCHEDULER_cancel (ltask4);
+    ltask4 = NULL;
+  }
+  if (NULL != ltask6)
+  {
+    GNUNET_SCHEDULER_cancel (ltask6);
+    ltask6 = NULL;
+  }
+
+  if (NULL != lsock4)
+  {
+    GNUNET_NETWORK_socket_close (lsock4);
+    lsock4 = NULL;
+  }
+  if (NULL != lsock6)
+  {
+    GNUNET_NETWORK_socket_close (lsock6);
+    lsock6 = NULL;
+  }
+}
+
+
+/**
+ * Schedule MHD.  This function should be called initially when an
+ * MHD is first getting its client socket, and will then automatically
+ * always be called later whenever there is work to be done.
+ *
+ * @param hd the daemon to schedule
+ */
+static void
+schedule_httpd ()
+{
+  fd_set rs;
+  fd_set ws;
+  fd_set es;
+  struct GNUNET_NETWORK_FDSet *wrs;
+  struct GNUNET_NETWORK_FDSet *wws;
+  int max;
+  int haveto;
+  MHD_UNSIGNED_LONG_LONG timeout;
+  struct GNUNET_TIME_Relative tv;
+
+  FD_ZERO (&rs);
+  FD_ZERO (&ws);
+  FD_ZERO (&es);
+  max = -1;
+  if (MHD_YES != MHD_get_fdset (httpd, &rs, &ws, &es, &max))
+  {
+    kill_httpd ();
+    return;
+  }
+  haveto = MHD_get_timeout (httpd, &timeout);
+  if (MHD_YES == haveto)
+    tv.rel_value_us = (uint64_t) timeout * 1000LL;
+  else
+    tv = GNUNET_TIME_UNIT_FOREVER_REL;
+  if (-1 != max)
+  {
+    wrs = GNUNET_NETWORK_fdset_create ();
+    wws = GNUNET_NETWORK_fdset_create ();
+    GNUNET_NETWORK_fdset_copy_native (wrs, &rs, max + 1);
+    GNUNET_NETWORK_fdset_copy_native (wws, &ws, max + 1);
+  }
+  else
+  {
+    wrs = NULL;
+    wws = NULL;
+  }
+  if (NULL != httpd_task)
+  {
+    GNUNET_SCHEDULER_cancel (httpd_task);
+    httpd_task = NULL;
+  }
+  if ((MHD_YES == haveto) || (-1 != max))
+  {
+    httpd_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                              tv,
+                                              wrs,
+                                              wws,
+                                              &do_httpd,
+                                              NULL);
+  }
+  if (NULL != wrs)
+    GNUNET_NETWORK_fdset_destroy (wrs);
+  if (NULL != wws)
+    GNUNET_NETWORK_fdset_destroy (wws);
+}
+
+/**
+ * Function called when MHD first processes an incoming connection.
+ * Gives us the respective URI information.
+ *
+ * We use this to associate the `struct MHD_Connection` with our
+ * internal `struct AcceptedRequest` data structure (by checking
+ * for matching sockets).
+ *
+ * @param cls the HTTP server handle (a `struct MhdHttpList`)
+ * @param url the URL that is being requested
+ * @param connection MHD connection object for the request
+ * @return the `struct Socks5Request` that this @a connection is for
+ */
+static void *
+mhd_log_callback (void *cls,
+                  const char *url,
+                  struct MHD_Connection *connection)
+{
+  struct AcceptedRequest *ar;
+  const union MHD_ConnectionInfo *ci;
+
+  ci = MHD_get_connection_info (connection,
+                                MHD_CONNECTION_INFO_SOCKET_CONTEXT);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Processing %s\n", url);
+  if (NULL == ci)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  ar = ci->socket_context;
+  return ar;
+}
+
+
+
+/**
+ * Function called when MHD decides that we are done with a connection.
+ *
+ * @param cls NULL
+ * @param connection connection handle
+ * @param con_cls value as set by the last call to
+ *        the MHD_AccessHandlerCallback, should be our handle
+ * @param toe reason for request termination (ignored)
+ */
+static void
+mhd_completed_cb (void *cls,
+                  struct MHD_Connection *connection,
+                  void **con_cls,
+                  enum MHD_RequestTerminationCode toe)
+{
+  struct AcceptedRequest *ar = *con_cls;
+  if (MHD_REQUEST_TERMINATED_COMPLETED_OK != toe)
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "MHD encountered error handling request: %d\n",
+                toe);
+  if (NULL == ar)
+    return;
+  if (NULL != ar->con_handle)
+  {
+    cleanup_handle (ar->con_handle);
+    ar->con_handle = NULL;
+  }
+  ar->socket_with_mhd = GNUNET_YES;
+  *con_cls = NULL;
+}
+
+/**
+ * Function called when MHD connection is opened or closed.
+ *
+ * @param cls NULL
+ * @param connection connection handle
+ * @param con_cls value as set by the last call to
+ *        the MHD_AccessHandlerCallback, should be our `struct Socks5Request *`
+ * @param toe connection notification type
+ */
+static void
+mhd_connection_cb (void *cls,
+                   struct MHD_Connection *connection,
+                   void **con_cls,
+                   enum MHD_ConnectionNotificationCode cnc)
+{
+  struct AcceptedRequest *ar;
+  const union MHD_ConnectionInfo *ci;
+  int sock;
+
+  switch (cnc)
+  {
+  case MHD_CONNECTION_NOTIFY_STARTED:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connection started...\n");
+    ci = MHD_get_connection_info (connection,
+                                  MHD_CONNECTION_INFO_CONNECTION_FD);
+    if (NULL == ci)
+    {
+      GNUNET_break (0);
+      return;
+    }
+    sock = ci->connect_fd;
+    for (ar = req_list_head; NULL != ar; ar = ar->next)
+    {
+      if (GNUNET_NETWORK_get_fd (ar->sock) == sock)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "Context set...\n");
+        *con_cls = ar;
+        break;
+      }
+    }
+    break;
+
+  case MHD_CONNECTION_NOTIFY_CLOSED:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Connection closed... cleaning up\n");
+    ar = *con_cls;
+    if (NULL == ar)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Connection stale!\n");
+      return;
+    }
+    cleanup_ar (ar);
+    *con_cls = NULL;
+    break;
+
+  default:
+    GNUNET_break (0);
+  }
+}
+
+
+
+/**
+ * Task run whenever HTTP server operations are pending.
+ *
+ * @param cls NULL
+ */
+static void
+do_httpd (void *cls)
+{
+  httpd_task = NULL;
+  MHD_run (httpd);
+  schedule_httpd ();
+}
+
+
+/**
+ * Accept new incoming connections
+ *
+ * @param cls the closure with the lsock4 or lsock6
+ */
+static void
+do_accept (void *cls)
+{
+  struct GNUNET_NETWORK_Handle *lsock = cls;
+  struct AcceptedRequest *ar;
+  int fd;
+  const struct sockaddr *addr;
+  socklen_t len;
+
+  GNUNET_assert (NULL != lsock);
+  if (lsock == lsock4)
+  {
+    ltask4 = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                            lsock,
+                                            &do_accept,
+                                            lsock);
+  }
+  else if (lsock == lsock6)
+  {
+    ltask6 = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                            lsock,
+                                            &do_accept,
+                                            lsock);
+  }
+  else
+    GNUNET_assert (0);
+  ar = GNUNET_new (struct AcceptedRequest);
+  ar->socket_with_mhd = GNUNET_YES;
+  ar->sock = GNUNET_NETWORK_socket_accept (lsock, NULL, NULL);
+  if (NULL == ar->sock)
+  {
+    GNUNET_free (ar);
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "accept");
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got an inbound connection, waiting for data\n");
+  fd = GNUNET_NETWORK_get_fd (ar->sock);
+  addr = GNUNET_NETWORK_get_addr (ar->sock);
+  len = GNUNET_NETWORK_get_addrlen (ar->sock);
+  GNUNET_CONTAINER_DLL_insert (req_list_head,
+                               req_list_tail,
+                               ar);
+  if (MHD_YES != MHD_add_connection (httpd, fd, addr, len))
+  {
+    GNUNET_NETWORK_socket_close (ar->sock);
+    GNUNET_free (ar);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Failed to pass client to MHD\n"));
+    return;
+  }
+  schedule_httpd ();
+}
+
+
+/**
+ * Task run on shutdown
+ *
+ * @param cls closure
+ */
+static void
+do_shutdown (void *cls)
+{
+  struct PluginListEntry *ple;
+
+  while (NULL != plugins_head)
+  {
+    ple = plugins_head;
+    GNUNET_CONTAINER_DLL_remove (plugins_head,
+                                 plugins_tail,
+                                 ple);
+    GNUNET_PLUGIN_unload (ple->libname, ple->plugin);
+    GNUNET_free (ple->libname);
+    GNUNET_free (ple);
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Shutting down...\n");
+  kill_httpd ();
+  GNUNET_free (allow_credentials);
+  GNUNET_free (allow_headers);
+}
+
+
+/**
+ * Create an IPv4 listen socket bound to our port.
+ *
+ * @return NULL on error
+ */
+static struct GNUNET_NETWORK_Handle *
+bind_v4 ()
+{
+  struct GNUNET_NETWORK_Handle *ls;
+  struct sockaddr_in sa4;
+  int eno;
+
+  memset (&sa4, 0, sizeof(sa4));
+  sa4.sin_family = AF_INET;
+  sa4.sin_port = htons (port);
+  sa4.sin_addr.s_addr = address;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  sa4.sin_len = sizeof(sa4);
+#endif
+  ls = GNUNET_NETWORK_socket_create (AF_INET, SOCK_STREAM, 0);
+  if (NULL == ls)
+    return NULL;
+  if (GNUNET_OK != GNUNET_NETWORK_socket_bind (ls,
+                                               (const struct sockaddr *) &sa4,
+                                               sizeof(sa4)))
+  {
+    eno = errno;
+    GNUNET_NETWORK_socket_close (ls);
+    errno = eno;
+    return NULL;
+  }
+  return ls;
+}
+
+
+/**
+ * Create an IPv6 listen socket bound to our port.
+ *
+ * @return NULL on error
+ */
+static struct GNUNET_NETWORK_Handle *
+bind_v6 ()
+{
+  struct GNUNET_NETWORK_Handle *ls;
+  struct sockaddr_in6 sa6;
+  int eno;
+
+  memset (&sa6, 0, sizeof(sa6));
+  sa6.sin6_family = AF_INET6;
+  sa6.sin6_port = htons (port);
+  sa6.sin6_addr = address6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+  sa6.sin6_len = sizeof(sa6);
+#endif
+  ls = GNUNET_NETWORK_socket_create (AF_INET6, SOCK_STREAM, 0);
+  if (NULL == ls)
+    return NULL;
+  if (GNUNET_OK != GNUNET_NETWORK_socket_bind (ls,
+                                               (const struct sockaddr *) &sa6,
+                                               sizeof(sa6)))
+  {
+    eno = errno;
+    GNUNET_NETWORK_socket_close (ls);
+    errno = eno;
+    return NULL;
+  }
+  return ls;
+}
+
+
+/**
+ * Callback for plugin load
+ *
+ * @param cls NULL
+ * @param libname the name of the library loaded
+ * @param lib_ret the object returned by the plugin initializer
+ */
+static void
+load_plugin (void *cls, const char *libname, void *lib_ret)
+{
+  struct GNUNET_REST_Plugin *plugin = lib_ret;
+  struct PluginListEntry *ple;
+
+  if (NULL == lib_ret)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Could not load plugin `%s'\n",
+                libname);
+    return;
+  }
+  GNUNET_assert (1 < strlen (plugin->name));
+  GNUNET_assert ('/' == *plugin->name);
+  ple = GNUNET_new (struct PluginListEntry);
+  ple->libname = GNUNET_strdup (libname);
+  ple->plugin = plugin;
+  GNUNET_CONTAINER_DLL_insert (plugins_head,
+                               plugins_tail,
+                               ple);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Loaded plugin `%s'\n", libname);
+}
+
+
+/**
+ * Main function that will be run
+ *
+ * @param cls closure
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL)
+ * @param c configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  char *addr_str;
+  char *basic_auth_file;
+  uint64_t secret;
+
+  cfg = c;
+  plugins_head = NULL;
+  plugins_tail = NULL;
+  /* Get port to bind to */
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (cfg, "rest", "HTTP_PORT", &port))
+  {
+    // No address specified
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Using default port...\n");
+    port = GNUNET_REST_SERVICE_PORT;
+  }
+
+  /* Get address to bind to */
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg, "rest", "BIND_TO", &addr_str))
+  {
+    // No address specified
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Don't know what to bind to...\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (1 != inet_pton (AF_INET, addr_str, &address))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse address %s\n",
+                addr_str);
+    GNUNET_free (addr_str);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_free (addr_str);
+  /* Get address to bind to */
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          "rest",
+                                                          "BIND_TO6",
+                                                          &addr_str))
+  {
+    // No address specified
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Don't know what to bind6 to...\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (1 != inet_pton (AF_INET6, addr_str, &address6))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse IPv6 address %s\n",
+                addr_str);
+    GNUNET_free (addr_str);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_free (addr_str);
+
+  basic_auth_enabled = GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                                             "rest",
+                                                             "BASIC_AUTH_ENABLED");
+  if (basic_auth_enabled)
+  {
+    if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                              "rest",
+                                                              "BASIC_AUTH_SECRET_FILE",
+                                                              &basic_auth_file))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "No basic auth secret file location set...\n");
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    if (GNUNET_YES != GNUNET_DISK_file_test (basic_auth_file))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "No basic auth secret found... generating\n");
+      secret = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                         UINT64_MAX);
+      basic_auth_secret = GNUNET_STRINGS_data_to_string_alloc (&secret,
+                                                               sizeof(secret));
+      if (GNUNET_OK !=
+          GNUNET_DISK_fn_write (basic_auth_file,
+                                basic_auth_secret,
+                                strlen (basic_auth_secret),
+                                GNUNET_DISK_PERM_USER_READ
+                                | GNUNET_DISK_PERM_USER_WRITE))
+        GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                                  "write",
+                                  basic_auth_file);
+      GNUNET_free (basic_auth_file);
+    }
+    else
+    {
+      char basic_auth_secret_tmp[16]; // Should be more than enough
+      memset (basic_auth_secret_tmp, 0, 16);
+      if (GNUNET_SYSERR == GNUNET_DISK_fn_read (basic_auth_file,
+                                                basic_auth_secret_tmp,
+                                                sizeof (basic_auth_secret_tmp) - 1))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Unable to read basic auth secret file.\n");
+        GNUNET_SCHEDULER_shutdown ();
+        GNUNET_free (basic_auth_file);
+        return;
+      }
+      GNUNET_free (basic_auth_file);
+      if (0 != getlogin_r (cuser, _POSIX_LOGIN_NAME_MAX))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Unable to get user.\n");
+        GNUNET_SCHEDULER_shutdown ();
+        return;
+      }
+      basic_auth_secret = GNUNET_strdup (basic_auth_secret_tmp);
+    }
+  }
+
+  /* Get CORS data from cfg */
+  echo_origin =
+    GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                          "rest",
+                                          "REST_ECHO_ORIGIN_WEBEXT");
+  allow_origins = NULL;
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          "rest",
+                                                          "REST_ALLOW_ORIGIN",
+                                                          &allow_origins))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "No CORS Access-Control-Allow-Origin header will be sent...\n");
+  }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             "rest",
+                                             "REST_ALLOW_CREDENTIALS",
+                                             &allow_credentials))
+  {
+    // No origin specified
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "No CORS Credential Header will be sent...\n");
+  }
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                          "rest",
+                                                          "REST_ALLOW_HEADERS",
+                                                          &allow_headers))
+  {
+    // No origin specified
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "No CORS Access-Control-Allow-Headers Header will be sent...\n");
+  }
+
+/* Open listen socket proxy */
+  lsock6 = bind_v6 ();
+  if (NULL == lsock6)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "bind");
+  }
+  else
+  {
+    if (GNUNET_OK != GNUNET_NETWORK_socket_listen (lsock6, 5))
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "listen");
+      GNUNET_NETWORK_socket_close (lsock6);
+      lsock6 = NULL;
+    }
+    else
+    {
+      ltask6 = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                              lsock6,
+                                              &do_accept,
+                                              lsock6);
+    }
+  }
+  lsock4 = bind_v4 ();
+  if (NULL == lsock4)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "bind");
+  }
+  else
+  {
+    if (GNUNET_OK != GNUNET_NETWORK_socket_listen (lsock4, 5))
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "listen");
+      GNUNET_NETWORK_socket_close (lsock4);
+      lsock4 = NULL;
+    }
+    else
+    {
+      ltask4 = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                              lsock4,
+                                              &do_accept,
+                                              lsock4);
+    }
+  }
+  if ((NULL == lsock4) && (NULL == lsock6))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Service listens on port %llu\n",
+              port);
+  httpd = MHD_start_daemon (MHD_USE_DEBUG | MHD_USE_NO_LISTEN_SOCKET
+                            | MHD_ALLOW_SUSPEND_RESUME,
+                            0,
+                            NULL,
+                            NULL,
+                            &create_response,
+                            NULL,
+                            MHD_OPTION_CONNECTION_TIMEOUT,
+                            (unsigned int) 16,
+                            MHD_OPTION_NOTIFY_CONNECTION,
+                            &mhd_connection_cb,
+                            NULL,
+                            MHD_OPTION_URI_LOG_CALLBACK,
+                            mhd_log_callback,
+                            NULL,
+                            MHD_OPTION_NOTIFY_COMPLETED,
+                            &mhd_completed_cb,
+                            NULL,
+                            MHD_OPTION_END);
+  if (NULL == httpd)
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+/* Load plugins */
+  GNUNET_PLUGIN_load_all_in_context (GNUNET_OS_project_data_default (),
+                                     "libgnunet_plugin_rest",
+                                     (void *) cfg,
+                                     &load_plugin,
+                                     NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown, NULL);
+}
+
+
+/**
+ *
+ * The main function for gnunet-rest-service
+ *
+ * @param argc number of arguments from the cli
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ *
+ */
+int
+main (int argc, char *const *argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] =
+  { GNUNET_GETOPT_OPTION_END };
+  static const char *err_page = "{}";
+  int ret;
+
+  if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv, &argc, &argv))
+    return 2;
+  GNUNET_log_setup ("gnunet-rest-server", "WARNING", NULL);
+  failure_response = MHD_create_response_from_buffer (strlen (err_page),
+                                                      (void *) err_page,
+                                                      MHD_RESPMEM_PERSISTENT);
+  ret = (GNUNET_OK == GNUNET_PROGRAM_run (argc,
+                                          argv,
+                                          "gnunet-rest-server",
+                                          _ ("GNUnet REST server"),
+                                          options,
+                                          &run,
+                                          NULL))
+        ? 0
+        : 1;
+  MHD_destroy_response (failure_response);
+  GNUNET_free_nz ((char *) argv);
+  return ret;
+}
+
+
+/* end of gnunet-rest-server.c */
diff --git a/src/service/rest/meson.build b/src/service/rest/meson.build
new file mode 100644
index 000000000..2dd3d8de4
--- /dev/null
+++ b/src/service/rest/meson.build
@@ -0,0 +1,58 @@
+libgnunetrest_src = ['rest.c']
+
+gnunetservicerest_src = ['gnunet-rest-server.c']
+
+configure_file(input : 'rest.conf',
+               output : 'rest.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+
+if get_option('monolith')
+  foreach p : libgnunetrest_src + gnunetservicerest_src
+    gnunet_src += 'rest/' + p
+  endforeach
+  subdir_done()
+endif
+
+
+libgnunetrest = library('gnunetrest',
+        libgnunetrest_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep, mhd_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+pkg.generate(libgnunetrest, url: 'https://www.gnunet.org',
+             description : 'Provides API for accessing the REST service')
+libgnunetrest_dep = declare_dependency(link_with : libgnunetrest)
+
+shared_module('gnunet_plugin_rest_config',
+              ['plugin_rest_config.c'],
+              dependencies: [libgnunetrest_dep,
+                             libgnunetutil_dep,
+                             json_dep,
+                             mhd_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir') / 'gnunet')
+shared_module('gnunet_plugin_rest_copying',
+              ['plugin_rest_copying.c'],
+              dependencies: [libgnunetrest_dep,
+                             libgnunetutil_dep,
+                             json_dep,
+                             mhd_dep],
+              include_directories: [incdir, configuration_inc],
+              install: true,
+              install_dir: get_option('libdir') / 'gnunet')
+
+
+executable ('gnunet-rest-server',
+            gnunetservicerest_src,
+            dependencies: [libgnunetrest_dep, libgnunetutil_dep, mhd_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir') / 'gnunet' / 'libexec')
+
diff --git a/src/service/rest/rest.c b/src/service/rest/rest.c
new file mode 100644
index 000000000..757c0b979
--- /dev/null
+++ b/src/service/rest/rest.c
@@ -0,0 +1,99 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2010-2015 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file rest/rest.c
+ * @brief helper library to create JSON REST Objects and handle REST
+ * responses/requests.
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_rest_lib.h"
+#include "microhttpd.h"
+
+/**
+ * REST Utilities
+ */
+
+int
+GNUNET_REST_namespace_match (const char *url, const char *namespace)
+{
+  return 0 == strncmp (namespace, url, strlen (namespace));
+}
+
+
+struct MHD_Response*
+GNUNET_REST_create_response (const char *data)
+{
+  struct MHD_Response *resp;
+  size_t len;
+
+  if (NULL == data)
+  {
+    len = 0;
+    data = "";
+  }
+  else
+    len = strlen (data);
+  resp = MHD_create_response_from_buffer (len,
+                                          (void *) data,
+                                          MHD_RESPMEM_MUST_COPY);
+  return resp;
+}
+
+
+int
+GNUNET_REST_handle_request (struct GNUNET_REST_RequestHandle *conn,
+                            const struct GNUNET_REST_RequestHandler *handlers,
+                            struct GNUNET_REST_RequestHandlerError *err,
+                            void *cls)
+{
+  int count;
+  int i;
+  char *url;
+
+  count = 0;
+  while (NULL != handlers[count].method)
+    count++;
+
+  GNUNET_asprintf (&url, "%s", conn->url);
+  if (url[strlen (url) - 1] == '/')
+    url[strlen (url) - 1] = '\0';
+  for (i = 0; i < count; i++)
+  {
+    if (0 != strcasecmp (conn->method, handlers[i].method))
+      continue;
+    if (strlen (url) < strlen (handlers[i].namespace))
+      continue;
+    if (GNUNET_NO == GNUNET_REST_namespace_match (url, handlers[i].namespace))
+      continue;
+    // Match
+    handlers[i].proc (conn, (const char *) url, cls);
+    GNUNET_free (url);
+    return GNUNET_YES;
+  }
+  GNUNET_free (url);
+  err->error_code = MHD_HTTP_BAD_REQUEST;
+  return GNUNET_NO;
+}
+
+
+/* end of rest.c */
diff --git a/src/service/rest/rest.conf b/src/service/rest/rest.conf
new file mode 100644
index 000000000..85c006c9b
--- /dev/null
+++ b/src/service/rest/rest.conf
@@ -0,0 +1,14 @@
+[rest]
+UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-rest.sock
+BINARY=gnunet-rest-server
+IMMEDIATE_START=YES
+HTTP_PORT=7776
+BIND_TO=127.0.0.1
+BIND_TO6=::1
+REST_ALLOW_HEADERS=Authorization,Accept,Content-Type
+REST_ECHO_ORIGIN_WEBEXT=YES
+REST_ALLOW_ORIGIN=http://localhost:4200
+REST_ALLOW_CREDENTIALS=true
+RUN_PER_USER=NO
+BASIC_AUTH_SECRET_FILE=$GNUNET_DATA_HOME/rest/secret
+BASIC_AUTH_ENABLED=YES