92 files changed, 13451 insertions, 12010 deletions

diff --git a/src/service/Makefile.am b/src/service/Makefile.am
index 8e661e432..041442725 100644
--- a/src/service/Makefile.am
+++ b/src/service/Makefile.am
@@ -13,9 +13,9 @@ SUBDIRS = \
   topology \
   dns \
         identity \
-        rest \
         datacache \
         datastore \
+        dhtu \
         dht \
   namecache \
   namestore \
@@ -31,5 +31,6 @@ SUBDIRS = \
         exit \
         pt \
         reclaim \
-        messenger
+        messenger \
+        rest
 
diff --git a/src/service/datacache/Makefile.am b/src/service/datacache/Makefile.am
index 9caeac543..022b45253 100644
--- a/src/service/datacache/Makefile.am
+++ b/src/service/datacache/Makefile.am
@@ -8,25 +8,11 @@ pkgcfgdir= $(pkgdatadir)/config.d/
 dist_pkgcfg_DATA = \
   datacache.conf
 
-sqldir = $(prefix)/share/gnunet/sql/
-
-sql_DATA = \
-  datacache-0001.sql \
-  datacache-drop.sql
-
-
 if USE_COVERAGE
   AM_CFLAGS = --coverage -O0
   XLIBS = -lgcov
 endif
 
-if HAVE_SQLITE
-  SQLITE_PLUGIN = libgnunet_plugin_datacache_sqlite.la
-endif
-if HAVE_POSTGRESQL
-  POSTGRES_PLUGIN = libgnunet_plugin_datacache_postgres.la
-endif
-
 lib_LTLIBRARIES = \
   libgnunetdatacache.la
 
@@ -41,57 +27,6 @@ libgnunetdatacache_la_LDFLAGS = \
   -version-info 0:1:0
 
 
-plugin_LTLIBRARIES = \
-  $(SQLITE_PLUGIN) \
-  $(POSTGRES_PLUGIN) \
-  libgnunet_plugin_datacache_heap.la
-
-# Real plugins should of course go into
-# plugin_LTLIBRARIES
-noinst_LTLIBRARIES = \
-  libgnunet_plugin_datacache_template.la
-
-
-libgnunet_plugin_datacache_sqlite_la_SOURCES = \
-  plugin_datacache_sqlite.c
-libgnunet_plugin_datacache_sqlite_la_LIBADD = \
-  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/lib/sq/libgnunetsq.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
-  $(LTLIBINTL)
-libgnunet_plugin_datacache_sqlite_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-libgnunet_plugin_datacache_heap_la_SOURCES = \
-  plugin_datacache_heap.c
-libgnunet_plugin_datacache_heap_la_LIBADD = \
-  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
-  $(LTLIBINTL)
-libgnunet_plugin_datacache_heap_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-libgnunet_plugin_datacache_postgres_la_SOURCES = \
-  plugin_datacache_postgres.c
-libgnunet_plugin_datacache_postgres_la_LIBADD = \
-  $(top_builddir)/src/lib/pq/libgnunetpq.la \
-  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(GN_PLUGIN_LDFLAGS) -lpq
-libgnunet_plugin_datacache_postgres_la_CPPFLAGS = \
- $(POSTGRESQL_CPPFLAGS) $(AM_CPPFLAGS)
-libgnunet_plugin_datacache_postgres_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
-
-libgnunet_plugin_datacache_template_la_SOURCES = \
-  plugin_datacache_template.c
-libgnunet_plugin_datacache_template_la_LIBADD = \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
-  $(LTLIBINTL)
-libgnunet_plugin_datacache_template_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
 if HAVE_SQLITE
 SQLITE_TESTS = \
  test_datacache_sqlite \
@@ -166,5 +101,4 @@ test_datacache_quota_postgres_LDADD = \
 EXTRA_DIST = \
  test_datacache_data_sqlite.conf \
  test_datacache_data_heap.conf \
- test_datacache_data_postgres.conf \
- $(sql_DATA)
+ test_datacache_data_postgres.conf
diff --git a/src/service/datacache/datacache-0001.sql b/src/service/datacache/datacache-0001.sql
deleted file mode 100644
index 6567de3c2..000000000
--- a/src/service/datacache/datacache-0001.sql
+++ /dev/null
@@ -1,48 +0,0 @@
---
--- This file is part of GNUnet
--- Copyright (C) 2014--2022 GNUnet e.V.
---
--- GNUnet is free software; you can redistribute it and/or modify it under the
--- terms of the GNU General Public License as published by the Free Software
--- Foundation; either version 3, or (at your option) any later version.
---
--- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
--- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
--- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
---
--- You should have received a copy of the GNU General Public License along with
--- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
---
-
--- Everything in one big transaction
-BEGIN;
-
--- Check patch versioning is in place.
-SELECT _v.register_patch('datacache-0001', NULL, NULL);
-
--------------------- Schema ----------------------------
-
-CREATE SCHEMA datacache;
-COMMENT ON SCHEMA datacache IS 'gnunet-datacache data';
-
-SET search_path TO datacache;
-
-CREATE TABLE IF NOT EXISTS gn180dc (
-  oid BIGINT GENERATED BY DEFAULT AS IDENTITY,
-  type INT4 NOT NULL,
-  ro INT4 NOT NULL,
-  prox INT4 NOT NULL,
-  expiration_time INT8 NOT NULL,
-  key BYTEA NOT NULL CHECK(LENGTH(key)=64),
-  trunc BYTEA NOT NULL CHECK(LENGTH(trunc)=32),
-  value BYTEA NOT NULL,
-  path BYTEA DEFAULT NULL);
-
-CREATE INDEX IF NOT EXISTS idx_oid
-  ON gn180dc (oid);
-CREATE INDEX IF NOT EXISTS idx_key
-  ON gn180dc (key);
-CREATE INDEX IF NOT EXISTS idx_dt
-  ON gn180dc (expiration_time);
-
-COMMIT;
diff --git a/src/service/datacache/datacache-drop.sql b/src/service/datacache/datacache-drop.sql
deleted file mode 100644
index 2dd84bca8..000000000
--- a/src/service/datacache/datacache-drop.sql
+++ /dev/null
@@ -1,25 +0,0 @@
---
--- This file is part of GNUnet
--- Copyright (C) 2014--2022 GNUnet e.V.
---
--- GNUnet is free software; you can redistribute it and/or modify it under the
--- terms of the GNU General Public License as published by the Free Software
--- Foundation; either version 3, or (at your option) any later version.
---
--- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
--- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
--- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
---
--- You should have received a copy of the GNU General Public License along with
--- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
---
-
--- Everything in one big transaction
-BEGIN;
-
-
-SELECT _v.unregister_patch('datacache-0001');
-
-DROP SCHEMA datacache CASCADE;
-
-COMMIT;
diff --git a/src/service/datacache/meson.build b/src/service/datacache/meson.build
index 528885c0d..f50036c03 100644
--- a/src/service/datacache/meson.build
+++ b/src/service/datacache/meson.build
@@ -5,9 +5,6 @@ configure_file(input : 'datacache.conf',
                configuration : cdata,
                install: true,
                install_dir: pkgcfgdir)
-install_data ('datacache-0001.sql',
-              'datacache-drop.sql',
-               install_dir: get_option('datadir')/'gnunet'/'sql')
 
 if get_option('monolith')
   foreach p : libgnunetdatacache_src
@@ -27,36 +24,6 @@ libgnunetdatacache_dep = declare_dependency(link_with : libgnunetdatacache)
 pkg.generate(libgnunetdatacache, url: 'https://www.gnunet.org',
              description : 'Provides datacache API for temporary storage to disk')
 
-shared_module('gnunet_plugin_datacache_sqlite',
-        ['plugin_datacache_sqlite.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetdatacache_dep,
-                       sqlite_dep,
-                       libgnunetsq_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
-shared_module('gnunet_plugin_datacache_heap',
-        ['plugin_datacache_heap.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetdatacache_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
-if pq_dep.found()
-  shared_module('gnunet_plugin_datacache_postgres',
-          ['plugin_datacache_postgres.c'],
-          dependencies: [libgnunetutil_dep,
-                         libgnunetdatacache_dep,
-                         pq_dep,
-                         libgnunetpq_dep],
-          include_directories: [incdir, configuration_inc],
-          install: true,
-          install_dir: get_option('libdir')/'gnunet')
-endif
-
 testdc_sqlite = executable ('test_datacache_sqlite',
             ['test_datacache.c'],
             dependencies: [
diff --git a/src/service/datacache/plugin_datacache_heap.c b/src/service/datacache/plugin_datacache_heap.c
deleted file mode 100644
index 0dd8e47f8..000000000
--- a/src/service/datacache/plugin_datacache_heap.c
+++ /dev/null
@@ -1,530 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2012, 2015, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datacache/plugin_datacache_heap.c
- * @brief heap-only implementation of a database backend for the datacache
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_datacache_plugin.h"
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-heap", __VA_ARGS__)
-
-#define LOG_STRERROR_FILE(kind, op, fn) GNUNET_log_from_strerror_file (kind, \
-                                                                       "datacache-heap", \
-                                                                       op, fn)
-
-#define NUM_HEAPS 24
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATACACHE_PluginEnvironment *env;
-
-  /**
-   * Our hash map.
-   */
-  struct GNUNET_CONTAINER_MultiHashMap *map;
-
-  /**
-   * Heaps sorted by distance.
-   */
-  struct GNUNET_CONTAINER_Heap *heaps[NUM_HEAPS];
-};
-
-
-/**
- * Entry in the hash map.
- */
-struct Value
-{
-  /**
-   * Block data.
-   */
-  struct GNUNET_DATACACHE_Block block;
-
-  /**
-   * Corresponding node in the heap.
-   */
-  struct GNUNET_CONTAINER_HeapNode *hn;
-
-  /**
-   * Put path as a non-const pointer.
-   */
-  struct GNUNET_DHT_PathElement *put_path;
-
-  /**
-   * How close is the hash to us? Determines which heap we are in!
-   */
-  uint32_t distance;
-
-};
-
-
-#define OVERHEAD (sizeof(struct Value) + 64)
-
-
-/**
- * Closure for #put_cb().
- */
-struct PutContext
-{
-  /**
-   * Block data.
-   */
-  const struct GNUNET_DATACACHE_Block *block;
-
-  /**
-   * Value to set to true if an equivalent block was found.
-   */
-  bool found;
-};
-
-
-/**
- * Function called during PUT to detect if an equivalent block
- * already exists.
- *
- * @param cls the `struct PutContext`
- * @param key the key for the value(s)
- * @param value an existing value
- * @return #GNUNET_YES if not found (to continue to iterate)
- */
-static enum GNUNET_GenericReturnValue
-put_cb (void *cls,
-        const struct GNUNET_HashCode *key,
-        void *value)
-{
-  struct PutContext *put_ctx = cls;
-  struct Value *val = value;
-
-  if ((val->block.data_size == put_ctx->block->data_size) &&
-      (val->block.type == put_ctx->block->type) &&
-      (0 == memcmp (val->block.data,
-                    put_ctx->block->data,
-                    put_ctx->block->data_size)))
-  {
-    put_ctx->found = true;
-    val->block.expiration_time
-      = GNUNET_TIME_absolute_max (val->block.expiration_time,
-                                  put_ctx->block->expiration_time);
-    /* replace old path with new path */
-    GNUNET_free (val->put_path);
-    val->put_path = GNUNET_memdup (put_ctx->block->put_path,
-                                   put_ctx->block->put_path_length
-                                   * sizeof (struct GNUNET_DHT_PathElement));
-    val->block.put_path = val->put_path;
-    val->block.put_path_length = put_ctx->block->put_path_length;
-    GNUNET_CONTAINER_heap_update_cost (val->hn,
-                                       val->block.expiration_time.abs_value_us);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Got same value for key %s and type %u (size %u vs %u)\n",
-                GNUNET_h2s (key),
-                (unsigned int) val->block.type,
-                (unsigned int) val->block.data_size,
-                (unsigned int) put_ctx->block->data_size);
-    return GNUNET_NO;
-  }
-  return GNUNET_YES;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param xor_distance how close is @a key to our PID?
- * @param block data to store
- * @return 0 if duplicate, -1 on error, number of bytes used otherwise
- */
-static ssize_t
-heap_plugin_put (void *cls,
-                 uint32_t xor_distance,
-                 const struct GNUNET_DATACACHE_Block *block)
-{
-  struct Plugin *plugin = cls;
-  struct Value *val;
-  struct PutContext put_ctx = {
-    .block = block,
-    .found = false
-  };
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Storing %u bytes under key %s with path length %u\n",
-              (unsigned int) block->data_size,
-              GNUNET_h2s (&block->key),
-              block->put_path_length);
-  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
-                                              &block->key,
-                                              &put_cb,
-                                              &put_ctx);
-  if (GNUNET_YES == put_ctx.found)
-    return 0;
-  val = GNUNET_malloc (sizeof(struct Value)
-                       + block->data_size);
-  GNUNET_memcpy (&val[1],
-                 block->data,
-                 block->data_size);
-  val->block = *block;
-  val->block.data = &val[1];
-  if (xor_distance >= NUM_HEAPS)
-    val->distance = NUM_HEAPS - 1;
-  else
-    val->distance = xor_distance;
-  if (0 != block->put_path_length)
-  {
-    val->put_path
-      = GNUNET_memdup (block->put_path,
-                       block->put_path_length
-                       * sizeof (struct GNUNET_DHT_PathElement));
-    val->block.put_path = val->put_path;
-  }
-  (void) GNUNET_CONTAINER_multihashmap_put (plugin->map,
-                                            &val->block.key,
-                                            val,
-                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-  val->hn = GNUNET_CONTAINER_heap_insert (
-    plugin->heaps[val->distance],
-    val,
-    val->block.expiration_time.abs_value_us);
-  return val->block.data_size + OVERHEAD;
-}
-
-
-/**
- * Closure for #get_cb().
- */
-struct GetContext
-{
-  /**
-   * Function to call for each result.
-   */
-  GNUNET_DATACACHE_Iterator iter;
-
-  /**
-   * Closure for @e iter.
-   */
-  void *iter_cls;
-
-  /**
-   * Number of results found.
-   */
-  unsigned int cnt;
-
-  /**
-   * Block type requested.
-   */
-  enum GNUNET_BLOCK_Type type;
-};
-
-
-/**
- * Function called during GET to find matching blocks.
- * Only matches by type.
- *
- * @param cls the `struct GetContext`
- * @param key the key for the value(s)
- * @param value an existing value
- * @return #GNUNET_YES to continue to iterate
- */
-static enum GNUNET_GenericReturnValue
-get_cb (void *cls,
-        const struct GNUNET_HashCode *key,
-        void *value)
-{
-  struct GetContext *get_ctx = cls;
-  struct Value *val = value;
-  enum GNUNET_GenericReturnValue ret;
-
-  if ( (get_ctx->type != val->block.type) &&
-       (GNUNET_BLOCK_TYPE_ANY != get_ctx->type) )
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Result for key %s does not match block type %d\n",
-                GNUNET_h2s (key),
-                get_ctx->type);
-    return GNUNET_OK;
-  }
-  if (GNUNET_TIME_absolute_is_past (val->block.expiration_time))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Result for key %s is expired\n",
-                GNUNET_h2s (key));
-    return GNUNET_OK;
-  }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Found result for key %s\n",
-              GNUNET_h2s (key));
-  if (NULL != get_ctx->iter)
-    ret = get_ctx->iter (get_ctx->iter_cls,
-                         &val->block);
-  else
-    ret = GNUNET_YES;
-  get_ctx->cnt++;
-  return ret;
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-heap_plugin_get (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 enum GNUNET_BLOCK_Type type,
-                 GNUNET_DATACACHE_Iterator iter,
-                 void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GetContext get_ctx;
-
-  get_ctx.type = type;
-  get_ctx.iter = iter;
-  get_ctx.iter_cls = iter_cls;
-  get_ctx.cnt = 0;
-  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
-                                              key,
-                                              &get_cb,
-                                              &get_ctx);
-  return get_ctx.cnt;
-}
-
-
-/**
- * Delete the entry with the lowest expiration value
- * from the datacache right now.
- *
- * @param cls closure (our `struct Plugin`)
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-heap_plugin_del (void *cls)
-{
-  struct Plugin *plugin = cls;
-  struct Value *val;
-
-  for (unsigned int i = 0; i < NUM_HEAPS; i++)
-  {
-    val = GNUNET_CONTAINER_heap_remove_root (plugin->heaps[i]);
-    if (NULL != val)
-      break;
-  }
-  if (NULL == val)
-    return GNUNET_SYSERR;
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CONTAINER_multihashmap_remove (plugin->map,
-                                                       &val->block.key,
-                                                       val));
-  plugin->env->delete_notify (plugin->env->cls,
-                              &val->block.key,
-                              val->block.data_size + OVERHEAD);
-  GNUNET_free (val->put_path);
-  GNUNET_free (val);
-  return GNUNET_OK;
-}
-
-
-/**
- * Closure for #find_closest().
- */
-struct GetClosestContext
-{
-  struct Value **values;
-
-  const struct GNUNET_HashCode *key;
-
-  enum GNUNET_BLOCK_Type type;
-
-  unsigned int num_results;
-
-};
-
-
-static enum GNUNET_GenericReturnValue
-find_closest (void *cls,
-              const struct GNUNET_HashCode *key,
-              void *value)
-{
-  struct GetClosestContext *gcc = cls;
-  struct Value *val = value;
-  unsigned int j;
-
-  if (1 != GNUNET_CRYPTO_hash_cmp (key,
-                                   gcc->key))
-    return GNUNET_OK; /* useless */
-  if ( (val->block.type != gcc->type) &&
-       (GNUNET_BLOCK_TYPE_ANY != gcc->type) )
-    return GNUNET_OK; /* useless */
-  j = gcc->num_results;
-  for (unsigned int i = 0; i < gcc->num_results; i++)
-  {
-    if (NULL == gcc->values[i])
-    {
-      j = i;
-      break;
-    }
-    if (1 ==
-        GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->block.key,
-                                key))
-    {
-      j = i;
-      break;
-    }
-  }
-  if (j == gcc->num_results)
-    return GNUNET_OK;
-  gcc->values[j] = val;
-  return GNUNET_OK;
-}
-
-
-/**
- * Iterate over the results that are "close" to a particular key in
- * the datacache.  "close" is defined as numerically larger than @a
- * key (when interpreted as a circular address space), with small
- * distance.
- *
- * @param cls closure (internal context for the plugin)
- * @param key area of the keyspace to look into
- * @param type desired block type for the replies
- * @param num_results number of results that should be returned to @a iter
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-heap_plugin_get_closest (void *cls,
-                         const struct GNUNET_HashCode *key,
-                         enum GNUNET_BLOCK_Type type,
-                         unsigned int num_results,
-                         GNUNET_DATACACHE_Iterator iter,
-                         void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  struct Value *values[num_results];
-  struct GetClosestContext gcc = {
-    .values = values,
-    .type = type,
-    .num_results = num_results * 2,
-    .key = key
-  };
-
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->map,
-                                         &find_closest,
-                                         &gcc);
-  for (unsigned int i = 0; i < num_results * 2; i++)
-  {
-    if (NULL == values[i])
-      return i;
-    if ( (NULL != iter) &&
-         (GNUNET_SYSERR ==
-          iter (iter_cls,
-                &values[i]->block)) )
-    {
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "Ending iteration (client error)\n");
-      return i;
-    }
-  }
-  return num_results * 2;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
- * @return the plugin's closure (our `struct Plugin`)
- */
-void *
-libgnunet_plugin_datacache_heap_init (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
-  struct GNUNET_DATACACHE_PluginFunctions *api;
-  struct Plugin *plugin;
-
-  plugin = GNUNET_new (struct Plugin);
-  plugin->map = GNUNET_CONTAINER_multihashmap_create (1024,   /* FIXME: base on quota! */
-                                                      GNUNET_YES);
-  for (unsigned int i = 0; i < NUM_HEAPS; i++)
-    plugin->heaps[i] = GNUNET_CONTAINER_heap_create (
-      GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  plugin->env = env;
-  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
-  api->cls = plugin;
-  api->get = &heap_plugin_get;
-  api->put = &heap_plugin_put;
-  api->del = &heap_plugin_del;
-  api->get_closest = &heap_plugin_get_closest;
-  LOG (GNUNET_ERROR_TYPE_INFO,
-       _ ("Heap datacache running\n"));
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls closure (our "struct Plugin")
- * @return NULL
- */
-void *
-libgnunet_plugin_datacache_heap_done (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-  struct Value *val;
-
-  for (unsigned int i = 0; i < NUM_HEAPS; i++)
-  {
-    while (NULL != (val = GNUNET_CONTAINER_heap_remove_root (plugin->heaps[i])))
-    {
-      GNUNET_assert (GNUNET_YES ==
-                     GNUNET_CONTAINER_multihashmap_remove (plugin->map,
-                                                           &val->block.key,
-                                                           val));
-      GNUNET_free (val->put_path);
-      GNUNET_free (val);
-    }
-    GNUNET_CONTAINER_heap_destroy (plugin->heaps[i]);
-  }
-  GNUNET_CONTAINER_multihashmap_destroy (plugin->map);
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datacache_heap.c */
diff --git a/src/service/datacache/plugin_datacache_postgres.c b/src/service/datacache/plugin_datacache_postgres.c
deleted file mode 100644
index 8bfd04aea..000000000
--- a/src/service/datacache/plugin_datacache_postgres.c
+++ /dev/null
@@ -1,616 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datacache/plugin_datacache_postgres.c
- * @brief postgres for an implementation of a database backend for the datacache
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_pq_lib.h"
-#include "gnunet_datacache_plugin.h"
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-postgres", __VA_ARGS__)
-
-/**
- * Per-entry overhead estimate
- */
-#define OVERHEAD (sizeof(struct GNUNET_HashCode) + 24)
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATACACHE_PluginEnvironment *env;
-
-  /**
-   * Native Postgres database handle.
-   */
-  struct GNUNET_PQ_Context *dbh;
-
-  /**
-   * Number of key-value pairs in the database.
-   */
-  unsigned int num_items;
-};
-
-
-/**
- * @brief Get a database handle
- *
- * @param plugin global context
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-init_connection (struct Plugin *plugin)
-{
-  struct GNUNET_PQ_PreparedStatement ps[] = {
-    GNUNET_PQ_make_prepare ("getkt",
-                            "SELECT expiration_time,type,ro,value,trunc,path"
-                            " FROM datacache.gn180dc"
-                            " WHERE key=$1 AND type=$2 AND expiration_time >= $3"),
-    GNUNET_PQ_make_prepare ("getk",
-                            "SELECT expiration_time,type,ro,value,trunc,path"
-                            " FROM datacache.gn180dc"
-                            " WHERE key=$1 AND expiration_time >= $2"),
-    GNUNET_PQ_make_prepare ("getex",
-                            "SELECT LENGTH(value) AS len,oid,key"
-                            " FROM datacache.gn180dc"
-                            " WHERE expiration_time < $1"
-                            " ORDER BY expiration_time ASC LIMIT 1"),
-    GNUNET_PQ_make_prepare ("getm",
-                            "SELECT LENGTH(value) AS len,oid,key"
-                            " FROM datacache.gn180dc"
-                            " ORDER BY prox ASC, expiration_time ASC LIMIT 1"),
-    GNUNET_PQ_make_prepare ("get_closest",
-                            "(SELECT expiration_time,type,ro,value,trunc,path,key"
-                            " FROM datacache.gn180dc"
-                            " WHERE key >= $1"
-                            "   AND expiration_time >= $2"
-                            "   AND ( (type = $3) OR ( 0 = $3) )"
-                            " ORDER BY key ASC"
-                            " LIMIT $4)"
-                            " UNION "
-                            "(SELECT expiration_time,type,ro,value,trunc,path,key"
-                            " FROM datacache.gn180dc"
-                            " WHERE key <= $1"
-                            "   AND expiration_time >= $2"
-                            "   AND ( (type = $3) OR ( 0 = $3) )"
-                            " ORDER BY key DESC"
-                            " LIMIT $4)"),
-    GNUNET_PQ_make_prepare ("delrow",
-                            "DELETE FROM datacache.gn180dc"
-                            " WHERE oid=$1"),
-    GNUNET_PQ_make_prepare ("put",
-                            "INSERT INTO datacache.gn180dc"
-                            " (type, ro, prox, expiration_time, key, value, trunc, path) "
-                            "VALUES ($1, $2, $3, $4, $5, $6, $7, $8)"),
-    GNUNET_PQ_PREPARED_STATEMENT_END
-  };
-
-  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->env->cfg,
-                                            "datacache-postgres",
-                                            "datacache-",
-                                            NULL,
-                                            ps);
-  if (NULL == plugin->dbh)
-    return GNUNET_SYSERR;
-  return GNUNET_OK;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param prox proximity of @a key to my PID
- * @param block data to store
- * @return 0 if duplicate, -1 on error, number of bytes used otherwise
- */
-static ssize_t
-postgres_plugin_put (void *cls,
-                     uint32_t prox,
-                     const struct GNUNET_DATACACHE_Block *block)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = (uint32_t) block->type;
-  uint32_t ro32 = (uint32_t) block->type;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_uint32 (&type32),
-    GNUNET_PQ_query_param_uint32 (&ro32),
-    GNUNET_PQ_query_param_uint32 (&prox),
-    GNUNET_PQ_query_param_absolute_time (&block->expiration_time),
-    GNUNET_PQ_query_param_auto_from_type (&block->key),
-    GNUNET_PQ_query_param_fixed_size (block->data,
-                                      block->data_size),
-    GNUNET_PQ_query_param_auto_from_type (&block->trunc_peer),
-    (0 == block->put_path_length)
-    ? GNUNET_PQ_query_param_null ()
-    : GNUNET_PQ_query_param_fixed_size (
-      block->put_path,
-      block->put_path_length
-      * sizeof(struct GNUNET_DHT_PathElement)),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus ret;
-
-  ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                            "put",
-                                            params);
-  if (0 > ret)
-    return -1;
-  plugin->num_items++;
-  return block->data_size + OVERHEAD;
-}
-
-
-/**
- * Closure for #handle_results.
- */
-struct HandleResultContext
-{
-  /**
-   * Function to call on each result, may be NULL.
-   */
-  GNUNET_DATACACHE_Iterator iter;
-
-  /**
-   * Closure for @e iter.
-   */
-  void *iter_cls;
-
-  /**
-   * Key used.
-   */
-  const struct GNUNET_HashCode *key;
-};
-
-
-/**
- * Function to be called with the results of a SELECT statement
- * that has returned @a num_results results.  Parse the result
- * and call the callback given in @a cls
- *
- * @param cls closure of type `struct HandleResultContext`
- * @param result the postgres result
- * @param num_results the number of results in @a result
- */
-static void
-handle_results (void *cls,
-                PGresult *result,
-                unsigned int num_results)
-{
-  struct HandleResultContext *hrc = cls;
-
-  for (unsigned int i = 0; i < num_results; i++)
-  {
-    uint32_t type32;
-    uint32_t bro32;
-    void *data;
-    struct GNUNET_DATACACHE_Block block;
-    void *path = NULL;
-    size_t path_size = 0;
-    struct GNUNET_PQ_ResultSpec rs[] = {
-      GNUNET_PQ_result_spec_absolute_time ("expiration_time",
-                                           &block.expiration_time),
-      GNUNET_PQ_result_spec_uint32 ("type",
-                                    &type32),
-      GNUNET_PQ_result_spec_uint32 ("ro",
-                                    &bro32),
-      GNUNET_PQ_result_spec_variable_size ("value",
-                                           &data,
-                                           &block.data_size),
-      GNUNET_PQ_result_spec_auto_from_type ("trunc",
-                                            &block.trunc_peer),
-      GNUNET_PQ_result_spec_allow_null (
-        GNUNET_PQ_result_spec_variable_size ("path",
-                                             &path,
-                                             &path_size),
-        NULL),
-      GNUNET_PQ_result_spec_end
-    };
-
-    if (GNUNET_YES !=
-        GNUNET_PQ_extract_result (result,
-                                  rs,
-                                  i))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (0 != (path_size % sizeof(struct GNUNET_DHT_PathElement)))
-    {
-      GNUNET_break (0);
-      path_size = 0;
-      path = NULL;
-    }
-    block.data = data;
-    block.put_path = path;
-    block.put_path_length
-      = path_size / sizeof (struct GNUNET_DHT_PathElement);
-    block.type = (enum GNUNET_BLOCK_Type) type32;
-    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
-    block.key = *hrc->key;
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Found result of size %u bytes and type %u in database\n",
-         (unsigned int) block.data_size,
-         (unsigned int) block.type);
-    if ( (NULL != hrc->iter) &&
-         (GNUNET_SYSERR ==
-          hrc->iter (hrc->iter_cls,
-                     &block)) )
-    {
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "Ending iteration (client error)\n");
-      GNUNET_PQ_cleanup_result (rs);
-      return;
-    }
-    GNUNET_PQ_cleanup_result (rs);
-  }
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key key to look for
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-postgres_plugin_get (void *cls,
-                     const struct GNUNET_HashCode *key,
-                     enum GNUNET_BLOCK_Type type,
-                     GNUNET_DATACACHE_Iterator iter,
-                     void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = (uint32_t) type;
-  struct GNUNET_TIME_Absolute now = { 0 };
-  struct GNUNET_PQ_QueryParam paramk[] = {
-    GNUNET_PQ_query_param_auto_from_type (key),
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_QueryParam paramkt[] = {
-    GNUNET_PQ_query_param_auto_from_type (key),
-    GNUNET_PQ_query_param_uint32 (&type32),
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus res;
-  struct HandleResultContext hr_ctx;
-
-  now = GNUNET_TIME_absolute_get ();
-  hr_ctx.iter = iter;
-  hr_ctx.iter_cls = iter_cls;
-  hr_ctx.key = key;
-  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                              (0 == type) ? "getk" : "getkt",
-                                              (0 == type) ? paramk : paramkt,
-                                              &handle_results,
-                                              &hr_ctx);
-  if (res < 0)
-    return 0;
-  return res;
-}
-
-
-/**
- * Delete the entry with the lowest expiration value
- * from the datacache right now.
- *
- * @param cls closure (our `struct Plugin`)
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-postgres_plugin_del (void *cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PQ_QueryParam pempty[] = {
-    GNUNET_PQ_query_param_end
-  };
-  uint32_t size;
-  uint64_t oid;
-  struct GNUNET_HashCode key;
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_uint32 ("len",
-                                  &size),
-    GNUNET_PQ_result_spec_uint64 ("oid",
-                                  &oid),
-    GNUNET_PQ_result_spec_auto_from_type ("key",
-                                          &key),
-    GNUNET_PQ_result_spec_end
-  };
-  enum GNUNET_DB_QueryStatus res;
-  struct GNUNET_PQ_QueryParam dparam[] = {
-    GNUNET_PQ_query_param_uint64 (&oid),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_TIME_Absolute now;
-  struct GNUNET_PQ_QueryParam xparam[] = {
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_end
-  };
-
-  now = GNUNET_TIME_absolute_get ();
-  res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
-                                                  "getex",
-                                                  xparam,
-                                                  rs);
-  if (0 >= res)
-    res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
-                                                    "getm",
-                                                    pempty,
-                                                    rs);
-  if (0 > res)
-    return GNUNET_SYSERR;
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
-  {
-    /* no result */
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Ending iteration (no more results)\n");
-    return 0;
-  }
-  res = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                            "delrow",
-                                            dparam);
-  if (0 > res)
-  {
-    GNUNET_PQ_cleanup_result (rs);
-    return GNUNET_SYSERR;
-  }
-  plugin->num_items--;
-  plugin->env->delete_notify (plugin->env->cls,
-                              &key,
-                              size + OVERHEAD);
-  GNUNET_PQ_cleanup_result (rs);
-  return GNUNET_OK;
-}
-
-
-/**
- * Closure for #extract_result_cb.
- */
-struct ExtractResultContext
-{
-  /**
-   * Function to call for each result found.
-   */
-  GNUNET_DATACACHE_Iterator iter;
-
-  /**
-   * Closure for @e iter.
-   */
-  void *iter_cls;
-};
-
-
-/**
- * Function to be called with the results of a SELECT statement
- * that has returned @a num_results results.  Calls the `iter`
- * from @a cls for each result.
- *
- * @param cls closure with the `struct ExtractResultContext`
- * @param result the postgres result
- * @param num_results the number of results in @a result
- */
-static void
-extract_result_cb (void *cls,
-                   PGresult *result,
-                   unsigned int num_results)
-{
-  struct ExtractResultContext *erc = cls;
-
-  if (NULL == erc->iter)
-    return;
-  for (unsigned int i = 0; i < num_results; i++)
-  {
-    uint32_t type32;
-    uint32_t bro32;
-    struct GNUNET_DATACACHE_Block block;
-    void *data;
-    void *path;
-    size_t path_size;
-    struct GNUNET_PQ_ResultSpec rs[] = {
-      GNUNET_PQ_result_spec_absolute_time ("expiration_time",
-                                           &block.expiration_time),
-      GNUNET_PQ_result_spec_uint32 ("type",
-                                    &type32),
-      GNUNET_PQ_result_spec_uint32 ("ro",
-                                    &bro32),
-      GNUNET_PQ_result_spec_variable_size ("value",
-                                           &data,
-                                           &block.data_size),
-      GNUNET_PQ_result_spec_auto_from_type ("trunc",
-                                            &block.trunc_peer),
-      GNUNET_PQ_result_spec_variable_size ("path",
-                                           &path,
-                                           &path_size),
-      GNUNET_PQ_result_spec_auto_from_type ("key",
-                                            &block.key),
-      GNUNET_PQ_result_spec_end
-    };
-
-    if (GNUNET_YES !=
-        GNUNET_PQ_extract_result (result,
-                                  rs,
-                                  i))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (0 != (path_size % sizeof(struct GNUNET_DHT_PathElement)))
-    {
-      GNUNET_break (0);
-      path_size = 0;
-      path = NULL;
-    }
-    block.type = (enum GNUNET_BLOCK_Type) type32;
-    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
-    block.data = data;
-    block.put_path = path;
-    block.put_path_length = path_size / sizeof (struct GNUNET_DHT_PathElement);
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Found result of size %u bytes and type %u in database\n",
-         (unsigned int) block.data_size,
-         (unsigned int) block.type);
-    if ( (NULL != erc->iter) &&
-         (GNUNET_SYSERR ==
-          erc->iter (erc->iter_cls,
-                     &block)) )
-    {
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "Ending iteration (client error)\n");
-      GNUNET_PQ_cleanup_result (rs);
-      break;
-    }
-    GNUNET_PQ_cleanup_result (rs);
-  }
-}
-
-
-/**
- * Iterate over the results that are "close" to a particular key in
- * the datacache.  "close" is defined as numerically larger than @a
- * key (when interpreted as a circular address space), with small
- * distance.
- *
- * @param cls closure (internal context for the plugin)
- * @param key area of the keyspace to look into
- * @param type desired block type for the replies
- * @param num_results number of results that should be returned to @a iter
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-postgres_plugin_get_closest (void *cls,
-                             const struct GNUNET_HashCode *key,
-                             enum GNUNET_BLOCK_Type type,
-                             unsigned int num_results,
-                             GNUNET_DATACACHE_Iterator iter,
-                             void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t num_results32 = (uint32_t) num_results;
-  uint32_t type32 = (uint32_t) type;
-  struct GNUNET_TIME_Absolute now;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (key),
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_uint32 (&type32),
-    GNUNET_PQ_query_param_uint32 (&num_results32),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus res;
-  struct ExtractResultContext erc;
-
-  erc.iter = iter;
-  erc.iter_cls = iter_cls;
-  now = GNUNET_TIME_absolute_get ();
-  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                              "get_closest",
-                                              params,
-                                              &extract_result_cb,
-                                              &erc);
-  if (0 > res)
-  {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Ending iteration (postgres error)\n");
-    return 0;
-  }
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
-  {
-    /* no result */
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Ending iteration (no more results)\n");
-    return 0;
-  }
-  return res;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
- * @return the plugin's closure (our `struct Plugin`)
- */
-void *
-libgnunet_plugin_datacache_postgres_init (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
-  struct GNUNET_DATACACHE_PluginFunctions *api;
-  struct Plugin *plugin;
-
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-
-  if (GNUNET_OK != init_connection (plugin))
-  {
-    GNUNET_free (plugin);
-    return NULL;
-  }
-
-  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
-  api->cls = plugin;
-  api->get = &postgres_plugin_get;
-  api->put = &postgres_plugin_put;
-  api->del = &postgres_plugin_del;
-  api->get_closest = &postgres_plugin_get_closest;
-  LOG (GNUNET_ERROR_TYPE_INFO,
-       "Postgres datacache running\n");
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls closure (our `struct Plugin`)
- * @return NULL
- */
-void *
-libgnunet_plugin_datacache_postgres_done (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_break (GNUNET_OK ==
-                GNUNET_PQ_exec_sql (plugin->dbh,
-                                    "datacache-drop"));
-  GNUNET_PQ_disconnect (plugin->dbh);
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datacache_postgres.c */
diff --git a/src/service/datacache/plugin_datacache_sqlite.c b/src/service/datacache/plugin_datacache_sqlite.c
deleted file mode 100644
index 1c6f24a82..000000000
--- a/src/service/datacache/plugin_datacache_sqlite.c
+++ /dev/null
@@ -1,1063 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datacache/plugin_datacache_sqlite.c
- * @brief sqlite for an implementation of a database backend for the datacache
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_datacache_plugin.h"
-#include "gnunet_sq_lib.h"
-#include <sqlite3.h>
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "datacache-sqlite", __VA_ARGS__)
-
-#define LOG_STRERROR_FILE(kind, op, fn) \
-  GNUNET_log_from_strerror_file (kind, "datacache-sqlite", op, fn)
-
-
-/**
- * How much overhead do we assume per entry in the
- * datacache?
- */
-#define OVERHEAD (sizeof(struct GNUNET_HashCode) + 36)
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATACACHE_PluginEnvironment *env;
-
-  /**
-   * Handle to the sqlite database.
-   */
-  sqlite3 *dbh;
-
-  /**
-   * Filename used for the DB.
-   */
-  char *fn;
-
-  /**
-   * Prepared statement for #sqlite_plugin_put.
-   */
-  sqlite3_stmt *insert_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_get.
-   */
-  sqlite3_stmt *get_count_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_get.
-   */
-  sqlite3_stmt *get_count_any_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_get.
-   */
-  sqlite3_stmt *get_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_get.
-   */
-  sqlite3_stmt *get_any_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_del.
-   */
-  sqlite3_stmt *del_select_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_del.
-   */
-  sqlite3_stmt *del_expired_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_del.
-   */
-  sqlite3_stmt *del_stmt;
-
-  /**
-   * Prepared statement for #sqlite_plugin_get_closest.
-   */
-  sqlite3_stmt *get_closest_stmt;
-
-  /**
-   * Number of key-value pairs in the database.
-   */
-  unsigned int num_items;
-};
-
-
-/**
- * Log an error message at log-level @a level that indicates
- * a failure of the command @a cmd with the error from the database @a db
- *
- * @param db database handle
- * @param level log level
- * @param cmd failed command
- */
-#define LOG_SQLITE(db, level, cmd)                    \
-  do                                                  \
-  {                                                   \
-    LOG (level,                                       \
-         _ ("`%s' failed at %s:%d with error: %s\n"), \
-         cmd,                                         \
-         __FILE__,                                    \
-         __LINE__,                                    \
-         sqlite3_errmsg (db));                        \
-  } while (0)
-
-
-/**
- * Execute SQL statement.
- *
- * @param db database handle
- * @param cmd SQL command to execute
- */
-#define SQLITE3_EXEC(db, cmd)                                   \
-  do                                                            \
-  {                                                             \
-    emsg = NULL;                                                \
-    if (SQLITE_OK !=                                            \
-        sqlite3_exec (db, cmd, NULL, NULL, &emsg))              \
-    {                                                           \
-      LOG (GNUNET_ERROR_TYPE_ERROR,                             \
-           _ ("`%s' failed at %s:%d with error: %s\n"),         \
-           "sqlite3_exec",                                      \
-           __FILE__,                                            \
-           __LINE__,                                            \
-           emsg);                                               \
-      sqlite3_free (emsg);                                      \
-    }                                                           \
-  } while (0)
-
-
-/**
- * @brief Prepare a SQL statement
- *
- * @param dbh database handle
- * @param zSql SQL statement text
- * @param[out] ppStmt set to the prepared statement
- * @return 0 on success
- */
-static int
-sq_prepare (sqlite3 *dbh,
-            const char *zSql, /* SQL statement, UTF-8 encoded */
-            sqlite3_stmt **ppStmt)
-{ /* OUT: Statement handle */
-  char *dummy;
-
-  return sqlite3_prepare (dbh,
-                          zSql,
-                          strlen (zSql),
-                          ppStmt,
-                          (const char **) &dummy);
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param xor_distance how close is @a key to our PID?
- * @param block data to store
- * @return 0 if duplicate, -1 on error, number of bytes used otherwise
- */
-static ssize_t
-sqlite_plugin_put (void *cls,
-                   uint32_t xor_distance,
-                   const struct GNUNET_DATACACHE_Block *block)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = (uint32_t) block->type;
-  uint32_t ro32 = (uint32_t) block->ro;
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_uint32 (&ro32),
-    GNUNET_SQ_query_param_absolute_time (&block->expiration_time),
-    GNUNET_SQ_query_param_auto_from_type (&block->key),
-    GNUNET_SQ_query_param_uint32 (&xor_distance),
-    GNUNET_SQ_query_param_fixed_size (block->data,
-                                      block->data_size),
-    GNUNET_SQ_query_param_fixed_size (block->put_path,
-                                      block->put_path_length
-                                      * sizeof(struct GNUNET_DHT_PathElement)),
-    GNUNET_SQ_query_param_auto_from_type (&block->trunc_peer),
-    GNUNET_SQ_query_param_end
-  };
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Processing PUT of %u bytes with key `%s' and expiration %s\n",
-       (unsigned int) block->data_size,
-       GNUNET_h2s (&block->key),
-       GNUNET_STRINGS_relative_time_to_string (
-         GNUNET_TIME_absolute_get_remaining (
-           block->expiration_time),
-         GNUNET_YES));
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->insert_stmt,
-                      params))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->insert_stmt);
-    return -1;
-  }
-  if (SQLITE_DONE !=
-      sqlite3_step (plugin->insert_stmt))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->insert_stmt);
-    return -1;
-  }
-  plugin->num_items++;
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->insert_stmt);
-  return block->data_size + OVERHEAD;
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-get_any (void *cls,
-         const struct GNUNET_HashCode *key,
-         GNUNET_DATACACHE_Iterator iter,
-         void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_TIME_Absolute now;
-  unsigned int cnt;
-  uint32_t off;
-  uint32_t btype32;
-  uint32_t bro32;
-  unsigned int total;
-  struct GNUNET_DATACACHE_Block block;
-  void *path;
-  void *data;
-  size_t path_size;
-  struct GNUNET_SQ_QueryParam params_count[] = {
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_QueryParam params_select[] = {
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_uint32 (&off),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_ResultSpec rs[] = {
-    GNUNET_SQ_result_spec_variable_size (&data,
-                                         &block.data_size),
-    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
-    GNUNET_SQ_result_spec_variable_size (&path,
-                                         &path_size),
-    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
-    GNUNET_SQ_result_spec_uint32 (&btype32),
-    GNUNET_SQ_result_spec_uint32 (&bro32),
-    GNUNET_SQ_result_spec_end
-  };
-
-  now = GNUNET_TIME_absolute_get ();
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Processing GET for key `%s'\n",
-       GNUNET_h2s (key));
-
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->get_count_any_stmt,
-                      params_count))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_count_any_stmt);
-    return 0;
-  }
-  if (SQLITE_ROW !=
-      sqlite3_step (plugin->get_count_any_stmt))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite_step");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_count_any_stmt);
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "No content found when processing GET for key `%s'\n",
-         GNUNET_h2s (key));
-    return 0;
-  }
-  total = sqlite3_column_int (plugin->get_count_any_stmt,
-                              0);
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->get_count_any_stmt);
-  if ( (0 == total) ||
-       (NULL == iter) )
-  {
-    if (0 == total)
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "No content found when processing GET for key `%s'\n",
-           GNUNET_h2s (key));
-    return total;
-  }
-
-  cnt = 0;
-  block.key = *key;
-  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                  total);
-  while (cnt < total)
-  {
-    off = (off + 1) % total;
-    if (GNUNET_OK !=
-        GNUNET_SQ_bind (plugin->get_any_stmt,
-                        params_select))
-    {
-      LOG_SQLITE (plugin->dbh,
-                  GNUNET_ERROR_TYPE_ERROR,
-                  "sqlite3_bind_xxx");
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_any_stmt);
-      return cnt;
-    }
-    if (SQLITE_ROW !=
-        sqlite3_step (plugin->get_any_stmt))
-      break;
-    if (GNUNET_OK !=
-        GNUNET_SQ_extract_result (plugin->get_any_stmt,
-                                  rs))
-    {
-      GNUNET_break (0);
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_any_stmt);
-      break;
-    }
-    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
-    {
-      GNUNET_break (0);
-      path_size = 0;
-      path = NULL;
-    }
-    block.data = data;
-    block.put_path = path;
-    block.put_path_length = path_size / sizeof(struct GNUNET_DHT_PathElement);
-    block.type = (enum GNUNET_BLOCK_Type) btype32;
-    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
-    cnt++;
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Found %u-byte result when processing GET for key `%s'\n",
-         (unsigned int) block.data_size,
-         GNUNET_h2s (&block.key));
-    if (GNUNET_OK !=
-        iter (iter_cls,
-              &block))
-    {
-      GNUNET_SQ_cleanup_result (rs);
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_any_stmt);
-      break;
-    }
-    GNUNET_SQ_cleanup_result (rs);
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_any_stmt);
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->get_any_stmt);
-  return cnt;
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-get_typed (void *cls,
-           const struct GNUNET_HashCode *key,
-           enum GNUNET_BLOCK_Type type,
-           GNUNET_DATACACHE_Iterator iter,
-           void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = type;
-  struct GNUNET_TIME_Absolute now;
-  unsigned int cnt;
-  uint32_t off;
-  uint32_t bro32;
-  unsigned int total;
-  struct GNUNET_DATACACHE_Block block;
-  void *path;
-  void *data;
-  size_t path_size;
-  struct GNUNET_SQ_QueryParam params_count[] = {
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_QueryParam params_select[] = {
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_uint32 (&off),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_ResultSpec rs[] = {
-    GNUNET_SQ_result_spec_variable_size (&data,
-                                         &block.data_size),
-    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
-    GNUNET_SQ_result_spec_variable_size (&path,
-                                         &path_size),
-    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
-    GNUNET_SQ_result_spec_uint32 (&bro32),
-    GNUNET_SQ_result_spec_end
-  };
-
-  now = GNUNET_TIME_absolute_get ();
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Processing GET for key `%s'\n",
-       GNUNET_h2s (key));
-
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->get_count_stmt,
-                      params_count))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_count_stmt);
-    return 0;
-  }
-  if (SQLITE_ROW !=
-      sqlite3_step (plugin->get_count_stmt))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite_step");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_count_stmt);
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "No content found when processing GET for key `%s'\n",
-         GNUNET_h2s (key));
-    return 0;
-  }
-  total = sqlite3_column_int (plugin->get_count_stmt,
-                              0);
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->get_count_stmt);
-  if ( (0 == total) ||
-       (NULL == iter) )
-  {
-    if (0 == total)
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "No content found when processing GET for key `%s'\n",
-           GNUNET_h2s (key));
-    return total;
-  }
-
-  cnt = 0;
-  block.key = *key;
-  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                  total);
-  while (cnt < total)
-  {
-    off = (off + 1) % total;
-    if (GNUNET_OK !=
-        GNUNET_SQ_bind (plugin->get_stmt,
-                        params_select))
-    {
-      LOG_SQLITE (plugin->dbh,
-                  GNUNET_ERROR_TYPE_ERROR,
-                  "sqlite3_bind_xxx");
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_stmt);
-      return cnt;
-    }
-    if (SQLITE_ROW !=
-        sqlite3_step (plugin->get_stmt))
-      break;
-    if (GNUNET_OK !=
-        GNUNET_SQ_extract_result (plugin->get_stmt,
-                                  rs))
-    {
-      GNUNET_break (0);
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_stmt);
-      break;
-    }
-    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
-    {
-      GNUNET_break (0);
-      path_size = 0;
-      path = NULL;
-    }
-    block.data = data;
-    block.put_path = path;
-    block.put_path_length = path_size / sizeof(struct GNUNET_DHT_PathElement);
-    block.type = type;
-    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
-    cnt++;
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Found %u-byte result when processing GET for key `%s'\n",
-         (unsigned int) block.data_size,
-         GNUNET_h2s (&block.key));
-    if ( (NULL != iter) &&
-         (GNUNET_OK !=
-          iter (iter_cls,
-                &block)) )
-    {
-      GNUNET_SQ_cleanup_result (rs);
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->get_stmt);
-      break;
-    }
-    GNUNET_SQ_cleanup_result (rs);
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_stmt);
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->get_stmt);
-  return cnt;
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-sqlite_plugin_get (void *cls,
-                   const struct GNUNET_HashCode *key,
-                   enum GNUNET_BLOCK_Type type,
-                   GNUNET_DATACACHE_Iterator iter,
-                   void *iter_cls)
-{
-  if (GNUNET_BLOCK_TYPE_ANY == type)
-    return get_any (cls,
-                    key,
-                    iter,
-                    iter_cls);
-  return get_typed (cls,
-                    key,
-                    type,
-                    iter,
-                    iter_cls);
-}
-
-
-/**
- * Delete the entry with the lowest expiration value
- * from the datacache right now.
- *
- * @param cls closure (our `struct Plugin`)
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-sqlite_plugin_del (void *cls)
-{
-  struct Plugin *plugin = cls;
-  uint64_t rowid;
-  void *data;
-  size_t data_size;
-  struct GNUNET_HashCode hc;
-  struct GNUNET_TIME_Absolute now;
-  struct GNUNET_SQ_ResultSpec rs[] = {
-    GNUNET_SQ_result_spec_uint64 (&rowid),
-    GNUNET_SQ_result_spec_auto_from_type (&hc),
-    GNUNET_SQ_result_spec_variable_size (&data,
-                                         &data_size),
-    GNUNET_SQ_result_spec_end
-  };
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_uint64 (&rowid),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_QueryParam time_params[] = {
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_end
-  };
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Processing DEL\n");
-  now = GNUNET_TIME_absolute_get ();
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->del_expired_stmt,
-                      time_params))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->del_expired_stmt);
-    return GNUNET_SYSERR;
-  }
-  if ( (SQLITE_ROW !=
-        sqlite3_step (plugin->del_expired_stmt)) ||
-       (GNUNET_OK !=
-        GNUNET_SQ_extract_result (plugin->del_expired_stmt,
-                                  rs)))
-  {
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->del_expired_stmt);
-    if (SQLITE_ROW !=
-        sqlite3_step (plugin->del_select_stmt))
-    {
-      LOG_SQLITE (plugin->dbh,
-                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                  "sqlite3_step");
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->del_select_stmt);
-      return GNUNET_SYSERR;
-    }
-    if (GNUNET_OK !=
-        GNUNET_SQ_extract_result (plugin->del_select_stmt,
-                                  rs))
-    {
-      GNUNET_SQ_reset (plugin->dbh,
-                       plugin->del_select_stmt);
-      GNUNET_break (0);
-      return GNUNET_SYSERR;
-    }
-  }
-  GNUNET_SQ_cleanup_result (rs);
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->del_select_stmt);
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->del_stmt,
-                      params))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->del_stmt);
-    return GNUNET_SYSERR;
-  }
-  if (SQLITE_DONE !=
-      sqlite3_step (plugin->del_stmt))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->del_stmt);
-    return GNUNET_SYSERR;
-  }
-  plugin->num_items--;
-  plugin->env->delete_notify (plugin->env->cls,
-                              &hc,
-                              data_size + OVERHEAD);
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->del_stmt);
-  return GNUNET_OK;
-}
-
-
-/**
- * Iterate over the results that are "close" to a particular key in
- * the datacache.  "close" is defined as numerically larger than @a
- * key (when interpreted as a circular address space), with small
- * distance.
- *
- * @param cls closure (internal context for the plugin)
- * @param key area of the keyspace to look into
- * @param type desired block type for the replies
- * @param num_results number of results that should be returned to @a iter
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-sqlite_plugin_get_closest (void *cls,
-                           const struct GNUNET_HashCode *key,
-                           enum GNUNET_BLOCK_Type type,
-                           unsigned int num_results,
-                           GNUNET_DATACACHE_Iterator iter,
-                           void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = type;
-  uint32_t num_results32 = num_results;
-  struct GNUNET_TIME_Absolute now;
-  void *data;
-  void *path;
-  size_t path_size;
-  unsigned int cnt;
-  uint32_t bro32;
-  struct GNUNET_DATACACHE_Block block;
-  uint32_t rtype32;
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_uint32 (&num_results32),
-    GNUNET_SQ_query_param_end
-  };
-  struct GNUNET_SQ_ResultSpec rs[] = {
-    GNUNET_SQ_result_spec_variable_size (&data,
-                                         &block.data_size),
-    GNUNET_SQ_result_spec_absolute_time (&block.expiration_time),
-    GNUNET_SQ_result_spec_variable_size (&path,
-                                         &path_size),
-    GNUNET_SQ_result_spec_auto_from_type (&block.trunc_peer),
-    GNUNET_SQ_result_spec_uint32 (&rtype32),
-    GNUNET_SQ_result_spec_uint32 (&bro32),
-    GNUNET_SQ_result_spec_auto_from_type (&block.key),
-    GNUNET_SQ_result_spec_end
-  };
-
-  now = GNUNET_TIME_absolute_get ();
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Processing GET_CLOSEST for key `%s'\n",
-       GNUNET_h2s (key));
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (plugin->get_closest_stmt,
-                      params))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh,
-                     plugin->get_closest_stmt);
-    return 0;
-  }
-  cnt = 0;
-  while (SQLITE_ROW ==
-         sqlite3_step (plugin->get_closest_stmt))
-  {
-    if (GNUNET_OK !=
-        GNUNET_SQ_extract_result (plugin->get_closest_stmt,
-                                  rs))
-    {
-      GNUNET_break (0);
-      break;
-    }
-    if (0 != path_size % sizeof(struct GNUNET_DHT_PathElement))
-    {
-      GNUNET_break (0);
-      path_size = 0;
-      path = NULL;
-    }
-    block.put_path_length
-      = path_size / sizeof(struct GNUNET_DHT_PathElement);
-    block.put_path = path;
-    block.data = data;
-    block.type = (enum GNUNET_BLOCK_Type) rtype32;
-    block.ro = (enum GNUNET_DHT_RouteOption) bro32;
-    cnt++;
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Found %u-byte result at %s when processing GET_CLOSE\n",
-         (unsigned int) block.data_size,
-         GNUNET_h2s (&block.key));
-
-    if (GNUNET_OK !=
-        iter (iter_cls,
-              &block))
-    {
-      GNUNET_SQ_cleanup_result (rs);
-      break;
-    }
-    GNUNET_SQ_cleanup_result (rs);
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   plugin->get_closest_stmt);
-  return cnt;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironment`)
- * @return the plugin's closure (our `struct Plugin`)
- */
-void *
-libgnunet_plugin_datacache_sqlite_init (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
-  struct GNUNET_DATACACHE_PluginFunctions *api;
-  struct Plugin *plugin;
-  char *fn;
-  char *fn_utf8;
-  sqlite3 *dbh;
-  char *emsg;
-
-  if (GNUNET_YES ==
-      GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
-                                            "datacache-sqlite",
-                                            "IN_MEMORY"))
-  {
-    if (SQLITE_OK !=
-        sqlite3_open (":memory:",
-                      &dbh))
-      return NULL;
-    fn_utf8 = NULL;
-  }
-  else
-  {
-    fn = GNUNET_DISK_mktemp ("gnunet-datacache");
-    if (NULL == fn)
-    {
-      GNUNET_break (0);
-      return NULL;
-    }
-    /* fn should be UTF-8-encoded. If it isn't, it's a bug. */
-    fn_utf8 = GNUNET_strdup (fn);
-    if (SQLITE_OK !=
-        sqlite3_open (fn_utf8,
-                      &dbh))
-    {
-      GNUNET_free (fn);
-      GNUNET_free (fn_utf8);
-      return NULL;
-    }
-    GNUNET_free (fn);
-  }
-
-  SQLITE3_EXEC (dbh, "PRAGMA temp_store=MEMORY");
-  SQLITE3_EXEC (dbh, "PRAGMA locking_mode=EXCLUSIVE");
-  SQLITE3_EXEC (dbh, "PRAGMA journal_mode=OFF");
-  SQLITE3_EXEC (dbh, "PRAGMA synchronous=OFF");
-  SQLITE3_EXEC (dbh, "PRAGMA page_size=4092");
-  if (GNUNET_YES ==
-      GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
-                                            "datacache-sqlite",
-                                            "IN_MEMORY"))
-    SQLITE3_EXEC (dbh, "PRAGMA sqlite_temp_store=3");
-
-  SQLITE3_EXEC (dbh,
-                "CREATE TABLE ds180 ("
-                "  type INTEGER NOT NULL DEFAULT 0,"
-                "  ro INTEGER NOT NULL DEFAULT 0,"
-                "  expire INTEGER NOT NULL,"
-                "  key BLOB NOT NULL DEFAULT '',"
-                "  prox INTEGER NOT NULL,"
-                "  value BLOB NOT NULL,"
-                "  trunc BLOB NOT NULL,"
-                "  path BLOB DEFAULT '')");
-  SQLITE3_EXEC (dbh,
-                "CREATE INDEX idx_hashidx"
-                " ON ds180 (key,type,expire)");
-  SQLITE3_EXEC (dbh,
-                "CREATE INDEX idx_prox_expire"
-                " ON ds180 (prox,expire)");
-  SQLITE3_EXEC (dbh,
-                "CREATE INDEX idx_expire_only"
-                " ON ds180 (expire)");
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-  plugin->dbh = dbh;
-  plugin->fn = fn_utf8;
-
-  if ((SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "INSERT INTO ds180"
-                   " (type, ro, expire, key, prox, value, path, trunc)"
-                   " VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-                   &plugin->insert_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT COUNT(*) FROM ds180 "
-                   "WHERE key=?"
-                   " AND type=?"
-                   " AND expire >= ?",
-                   &plugin->get_count_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT COUNT(*) FROM ds180 "
-                   "WHERE key=? AND expire >= ?",
-                   &plugin->get_count_any_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT value,expire,path,trunc,ro"
-                   " FROM ds180"
-                   " WHERE key=?"
-                   " AND type=?"
-                   " AND expire >= ?"
-                   " LIMIT 1 OFFSET ?",
-                   &plugin->get_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT value,expire,path,trunc,type,ro"
-                   " FROM ds180"
-                   " WHERE key=?"
-                   " AND expire >= ?"
-                   " LIMIT 1 OFFSET ?",
-                   &plugin->get_any_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT _ROWID_,key,value FROM ds180"
-                   " WHERE expire < ?1"
-                   " ORDER BY expire ASC LIMIT 1",
-                   &plugin->del_expired_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT _ROWID_,key,value FROM ds180"
-                   " ORDER BY prox ASC, expire ASC LIMIT 1",
-                   &plugin->del_select_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "DELETE FROM ds180 WHERE _ROWID_=?",
-                   &plugin->del_stmt)) ||
-      (SQLITE_OK !=
-       sq_prepare (plugin->dbh,
-                   "SELECT * FROM ("
-                   " SELECT value,expire,path,trunc,type,ro,key"
-                   " FROM ds180 "
-                   " WHERE key>=?1 "
-                   "  AND expire >= ?2"
-                   "  AND ( (type=?3) or (0 == ?3) )"
-                   " ORDER BY KEY ASC LIMIT ?4)"
-                   "UNION "
-                   "SELECT * FROM ("
-                   " SELECT value,expire,path,trunc,type,ro,key"
-                   " FROM ds180 "
-                   " WHERE key<=?1 "
-                   "  AND expire >= ?2"
-                   "  AND ( (type=?3) or (0 == ?3) )"
-                   " ORDER BY KEY DESC LIMIT ?4)",
-                   &plugin->get_closest_stmt)))
-  {
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sq_prepare");
-    GNUNET_break (SQLITE_OK ==
-                  sqlite3_close (plugin->dbh));
-    GNUNET_free (plugin);
-    return NULL;
-  }
-
-  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
-  api->cls = plugin;
-  api->get = &sqlite_plugin_get;
-  api->put = &sqlite_plugin_put;
-  api->del = &sqlite_plugin_del;
-  api->get_closest = &sqlite_plugin_get_closest;
-  LOG (GNUNET_ERROR_TYPE_INFO,
-       "Sqlite datacache running\n");
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls closure (our `struct Plugin`)
- * @return NULL
- */
-void *
-libgnunet_plugin_datacache_sqlite_done (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-  int result;
-
-#if SQLITE_VERSION_NUMBER >= 3007000
-  sqlite3_stmt *stmt;
-#endif
-
-#if ! WINDOWS || defined(__CYGWIN__)
-  if ( (NULL != plugin->fn) &&
-       (0 != unlink (plugin->fn)) )
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING,
-                       "unlink",
-                       plugin->fn);
-  GNUNET_free (plugin->fn);
-#endif
-  sqlite3_finalize (plugin->insert_stmt);
-  sqlite3_finalize (plugin->get_count_stmt);
-  sqlite3_finalize (plugin->get_count_any_stmt);
-  sqlite3_finalize (plugin->get_stmt);
-  sqlite3_finalize (plugin->get_any_stmt);
-  sqlite3_finalize (plugin->del_select_stmt);
-  sqlite3_finalize (plugin->del_expired_stmt);
-  sqlite3_finalize (plugin->del_stmt);
-  sqlite3_finalize (plugin->get_closest_stmt);
-  result = sqlite3_close (plugin->dbh);
-#if SQLITE_VERSION_NUMBER >= 3007000
-  if (SQLITE_BUSY == result)
-  {
-    LOG (GNUNET_ERROR_TYPE_WARNING,
-         _ (
-           "Tried to close sqlite without finalizing all prepared statements.\n"));
-    stmt = sqlite3_next_stmt (plugin->dbh,
-                              NULL);
-    while (NULL != stmt)
-    {
-      result = sqlite3_finalize (stmt);
-      if (result != SQLITE_OK)
-        LOG (GNUNET_ERROR_TYPE_WARNING,
-             "Failed to close statement %p: %d\n",
-             stmt,
-             result);
-      stmt = sqlite3_next_stmt (plugin->dbh,
-                                NULL);
-    }
-    result = sqlite3_close (plugin->dbh);
-  }
-#endif
-  if (SQLITE_OK != result)
-    LOG_SQLITE (plugin->dbh,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_close");
-
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datacache_sqlite.c */
diff --git a/src/service/datacache/plugin_datacache_template.c b/src/service/datacache/plugin_datacache_template.c
deleted file mode 100644
index 1bd712d39..000000000
--- a/src/service/datacache/plugin_datacache_template.c
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datacache/plugin_datacache_template.c
- * @brief template for an implementation of a database backend for the datacache
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_datacache_plugin.h"
-
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATACACHE_PluginEnvironment *env;
-};
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param xor_distance distance of @a key to our PID
- * @param block data to store
- * @return 0 if duplicate, -1 on error, number of bytes used otherwise
- */
-static ssize_t
-template_plugin_put (void *cls,
-                     uint32_t xor_distance,
-                     const struct GNUNET_DATACACHE_Block *block)
-{
-  GNUNET_break (0);
-  return -1;
-}
-
-
-/**
- * Iterate over the results for a particular key
- * in the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param key
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-template_plugin_get (void *cls,
-                     const struct GNUNET_HashCode *key,
-                     enum GNUNET_BLOCK_Type type,
-                     GNUNET_DATACACHE_Iterator iter,
-                     void *iter_cls)
-{
-  GNUNET_break (0);
-  return 0;
-}
-
-
-/**
- * Delete the entry with the lowest expiration value
- * from the datacache right now.
- *
- * @param cls closure (our `struct Plugin`)
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-template_plugin_del (void *cls)
-{
-  GNUNET_break (0);
-  return GNUNET_SYSERR;
-}
-
-
-/**
- * Iterate over the results that are "close" to a particular key in
- * the datacache.  "close" is defined as numerically larger than @a
- * key (when interpreted as a circular address space), with small
- * distance.
- *
- * @param cls closure (internal context for the plugin)
- * @param key area of the keyspace to look into
- * @param type desired block type for the replies
- * @param num_results number of results that should be returned to @a iter
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-template_plugin_get_closest (void *cls,
-                             const struct GNUNET_HashCode *key,
-                             enum GNUNET_BLOCK_Type type,
-                             unsigned int num_results,
-                             GNUNET_DATACACHE_Iterator iter,
-                             void *iter_cls)
-{
-  GNUNET_break (0);
-  return 0;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls closure (the `struct GNUNET_DATACACHE_PluginEnvironmnet`)
- * @return the plugin's closure (our `struct Plugin`)
- */
-void *
-libgnunet_plugin_datacache_template_init (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginEnvironment *env = cls;
-  struct GNUNET_DATACACHE_PluginFunctions *api;
-  struct Plugin *plugin;
-
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-  api = GNUNET_new (struct GNUNET_DATACACHE_PluginFunctions);
-  api->cls = plugin;
-  api->get = &template_plugin_get;
-  api->put = &template_plugin_put;
-  api->del = &template_plugin_del;
-  api->get_closest = &template_plugin_get_closest;
-  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
-                   "template",
-                   "Template datacache running\n");
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls closure (our `struct Plugin`)
- * @return NULL
- */
-void *
-libgnunet_plugin_datacache_template_done (void *cls)
-{
-  struct GNUNET_DATACACHE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datacache_template.c */
diff --git a/src/service/datastore/Makefile.am b/src/service/datastore/Makefile.am
index 9ae5004c6..22f98482a 100644
--- a/src/service/datastore/Makefile.am
+++ b/src/service/datastore/Makefile.am
@@ -10,12 +10,6 @@ libexecdir= $(pkglibdir)/libexec/
 pkgcfg_DATA = \
   datastore.conf
 
-sqldir = $(prefix)/share/gnunet/sql/
-
-sql_DATA = \
-  datastore-0001.sql \
-  datastore-drop.sql
-
 if USE_COVERAGE
   AM_CFLAGS = --coverage -O0
   XLIBS = -lgcov
@@ -46,89 +40,30 @@ gnunet_service_datastore_LDADD = \
   $(GN_LIBINTL)
 
 if HAVE_SQLITE
- SQLITE_PLUGIN = libgnunet_plugin_datastore_sqlite.la
 if HAVE_BENCHMARKS
   SQLITE_BENCHMARKS = \
-   perf_datastore_api_sqlite \
-   perf_plugin_datastore_sqlite
+   perf_datastore_api_sqlite
 endif
  SQLITE_TESTS = \
   test_datastore_api_sqlite \
   test_datastore_api_management_sqlite \
-  test_plugin_datastore_sqlite \
   $(SQLITE_BENCHMARKS)
 endif
 if HAVE_POSTGRESQL
- POSTGRES_PLUGIN = libgnunet_plugin_datastore_postgres.la
 if HAVE_BENCHMARKS
   POSTGRES_BENCHMARKS = \
-   perf_datastore_api_postgres \
-   perf_plugin_datastore_postgres
+   perf_datastore_api_postgres
 endif
  POSTGRES_TESTS = \
   test_datastore_api_postgres \
   test_datastore_api_management_postgres \
-  test_plugin_datastore_postgres \
   $(POSTGRES_BENCHMARKS)
 endif
 
-plugin_LTLIBRARIES = \
-  $(SQLITE_PLUGIN) \
-  $(POSTGRES_PLUGIN) \
-  libgnunet_plugin_datastore_heap.la
-
-# Real plugins should of course go into
-# plugin_LTLIBRARIES
-noinst_LTLIBRARIES = \
-  libgnunet_plugin_datastore_template.la
-
-
-libgnunet_plugin_datastore_sqlite_la_SOURCES = \
-  plugin_datastore_sqlite.c
-libgnunet_plugin_datastore_sqlite_la_LIBADD = \
-  $(top_builddir)/src/lib/sq/libgnunetsq.la \
-  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lsqlite3 \
-  $(LTLIBINTL)
-libgnunet_plugin_datastore_sqlite_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
-libgnunet_plugin_datastore_heap_la_SOURCES = \
-  plugin_datastore_heap.c
-libgnunet_plugin_datastore_heap_la_LIBADD = \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
-  $(LTLIBINTL)
-libgnunet_plugin_datastore_heap_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
-libgnunet_plugin_datastore_postgres_la_SOURCES = \
-  plugin_datastore_postgres.c
-libgnunet_plugin_datastore_postgres_la_LIBADD = \
-  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/lib/pq/libgnunetpq.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) -lpq
-libgnunet_plugin_datastore_postgres_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS) $(POSTGRESQL_LDFLAGS)
-libgnunet_plugin_datastore_postgres_la_CPPFLAGS = \
- $(POSTGRESQL_CPPFLAGS) $(AM_CPPFLAGS)
-
-
-libgnunet_plugin_datastore_template_la_SOURCES = \
-  plugin_datastore_template.c
-libgnunet_plugin_datastore_template_la_LIBADD = \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
-  $(LTLIBINTL)
-libgnunet_plugin_datastore_template_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
 check_PROGRAMS = \
   test_datastore_api_heap \
   test_datastore_api_management_heap \
   perf_datastore_api_heap \
-  perf_plugin_datastore_heap \
-  test_plugin_datastore_heap \
   $(SQLITE_TESTS) \
   $(POSTGRES_TESTS)
 
@@ -158,19 +93,6 @@ perf_datastore_api_heap_LDADD = \
  libgnunetdatastore.la \
  $(top_builddir)/src/lib/util/libgnunetutil.la
 
-perf_plugin_datastore_heap_SOURCES = \
- perf_plugin_datastore.c
-perf_plugin_datastore_heap_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-test_plugin_datastore_heap_SOURCES = \
- test_plugin_datastore.c
-test_plugin_datastore_heap_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-
 test_datastore_api_sqlite_SOURCES = \
  test_datastore_api.c
 test_datastore_api_sqlite_LDADD = \
@@ -192,19 +114,6 @@ perf_datastore_api_sqlite_LDADD = \
  libgnunetdatastore.la \
  $(top_builddir)/src/lib/util/libgnunetutil.la
 
-perf_plugin_datastore_sqlite_SOURCES = \
- perf_plugin_datastore.c
-perf_plugin_datastore_sqlite_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-test_plugin_datastore_sqlite_SOURCES = \
- test_plugin_datastore.c
-test_plugin_datastore_sqlite_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-
 test_datastore_api_postgres_SOURCES = \
  test_datastore_api.c
 test_datastore_api_postgres_LDADD = \
@@ -226,28 +135,8 @@ perf_datastore_api_postgres_LDADD = \
  libgnunetdatastore.la \
  $(top_builddir)/src/lib/util/libgnunetutil.la
 
-test_plugin_datastore_postgres_SOURCES = \
- test_plugin_datastore.c
-test_plugin_datastore_postgres_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-perf_plugin_datastore_postgres_SOURCES = \
- perf_plugin_datastore.c
-perf_plugin_datastore_postgres_LDADD = \
- $(top_builddir)/src/service/testing/libgnunettesting.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-
-
 EXTRA_DIST = \
  test_defaults.conf \
  test_datastore_api_data_sqlite.conf \
- perf_plugin_datastore_data_sqlite.conf \
- test_plugin_datastore_data_sqlite.conf \
  test_datastore_api_data_heap.conf \
- perf_plugin_datastore_data_heap.conf \
- test_plugin_datastore_data_heap.conf \
- test_datastore_api_data_postgres.conf \
- perf_plugin_datastore_data_postgres.conf \
- test_plugin_datastore_data_postgres.conf \
- $(sql_DATA)
+ test_datastore_api_data_postgres.conf
diff --git a/src/service/datastore/datastore-0001.sql b/src/service/datastore/datastore-0001.sql
deleted file mode 100644
index 0d4758be2..000000000
--- a/src/service/datastore/datastore-0001.sql
+++ /dev/null
@@ -1,49 +0,0 @@
---
--- This file is part of GNUnet
--- Copyright (C) 2014--2022 GNUnet e.V.
---
--- GNUnet is free software; you can redistribute it and/or modify it under the
--- terms of the GNU General Public License as published by the Free Software
--- Foundation; either version 3, or (at your option) any later version.
---
--- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
--- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
--- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
---
--- You should have received a copy of the GNU General Public License along with
--- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
---
-
--- Everything in one big transaction
-BEGIN;
-
--- Check patch versioning is in place.
-SELECT _v.register_patch('datastore-0001', NULL, NULL);
-
--------------------- Schema ----------------------------
-
-CREATE SCHEMA datastore;
-COMMENT ON SCHEMA datastore IS 'gnunet-datastore data';
-
-SET search_path TO datastore;
-
-CREATE TABLE IF NOT EXISTS gn090 (
-  repl INTEGER NOT NULL DEFAULT 0,
-  type INTEGER NOT NULL DEFAULT 0,
-  prio INTEGER NOT NULL DEFAULT 0,
-  anonLevel INTEGER NOT NULL DEFAULT 0,
-  expire BIGINT NOT NULL DEFAULT 0,
-  rvalue BIGINT NOT NULL DEFAULT 0,
-  hash BYTEA NOT NULL DEFAULT '',
-  vhash BYTEA NOT NULL DEFAULT '',
-  value BYTEA NOT NULL DEFAULT '',
-  oid  BIGINT GENERATED BY DEFAULT AS IDENTITY);
-
-CREATE INDEX IF NOT EXISTS oid_hash ON gn090 (oid);
-CREATE INDEX IF NOT EXISTS idx_hash ON gn090 (hash);
-CREATE INDEX IF NOT EXISTS idx_prio_anon ON gn090 (prio,anonLevel);
-CREATE INDEX IF NOT EXISTS idx_prio_hash_anon ON gn090 (prio,hash,anonLevel);
-CREATE INDEX IF NOT EXISTS idx_repl_rvalue ON gn090 (repl,rvalue);
-CREATE INDEX IF NOT EXISTS idx_expire_hash ON gn090 (expire,hash);
-
-COMMIT;
diff --git a/src/service/datastore/datastore-drop.sql b/src/service/datastore/datastore-drop.sql
deleted file mode 100644
index 67fee303d..000000000
--- a/src/service/datastore/datastore-drop.sql
+++ /dev/null
@@ -1,25 +0,0 @@
---
--- This file is part of GNUnet
--- Copyright (C) 2014--2022 GNUnet e.V.
---
--- GNUnet is free software; you can redistribute it and/or modify it under the
--- terms of the GNU General Public License as published by the Free Software
--- Foundation; either version 3, or (at your option) any later version.
---
--- GNUnet is distributed in the hope that it will be useful, but WITHOUT ANY
--- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
--- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
---
--- You should have received a copy of the GNU General Public License along with
--- GNUnet; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
---
-
--- Everything in one big transaction
-BEGIN;
-
-
-SELECT _v.unregister_patch('datastore-0001');
-
-DROP SCHEMA datastore CASCADE;
-
-COMMIT;
diff --git a/src/service/datastore/meson.build b/src/service/datastore/meson.build
index 9dde488a0..b81d8bb86 100644
--- a/src/service/datastore/meson.build
+++ b/src/service/datastore/meson.build
@@ -8,10 +8,6 @@ configure_file(input : 'datastore.conf.in',
                install: true,
                install_dir: pkgcfgdir)
 
-install_data ('datastore-0001.sql',
-              'datastore-drop.sql',
-               install_dir: get_option('datadir')/'gnunet'/'sql')
-
 if get_option('monolith')
   foreach p : libgnunetdatastore_src + gnunetservicedatastore_src
     gnunet_src += 'datastore/' + p
@@ -32,36 +28,6 @@ libgnunetdatastore_dep = declare_dependency(link_with : libgnunetdatastore)
 pkg.generate(libgnunetdatastore, url: 'https://www.gnunet.org',
              description : 'Management API for the datastore for persistent storage to disk')
 
-shared_module('gnunet_plugin_datastore_sqlite',
-        ['plugin_datastore_sqlite.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetdatastore_dep,
-                       sqlite_dep,
-                       libgnunetsq_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
-shared_module('gnunet_plugin_datastore_heap',
-        ['plugin_datastore_heap.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetdatacache_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
-if pq_dep.found()
-  shared_module('gnunet_plugin_datastore_postgres',
-          ['plugin_datastore_postgres.c'],
-          dependencies: [libgnunetutil_dep,
-                         libgnunetdatastore_dep,
-                         pq_dep,
-                         libgnunetpq_dep],
-          include_directories: [incdir, configuration_inc],
-          install: true,
-          install_dir: get_option('libdir')/'gnunet')
-endif
-
 executable ('gnunet-service-datastore',
             gnunetservicedatastore_src,
             dependencies: [libgnunetdatastore_dep,
@@ -92,16 +58,6 @@ testds_mgmt_sqlite = executable ('test_datastore_api_management_sqlite',
             include_directories: [incdir, configuration_inc],
             install: false)
 
-testds_plugin_sqlite = executable ('test_plugin_datastore_sqlite',
-            ['test_plugin_datastore.c'],
-            dependencies: [
-              libgnunetdatastore_dep,
-              libgnunetutil_dep,
-              libgnunettesting_dep
-              ],
-            include_directories: [incdir, configuration_inc],
-            install: false)
-
 testds_heap = executable ('test_datastore_api_heap',
             ['test_datastore_api.c'],
             dependencies: [
@@ -122,16 +78,6 @@ testds_mgmt_heap = executable ('test_datastore_api_management_heap',
             include_directories: [incdir, configuration_inc],
             install: false)
 
-testds_plugin_heap = executable ('test_plugin_datastore_heap',
-            ['test_plugin_datastore.c'],
-            dependencies: [
-              libgnunetdatastore_dep,
-              libgnunetutil_dep,
-              libgnunettesting_dep
-              ],
-            include_directories: [incdir, configuration_inc],
-            install: false)
-
 testds_pq = executable ('test_datastore_api_postgres',
             ['test_datastore_api.c'],
             dependencies: [
@@ -142,16 +88,6 @@ testds_pq = executable ('test_datastore_api_postgres',
             include_directories: [incdir, configuration_inc],
             install: false)
 
-testds_plugin_pq = executable ('test_plugin_datastore_postgres',
-            ['test_plugin_datastore.c'],
-            dependencies: [
-              libgnunetdatastore_dep,
-              libgnunetutil_dep,
-              libgnunettesting_dep
-              ],
-            include_directories: [incdir, configuration_inc],
-            install: false)
-
 testds_mgmt_pq = executable ('test_datastore_api_management_postgres',
             ['test_datastore_api_management.c'],
             dependencies: [
@@ -179,18 +115,12 @@ test('test_datastore_api_sqlite', testds_sqlite,
   suite: 'datastore', workdir: meson.current_build_dir())
 test('test_datastore_api_management_sqlite', testds_mgmt_sqlite,
   suite: 'datastore', workdir: meson.current_build_dir())
-test('test_plugin_datastore_sqlite', testds_plugin_sqlite,
-  suite: 'datastore', workdir: meson.current_build_dir())
 test('test_datastore_api_heap', testds_heap,
   suite: 'datastore', workdir: meson.current_build_dir())
 test('test_datastore_api_management_heap', testds_mgmt_heap,
   suite: 'datastore', workdir: meson.current_build_dir())
-test('test_plugin_datastore_heap', testds_plugin_heap,
-  suite: 'datastore', workdir: meson.current_build_dir())
 test('test_datastore_api_postgres', testds_pq,
   suite: 'datastore', workdir: meson.current_build_dir())
 test('test_datastore_api_management_postgres', testds_mgmt_pq,
   suite: 'datastore', workdir: meson.current_build_dir())
-test('test_plugin_datastore_postgres', testds_plugin_pq,
-  suite: 'datastore', workdir: meson.current_build_dir())
 
diff --git a/src/service/datastore/perf_plugin_datastore.c b/src/service/datastore/perf_plugin_datastore.c
deleted file mode 100644
index 8e63b08e6..000000000
--- a/src/service/datastore/perf_plugin_datastore.c
+++ /dev/null
@@ -1,573 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2004, 2005, 2006, 2007, 2009, 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/*
- * @file perf_plugin_datastore.c
- * @brief Profile database plugin directly, focusing on iterators.
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_protocols.h"
-#include "gnunet_datastore_plugin.h"
-#include "gnunet_testing_lib.h"
-#include <gauger.h>
-
-/**
- * Target datastore size (in bytes).  Realistic sizes are
- * more like 16 GB (not the default of 16 MB); however,
- * those take too long to run them in the usual "make check"
- * sequence.  Hence the value used for shipping is tiny.
- */
-#define MAX_SIZE 1024LL * 1024 * 16 * 1
-
-#define ITERATIONS 2
-
-/**
- * Number of put operations equivalent to 1/10th of MAX_SIZE
- */
-#define PUT_10 (MAX_SIZE / 32 / 1024 / ITERATIONS)
-
-static char category[256];
-
-static unsigned int hits[PUT_10 / 8 + 1];
-
-static unsigned long long stored_bytes;
-
-static unsigned long long stored_entries;
-
-static unsigned long long stored_ops;
-
-static const char *plugin_name;
-
-static int ok;
-
-enum RunPhase
-{
-  RP_ERROR = 0,
-  RP_PUT,
-  RP_REP_GET,
-  RP_ZA_GET,
-  RP_EXP_GET,
-  RP_DONE
-};
-
-
-struct CpsRunContext
-{
-  unsigned int i;
-  struct GNUNET_TIME_Absolute start;
-  struct GNUNET_TIME_Absolute end;
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  enum RunPhase phase;
-  unsigned int cnt;
-  unsigned int iter;
-  uint64_t offset;
-};
-
-
-/**
- * Function called by plugins to notify us about a
- * change in their disk utilization.
- *
- * @param cls closure (NULL)
- * @param delta change in disk utilization,
- *        0 for "reset to empty"
- */
-static void
-disk_utilization_change_cb (void *cls, int delta)
-{
-}
-
-
-static void
-test (void *cls);
-
-
-/**
- * Put continuation.
- *
- * @param cls closure
- * @param key key for the item stored
- * @param size size of the item stored
- * @param status #GNUNET_OK or #GNUNET_SYSERROR
- * @param msg error message on error
- */
-static void
-put_continuation (void *cls,
-                  const struct GNUNET_HashCode *key,
-                  uint32_t size,
-                  int status,
-                  const char *msg)
-{
-  struct CpsRunContext *crc = cls;
-
-  if (GNUNET_OK != status)
-  {
-    fprintf (stderr, "ERROR: `%s'\n", msg);
-  }
-  else
-  {
-    stored_bytes += size;
-    stored_ops++;
-    stored_entries++;
-  }
-  GNUNET_SCHEDULER_add_now (&test, crc);
-}
-
-
-static void
-do_put (struct CpsRunContext *crc)
-{
-  char value[65536];
-  size_t size;
-  static struct GNUNET_HashCode key;
-  static int i;
-  unsigned int prio;
-
-  if (0 == i)
-    crc->start = GNUNET_TIME_absolute_get ();
-  if (PUT_10 == i)
-  {
-    i = 0;
-    crc->end = GNUNET_TIME_absolute_get ();
-    {
-      printf ("%s took %s for %llu items\n", "Storing an item",
-              GNUNET_STRINGS_relative_time_to_string (
-                GNUNET_TIME_absolute_get_difference (crc->start,
-                                                     crc
-                                                     ->end),
-                GNUNET_YES),
-              PUT_10);
-      if (PUT_10 > 0)
-        GAUGER (category, "Storing an item",
-                (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
-                / PUT_10,
-                "ms/item");
-    }
-    crc->i++;
-    crc->start = GNUNET_TIME_absolute_get ();
-    crc->phase++;
-    GNUNET_SCHEDULER_add_now (&test, crc);
-    return;
-  }
-  /* most content is 32k */
-  size = 32 * 1024;
-  if (GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 16) == 0)   /* but some of it is less! */
-    size = 8 + GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 32 * 1024);
-  size = size - (size & 7);     /* always multiple of 8 */
-
-  /* generate random key */
-  key.bits[0] = (unsigned int) GNUNET_TIME_absolute_get ().abs_value_us;
-  GNUNET_CRYPTO_hash (&key, sizeof(struct GNUNET_HashCode), &key);
-  memset (value, i, size);
-  if (i > 255)
-    memset (value, i - 255, size / 2);
-  value[0] = crc->i;
-  GNUNET_memcpy (&value[4], &i, sizeof(i));
-  prio = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 100);
-  crc->api->put (crc->api->cls,
-                 &key,
-                 false /* absent */,
-                 size,
-                 value,
-                 1 + i % 4 /* type */,
-                 prio,
-                 i % 4 /* anonymity */,
-                 0 /* replication */,
-                 GNUNET_TIME_relative_to_absolute
-                   (GNUNET_TIME_relative_multiply
-                     (GNUNET_TIME_UNIT_MILLISECONDS,
-                     60 * 60 * 60 * 1000
-                     + GNUNET_CRYPTO_random_u32
-                       (GNUNET_CRYPTO_QUALITY_WEAK, 1000))),
-                 put_continuation,
-                 crc);
-  i++;
-}
-
-
-static int
-iterate_zeros (void *cls,
-               const struct GNUNET_HashCode *key,
-               uint32_t size,
-               const void *data,
-               enum GNUNET_BLOCK_Type type,
-               uint32_t priority,
-               uint32_t anonymity,
-               uint32_t replication,
-               struct GNUNET_TIME_Absolute expiration,
-               uint64_t uid)
-{
-  struct CpsRunContext *crc = cls;
-  int i;
-  const char *cdata = data;
-
-  GNUNET_assert (key != NULL);
-  GNUNET_assert (size >= 8);
-  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
-  hits[i / 8] |= (1 << (i % 8));
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Found result %d type=%u, priority=%u, size=%u, expire=%s\n",
-              i,
-              type, priority, size,
-              GNUNET_STRINGS_absolute_time_to_string (expiration));
-  crc->cnt++;
-  if (crc->cnt == PUT_10 / 4 - 1)
-  {
-    unsigned int bc;
-
-    bc = 0;
-    for (i = 0; i < PUT_10; i++)
-      if (0 != (hits[i / 8] & (1 << (i % 8))))
-        bc++;
-
-    crc->end = GNUNET_TIME_absolute_get ();
-    printf ("%s took %s yielding %u/%u items\n",
-            "Select random zero-anonymity item",
-            GNUNET_STRINGS_relative_time_to_string (
-              GNUNET_TIME_absolute_get_difference (crc->start,
-                                                   crc
-                                                   ->end),
-              GNUNET_YES),
-            bc, crc->cnt);
-    if (crc->cnt > 0)
-      GAUGER (category, "Select random zero-anonymity item",
-              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
-              / crc->cnt,
-              "ms/item");
-    memset (hits, 0, sizeof(hits));
-    crc->phase++;
-    crc->cnt = 0;
-    crc->start = GNUNET_TIME_absolute_get ();
-  }
-  GNUNET_SCHEDULER_add_now (&test, crc);
-  return GNUNET_OK;
-}
-
-
-static int
-expiration_get (void *cls,
-                const struct GNUNET_HashCode *key,
-                uint32_t size,
-                const void *data,
-                enum GNUNET_BLOCK_Type type,
-                uint32_t priority,
-                uint32_t anonymity,
-                uint32_t replication,
-                struct GNUNET_TIME_Absolute expiration,
-                uint64_t uid)
-{
-  struct CpsRunContext *crc = cls;
-  int i;
-  const char *cdata = data;
-
-  GNUNET_assert (size >= 8);
-  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
-  hits[i / 8] |= (1 << (i % 8));
-  crc->cnt++;
-  if (PUT_10 <= crc->cnt)
-  {
-    unsigned int bc;
-
-    bc = 0;
-    for (i = 0; i < PUT_10; i++)
-      if (0 != (hits[i / 8] & (1 << (i % 8))))
-        bc++;
-
-    crc->end = GNUNET_TIME_absolute_get ();
-    printf ("%s took %s yielding %u/%u items\n",
-            "Selecting and deleting by expiration",
-            GNUNET_STRINGS_relative_time_to_string (
-              GNUNET_TIME_absolute_get_difference (crc->start,
-                                                   crc
-                                                   ->end),
-              GNUNET_YES),
-            bc, (unsigned int) PUT_10);
-    if (crc->cnt > 0)
-      GAUGER (category, "Selecting and deleting by expiration",
-              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
-              / crc->cnt,
-              "ms/item");
-    memset (hits, 0, sizeof(hits));
-    if (++crc->iter == ITERATIONS)
-      crc->phase++;
-    else
-      crc->phase = RP_PUT;
-    crc->cnt = 0;
-    crc->start = GNUNET_TIME_absolute_get ();
-  }
-  GNUNET_SCHEDULER_add_now (&test, crc);
-  return GNUNET_NO;
-}
-
-
-static int
-replication_get (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 uint32_t size,
-                 const void *data,
-                 enum GNUNET_BLOCK_Type type,
-                 uint32_t priority,
-                 uint32_t anonymity,
-                 uint32_t replication,
-                 struct GNUNET_TIME_Absolute expiration,
-                 uint64_t uid)
-{
-  struct CpsRunContext *crc = cls;
-  int i;
-  const char *cdata = data;
-
-  GNUNET_assert (NULL != key);
-  GNUNET_assert (size >= 8);
-  GNUNET_memcpy (&i, &cdata[4], sizeof(i));
-  hits[i / 8] |= (1 << (i % 8));
-  crc->cnt++;
-  if (PUT_10 <= crc->cnt)
-  {
-    unsigned int bc;
-
-    bc = 0;
-    for (i = 0; i < PUT_10; i++)
-      if (0 != (hits[i / 8] & (1 << (i % 8))))
-        bc++;
-
-    crc->end = GNUNET_TIME_absolute_get ();
-    printf ("%s took %s yielding %u/%u items\n",
-            "Selecting random item for replication",
-            GNUNET_STRINGS_relative_time_to_string (
-              GNUNET_TIME_absolute_get_difference (crc->start,
-                                                   crc
-                                                   ->end),
-              GNUNET_YES),
-            bc, (unsigned int) PUT_10);
-    if (crc->cnt > 0)
-      GAUGER (category, "Selecting random item for replication",
-              (crc->end.abs_value_us - crc->start.abs_value_us) / 1000LL
-              / crc->cnt,
-              "ms/item");
-    memset (hits, 0, sizeof(hits));
-    crc->phase++;
-    crc->offset = 0;
-    crc->cnt = 0;
-    crc->start = GNUNET_TIME_absolute_get ();
-  }
-
-  GNUNET_SCHEDULER_add_now (&test, crc);
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called when the service shuts
- * down.  Unloads our datastore plugin.
- *
- * @param api api to unload
- * @param cfg configuration to use
- */
-static void
-unload_plugin (struct GNUNET_DATASTORE_PluginFunctions *api,
-               const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  char *name;
-  char *libname;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, "DATASTORE", "DATABASE",
-                                             &name))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("No `%s' specified for `%s' in configuration!\n"),
-                "DATABASE",
-                "DATASTORE");
-    return;
-  }
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
-  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
-  GNUNET_free (libname);
-  GNUNET_free (name);
-}
-
-
-/**
- * Last task run during shutdown.  Disconnects us from
- * the transport and core.
- */
-static void
-cleaning_task (void *cls)
-{
-  struct CpsRunContext *crc = cls;
-
-  unload_plugin (crc->api, crc->cfg);
-  GNUNET_free (crc);
-}
-
-
-static void
-test (void *cls)
-{
-  struct CpsRunContext *crc = cls;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "In phase %d, iteration %u\n", crc->phase, crc->cnt);
-  switch (crc->phase)
-  {
-  case RP_ERROR:
-    GNUNET_break (0);
-    crc->api->drop (crc->api->cls);
-    ok = 1;
-    GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_IDLE,
-                                        &cleaning_task, crc);
-    break;
-
-  case RP_PUT:
-    do_put (crc);
-    break;
-
-  case RP_REP_GET:
-    crc->api->get_replication (crc->api->cls, &replication_get, crc);
-    break;
-
-  case RP_ZA_GET:
-    crc->api->get_zero_anonymity (crc->api->cls, crc->offset++, 1,
-                                  &iterate_zeros, crc);
-    break;
-
-  case RP_EXP_GET:
-    crc->api->get_expiration (crc->api->cls, &expiration_get, crc);
-    break;
-
-  case RP_DONE:
-    crc->api->drop (crc->api->cls);
-    ok = 0;
-    GNUNET_SCHEDULER_add_with_priority (GNUNET_SCHEDULER_PRIORITY_IDLE,
-                                        &cleaning_task, crc);
-    break;
-  }
-}
-
-
-/**
- * Load the datastore plugin.
- */
-static struct GNUNET_DATASTORE_PluginFunctions *
-load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  static struct GNUNET_DATASTORE_PluginEnvironment env;
-  struct GNUNET_DATASTORE_PluginFunctions *ret;
-  char *name;
-  char *libname;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, "DATASTORE", "DATABASE",
-                                             &name))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("No `%s' specified for `%s' in configuration!\n"),
-                "DATABASE",
-                "DATASTORE");
-    return NULL;
-  }
-  env.cfg = cfg;
-  env.duc = &disk_utilization_change_cb;
-  env.cls = NULL;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datastore plugin\n"),
-              name);
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
-  if (NULL == (ret = GNUNET_PLUGIN_load (libname, &env)))
-  {
-    fprintf (stderr, "Failed to load plugin `%s'!\n", name);
-    GNUNET_free (name);
-    GNUNET_free (libname);
-    return NULL;
-  }
-  GNUNET_free (libname);
-  GNUNET_free (name);
-  return ret;
-}
-
-
-static void
-run (void *cls, char *const *args, const char *cfgfile,
-     const struct GNUNET_CONFIGURATION_Handle *c)
-{
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  struct CpsRunContext *crc;
-
-  if (NULL == c)
-  {
-    GNUNET_break (0);
-    return;
-  }
-  api = load_plugin (c);
-  if (api == NULL)
-  {
-    fprintf (stderr,
-             "%s",
-             "Could not initialize plugin, assuming database not configured. Test not run!\n");
-    return;
-  }
-  crc = GNUNET_new (struct CpsRunContext);
-  crc->api = api;
-  crc->cfg = c;
-  crc->phase = RP_PUT;
-  ok = 2;
-  GNUNET_SCHEDULER_add_now (&test, crc);
-}
-
-
-int
-main (int argc, char *argv[])
-{
-  char dir_name[PATH_MAX];
-  char cfg_name[PATH_MAX];
-  char *const xargv[] = {
-    "perf-plugin-datastore",
-    "-c",
-    cfg_name,
-    NULL
-  };
-  struct GNUNET_GETOPT_CommandLineOption options[] = {
-    GNUNET_GETOPT_OPTION_END
-  };
-
-  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
-  GNUNET_snprintf (dir_name, sizeof(dir_name), "/tmp/perf-gnunet-datastore-%s",
-                   plugin_name);
-  GNUNET_DISK_directory_remove (dir_name);
-  GNUNET_log_setup ("perf-plugin-datastore",
-                    "WARNING",
-                    NULL);
-  GNUNET_snprintf (category, sizeof(category), "DATASTORE-%s", plugin_name);
-  GNUNET_snprintf (cfg_name, sizeof(cfg_name),
-                   "perf_plugin_datastore_data_%s.conf", plugin_name);
-  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1, xargv,
-                      "perf-plugin-datastore", "nohelp", options, &run, NULL);
-  if (ok != 0)
-    fprintf (stderr, "Missed some testcases: %u\n", ok);
-  GNUNET_DISK_directory_remove (dir_name);
-
-  return ok;
-}
-
-
-/* end of perf_plugin_datastore.c */
diff --git a/src/service/datastore/perf_plugin_datastore_data_heap.conf b/src/service/datastore/perf_plugin_datastore_data_heap.conf
deleted file mode 100644
index 873cf9606..000000000
--- a/src/service/datastore/perf_plugin_datastore_data_heap.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-heap/
-
-
-[datastore]
-DATABASE = heap
diff --git a/src/service/datastore/perf_plugin_datastore_data_postgres.conf b/src/service/datastore/perf_plugin_datastore_data_postgres.conf
deleted file mode 100644
index 7683887a8..000000000
--- a/src/service/datastore/perf_plugin_datastore_data_postgres.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-postgres/
-
-[datastore]
-DATABASE = postgres
-
-[datastore-postgres]
-CONFIG = dbname=gnunetcheck
-
diff --git a/src/service/datastore/perf_plugin_datastore_data_sqlite.conf b/src/service/datastore/perf_plugin_datastore_data_sqlite.conf
deleted file mode 100644
index 888e020a6..000000000
--- a/src/service/datastore/perf_plugin_datastore_data_sqlite.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/perf-gnunet-datastore-sqlite/
-
diff --git a/src/service/datastore/plugin_datastore_heap.c b/src/service/datastore/plugin_datastore_heap.c
deleted file mode 100644
index a827a2763..000000000
--- a/src/service/datastore/plugin_datastore_heap.c
+++ /dev/null
@@ -1,944 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2012 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datastore/plugin_datastore_heap.c
- * @brief heap-based datastore backend; usually we want the datastore
- *        to be persistent, and storing data in the heap is obviously
- *        NOT going to be persistent; still, this plugin is useful for
- *        testing/benchmarking --- but never for production!
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_datastore_plugin.h"
-
-
-/**
- * A value that we are storing.
- */
-struct Value
-{
-  /**
-   * Key for the value.
-   */
-  struct GNUNET_HashCode key;
-
-  /**
-   * Pointer to the value's data (allocated at the end of this struct).
-   */
-  const void *data;
-
-  /**
-   * Entry for this value in the 'expire' heap.
-   */
-  struct GNUNET_CONTAINER_HeapNode *expire_heap;
-
-  /**
-   * Entry for this value in the 'replication' heap.
-   */
-  struct GNUNET_CONTAINER_HeapNode *replication_heap;
-
-  /**
-   * Expiration time for this value.
-   */
-  struct GNUNET_TIME_Absolute expiration;
-
-  /**
-   * Offset of this value in the array of the 'struct ZeroAnonByType';
-   * only used if anonymity is zero.
-   */
-  unsigned int zero_anon_offset;
-
-  /**
-   * Number of bytes in 'data'.
-   */
-  uint32_t size;
-
-  /**
-   * Priority of the value.
-   */
-  uint32_t priority;
-
-  /**
-   * Anonymity level for the value.
-   */
-  uint32_t anonymity;
-
-  /**
-   * Replication level for the value.
-   */
-  uint32_t replication;
-
-  /**
-   * Type of 'data'.
-   */
-  enum GNUNET_BLOCK_Type type;
-};
-
-
-/**
- * We organize 0-anonymity values in arrays "by type".
- */
-struct ZeroAnonByType
-{
-  /**
-   * We keep these in a DLL.
-   */
-  struct ZeroAnonByType *next;
-
-  /**
-   * We keep these in a DLL.
-   */
-  struct ZeroAnonByType *prev;
-
-  /**
-   * Array of 0-anonymity items of the given type.
-   */
-  struct Value **array;
-
-  /**
-   * Allocated size of the array.
-   */
-  unsigned int array_size;
-
-  /**
-   * First unused offset in 'array'.
-   */
-  unsigned int array_pos;
-
-  /**
-   * Type of all of the values in 'array'.
-   */
-  enum GNUNET_BLOCK_Type type;
-};
-
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATASTORE_PluginEnvironment *env;
-
-  /**
-   * Mapping from keys to 'struct Value's.
-   */
-  struct GNUNET_CONTAINER_MultiHashMap *keyvalue;
-
-  /**
-   * Heap organized by minimum expiration time.
-   */
-  struct GNUNET_CONTAINER_Heap *by_expiration;
-
-  /**
-   * Heap organized by maximum replication value.
-   */
-  struct GNUNET_CONTAINER_Heap *by_replication;
-
-  /**
-   * Head of list of arrays containing zero-anonymity values by type.
-   */
-  struct ZeroAnonByType *zero_head;
-
-  /**
-   * Tail of list of arrays containing zero-anonymity values by type.
-   */
-  struct ZeroAnonByType *zero_tail;
-
-  /**
-   * Size of all values we're storing.
-   */
-  unsigned long long size;
-};
-
-
-/**
- * Get an estimate of how much space the database is
- * currently using.
- *
- * @param cls our "struct Plugin*"
- * @return number of bytes used on disk
- */
-static void
-heap_plugin_estimate_size (void *cls, unsigned long long *estimate)
-{
-  struct Plugin *plugin = cls;
-
-  if (NULL != estimate)
-    *estimate = plugin->size;
-}
-
-
-/**
- * Closure for iterator for updating.
- */
-struct UpdateContext
-{
-  /**
-   * Number of bytes in 'data'.
-   */
-  uint32_t size;
-
-  /**
-   * Pointer to the data.
-   */
-  const void *data;
-
-  /**
-   * Priority of the value.
-   */
-  uint32_t priority;
-
-  /**
-   * Replication level for the value.
-   */
-  uint32_t replication;
-
-  /**
-   * Expiration time for this value.
-   */
-  struct GNUNET_TIME_Absolute expiration;
-
-  /**
-   * True if the value was found and updated.
-   */
-  bool updated;
-};
-
-
-/**
- * Update the matching value.
- *
- * @param cls the 'struct UpdateContext'
- * @param key unused
- * @param val the 'struct Value'
- * @return GNUNET_YES (continue iteration), GNUNET_NO if value was found
- */
-static int
-update_iterator (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 void *val)
-{
-  struct UpdateContext *uc = cls;
-  struct Value *value = val;
-
-  if (value->size != uc->size)
-    return GNUNET_YES;
-  if (0 != memcmp (value->data, uc->data, uc->size))
-    return GNUNET_YES;
-  uc->expiration = GNUNET_TIME_absolute_max (value->expiration,
-                                             uc->expiration);
-  if (value->expiration.abs_value_us != uc->expiration.abs_value_us)
-  {
-    value->expiration = uc->expiration;
-    GNUNET_CONTAINER_heap_update_cost (value->expire_heap,
-                                       value->expiration.abs_value_us);
-  }
-  /* Saturating adds, don't overflow */
-  if (value->priority > UINT32_MAX - uc->priority)
-    value->priority = UINT32_MAX;
-  else
-    value->priority += uc->priority;
-  if (value->replication > UINT32_MAX - uc->replication)
-    value->replication = UINT32_MAX;
-  else
-    value->replication += uc->replication;
-  uc->updated = true;
-  return GNUNET_NO;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure
- * @param key key for the item
- * @param absent true if the key was not found in the bloom filter
- * @param size number of bytes in data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure
- */
-static void
-heap_plugin_put (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 bool absent,
-                 uint32_t size,
-                 const void *data,
-                 enum GNUNET_BLOCK_Type type,
-                 uint32_t priority,
-                 uint32_t anonymity,
-                 uint32_t replication,
-                 struct GNUNET_TIME_Absolute expiration,
-                 PluginPutCont cont,
-                 void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct Value *value;
-
-  if (! absent)
-  {
-    struct UpdateContext uc;
-
-    uc.size = size;
-    uc.data = data;
-    uc.priority = priority;
-    uc.replication = replication;
-    uc.expiration = expiration;
-    uc.updated = false;
-    GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
-                                                key,
-                                                &update_iterator,
-                                                &uc);
-    if (uc.updated)
-    {
-      cont (cont_cls, key, size, GNUNET_NO, NULL);
-      return;
-    }
-  }
-  value = GNUNET_malloc (sizeof(struct Value) + size);
-  value->key = *key;
-  value->data = &value[1];
-  value->expire_heap = GNUNET_CONTAINER_heap_insert (plugin->by_expiration,
-                                                     value,
-                                                     expiration.abs_value_us);
-  value->replication_heap = GNUNET_CONTAINER_heap_insert (
-    plugin->by_replication,
-    value,
-    replication);
-  value->expiration = expiration;
-  if (0 == anonymity)
-  {
-    struct ZeroAnonByType *zabt;
-
-    for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
-      if (zabt->type == type)
-        break;
-    if (NULL == zabt)
-    {
-      zabt = GNUNET_new (struct ZeroAnonByType);
-      zabt->type = type;
-      GNUNET_CONTAINER_DLL_insert (plugin->zero_head,
-                                   plugin->zero_tail,
-                                   zabt);
-    }
-    if (zabt->array_size == zabt->array_pos)
-    {
-      GNUNET_array_grow (zabt->array,
-                         zabt->array_size,
-                         zabt->array_size * 2 + 4);
-    }
-    value->zero_anon_offset = zabt->array_pos;
-    zabt->array[zabt->array_pos++] = value;
-  }
-  value->size = size;
-  value->priority = priority;
-  value->anonymity = anonymity;
-  value->replication = replication;
-  value->type = type;
-  GNUNET_memcpy (&value[1], data, size);
-  GNUNET_CONTAINER_multihashmap_put (plugin->keyvalue,
-                                     &value->key,
-                                     value,
-                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-  plugin->size += size;
-  cont (cont_cls, key, size, GNUNET_OK, NULL);
-}
-
-
-/**
- * Delete the given value, removing it from the plugin's data
- * structures.
- *
- * @param plugin the plugin
- * @param value value to delete
- */
-static void
-delete_value (struct Plugin *plugin,
-              struct Value *value)
-{
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CONTAINER_multihashmap_remove (plugin->keyvalue,
-                                                       &value->key,
-                                                       value));
-  GNUNET_assert (value == GNUNET_CONTAINER_heap_remove_node (
-                   value->expire_heap));
-  GNUNET_assert (value == GNUNET_CONTAINER_heap_remove_node (
-                   value->replication_heap));
-  if (0 == value->anonymity)
-  {
-    struct ZeroAnonByType *zabt;
-
-    for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
-      if (zabt->type == value->type)
-        break;
-    GNUNET_assert (NULL != zabt);
-    zabt->array[value->zero_anon_offset] = zabt->array[--zabt->array_pos];
-    zabt->array[value->zero_anon_offset]->zero_anon_offset =
-      value->zero_anon_offset;
-    if (0 == zabt->array_pos)
-    {
-      GNUNET_array_grow (zabt->array,
-                         zabt->array_size,
-                         0);
-      GNUNET_CONTAINER_DLL_remove (plugin->zero_head,
-                                   plugin->zero_tail,
-                                   zabt);
-      GNUNET_free (zabt);
-    }
-  }
-  plugin->size -= value->size;
-  GNUNET_free (value);
-}
-
-
-/**
- * Closure for iterator called during 'get_key'.
- */
-struct GetContext
-{
-  /**
-   * Lowest uid to consider.
-   */
-  uint64_t next_uid;
-
-  /**
-   * Value with lowest uid >= next_uid found so far.
-   */
-  struct Value *value;
-
-  /**
-   * Requested type.
-   */
-  enum GNUNET_BLOCK_Type type;
-
-  /**
-   * If true, return a random value
-   */
-  bool random;
-};
-
-
-/**
- * Obtain the matching value with the lowest uid >= next_uid.
- *
- * @param cls the 'struct GetContext'
- * @param key unused
- * @param val the 'struct Value'
- * @return GNUNET_YES (continue iteration), GNUNET_NO if result was found
- */
-static int
-get_iterator (void *cls,
-              const struct GNUNET_HashCode *key,
-              void *val)
-{
-  struct GetContext *gc = cls;
-  struct Value *value = val;
-
-  if ((gc->type != GNUNET_BLOCK_TYPE_ANY) &&
-      (gc->type != value->type))
-    return GNUNET_OK;
-  if (gc->random)
-  {
-    gc->value = value;
-    return GNUNET_NO;
-  }
-  if ((uint64_t) (intptr_t) value < gc->next_uid)
-    return GNUNET_OK;
-  if ((NULL != gc->value) &&
-      (value > gc->value))
-    return GNUNET_OK;
-  gc->value = value;
-  return GNUNET_OK;
-}
-
-
-/**
- * Get one of the results for a particular key in the datastore.
- *
- * @param cls closure
- * @param next_uid return the result with lowest uid >= next_uid
- * @param random if true, return a random result instead of using next_uid
- * @param key maybe NULL (to match all entries)
- * @param type entries of which type are relevant?
- *     Use 0 for any type.
- * @param proc function to call on the matching value;
- *        will be called with NULL if nothing matches
- * @param proc_cls closure for @a proc
- */
-static void
-heap_plugin_get_key (void *cls,
-                     uint64_t next_uid,
-                     bool random,
-                     const struct GNUNET_HashCode *key,
-                     enum GNUNET_BLOCK_Type type,
-                     PluginDatumProcessor proc,
-                     void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GetContext gc;
-
-  gc.value = NULL;
-  gc.next_uid = next_uid;
-  gc.random = random;
-  gc.type = type;
-  if (NULL == key)
-  {
-    GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
-                                           &get_iterator,
-                                           &gc);
-  }
-  else
-  {
-    GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
-                                                key,
-                                                &get_iterator,
-                                                &gc);
-  }
-  if (NULL == gc.value)
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  GNUNET_assert (GNUNET_OK ==
-                 proc (proc_cls,
-                       &gc.value->key,
-                       gc.value->size,
-                       &gc.value[1],
-                       gc.value->type,
-                       gc.value->priority,
-                       gc.value->anonymity,
-                       gc.value->replication,
-                       gc.value->expiration,
-                       (uint64_t) (intptr_t) gc.value));
-}
-
-
-/**
- * Get a random item for replication.  Returns a single, not expired,
- * random item from those with the highest replication counters.  The
- * item's replication counter is decremented by one IF it was positive
- * before.  Call 'proc' with all values ZERO or NULL if the datastore
- * is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for proc
- */
-static void
-heap_plugin_get_replication (void *cls,
-                             PluginDatumProcessor proc,
-                             void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct Value *value;
-
-  value = GNUNET_CONTAINER_heap_remove_root (plugin->by_replication);
-  if (NULL == value)
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  if (value->replication > 0)
-  {
-    value->replication--;
-    value->replication_heap = GNUNET_CONTAINER_heap_insert (
-      plugin->by_replication,
-      value,
-      value->replication);
-  }
-  else
-  {
-    /* need a better way to pick a random item, replication level is always 0 */
-    value->replication_heap = GNUNET_CONTAINER_heap_insert (
-      plugin->by_replication,
-      value,
-      value->replication);
-    value = GNUNET_CONTAINER_heap_walk_get_next (plugin->by_replication);
-  }
-  GNUNET_assert (GNUNET_OK ==
-                 proc (proc_cls,
-                       &value->key,
-                       value->size,
-                       &value[1],
-                       value->type,
-                       value->priority,
-                       value->anonymity,
-                       value->replication,
-                       value->expiration,
-                       (uint64_t) (intptr_t) value));
-}
-
-
-/**
- * Get a random item for expiration.  Call 'proc' with all values ZERO
- * or NULL if the datastore is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for proc
- */
-static void
-heap_plugin_get_expiration (void *cls, PluginDatumProcessor proc,
-                            void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct Value *value;
-
-  value = GNUNET_CONTAINER_heap_peek (plugin->by_expiration);
-  if (NULL == value)
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  if (GNUNET_NO ==
-      proc (proc_cls,
-            &value->key,
-            value->size,
-            &value[1],
-            value->type,
-            value->priority,
-            value->anonymity,
-            value->replication,
-            value->expiration,
-            (uint64_t) (intptr_t) value))
-    delete_value (plugin, value);
-}
-
-
-/**
- * Call the given processor on an item with zero anonymity.
- *
- * @param cls our "struct Plugin*"
- * @param next_uid return the result with lowest uid >= next_uid
- * @param type entries of which type should be considered?
- *        Must not be zero (ANY).
- * @param proc function to call on each matching value;
- *        will be called with NULL if no value matches
- * @param proc_cls closure for proc
- */
-static void
-heap_plugin_get_zero_anonymity (void *cls, uint64_t next_uid,
-                                enum GNUNET_BLOCK_Type type,
-                                PluginDatumProcessor proc, void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct ZeroAnonByType *zabt;
-  struct Value *value = NULL;
-
-  for (zabt = plugin->zero_head; NULL != zabt; zabt = zabt->next)
-  {
-    if ((type != GNUNET_BLOCK_TYPE_ANY) &&
-        (type != zabt->type))
-      continue;
-    for (int i = 0; i < zabt->array_pos; ++i)
-    {
-      if ((uint64_t) (intptr_t) zabt->array[i] < next_uid)
-        continue;
-      if ((NULL != value) &&
-          (zabt->array[i] > value))
-        continue;
-      value = zabt->array[i];
-    }
-  }
-  if (NULL == value)
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  GNUNET_assert (GNUNET_OK ==
-                 proc (proc_cls,
-                       &value->key,
-                       value->size,
-                       &value[1],
-                       value->type,
-                       value->priority,
-                       value->anonymity,
-                       value->replication,
-                       value->expiration,
-                       (uint64_t) (intptr_t) value));
-}
-
-
-/**
- * Drop database.
- */
-static void
-heap_plugin_drop (void *cls)
-{
-  /* nothing needs to be done */
-}
-
-
-/**
- * Closure for the 'return_value' function.
- */
-struct GetAllContext
-{
-  /**
-   * Function to call.
-   */
-  PluginKeyProcessor proc;
-
-  /**
-   * Closure for 'proc'.
-   */
-  void *proc_cls;
-};
-
-
-/**
- * Callback invoked to call callback on each value.
- *
- * @param cls the plugin
- * @param key unused
- * @param val the value
- * @return GNUNET_OK (continue to iterate)
- */
-static int
-return_value (void *cls,
-              const struct GNUNET_HashCode *key,
-              void *val)
-{
-  struct GetAllContext *gac = cls;
-
-  gac->proc (gac->proc_cls,
-             key,
-             1);
-  return GNUNET_OK;
-}
-
-
-/**
- * Get all of the keys in the datastore.
- *
- * @param cls closure
- * @param proc function to call on each key
- * @param proc_cls closure for proc
- */
-static void
-heap_get_keys (void *cls,
-               PluginKeyProcessor proc,
-               void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GetAllContext gac;
-
-  gac.proc = proc;
-  gac.proc_cls = proc_cls;
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
-                                         &return_value,
-                                         &gac);
-  proc (proc_cls, NULL, 0);
-}
-
-
-/**
- * Closure for iterator called during 'remove_key'.
- */
-struct RemoveContext
-{
-  /**
-   * Value found.
-   */
-  struct Value *value;
-
-  /**
-   * Size of data.
-   */
-  uint32_t size;
-
-  /**
-   * Data to remove.
-   */
-  const void *data;
-};
-
-
-/**
- * Obtain the matching value with the lowest uid >= next_uid.
- *
- * @param cls the 'struct GetContext'
- * @param key unused
- * @param val the 'struct Value'
- * @return GNUNET_YES (continue iteration), GNUNET_NO if result was found
- */
-static int
-remove_iterator (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 void *val)
-{
-  struct RemoveContext *rc = cls;
-  struct Value *value = val;
-
-  if (value->size != rc->size)
-    return GNUNET_YES;
-  if (0 != memcmp (value->data, rc->data, rc->size))
-    return GNUNET_YES;
-  rc->value = value;
-  return GNUNET_NO;
-}
-
-
-/**
- * Remove a particular key in the datastore.
- *
- * @param cls closure
- * @param key key for the content
- * @param size number of bytes in data
- * @param data content stored
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure for @a cont
- */
-static void
-heap_plugin_remove_key (void *cls,
-                        const struct GNUNET_HashCode *key,
-                        uint32_t size,
-                        const void *data,
-                        PluginRemoveCont cont,
-                        void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct RemoveContext rc;
-
-  rc.value = NULL;
-  rc.size = size;
-  rc.data = data;
-  GNUNET_CONTAINER_multihashmap_get_multiple (plugin->keyvalue,
-                                              key,
-                                              &remove_iterator,
-                                              &rc);
-  if (NULL == rc.value)
-  {
-    cont (cont_cls,
-          key,
-          size,
-          GNUNET_NO,
-          NULL);
-    return;
-  }
-  delete_value (plugin,
-                rc.value);
-  cont (cont_cls,
-        key,
-        size,
-        GNUNET_OK,
-        NULL);
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls the "struct GNUNET_DATASTORE_PluginEnvironment*"
- * @return our "struct Plugin*"
- */
-void *
-libgnunet_plugin_datastore_heap_init (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  struct Plugin *plugin;
-  unsigned long long esize;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_number (env->cfg,
-                                             "datastore-heap",
-                                             "HASHMAPSIZE",
-                                             &esize))
-    esize = 128 * 1024;
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-  plugin->keyvalue = GNUNET_CONTAINER_multihashmap_create (esize, GNUNET_YES);
-  plugin->by_expiration = GNUNET_CONTAINER_heap_create (
-    GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  plugin->by_replication = GNUNET_CONTAINER_heap_create (
-    GNUNET_CONTAINER_HEAP_ORDER_MAX);
-  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
-  api->cls = plugin;
-  api->estimate_size = &heap_plugin_estimate_size;
-  api->put = &heap_plugin_put;
-  api->get_key = &heap_plugin_get_key;
-  api->get_replication = &heap_plugin_get_replication;
-  api->get_expiration = &heap_plugin_get_expiration;
-  api->get_zero_anonymity = &heap_plugin_get_zero_anonymity;
-  api->drop = &heap_plugin_drop;
-  api->get_keys = &heap_get_keys;
-  api->remove_key = &heap_plugin_remove_key;
-  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "heap",
-                   _ ("Heap database running\n"));
-  return api;
-}
-
-
-/**
- * Callback invoked to free all value.
- *
- * @param cls the plugin
- * @param key unused
- * @param val the value
- * @return GNUNET_OK (continue to iterate)
- */
-static int
-free_value (void *cls,
-            const struct GNUNET_HashCode *key,
-            void *val)
-{
-  struct Plugin *plugin = cls;
-  struct Value *value = val;
-
-  delete_value (plugin, value);
-  return GNUNET_OK;
-}
-
-
-/**
- * Exit point from the plugin.
- * @param cls our "struct Plugin*"
- * @return always NULL
- */
-void *
-libgnunet_plugin_datastore_heap_done (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->keyvalue,
-                                         &free_value,
-                                         plugin);
-  GNUNET_CONTAINER_multihashmap_destroy (plugin->keyvalue);
-  GNUNET_CONTAINER_heap_destroy (plugin->by_expiration);
-  GNUNET_CONTAINER_heap_destroy (plugin->by_replication);
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datastore_heap.c */
diff --git a/src/service/datastore/plugin_datastore_postgres.c b/src/service/datastore/plugin_datastore_postgres.c
deleted file mode 100644
index 5fcacc17b..000000000
--- a/src/service/datastore/plugin_datastore_postgres.c
+++ /dev/null
@@ -1,930 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2009-2017, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datastore/plugin_datastore_postgres.c
- * @brief postgres-based datastore backend
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_datastore_plugin.h"
-#include "gnunet_pq_lib.h"
-
-
-/**
- * After how many ms "busy" should a DB operation fail for good?
- * A low value makes sure that we are more responsive to requests
- * (especially PUTs).  A high value guarantees a higher success
- * rate (SELECTs in iterate can take several seconds despite LIMIT=1).
- *
- * The default value of 1s should ensure that users do not experience
- * huge latencies while at the same time allowing operations to succeed
- * with reasonable probability.
- */
-#define BUSY_TIMEOUT GNUNET_TIME_UNIT_SECONDS
-
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATASTORE_PluginEnvironment *env;
-
-  /**
-   * Native Postgres database handle.
-   */
-  struct GNUNET_PQ_Context *dbh;
-};
-
-
-/**
- * @brief Get a database handle
- *
- * @param plugin global context
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-static enum GNUNET_GenericReturnValue
-init_connection (struct Plugin *plugin)
-{
-#define RESULT_COLUMNS "repl, type, prio, anonLevel, expire, hash, value, oid"
-  struct GNUNET_PQ_PreparedStatement ps[] = {
-    GNUNET_PQ_make_prepare ("get",
-                            "SELECT " RESULT_COLUMNS
-                            " FROM datastore.gn090"
-                            " WHERE oid >= $1::bigint AND"
-                            " (rvalue >= $2 OR 0 = $3::smallint) AND"
-                            " (hash = $4 OR 0 = $5::smallint) AND"
-                            " (type = $6 OR 0 = $7::smallint)"
-                            " ORDER BY oid ASC LIMIT 1"),
-    GNUNET_PQ_make_prepare ("put",
-                            "INSERT INTO datastore.gn090"
-                            " (repl, type, prio, anonLevel, expire, rvalue, hash, vhash, value) "
-                            "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)"),
-    GNUNET_PQ_make_prepare ("update",
-                            "UPDATE datastore.gn090"
-                            " SET prio = prio + $1,"
-                            " repl = repl + $2,"
-                            " expire = GREATEST(expire, $3)"
-                            " WHERE hash = $4 AND vhash = $5"),
-    GNUNET_PQ_make_prepare ("decrepl",
-                            "UPDATE datastore.gn090"
-                            " SET repl = GREATEST (repl - 1, 0)"
-                            " WHERE oid = $1"),
-    GNUNET_PQ_make_prepare ("select_non_anonymous",
-                            "SELECT " RESULT_COLUMNS
-                            " FROM datastore.gn090"
-                            " WHERE anonLevel = 0 AND type = $1 AND oid >= $2::bigint"
-                            " ORDER BY oid ASC LIMIT 1"),
-    GNUNET_PQ_make_prepare ("select_expiration_order",
-                            "(SELECT " RESULT_COLUMNS
-                            " FROM datastore.gn090"
-                            " WHERE expire < $1 ORDER BY prio ASC LIMIT 1) "
-                            "UNION "
-                            "(SELECT " RESULT_COLUMNS
-                            " FROM datastore.gn090"
-                            " ORDER BY prio ASC LIMIT 1)"
-                            " ORDER BY expire ASC LIMIT 1"),
-    GNUNET_PQ_make_prepare ("select_replication_order",
-                            "SELECT " RESULT_COLUMNS
-                            " FROM datastore.gn090"
-                            " ORDER BY repl DESC,RANDOM() LIMIT 1"),
-    GNUNET_PQ_make_prepare ("delrow",
-                            "DELETE FROM datastore.gn090"
-                            " WHERE oid=$1"),
-    GNUNET_PQ_make_prepare ("remove",
-                            "DELETE FROM datastore.gn090"
-                            " WHERE hash = $1 AND"
-                            " value = $2"),
-    GNUNET_PQ_make_prepare ("get_keys",
-                            "SELECT hash"
-                            " FROM datastore.gn090"),
-    GNUNET_PQ_make_prepare ("estimate_size",
-                            "SELECT CASE WHEN NOT EXISTS"
-                            "  (SELECT 1 FROM datastore.gn090)"
-                            "  THEN 0"
-                            "  ELSE (SELECT SUM(LENGTH(value))+256*COUNT(*)"
-                            "        FROM datastore.gn090)"
-                            "END AS total"),
-    GNUNET_PQ_PREPARED_STATEMENT_END
-  };
-#undef RESULT_COLUMNS
-
-  plugin->dbh = GNUNET_PQ_connect_with_cfg (plugin->env->cfg,
-                                            "datastore-postgres",
-                                            "datastore-",
-                                            NULL,
-                                            ps);
-  if (NULL == plugin->dbh)
-    return GNUNET_SYSERR;
-  return GNUNET_OK;
-}
-
-
-/**
- * Get an estimate of how much space the database is
- * currently using.
- *
- * @param cls our `struct Plugin *`
- * @return number of bytes used on disk
- */
-static void
-postgres_plugin_estimate_size (void *cls,
-                               unsigned long long *estimate)
-{
-  struct Plugin *plugin = cls;
-  uint64_t total;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_uint64 ("total",
-                                  &total),
-    GNUNET_PQ_result_spec_end
-  };
-  enum GNUNET_DB_QueryStatus ret;
-
-  if (NULL == estimate)
-    return;
-  ret = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
-                                                  "estimate_size",
-                                                  params,
-                                                  rs);
-  if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT != ret)
-  {
-    *estimate = 0LL;
-    return;
-  }
-  *estimate = total;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure with the `struct Plugin`
- * @param key key for the item
- * @param absent true if the key was not found in the bloom filter
- * @param size number of bytes in data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure
- */
-static void
-postgres_plugin_put (void *cls,
-                     const struct GNUNET_HashCode *key,
-                     bool absent,
-                     uint32_t size,
-                     const void *data,
-                     enum GNUNET_BLOCK_Type type,
-                     uint32_t priority,
-                     uint32_t anonymity,
-                     uint32_t replication,
-                     struct GNUNET_TIME_Absolute expiration,
-                     PluginPutCont cont,
-                     void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_HashCode vhash;
-  enum GNUNET_DB_QueryStatus ret;
-
-  GNUNET_CRYPTO_hash (data,
-                      size,
-                      &vhash);
-  if (! absent)
-  {
-    struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_uint32 (&priority),
-      GNUNET_PQ_query_param_uint32 (&replication),
-      GNUNET_PQ_query_param_absolute_time (&expiration),
-      GNUNET_PQ_query_param_auto_from_type (key),
-      GNUNET_PQ_query_param_auto_from_type (&vhash),
-      GNUNET_PQ_query_param_end
-    };
-    ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                              "update",
-                                              params);
-    if (0 > ret)
-    {
-      cont (cont_cls,
-            key,
-            size,
-            GNUNET_SYSERR,
-            _ ("Postgresql exec failure"));
-      return;
-    }
-    bool affected = (0 != ret);
-    if (affected)
-    {
-      cont (cont_cls,
-            key,
-            size,
-            GNUNET_NO,
-            NULL);
-      return;
-    }
-  }
-
-  {
-    uint32_t utype = (uint32_t) type;
-    uint64_t rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                                UINT64_MAX);
-    struct GNUNET_PQ_QueryParam params[] = {
-      GNUNET_PQ_query_param_uint32 (&replication),
-      GNUNET_PQ_query_param_uint32 (&utype),
-      GNUNET_PQ_query_param_uint32 (&priority),
-      GNUNET_PQ_query_param_uint32 (&anonymity),
-      GNUNET_PQ_query_param_absolute_time (&expiration),
-      GNUNET_PQ_query_param_uint64 (&rvalue),
-      GNUNET_PQ_query_param_auto_from_type (key),
-      GNUNET_PQ_query_param_auto_from_type (&vhash),
-      GNUNET_PQ_query_param_fixed_size (data, size),
-      GNUNET_PQ_query_param_end
-    };
-
-    ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                              "put",
-                                              params);
-    if (0 > ret)
-    {
-      cont (cont_cls,
-            key,
-            size,
-            GNUNET_SYSERR,
-            "Postgresql exec failure");
-      return;
-    }
-  }
-  plugin->env->duc (plugin->env->cls,
-                    size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
-  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                   "datastore-postgres",
-                   "Stored %u bytes in database\n",
-                   (unsigned int) size);
-  cont (cont_cls,
-        key,
-        size,
-        GNUNET_OK,
-        NULL);
-}
-
-
-/**
- * Closure for #process_result.
- */
-struct ProcessResultContext
-{
-  /**
-   * The plugin handle.
-   */
-  struct Plugin *plugin;
-
-  /**
-   * Function to call on each result.
-   */
-  PluginDatumProcessor proc;
-
-  /**
-   * Closure for @e proc.
-   */
-  void *proc_cls;
-};
-
-
-/**
- * Function invoked to process the result and call the processor of @a
- * cls.
- *
- * @param cls our `struct ProcessResultContext`
- * @param res result from exec
- * @param num_results number of results in @a res
- */
-static void
-process_result (void *cls,
-                PGresult *res,
-                unsigned int num_results)
-{
-  struct ProcessResultContext *prc = cls;
-  struct Plugin *plugin = prc->plugin;
-
-  if (0 == num_results)
-  {
-    /* no result */
-    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                     "datastore-postgres",
-                     "Ending iteration (no more results)\n");
-    prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-               GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  if (1 != num_results)
-  {
-    GNUNET_break (0);
-    prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-               GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  /* Technically we don't need the loop here, but nicer in case
-     we ever relax the condition above. */
-  for (unsigned int i = 0; i < num_results; i++)
-  {
-    int iret;
-    uint64_t rowid;
-    uint32_t utype;
-    uint32_t anonymity;
-    uint32_t replication;
-    uint32_t priority;
-    size_t size;
-    void *data;
-    struct GNUNET_TIME_Absolute expiration_time;
-    struct GNUNET_HashCode key;
-    struct GNUNET_PQ_ResultSpec rs[] = {
-      GNUNET_PQ_result_spec_uint32 ("repl", &replication),
-      GNUNET_PQ_result_spec_uint32 ("type", &utype),
-      GNUNET_PQ_result_spec_uint32 ("prio", &priority),
-      GNUNET_PQ_result_spec_uint32 ("anonLevel", &anonymity),
-      GNUNET_PQ_result_spec_absolute_time ("expire", &expiration_time),
-      GNUNET_PQ_result_spec_auto_from_type ("hash", &key),
-      GNUNET_PQ_result_spec_variable_size ("value", &data, &size),
-      GNUNET_PQ_result_spec_uint64 ("oid", &rowid),
-      GNUNET_PQ_result_spec_end
-    };
-
-    if (GNUNET_OK !=
-        GNUNET_PQ_extract_result (res,
-                                  rs,
-                                  i))
-    {
-      GNUNET_break (0);
-      prc->proc (prc->proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-                 GNUNET_TIME_UNIT_ZERO_ABS, 0);
-      return;
-    }
-
-    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                     "datastore-postgres",
-                     "Found result of size %u bytes and type %u in database\n",
-                     (unsigned int) size,
-                     (unsigned int) utype);
-    iret = prc->proc (prc->proc_cls,
-                      &key,
-                      size,
-                      data,
-                      (enum GNUNET_BLOCK_Type) utype,
-                      priority,
-                      anonymity,
-                      replication,
-                      expiration_time,
-                      rowid);
-    if (iret == GNUNET_NO)
-    {
-      struct GNUNET_PQ_QueryParam param[] = {
-        GNUNET_PQ_query_param_uint64 (&rowid),
-        GNUNET_PQ_query_param_end
-      };
-
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Processor asked for item %u to be removed.\n",
-                  (unsigned int) rowid);
-      if (0 <
-          GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                              "delrow",
-                                              param))
-      {
-        GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                         "datastore-postgres",
-                         "Deleting %u bytes from database\n",
-                         (unsigned int) size);
-        plugin->env->duc (plugin->env->cls,
-                          -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
-        GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                         "datastore-postgres",
-                         "Deleted %u bytes from database\n",
-                         (unsigned int) size);
-      }
-    }
-    GNUNET_PQ_cleanup_result (rs);
-  }   /* for (i) */
-}
-
-
-/**
- * Get one of the results for a particular key in the datastore.
- *
- * @param cls closure with the `struct Plugin`
- * @param next_uid return the result with lowest uid >= next_uid
- * @param random if true, return a random result instead of using next_uid
- * @param key maybe NULL (to match all entries)
- * @param type entries of which type are relevant?
- *     Use 0 for any type.
- * @param proc function to call on the matching value;
- *        will be called with NULL if nothing matches
- * @param proc_cls closure for @a proc
- */
-static void
-postgres_plugin_get_key (void *cls,
-                         uint64_t next_uid,
-                         bool random,
-                         const struct GNUNET_HashCode *key,
-                         enum GNUNET_BLOCK_Type type,
-                         PluginDatumProcessor proc,
-                         void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t utype = type;
-  uint16_t use_rvalue = random;
-  uint16_t use_key = NULL != key;
-  uint16_t use_type = GNUNET_BLOCK_TYPE_ANY != type;
-  uint64_t rvalue;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_uint64 (&next_uid),
-    GNUNET_PQ_query_param_uint64 (&rvalue),
-    GNUNET_PQ_query_param_uint16 (&use_rvalue),
-    GNUNET_PQ_query_param_auto_from_type (key),
-    GNUNET_PQ_query_param_uint16 (&use_key),
-    GNUNET_PQ_query_param_uint32 (&utype),
-    GNUNET_PQ_query_param_uint16 (&use_type),
-    GNUNET_PQ_query_param_end
-  };
-  struct ProcessResultContext prc;
-  enum GNUNET_DB_QueryStatus res;
-
-  if (random)
-  {
-    rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                       UINT64_MAX);
-    next_uid = 0;
-  }
-  else
-  {
-    rvalue = 0;
-  }
-  prc.plugin = plugin;
-  prc.proc = proc;
-  prc.proc_cls = proc_cls;
-
-  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                              "get",
-                                              params,
-                                              &process_result,
-                                              &prc);
-  if (0 > res)
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-          GNUNET_TIME_UNIT_ZERO_ABS, 0);
-}
-
-
-/**
- * Select a subset of the items in the datastore and call
- * the given iterator for each of them.
- *
- * @param cls our `struct Plugin *`
- * @param next_uid return the result with lowest uid >= next_uid
- * @param type entries of which type should be considered?
- *        Must not be zero (ANY).
- * @param proc function to call on the matching value;
- *        will be called with NULL if no value matches
- * @param proc_cls closure for @a proc
- */
-static void
-postgres_plugin_get_zero_anonymity (void *cls,
-                                    uint64_t next_uid,
-                                    enum GNUNET_BLOCK_Type type,
-                                    PluginDatumProcessor proc,
-                                    void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t utype = type;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_uint32 (&utype),
-    GNUNET_PQ_query_param_uint64 (&next_uid),
-    GNUNET_PQ_query_param_end
-  };
-  struct ProcessResultContext prc;
-  enum GNUNET_DB_QueryStatus res;
-
-  prc.plugin = plugin;
-  prc.proc = proc;
-  prc.proc_cls = proc_cls;
-  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                              "select_non_anonymous",
-                                              params,
-                                              &process_result,
-                                              &prc);
-  if (0 > res)
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-          GNUNET_TIME_UNIT_ZERO_ABS, 0);
-}
-
-
-/**
- * Context for #repl_iter() function.
- */
-struct ReplCtx
-{
-  /**
-   * Plugin handle.
-   */
-  struct Plugin *plugin;
-
-  /**
-   * Function to call for the result (or the NULL).
-   */
-  PluginDatumProcessor proc;
-
-  /**
-   * Closure for @e proc.
-   */
-  void *proc_cls;
-};
-
-
-/**
- * Wrapper for the iterator for 'sqlite_plugin_replication_get'.
- * Decrements the replication counter and calls the original
- * iterator.
- *
- * @param cls closure with the `struct ReplCtx *`
- * @param key key for the content
- * @param size number of bytes in @a data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param uid unique identifier for the datum;
- *        maybe 0 if no unique identifier is available
- * @return #GNUNET_SYSERR to abort the iteration,
- *         #GNUNET_OK to continue
- *         (continue on call to "next", of course),
- *         #GNUNET_NO to delete the item and continue (if supported)
- */
-static int
-repl_proc (void *cls,
-           const struct GNUNET_HashCode *key,
-           uint32_t size,
-           const void *data,
-           enum GNUNET_BLOCK_Type type,
-           uint32_t priority,
-           uint32_t anonymity,
-           uint32_t replication,
-           struct GNUNET_TIME_Absolute expiration,
-           uint64_t uid)
-{
-  struct ReplCtx *rc = cls;
-  struct Plugin *plugin = rc->plugin;
-  int ret;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_uint64 (&uid),
-    GNUNET_PQ_query_param_end
-  };
-  enum GNUNET_DB_QueryStatus qret;
-
-  ret = rc->proc (rc->proc_cls,
-                  key,
-                  size,
-                  data,
-                  type,
-                  priority,
-                  anonymity,
-                  replication,
-                  expiration,
-                  uid);
-  if (NULL == key)
-    return ret;
-  qret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                             "decrepl",
-                                             params);
-  if (0 > qret)
-    return GNUNET_SYSERR;
-  return ret;
-}
-
-
-/**
- * Get a random item for replication.  Returns a single, not expired,
- * random item from those with the highest replication counters.  The
- * item's replication counter is decremented by one IF it was positive
- * before.  Call @a proc with all values ZERO or NULL if the datastore
- * is empty.
- *
- * @param cls closure with the `struct Plugin`
- * @param proc function to call the value (once only).
- * @param proc_cls closure for @a proc
- */
-static void
-postgres_plugin_get_replication (void *cls,
-                                 PluginDatumProcessor proc,
-                                 void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_end
-  };
-  struct ReplCtx rc;
-  struct ProcessResultContext prc;
-  enum GNUNET_DB_QueryStatus res;
-
-  rc.plugin = plugin;
-  rc.proc = proc;
-  rc.proc_cls = proc_cls;
-  prc.plugin = plugin;
-  prc.proc = &repl_proc;
-  prc.proc_cls = &rc;
-  res = GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                              "select_replication_order",
-                                              params,
-                                              &process_result,
-                                              &prc);
-  if (0 > res)
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0,
-          GNUNET_TIME_UNIT_ZERO_ABS, 0);
-}
-
-
-/**
- * Get a random item for expiration.  Call @a proc with all values
- * ZERO or NULL if the datastore is empty.
- *
- * @param cls closure with the `struct Plugin`
- * @param proc function to call the value (once only).
- * @param proc_cls closure for @a proc
- */
-static void
-postgres_plugin_get_expiration (void *cls,
-                                PluginDatumProcessor proc,
-                                void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_TIME_Absolute now = { 0 };
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_end
-  };
-  struct ProcessResultContext prc;
-
-  now = GNUNET_TIME_absolute_get ();
-  prc.plugin = plugin;
-  prc.proc = proc;
-  prc.proc_cls = proc_cls;
-  (void) GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                               "select_expiration_order",
-                                               params,
-                                               &process_result,
-                                               &prc);
-}
-
-
-/**
- * Closure for #process_keys.
- */
-struct ProcessKeysContext
-{
-  /**
-   * Function to call for each key.
-   */
-  PluginKeyProcessor proc;
-
-  /**
-   * Closure for @e proc.
-   */
-  void *proc_cls;
-};
-
-
-/**
- * Function to be called with the results of a SELECT statement
- * that has returned @a num_results results.
- *
- * @param cls closure with a `struct ProcessKeysContext`
- * @param result the postgres result
- * @param num_results the number of results in @a result
- */
-static void
-process_keys (void *cls,
-              PGresult *result,
-              unsigned int num_results)
-{
-  struct ProcessKeysContext *pkc = cls;
-
-  for (unsigned i = 0; i < num_results; i++)
-  {
-    struct GNUNET_HashCode key;
-    struct GNUNET_PQ_ResultSpec rs[] = {
-      GNUNET_PQ_result_spec_auto_from_type ("hash",
-                                            &key),
-      GNUNET_PQ_result_spec_end
-    };
-
-    if (GNUNET_OK !=
-        GNUNET_PQ_extract_result (result,
-                                  rs,
-                                  i))
-    {
-      GNUNET_break (0);
-      continue;
-    }
-    pkc->proc (pkc->proc_cls,
-               &key,
-               1);
-    GNUNET_PQ_cleanup_result (rs);
-  }
-}
-
-
-/**
- * Get all of the keys in the datastore.
- *
- * @param cls closure with the `struct Plugin *`
- * @param proc function to call on each key
- * @param proc_cls closure for @a proc
- */
-static void
-postgres_plugin_get_keys (void *cls,
-                          PluginKeyProcessor proc,
-                          void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_end
-  };
-  struct ProcessKeysContext pkc;
-
-  pkc.proc = proc;
-  pkc.proc_cls = proc_cls;
-  (void) GNUNET_PQ_eval_prepared_multi_select (plugin->dbh,
-                                               "get_keys",
-                                               params,
-                                               &process_keys,
-                                               &pkc);
-  proc (proc_cls,
-        NULL,
-        0);
-}
-
-
-/**
- * Drop database.
- *
- * @param cls closure with the `struct Plugin *`
- */
-static void
-postgres_plugin_drop (void *cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PQ_ExecuteStatement es[] = {
-    GNUNET_PQ_make_execute ("DROP TABLE gn090"),
-    GNUNET_PQ_EXECUTE_STATEMENT_END
-  };
-
-  if (GNUNET_OK !=
-      GNUNET_PQ_exec_statements (plugin->dbh,
-                                 es))
-    GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
-                     "postgres",
-                     _ ("Failed to drop table from database.\n"));
-}
-
-
-/**
- * Remove a particular key in the datastore.
- *
- * @param cls closure
- * @param key key for the content
- * @param size number of bytes in data
- * @param data content stored
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure for @a cont
- */
-static void
-postgres_plugin_remove_key (void *cls,
-                            const struct GNUNET_HashCode *key,
-                            uint32_t size,
-                            const void *data,
-                            PluginRemoveCont cont,
-                            void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  enum GNUNET_DB_QueryStatus ret;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_auto_from_type (key),
-    GNUNET_PQ_query_param_fixed_size (data, size),
-    GNUNET_PQ_query_param_end
-  };
-
-  ret = GNUNET_PQ_eval_prepared_non_select (plugin->dbh,
-                                            "remove",
-                                            params);
-  if (0 > ret)
-  {
-    cont (cont_cls,
-          key,
-          size,
-          GNUNET_SYSERR,
-          _ ("Postgresql exec failure"));
-    return;
-  }
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == ret)
-  {
-    cont (cont_cls,
-          key,
-          size,
-          GNUNET_NO,
-          NULL);
-    return;
-  }
-  plugin->env->duc (plugin->env->cls,
-                    -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
-  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                   "datastore-postgres",
-                   "Deleted %u bytes from database\n",
-                   (unsigned int) size);
-  cont (cont_cls,
-        key,
-        size,
-        GNUNET_OK,
-        NULL);
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls the `struct GNUNET_DATASTORE_PluginEnvironment*`
- * @return our `struct Plugin *`
- */
-void *
-libgnunet_plugin_datastore_postgres_init (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  struct Plugin *plugin;
-
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-  if (GNUNET_OK != init_connection (plugin))
-  {
-    GNUNET_free (plugin);
-    return NULL;
-  }
-  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
-  api->cls = plugin;
-  api->estimate_size = &postgres_plugin_estimate_size;
-  api->put = &postgres_plugin_put;
-  api->get_key = &postgres_plugin_get_key;
-  api->get_replication = &postgres_plugin_get_replication;
-  api->get_expiration = &postgres_plugin_get_expiration;
-  api->get_zero_anonymity = &postgres_plugin_get_zero_anonymity;
-  api->get_keys = &postgres_plugin_get_keys;
-  api->drop = &postgres_plugin_drop;
-  api->remove_key = &postgres_plugin_remove_key;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls our `struct Plugin *`
- * @return always NULL
- */
-void *
-libgnunet_plugin_datastore_postgres_done (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_PQ_disconnect (plugin->dbh);
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datastore_postgres.c */
diff --git a/src/service/datastore/plugin_datastore_sqlite.c b/src/service/datastore/plugin_datastore_sqlite.c
deleted file mode 100644
index 5ea9da4cb..000000000
--- a/src/service/datastore/plugin_datastore_sqlite.c
+++ /dev/null
@@ -1,1375 +0,0 @@
-/*
- * This file is part of GNUnet
- * Copyright (C) 2009, 2011, 2017 GNUnet e.V.
- *
- * GNUnet is free software: you can redistribute it and/or modify it
- * under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License,
- * or (at your option) any later version.
- *
- * GNUnet is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datastore/plugin_datastore_sqlite.c
- * @brief sqlite-based datastore backend
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_datastore_plugin.h"
-#include "gnunet_sq_lib.h"
-#include <sqlite3.h>
-
-
-/**
- * We allocate items on the stack at times.  To prevent a stack
- * overflow, we impose a limit on the maximum size for the data per
- * item.  64k should be enough.
- */
-#define MAX_ITEM_SIZE 65536
-
-/**
- * After how many ms "busy" should a DB operation fail for good?
- * A low value makes sure that we are more responsive to requests
- * (especially PUTs).  A high value guarantees a higher success
- * rate (SELECTs in iterate can take several seconds despite LIMIT=1).
- *
- * The default value of 250ms should ensure that users do not experience
- * huge latencies while at the same time allowing operations to succeed
- * with reasonable probability.
- */
-#define BUSY_TIMEOUT_MS 250
-
-
-/**
- * Log an error message at log-level 'level' that indicates
- * a failure of the command 'cmd' on file 'filename'
- * with the message given by strerror(errno).
- */
-#define LOG_SQLITE(db, level, cmd)                                \
-  do                                                              \
-  {                                                               \
-    GNUNET_log_from (level,                                       \
-                     "sqlite",                                    \
-                     _ ("`%s' failed at %s:%d with error: %s\n"), \
-                     cmd,                                         \
-                     __FILE__,                                    \
-                     __LINE__,                                    \
-                     sqlite3_errmsg (db->dbh));                   \
-  } while (0)
-
-
-/**
- * Log an error message at log-level 'level' that indicates
- * a failure of the command 'cmd' on file 'filename'
- * with the message given by strerror(errno).
- */
-#define LOG_SQLITE_MSG(db, msg, level, cmd)                       \
-  do                                                              \
-  {                                                               \
-    GNUNET_log_from (level,                                       \
-                     "sqlite",                                    \
-                     _ ("`%s' failed at %s:%d with error: %s\n"), \
-                     cmd,                                         \
-                     __FILE__,                                    \
-                     __LINE__,                                    \
-                     sqlite3_errmsg (db->dbh));                   \
-    GNUNET_asprintf (msg,                                         \
-                     _ ("`%s' failed at %s:%u with error: %s"),   \
-                     cmd,                                         \
-                     __FILE__,                                    \
-                     __LINE__,                                    \
-                     sqlite3_errmsg (db->dbh));                   \
-  } while (0)
-
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATASTORE_PluginEnvironment *env;
-
-  /**
-   * Database filename.
-   */
-  char *fn;
-
-  /**
-   * Native SQLite database handle.
-   */
-  sqlite3 *dbh;
-
-  /**
-   * Precompiled SQL for remove_key.
-   */
-  sqlite3_stmt *remove;
-
-  /**
-   * Precompiled SQL for deletion.
-   */
-  sqlite3_stmt *delRow;
-
-  /**
-   * Precompiled SQL for update.
-   */
-  sqlite3_stmt *update;
-
-  /**
-   * Get maximum repl value in database.
-   */
-  sqlite3_stmt *maxRepl;
-
-  /**
-   * Precompiled SQL for replication decrement.
-   */
-  sqlite3_stmt *updRepl;
-
-  /**
-   * Precompiled SQL for replication selection.
-   */
-  sqlite3_stmt *selRepl;
-
-  /**
-   * Precompiled SQL for expiration selection.
-   */
-  sqlite3_stmt *selExpi;
-
-  /**
-   * Precompiled SQL for expiration selection.
-   */
-  sqlite3_stmt *selZeroAnon;
-
-  /**
-   * Precompiled SQL for insertion.
-   */
-  sqlite3_stmt *insertContent;
-
-  /**
-   * Precompiled SQL for selection
-   */
-  sqlite3_stmt *get[8];
-
-  /**
-   * Should the database be dropped on shutdown?
-   */
-  int drop_on_shutdown;
-};
-
-
-/**
- * @brief Prepare a SQL statement
- *
- * @param dbh handle to the database
- * @param zSql SQL statement, UTF-8 encoded
- * @param ppStmt set to the prepared statement
- * @return 0 on success
- */
-static int
-sq_prepare (sqlite3 *dbh, const char *zSql, sqlite3_stmt **ppStmt)
-{
-  char *dummy;
-  int result;
-
-  result = sqlite3_prepare_v2 (dbh,
-                               zSql,
-                               strlen (zSql),
-                               ppStmt,
-                               (const char **) &dummy);
-  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                   "sqlite",
-                   "Prepared `%s' / %p: %d\n",
-                   zSql,
-                   *ppStmt,
-                   result);
-  return result;
-}
-
-
-/**
- * Create our database indices.
- *
- * @param dbh handle to the database
- */
-static void
-create_indices (sqlite3 *dbh)
-{
-  /* create indices */
-  if (
-    0 !=
-    (SQLITE_OK !=
-     sqlite3_exec (dbh,
-                   "CREATE INDEX IF NOT EXISTS idx_hash ON gn091 (hash)",
-                   NULL,
-                   NULL,
-                   NULL))
-    + (SQLITE_OK !=
-       sqlite3_exec (
-         dbh,
-         "CREATE INDEX IF NOT EXISTS idx_anon_type ON gn091 (anonLevel ASC,type)",
-         NULL,
-         NULL,
-         NULL))
-    + (SQLITE_OK !=
-       sqlite3_exec (dbh,
-                     "CREATE INDEX IF NOT EXISTS idx_expire ON gn091 (expire ASC)",
-                     NULL,
-                     NULL,
-                     NULL))
-    + (SQLITE_OK !=
-       sqlite3_exec (
-         dbh,
-         "CREATE INDEX IF NOT EXISTS idx_repl_rvalue ON gn091 (repl,rvalue)",
-         NULL,
-         NULL,
-         NULL)))
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
-                     "sqlite",
-                     "Failed to create indices: %s\n",
-                     sqlite3_errmsg (dbh));
-}
-
-
-#if 0
-#define CHECK(a) GNUNET_break (a)
-#define ENULL NULL
-#else
-#define ENULL &e
-#define ENULL_DEFINED 1
-#define CHECK(a)                                     \
-  if (! (a))                                         \
-  {                                                  \
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "%s\n", e); \
-    sqlite3_free (e);                                \
-    e = NULL;                                        \
-  }
-#endif
-
-
-/**
- * Initialize the database connections and associated
- * data structures (create tables and indices
- * as needed as well).
- *
- * @param cfg our configuration
- * @param plugin the plugin context (state for this module)
- * @return #GNUNET_OK on success
- */
-static int
-database_setup (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                struct Plugin *plugin)
-{
-  sqlite3_stmt *stmt;
-  char *afsdir;
-
-#if ENULL_DEFINED
-  char *e;
-#endif
-
-  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (cfg,
-                                                            "datastore-sqlite",
-                                                            "FILENAME",
-                                                            &afsdir))
-  {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
-                               "datastore-sqlite",
-                               "FILENAME");
-    return GNUNET_SYSERR;
-  }
-  if (GNUNET_OK != GNUNET_DISK_file_test (afsdir))
-  {
-    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (afsdir))
-    {
-      GNUNET_break (0);
-      GNUNET_free (afsdir);
-      return GNUNET_SYSERR;
-    }
-    /* database is new or got deleted, reset payload to zero! */
-    if (NULL != plugin->env->duc)
-      plugin->env->duc (plugin->env->cls, 0);
-  }
-  /* afsdir should be UTF-8-encoded. If it isn't, it's a bug */
-  plugin->fn = afsdir;
-
-  /* Open database and precompile statements */
-  if (SQLITE_OK != sqlite3_open (plugin->fn, &plugin->dbh))
-  {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
-                     "sqlite",
-                     _ ("Unable to initialize SQLite: %s.\n"),
-                     sqlite3_errmsg (plugin->dbh));
-    return GNUNET_SYSERR;
-  }
-  CHECK (
-    SQLITE_OK ==
-    sqlite3_exec (plugin->dbh, "PRAGMA temp_store=MEMORY", NULL, NULL, ENULL));
-  CHECK (
-    SQLITE_OK ==
-    sqlite3_exec (plugin->dbh, "PRAGMA synchronous=OFF", NULL, NULL, ENULL));
-  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
-                                    "PRAGMA legacy_file_format=OFF",
-                                    NULL,
-                                    NULL,
-                                    ENULL));
-  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
-                                    "PRAGMA auto_vacuum=INCREMENTAL",
-                                    NULL,
-                                    NULL,
-                                    ENULL));
-  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
-                                    "PRAGMA locking_mode=EXCLUSIVE",
-                                    NULL,
-                                    NULL,
-                                    ENULL));
-  CHECK (
-    SQLITE_OK ==
-    sqlite3_exec (plugin->dbh, "PRAGMA page_size=4096", NULL, NULL, ENULL));
-
-  CHECK (SQLITE_OK == sqlite3_busy_timeout (plugin->dbh, BUSY_TIMEOUT_MS));
-
-
-  /* We have to do it here, because otherwise precompiling SQL might fail */
-  CHECK (SQLITE_OK ==
-         sq_prepare (plugin->dbh,
-                     "SELECT 1 FROM sqlite_master WHERE tbl_name = 'gn091'",
-                     &stmt));
-
-  /* FIXME: SQLite does not have unsigned integers! This is ok for the type column because
-   * we only test equality on it and can cast it to/from uint32_t. For repl, prio, and anonLevel
-   * we do math or inequality tests, so we can't handle the entire range of uint32_t.
-   * This will also cause problems for expiration times after 294247-01-10-04:00:54 UTC.
-   */if ((SQLITE_DONE == sqlite3_step (stmt)) &&
-      (SQLITE_OK != sqlite3_exec (plugin->dbh,
-                                  "CREATE TABLE gn091 ("
-                                  "  repl INT4 NOT NULL DEFAULT 0,"
-                                  "  type INT4 NOT NULL DEFAULT 0,"
-                                  "  prio INT4 NOT NULL DEFAULT 0,"
-                                  "  anonLevel INT4 NOT NULL DEFAULT 0,"
-                                  "  expire INT8 NOT NULL DEFAULT 0,"
-                                  "  rvalue INT8 NOT NULL,"
-                                  "  hash TEXT NOT NULL DEFAULT '',"
-                                  "  vhash TEXT NOT NULL DEFAULT '',"
-                                  "  value BLOB NOT NULL DEFAULT '')",
-                                  NULL,
-                                  NULL,
-                                  NULL)))
-  {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_exec");
-    sqlite3_finalize (stmt);
-    return GNUNET_SYSERR;
-  }
-  sqlite3_finalize (stmt);
-  create_indices (plugin->dbh);
-
-#define RESULT_COLUMNS \
-  "repl, type, prio, anonLevel, expire, hash, value, _ROWID_"
-  if (
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "UPDATE gn091 "
-                              "SET prio = prio + ?, "
-                              "repl = repl + ?, "
-                              "expire = MAX(expire, ?) "
-                              "WHERE hash = ? AND vhash = ?",
-                              &plugin->update)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "UPDATE gn091 "
-                              "SET repl = MAX (0, repl - 1) WHERE _ROWID_ = ?",
-                              &plugin->updRepl)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE repl=?2 AND "
-                              " (rvalue>=?1 OR "
-                              "  NOT EXISTS (SELECT 1 FROM gn091 "
-                              "WHERE repl=?2 AND rvalue>=?1 LIMIT 1) ) "
-                              "ORDER BY rvalue ASC LIMIT 1",
-                              &plugin->selRepl)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT MAX(repl) FROM gn091",
-                              &plugin->maxRepl)) ||
-    (SQLITE_OK !=
-     sq_prepare (plugin->dbh,
-                 "SELECT " RESULT_COLUMNS " FROM gn091 "
-                 "WHERE NOT EXISTS (SELECT 1 FROM gn091 WHERE expire < ?1 LIMIT 1) OR (expire < ?1) "
-                 "ORDER BY expire ASC LIMIT 1",
-                 &plugin->selExpi)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ? AND "
-                              "anonLevel = 0 AND "
-                              "type = ? "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->selZeroAnon)) ||
-    (SQLITE_OK !=
-     sq_prepare (plugin->dbh,
-                 "INSERT INTO gn091 (repl, type, prio, anonLevel, expire, rvalue, hash, vhash, value) "
-                 "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
-                 &plugin->insertContent)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[0])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "type = ?4 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[1])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "hash = ?3 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[2])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "hash = ?3 AND "
-                              "type = ?4 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[3])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "rvalue >= ?2 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[4])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "rvalue >= ?2 AND "
-                              "type = ?4 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[5])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "rvalue >= ?2 AND "
-                              "hash = ?3 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[6])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "SELECT " RESULT_COLUMNS " FROM gn091 "
-                              "WHERE _ROWID_ >= ?1 AND "
-                              "rvalue >= ?2 AND "
-                              "hash = ?3 AND "
-                              "type = ?4 "
-                              "ORDER BY _ROWID_ ASC LIMIT 1",
-                              &plugin->get[7])) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "DELETE FROM gn091 WHERE _ROWID_ = ?",
-                              &plugin->delRow)) ||
-    (SQLITE_OK != sq_prepare (plugin->dbh,
-                              "DELETE FROM gn091 "
-                              "WHERE hash = ? AND "
-                              "value = ? ",
-                              &plugin->remove)) ||
-    false)
-  {
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "precompiling");
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * Shutdown database connection and associate data
- * structures.
- *
- * @param plugin the plugin context (state for this module)
- */
-static void
-database_shutdown (struct Plugin *plugin)
-{
-  int result;
-
-#if SQLITE_VERSION_NUMBER >= 3007000
-  sqlite3_stmt *stmt;
-#endif
-
-  if (NULL != plugin->remove)
-    sqlite3_finalize (plugin->remove);
-  if (NULL != plugin->delRow)
-    sqlite3_finalize (plugin->delRow);
-  if (NULL != plugin->update)
-    sqlite3_finalize (plugin->update);
-  if (NULL != plugin->updRepl)
-    sqlite3_finalize (plugin->updRepl);
-  if (NULL != plugin->selRepl)
-    sqlite3_finalize (plugin->selRepl);
-  if (NULL != plugin->maxRepl)
-    sqlite3_finalize (plugin->maxRepl);
-  if (NULL != plugin->selExpi)
-    sqlite3_finalize (plugin->selExpi);
-  if (NULL != plugin->selZeroAnon)
-    sqlite3_finalize (plugin->selZeroAnon);
-  if (NULL != plugin->insertContent)
-    sqlite3_finalize (plugin->insertContent);
-  for (int i = 0; i < 8; ++i)
-    if (NULL != plugin->get[i])
-      sqlite3_finalize (plugin->get[i]);
-  result = sqlite3_close (plugin->dbh);
-#if SQLITE_VERSION_NUMBER >= 3007000
-  if (result == SQLITE_BUSY)
-  {
-    GNUNET_log_from (
-      GNUNET_ERROR_TYPE_WARNING,
-      "sqlite",
-      _ (
-        "Tried to close sqlite without finalizing all prepared statements.\n"));
-    stmt = sqlite3_next_stmt (plugin->dbh, NULL);
-    while (NULL != stmt)
-    {
-      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                       "sqlite",
-                       "Closing statement %p\n",
-                       stmt);
-      result = sqlite3_finalize (stmt);
-      if (result != SQLITE_OK)
-        GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING,
-                         "sqlite",
-                         "Failed to close statement %p: %d\n",
-                         stmt,
-                         result);
-      stmt = sqlite3_next_stmt (plugin->dbh, NULL);
-    }
-    result = sqlite3_close (plugin->dbh);
-  }
-#endif
-  if (SQLITE_OK != result)
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite3_close");
-  GNUNET_free (plugin->fn);
-}
-
-
-/**
- * Delete the database entry with the given
- * row identifier.
- *
- * @param plugin the plugin context (state for this module)
- * @param rid the ID of the row to delete
- */
-static int
-delete_by_rowid (struct Plugin *plugin, uint64_t rid)
-{
-  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_uint64 (&rid),
-                                           GNUNET_SQ_query_param_end };
-
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->delRow, params))
-    return GNUNET_SYSERR;
-  if (SQLITE_DONE != sqlite3_step (plugin->delRow))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh, plugin->delRow);
-    return GNUNET_SYSERR;
-  }
-  GNUNET_SQ_reset (plugin->dbh, plugin->delRow);
-  return GNUNET_OK;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure
- * @param key key for the item
- * @param absent true if the key was not found in the bloom filter
- * @param size number of bytes in @a data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure
- */
-static void
-sqlite_plugin_put (void *cls,
-                   const struct GNUNET_HashCode *key,
-                   bool absent,
-                   uint32_t size,
-                   const void *data,
-                   enum GNUNET_BLOCK_Type type,
-                   uint32_t priority,
-                   uint32_t anonymity,
-                   uint32_t replication,
-                   struct GNUNET_TIME_Absolute expiration,
-                   PluginPutCont cont,
-                   void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_HashCode vhash;
-  char *msg = NULL;
-
-  GNUNET_CRYPTO_hash (data, size, &vhash);
-
-  if (! absent)
-  {
-    struct GNUNET_SQ_QueryParam params[] =
-    { GNUNET_SQ_query_param_uint32 (&priority),
-      GNUNET_SQ_query_param_uint32 (&replication),
-      GNUNET_SQ_query_param_absolute_time (&expiration),
-      GNUNET_SQ_query_param_auto_from_type (key),
-      GNUNET_SQ_query_param_auto_from_type (&vhash),
-      GNUNET_SQ_query_param_end };
-
-    if (GNUNET_OK != GNUNET_SQ_bind (plugin->update, params))
-    {
-      cont (cont_cls, key, size, GNUNET_SYSERR, _ ("sqlite bind failure"));
-      return;
-    }
-    if (SQLITE_DONE != sqlite3_step (plugin->update))
-    {
-      LOG_SQLITE_MSG (plugin,
-                      &msg,
-                      GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                      "sqlite3_step");
-      cont (cont_cls, key, size, GNUNET_SYSERR, msg);
-      GNUNET_free (msg);
-      return;
-    }
-    int changes = sqlite3_changes (plugin->dbh);
-    GNUNET_SQ_reset (plugin->dbh, plugin->update);
-    if (0 != changes)
-    {
-      cont (cont_cls, key, size, GNUNET_NO, NULL);
-      return;
-    }
-  }
-
-  uint64_t rvalue;
-  uint32_t type32 = (uint32_t) type;
-  struct GNUNET_SQ_QueryParam params[] =
-  { GNUNET_SQ_query_param_uint32 (&replication),
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_uint32 (&priority),
-    GNUNET_SQ_query_param_uint32 (&anonymity),
-    GNUNET_SQ_query_param_absolute_time (&expiration),
-    GNUNET_SQ_query_param_uint64 (&rvalue),
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_auto_from_type (&vhash),
-    GNUNET_SQ_query_param_fixed_size (data, size),
-    GNUNET_SQ_query_param_end };
-  int n;
-  int ret;
-  sqlite3_stmt *stmt;
-
-  if (size > MAX_ITEM_SIZE)
-  {
-    cont (cont_cls, key, size, GNUNET_SYSERR, _ ("Data too large"));
-    return;
-  }
-  GNUNET_log_from (
-    GNUNET_ERROR_TYPE_DEBUG,
-    "sqlite",
-    "Storing in database block with type %u/key `%s'/priority %u/expiration in %s (%s).\n",
-    type,
-    GNUNET_h2s (key),
-    priority,
-    GNUNET_STRINGS_relative_time_to_string (GNUNET_TIME_absolute_get_remaining (
-                                              expiration),
-                                            GNUNET_YES),
-    GNUNET_STRINGS_absolute_time_to_string (expiration));
-  stmt = plugin->insertContent;
-  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
-  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
-  {
-    cont (cont_cls, key, size, GNUNET_SYSERR, NULL);
-    return;
-  }
-  n = sqlite3_step (stmt);
-  switch (n)
-  {
-  case SQLITE_DONE:
-    if (NULL != plugin->env->duc)
-      plugin->env->duc (plugin->env->cls,
-                        size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
-    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                     "sqlite",
-                     "Stored new entry (%u bytes)\n",
-                     size + GNUNET_DATASTORE_ENTRY_OVERHEAD);
-    ret = GNUNET_OK;
-    break;
-
-  case SQLITE_BUSY:
-    GNUNET_break (0);
-    LOG_SQLITE_MSG (plugin,
-                    &msg,
-                    GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                    "sqlite3_step");
-    ret = GNUNET_SYSERR;
-    break;
-
-  default:
-    LOG_SQLITE_MSG (plugin,
-                    &msg,
-                    GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                    "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh, stmt);
-    database_shutdown (plugin);
-    database_setup (plugin->env->cfg, plugin);
-    cont (cont_cls, key, size, GNUNET_SYSERR, msg);
-    GNUNET_free (msg);
-    return;
-  }
-  GNUNET_SQ_reset (plugin->dbh, stmt);
-  cont (cont_cls, key, size, ret, msg);
-  GNUNET_free (msg);
-}
-
-
-/**
- * Execute statement that gets a row and call the callback
- * with the result.  Resets the statement afterwards.
- *
- * @param plugin the plugin
- * @param stmt the statement
- * @param proc processor to call
- * @param proc_cls closure for @a proc
- */
-static void
-execute_get (struct Plugin *plugin,
-             sqlite3_stmt *stmt,
-             PluginDatumProcessor proc,
-             void *proc_cls)
-{
-  int n;
-  struct GNUNET_TIME_Absolute expiration;
-  uint32_t replication;
-  uint32_t type;
-  uint32_t priority;
-  uint32_t anonymity;
-  uint64_t rowid;
-  void *value;
-  size_t value_size;
-  struct GNUNET_HashCode key;
-  int ret;
-  struct GNUNET_SQ_ResultSpec rs[] =
-  { GNUNET_SQ_result_spec_uint32 (&replication),
-    GNUNET_SQ_result_spec_uint32 (&type),
-    GNUNET_SQ_result_spec_uint32 (&priority),
-    GNUNET_SQ_result_spec_uint32 (&anonymity),
-    GNUNET_SQ_result_spec_absolute_time (&expiration),
-    GNUNET_SQ_result_spec_auto_from_type (&key),
-    GNUNET_SQ_result_spec_variable_size (&value, &value_size),
-    GNUNET_SQ_result_spec_uint64 (&rowid),
-    GNUNET_SQ_result_spec_end };
-
-  n = sqlite3_step (stmt);
-  switch (n)
-  {
-  case SQLITE_ROW:
-    if (GNUNET_OK != GNUNET_SQ_extract_result (stmt, rs))
-    {
-      GNUNET_break (0);
-      break;
-    }
-    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                     "sqlite",
-                     "Found reply in database with expiration %s\n",
-                     GNUNET_STRINGS_absolute_time_to_string (expiration));
-    ret = proc (proc_cls,
-                &key,
-                value_size,
-                value,
-                type,
-                priority,
-                anonymity,
-                replication,
-                expiration,
-                rowid);
-    GNUNET_SQ_cleanup_result (rs);
-    GNUNET_SQ_reset (plugin->dbh, stmt);
-    if ((GNUNET_NO == ret) && (GNUNET_OK == delete_by_rowid (plugin, rowid)) &&
-        (NULL != plugin->env->duc))
-      plugin->env->duc (plugin->env->cls,
-                        -(value_size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
-    return;
-
-  case SQLITE_DONE:
-    /* database must be empty */
-    break;
-
-  case SQLITE_BUSY:
-  case SQLITE_ERROR:
-  case SQLITE_MISUSE:
-  default:
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    if (SQLITE_OK != sqlite3_reset (stmt))
-      LOG_SQLITE (plugin,
-                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                  "sqlite3_reset");
-    GNUNET_break (0);
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    database_shutdown (plugin);
-    database_setup (plugin->env->cfg, plugin);
-    return;
-  }
-  GNUNET_SQ_reset (plugin->dbh, stmt);
-  proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-}
-
-
-/**
- * Select a subset of the items in the datastore and call
- * the given processor for the item.
- *
- * @param cls our plugin context
- * @param next_uid return the result with lowest uid >= next_uid
- * @param type entries of which type should be considered?
- *        Must not be zero (ANY).
- * @param proc function to call on the matching value;
- *        will be called with NULL if no value matches
- * @param proc_cls closure for @a proc
- */
-static void
-sqlite_plugin_get_zero_anonymity (void *cls,
-                                  uint64_t next_uid,
-                                  enum GNUNET_BLOCK_Type type,
-                                  PluginDatumProcessor proc,
-                                  void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t type32 = type;
-  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_uint64 (
-                                             &next_uid),
-                                           GNUNET_SQ_query_param_uint32 (
-                                             &type32),
-                                           GNUNET_SQ_query_param_end };
-
-  GNUNET_assert (type != GNUNET_BLOCK_TYPE_ANY);
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->selZeroAnon, params))
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  execute_get (plugin, plugin->selZeroAnon, proc, proc_cls);
-}
-
-
-/**
- * Get results for a particular key in the datastore.
- *
- * @param cls closure
- * @param next_uid return the result with lowest uid >= next_uid
- * @param random if true, return a random result instead of using next_uid
- * @param key maybe NULL (to match all entries)
- * @param type entries of which type are relevant?
- *     Use 0 for any type.
- * @param proc function to call on the matching value;
- *        will be called with NULL if nothing matches
- * @param proc_cls closure for @a proc
- */
-static void
-sqlite_plugin_get_key (void *cls,
-                       uint64_t next_uid,
-                       bool random,
-                       const struct GNUNET_HashCode *key,
-                       enum GNUNET_BLOCK_Type type,
-                       PluginDatumProcessor proc,
-                       void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  uint64_t rvalue;
-  int use_rvalue = random;
-  uint32_t type32 = (uint32_t) type;
-  int use_type = GNUNET_BLOCK_TYPE_ANY != type;
-  int use_key = NULL != key;
-  sqlite3_stmt *stmt = plugin->get[use_rvalue * 4 + use_key * 2 + use_type];
-  struct GNUNET_SQ_QueryParam params[] =
-  { GNUNET_SQ_query_param_uint64 (&next_uid),
-    GNUNET_SQ_query_param_uint64 (&rvalue),
-    GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_uint32 (&type32),
-    GNUNET_SQ_query_param_end };
-
-  /* SQLite doesn't like it when you try to bind a parameter greater than the
-   * last numbered parameter, but unused parameters in the middle are OK.
-   */
-  if (! use_type)
-  {
-    params[3] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
-    if (! use_key)
-    {
-      params[2] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
-      if (! use_rvalue)
-        params[1] = (struct GNUNET_SQ_QueryParam) GNUNET_SQ_query_param_end;
-    }
-  }
-  if (random)
-  {
-    rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
-    next_uid = 0;
-  }
-  else
-    rvalue = 0;
-
-  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  execute_get (plugin, stmt, proc, proc_cls);
-}
-
-
-/**
- * Context for #repl_proc() function.
- */
-struct ReplCtx
-{
-  /**
-   * Function to call for the result (or the NULL).
-   */
-  PluginDatumProcessor proc;
-
-  /**
-   * Closure for @e proc.
-   */
-  void *proc_cls;
-
-  /**
-   * UID to use.
-   */
-  uint64_t uid;
-
-  /**
-   * Yes if UID was set.
-   */
-  int have_uid;
-};
-
-
-/**
- * Wrapper for the processor for #sqlite_plugin_get_replication().
- * Decrements the replication counter and calls the original
- * processor.
- *
- * @param cls closure
- * @param key key for the content
- * @param size number of bytes in @a data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param uid unique identifier for the datum;
- *        maybe 0 if no unique identifier is available
- * @return #GNUNET_OK for normal return,
- *         #GNUNET_NO to delete the item
- */
-static int
-repl_proc (void *cls,
-           const struct GNUNET_HashCode *key,
-           uint32_t size,
-           const void *data,
-           enum GNUNET_BLOCK_Type type,
-           uint32_t priority,
-           uint32_t anonymity,
-           uint32_t replication,
-           struct GNUNET_TIME_Absolute expiration,
-           uint64_t uid)
-{
-  struct ReplCtx *rc = cls;
-  int ret;
-
-  if (GNUNET_SYSERR == rc->have_uid)
-    rc->have_uid = GNUNET_NO;
-  ret = rc->proc (rc->proc_cls,
-                  key,
-                  size,
-                  data,
-                  type,
-                  priority,
-                  anonymity,
-                  replication,
-                  expiration,
-                  uid);
-  if (NULL != key)
-  {
-    rc->uid = uid;
-    rc->have_uid = GNUNET_YES;
-  }
-  return ret;
-}
-
-
-/**
- * Get a random item for replication.  Returns a single random item
- * from those with the highest replication counters.  The item's
- * replication counter is decremented by one IF it was positive before.
- * Call @a proc with all values ZERO or NULL if the datastore is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for @a proc
- */
-static void
-sqlite_plugin_get_replication (void *cls,
-                               PluginDatumProcessor proc,
-                               void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct ReplCtx rc;
-  uint64_t rvalue = 0;
-  uint32_t repl;
-  struct GNUNET_SQ_QueryParam params_sel_repl[] =
-  { GNUNET_SQ_query_param_uint64 (&rvalue),
-    GNUNET_SQ_query_param_uint32 (&repl),
-    GNUNET_SQ_query_param_end };
-  struct GNUNET_SQ_QueryParam params_upd_repl[] =
-  { GNUNET_SQ_query_param_uint64 (&rc.uid), GNUNET_SQ_query_param_end };
-
-  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                   "datastore-sqlite",
-                   "Getting random block based on replication order.\n");
-  if (SQLITE_ROW != sqlite3_step (plugin->maxRepl))
-  {
-    GNUNET_SQ_reset (plugin->dbh, plugin->maxRepl);
-    /* DB empty */
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  repl = sqlite3_column_int (plugin->maxRepl, 0);
-  GNUNET_SQ_reset (plugin->dbh, plugin->maxRepl);
-  rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK, UINT64_MAX);
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->selRepl, params_sel_repl))
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  rc.have_uid = GNUNET_SYSERR;
-  rc.proc = proc;
-  rc.proc_cls = proc_cls;
-  execute_get (plugin, plugin->selRepl, &repl_proc, &rc);
-  if (GNUNET_YES == rc.have_uid)
-  {
-    if (GNUNET_OK != GNUNET_SQ_bind (plugin->updRepl, params_upd_repl))
-    {
-      proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-      return;
-    }
-    if (SQLITE_DONE != sqlite3_step (plugin->updRepl))
-      LOG_SQLITE (plugin,
-                  GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                  "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh, plugin->updRepl);
-  }
-  if (GNUNET_SYSERR == rc.have_uid)
-  {
-    /* proc was not called at all so far, do it now. */
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-  }
-}
-
-
-/**
- * Get a random item that has expired or has low priority.
- * Call @a proc with all values ZERO or NULL if the datastore is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for @a proc
- */
-static void
-sqlite_plugin_get_expiration (void *cls,
-                              PluginDatumProcessor proc,
-                              void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt;
-  struct GNUNET_TIME_Absolute now = { 0 };
-  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_absolute_time (
-                                             &now),
-                                           GNUNET_SQ_query_param_end };
-
-  GNUNET_log_from (
-    GNUNET_ERROR_TYPE_DEBUG,
-    "sqlite",
-    "Getting random block based on expiration and priority order.\n");
-  now = GNUNET_TIME_absolute_get ();
-  stmt = plugin->selExpi;
-  if (GNUNET_OK != GNUNET_SQ_bind (stmt, params))
-  {
-    proc (proc_cls, NULL, 0, NULL, 0, 0, 0, 0, GNUNET_TIME_UNIT_ZERO_ABS, 0);
-    return;
-  }
-  execute_get (plugin, stmt, proc, proc_cls);
-}
-
-
-/**
- * Get all of the keys in the datastore.
- *
- * @param cls closure
- * @param proc function to call on each key
- * @param proc_cls closure for @a proc
- */
-static void
-sqlite_plugin_get_keys (void *cls, PluginKeyProcessor proc, void *proc_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_HashCode key;
-  struct GNUNET_SQ_ResultSpec results[] =
-  { GNUNET_SQ_result_spec_auto_from_type (&key), GNUNET_SQ_result_spec_end };
-  sqlite3_stmt *stmt;
-  int ret;
-
-  GNUNET_assert (NULL != proc);
-  if (SQLITE_OK != sq_prepare (plugin->dbh, "SELECT hash FROM gn091", &stmt))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite_prepare");
-    proc (proc_cls, NULL, 0);
-    return;
-  }
-  while (SQLITE_ROW == (ret = sqlite3_step (stmt)))
-  {
-    if (GNUNET_OK == GNUNET_SQ_extract_result (stmt, results))
-      proc (proc_cls, &key, 1);
-    else
-      GNUNET_break (0);
-  }
-  if (SQLITE_DONE != ret)
-    LOG_SQLITE (plugin, GNUNET_ERROR_TYPE_ERROR, "sqlite_step");
-  sqlite3_finalize (stmt);
-  proc (proc_cls, NULL, 0);
-}
-
-
-/**
- * Drop database.
- *
- * @param cls our plugin context
- */
-static void
-sqlite_plugin_drop (void *cls)
-{
-  struct Plugin *plugin = cls;
-
-  plugin->drop_on_shutdown = GNUNET_YES;
-}
-
-
-/**
- * Remove a particular key in the datastore.
- *
- * @param cls closure
- * @param key key for the content
- * @param size number of bytes in data
- * @param data content stored
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure for @a cont
- */
-static void
-sqlite_plugin_remove_key (void *cls,
-                          const struct GNUNET_HashCode *key,
-                          uint32_t size,
-                          const void *data,
-                          PluginRemoveCont cont,
-                          void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_SQ_QueryParam params[] =
-  { GNUNET_SQ_query_param_auto_from_type (key),
-    GNUNET_SQ_query_param_fixed_size (data, size),
-    GNUNET_SQ_query_param_end };
-
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->remove, params))
-  {
-    cont (cont_cls, key, size, GNUNET_SYSERR, "bind failed");
-    return;
-  }
-  if (SQLITE_DONE != sqlite3_step (plugin->remove))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh, plugin->remove);
-    cont (cont_cls, key, size, GNUNET_SYSERR, "sqlite3_step failed");
-    return;
-  }
-  int changes = sqlite3_changes (plugin->dbh);
-  GNUNET_SQ_reset (plugin->dbh, plugin->remove);
-  if (0 == changes)
-  {
-    cont (cont_cls, key, size, GNUNET_NO, NULL);
-    return;
-  }
-  if (NULL != plugin->env->duc)
-    plugin->env->duc (plugin->env->cls,
-                      -(size + GNUNET_DATASTORE_ENTRY_OVERHEAD));
-  cont (cont_cls, key, size, GNUNET_OK, NULL);
-}
-
-
-/**
- * Get an estimate of how much space the database is
- * currently using.
- *
- * @param cls the `struct Plugin`
- * @return the size of the database on disk (estimate)
- */
-static void
-sqlite_plugin_estimate_size (void *cls, unsigned long long *estimate)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt;
-  uint64_t pages;
-  uint64_t page_size;
-
-#if ENULL_DEFINED
-  char *e;
-#endif
-
-  if (NULL == estimate)
-    return;
-  if (SQLITE_VERSION_NUMBER < 3006000)
-  {
-    GNUNET_log_from (
-      GNUNET_ERROR_TYPE_WARNING,
-      "datastore-sqlite",
-      _ ("sqlite version to old to determine size, assuming zero\n"));
-    *estimate = 0;
-    return;
-  }
-  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh, "VACUUM", NULL, NULL, ENULL));
-  CHECK (SQLITE_OK == sqlite3_exec (plugin->dbh,
-                                    "PRAGMA auto_vacuum=INCREMENTAL",
-                                    NULL,
-                                    NULL,
-                                    ENULL));
-  if (SQLITE_OK != sq_prepare (plugin->dbh, "PRAGMA page_count", &stmt))
-  {
-    GNUNET_log_from (
-      GNUNET_ERROR_TYPE_WARNING,
-      "datastore-sqlite",
-      _("error preparing statement\n"));
-    return;
-  }
-  if (SQLITE_ROW == sqlite3_step (stmt))
-    pages = sqlite3_column_int64 (stmt, 0);
-  else
-    pages = 0;
-  sqlite3_finalize (stmt);
-  if (SQLITE_OK != sq_prepare (plugin->dbh, "PRAGMA page_size", &stmt))
-  {
-    GNUNET_log_from (
-      GNUNET_ERROR_TYPE_WARNING,
-      "datastore-sqlite",
-      _("error preparing statement\n"));
-    return;
-  }
-  if (SQLITE_ROW != sqlite3_step (stmt))
-  {
-    GNUNET_log_from (
-      GNUNET_ERROR_TYPE_WARNING,
-      "datastore-sqlite",
-      _("error stepping\n"));
-    return;
-  }
-  page_size = sqlite3_column_int64 (stmt, 0);
-  sqlite3_finalize (stmt);
-  GNUNET_log (
-    GNUNET_ERROR_TYPE_INFO,
-    _ (
-      "Using sqlite page utilization to estimate payload (%llu pages of size %llu bytes)\n"),
-    (unsigned long long) pages,
-    (unsigned long long) page_size);
-  *estimate = pages * page_size;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls the `struct GNUNET_DATASTORE_PluginEnvironment *`
- * @return NULL on error, othrewise the plugin context
- */
-void *
-libgnunet_plugin_datastore_sqlite_init (void *cls)
-{
-  static struct Plugin plugin;
-  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-
-  if (NULL != plugin.env)
-    return NULL; /* can only initialize once! */
-  memset (&plugin, 0, sizeof(struct Plugin));
-  plugin.env = env;
-  if (GNUNET_OK != database_setup (env->cfg, &plugin))
-  {
-    database_shutdown (&plugin);
-    return NULL;
-  }
-  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
-  api->cls = &plugin;
-  api->estimate_size = &sqlite_plugin_estimate_size;
-  api->put = &sqlite_plugin_put;
-  api->get_key = &sqlite_plugin_get_key;
-  api->get_replication = &sqlite_plugin_get_replication;
-  api->get_expiration = &sqlite_plugin_get_expiration;
-  api->get_zero_anonymity = &sqlite_plugin_get_zero_anonymity;
-  api->get_keys = &sqlite_plugin_get_keys;
-  api->drop = &sqlite_plugin_drop;
-  api->remove_key = &sqlite_plugin_remove_key;
-  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
-                   "sqlite",
-                   _ ("Sqlite database running\n"));
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls the plugin context (as returned by "init")
- * @return always NULL
- */
-void *
-libgnunet_plugin_datastore_sqlite_done (void *cls)
-{
-  char *fn;
-  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
-                   "sqlite",
-                   "sqlite plugin is done\n");
-  fn = NULL;
-  if (plugin->drop_on_shutdown)
-    fn = GNUNET_strdup (plugin->fn);
-  database_shutdown (plugin);
-  plugin->env = NULL;
-  GNUNET_free (api);
-  if (NULL != fn)
-  {
-    if (0 != unlink (fn))
-      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING, "unlink", fn);
-    GNUNET_free (fn);
-  }
-  return NULL;
-}
-
-
-/* end of plugin_datastore_sqlite.c */
diff --git a/src/service/datastore/plugin_datastore_template.c b/src/service/datastore/plugin_datastore_template.c
deleted file mode 100644
index 2b455f8cb..000000000
--- a/src/service/datastore/plugin_datastore_template.c
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2009, 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file datastore/plugin_datastore_template.c
- * @brief template-based datastore backend
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_datastore_plugin.h"
-
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Our execution environment.
-   */
-  struct GNUNET_DATASTORE_PluginEnvironment *env;
-};
-
-
-/**
- * Get an estimate of how much space the database is
- * currently using.
- *
- * @param cls our "struct Plugin*"
- * @return number of bytes used on disk
- */
-static void
-template_plugin_estimate_size (void *cls, unsigned long long *estimate)
-{
-  if (NULL == estimate)
-    return;
-  GNUNET_break (0);
-  *estimate = 0;
-}
-
-
-/**
- * Store an item in the datastore.
- *
- * @param cls closure
- * @param key key for the item
- * @param absent true if the key was not found in the bloom filter
- * @param size number of bytes in data
- * @param data content stored
- * @param type type of the content
- * @param priority priority of the content
- * @param anonymity anonymity-level for the content
- * @param replication replication-level for the content
- * @param expiration expiration time for the content
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure
- */
-static void
-template_plugin_put (void *cls,
-                     const struct GNUNET_HashCode *key,
-                     bool absent,
-                     uint32_t size,
-                     const void *data,
-                     enum GNUNET_BLOCK_Type type,
-                     uint32_t priority,
-                     uint32_t anonymity,
-                     uint32_t replication,
-                     struct GNUNET_TIME_Absolute expiration,
-                     PluginPutCont cont,
-                     void *cont_cls)
-{
-  GNUNET_break (0);
-  cont (cont_cls, key, size, GNUNET_SYSERR, "not implemented");
-}
-
-
-/**
- * Get one of the results for a particular key in the datastore.
- *
- * @param cls closure
- * @param next_uid return the result with lowest uid >= next_uid
- * @param random if true, return a random result instead of using next_uid
- * @param key maybe NULL (to match all entries)
- * @param type entries of which type are relevant?
- *     Use 0 for any type.
- * @param proc function to call on each matching value;
- *        will be called with NULL if nothing matches
- * @param proc_cls closure for proc
- */
-static void
-template_plugin_get_key (void *cls,
-                         uint64_t next_uid,
-                         bool random,
-                         const struct GNUNET_HashCode *key,
-                         enum GNUNET_BLOCK_Type type,
-                         PluginDatumProcessor proc,
-                         void *proc_cls)
-{
-  GNUNET_break (0);
-}
-
-
-/**
- * Get a random item for replication.  Returns a single, not expired,
- * random item from those with the highest replication counters.  The
- * item's replication counter is decremented by one IF it was positive
- * before.  Call 'proc' with all values ZERO or NULL if the datastore
- * is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for proc
- */
-static void
-template_plugin_get_replication (void *cls, PluginDatumProcessor proc,
-                                 void *proc_cls)
-{
-  GNUNET_break (0);
-}
-
-
-/**
- * Get a random item for expiration.  Call 'proc' with all values ZERO
- * or NULL if the datastore is empty.
- *
- * @param cls closure
- * @param proc function to call the value (once only).
- * @param proc_cls closure for proc
- */
-static void
-template_plugin_get_expiration (void *cls, PluginDatumProcessor proc,
-                                void *proc_cls)
-{
-  GNUNET_break (0);
-}
-
-
-/**
- * Call the given processor on an item with zero anonymity.
- *
- * @param cls our "struct Plugin*"
- * @param next_uid return the result with lowest uid >= next_uid
- * @param type entries of which type should be considered?
- *        Must not be zero (ANY).
- * @param proc function to call on the matching value;
- *        will be called with NULL if no value matches
- * @param proc_cls closure for proc
- */
-static void
-template_plugin_get_zero_anonymity (void *cls, uint64_t next_uid,
-                                    enum GNUNET_BLOCK_Type type,
-                                    PluginDatumProcessor proc, void *proc_cls)
-{
-  GNUNET_break (0);
-}
-
-
-/**
- * Drop database.
- */
-static void
-template_plugin_drop (void *cls)
-{
-  GNUNET_break (0);
-}
-
-
-/**
- * Get all of the keys in the datastore.
- *
- * @param cls closure
- * @param proc function to call on each key
- * @param proc_cls closure for proc
- */
-static void
-template_get_keys (void *cls,
-                   PluginKeyProcessor proc,
-                   void *proc_cls)
-{
-  proc (proc_cls, NULL, 0);
-}
-
-
-/**
- * Remove a particular key in the datastore.
- *
- * @param cls closure
- * @param key key for the content
- * @param size number of bytes in data
- * @param data content stored
- * @param cont continuation called with success or failure status
- * @param cont_cls continuation closure for @a cont
- */
-static void
-template_plugin_remove_key (void *cls,
-                            const struct GNUNET_HashCode *key,
-                            uint32_t size,
-                            const void *data,
-                            PluginRemoveCont cont,
-                            void *cont_cls)
-{
-  GNUNET_break (0);
-  cont (cont_cls, key, size, GNUNET_SYSERR, "not implemented");
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls the "struct GNUNET_DATASTORE_PluginEnvironment*"
- * @return our "struct Plugin*"
- */
-void *
-libgnunet_plugin_datastore_template_init (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginEnvironment *env = cls;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  struct Plugin *plugin;
-
-  plugin = GNUNET_new (struct Plugin);
-  plugin->env = env;
-  api = GNUNET_new (struct GNUNET_DATASTORE_PluginFunctions);
-  api->cls = plugin;
-  api->estimate_size = &template_plugin_estimate_size;
-  api->put = &template_plugin_put;
-  api->get_key = &template_plugin_get_key;
-  api->get_replication = &template_plugin_get_replication;
-  api->get_expiration = &template_plugin_get_expiration;
-  api->get_zero_anonymity = &template_plugin_get_zero_anonymity;
-  api->drop = &template_plugin_drop;
-  api->get_keys = &template_get_keys;
-  api->remove_key = &template_plugin_remove_key;
-  GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "template",
-                   _ ("Template database running\n"));
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- * @param cls our "struct Plugin*"
- * @return always NULL
- */
-void *
-libgnunet_plugin_datastore_template_done (void *cls)
-{
-  struct GNUNET_DATASTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  GNUNET_free (plugin);
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_datastore_template.c */
diff --git a/src/service/datastore/test_plugin_datastore.c b/src/service/datastore/test_plugin_datastore.c
deleted file mode 100644
index 7de1acf2d..000000000
--- a/src/service/datastore/test_plugin_datastore.c
+++ /dev/null
@@ -1,478 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/*
- * @file test_plugin_datastore.c
- * @brief Test database plugin directly, calling each API function once
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_protocols.h"
-#include "gnunet_datastore_plugin.h"
-#include "gnunet_testing_lib.h"
-
-/**
- * Number of put operations to perform.
- */
-#define PUT_10 10
-
-static unsigned long long stored_bytes;
-
-static unsigned long long stored_entries;
-
-static unsigned long long stored_ops;
-
-static const char *plugin_name;
-
-static int ok;
-
-enum RunPhase
-{
-  RP_ERROR = 0,
-  RP_PUT,
-  RP_GET,
-  RP_ITER_ZERO,
-  RP_REPL_GET,
-  RP_EXPI_GET,
-  RP_REMOVE,
-  RP_DROP
-};
-
-
-struct CpsRunContext
-{
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  enum RunPhase phase;
-  unsigned int cnt;
-  unsigned int i;
-};
-
-
-/**
- * Function called by plugins to notify us about a
- * change in their disk utilization.
- *
- * @param cls closure (NULL)
- * @param delta change in disk utilization,
- *        0 for "reset to empty"
- */
-static void
-disk_utilization_change_cb (void *cls, int delta)
-{
-  /* do nothing */
-}
-
-
-static void
-test (void *cls);
-
-
-/**
- * Put continuation.
- *
- * @param cls closure
- * @param key key for the item stored
- * @param size size of the item stored
- * @param status #GNUNET_OK or #GNUNET_SYSERROR
- * @param msg error message on error
- */
-static void
-put_continuation (void *cls,
-                  const struct GNUNET_HashCode *key,
-                  uint32_t size,
-                  int status,
-                  const char *msg)
-{
-  struct CpsRunContext *crc = cls;
-  static unsigned long long os;
-  unsigned long long cs;
-
-  if (GNUNET_OK != status)
-  {
-    fprintf (stderr,
-             "ERROR: `%s'\n",
-             msg);
-  }
-  else
-  {
-    crc->api->estimate_size (crc->api->cls,
-                             &cs);
-    GNUNET_assert (os <= cs);
-    os = cs;
-    stored_bytes += size;
-    stored_ops++;
-    stored_entries++;
-  }
-  GNUNET_SCHEDULER_add_now (&test, crc);
-}
-
-
-static void
-gen_key (int i, struct GNUNET_HashCode *key)
-{
-  memset (key, 0, sizeof(struct GNUNET_HashCode));
-  key->bits[0] = (unsigned int) i;
-  GNUNET_CRYPTO_hash (key, sizeof(struct GNUNET_HashCode), key);
-}
-
-
-static void
-do_put (struct CpsRunContext *crc)
-{
-  char value[65536];
-  size_t size;
-  struct GNUNET_HashCode key;
-  unsigned int prio;
-  static int i;
-
-  if (PUT_10 == i)
-  {
-    i = 0;
-    crc->phase++;
-    GNUNET_SCHEDULER_add_now (&test, crc);
-    return;
-  }
-  /* most content is 32k */
-  size = 32 * 1024;
-
-  if ((0 != i) && (GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 16) ==
-                   0) )                                                           /* but some of it is less! */
-    size = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 32 * 1024);
-  size = size - (size & 7);     /* always multiple of 8 */
-
-  /* generate random key */
-  gen_key (i, &key);
-  memset (value, i, size);
-  if (i > 255)
-    memset (value, i - 255, size / 2);
-  value[0] = crc->i;
-  prio = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 100);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "putting type %u, anon %u under key %s\n", i + 1, i,
-              GNUNET_h2s (&key));
-  crc->api->put (crc->api->cls,
-                 &key,
-                 false /* absent */,
-                 size,
-                 value, i + 1 /* type */,
-                 prio,
-                 i /* anonymity */,
-                 0 /* replication */,
-                 GNUNET_TIME_relative_to_absolute
-                   (GNUNET_TIME_relative_multiply
-                     (GNUNET_TIME_UNIT_MILLISECONDS,
-                     60 * 60 * 60 * 1000
-                     + GNUNET_CRYPTO_random_u32
-                       (GNUNET_CRYPTO_QUALITY_WEAK, 1000))),
-                 put_continuation,
-                 crc);
-  i++;
-}
-
-
-static uint64_t guid;
-
-
-static int
-iterate_one_shot (void *cls,
-                  const struct GNUNET_HashCode *key,
-                  uint32_t size,
-                  const void *data,
-                  enum GNUNET_BLOCK_Type type,
-                  uint32_t priority,
-                  uint32_t anonymity,
-                  uint32_t replication,
-                  struct GNUNET_TIME_Absolute expiration,
-                  uint64_t uid)
-{
-  struct CpsRunContext *crc = cls;
-
-  GNUNET_assert (NULL != key);
-  guid = uid;
-  crc->phase++;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Found result type=%u, priority=%u, size=%u, expire=%s, key %s\n",
-              (unsigned int) type,
-              (unsigned int) priority,
-              (unsigned int) size,
-              GNUNET_STRINGS_absolute_time_to_string (expiration),
-              GNUNET_h2s (key));
-  GNUNET_SCHEDULER_add_now (&test,
-                            crc);
-  return GNUNET_OK;
-}
-
-
-static void
-remove_continuation (void *cls,
-                     const struct GNUNET_HashCode *key,
-                     uint32_t size,
-                     int status,
-                     const char *msg)
-{
-  struct CpsRunContext *crc = cls;
-
-  GNUNET_assert (NULL != key);
-  GNUNET_assert (32768 == size);
-  GNUNET_assert (GNUNET_OK == status);
-  GNUNET_assert (NULL == msg);
-  crc->phase++;
-  GNUNET_SCHEDULER_add_now (&test,
-                            crc);
-}
-
-
-/**
- * Function called when the service shuts
- * down.  Unloads our datastore plugin.
- *
- * @param api api to unload
- * @param cfg configuration to use
- */
-static void
-unload_plugin (struct GNUNET_DATASTORE_PluginFunctions *api,
-               const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  char *name;
-  char *libname;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg,
-                                             "DATASTORE",
-                                             "DATABASE",
-                                             &name))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("No `%s' specified for `%s' in configuration!\n"),
-                "DATABASE",
-                "DATASTORE");
-    return;
-  }
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
-  GNUNET_break (NULL == GNUNET_PLUGIN_unload (libname, api));
-  GNUNET_free (libname);
-  GNUNET_free (name);
-}
-
-
-/**
- * Last task run during shutdown.  Disconnects us from
- * the transport and core.
- */
-static void
-cleaning_task (void *cls)
-{
-  struct CpsRunContext *crc = cls;
-
-  unload_plugin (crc->api, crc->cfg);
-  GNUNET_free (crc);
-}
-
-
-static void
-test (void *cls)
-{
-  struct CpsRunContext *crc = cls;
-  struct GNUNET_HashCode key;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "In phase %d, iteration %u\n", crc->phase, crc->cnt);
-  switch (crc->phase)
-  {
-  case RP_ERROR:
-    ok = 1;
-    GNUNET_break (0);
-    crc->api->drop (crc->api->cls);
-    GNUNET_SCHEDULER_add_now (&cleaning_task, crc);
-    break;
-
-  case RP_PUT:
-    do_put (crc);
-    break;
-
-  case RP_GET:
-    if (crc->cnt == 1)
-    {
-      crc->cnt = 0;
-      crc->phase++;
-      GNUNET_SCHEDULER_add_now (&test, crc);
-      break;
-    }
-    gen_key (5, &key);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Looking for %s\n",
-                GNUNET_h2s (&key));
-    crc->api->get_key (crc->api->cls,
-                       0,
-                       false,
-                       &key,
-                       GNUNET_BLOCK_TYPE_ANY,
-                       &iterate_one_shot,
-                       crc);
-    break;
-
-  case RP_ITER_ZERO:
-    if (crc->cnt == 1)
-    {
-      crc->cnt = 0;
-      crc->phase++;
-      GNUNET_SCHEDULER_add_now (&test, crc);
-      break;
-    }
-    crc->api->get_zero_anonymity (crc->api->cls, 0, 1, &iterate_one_shot, crc);
-    break;
-
-  case RP_REPL_GET:
-    crc->api->get_replication (crc->api->cls, &iterate_one_shot, crc);
-    break;
-
-  case RP_EXPI_GET:
-    crc->api->get_expiration (crc->api->cls, &iterate_one_shot, crc);
-    break;
-
-  case RP_REMOVE:
-    {
-      struct GNUNET_HashCode key;
-      uint32_t size = 32768;
-      char value[size];
-
-      gen_key (0, &key);
-      memset (value, 0, size);
-      value[0] = crc->i;
-      crc->api->remove_key (crc->api->cls,
-                            &key,
-                            size,
-                            value,
-                            &remove_continuation,
-                            crc);
-      break;
-    }
-
-  case RP_DROP:
-    crc->api->drop (crc->api->cls);
-    GNUNET_SCHEDULER_add_now (&cleaning_task, crc);
-    break;
-  }
-}
-
-
-/**
- * Load the datastore plugin.
- */
-static struct GNUNET_DATASTORE_PluginFunctions *
-load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  static struct GNUNET_DATASTORE_PluginEnvironment env;
-  struct GNUNET_DATASTORE_PluginFunctions *ret;
-  char *name;
-  char *libname;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg,
-                                             "DATASTORE",
-                                             "DATABASE",
-                                             &name))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("No `%s' specified for `%s' in configuration!\n"),
-                "DATABASE",
-                "DATASTORE");
-    return NULL;
-  }
-  env.cfg = cfg;
-  env.duc = &disk_utilization_change_cb;
-  env.cls = NULL;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datastore plugin\n"),
-              name);
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datastore_%s", name);
-  if (NULL == (ret = GNUNET_PLUGIN_load (libname, &env)))
-  {
-    fprintf (stderr, "Failed to load plugin `%s'!\n", name);
-    GNUNET_free (libname);
-    GNUNET_free (name);
-    ok = 77;   /* mark test as skipped */
-    return NULL;
-  }
-  GNUNET_free (libname);
-  GNUNET_free (name);
-  return ret;
-}
-
-
-static void
-run (void *cls, char *const *args, const char *cfgfile,
-     const struct GNUNET_CONFIGURATION_Handle *c)
-{
-  struct GNUNET_DATASTORE_PluginFunctions *api;
-  struct CpsRunContext *crc;
-
-  api = load_plugin (c);
-  if (api == NULL)
-  {
-    fprintf (stderr,
-             "%s",
-             "Could not initialize plugin, assuming database not configured. Test not run!\n");
-    return;
-  }
-  crc = GNUNET_new (struct CpsRunContext);
-  crc->api = api;
-  crc->cfg = c;
-  crc->phase = RP_PUT;
-  GNUNET_SCHEDULER_add_now (&test, crc);
-}
-
-
-int
-main (int argc, char *argv[])
-{
-  char dir_name[PATH_MAX];
-  char cfg_name[PATH_MAX];
-  char *const xargv[] = {
-    "test-plugin-datastore",
-    "-c",
-    cfg_name,
-    NULL
-  };
-  static struct GNUNET_GETOPT_CommandLineOption options[] = {
-    GNUNET_GETOPT_OPTION_END
-  };
-
-  /* determine name of plugin to use */
-  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
-  GNUNET_snprintf (dir_name, sizeof(dir_name),
-                   "/tmp/test-gnunet-datastore-plugin-%s", plugin_name);
-  GNUNET_DISK_directory_remove (dir_name);
-  GNUNET_log_setup ("test-plugin-datastore",
-                    "WARNING",
-                    NULL);
-  GNUNET_snprintf (cfg_name, sizeof(cfg_name),
-                   "test_plugin_datastore_data_%s.conf", plugin_name);
-  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1, xargv,
-                      "test-plugin-datastore", "nohelp", options, &run, NULL);
-  if ((0 != ok) && (77 != ok))
-    fprintf (stderr, "Missed some testcases: %u\n", ok);
-  GNUNET_DISK_directory_remove (dir_name);
-  return ok;
-}
-
-
-/* end of test_plugin_datastore.c */
diff --git a/src/service/datastore/test_plugin_datastore_data_heap.conf b/src/service/datastore/test_plugin_datastore_data_heap.conf
deleted file mode 100644
index b1ea8ff67..000000000
--- a/src/service/datastore/test_plugin_datastore_data_heap.conf
+++ /dev/null
@@ -1,6 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-heap/
-
-[datastore]
-DATABASE = heap
diff --git a/src/service/datastore/test_plugin_datastore_data_postgres.conf b/src/service/datastore/test_plugin_datastore_data_postgres.conf
deleted file mode 100644
index d0e29437f..000000000
--- a/src/service/datastore/test_plugin_datastore_data_postgres.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-postgres/
-
-[datastore]
-DATABASE = postgres
-
-[datastore-postgres]
-CONFIG = dbname=gnunetcheck
-
diff --git a/src/service/datastore/test_plugin_datastore_data_sqlite.conf b/src/service/datastore/test_plugin_datastore_data_sqlite.conf
deleted file mode 100644
index ca837c77a..000000000
--- a/src/service/datastore/test_plugin_datastore_data_sqlite.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-@INLINE@ test_defaults.conf
-[PATHS]
-GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-datastore-plugin-sqlite/
-
diff --git a/src/service/dht/Makefile.am b/src/service/dht/Makefile.am
index bf3d26235..53df04faf 100644
--- a/src/service/dht/Makefile.am
+++ b/src/service/dht/Makefile.am
@@ -29,21 +29,6 @@ libgnunetdht_la_LDFLAGS = \
   -version-info 4:0:0
 
 
-plugin_LTLIBRARIES = \
-  libgnunet_plugin_block_dht.la
-
-libgnunet_plugin_block_dht_la_SOURCES = \
-  plugin_block_dht.c
-libgnunet_plugin_block_dht_la_LIBADD = \
-  $(top_builddir)/src/lib/hello/libgnunethello.la \
-  $(top_builddir)/src/lib/block/libgnunetblock.la \
-  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(LTLIBINTL)
-libgnunet_plugin_block_dht_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
 libexec_PROGRAMS = \
  gnunet-service-dht
 
diff --git a/src/service/dht/meson.build b/src/service/dht/meson.build
index 49ace7e0b..3972a0983 100644
--- a/src/service/dht/meson.build
+++ b/src/service/dht/meson.build
@@ -29,16 +29,6 @@ libgnunetdht_dep = declare_dependency(link_with : libgnunetdht)
 pkg.generate(libgnunetdht, url: 'https://www.gnunet.org',
            description : 'Provides API for the R5N distributed hash table')
 
-shared_module('gnunet_plugin_block_dht',
-        ['plugin_block_dht.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunethello_dep,
-                       libgnunetblock_dep,
-                       libgnunetblockgroup_dep],
-        include_directories: [incdir, configuration_inc],
-              install:true,
-              install_dir: get_option('libdir')/'gnunet')
-
 executable ('gnunet-service-dht',
             gnunetservicedht_src,
             dependencies: [libgnunetdht_dep, libgnunetutil_dep,
diff --git a/src/service/dht/plugin_block_dht.c b/src/service/dht/plugin_block_dht.c
deleted file mode 100644
index aa5ffc719..000000000
--- a/src/service/dht/plugin_block_dht.c
+++ /dev/null
@@ -1,311 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2010, 2017, 2022 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dht/plugin_block_dht.c
- * @brief block plugin for DHT internals (right now, find-peer requests only);
- *        other plugins should be used to store "useful" data in the
- *        DHT (see fs block plugin)
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_constants.h"
-#include "gnunet_hello_uri_lib.h"
-#include "gnunet_block_plugin.h"
-#include "gnunet_block_group_lib.h"
-
-#define DEBUG_DHT GNUNET_EXTRA_LOGGING
-
-/**
- * Number of bits we set per entry in the bloomfilter.
- * Do not change!
- */
-#define BLOOMFILTER_K 16
-
-
-/**
- * Create a new block group.
- *
- * @param ctx block context in which the block group is created
- * @param type type of the block for which we are creating the group
- * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
- * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
- * @param va variable arguments specific to @a type
- * @return block group handle, NULL if block groups are not supported
- *         by this @a type of block (this is not an error)
- */
-static struct GNUNET_BLOCK_Group *
-block_plugin_dht_create_group (void *cls,
-                               enum GNUNET_BLOCK_Type type,
-                               const void *raw_data,
-                               size_t raw_data_size,
-                               va_list va)
-{
-  unsigned int bf_size;
-  const char *guard;
-
-  guard = va_arg (va, const char *);
-  if (0 == strcmp (guard,
-                   "seen-set-size"))
-    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va,
-                                                                   unsigned int),
-                                                           BLOOMFILTER_K);
-  else if (0 == strcmp (guard,
-                        "filter-size"))
-    bf_size = va_arg (va, unsigned int);
-  else
-  {
-    GNUNET_break (0);
-    bf_size = 8;
-  }
-  GNUNET_break (NULL == va_arg (va, const char *));
-  return GNUNET_BLOCK_GROUP_bf_create (cls,
-                                       bf_size,
-                                       BLOOMFILTER_K,
-                                       type,
-                                       raw_data,
-                                       raw_data_size);
-}
-
-
-/**
- * Function called to validate a query.
- *
- * @param cls closure
- * @param type block type
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dht_check_query (void *cls,
-                              enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_HashCode *query,
-                              const void *xquery,
-                              size_t xquery_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    return GNUNET_OK;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a block for storage.
- *
- * @param cls closure
- * @param type block type
- * @param block block data to validate
- * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dht_check_block (void *cls,
-                              enum GNUNET_BLOCK_Type type,
-                              const void *block,
-                              size_t block_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    {
-      struct GNUNET_HELLO_Builder *b;
-      struct GNUNET_PeerIdentity pid;
-      struct GNUNET_HashCode h_pid;
-
-      b = GNUNET_HELLO_builder_from_block (block,
-                                           block_size);
-      if (NULL == b)
-      {
-        GNUNET_break (0);
-        return GNUNET_NO;
-      }
-      GNUNET_HELLO_builder_iterate (b,
-                                    &pid,
-                                    NULL, NULL);
-      GNUNET_CRYPTO_hash (&pid,
-                          sizeof (pid),
-                          &h_pid);
-      GNUNET_HELLO_builder_free (b);
-      return GNUNET_OK;
-    }
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a reply to a request.  Note that it is assumed
- * that the reply has already been matched to the key (and signatures checked)
- * as it would be done with the GetKeyFunction and the
- * BlockEvaluationFunction.
- *
- * @param cls closure
- * @param type block type
- * @param group which block group to use for evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_ReplyEvaluationResult
-block_plugin_dht_check_reply (
-  void *cls,
-  enum GNUNET_BLOCK_Type type,
-  struct GNUNET_BLOCK_Group *group,
-  const struct GNUNET_HashCode *query,
-  const void *xquery,
-  size_t xquery_size,
-  const void *reply_block,
-  size_t reply_block_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    {
-      struct GNUNET_HELLO_Builder *b;
-      struct GNUNET_PeerIdentity pid;
-      struct GNUNET_HashCode h_pid;
-
-      b = GNUNET_HELLO_builder_from_block (reply_block,
-                                           reply_block_size);
-      GNUNET_assert (NULL != b);
-      GNUNET_HELLO_builder_iterate (b,
-                                    &pid,
-                                    NULL, NULL);
-      GNUNET_CRYPTO_hash (&pid,
-                          sizeof (pid),
-                          &h_pid);
-      GNUNET_HELLO_builder_free (b);
-      if (GNUNET_YES ==
-          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                              &h_pid))
-        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-      return GNUNET_BLOCK_REPLY_OK_MORE;
-    }
-  default:
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-}
-
-
-/**
- * Function called to obtain the key for a block.
- *
- * @param cls closure
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes @a block
- * @param[out] key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dht_get_key (void *cls,
-                          enum GNUNET_BLOCK_Type type,
-                          const void *block,
-                          size_t block_size,
-                          struct GNUNET_HashCode *key)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DHT_HELLO:
-    {
-      struct GNUNET_HELLO_Builder *b;
-      struct GNUNET_PeerIdentity pid;
-
-      b = GNUNET_HELLO_builder_from_block (block,
-                                           block_size);
-      if (NULL == b)
-      {
-        GNUNET_break (0);
-        memset (key,
-                0,
-                sizeof (*key));
-        return GNUNET_OK;
-      }
-      GNUNET_HELLO_builder_iterate (b,
-                                    &pid,
-                                    NULL, NULL);
-      GNUNET_CRYPTO_hash (&pid,
-                          sizeof (pid),
-                          key);
-      GNUNET_HELLO_builder_free (b);
-      return GNUNET_OK;
-    }
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Entry point for the plugin.
- */
-void *
-libgnunet_plugin_block_dht_init (void *cls)
-{
-  static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_DHT_HELLO,
-    GNUNET_BLOCK_TYPE_ANY       /* end of list */
-  };
-  struct GNUNET_BLOCK_PluginFunctions *api;
-
-  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->get_key = &block_plugin_dht_get_key;
-  api->check_query = &block_plugin_dht_check_query;
-  api->check_block = &block_plugin_dht_check_block;
-  api->check_reply = &block_plugin_dht_check_reply;
-  api->create_group = &block_plugin_dht_create_group;
-  api->types = types;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- */
-void *
-libgnunet_plugin_block_dht_done (void *cls)
-{
-  struct GNUNET_BLOCK_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_block_dht.c */
diff --git a/src/service/dhtu/.gitignore b/src/service/dhtu/.gitignore
new file mode 100644
index 000000000..21f1a7c9b
--- /dev/null
+++ b/src/service/dhtu/.gitignore
@@ -0,0 +1 @@
+test_dhtu_ip
diff --git a/src/service/dhtu/Makefile.am b/src/service/dhtu/Makefile.am
new file mode 100644
index 000000000..500d5a7b1
--- /dev/null
+++ b/src/service/dhtu/Makefile.am
@@ -0,0 +1,81 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+plugindir = $(libdir)/gnunet
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+if USE_COVERAGE
+  AM_CFLAGS = --coverage -O0
+  XLIBS = -lgcov
+endif
+
+pkgcfg_DATA = \
+  dhtu.conf
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_dhtu_gnunet.la
+
+if !OPENBSD
+plugin_LTLIBRARIES += libgnunet_plugin_dhtu_ip.la
+
+libgnunet_plugin_dhtu_ip_la_SOURCES = \
+  plugin_dhtu_ip.c
+libgnunet_plugin_dhtu_ip_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_dhtu_ip_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+endif
+
+
+libgnunet_plugin_dhtu_gnunet_la_SOURCES = \
+  plugin_dhtu_gnunet.c
+libgnunet_plugin_dhtu_gnunet_la_LIBADD = \
+  $(top_builddir)/src/service/core/libgnunetcore.la \
+  $(top_builddir)/src/service/peerstore/libgnunetpeerstore.la \
+  $(top_builddir)/src/service/transport/libgnunettransportapplication.la \
+  $(top_builddir)/src/lib/hello/libgnunethello.la \
+  $(top_builddir)/src/service/nse/libgnunetnse.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(XLIBS) \
+  $(LTLIBINTL)
+libgnunet_plugin_dhtu_gnunet_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+lib_LTLIBRARIES = \
+  libgnunettestingdhtu.la
+
+libgnunettestingdhtu_la_SOURCES = \
+  testing_dhtu_cmd_send.c
+libgnunettestingdhtu_la_LIBADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/service/arm/libgnunetarm.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la \
+ $(LTLIBINTL)
+libgnunettestingdhtu_la_LDFLAGS = \
+ $(GN_LIB_LDFLAGS) \
+ -version-info 0:0:0
+
+
+
+test_dhtu_ip_SOURCES = \
+ test_dhtu_ip.c
+test_dhtu_ip_LDADD = \
+ $(top_builddir)/src/service/testing/libgnunettesting.la \
+ $(top_builddir)/src/service/arm/libgnunetarm.la \
+ $(top_builddir)/src/lib/util/libgnunetutil.la
+
+check_PROGRAMS = \
+ test_dhtu_ip
+
+EXTRA_DIST = \
+  dhtu.conf
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = \
+ $(check_PROGRAMS)
+endif
diff --git a/src/service/dhtu/dhtu.conf b/src/service/dhtu/dhtu.conf
new file mode 100644
index 000000000..ea5ade752
--- /dev/null
+++ b/src/service/dhtu/dhtu.conf
@@ -0,0 +1,7 @@
+[dhtu-gnunet]
+ENABLED = YES
+
+[dhtu-ip]
+ENABLED = NO
+NSE = 4
+UDP_PORT = 6666
diff --git a/src/service/dhtu/meson.build b/src/service/dhtu/meson.build
new file mode 100644
index 000000000..b2525e782
--- /dev/null
+++ b/src/service/dhtu/meson.build
@@ -0,0 +1,61 @@
+libgnunetplugindhtuip_src = ['plugin_dhtu_ip.c']
+libgnunetplugindhtugnunet_src = ['plugin_dhtu_gnunet.c']
+
+configure_file(input : 'dhtu.conf',
+               output : 'dhtu.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+if get_option('monolith')
+  foreach p : libgnunetplugindhtuip_src + libgnunetplugindhtugnunet_src
+    gnunet_src += 'dhtu/' + p
+  endforeach
+  subdir_done()
+endif
+
+libgnunettestingdhtu = library('gnunettestingdhtu',
+        ['testing_dhtu_cmd_send.c'],
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [
+          libgnunetutil_dep,
+          libgnunetarm_dep,
+          libgnunettesting_dep
+          ],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunettestingdhtu_dep = declare_dependency(link_with : libgnunettestingdhtu)
+
+shared_module('gnunet_plugin_dhtu_ip',
+          libgnunetplugindhtuip_src,
+          dependencies: [libgnunetutil_dep, m_dep],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+
+shared_module('gnunet_plugin_dhtu_gnunet',
+          libgnunetplugindhtugnunet_src,
+          dependencies: [libgnunetutil_dep,
+                         m_dep,
+                         libgnunetcore_dep,
+                         libgnunethello_dep,
+                         libgnunetpeerstore_dep,
+                         libgnunetnse_dep,
+                         ],
+          include_directories: [incdir, configuration_inc],
+          install: true,
+          install_dir: get_option('libdir')/'gnunet')
+
+testdhtu_ip = executable('test_dhtu_ip',
+           ['test_dhtu_ip.c'],
+          dependencies: [libgnunetutil_dep,
+                         libgnunettesting_dep],
+          include_directories: [incdir, configuration_inc],
+          install: false)
+
+test('test_dhtu_ip', testdhtu_ip, suite: 'dhtu',
+     workdir: meson.current_build_dir())
+
+
diff --git a/src/service/dhtu/plugin_dhtu_gnunet.c b/src/service/dhtu/plugin_dhtu_gnunet.c
new file mode 100644
index 000000000..75f466916
--- /dev/null
+++ b/src/service/dhtu/plugin_dhtu_gnunet.c
@@ -0,0 +1,603 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ *
+ * @file plugin_dhtu_gnunet.c
+ * @brief plain IP based DHT network underlay
+ */
+#include "platform.h"
+#include "gnunet_dhtu_plugin.h"
+#include "gnunet_core_service.h"
+#include "gnunet_transport_application_service.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_peerstore_service.h"
+#include "gnunet_nse_service.h"
+
+/**
+ * Opaque handle that the underlay offers for our address to be used when
+ * sending messages to another peer.
+ */
+struct GNUNET_DHTU_Source
+{
+
+  /**
+   * Application context for this source.
+   */
+  void *app_ctx;
+
+};
+
+
+/**
+ * Opaque handle that the underlay offers for the target peer when sending
+ * messages to another peer.
+ */
+struct GNUNET_DHTU_Target
+{
+
+  /**
+   * Application context for this target.
+   */
+  void *app_ctx;
+
+  /**
+   * Our plugin with its environment.
+   */
+  struct Plugin *plugin;
+
+  /**
+   * CORE MQ to send messages to this peer.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Head of preferences expressed for this target.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *ph_head;
+
+  /**
+   * Tail of preferences expressed for this target.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *ph_tail;
+
+  /**
+   * Transport suggest handle.
+   */
+  struct GNUNET_TRANSPORT_ApplicationSuggestHandle *ash;
+
+  /**
+   * Identity of this peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Preference counter, length of the @a ph_head DLL.
+   */
+  unsigned int ph_count;
+
+};
+
+
+/**
+ * Opaque handle expressing a preference of the DHT to
+ * keep a particular target connected.
+ */
+struct GNUNET_DHTU_PreferenceHandle
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *prev;
+
+  /**
+   * Target a preference was expressed for.
+   */
+  struct GNUNET_DHTU_Target *target;
+};
+
+
+/**
+ * Closure for all plugin functions.
+ */
+struct Plugin
+{
+
+  /**
+   * Our "source" address. Traditional CORE API does not tell us which source
+   * it is, so they are all identical.
+   */
+  struct GNUNET_DHTU_Source src;
+
+  /**
+   * Callbacks into the DHT.
+   */
+  struct GNUNET_DHTU_PluginEnvironment *env;
+
+  /**
+   * Handle to the PEERSTORE service.
+   */
+  struct GNUNET_PEERSTORE_Handle *peerstore;
+
+  /**
+   * Handle to the CORE service.
+   */
+  struct GNUNET_CORE_Handle *core;
+
+  /**
+   * Handle to Transport service.
+   */
+  struct GNUNET_TRANSPORT_ApplicationHandle *transport;
+
+  /**
+   * Handle to the NSE service.
+   */
+  struct GNUNET_NSE_Handle *nse;
+
+  /**
+   * Our peerstore notification context.  We use notification
+   * to instantly learn about new peers as they are discovered.
+   */
+  struct GNUNET_PEERSTORE_NotifyContext *peerstore_notify;
+
+  /**
+   * Identity of this peer.
+   */
+  struct GNUNET_PeerIdentity my_identity;
+
+  /**
+   * Our private key.
+   */
+  struct GNUNET_CRYPTO_EddsaPrivateKey *my_priv;
+
+};
+
+
+//#include "../peerinfo-tool/gnunet-peerinfo_plugins.c"
+
+
+/**
+ * Request creation of a session with a peer at the given @a address.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param pid target identity of the peer to connect to
+ * @param address target address to connect to
+ */
+static void
+gnunet_try_connect (void *cls,
+                    const struct GNUNET_PeerIdentity *pid,
+                    const char *address)
+{
+  struct Plugin *plugin = cls;
+  enum GNUNET_NetworkType nt = 0;
+  char *addr;
+  const char *eou;
+  int pfx_len;
+
+  eou = strstr (address,
+                  "://");
+  if (NULL == eou)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  pfx_len = eou - address;
+  eou += 3;
+  GNUNET_asprintf (&addr,
+                   "%.*s-%s",
+                   pfx_len,
+                   address,
+                   eou);
+  GNUNET_TRANSPORT_application_validate (plugin->transport,
+                                         pid,
+                                         nt,
+                                         addr);
+  GNUNET_free (addr);
+}
+
+
+/**
+ * Request underlay to keep the connection to @a target alive if possible.
+ * Hold may be called multiple times to express a strong preference to
+ * keep a connection, say because a @a target is in multiple tables.
+ *
+ * @param cls closure
+ * @param target connection to keep alive
+ */
+static struct GNUNET_DHTU_PreferenceHandle *
+gnunet_hold (void *cls,
+             struct GNUNET_DHTU_Target *target)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_DHTU_PreferenceHandle *ph;
+
+  ph = GNUNET_new (struct GNUNET_DHTU_PreferenceHandle);
+  ph->target = target;
+  GNUNET_CONTAINER_DLL_insert (target->ph_head,
+                               target->ph_tail,
+                               ph);
+  target->ph_count++;
+  if (NULL != target->ash)
+    GNUNET_TRANSPORT_application_suggest_cancel (target->ash);
+  target->ash
+    = GNUNET_TRANSPORT_application_suggest (plugin->transport,
+                                            &target->pid,
+                                            GNUNET_MQ_PRIO_BEST_EFFORT,
+                                            GNUNET_BANDWIDTH_ZERO);
+  return ph;
+}
+
+
+/**
+ * Do no long request underlay to keep the connection alive.
+ *
+ * @param cls closure
+ * @param target connection to keep alive
+ */
+static void
+gnunet_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
+{
+  struct GNUNET_DHTU_Target *target = ph->target;
+  struct Plugin *plugin = target->plugin;
+
+  GNUNET_CONTAINER_DLL_remove (target->ph_head,
+                               target->ph_tail,
+                               ph);
+  target->ph_count--;
+  GNUNET_free (ph);
+  if (NULL != target->ash)
+    GNUNET_TRANSPORT_application_suggest_cancel (target->ash);
+  if (0 == target->ph_count)
+    target->ash = NULL;
+  else
+    target->ash
+      = GNUNET_TRANSPORT_application_suggest (plugin->transport,
+                                              &target->pid,
+                                              GNUNET_MQ_PRIO_BEST_EFFORT,
+                                              GNUNET_BANDWIDTH_ZERO);
+}
+
+
+/**
+ * Send message to some other participant over the network.  Note that
+ * sending is not guaranteeing that the other peer actually received the
+ * message.  For any given @a target, the DHT must wait for the @a
+ * finished_cb to be called before calling send() again.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param target receiver identification
+ * @param msg message
+ * @param msg_size number of bytes in @a msg
+ * @param finished_cb function called once transmission is done
+ *        (not called if @a target disconnects, then only the
+ *         disconnect_cb is called).
+ * @param finished_cb_cls closure for @a finished_cb
+ */
+static void
+gnunet_send (void *cls,
+             struct GNUNET_DHTU_Target *target,
+             const void *msg,
+             size_t msg_size,
+             GNUNET_SCHEDULER_TaskCallback finished_cb,
+             void *finished_cb_cls)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *cmsg;
+
+  env = GNUNET_MQ_msg_extra (cmsg,
+                             msg_size,
+                             GNUNET_MESSAGE_TYPE_DHT_CORE);
+  GNUNET_MQ_notify_sent (env,
+                         finished_cb,
+                         finished_cb_cls);
+  memcpy (&cmsg[1],
+          msg,
+          msg_size);
+  GNUNET_MQ_send (target->mq,
+                  env);
+}
+
+
+/**
+ * Method called whenever a given peer connects.
+ *
+ * @param cls closure
+ * @param peer peer identity this notification is about
+ * @return closure associated with @a peer. given to mq callbacks and
+ *         #GNUNET_CORE_DisconnectEventHandler
+ */
+static void *
+core_connect_cb (void *cls,
+                 const struct GNUNET_PeerIdentity *peer,
+                 struct GNUNET_MQ_Handle *mq)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_DHTU_Target *target;
+
+  target = GNUNET_new (struct GNUNET_DHTU_Target);
+  target->plugin = plugin;
+  target->mq = mq;
+  target->pid = *peer;
+  plugin->env->connect_cb (plugin->env->cls,
+                           target,
+                           &target->pid,
+                           &target->app_ctx);
+  return target;
+}
+
+
+/**
+ * Method called whenever a peer disconnects.
+ *
+ * @param cls closure
+ * @param peer peer identity this notification is about
+ * @param peer_cls closure associated with peer. given in
+ *        #GNUNET_CORE_ConnectEventHandler
+ */
+static void
+core_disconnect_cb (void *cls,
+                    const struct GNUNET_PeerIdentity *peer,
+                    void *peer_cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_DHTU_Target *target = peer_cls;
+
+  plugin->env->disconnect_cb (target->app_ctx);
+  if (NULL != target->ash)
+    GNUNET_TRANSPORT_application_suggest_cancel (target->ash);
+  GNUNET_free (target);
+}
+
+
+static void
+add_addr (void *cls,
+          const char *addr)
+{
+  struct Plugin *plugin = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG ,
+              "peerinfo_cb addr %s\n",
+              addr);
+  plugin->env->address_add_cb (plugin->env->cls,
+                               addr,
+                               &plugin->src,
+                               &plugin->src.app_ctx);
+}
+
+
+/**
+ * Find the @a hello for our identity and then pass
+ * it to the DHT as a URL.  Note that we only
+ * add addresses, never remove them, due to limitations
+ * of the current peerinfo/core/transport APIs.
+ * This will change with TNG.
+ *
+ * @param cls a `struct Plugin`
+ * @param peer id of the peer, NULL for last call
+ * @param hello hello message for the peer (can be NULL)
+ * @param err_msg message
+ */
+static void
+peerinfo_cb (void *cls,
+             const struct GNUNET_PeerIdentity *peer,
+             const struct GNUNET_MessageHeader *hello,
+             const char *emsg)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_HELLO_Builder *builder;
+
+  if (NULL == hello)
+    return;
+  if (NULL == peer)
+    return;
+  if (0 !=
+      GNUNET_memcmp (peer,
+                     &plugin->my_identity))
+    return;
+  builder = GNUNET_HELLO_builder_from_msg (hello);
+  GNUNET_HELLO_builder_iterate (builder,
+                                (struct GNUNET_PeerIdentity *) peer,
+                                add_addr,
+                                plugin);
+  GNUNET_HELLO_builder_free (builder);
+}
+
+
+/**
+ * Function called after #GNUNET_CORE_connect has succeeded (or failed
+ * for good).  Note that the private key of the peer is intentionally
+ * not exposed here; if you need it, your process should try to read
+ * the private key file directly (which should work if you are
+ * authorized...).  Implementations of this function must not call
+ * #GNUNET_CORE_disconnect (other than by scheduling a new task to
+ * do this later).
+ *
+ * @param cls closure
+ * @param my_identity ID of this peer, NULL if we failed
+ */
+static void
+ core_init_cb (void *cls,
+              const struct GNUNET_PeerIdentity *my_identity)
+{
+  struct Plugin *plugin = cls;
+
+  plugin->my_identity = *my_identity;
+  plugin->peerstore_notify =
+      GNUNET_PEERSTORE_hello_changed_notify (plugin->peerstore,
+                                             GNUNET_NO,
+                                             &peerinfo_cb,
+                                             plugin);
+}
+
+
+/**
+ * Anything goes, always return #GNUNET_OK.
+ *
+ * @param cls unused
+ * @param msg message to check
+ * @return #GNUNET_OK if all is fine
+ */
+static int
+check_core_message (void *cls,
+                    const struct GNUNET_MessageHeader *msg)
+{
+  (void) cls;
+  (void) msg;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle message from CORE for the DHT. Passes it to the
+ * DHT logic.
+ *
+ * @param cls a `struct GNUNET_DHTU_Target` of the sender
+ * @param msg the message we received
+ */
+static void
+handle_core_message (void *cls,
+                     const struct GNUNET_MessageHeader *msg)
+{
+  struct GNUNET_DHTU_Target *origin = cls;
+  struct Plugin *plugin = origin->plugin;
+
+  plugin->env->receive_cb (plugin->env->cls,
+                           &origin->app_ctx,
+                           &plugin->src.app_ctx,
+                           &msg[1],
+                           ntohs (msg->size) - sizeof (*msg));
+}
+
+
+/**
+ * Callback to call when network size estimate is updated.
+ *
+ * @param cls closure
+ * @param timestamp time when the estimate was received from the server (or created by the server)
+ * @param logestimate the log(Base 2) value of the current network size estimate
+ * @param std_dev standard deviation for the estimate
+ */
+static void
+nse_cb (void *cls,
+        struct GNUNET_TIME_Absolute timestamp,
+        double logestimate,
+        double std_dev)
+{
+  struct Plugin *plugin = cls;
+
+  plugin->env->network_size_cb (plugin->env->cls,
+                                timestamp,
+                                logestimate,
+                                std_dev);
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return NULL
+ */
+void *
+libgnunet_plugin_dhtu_gnunet_done (void *cls)
+{
+  struct GNUNET_DHTU_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+
+  if (NULL != plugin->nse)
+    GNUNET_NSE_disconnect (plugin->nse);
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
+  if (NULL != plugin->core)
+    GNUNET_CORE_disconnect (plugin->core);
+  if (NULL != plugin->transport)
+    GNUNET_TRANSPORT_application_done (plugin->transport);
+  if (NULL != plugin->peerstore_notify)
+    GNUNET_PEERSTORE_hello_changed_notify_cancel (plugin->peerstore_notify);
+  if (NULL != plugin->peerstore)
+    GNUNET_PEERSTORE_disconnect (plugin->peerstore, GNUNET_YES);
+  //GPI_plugins_unload ();
+  GNUNET_free (plugin->my_priv);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DHTU_PluginEnvironment`)
+ * @return the plugin's API
+ */
+void *
+libgnunet_plugin_dhtu_gnunet_init (void *cls)
+{
+  struct GNUNET_DHTU_PluginEnvironment *env = cls;
+  struct GNUNET_DHTU_PluginFunctions *api;
+  struct Plugin *plugin;
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (core_message,
+                           GNUNET_MESSAGE_TYPE_DHT_CORE,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+
+  plugin = GNUNET_new (struct Plugin);
+  plugin->my_priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (env->cfg);
+  plugin->env = env;
+  api = GNUNET_new (struct GNUNET_DHTU_PluginFunctions);
+  api->cls = plugin;
+  api->try_connect = &gnunet_try_connect;
+  api->hold = &gnunet_hold;
+  api->drop = &gnunet_drop;
+  api->send = &gnunet_send;
+  plugin->peerstore = GNUNET_PEERSTORE_connect (env->cfg);
+  plugin->transport = GNUNET_TRANSPORT_application_init (env->cfg);
+  plugin->core = GNUNET_CORE_connect (env->cfg,
+                                      plugin,
+                                      &core_init_cb,
+                                      &core_connect_cb,
+                                      &core_disconnect_cb,
+                                      handlers);
+  plugin->nse = GNUNET_NSE_connect (env->cfg,
+                                    &nse_cb,
+                                    plugin);
+  if ( (NULL == plugin->transport) ||
+       (NULL == plugin->core) ||
+       (NULL == plugin->nse) )
+  {
+    GNUNET_break (0);
+    GNUNET_free (api);
+    libgnunet_plugin_dhtu_gnunet_done (plugin);
+    return NULL;
+  }
+  //GPI_plugins_load (env->cfg);
+  return api;
+}
diff --git a/src/service/dhtu/plugin_dhtu_ip.c b/src/service/dhtu/plugin_dhtu_ip.c
new file mode 100644
index 000000000..06d0f0f60
--- /dev/null
+++ b/src/service/dhtu/plugin_dhtu_ip.c
@@ -0,0 +1,1171 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2021, 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ *
+ * @file plugin_dhtu_ip.c
+ * @brief plain IP based DHT network underlay
+ */
+#include "platform.h"
+#include "gnunet_dhtu_plugin.h"
+
+/**
+ * How frequently should we re-scan our local interfaces for IPs?
+ */
+#define SCAN_FREQ GNUNET_TIME_UNIT_MINUTES
+
+/**
+ * Maximum number of concurrently active destinations to support.
+ */
+#define MAX_DESTS 256
+
+
+/**
+ * Opaque handle that the underlay offers for our address to be used when
+ * sending messages to another peer.
+ */
+struct GNUNET_DHTU_Source
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_Source *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_Source *prev;
+
+  /**
+   * Application context for this source.
+   */
+  void *app_ctx;
+
+  /**
+   * Address in URL form ("ip+udp://$PID/$IP:$PORT")
+   */
+  char *address;
+
+  /**
+   * My actual address.
+   */
+  struct sockaddr_storage addr;
+
+  /**
+   * Number of bytes in @a addr.
+   */
+  socklen_t addrlen;
+
+  /**
+   * Last generation this address was observed.
+   */
+  unsigned int scan_generation;
+
+};
+
+
+/**
+ * Opaque handle that the underlay offers for the target peer when sending
+ * messages to another peer.
+ */
+struct GNUNET_DHTU_Target
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_Target *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_Target *prev;
+
+  /**
+   * Application context for this target.
+   */
+  void *app_ctx;
+
+  /**
+   * Head of preferences expressed for this target.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *ph_head;
+
+  /**
+   * Tail of preferences expressed for this target.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *ph_tail;
+
+  /**
+   * Peer's identity.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Target IP address.
+   */
+  struct sockaddr_storage addr;
+
+  /**
+   * Number of bytes in @a addr.
+   */
+  socklen_t addrlen;
+
+  /**
+   * Preference counter, length of the @a ph_head DLL.
+   */
+  unsigned int ph_count;
+
+};
+
+/**
+ * Opaque handle expressing a preference of the DHT to
+ * keep a particular target connected.
+ */
+struct GNUNET_DHTU_PreferenceHandle
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GNUNET_DHTU_PreferenceHandle *prev;
+
+  /**
+   * Target a preference was expressed for.
+   */
+  struct GNUNET_DHTU_Target *target;
+};
+
+
+/**
+ * Closure for all plugin functions.
+ */
+struct Plugin
+{
+  /**
+   * Callbacks into the DHT.
+   */
+  struct GNUNET_DHTU_PluginEnvironment *env;
+
+  /**
+   * Head of sources where we receive traffic.
+   */
+  struct GNUNET_DHTU_Source *src_head;
+
+  /**
+   * Tail of sources where we receive traffic.
+   */
+  struct GNUNET_DHTU_Source *src_tail;
+
+  /**
+   * Head of destinations that are active. Sorted by
+   * last use, with latest used at the head.
+   */
+  struct GNUNET_DHTU_Target *dst_head;
+
+  /**
+   * Tail of destinations that are active.
+   */
+  struct GNUNET_DHTU_Target *dst_tail;
+
+  /**
+   * Map from hashes of sockaddrs to targets.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *dsts;
+
+  /**
+   * Task that scans for IP address changes.
+   */
+  struct GNUNET_SCHEDULER_Task *scan_task;
+
+  /**
+   * Task that reads incoming UDP packets.
+   */
+  struct GNUNET_SCHEDULER_Task *read_task;
+
+  /**
+   * Port we bind to.
+   */
+  char *port;
+
+  /**
+   * My UDP socket.
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * My identity.
+   */
+  struct GNUNET_PeerIdentity my_id;
+
+  /**
+   * How often have we scanned for IPs?
+   */
+  unsigned int scan_generation;
+
+  /**
+   * Port as a 16-bit value.
+   */
+  uint16_t port16;
+};
+
+
+/**
+ * Create a target to which we may send traffic.
+ *
+ * @param plugin our plugin
+ * @param pid presumed identity of the target
+ * @param addr target address
+ * @param addrlen number of bytes in @a addr
+ * @return new target object
+ */
+static struct GNUNET_DHTU_Target *
+create_target (struct Plugin *plugin,
+               const struct GNUNET_PeerIdentity *pid,
+               const struct sockaddr *addr,
+               socklen_t addrlen)
+{
+  struct GNUNET_DHTU_Target *dst;
+
+  if (MAX_DESTS <=
+      GNUNET_CONTAINER_multihashmap_size (plugin->dsts))
+  {
+    struct GNUNET_HashCode key;
+
+    dst = NULL;
+    for (struct GNUNET_DHTU_Target *pos = plugin->dst_head;
+         NULL != pos;
+         pos = pos->next)
+    {
+      /* >= here assures we remove oldest entries first */
+      if ( (NULL == dst) ||
+           (dst->ph_count >= pos->ph_count) )
+        dst = pos;
+    }
+    GNUNET_assert (NULL != dst);
+    plugin->env->disconnect_cb (dst->app_ctx);
+    GNUNET_CRYPTO_hash (&dst->addr,
+                        dst->addrlen,
+                        &key);
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_remove (plugin->dsts,
+                                                         &key,
+                                                         dst));
+    GNUNET_CONTAINER_DLL_remove (plugin->dst_head,
+                                 plugin->dst_tail,
+                                 dst);
+    GNUNET_assert (NULL == dst->ph_head);
+    GNUNET_free (dst);
+  }
+  dst = GNUNET_new (struct GNUNET_DHTU_Target);
+  dst->addrlen = addrlen;
+  dst->pid = *pid;
+  memcpy (&dst->addr,
+          addr,
+          addrlen);
+  GNUNET_CONTAINER_DLL_insert (plugin->dst_head,
+                               plugin->dst_tail,
+                               dst);
+  plugin->env->connect_cb (plugin->env->cls,
+                           dst,
+                           &dst->pid,
+                           &dst->app_ctx);
+  return dst;
+}
+
+
+/**
+ * Find target matching @a addr. If none exists,
+ * create one!
+ *
+ * @param plugin the plugin handle
+ * @param pid presumed identity of the target
+ * @param addr socket address to find
+ * @param addrlen number of bytes in @a addr
+ * @return matching target object
+ */
+static struct GNUNET_DHTU_Target *
+find_target (struct Plugin *plugin,
+             const struct GNUNET_PeerIdentity *pid,
+             const void *addr,
+             size_t addrlen)
+{
+  struct GNUNET_HashCode key;
+  struct GNUNET_DHTU_Target *dst;
+
+  GNUNET_CRYPTO_hash (addr,
+                      addrlen,
+                      &key);
+  dst = GNUNET_CONTAINER_multihashmap_get (plugin->dsts,
+                                           &key);
+  if (NULL == dst)
+  {
+    dst = create_target (plugin,
+                         pid,
+                         (const struct sockaddr *) addr,
+                         addrlen);
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_put (
+                     plugin->dsts,
+                     &key,
+                     dst,
+                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  }
+  else
+  {
+    /* move to head of DLL */
+    GNUNET_CONTAINER_DLL_remove (plugin->dst_head,
+                                 plugin->dst_tail,
+                                 dst);
+    GNUNET_CONTAINER_DLL_insert (plugin->dst_head,
+                                 plugin->dst_tail,
+                                 dst);
+
+  }
+  return dst;
+}
+
+
+/**
+ * Request creation of a session with a peer at the given @a address.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param pid identity of the target peer
+ * @param address target address to connect to
+ */
+static void
+ip_try_connect (void *cls,
+                const struct GNUNET_PeerIdentity *pid,
+                const char *address)
+{
+  struct Plugin *plugin = cls;
+  char *colon;
+  const char *port;
+  char *addr;
+  struct addrinfo hints = {
+    .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV
+  };
+  struct addrinfo *result = NULL;
+
+  if (0 !=
+      strncmp (address,
+               "ip+",
+               strlen ("ip+")))
+    return;
+  address += strlen ("ip+");
+  if (0 !=
+      strncmp (address,
+               "udp://",
+               strlen ("udp://")))
+    return;
+  address += strlen ("udp://");
+  addr = GNUNET_strdup (address);
+  colon = strchr (addr, ':');
+  if (NULL == colon)
+  {
+    port = plugin->port;
+  }
+  else
+  {
+    *colon = '\0';
+    port = colon + 1;
+  }
+  if (0 !=
+      getaddrinfo (addr,
+                   port,
+                   &hints,
+                   &result))
+  {
+    GNUNET_break (0);
+    GNUNET_free (addr);
+    return;
+  }
+  GNUNET_free (addr);
+  (void) find_target (plugin,
+                      pid,
+                      result->ai_addr,
+                      result->ai_addrlen);
+  freeaddrinfo (result);
+}
+
+
+/**
+ * Request underlay to keep the connection to @a target alive if possible.
+ * Hold may be called multiple times to express a strong preference to
+ * keep a connection, say because a @a target is in multiple tables.
+ *
+ * @param cls closure
+ * @param target connection to keep alive
+ */
+static struct GNUNET_DHTU_PreferenceHandle *
+ip_hold (void *cls,
+         struct GNUNET_DHTU_Target *target)
+{
+  struct GNUNET_DHTU_PreferenceHandle *ph;
+
+  ph = GNUNET_new (struct GNUNET_DHTU_PreferenceHandle);
+  ph->target = target;
+  GNUNET_CONTAINER_DLL_insert (target->ph_head,
+                               target->ph_tail,
+                               ph);
+  target->ph_count++;
+  return ph;
+}
+
+
+/**
+ * Do no long request underlay to keep the connection alive.
+ *
+ * @param cls closure
+ * @param target connection to keep alive
+ */
+static void
+ip_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
+{
+  struct GNUNET_DHTU_Target *target = ph->target;
+
+  GNUNET_CONTAINER_DLL_remove (target->ph_head,
+                               target->ph_tail,
+                               ph);
+  target->ph_count--;
+  GNUNET_free (ph);
+}
+
+
+/**
+ * Send message to some other participant over the network.  Note that
+ * sending is not guaranteeing that the other peer actually received the
+ * message.  For any given @a target, the DHT must wait for the @a
+ * finished_cb to be called before calling send() again.
+ *
+ * @param cls closure (internal context for the plugin)
+ * @param target receiver identification
+ * @param msg message
+ * @param msg_size number of bytes in @a msg
+ * @param finished_cb function called once transmission is done
+ *        (not called if @a target disconnects, then only the
+ *         disconnect_cb is called).
+ * @param finished_cb_cls closure for @a finished_cb
+ */
+static void
+ip_send (void *cls,
+         struct GNUNET_DHTU_Target *target,
+         const void *msg,
+         size_t msg_size,
+         GNUNET_SCHEDULER_TaskCallback finished_cb,
+         void *finished_cb_cls)
+{
+  struct Plugin *plugin = cls;
+  char buf[sizeof (plugin->my_id) + msg_size];
+
+  memcpy (buf,
+          &plugin->my_id,
+          sizeof (plugin->my_id));
+  memcpy (&buf[sizeof (plugin->my_id)],
+          msg,
+          msg_size);
+  GNUNET_NETWORK_socket_sendto (plugin->sock,
+                                buf,
+                                sizeof (buf),
+                                (const struct sockaddr *) &target->addr,
+                                target->addrlen);
+  finished_cb (finished_cb_cls);
+}
+
+
+/**
+ * Create a new source on which we may be receiving traffic.
+ *
+ * @param plugin our plugin
+ * @param addr our address
+ * @param addrlen number of bytes in @a addr
+ * @return new source object
+ */
+static struct GNUNET_DHTU_Source *
+create_source (struct Plugin *plugin,
+               const struct sockaddr *addr,
+               socklen_t addrlen)
+{
+  struct GNUNET_DHTU_Source *src;
+
+  src = GNUNET_new (struct GNUNET_DHTU_Source);
+  src->addrlen = addrlen;
+  memcpy (&src->addr,
+          addr,
+          addrlen);
+  src->scan_generation = plugin->scan_generation;
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    {
+      const struct sockaddr_in *s4 = (const struct sockaddr_in *) addr;
+      char buf[INET_ADDRSTRLEN];
+
+      GNUNET_assert (sizeof (struct sockaddr_in) == addrlen);
+      GNUNET_asprintf (&src->address,
+                       "ip+udp://%s:%u",
+                       inet_ntop (AF_INET,
+                                  &s4->sin_addr,
+                                  buf,
+                                  sizeof (buf)),
+                       ntohs (s4->sin_port));
+    }
+    break;
+  case AF_INET6:
+    {
+      const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *) addr;
+      char buf[INET6_ADDRSTRLEN];
+
+      GNUNET_assert (sizeof (struct sockaddr_in6) == addrlen);
+      GNUNET_asprintf (&src->address,
+                       "ip+udp://[%s]:%u",
+                       inet_ntop (AF_INET6,
+                                  &s6->sin6_addr,
+                                  buf,
+                                  sizeof (buf)),
+                       ntohs (s6->sin6_port));
+    }
+    break;
+  default:
+    GNUNET_break (0);
+    GNUNET_free (src);
+    return NULL;
+  }
+  GNUNET_CONTAINER_DLL_insert (plugin->src_head,
+                               plugin->src_tail,
+                               src);
+  plugin->env->address_add_cb (plugin->env->cls,
+                               src->address,
+                               src,
+                               &src->app_ctx);
+  return src;
+}
+
+
+/**
+ * Compare two addresses excluding the ports for equality. Only compares IP
+ * address. Must only be called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp_np (const struct sockaddr *a1,
+            const struct sockaddr *a2,
+            size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
+ * Compare two addresses for equality. Only
+ * compares IP address and port. Must only be
+ * called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp (const struct sockaddr *a1,
+         const struct sockaddr *a2,
+         size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+
+      if (s1->sin_port != s2->sin_port)
+        return 1;
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+
+      if (s1->sin6_port != s2->sin6_port)
+        return 1;
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
+ * Callback function invoked for each interface found.
+ *
+ * @param cls closure
+ * @param name name of the interface (can be NULL for unknown)
+ * @param isDefault is this presumably the default interface
+ * @param addr address of this interface (can be NULL for unknown or unassigned)
+ * @param broadcast_addr the broadcast address (can be NULL for unknown or unassigned)
+ * @param netmask the network mask (can be NULL for unknown or unassigned)
+ * @param addrlen length of the address
+ * @return #GNUNET_OK to continue iteration, #GNUNET_SYSERR to abort
+ */
+static enum GNUNET_GenericReturnValue
+process_ifcs (void *cls,
+              const char *name,
+              int isDefault,
+              const struct sockaddr *addr,
+              const struct sockaddr *broadcast_addr,
+              const struct sockaddr *netmask,
+              socklen_t addrlen)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_DHTU_Source *src;
+
+  for (src = plugin->src_head;
+       NULL != src;
+       src = src->next)
+  {
+    if ( (addrlen == src->addrlen) &&
+         (0 == addrcmp_np (addr,
+                           (const struct sockaddr *) &src->addr,
+                           addrlen)) )
+    {
+      src->scan_generation = plugin->scan_generation;
+      return GNUNET_OK;
+    }
+  }
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    {
+      struct sockaddr_in v4;
+
+      GNUNET_assert (sizeof(v4) == addrlen);
+      memcpy (&v4,
+              addr,
+              addrlen);
+      v4.sin_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v4,
+                            sizeof (v4));
+      break;
+    }
+  case AF_INET6:
+    {
+      struct sockaddr_in6 v6;
+
+      GNUNET_assert (sizeof(v6) == addrlen);
+      memcpy (&v6,
+              addr,
+              addrlen);
+      v6.sin6_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v6,
+                            sizeof (v6));
+      break;
+    }
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Scan network interfaces for IP address changes.
+ *
+ * @param cls a `struct Plugin`
+ */
+static void
+scan (void *cls)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_DHTU_Source *next;
+
+  plugin->scan_generation++;
+  GNUNET_OS_network_interfaces_list (&process_ifcs,
+                                     plugin);
+  for (struct GNUNET_DHTU_Source *src = plugin->src_head;
+       NULL != src;
+       src = next)
+  {
+    next = src->next;
+    if (src->scan_generation >= plugin->scan_generation)
+      continue;
+    GNUNET_CONTAINER_DLL_remove (plugin->src_head,
+                                 plugin->src_tail,
+                                 src);
+    plugin->env->address_del_cb (src->app_ctx);
+    GNUNET_free (src->address);
+    GNUNET_free (src);
+  }
+  plugin->scan_task = GNUNET_SCHEDULER_add_delayed (SCAN_FREQ,
+                                                    &scan,
+                                                    plugin);
+}
+
+
+/**
+ * Find our source matching @a addr. If none exists,
+ * create one!
+ *
+ * @param plugin the plugin handle
+ * @param addr socket address to find
+ * @param addrlen number of bytes in @a addr
+ * @return matching source object
+ */
+static struct GNUNET_DHTU_Source *
+find_source (struct Plugin *plugin,
+             const void *addr,
+             size_t addrlen)
+{
+  for (struct GNUNET_DHTU_Source *src = plugin->src_head;
+       NULL != src;
+       src = src->next)
+  {
+    if ( (addrlen == src->addrlen) &&
+         (0 == addrcmp (addr,
+                        (const struct sockaddr *) &src->addr,
+                        addrlen)) )
+      return src;
+  }
+
+  return create_source (plugin,
+                        (const struct sockaddr *) addr,
+                        addrlen);
+}
+
+
+/**
+ * UDP socket is ready to receive. Read.
+ *
+ * @param cls our `struct Plugin *`
+ */
+static void
+read_cb (void *cls)
+{
+  struct Plugin *plugin = cls;
+  ssize_t ret;
+  const struct GNUNET_PeerIdentity *pid;
+  char buf[65536] GNUNET_ALIGN;
+  struct sockaddr_storage sa;
+  struct iovec iov = {
+    .iov_base = buf,
+    .iov_len = sizeof (buf)
+  };
+  char ctl[128];
+  struct msghdr mh = {
+    .msg_name = &sa,
+    .msg_namelen = sizeof (sa),
+    .msg_iov = &iov,
+    .msg_iovlen = 1,
+    .msg_control = ctl,
+    .msg_controllen = sizeof (ctl)
+  };
+  struct GNUNET_DHTU_Target *dst = NULL;
+  struct GNUNET_DHTU_Source *src = NULL;
+
+  ret = recvmsg  (GNUNET_NETWORK_get_fd (plugin->sock),
+                  &mh,
+                  MSG_DONTWAIT);
+  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    plugin->sock,
+    &read_cb,
+    plugin);
+  if (ret < 0)
+    return; /* read failure, hopefully EAGAIN */
+  if (ret < sizeof (*pid))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  /* find IP where we received message */
+  for (struct cmsghdr *cmsg = CMSG_FIRSTHDR (&mh);
+       NULL != cmsg;
+       cmsg = CMSG_NXTHDR (&mh,
+                           cmsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Got CMSG level %u (%d/%d), type %u (%d/%d)\n",
+                cmsg->cmsg_level,
+                (cmsg->cmsg_level == IPPROTO_IP),
+                (cmsg->cmsg_level == IPPROTO_IPV6),
+                cmsg->cmsg_type,
+                (cmsg->cmsg_type == IP_PKTINFO),
+                (cmsg->cmsg_type == IPV6_PKTINFO));
+    if ( (cmsg->cmsg_level == IPPROTO_IP) &&
+         (cmsg->cmsg_type == IP_PKTINFO) )
+    {
+      if (CMSG_LEN (sizeof (struct in_pktinfo)) ==
+          cmsg->cmsg_len)
+      {
+        struct in_pktinfo pi;
+
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
+        {
+          struct sockaddr_in sa = {
+            .sin_family = AF_INET,
+            .sin_addr = pi.ipi_addr,
+            .sin_port = htons (plugin->port16)
+          };
+
+          src = find_source (plugin,
+                             &sa,
+                             sizeof (sa));
+          /* For sources we discovered by reading,
+             force the generation far into the future */
+          src->scan_generation = plugin->scan_generation + 60;
+        }
+        break;
+      }
+      else
+        GNUNET_break (0);
+    }
+    if ( (cmsg->cmsg_level == IPPROTO_IPV6) &&
+         (cmsg->cmsg_type == IPV6_PKTINFO) )
+    {
+      if (CMSG_LEN (sizeof (struct in6_pktinfo)) ==
+          cmsg->cmsg_len)
+      {
+        struct in6_pktinfo pi;
+
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
+        {
+          struct sockaddr_in6 sa = {
+            .sin6_family = AF_INET6,
+            .sin6_addr = pi.ipi6_addr,
+            .sin6_port = htons (plugin->port16),
+            .sin6_scope_id = pi.ipi6_ifindex
+          };
+
+          src = find_source (plugin,
+                             &sa,
+                             sizeof (sa));
+          /* For sources we discovered by reading,
+             force the generation far into the future */
+          src->scan_generation = plugin->scan_generation + 60;
+          break;
+        }
+      }
+      else
+        GNUNET_break (0);
+    }
+  }
+  if (NULL == src)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  pid = (const struct GNUNET_PeerIdentity *) buf;
+  dst = find_target (plugin,
+                     pid,
+                     &sa,
+                     mh.msg_namelen);
+  if (NULL == dst)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  plugin->env->receive_cb (plugin->env->cls,
+                           &dst->app_ctx,
+                           &src->app_ctx,
+                           &buf[sizeof(*pid)],
+                           ret - sizeof (*pid));
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls closure (the `struct GNUNET_DHTU_PluginEnvironment`)
+ * @return the plugin's API
+ */
+void *
+libgnunet_plugin_dhtu_ip_init (void *cls)
+{
+  struct GNUNET_DHTU_PluginEnvironment *env = cls;
+  struct GNUNET_DHTU_PluginFunctions *api;
+  struct Plugin *plugin;
+  char *port;
+  unsigned int nport;
+  int sock;
+  int af;
+  unsigned long long nse;
+
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (env->cfg,
+                                             "DHTU-IP",
+                                             "NSE",
+                                             &nse))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "DHTU-IP",
+                               "NSE");
+    return NULL;
+  }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (env->cfg,
+                                             "DHTU-IP",
+                                             "UDP_PORT",
+                                             &port))
+  {
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               "DHTU-IP",
+                               "UDP_PORT");
+    return NULL;
+  }
+  {
+    char dummy;
+
+    if ( (1 != sscanf (port,
+                       "%u%c",
+                       &nport,
+                       &dummy)) ||
+         (nport > UINT16_MAX) )
+    {
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
+                                 "DHTU-IP",
+                                 "UDP_PORT",
+                                 "must be number below 65536");
+      GNUNET_free (port);
+      return NULL;
+    }
+  }
+  plugin = GNUNET_new (struct Plugin);
+  plugin->env = env;
+  plugin->port = port;
+  plugin->port16 = (uint16_t) nport;
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_get_peer_identity (env->cfg,
+                                       &plugin->my_id))
+  {
+    GNUNET_free (plugin);
+    return NULL;
+  }
+  af = AF_INET6;
+  sock = socket (af,
+                 SOCK_DGRAM,
+                 IPPROTO_UDP);
+  if (-1 == sock)
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                         "socket");
+    GNUNET_free (plugin->port);
+    GNUNET_free (plugin);
+    return NULL;
+  }
+  switch (af)
+  {
+  case AF_INET:
+    {
+      int on = 1;
+
+      if (0 !=
+          setsockopt (sock,
+                      IPPROTO_IP,
+                      IP_PKTINFO,
+                      &on,
+                      sizeof (on)))
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                             "setsockopt");
+      }
+    }
+    {
+      struct sockaddr_in sa = {
+        .sin_family = AF_INET,
+        .sin_port = htons ((uint16_t) nport)
+      };
+
+      if (0 !=
+          bind (sock,
+                (const struct sockaddr *) &sa,
+                sizeof (sa)))
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                             "socket");
+        GNUNET_break (0 ==
+                      close (sock));
+        GNUNET_free (plugin->port);
+        GNUNET_free (plugin);
+        return NULL;
+      }
+    }
+    break;
+  case AF_INET6:
+    {
+      int on = 1;
+
+      if (0 !=
+          setsockopt (sock,
+                      IPPROTO_IPV6,
+                      IPV6_RECVPKTINFO,
+                      &on,
+                      sizeof (on)))
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                             "setsockopt");
+      }
+    }
+    {
+      struct sockaddr_in6 sa = {
+        .sin6_family = AF_INET6,
+        .sin6_port = htons ((uint16_t) nport)
+      };
+
+      if (0 !=
+          bind (sock,
+                (const struct sockaddr *) &sa,
+                sizeof (sa)))
+      {
+        GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                             "socket");
+        GNUNET_break (0 ==
+                      close (sock));
+        GNUNET_free (plugin->port);
+        GNUNET_free (plugin);
+        return NULL;
+      }
+    }
+    break;
+  }
+  plugin->dsts = GNUNET_CONTAINER_multihashmap_create (128,
+                                                       GNUNET_NO);
+  plugin->sock = GNUNET_NETWORK_socket_box_native (sock);
+  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    plugin->sock,
+    &read_cb,
+    plugin);
+  env->network_size_cb (env->cls,
+                        GNUNET_TIME_UNIT_ZERO_ABS,
+                        log (nse) / log (2),
+                        -1.0 /* stddev */);
+  plugin->scan_task = GNUNET_SCHEDULER_add_now (&scan,
+                                                plugin);
+  api = GNUNET_new (struct GNUNET_DHTU_PluginFunctions);
+  api->cls = plugin;
+  api->try_connect = &ip_try_connect;
+  api->hold = &ip_hold;
+  api->drop = &ip_drop;
+  api->send = &ip_send;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls closure (our `struct Plugin`)
+ * @return NULL
+ */
+void *
+libgnunet_plugin_dhtu_ip_done (void *cls)
+{
+  struct GNUNET_DHTU_PluginFunctions *api = cls;
+  struct Plugin *plugin = api->cls;
+  struct GNUNET_DHTU_Source *src;
+  struct GNUNET_DHTU_Target *dst;
+
+  while (NULL != (dst = plugin->dst_head))
+  {
+    plugin->env->disconnect_cb (dst->app_ctx);
+    GNUNET_assert (NULL == dst->ph_head);
+    GNUNET_CONTAINER_DLL_remove (plugin->dst_head,
+                                 plugin->dst_tail,
+                                 dst);
+    GNUNET_free (dst);
+  }
+  while (NULL != (src = plugin->src_head))
+  {
+    plugin->env->address_del_cb (src->app_ctx);
+    GNUNET_CONTAINER_DLL_remove (plugin->src_head,
+                                 plugin->src_tail,
+                                 src);
+    GNUNET_free (src->address);
+    GNUNET_free (src);
+  }
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->dsts);
+  if (NULL != plugin->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (plugin->read_task);
+    plugin->read_task = NULL;
+  }
+  GNUNET_SCHEDULER_cancel (plugin->scan_task);
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_NETWORK_socket_close (plugin->sock));
+  GNUNET_free (plugin->port);
+  GNUNET_free (plugin);
+  GNUNET_free (api);
+  return NULL;
+}
diff --git a/src/service/dhtu/test_dhtu_ip.c b/src/service/dhtu/test_dhtu_ip.c
new file mode 100644
index 000000000..030b17b5f
--- /dev/null
+++ b/src/service/dhtu/test_dhtu_ip.c
@@ -0,0 +1,45 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file dhtu/test_dhtu_ip.c
+ * @brief Test case for the DHTU implementation for IP
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_testing_netjail_lib.h"
+#include "gnunet_util_lib.h"
+
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 120)
+
+#define CONFIG_FILE "test_dhtu_ip.conf"
+
+
+int
+main (int argc,
+      char *const *argv)
+{
+  struct GNUNET_TESTING_Command commands[] = {
+    GNUNET_TESTING_cmd_end ()
+  };
+
+  return GNUNET_TESTING_main (commands,
+                              TIMEOUT);
+}
diff --git a/src/service/dhtu/testing_dhtu_cmd_send.c b/src/service/dhtu/testing_dhtu_cmd_send.c
new file mode 100644
index 000000000..45d166b14
--- /dev/null
+++ b/src/service/dhtu/testing_dhtu_cmd_send.c
@@ -0,0 +1,119 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testing/testing_dhtu_cmd_send.c
+ * @brief use DHTU to send a message
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_testing_ng_lib.h"
+#include "gnunet_testing_netjail_lib.h"
+
+
+/**
+ * State for the 'send' command.
+ */
+struct SendState
+{
+
+  /**
+   * Mandatory context for async commands.
+   */
+  struct GNUNET_TESTING_AsyncContext ac;
+
+};
+
+
+/**
+ *
+ *
+ * @param cls a `struct SendState`
+ */
+static void
+send_cleanup (void *cls)
+{
+  struct SendState *ss = cls;
+
+  GNUNET_free (ss);
+}
+
+
+/**
+ * Return trains of the ``send`` command.
+ *
+ * @param cls closure.
+ * @param[out] ret result
+ * @param trait name of the trait.
+ * @param index index number of the object to offer.
+ * @return #GNUNET_OK on success.
+ *         #GNUNET_NO if no trait was found
+ */
+static enum GNUNET_GenericReturnValue
+send_traits (void *cls,
+             const void **ret,
+             const char *trait,
+             unsigned int index)
+{
+  return GNUNET_NO;
+}
+
+
+/**
+ * Run the 'send' command.
+ *
+ * @param cls closure.
+ * @param is interpreter state.
+ */
+static void
+send_run (void *cls,
+          struct GNUNET_TESTING_Interpreter *is)
+{
+  struct SendState *ss = cls;
+
+#if 0
+  other_cmd = GNUNET_TESTING_interpreter_lookup_command (ss->other_label);
+  GNUNET_TESTING_get_trait_XXX (other_cmd,
+                                &data);
+#endif
+  GNUNET_TESTING_async_finish (&ss->ac);
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTING_DHTU_cmd_send (const char *label)
+{
+  struct SendState *ss;
+
+  ss = GNUNET_new (struct SendState);
+
+  {
+    struct GNUNET_TESTING_Command cmd = {
+      .cls = ss,
+      .run = &send_run,
+      .ac = &ss->ac,
+      .cleanup = &send_cleanup,
+      .traits = &send_traits
+    };
+    strncpy (cmd.label, label, GNUNET_TESTING_CMD_MAX_LABEL_LENGTH);
+
+    return cmd;
+  }
+}
diff --git a/src/service/dns/Makefile.am b/src/service/dns/Makefile.am
index 38ee78c3a..0d07b9e5e 100644
--- a/src/service/dns/Makefile.am
+++ b/src/service/dns/Makefile.am
@@ -29,9 +29,6 @@ noinst_PROGRAMS = \
   gnunet-dns-redirector \
   gnunet-zonewalk
 
-plugin_LTLIBRARIES = \
-  libgnunet_plugin_block_dns.la
-
 if LINUX
 check_SCRIPTS = \
  test_gnunet_dns.sh
@@ -77,17 +74,6 @@ libgnunetdns_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS) \
   -version-info 0:0:0
 
-libgnunet_plugin_block_dns_la_SOURCES = \
-  plugin_block_dns.c
-libgnunet_plugin_block_dns_la_LIBADD = \
-  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
-  $(top_builddir)/src/lib/block/libgnunetblock.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la
-libgnunet_plugin_block_dns_la_LDFLAGS = \
-  $(GN_LIBINTL) \
-  $(top_builddir)/src/block/$(GN_PLUGIN_LDFLAGS)
-
-
 if ENABLE_TEST_RUN
 AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
 TESTS = $(check_PROGRAMS)  $(check_SCRIPTS)
diff --git a/src/service/dns/meson.build b/src/service/dns/meson.build
index fe0f6e954..e1b7f7670 100644
--- a/src/service/dns/meson.build
+++ b/src/service/dns/meson.build
@@ -1,5 +1,4 @@
 libgnunetdns_src = ['dns_api.c']
-libgnunetpluginblockdns_src = ['plugin_block_dns.c']
 
 gnunetservicedns_src = ['gnunet-service-dns.c']
 gnunetdnsredirector_src = ['gnunet-dns-monitor.c']
@@ -12,7 +11,7 @@ configure_file(input : 'dns.conf.in',
                install_dir: pkgcfgdir)
 
 if get_option('monolith')
-  foreach p : libgnunetdns_src + gnunetservicedns_src + libgnunetpluginblockdns_src
+  foreach p : libgnunetdns_src + gnunetservicedns_src
     gnunet_src += 'dns/' + p
   endforeach
 endif
@@ -29,13 +28,6 @@ libgnunetdns_dep = declare_dependency(link_with : libgnunetdns)
 pkg.generate(libgnunetdns, url: 'https://www.gnunet.org',
              description : 'Provides API to access GNUnet\'s DNS service (to intercept and manipulate DNS queries)')
 
-shared_module('gnunet_plugin_block_dns',
-        libgnunetpluginblockdns_src,
-        dependencies: [libgnunetutil_dep, libgnunetblockgroup_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
 executable ('gnunet-service-dns',
             gnunetservicedns_src,
             dependencies: [libgnunetdns_dep, libgnunetutil_dep,
diff --git a/src/service/dns/plugin_block_dns.c b/src/service/dns/plugin_block_dns.c
deleted file mode 100644
index 1bbd7f750..000000000
--- a/src/service/dns/plugin_block_dns.c
+++ /dev/null
@@ -1,290 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2013, 2017 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dns/plugin_block_dns.c
- * @brief block plugin for advertising a DNS exit service
- * @author Christian Grothoff
- *
- * Note that this plugin might more belong with EXIT and PT
- * as those two are using this type of block.  Still, this
- * might be a natural enough place for people to find the code...
- */
-#include "platform.h"
-#include "gnunet_block_plugin.h"
-#include "block_dns.h"
-#include "gnunet_signatures.h"
-#include "gnunet_block_group_lib.h"
-
-
-/**
- * Number of bits we set per entry in the bloomfilter.
- * Do not change!
- */
-#define BLOOMFILTER_K 16
-
-
-/**
- * Create a new block group.
- *
- * @param ctx block context in which the block group is created
- * @param type type of the block for which we are creating the group
- * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
- * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
- * @param va variable arguments specific to @a type
- * @return block group handle, NULL if block groups are not supported
- *         by this @a type of block (this is not an error)
- */
-static struct GNUNET_BLOCK_Group *
-block_plugin_dns_create_group (void *cls,
-                               enum GNUNET_BLOCK_Type type,
-                               const void *raw_data,
-                               size_t raw_data_size,
-                               va_list va)
-{
-  unsigned int bf_size;
-  const char *guard;
-
-  guard = va_arg (va, const char *);
-  if (0 == strcmp (guard,
-                   "seen-set-size"))
-    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
-                                                                   int),
-                                                           BLOOMFILTER_K);
-  else if (0 == strcmp (guard,
-                        "filter-size"))
-    bf_size = va_arg (va, unsigned int);
-  else
-  {
-    GNUNET_break (0);
-    bf_size = 8;
-  }
-  GNUNET_break (NULL == va_arg (va, const char *));
-  return GNUNET_BLOCK_GROUP_bf_create (cls,
-                                       bf_size,
-                                       BLOOMFILTER_K,
-                                       type,
-                                       raw_data,
-                                       raw_data_size);
-}
-
-
-/**
- * Function called to validate a query.
- *
- * @param cls closure
- * @param type block type
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dns_check_query (void *cls,
-                              enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_HashCode *query,
-                              const void *xquery,
-                              size_t xquery_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DNS:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    return GNUNET_OK;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a block for storage.
- *
- * @param cls closure
- * @param type block type
- * @param block block data to validate
- * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dns_check_block (void *cls,
-                              enum GNUNET_BLOCK_Type type,
-                              const void *block,
-                              size_t block_size)
-{
-  const struct GNUNET_DNS_Advertisement *ad;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DNS:
-    if (sizeof(struct GNUNET_DNS_Advertisement) != block_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    ad = block;
-
-    if (ntohl (ad->purpose.size) !=
-        sizeof(struct GNUNET_DNS_Advertisement)
-        - sizeof(struct GNUNET_CRYPTO_EddsaSignature))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    if (GNUNET_TIME_absolute_is_past (
-          GNUNET_TIME_absolute_ntoh (ad->expiration_time)))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "DNS advertisement has expired\n");
-      return GNUNET_NO;
-    }
-    if (GNUNET_OK !=
-        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_DNS_RECORD,
-                                     &ad->purpose,
-                                     &ad->signature,
-                                     &ad->peer.public_key))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    return GNUNET_OK;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a reply to a request.  Note that it is assumed
- * that the reply has already been matched to the key (and signatures checked)
- * as it would be done with the GetKeyFunction and the
- * BlockEvaluationFunction.
- *
- * @param cls closure
- * @param type block type
- * @param group which block group to use for evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_ReplyEvaluationResult
-block_plugin_dns_check_reply (
-  void *cls,
-  enum GNUNET_BLOCK_Type type,
-  struct GNUNET_BLOCK_Group *group,
-  const struct GNUNET_HashCode *query,
-  const void *xquery,
-  size_t xquery_size,
-  const void *reply_block,
-  size_t reply_block_size)
-{
-  struct GNUNET_HashCode phash;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DNS:
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &phash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                            &phash))
-      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-    return GNUNET_BLOCK_REPLY_OK_MORE;
-  default:
-    GNUNET_break (0);
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-}
-
-
-/**
- * Function called to obtain the key for a block.
- *
- * @param cls closure
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes in @a block
- * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_dns_get_key (void *cls,
-                          enum GNUNET_BLOCK_Type type,
-                          const void *block,
-                          size_t block_size,
-                          struct GNUNET_HashCode *key)
-{
-  if (GNUNET_BLOCK_TYPE_DNS != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_NO;
-}
-
-
-/**
- * Entry point for the plugin.
- */
-void *
-libgnunet_plugin_block_dns_init (void *cls)
-{
-  static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_DNS,
-    GNUNET_BLOCK_TYPE_ANY       /* end of list */
-  };
-  struct GNUNET_BLOCK_PluginFunctions *api;
-
-  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->get_key = &block_plugin_dns_get_key;
-  api->check_query = &block_plugin_dns_check_query;
-  api->check_block = &block_plugin_dns_check_block;
-  api->check_reply = &block_plugin_dns_check_reply;
-  api->create_group = &block_plugin_dns_create_group;
-  api->types = types;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- */
-void *
-libgnunet_plugin_block_dns_done (void *cls)
-{
-  struct GNUNET_BLOCK_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_block_dns.c */
diff --git a/src/service/meson.build b/src/service/meson.build
index 6acbc3b10..b089c9794 100644
--- a/src/service/meson.build
+++ b/src/service/meson.build
@@ -2,7 +2,6 @@ subdir('util')
 subdir('arm')
 subdir('statistics')
 subdir('testing')
-subdir('rest')
 subdir('datacache')
 subdir('datastore')
 subdir('peerstore')
@@ -11,6 +10,7 @@ subdir('nat-auto')
 subdir('transport')
 subdir('core')
 subdir('nse')
+subdir('dhtu')
 subdir('dht')
 subdir('hostlist')
 subdir('regex')
@@ -30,6 +30,7 @@ subdir('exit')
 subdir('pt')
 subdir('reclaim')
 subdir('messenger')
+subdir('rest')
 
 if not get_option('monolith')
   subdir_done()
@@ -42,7 +43,10 @@ libgnunet = library('gnunet',
                                    libgnunetjson_dep,
                                    libgnunetblock_dep,
                                    libgnunetblockgroup_dep,
+                                   libgnunetregexblock_dep,
                                    libgnunetgnsrecord_dep,
+                                   libgnunetgnsrecordjson_dep,
+                                   jose_dep,
                                    libgnunetcurl_dep],
                     c_args: ['-DHAVE_GNUNET_MONOLITH=1'],
                     include_directories: [incdir, configuration_inc, exitdir])
diff --git a/src/service/messenger/Makefile.am b/src/service/messenger/Makefile.am
index d778d6e0c..c2ae65a08 100644
--- a/src/service/messenger/Makefile.am
+++ b/src/service/messenger/Makefile.am
@@ -10,19 +10,6 @@ pkgcfgdir= $(pkgdatadir)/config.d/
 
 libexecdir= $(pkglibdir)/libexec/
 
-plugin_LTLIBRARIES = \
-  libgnunet_plugin_gnsrecord_messenger.la
-
-
-libgnunet_plugin_gnsrecord_messenger_la_SOURCES = \
-  plugin_gnsrecord_messenger.c
-libgnunet_plugin_gnsrecord_messenger_la_LIBADD = \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(LTLIBINTL)
-libgnunet_plugin_gnsrecord_messenger_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
 pkgcfg_DATA = \
   messenger.conf
 
diff --git a/src/service/messenger/meson.build b/src/service/messenger/meson.build
index a6de2f516..3c05d7760 100644
--- a/src/service/messenger/meson.build
+++ b/src/service/messenger/meson.build
@@ -55,14 +55,6 @@ libgnunetmessenger_dep = declare_dependency(link_with : libgnunetmessenger)
 pkg.generate(libgnunetmessenger, url: 'https://www.gnunet.org',
              description : 'Provides API to access the GNUnet Messenger subsystem')
 
-shared_module('gnunet_plugin_gnsrecord_messenger',
-              ['plugin_gnsrecord_messenger.c'],
-              dependencies: [libgnunetutil_dep, libgnunetgnsrecord_dep,
-                             libgnunetmessenger_dep],
-              include_directories: [incdir, configuration_inc],
-              install: true,
-              install_dir: get_option('libdir')/'gnunet')
-
 executable ('gnunet-service-messenger',
             gnunetservicemessenger_src,
             dependencies: [libgnunetmessenger_dep,
diff --git a/src/service/messenger/plugin_gnsrecord_messenger.c b/src/service/messenger/plugin_gnsrecord_messenger.c
deleted file mode 100644
index e09a0330d..000000000
--- a/src/service/messenger/plugin_gnsrecord_messenger.c
+++ /dev/null
@@ -1,298 +0,0 @@
-/*
-   This file is part of GNUnet.
-   Copyright (C) 2021--2022 GNUnet e.V.
-
-   GNUnet is free software: you can redistribute it and/or modify it
-   under the terms of the GNU Affero General Public License as published
-   by the Free Software Foundation, either version 3 of the License,
-   or (at your option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Affero General Public License for more details.
-
-   You should have received a copy of the GNU Affero General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-   SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Tobias Frisch
- * @file src/messenger/plugin_gnsrecord_messenger.c
- * @brief Plugin to provide the API for useful GNS records to improve
- *        the usability of the messenger service.
- */
-
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_gnsrecord_lib.h"
-#include "gnunet_messenger_service.h"
-#include "gnunet_gnsrecord_plugin.h"
-
-
-/**
- * Convert the 'value' of a record to a string.
- *
- * @param cls closure, unused
- * @param type type of the record
- * @param data value in binary encoding
- * @param data_size number of bytes in @a data
- * @return NULL on error, otherwise human-readable representation of the value
- */
-static char *
-messenger_value_to_string (void *cls,
-                           uint32_t type,
-                           const void *data,
-                           size_t data_size)
-{
-  (void) cls;
-  switch (type)
-  {
-  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY:
-    {
-      if (data_size != sizeof(struct GNUNET_MESSENGER_RoomEntryRecord))
-      {
-        GNUNET_break_op (0);
-        return NULL;
-      }
-
-      const struct GNUNET_MESSENGER_RoomEntryRecord *record = data;
-
-      char *door = GNUNET_CRYPTO_eddsa_public_key_to_string (&(record->door.public_key));
-      char *key = GNUNET_STRINGS_data_to_string_alloc (&(record->key), sizeof(struct GNUNET_HashCode));
-
-      char *ret;
-      GNUNET_asprintf (&ret, "%s-%s", key, door);
-      GNUNET_free (key);
-      GNUNET_free (door);
-      return ret;
-    }
-  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS:
-    {
-      if (data_size != sizeof(struct GNUNET_MESSENGER_RoomDetailsRecord))
-      {
-        GNUNET_break_op (0);
-        return NULL;
-      }
-
-      const struct GNUNET_MESSENGER_RoomDetailsRecord *record = data;
-
-      char *name = GNUNET_strndup(record->name, 256);
-      char *flags = GNUNET_STRINGS_data_to_string_alloc (&(record->flags), sizeof(uint32_t));
-
-      char *ret;
-      GNUNET_asprintf (&ret, "%s-%s", flags, name);
-      GNUNET_free (flags);
-      GNUNET_free (name);
-      return ret;
-    }
-  default:
-    return NULL;
-  }
-}
-
-
-/**
- * Convert human-readable version of a 'value' of a record to the binary
- * representation.
- *
- * @param cls closure, unused
- * @param type type of the record
- * @param s human-readable string
- * @param data set to value in binary encoding (will be allocated)
- * @param data_size set to number of bytes in @a data
- * @return #GNUNET_OK on success
- */
-static int
-messenger_string_to_value (void *cls,
-                           uint32_t type,
-                           const char *s,
-                           void **data,
-                           size_t *data_size)
-{
-  (void) cls;
-  if (NULL == s)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-
-  switch (type)
-  {
-  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY:
-    {
-      char key [103];
-      const char *dash;
-      struct GNUNET_PeerIdentity door;
-
-      if ((NULL == (dash = strchr (s, '-'))) ||
-          (1 != sscanf (s, "%103s-", key)) ||
-          (GNUNET_OK != GNUNET_CRYPTO_eddsa_public_key_from_string (dash + 1,
-                                                                    strlen (dash + 1),
-                                                                    &(door.public_key))))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                    _ ("Unable to parse MESSENGER_ROOM_ENTRY record `%s'\n"),
-                    s);
-        return GNUNET_SYSERR;
-      }
-
-      struct GNUNET_MESSENGER_RoomEntryRecord *record = GNUNET_new (
-          struct GNUNET_MESSENGER_RoomEntryRecord
-      );
-
-      if (GNUNET_OK != GNUNET_STRINGS_string_to_data (key,
-                                                      strlen (key),
-                                                      &(record->key),
-                                                      sizeof(struct GNUNET_HashCode)))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                    _ ("Unable to parse MESSENGER_ROOM_ENTRY record `%s'\n"),
-                    s);
-        GNUNET_free (record);
-        return GNUNET_SYSERR;
-      }
-
-      record->door = door;
-      *data = record;
-      *data_size = sizeof(struct GNUNET_MESSENGER_RoomEntryRecord);
-      return GNUNET_OK;
-    }
-  case GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS:
-    {
-      char flags [7];
-      const char *dash;
-
-      if ((NULL == (dash = strchr (s, '-'))) ||
-          (1 != sscanf (s, "%7s-", flags)) ||
-          (strlen (dash + 1) > 256))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                    _ ("Unable to parse MESSENGER_ROOM_DETAILS record `%s'\n"),
-                    s);
-        return GNUNET_SYSERR;
-      }
-
-      struct GNUNET_MESSENGER_RoomDetailsRecord *record = GNUNET_new (
-          struct GNUNET_MESSENGER_RoomDetailsRecord
-      );
-
-      if (GNUNET_OK != GNUNET_STRINGS_string_to_data (flags,
-                                                      strlen (flags),
-                                                      &(record->flags),
-                                                      sizeof(uint32_t)))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                    _ ("Unable to parse MESSENGER_ROOM_DETAILS record `%s'\n"),
-                    s);
-        GNUNET_free (record);
-        return GNUNET_SYSERR;
-      }
-
-      GNUNET_memcpy(record->name, dash + 1, strlen(dash + 1));
-
-      *data = record;
-      *data_size = sizeof(struct GNUNET_MESSENGER_RoomDetailsRecord);
-      return GNUNET_OK;
-    }
-  default:
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Mapping of record type numbers to human-readable
- * record type names.
- */
-static struct
-{
-  const char *name;
-  uint32_t number;
-} name_map[] = {
-  { "MESSENGER_ROOM_ENTRY", GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY },
-  { "MESSENGER_ROOM_DETAILS", GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_DETAILS },
-  { NULL, UINT32_MAX }
-};
-
-
-/**
- * Convert a type name (e.g. "AAAA") to the corresponding number.
- *
- * @param cls closure, unused
- * @param gns_typename name to convert
- * @return corresponding number, UINT32_MAX on error
- */
-static uint32_t
-messenger_typename_to_number (void *cls,
-                              const char *gns_typename)
-{
-  unsigned int i;
-
-  (void) cls;
-  i = 0;
-  while ((name_map[i].name != NULL) &&
-         (0 != strcasecmp (gns_typename, name_map[i].name)))
-    i++;
-  return name_map[i].number;
-}
-
-
-/**
- * Convert a type number to the corresponding type string (e.g. 1 to "A")
- *
- * @param cls closure, unused
- * @param type number of a type to convert
- * @return corresponding typestring, NULL on error
- */
-static const char *
-messenger_number_to_typename (void *cls,
-                              uint32_t type)
-{
-  unsigned int i;
-
-  (void) cls;
-  i = 0;
-  while ((name_map[i].name != NULL) &&
-         (type != name_map[i].number))
-    i++;
-  return name_map[i].name;
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls NULL
- * @return the exported block API
- */
-void *
-libgnunet_plugin_gnsrecord_messenger_init (void *cls)
-{
-  struct GNUNET_GNSRECORD_PluginFunctions *api;
-
-  (void) cls;
-  api = GNUNET_new (struct GNUNET_GNSRECORD_PluginFunctions);
-  api->value_to_string = &messenger_value_to_string;
-  api->string_to_value = &messenger_string_to_value;
-  api->typename_to_number = &messenger_typename_to_number;
-  api->number_to_typename = &messenger_number_to_typename;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls the return value from #libgnunet_plugin_block_test_init
- * @return NULL
- */
-void *
-libgnunet_plugin_gnsrecord_messenger_done (void *cls)
-{
-  struct GNUNET_GNSRECORD_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
diff --git a/src/service/namestore/meson.build b/src/service/namestore/meson.build
index 879eaef09..912b312fa 100644
--- a/src/service/namestore/meson.build
+++ b/src/service/namestore/meson.build
@@ -1,7 +1,5 @@
 libgnunetnamestore_src = ['namestore_api.c', 'namestore_api_monitor.c']
-libgnunetpluginnamestore_sqlite_src = ['plugin_namestore_sqlite.c']
 
-gnunetnamestore_src = ['gnunet-namestore.c']
 gnunetservicenamestore_src = ['gnunet-service-namestore.c']
 
 configure_file(input : 'namestore.conf.in',
diff --git a/src/service/peerstore/Makefile.am b/src/service/peerstore/Makefile.am
index 28948b7db..de301bbcf 100644
--- a/src/service/peerstore/Makefile.am
+++ b/src/service/peerstore/Makefile.am
@@ -51,63 +51,15 @@ libgnunetpeerstore_la_LDFLAGS = \
   $(GN_LIBINTL) \
   $(GN_LIB_LDFLAGS)
 
-if HAVE_EXPERIMENTAL
-FLAT_PLUGIN = libgnunet_plugin_peerstore_flat.la
-FLAT_TESTS = test_plugin_peerstore_flat
-libgnunet_plugin_peerstore_flat_la_SOURCES = \
-  plugin_peerstore_flat.c
-libgnunet_plugin_peerstore_flat_la_LIBADD = \
-  libgnunetpeerstore.la  \
-  $(top_builddir)/src/lib/util/libgnunetutil.la $(XLIBS) \
-  $(LTLIBINTL)
-libgnunet_plugin_peerstore_flat_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-endif
-
-if HAVE_SQLITE
-SQLITE_PLUGIN = libgnunet_plugin_peerstore_sqlite.la
-SQLITE_TESTS = test_plugin_peerstore_sqlite
-libgnunet_plugin_peerstore_sqlite_la_SOURCES = \
-  plugin_peerstore_sqlite.c
-libgnunet_plugin_peerstore_sqlite_la_LIBADD = \
-  libgnunetpeerstore.la  \
-  $(top_builddir)/src/lib/sq/libgnunetsq.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(XLIBS) -lsqlite3 \
-  $(LTLIBINTL)
-libgnunet_plugin_peerstore_sqlite_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-endif
-
-plugin_LTLIBRARIES = \
-  $(SQLITE_PLUGIN) \
-        $(FLAT_PLUGIN)
-
-test_plugin_peerstore_sqlite_SOURCES = \
-  test_plugin_peerstore.c
-test_plugin_peerstore_sqlite_LDADD = \
-        $(top_builddir)/src/service/testing/libgnunettesting.la \
-        $(top_builddir)/src/lib/util/libgnunetutil.la
-
-test_plugin_peerstore_flat_SOURCES = \
-  test_plugin_peerstore.c
-test_plugin_peerstore_flat_LDADD = \
-        $(top_builddir)/src/service/testing/libgnunettesting.la \
-        $(top_builddir)/src/lib/util/libgnunetutil.la
-
 check_PROGRAMS = \
  test_peerstore_api_store \
  test_peerstore_api_iterate \
  test_peerstore_api_watch \
  test_peerstore_api_sync \
- perf_peerstore_store \
- $(SQLITE_TESTS) \
- $(FLAT_TESTS)
+ perf_peerstore_store
 
 EXTRA_DIST = \
- test_peerstore_api_data.conf \
- test_plugin_peerstore_flat.conf \
- test_plugin_peerstore_sqlite.conf
+ test_peerstore_api_data.conf
 
 if ENABLE_TEST_RUN
 AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
diff --git a/src/service/peerstore/meson.build b/src/service/peerstore/meson.build
index 7d8710c4b..db70b0b9e 100644
--- a/src/service/peerstore/meson.build
+++ b/src/service/peerstore/meson.build
@@ -28,16 +28,6 @@ pkg.generate(libgnunetpeerstore, url: 'https://www.gnunet.org',
              description : 'Provides API for accessing the peerstore service')
 libgnunetpeerstore_dep = declare_dependency(link_with : libgnunetpeerstore)
 
-shared_module('gnunet_plugin_peerstore_sqlite',
-        ['plugin_peerstore_sqlite.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetpeerstore_dep,
-                       libgnunetsq_dep,
-                       sqlite_dep],
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir')/'gnunet')
-
 executable ('gnunet-service-peerstore',
             gnunetservicepeerstore_src,
             dependencies: [libgnunetpeerstore_dep,
diff --git a/src/service/peerstore/plugin_peerstore_flat.c b/src/service/peerstore/plugin_peerstore_flat.c
deleted file mode 100644
index cc5b8b76b..000000000
--- a/src/service/peerstore/plugin_peerstore_flat.c
+++ /dev/null
@@ -1,606 +0,0 @@
-/*
- * This file is part of GNUnet
- * Copyright (C) 2015 Christian Grothoff (and other contributing authors)
- *
- * GNUnet is free software: you can redistribute it and/or modify it
- * under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License,
- * or (at your option) any later version.
- *
- * GNUnet is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file peerstore/plugin_peerstore_flat.c
- * @brief flat file-based peerstore backend
- * @author Martin Schanzenbach
- */
-
-#include "platform.h"
-#include "gnunet_peerstore_plugin.h"
-#include "gnunet_peerstore_service.h"
-#include "peerstore.h"
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Configuration handle
-   */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-  /**
-   * HashMap
-   */
-  struct GNUNET_CONTAINER_MultiHashMap *hm;
-
-  /**
-   * Iterator
-   */
-  GNUNET_PEERSTORE_Processor iter;
-
-  /**
-   * Iterator cls
-   */
-  void *iter_cls;
-
-  /**
-   * iterator key
-   */
-  const char *iter_key;
-
-  /**
-   * Iterator peer
-   */
-  const struct GNUNET_PeerIdentity *iter_peer;
-
-  /**
-   * Iterator subsystem
-   */
-  const char *iter_sub_system;
-
-  /**
-   * Iterator time
-   */
-  struct GNUNET_TIME_Absolute iter_now;
-
-  /**
-   * Deleted entries
-   */
-  uint64_t deleted_entries;
-
-  /**
-   * Expired entries
-   */
-  uint64_t exp_changes;
-
-  /**
-   * Database filename.
-   */
-  char *fn;
-
-  /**
-   * Result found bool
-   */
-  int iter_result_found;
-};
-
-
-static int
-delete_entries (void *cls,
-                const struct GNUNET_HashCode *key,
-                void *value)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PEERSTORE_Record *entry = value;
-
-  if (0 != strcmp (plugin->iter_key, entry->key))
-    return GNUNET_YES;
-  if (0 != memcmp (plugin->iter_peer,
-                   &entry->peer,
-                   sizeof(struct GNUNET_PeerIdentity)))
-    return GNUNET_YES;
-  if (0 != strcmp (plugin->iter_sub_system, entry->sub_system))
-    return GNUNET_YES;
-
-  GNUNET_CONTAINER_multihashmap_remove (plugin->hm, key, value);
-  plugin->deleted_entries++;
-  return GNUNET_YES;
-}
-
-
-/**
- * Delete records with the given key
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of sub system
- * @param peer Peer identity (can be NULL)
- * @param key entry key string (can be NULL)
- * @return number of deleted records
- */
-static int
-peerstore_flat_delete_records (void *cls, const char *sub_system,
-                               const struct GNUNET_PeerIdentity *peer,
-                               const char *key)
-{
-  struct Plugin *plugin = cls;
-
-  plugin->iter_sub_system = sub_system;
-  plugin->iter_peer = peer;
-  plugin->iter_key = key;
-  plugin->deleted_entries = 0;
-
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
-                                         &delete_entries,
-                                         plugin);
-  return plugin->deleted_entries;
-}
-
-
-static int
-expire_entries (void *cls,
-                const struct GNUNET_HashCode *key,
-                void *value)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PEERSTORE_Record *entry = value;
-
-  if (entry->expiry.abs_value_us < plugin->iter_now.abs_value_us)
-  {
-    GNUNET_CONTAINER_multihashmap_remove (plugin->hm, key, value);
-    plugin->exp_changes++;
-  }
-  return GNUNET_YES;
-}
-
-
-/**
- * Delete expired records (expiry < now)
- *
- * @param cls closure (internal context for the plugin)
- * @param now time to use as reference
- * @param cont continuation called with the number of records expired
- * @param cont_cls continuation closure
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and cont is not
- * called
- */
-static int
-peerstore_flat_expire_records (void *cls, struct GNUNET_TIME_Absolute now,
-                               GNUNET_PEERSTORE_Continuation cont,
-                               void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-
-  plugin->exp_changes = 0;
-  plugin->iter_now = now;
-
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
-                                         &expire_entries,
-                                         plugin);
-  if (NULL != cont)
-  {
-    cont (cont_cls, plugin->exp_changes);
-  }
-  return GNUNET_OK;
-}
-
-
-static int
-iterate_entries (void *cls,
-                 const struct GNUNET_HashCode *key,
-                 void *value)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_PEERSTORE_Record *entry = value;
-
-  if ((NULL != plugin->iter_peer) &&
-      (0 != memcmp (plugin->iter_peer,
-                    &entry->peer,
-                    sizeof(struct GNUNET_PeerIdentity))))
-  {
-    return GNUNET_YES;
-  }
-  if ((NULL != plugin->iter_key) &&
-      (0 != strcmp (plugin->iter_key,
-                    entry->key)))
-  {
-    return GNUNET_YES;
-  }
-  if (NULL != plugin->iter)
-    plugin->iter (plugin->iter_cls, entry, NULL);
-  plugin->iter_result_found = GNUNET_YES;
-  return GNUNET_YES;
-}
-
-
-/**
- * Iterate over the records given an optional peer id
- * and/or key.
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of sub system
- * @param peer Peer identity (can be NULL)
- * @param key entry key string (can be NULL)
- * @param iter function to call asynchronously with the results, terminated
- * by a NULL result
- * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and iter is not
- * called
- */
-static int
-peerstore_flat_iterate_records (void *cls, const char *sub_system,
-                                const struct GNUNET_PeerIdentity *peer,
-                                const char *key,
-                                GNUNET_PEERSTORE_Processor iter,
-                                void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-
-  plugin->iter = iter;
-  plugin->iter_cls = iter_cls;
-  plugin->iter_peer = peer;
-  plugin->iter_sub_system = sub_system;
-  plugin->iter_key = key;
-
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
-                                         &iterate_entries,
-                                         plugin);
-  if (NULL != iter)
-    iter (iter_cls, NULL, NULL);
-  return GNUNET_OK;
-}
-
-
-/**
- * Store a record in the peerstore.
- * Key is the combination of sub system and peer identity.
- * One key can store multiple values.
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of the GNUnet sub system responsible
- * @param peer peer identity
- * @param key record key string
- * @param value value to be stored
- * @param size size of value to be stored
- * @param expiry absolute time after which the record is (possibly) deleted
- * @param options options related to the store operation
- * @param cont continuation called when record is stored
- * @param cont_cls continuation closure
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR and cont is not called
- */
-static int
-peerstore_flat_store_record (void *cls, const char *sub_system,
-                             const struct GNUNET_PeerIdentity *peer,
-                             const char *key, const void *value, size_t size,
-                             struct GNUNET_TIME_Absolute expiry,
-                             enum GNUNET_PEERSTORE_StoreOption options,
-                             GNUNET_PEERSTORE_Continuation cont,
-                             void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_HashCode hkey;
-  struct GNUNET_PEERSTORE_Record *entry;
-  const char *peer_id;
-
-
-  entry = GNUNET_new (struct GNUNET_PEERSTORE_Record);
-  entry->sub_system = GNUNET_strdup (sub_system);
-  entry->key = GNUNET_strdup (key);
-  entry->value = GNUNET_malloc (size);
-  GNUNET_memcpy (entry->value, value, size);
-  entry->value_size = size;
-  entry->peer = *peer;
-  entry->expiry = expiry;
-
-  peer_id = GNUNET_i2s (peer);
-  GNUNET_CRYPTO_hash (peer_id,
-                      strlen (peer_id),
-                      &hkey);
-
-  if (GNUNET_PEERSTORE_STOREOPTION_REPLACE == options)
-  {
-    peerstore_flat_delete_records (cls, sub_system, peer, key);
-  }
-
-  GNUNET_CONTAINER_multihashmap_put (plugin->hm,
-                                     &hkey,
-                                     entry,
-                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-  if (NULL != cont)
-  {
-    cont (cont_cls, GNUNET_OK);
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * Initialize the database connections and associated
- * data structures (create tables and indices
- * as needed as well).
- *
- * @param plugin the plugin context (state for this module)
- * @return GNUNET_OK on success
- */
-static int
-database_setup (struct Plugin *plugin)
-{
-  char *afsdir;
-  char *key;
-  char *sub_system;
-  const char *peer_id;
-  char *peer;
-  char *value;
-  char *expiry;
-  struct GNUNET_DISK_FileHandle *fh;
-  struct GNUNET_PEERSTORE_Record *entry;
-  struct GNUNET_HashCode hkey;
-  uint64_t size;
-  char *buffer;
-  char *line;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg, "peerstore-flat",
-                                               "FILENAME", &afsdir))
-  {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "peerstore-flat",
-                               "FILENAME");
-    return GNUNET_SYSERR;
-  }
-  if (GNUNET_OK != GNUNET_DISK_file_test (afsdir))
-  {
-    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (afsdir))
-    {
-      GNUNET_break (0);
-      GNUNET_free (afsdir);
-      return GNUNET_SYSERR;
-    }
-  }
-  /* afsdir should be UTF-8-encoded. If it isn't, it's a bug */
-  plugin->fn = afsdir;
-
-  fh = GNUNET_DISK_file_open (afsdir,
-                              GNUNET_DISK_OPEN_CREATE
-                              | GNUNET_DISK_OPEN_READWRITE,
-                              GNUNET_DISK_PERM_USER_WRITE
-                              | GNUNET_DISK_PERM_USER_READ);
-  if (NULL == fh)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("Unable to initialize file: %s.\n"),
-                afsdir);
-    return GNUNET_SYSERR;
-  }
-
-  /* Load data from file into hashmap */
-  plugin->hm = GNUNET_CONTAINER_multihashmap_create (10,
-                                                     GNUNET_NO);
-
-  if (GNUNET_SYSERR == GNUNET_DISK_file_size (afsdir,
-                                              &size,
-                                              GNUNET_YES,
-                                              GNUNET_YES))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("Unable to get filesize: %s.\n"),
-                afsdir);
-    return GNUNET_SYSERR;
-  }
-
-  buffer = GNUNET_malloc (size + 1);
-
-  if (GNUNET_SYSERR == GNUNET_DISK_file_read (fh,
-                                              buffer,
-                                              size))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("Unable to read file: %s.\n"),
-                afsdir);
-    GNUNET_DISK_file_close (fh);
-    GNUNET_free (buffer);
-    return GNUNET_SYSERR;
-  }
-
-  buffer[size] = '\0';
-  GNUNET_DISK_file_close (fh);
-  if (0 < size)
-  {
-    line = strtok (buffer, "\n");
-    while (line != NULL)
-    {
-      sub_system = strtok (line, ",");
-      if (NULL == sub_system)
-        break;
-      peer = strtok (NULL, ",");
-      if (NULL == peer)
-        break;
-      key = strtok (NULL, ",");
-      if (NULL == key)
-        break;
-      value = strtok (NULL, ",");
-      if (NULL == value)
-        break;
-      expiry = strtok (NULL, ",");
-      if (NULL == expiry)
-        break;
-      entry = GNUNET_new (struct GNUNET_PEERSTORE_Record);
-      entry->sub_system = GNUNET_strdup (sub_system);
-      entry->key = GNUNET_strdup (key);
-      {
-        size_t s;
-        char *o;
-
-        o = NULL;
-        s = GNUNET_STRINGS_base64_decode (peer,
-                                          strlen (peer),
-                                          (void **) &o);
-        if (sizeof(struct GNUNET_PeerIdentity) == s)
-          GNUNET_memcpy (&entry->peer,
-                         o,
-                         s);
-        else
-          GNUNET_break (0);
-        GNUNET_free (o);
-      }
-      entry->value_size = GNUNET_STRINGS_base64_decode (value,
-                                                        strlen (value),
-                                                        (void **) &entry->value);
-      if (GNUNET_SYSERR ==
-          GNUNET_STRINGS_fancy_time_to_absolute (expiry,
-                                                 &entry->expiry))
-      {
-        GNUNET_free (entry->sub_system);
-        GNUNET_free (entry->key);
-        GNUNET_free (entry);
-        break;
-      }
-      peer_id = GNUNET_i2s (&entry->peer);
-      GNUNET_CRYPTO_hash (peer_id,
-                          strlen (peer_id),
-                          &hkey);
-
-      GNUNET_assert (GNUNET_OK == GNUNET_CONTAINER_multihashmap_put (plugin->hm,
-                                                                     &hkey,
-                                                                     entry,
-                                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
-    }
-  }
-  GNUNET_free (buffer);
-  return GNUNET_OK;
-}
-
-
-static int
-store_and_free_entries (void *cls,
-                        const struct GNUNET_HashCode *key,
-                        void *value)
-{
-  struct GNUNET_DISK_FileHandle *fh = cls;
-  struct GNUNET_PEERSTORE_Record *entry = value;
-  char *line;
-  char *peer;
-  const char *expiry;
-  char *val;
-
-  GNUNET_STRINGS_base64_encode (entry->value,
-                                entry->value_size,
-                                &val);
-  expiry = GNUNET_STRINGS_absolute_time_to_string (entry->expiry);
-  GNUNET_STRINGS_base64_encode ((char *) &entry->peer,
-                                sizeof(struct GNUNET_PeerIdentity),
-                                &peer);
-  GNUNET_asprintf (&line,
-                   "%s,%s,%s,%s,%s",
-                   entry->sub_system,
-                   peer,
-                   entry->key,
-                   val,
-                   expiry);
-  GNUNET_free (val);
-  GNUNET_free (peer);
-  GNUNET_DISK_file_write (fh,
-                          line,
-                          strlen (line));
-  GNUNET_free (entry->sub_system);
-  GNUNET_free (entry->key);
-  GNUNET_free (entry->value);
-  GNUNET_free (entry);
-  GNUNET_free (line);
-  return GNUNET_YES;
-}
-
-
-/**
- * Shutdown database connection and associate data
- * structures.
- * @param plugin the plugin context (state for this module)
- */
-static void
-database_shutdown (struct Plugin *plugin)
-{
-  struct GNUNET_DISK_FileHandle *fh;
-
-  fh = GNUNET_DISK_file_open (plugin->fn,
-                              GNUNET_DISK_OPEN_CREATE
-                              | GNUNET_DISK_OPEN_TRUNCATE
-                              | GNUNET_DISK_OPEN_READWRITE,
-                              GNUNET_DISK_PERM_USER_WRITE
-                              | GNUNET_DISK_PERM_USER_READ);
-  if (NULL == fh)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("Unable to initialize file: %s.\n"),
-                plugin->fn);
-    return;
-  }
-  GNUNET_CONTAINER_multihashmap_iterate (plugin->hm,
-                                         &store_and_free_entries,
-                                         fh);
-  GNUNET_CONTAINER_multihashmap_destroy (plugin->hm);
-  GNUNET_DISK_file_close (fh);
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls The struct GNUNET_CONFIGURATION_Handle.
- * @return NULL on error, otherwise the plugin context
- */
-void *
-libgnunet_plugin_peerstore_flat_init (void *cls)
-{
-  static struct Plugin plugin;
-  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
-  struct GNUNET_PEERSTORE_PluginFunctions *api;
-
-  if (NULL != plugin.cfg)
-    return NULL;                /* can only initialize once! */
-  memset (&plugin, 0, sizeof(struct Plugin));
-  plugin.cfg = cfg;
-  if (GNUNET_OK != database_setup (&plugin))
-  {
-    database_shutdown (&plugin);
-    return NULL;
-  }
-  api = GNUNET_new (struct GNUNET_PEERSTORE_PluginFunctions);
-  api->cls = &plugin;
-  api->store_record = &peerstore_flat_store_record;
-  api->iterate_records = &peerstore_flat_iterate_records;
-  api->expire_records = &peerstore_flat_expire_records;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Flat plugin is running\n");
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls The plugin context (as returned by "init")
- * @return Always NULL
- */
-void *
-libgnunet_plugin_peerstore_flat_done (void *cls)
-{
-  struct GNUNET_PEERSTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  database_shutdown (plugin);
-  plugin->cfg = NULL;
-  GNUNET_free (api);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Flat plugin is finished\n");
-  return NULL;
-}
-
-
-/* end of plugin_peerstore_sqlite.c */
diff --git a/src/service/peerstore/plugin_peerstore_sqlite.c b/src/service/peerstore/plugin_peerstore_sqlite.c
deleted file mode 100644
index ad69efdf4..000000000
--- a/src/service/peerstore/plugin_peerstore_sqlite.c
+++ /dev/null
@@ -1,702 +0,0 @@
-/*
- * This file is part of GNUnet
- * Copyright (C) 2013, 2017 GNUnet e.V.
- *
- * GNUnet is free software: you can redistribute it and/or modify it
- * under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License,
- * or (at your option) any later version.
- *
- * GNUnet is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file peerstore/plugin_peerstore_sqlite.c
- * @brief sqlite-based peerstore backend
- * @author Omar Tarabai
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_peerstore_plugin.h"
-#include "gnunet_peerstore_service.h"
-#include "gnunet_sq_lib.h"
-#include "peerstore.h"
-#include <sqlite3.h>
-
-/**
- * After how many ms "busy" should a DB operation fail for good?  A
- * low value makes sure that we are more responsive to requests
- * (especially PUTs).  A high value guarantees a higher success rate
- * (SELECTs in iterate can take several seconds despite LIMIT=1).
- *
- * The default value of 1s should ensure that users do not experience
- * huge latencies while at the same time allowing operations to
- * succeed with reasonable probability.
- */
-#define BUSY_TIMEOUT_MS 1000
-
-/**
- * Log an error message at log-level 'level' that indicates
- * a failure of the command 'cmd' on file 'filename'
- * with the message given by strerror(errno).
- */
-#define LOG_SQLITE(db, level, cmd) do { GNUNET_log_from (level, \
-                                                         "peerstore-sqlite", _ ( \
-                                                           "`%s' failed at %s:%d with error: %s\n"), \
-                                                         cmd, \
-                                                         __FILE__, __LINE__, \
-                                                         sqlite3_errmsg ( \
-                                                           db->dbh)); \
-} while (0)
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "peerstore-sqlite", __VA_ARGS__)
-
-/**
- * Context for all functions in this plugin.
- */
-struct Plugin
-{
-  /**
-   * Configuration handle
-   */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-  /**
-   * Database filename.
-   */
-  char *fn;
-
-  /**
-   * Native SQLite database handle.
-   */
-  sqlite3 *dbh;
-
-  /**
-   * Precompiled SQL for inserting into peerstoredata
-   */
-  sqlite3_stmt *insert_peerstoredata;
-
-  /**
-   * Precompiled SQL for selecting from peerstoredata
-   */
-  sqlite3_stmt *select_peerstoredata;
-
-  /**
-   * Precompiled SQL for selecting from peerstoredata
-   */
-  sqlite3_stmt *select_peerstoredata_by_pid;
-
-  /**
-   * Precompiled SQL for selecting from peerstoredata
-   */
-  sqlite3_stmt *select_peerstoredata_by_key;
-
-  /**
-   * Precompiled SQL for selecting from peerstoredata
-   */
-  sqlite3_stmt *select_peerstoredata_by_all;
-
-  /**
-   * Precompiled SQL for deleting expired
-   * records from peerstoredata
-   */
-  sqlite3_stmt *expire_peerstoredata;
-
-  /**
-   * Precompiled SQL for deleting records
-   * with given key
-   */
-  sqlite3_stmt *delete_peerstoredata;
-};
-
-
-/**
- * Delete records with the given key
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of sub system
- * @param peer Peer identity (can be NULL)
- * @param key entry key string (can be NULL)
- * @return number of deleted records, #GNUNE_SYSERR on error
- */
-static int
-peerstore_sqlite_delete_records (void *cls,
-                                 const char *sub_system,
-                                 const struct GNUNET_PeerIdentity *peer,
-                                 const char *key)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt = plugin->delete_peerstoredata;
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_string (sub_system),
-    GNUNET_SQ_query_param_auto_from_type (peer),
-    GNUNET_SQ_query_param_string (key),
-    GNUNET_SQ_query_param_end
-  };
-  int ret;
-
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (stmt,
-                      params))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind");
-    GNUNET_SQ_reset (plugin->dbh,
-                     stmt);
-    return GNUNET_SYSERR;
-  }
-  if (SQLITE_DONE !=
-      sqlite3_step (stmt))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    ret = GNUNET_SYSERR;
-  }
-  else
-  {
-    ret = sqlite3_changes (plugin->dbh);
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   stmt);
-  return ret;
-}
-
-
-/**
- * Delete expired records (expiry < now)
- *
- * @param cls closure (internal context for the plugin)
- * @param now time to use as reference
- * @param cont continuation called with the number of records expired
- * @param cont_cls continuation closure
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and cont is not
- * called
- */
-static int
-peerstore_sqlite_expire_records (void *cls, struct GNUNET_TIME_Absolute now,
-                                 GNUNET_PEERSTORE_Continuation cont,
-                                 void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt = plugin->expire_peerstoredata;
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_absolute_time (&now),
-    GNUNET_SQ_query_param_end
-  };
-
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (stmt,
-                      params))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind");
-    GNUNET_SQ_reset (plugin->dbh,
-                     stmt);
-    return GNUNET_SYSERR;
-  }
-  if (SQLITE_DONE != sqlite3_step (stmt))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-    GNUNET_SQ_reset (plugin->dbh,
-                     stmt);
-    return GNUNET_SYSERR;
-  }
-  if (NULL != cont)
-    cont (cont_cls,
-          sqlite3_changes (plugin->dbh));
-  GNUNET_SQ_reset (plugin->dbh,
-                   stmt);
-  return GNUNET_OK;
-}
-
-
-/**
- * Iterate over the records given an optional peer id
- * and/or key.
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of sub system
- * @param peer Peer identity (can be NULL)
- * @param key entry key string (can be NULL)
- * @param iter function to call asynchronously with the results, terminated
- * by a NULL result
- * @param iter_cls closure for @a iter
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error and iter is not
- * called
- */
-static int
-peerstore_sqlite_iterate_records (void *cls,
-                                  const char *sub_system,
-                                  const struct GNUNET_PeerIdentity *peer,
-                                  const char *key,
-                                  GNUNET_PEERSTORE_Processor iter,
-                                  void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt;
-  int err = 0;
-  int sret;
-  struct GNUNET_PEERSTORE_Record rec;
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Executing iterate request on sqlite db.\n");
-  if (NULL == peer)
-  {
-    if (NULL == key)
-    {
-      struct GNUNET_SQ_QueryParam params[] = {
-        GNUNET_SQ_query_param_string (sub_system),
-        GNUNET_SQ_query_param_end
-      };
-
-      stmt = plugin->select_peerstoredata;
-      err = GNUNET_SQ_bind (stmt,
-                            params);
-    }
-    else
-    {
-      struct GNUNET_SQ_QueryParam params[] = {
-        GNUNET_SQ_query_param_string (sub_system),
-        GNUNET_SQ_query_param_string (key),
-        GNUNET_SQ_query_param_end
-      };
-
-      stmt = plugin->select_peerstoredata_by_key;
-      err = GNUNET_SQ_bind (stmt,
-                            params);
-    }
-  }
-  else
-  {
-    if (NULL == key)
-    {
-      struct GNUNET_SQ_QueryParam params[] = {
-        GNUNET_SQ_query_param_string (sub_system),
-        GNUNET_SQ_query_param_auto_from_type (peer),
-        GNUNET_SQ_query_param_end
-      };
-
-      stmt = plugin->select_peerstoredata_by_pid;
-      err = GNUNET_SQ_bind (stmt,
-                            params);
-    }
-    else
-    {
-      struct GNUNET_SQ_QueryParam params[] = {
-        GNUNET_SQ_query_param_string (sub_system),
-        GNUNET_SQ_query_param_auto_from_type (peer),
-        GNUNET_SQ_query_param_string (key),
-        GNUNET_SQ_query_param_end
-      };
-
-      stmt = plugin->select_peerstoredata_by_all;
-      err = GNUNET_SQ_bind (stmt,
-                            params);
-    }
-  }
-
-  if (GNUNET_OK != err)
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind_XXXX");
-    GNUNET_SQ_reset (plugin->dbh,
-                     stmt);
-    return GNUNET_SYSERR;
-  }
-
-  err = 0;
-  while (SQLITE_ROW == (sret = sqlite3_step (stmt)))
-  {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Returning a matched record.\n");
-    struct GNUNET_SQ_ResultSpec rs[] = {
-      GNUNET_SQ_result_spec_string (&rec.sub_system),
-      GNUNET_SQ_result_spec_auto_from_type (&rec.peer),
-      GNUNET_SQ_result_spec_string (&rec.key),
-      GNUNET_SQ_result_spec_variable_size (&rec.value, &rec.value_size),
-      GNUNET_SQ_result_spec_absolute_time (&rec.expiry),
-      GNUNET_SQ_result_spec_end
-    };
-
-    if (GNUNET_OK !=
-        GNUNET_SQ_extract_result (stmt,
-                                  rs))
-    {
-      GNUNET_break (0);
-      break;
-    }
-    if (NULL != iter)
-      iter (iter_cls,
-            &rec,
-            NULL);
-    GNUNET_SQ_cleanup_result (rs);
-  }
-  if (SQLITE_DONE != sret)
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite_step");
-    err = 1;
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   stmt);
-  if (NULL != iter)
-    iter (iter_cls,
-          NULL,
-          err ? "sqlite error" : NULL);
-  return GNUNET_OK;
-}
-
-
-/**
- * Store a record in the peerstore.
- * Key is the combination of sub system and peer identity.
- * One key can store multiple values.
- *
- * @param cls closure (internal context for the plugin)
- * @param sub_system name of the GNUnet sub system responsible
- * @param peer peer identity
- * @param key record key string
- * @param value value to be stored
- * @param size size of value to be stored
- * @param expiry absolute time after which the record is (possibly) deleted
- * @param options options related to the store operation
- * @param cont continuation called when record is stored
- * @param cont_cls continuation closure
- * @return #GNUNET_OK on success, else #GNUNET_SYSERR and cont is not called
- */
-static int
-peerstore_sqlite_store_record (void *cls,
-                               const char *sub_system,
-                               const struct GNUNET_PeerIdentity *peer,
-                               const char *key,
-                               const void *value,
-                               size_t size,
-                               struct GNUNET_TIME_Absolute expiry,
-                               enum GNUNET_PEERSTORE_StoreOption options,
-                               GNUNET_PEERSTORE_Continuation cont,
-                               void *cont_cls)
-{
-  struct Plugin *plugin = cls;
-  sqlite3_stmt *stmt = plugin->insert_peerstoredata;
-  struct GNUNET_SQ_QueryParam params[] = {
-    GNUNET_SQ_query_param_string (sub_system),
-    GNUNET_SQ_query_param_auto_from_type (peer),
-    GNUNET_SQ_query_param_string (key),
-    GNUNET_SQ_query_param_fixed_size (value, size),
-    GNUNET_SQ_query_param_absolute_time (&expiry),
-    GNUNET_SQ_query_param_end
-  };
-
-  if (GNUNET_PEERSTORE_STOREOPTION_REPLACE == options)
-  {
-    peerstore_sqlite_delete_records (cls,
-                                     sub_system,
-                                     peer,
-                                     key);
-  }
-  if (GNUNET_OK !=
-      GNUNET_SQ_bind (stmt,
-                      params))
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_bind");
-  else if (SQLITE_DONE != sqlite3_step (stmt))
-  {
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
-                "sqlite3_step");
-  }
-  GNUNET_SQ_reset (plugin->dbh,
-                   stmt);
-  if (NULL != cont)
-    cont (cont_cls,
-          GNUNET_OK);
-  return GNUNET_OK;
-}
-
-
-/**
- * @brief Prepare a SQL statement
- *
- * @param dbh handle to the database
- * @param sql SQL statement, UTF-8 encoded
- * @return 0 on success
- */
-static int
-sql_exec (sqlite3 *dbh,
-          const char *sql)
-{
-  int result;
-
-  result = sqlite3_exec (dbh,
-                         sql,
-                         NULL,
-                         NULL,
-                         NULL);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Executed `%s' / %d\n",
-       sql,
-       result);
-  if (SQLITE_OK != result)
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-         _ ("Error executing SQL query: %s\n  %s\n"),
-         sqlite3_errmsg (dbh),
-         sql);
-  return result;
-}
-
-
-/**
- * @brief Prepare a SQL statement
- *
- * @param dbh handle to the database
- * @param sql SQL statement, UTF-8 encoded
- * @param stmt set to the prepared statement
- * @return 0 on success
- */
-static int
-sql_prepare (sqlite3 *dbh,
-             const char *sql,
-             sqlite3_stmt **stmt)
-{
-  char *tail;
-  int result;
-
-  result = sqlite3_prepare_v2 (dbh,
-                               sql,
-                               strlen (sql),
-                               stmt,
-                               (const char **) &tail);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Prepared `%s' / %p: %d\n",
-       sql,
-       *stmt,
-       result);
-  if (SQLITE_OK != result)
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-         _ ("Error preparing SQL query: %s\n  %s\n"),
-         sqlite3_errmsg (dbh),
-         sql);
-  return result;
-}
-
-
-/**
- * Initialize the database connections and associated
- * data structures (create tables and indices
- * as needed as well).
- *
- * @param plugin the plugin context (state for this module)
- * @return #GNUNET_OK on success
- */
-static int
-database_setup (struct Plugin *plugin)
-{
-  char *filename;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_filename (plugin->cfg,
-                                               "peerstore-sqlite",
-                                               "FILENAME",
-                                               &filename))
-  {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
-                               "peerstore-sqlite",
-                               "FILENAME");
-    return GNUNET_SYSERR;
-  }
-  if (GNUNET_OK != GNUNET_DISK_file_test (filename))
-  {
-    if (GNUNET_OK != GNUNET_DISK_directory_create_for_file (filename))
-    {
-      GNUNET_break (0);
-      GNUNET_free (filename);
-      return GNUNET_SYSERR;
-    }
-  }
-  /* filename should be UTF-8-encoded. If it isn't, it's a bug */
-  plugin->fn = filename;
-  /* Open database and precompile statements */
-  if (SQLITE_OK != sqlite3_open (plugin->fn,
-                                 &plugin->dbh))
-  {
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-         _ ("Unable to initialize SQLite: %s.\n"),
-         sqlite3_errmsg (plugin->dbh));
-    return GNUNET_SYSERR;
-  }
-  sql_exec (plugin->dbh,
-            "PRAGMA temp_store=MEMORY");
-  sql_exec (plugin->dbh,
-            "PRAGMA synchronous=OFF");
-  sql_exec (plugin->dbh,
-            "PRAGMA legacy_file_format=OFF");
-  sql_exec (plugin->dbh,
-            "PRAGMA auto_vacuum=INCREMENTAL");
-  sql_exec (plugin->dbh,
-            "PRAGMA encoding=\"UTF-8\"");
-  sql_exec (plugin->dbh,
-            "PRAGMA page_size=4096");
-  sqlite3_busy_timeout (plugin->dbh,
-                        BUSY_TIMEOUT_MS);
-  /* Create tables */
-  sql_exec (plugin->dbh,
-            "CREATE TABLE IF NOT EXISTS peerstoredata (\n"
-            "  sub_system TEXT NOT NULL,\n"
-            "  peer_id BLOB NOT NULL,\n"
-            "  key TEXT NOT NULL,\n"
-            "  value BLOB NULL,\n"
-            "  expiry INT8 NOT NULL" ");");
-  /* Create Indices */
-  if (SQLITE_OK !=
-      sqlite3_exec (plugin->dbh,
-                    "CREATE INDEX IF NOT EXISTS peerstoredata_key_index ON peerstoredata (sub_system, peer_id, key)",
-                    NULL,
-                    NULL,
-                    NULL))
-  {
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-         _ ("Unable to create indices: %s.\n"),
-         sqlite3_errmsg (plugin->dbh));
-    return GNUNET_SYSERR;
-  }
-  /* Prepare statements */
-
-  sql_prepare (plugin->dbh,
-               "INSERT INTO peerstoredata (sub_system, peer_id, key, value, expiry)"
-               " VALUES (?,?,?,?,?);",
-               &plugin->insert_peerstoredata);
-  sql_prepare (plugin->dbh,
-               "SELECT sub_system,peer_id,key,value,expiry FROM peerstoredata"
-               " WHERE sub_system = ?",
-               &plugin->select_peerstoredata);
-  sql_prepare (plugin->dbh,
-               "SELECT sub_system,peer_id,key,value,expiry FROM peerstoredata"
-               " WHERE sub_system = ?"
-               " AND peer_id = ?",
-               &plugin->select_peerstoredata_by_pid);
-  sql_prepare (plugin->dbh,
-               "SELECT sub_system,peer_id,key,value,expiry FROM peerstoredata"
-               " WHERE sub_system = ?"
-               " AND key = ?",
-               &plugin->select_peerstoredata_by_key);
-  sql_prepare (plugin->dbh,
-               "SELECT sub_system,peer_id,key,value,expiry FROM peerstoredata"
-               " WHERE sub_system = ?"
-               " AND peer_id = ?" " AND key = ?",
-               &plugin->select_peerstoredata_by_all);
-  sql_prepare (plugin->dbh,
-               "DELETE FROM peerstoredata"
-               " WHERE expiry < ?",
-               &plugin->expire_peerstoredata);
-  sql_prepare (plugin->dbh,
-               "DELETE FROM peerstoredata"
-               " WHERE sub_system = ?"
-               " AND peer_id = ?" " AND key = ?",
-               &plugin->delete_peerstoredata);
-  return GNUNET_OK;
-}
-
-
-/**
- * Shutdown database connection and associate data
- * structures.
- * @param plugin the plugin context (state for this module)
- */
-static void
-database_shutdown (struct Plugin *plugin)
-{
-  int result;
-  sqlite3_stmt *stmt;
-
-  while (NULL != (stmt = sqlite3_next_stmt (plugin->dbh,
-                                            NULL)))
-  {
-    result = sqlite3_finalize (stmt);
-    if (SQLITE_OK != result)
-      LOG (GNUNET_ERROR_TYPE_WARNING,
-           "Failed to close statement %p: %d\n",
-           stmt,
-           result);
-  }
-  if (SQLITE_OK != sqlite3_close (plugin->dbh))
-    LOG_SQLITE (plugin,
-                GNUNET_ERROR_TYPE_ERROR,
-                "sqlite3_close");
-  GNUNET_free (plugin->fn);
-}
-
-
-/**
- * Entry point for the plugin.
- *
- * @param cls The struct GNUNET_CONFIGURATION_Handle.
- * @return NULL on error, otherwise the plugin context
- */
-void *
-libgnunet_plugin_peerstore_sqlite_init (void *cls)
-{
-  static struct Plugin plugin;
-  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
-  struct GNUNET_PEERSTORE_PluginFunctions *api;
-
-  if (NULL != plugin.cfg)
-    return NULL;                /* can only initialize once! */
-  memset (&plugin,
-          0,
-          sizeof(struct Plugin));
-  plugin.cfg = cfg;
-  if (GNUNET_OK != database_setup (&plugin))
-  {
-    database_shutdown (&plugin);
-    return NULL;
-  }
-  api = GNUNET_new (struct GNUNET_PEERSTORE_PluginFunctions);
-  api->cls = &plugin;
-  api->store_record = &peerstore_sqlite_store_record;
-  api->iterate_records = &peerstore_sqlite_iterate_records;
-  api->expire_records = &peerstore_sqlite_expire_records;
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Sqlite plugin is running\n");
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- *
- * @param cls The plugin context (as returned by "init")
- * @return Always NULL
- */
-void *
-libgnunet_plugin_peerstore_sqlite_done (void *cls)
-{
-  struct GNUNET_PEERSTORE_PluginFunctions *api = cls;
-  struct Plugin *plugin = api->cls;
-
-  database_shutdown (plugin);
-  plugin->cfg = NULL;
-  GNUNET_free (api);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Sqlite plugin is finished\n");
-  return NULL;
-}
-
-
-/* end of plugin_peerstore_sqlite.c */
diff --git a/src/service/peerstore/test_plugin_peerstore.c b/src/service/peerstore/test_plugin_peerstore.c
deleted file mode 100644
index bce62dda9..000000000
--- a/src/service/peerstore/test_plugin_peerstore.c
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2015 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/*
- * @file namestore/test_plugin_namestore.c
- * @brief Test for the namestore plugins
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_peerstore_plugin.h"
-#include "gnunet_testing_lib.h"
-
-
-static int ok;
-
-/**
- * Name of plugin under test.
- */
-static const char *plugin_name;
-
-
-static struct GNUNET_PEERSTORE_PluginFunctions *psp;
-
-static struct GNUNET_PeerIdentity p1;
-
-
-/**
- * Function called when the service shuts down.  Unloads our namestore
- * plugin.
- *
- * @param api api to unload
- */
-static void
-unload_plugin (struct GNUNET_PEERSTORE_PluginFunctions *api)
-{
-  char *libname;
-
-  GNUNET_asprintf (&libname,
-                   "libgnunet_plugin_peer_%s",
-                   plugin_name);
-  GNUNET_break (NULL ==
-                GNUNET_PLUGIN_unload (libname,
-                                      api));
-  GNUNET_free (libname);
-}
-
-
-/**
- * Load the namestore plugin.
- *
- * @param cfg configuration to pass
- * @return NULL on error
- */
-static struct GNUNET_PEERSTORE_PluginFunctions *
-load_plugin (const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  struct GNUNET_PEERSTORE_PluginFunctions *ret;
-  char *libname;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              _ ("Loading `%s' peer plugin\n"),
-              plugin_name);
-  GNUNET_asprintf (&libname,
-                   "libgnunet_plugin_peerstore_%s",
-                   plugin_name);
-  if (NULL == (ret = GNUNET_PLUGIN_load (libname,
-                                         (void *) cfg)))
-  {
-    fprintf (stderr,
-             "Failed to load plugin `%s'!\n",
-             plugin_name);
-    GNUNET_free (libname);
-    return NULL;
-  }
-  GNUNET_free (libname);
-  return ret;
-}
-
-
-static void
-test_record (void *cls,
-             const struct GNUNET_PEERSTORE_Record *record,
-             const char *error)
-{
-  const struct GNUNET_PeerIdentity *id = cls;
-  const char*testval = "test_val";
-
-  if (NULL == record)
-  {
-    unload_plugin (psp);
-    return;
-  }
-  GNUNET_assert (0 == memcmp (&record->peer,
-                              id,
-                              sizeof(struct GNUNET_PeerIdentity)));
-  GNUNET_assert (0 == strcmp ("subsys",
-                              record->sub_system));
-  GNUNET_assert (0 == strcmp ("key",
-                              record->key));
-  GNUNET_assert (0 == memcmp (testval,
-                              record->value,
-                              strlen (testval)));
-  ok = 0;
-}
-
-
-static void
-get_record (struct GNUNET_PEERSTORE_PluginFunctions *psp,
-            const struct GNUNET_PeerIdentity *identity)
-{
-  GNUNET_assert (GNUNET_OK ==
-                 psp->iterate_records (psp->cls,
-                                       "subsys",
-                                       identity,
-                                       "key",
-                                       &test_record,
-                                       (void *) identity));
-}
-
-
-static void
-store_cont (void *cls,
-            int status)
-{
-  GNUNET_assert (GNUNET_OK == status);
-  get_record (psp,
-              &p1);
-}
-
-
-static void
-put_record (struct GNUNET_PEERSTORE_PluginFunctions *psp,
-            const struct GNUNET_PeerIdentity *identity)
-{
-  GNUNET_assert (GNUNET_OK ==
-                 psp->store_record (psp->cls,
-                                    "subsys",
-                                    identity,
-                                    "key",
-                                    "test_value",
-                                    strlen ("test_value"),
-                                    GNUNET_TIME_absolute_get (),
-                                    GNUNET_PEERSTORE_STOREOPTION_REPLACE,
-                                    &store_cont,
-                                    NULL));
-}
-
-
-static void
-run (void *cls,
-     char *const *args,
-     const char *cfgfile,
-     const struct GNUNET_CONFIGURATION_Handle *cfg)
-{
-  ok = 1;
-  psp = load_plugin (cfg);
-  if (NULL == psp)
-  {
-    fprintf (stderr,
-             "%s",
-             "Failed to initialize peerstore.  Database likely not setup, skipping test.\n");
-    return;
-  }
-  memset (&p1, 1, sizeof(p1));
-  put_record (psp,
-              &p1);
-}
-
-
-int
-main (int argc, char *argv[])
-{
-  char cfg_name[PATH_MAX];
-  char *const xargv[] = {
-    "test-plugin-peerstore",
-    "-c",
-    cfg_name,
-    NULL
-  };
-  struct GNUNET_GETOPT_CommandLineOption options[] = {
-    GNUNET_GETOPT_OPTION_END
-  };
-
-  GNUNET_log_setup ("test-plugin-peerstore",
-                    "WARNING",
-                    NULL);
-  plugin_name = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
-  GNUNET_snprintf (cfg_name,
-                   sizeof(cfg_name),
-                   "test_plugin_peerstore_%s.conf",
-                   plugin_name);
-  GNUNET_PROGRAM_run ((sizeof(xargv) / sizeof(char *)) - 1,
-                      xargv,
-                      "test-plugin-peerstore",
-                      "nohelp",
-                      options,
-                      &run,
-                      NULL);
-  if (ok != 0)
-    fprintf (stderr,
-             "Missed some testcases: %d\n",
-             ok);
-  return ok;
-}
-
-
-/* end of test_plugin_peerstore.c */
diff --git a/src/service/peerstore/test_plugin_peerstore_flat.conf b/src/service/peerstore/test_plugin_peerstore_flat.conf
deleted file mode 100644
index c55b1e9d6..000000000
--- a/src/service/peerstore/test_plugin_peerstore_flat.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-[peerstore-flat]
-FILENAME = $GNUNET_TMP/gnunet-test-plugin-namestore-flat/flatdb
-
-[peerstore]
-# PREFIX = valgrind --log-file=/home/schanzen/dev/gnunet/src/peerstore/vg_log
diff --git a/src/service/peerstore/test_plugin_peerstore_sqlite.conf b/src/service/peerstore/test_plugin_peerstore_sqlite.conf
deleted file mode 100644
index dcf1fc1a4..000000000
--- a/src/service/peerstore/test_plugin_peerstore_sqlite.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[peerstore-sqlite]
-FILENAME = $GNUNET_TMP/gnunet-test-plugin-peerstore-sqlite/sqlite.db
diff --git a/src/service/regex/Makefile.am b/src/service/regex/Makefile.am
index 14cdb054b..255988889 100644
--- a/src/service/regex/Makefile.am
+++ b/src/service/regex/Makefile.am
@@ -31,27 +31,15 @@ REGEX_INTERNAL_TEST = \
 gnunet_service_regex_SOURCES =  \
  $(REGEX_INTERNAL) gnunet-service-regex.c
 gnunet_service_regex_LDADD =  -lm \
- libgnunetregexblock.la \
+ $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
  $(top_builddir)/src/service/dht/libgnunetdht.la \
  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
  $(top_builddir)/src/lib/util/libgnunetutil.la \
  $(GN_LIBINTL)
 
 lib_LTLIBRARIES = \
-  libgnunetregexblock.la \
   libgnunetregex.la
 
-libgnunetregexblock_la_SOURCES = \
-  regex_block_lib.c regex_block_lib.h
-libgnunetregexblock_la_LIBADD = \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(XLIB) \
-  $(LTLIBINTL)
-libgnunetregexblock_la_LDFLAGS = \
-  $(GN_LIB_LDFLAGS)  \
-  -version-info 1:0:0
-
-
 libgnunetregex_la_SOURCES = \
   regex_api_announce.c \
   regex_api_search.c \
@@ -64,20 +52,6 @@ libgnunetregex_la_LDFLAGS = \
    -version-info 3:1:0
 
 
-plugin_LTLIBRARIES = \
- libgnunet_plugin_block_regex.la
-
-libgnunet_plugin_block_regex_la_SOURCES = \
- plugin_block_regex.c
-libgnunet_plugin_block_regex_la_LIBADD = \
- libgnunetregexblock.la \
- $(top_builddir)/src/lib/block/libgnunetblock.la \
- $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
- $(top_builddir)/src/lib/util/libgnunetutil.la
-libgnunet_plugin_block_regex_la_LDFLAGS = \
- $(GN_LIBINTL) \
- $(GN_PLUGIN_LDFLAGS)
-
 # FIXME we phased out mysql. If we want to keep, needs rewrite
 #if HAVE_MYSQL
 #noinst_mysql_progs = \
@@ -100,7 +74,7 @@ perf_regex_SOURCES = \
   $(REGEX_INTERNAL_TEST) perf-regex.c
 perf_regex_LDADD = -lm \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la
 perf_regex_LDFLAGS = \
@@ -110,7 +84,7 @@ gnunet_daemon_regexprofiler_SOURCES = \
   $(REGEX_INTERNAL_TEST) gnunet-daemon-regexprofiler.c
 gnunet_daemon_regexprofiler_LDADD = -lm \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la
 gnunet_daemon_regexprofiler_LDFLAGS = \
@@ -133,7 +107,7 @@ test_regex_eval_api_SOURCES = \
   $(REGEX_INTERNAL_TEST) test_regex_eval_api.c
 test_regex_eval_api_LDADD = -lm \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la
 
@@ -154,7 +128,7 @@ test_regex_api_LDADD = -lm \
 test_regex_iterate_api_SOURCES = \
   $(REGEX_INTERNAL) test_regex_iterate_api.c
 test_regex_iterate_api_LDADD = -lm \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la
@@ -163,7 +137,7 @@ test_regex_proofs_SOURCES = \
   $(REGEX_INTERNAL_TEST) test_regex_proofs.c
 test_regex_proofs_LDADD = -lm \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la
 
@@ -171,7 +145,7 @@ test_regex_graph_api_SOURCES = \
   $(REGEX_INTERNAL_TEST) test_regex_graph_api.c
 test_regex_graph_api_LDADD = -lm \
   $(top_builddir)/src/service/dht/libgnunetdht.la \
-  libgnunetregexblock.la \
+  $(top_builddir)/src/plugin/regex/libgnunetregexblock.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/lib/util/libgnunetutil.la
 
diff --git a/src/service/regex/meson.build b/src/service/regex/meson.build
index da607ca47..3c25a5148 100644
--- a/src/service/regex/meson.build
+++ b/src/service/regex/meson.build
@@ -1,7 +1,5 @@
 libgnunetregex_src = ['regex_api_announce.c',
                      'regex_api_search.c']
-libgnunetregexblock_src = ['regex_block_lib.c']
-
 gnunetserviceregex_src = ['gnunet-service-regex.c',
                           'regex_internal_dht.c',
                           'regex_internal.c']
@@ -14,7 +12,7 @@ configure_file(input : 'regex.conf.in',
 
 
 if get_option('monolith')
-  foreach p : libgnunetregex_src + libgnunetregexblock_src + gnunetserviceregex_src
+  foreach p : libgnunetregex_src + gnunetserviceregex_src
     gnunet_src += 'regex/' + p
   endforeach
 endif
@@ -30,26 +28,6 @@ libgnunetregex = library('gnunetregex',
 pkg.generate(libgnunetregex, url: 'https://www.gnunet.org',
              description : 'Provides API for accessing the regex service')
 libgnunetregex_dep = declare_dependency(link_with : libgnunetregex)
-libgnunetregexblock = library('gnunetregexblock',
-        libgnunetregexblock_src,
-        soversion: '1',
-        version: '1.0.0',
-        dependencies: libgnunetutil_dep,
-        include_directories: [incdir, configuration_inc],
-        install: true,
-        install_dir: get_option('libdir'))
-libgnunetregexblock_dep = declare_dependency(link_with : libgnunetregexblock)
-
-shared_module('gnunet_plugin_block_regex',
-        ['plugin_block_regex.c'],
-        dependencies: [libgnunetutil_dep,
-                       libgnunetregexblock_dep,
-                       libgnunetblock_dep,
-                       libgnunetblockgroup_dep],
-        include_directories: [incdir, configuration_inc],
-              install:true,
-              install_dir: get_option('libdir')/'gnunet')
-
 
 executable ('gnunet-service-regex',
             gnunetserviceregex_src,
diff --git a/src/service/regex/plugin_block_regex.c b/src/service/regex/plugin_block_regex.c
deleted file mode 100644
index 5f23a32df..000000000
--- a/src/service/regex/plugin_block_regex.c
+++ /dev/null
@@ -1,380 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2013 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file regex/plugin_block_regex.c
- * @brief blocks used for regex storage and search
- * @author Bartlomiej Polot
- */
-#include "platform.h"
-#include "gnunet_block_plugin.h"
-#include "gnunet_block_group_lib.h"
-#include "block_regex.h"
-#include "regex_block_lib.h"
-#include "gnunet_signatures.h"
-
-
-/**
- * Number of bits we set per entry in the bloomfilter.
- * Do not change!
- */
-#define BLOOMFILTER_K 16
-
-
-/**
- * How big is the BF we use for REGEX blocks?
- */
-#define REGEX_BF_SIZE 8
-
-
-/**
- * Create a new block group.
- *
- * @param ctx block context in which the block group is created
- * @param type type of the block for which we are creating the group
- * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
- * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
- * @param va variable arguments specific to @a type
- * @return block group handle, NULL if block groups are not supported
- *         by this @a type of block (this is not an error)
- */
-static struct GNUNET_BLOCK_Group *
-block_plugin_regex_create_group (void *cls,
-                                 enum GNUNET_BLOCK_Type type,
-                                 const void *raw_data,
-                                 size_t raw_data_size,
-                                 va_list va)
-{
-  unsigned int bf_size;
-  const char *guard;
-
-  guard = va_arg (va, const char *);
-  if (0 == strcmp (guard,
-                   "seen-set-size"))
-    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
-                                                                   int),
-                                                           BLOOMFILTER_K);
-  else if (0 == strcmp (guard,
-                        "filter-size"))
-    bf_size = va_arg (va, unsigned int);
-  else
-  {
-    GNUNET_break (0);
-    bf_size = REGEX_BF_SIZE;
-  }
-  GNUNET_break (NULL == va_arg (va, const char *));
-  return GNUNET_BLOCK_GROUP_bf_create (cls,
-                                       bf_size,
-                                       BLOOMFILTER_K,
-                                       type,
-                                       raw_data,
-                                       raw_data_size);
-}
-
-
-/**
- * Function called to validate a query.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_regex_check_query (void *cls,
-                                enum GNUNET_BLOCK_Type type,
-                                const struct GNUNET_HashCode *query,
-                                const void *xquery,
-                                size_t xquery_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    if (0 != xquery_size)
-    {
-      const char *s;
-
-      s = (const char *) xquery;
-      if ('\0' != s[xquery_size - 1])     /* must be valid 0-terminated string */
-      {
-        GNUNET_break_op (0);
-        return GNUNET_NO;
-      }
-    }
-    return GNUNET_OK;
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_NO;
-    }
-    return GNUNET_OK;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a block for storage.
- *
- * @param cls closure
- * @param type block type
- * @param block block data to validate
- * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_regex_check_block (void *cls,
-                                enum GNUNET_BLOCK_Type type,
-                                const void *block,
-                                size_t block_size)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    if (GNUNET_SYSERR ==
-        REGEX_BLOCK_check (block,
-                           block_size,
-                           NULL,
-                           NULL))
-      return GNUNET_NO;
-    return GNUNET_OK;
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    {
-      const struct RegexAcceptBlock *rba;
-
-      if (sizeof(struct RegexAcceptBlock) != block_size)
-      {
-        GNUNET_break_op (0);
-        return GNUNET_NO;
-      }
-      rba = block;
-      if (ntohl (rba->purpose.size) !=
-          sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-          + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-          + sizeof(struct GNUNET_HashCode))
-      {
-        GNUNET_break_op (0);
-        return GNUNET_NO;
-      }
-      if (GNUNET_TIME_absolute_is_past (GNUNET_TIME_absolute_ntoh (
-                                          rba->expiration_time)))
-      {
-        return GNUNET_NO;
-      }
-      if (GNUNET_OK !=
-          GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT,
-                                       &rba->purpose,
-                                       &rba->signature,
-                                       &rba->peer.public_key))
-      {
-        GNUNET_break_op (0);
-        return GNUNET_NO;
-      }
-      return GNUNET_OK;
-    }
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Function called to validate a reply to a request.  Note that it is assumed
- * that the reply has already been matched to the key (and signatures checked)
- * as it would be done with the GetKeyFunction and the
- * BlockEvaluationFunction.
- *
- * @param cls closure
- * @param type block type
- * @param group which block group to use for evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_ReplyEvaluationResult
-block_plugin_regex_check_reply (
-  void *cls,
-  enum GNUNET_BLOCK_Type type,
-  struct GNUNET_BLOCK_Group *group,
-  const struct GNUNET_HashCode *query,
-  const void *xquery,
-  size_t xquery_size,
-  const void *reply_block,
-  size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    if (0 != xquery_size)
-    {
-      const char *s;
-
-      s = (const char *) xquery;
-      GNUNET_assert ('\0' == s[xquery_size - 1]);
-    }
-    switch (REGEX_BLOCK_check (reply_block,
-                               reply_block_size,
-                               query,
-                               xquery))
-    {
-    case GNUNET_SYSERR:
-      GNUNET_assert (0);
-    case GNUNET_NO:
-      /* xquery mismatch, can happen */
-      return GNUNET_BLOCK_REPLY_IRRELEVANT;
-    default:
-      break;
-    }
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &chash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                            &chash))
-      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-    return GNUNET_BLOCK_REPLY_OK_MORE;
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    {
-      const struct RegexAcceptBlock *rba;
-
-      GNUNET_assert (sizeof(struct RegexAcceptBlock) == reply_block_size);
-      rba = reply_block;
-      GNUNET_assert (ntohl (rba->purpose.size) ==
-                     sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-                     + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-                     + sizeof(struct GNUNET_HashCode));
-      GNUNET_CRYPTO_hash (reply_block,
-                          reply_block_size,
-                          &chash);
-      if (GNUNET_YES ==
-          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                              &chash))
-        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-      return GNUNET_BLOCK_REPLY_OK_MORE;
-    }
-  default:
-    GNUNET_break (0);
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-  return GNUNET_BLOCK_REPLY_OK_MORE;
-}
-
-
-/**
- * Function called to obtain the key for a block.
- *
- * @param cls closure
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes in @a block
- * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported,
- *         #GNUNET_NO if extracting a key from a block of this type does not work
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_regex_get_key (void *cls,
-                            enum GNUNET_BLOCK_Type type,
-                            const void *block,
-                            size_t block_size,
-                            struct GNUNET_HashCode *key)
-{
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    if (GNUNET_OK !=
-        REGEX_BLOCK_get_key (block,
-                             block_size,
-                             key))
-    {
-      GNUNET_break_op (0);
-      memset (key,
-              0,
-              sizeof (*key));
-      return GNUNET_OK;
-    }
-    return GNUNET_OK;
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    if (sizeof(struct RegexAcceptBlock) != block_size)
-    {
-      GNUNET_break_op (0);
-      memset (key,
-              0,
-              sizeof (*key));
-      return GNUNET_OK;
-    }
-    *key = ((struct RegexAcceptBlock *) block)->key;
-    return GNUNET_OK;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-}
-
-
-/**
- * Entry point for the plugin.
- */
-void *
-libgnunet_plugin_block_regex_init (void *cls)
-{
-  static const enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_REGEX,
-    GNUNET_BLOCK_TYPE_REGEX_ACCEPT,
-    GNUNET_BLOCK_TYPE_ANY       /* end of list */
-  };
-  struct GNUNET_BLOCK_PluginFunctions *api;
-
-  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->get_key = &block_plugin_regex_get_key;
-  api->check_query = &block_plugin_regex_check_query;
-  api->check_block = &block_plugin_regex_check_block;
-  api->check_reply = &block_plugin_regex_check_reply;
-  api->create_group = &block_plugin_regex_create_group;
-  api->types = types;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- */
-void *
-libgnunet_plugin_block_regex_done (void *cls)
-{
-  struct GNUNET_BLOCK_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_block_regex.c */
diff --git a/src/service/regex/regex_block_lib.c b/src/service/regex/regex_block_lib.c
deleted file mode 100644
index 048d6d743..000000000
--- a/src/service/regex/regex_block_lib.c
+++ /dev/null
@@ -1,431 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2012,2013 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-/**
- * @author Bartlomiej Polot
- * @file regex/regex_block_lib.c
- * @brief functions for manipulating non-accept blocks stored for
- *        regex in the DHT
- */
-#include "platform.h"
-#include "regex_block_lib.h"
-#include "gnunet_constants.h"
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "regex-bck", __VA_ARGS__)
-
-GNUNET_NETWORK_STRUCT_BEGIN
-
-/**
- * Information for each edge.
- */
-struct EdgeInfo
-{
-  /**
-   * Index of the destination of this edge in the
-   * unique destinations array.
-   */
-  uint16_t destination_index GNUNET_PACKED;
-
-  /**
-   * Number of bytes the token for this edge takes in the
-   * token area.
-   */
-  uint16_t token_length GNUNET_PACKED;
-};
-
-
-/**
- * @brief Block to announce a regex state.
- */
-struct RegexBlock
-{
-  /**
-   * Length of the proof regex string.
-   */
-  uint16_t proof_len GNUNET_PACKED;
-
-  /**
-   * Is this state an accepting state?
-   */
-  int16_t is_accepting GNUNET_PACKED;
-
-  /**
-   * Number of edges parting from this state.
-   */
-  uint16_t num_edges GNUNET_PACKED;
-
-  /**
-   * Number of unique destinations reachable from this state.
-   */
-  uint16_t num_destinations GNUNET_PACKED;
-
-  /* followed by 'struct GNUNET_HashCode[num_destinations]' */
-
-  /* followed by 'struct EdgeInfo[edge_destination_indices]' */
-
-  /* followed by 'char proof[n_proof]', NOT 0-terminated */
-
-  /* followed by 'char tokens[num_edges][edge_info[k].token_length]';
-     essentially all of the tokens one after the other in the
-     order of the edges; tokens are NOT 0-terminated */
-};
-
-
-GNUNET_NETWORK_STRUCT_END
-
-
-/**
- * Test if this block is marked as being an accept state.
- *
- * @param block block to test
- * @param size number of bytes in block
- * @return #GNUNET_YES if the block is accepting, #GNUNET_NO if not
- */
-int
-GNUNET_BLOCK_is_accepting (const struct RegexBlock *block,
-                           size_t size)
-{
-  if (size < sizeof(struct RegexBlock))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  return ntohs (block->is_accepting);
-}
-
-
-int
-REGEX_BLOCK_check_proof (const char *proof,
-                         size_t proof_len,
-                         const struct GNUNET_HashCode *key)
-{
-  struct GNUNET_HashCode key_check;
-
-  if ((NULL == proof) || (NULL == key))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Proof check failed, was NULL.\n");
-    return GNUNET_NO;
-  }
-  GNUNET_CRYPTO_hash (proof, proof_len, &key_check);
-  return (0 ==
-          GNUNET_CRYPTO_hash_cmp (key, &key_check)) ? GNUNET_OK : GNUNET_NO;
-}
-
-
-/**
- * Struct to keep track of the xquery while iterating all the edges in a block.
- */
-struct CheckEdgeContext
-{
-  /**
-   * Xquery: string we are looking for.
-   */
-  const char *xquery;
-
-  /**
-   * Has any edge matched the xquery so far? (GNUNET_OK / GNUNET_NO)
-   */
-  int found;
-};
-
-
-/**
- * Iterator over all edges in a block, checking for a presence of a given query.
- *
- * @param cls Closure, (xquery context).
- * @param token Token that follows to next state.
- * @param len Length of token.
- * @param key Hash of next state.
- *
- * @return #GNUNET_YES, to keep iterating
- */
-static int
-check_edge (void *cls,
-            const char *token,
-            size_t len,
-            const struct GNUNET_HashCode *key)
-{
-  struct CheckEdgeContext *ctx = cls;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "edge %.*s [%u]: %s\n",
-              (int) len,
-              token,
-              (unsigned int) len,
-              GNUNET_h2s (key));
-  if (NULL == ctx->xquery)
-    return GNUNET_YES;
-  if (strlen (ctx->xquery) < len)
-    return GNUNET_YES; /* too long */
-  if (0 == strncmp (ctx->xquery, token, len))
-    ctx->found = GNUNET_OK;
-  return GNUNET_YES; /* keep checking for malformed data! */
-}
-
-
-int
-REGEX_BLOCK_check (const struct RegexBlock *block,
-                   size_t size,
-                   const struct GNUNET_HashCode *query,
-                   const char *xquery)
-{
-  struct GNUNET_HashCode key;
-  struct CheckEdgeContext ctx;
-  int res;
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Block check\n");
-  if (GNUNET_OK !=
-      REGEX_BLOCK_get_key (block, size,
-                           &key))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  if ((NULL != query) &&
-      (0 != GNUNET_memcmp (&key,
-                           query)) )
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  if ((GNUNET_YES == ntohs (block->is_accepting)) &&
-      ((NULL == xquery) || ('\0' == xquery[0])))
-  {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "  out! Is accepting: %u, xquery %p\n",
-         ntohs (block->is_accepting),
-         xquery);
-    return GNUNET_OK;
-  }
-  ctx.xquery = xquery;
-  ctx.found = GNUNET_NO;
-  res = REGEX_BLOCK_iterate (block, size, &check_edge, &ctx);
-  if (GNUNET_SYSERR == res)
-    return GNUNET_SYSERR;
-  if (NULL == xquery)
-    return GNUNET_YES;
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Result %d\n", ctx.found);
-  return ctx.found;
-}
-
-
-int
-REGEX_BLOCK_get_key (const struct RegexBlock *block,
-                     size_t block_len,
-                     struct GNUNET_HashCode *key)
-{
-  uint16_t len;
-  const struct GNUNET_HashCode *destinations;
-  const struct EdgeInfo *edges;
-  uint16_t num_destinations;
-  uint16_t num_edges;
-  size_t total;
-
-  if (block_len < sizeof(struct RegexBlock))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  num_destinations = ntohs (block->num_destinations);
-  num_edges = ntohs (block->num_edges);
-  len = ntohs (block->proof_len);
-  destinations = (const struct GNUNET_HashCode *) &block[1];
-  edges = (const struct EdgeInfo *) &destinations[num_destinations];
-  total = sizeof(struct RegexBlock) + num_destinations * sizeof(struct
-                                                                GNUNET_HashCode)
-          + num_edges * sizeof(struct EdgeInfo) + len;
-  if (block_len < total)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  GNUNET_CRYPTO_hash (&edges[num_edges], len, key);
-  return GNUNET_OK;
-}
-
-
-int
-REGEX_BLOCK_iterate (const struct RegexBlock *block,
-                     size_t size,
-                     REGEX_INTERNAL_EgdeIterator iterator,
-                     void *iter_cls)
-{
-  uint16_t len;
-  const struct GNUNET_HashCode *destinations;
-  const struct EdgeInfo *edges;
-  const char *aux;
-  uint16_t num_destinations;
-  uint16_t num_edges;
-  size_t total;
-  unsigned int n;
-  size_t off;
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Block iterate\n");
-  if (size < sizeof(struct RegexBlock))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  num_destinations = ntohs (block->num_destinations);
-  num_edges = ntohs (block->num_edges);
-  len = ntohs (block->proof_len);
-  destinations = (const struct GNUNET_HashCode *) &block[1];
-  edges = (const struct EdgeInfo *) &destinations[num_destinations];
-  aux = (const char *) &edges[num_edges];
-  total = sizeof(struct RegexBlock) + num_destinations * sizeof(struct
-                                                                GNUNET_HashCode)
-          + num_edges * sizeof(struct EdgeInfo) + len;
-  if (size < total)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  for (n = 0; n < num_edges; n++)
-    total += ntohs (edges[n].token_length);
-  if (size != total)
-  {
-    fprintf (stderr, "Expected %u, got %u\n",
-             (unsigned int) size,
-             (unsigned int) total);
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  off = len;
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Start iterating block of size %lu, proof %u, off %lu edges %u\n",
-       (unsigned long) size, len, (unsigned long) off, n);
-  /* &aux[off] always points to our token */
-  for (n = 0; n < num_edges; n++)
-  {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Edge %u/%u, off %lu tokenlen %u (%.*s)\n",
-         n + 1, num_edges, (unsigned long) off,
-         ntohs (edges[n].token_length), ntohs (edges[n].token_length),
-         &aux[off]);
-    if (NULL != iterator)
-      if (GNUNET_NO == iterator (iter_cls,
-                                 &aux[off],
-                                 ntohs (edges[n].token_length),
-                                 &destinations[ntohs (
-                                                 edges[n].destination_index)]))
-        return GNUNET_OK;
-    off += ntohs (edges[n].token_length);
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * Construct a regex block to be stored in the DHT.
- *
- * @param proof proof string for the block
- * @param num_edges number of edges in the block
- * @param edges the edges of the block
- * @param accepting is this an accepting state
- * @param rsize set to the size of the returned block (OUT-only)
- * @return the regex block, NULL on error
- */
-struct RegexBlock *
-REGEX_BLOCK_create (const char *proof,
-                    unsigned int num_edges,
-                    const struct REGEX_BLOCK_Edge *edges,
-                    int accepting,
-                    size_t *rsize)
-{
-  struct RegexBlock *block;
-  struct GNUNET_HashCode destinations[1024]; /* 1024 = 64k/64 bytes/key == absolute MAX */
-  uint16_t destination_indices[num_edges];
-  struct GNUNET_HashCode *dests;
-  struct EdgeInfo *edgeinfos;
-  size_t off;
-  size_t len;
-  size_t total;
-  size_t slen;
-  unsigned int unique_destinations;
-  unsigned int j;
-  unsigned int i;
-  char *aux;
-
-  len = strlen (proof);
-  if (len > UINT16_MAX)
-  {
-    GNUNET_break (0);
-    return NULL;
-  }
-  unique_destinations = 0;
-  total = sizeof(struct RegexBlock) + len;
-  for (i = 0; i < num_edges; i++)
-  {
-    slen = strlen (edges[i].label);
-    if (slen > UINT16_MAX)
-    {
-      GNUNET_break (0);
-      return NULL;
-    }
-    total += slen;
-    for (j = 0; j < unique_destinations; j++)
-      if (0 == memcmp (&destinations[j],
-                       &edges[i].destination,
-                       sizeof(struct GNUNET_HashCode)))
-        break;
-    if (j >= 1024)
-    {
-      GNUNET_break (0);
-      return NULL;
-    }
-    destination_indices[i] = j;
-    if (j == unique_destinations)
-      destinations[unique_destinations++] = edges[i].destination;
-  }
-  total += num_edges * sizeof(struct EdgeInfo) + unique_destinations
-           * sizeof(struct GNUNET_HashCode);
-  if (total >= GNUNET_CONSTANTS_MAX_BLOCK_SIZE)
-  {
-    GNUNET_break (0);
-    return NULL;
-  }
-  block = GNUNET_malloc (total);
-  block->proof_len = htons (len);
-  block->is_accepting = htons (accepting);
-  block->num_edges = htons (num_edges);
-  block->num_destinations = htons (unique_destinations);
-  dests = (struct GNUNET_HashCode *) &block[1];
-  GNUNET_memcpy (dests, destinations, sizeof(struct GNUNET_HashCode)
-                 * unique_destinations);
-  edgeinfos = (struct EdgeInfo *) &dests[unique_destinations];
-  aux = (char *) &edgeinfos[num_edges];
-  off = len;
-  GNUNET_memcpy (aux, proof, len);
-  for (i = 0; i < num_edges; i++)
-  {
-    slen = strlen (edges[i].label);
-    edgeinfos[i].token_length = htons ((uint16_t) slen);
-    edgeinfos[i].destination_index = htons (destination_indices[i]);
-    GNUNET_memcpy (&aux[off],
-                   edges[i].label,
-                   slen);
-    off += slen;
-  }
-  *rsize = total;
-  return block;
-}
-
-
-/* end of regex_block_lib.c */
diff --git a/src/service/regex/regex_block_lib.h b/src/service/regex/regex_block_lib.h
deleted file mode 100644
index 11029b9af..000000000
--- a/src/service/regex/regex_block_lib.h
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2012,2013 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Bartlomiej Polot
- * @file regex/regex_block_lib.h
- * @brief common function to manipulate blocks stored by regex in the DHT
- */
-
-#ifndef REGEX_BLOCK_LIB_H_
-#define REGEX_BLOCK_LIB_H_
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0
-/* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-#include "platform.h"
-#include "block_regex.h"
-
-
-/**
- * Representation of a Regex node (and edges) in the DHT.
- */
-struct RegexBlock;
-
-
-/**
- * Edge representation.
- */
-struct REGEX_BLOCK_Edge
-{
-  /**
-   * Label of the edge.  FIXME: might want to not consume exactly
-   * multiples of 8 bits, need length!
-   */
-  const char *label;
-
-  /**
-   * Destination of the edge.
-   */
-  struct GNUNET_HashCode destination;
-};
-
-
-/**
- * Check if the given 'proof' matches the given 'key'.
- *
- * @param proof partial regex of a state
- * @param proof_len number of bytes in @a proof
- * @param key hash of a state.
- * @return #GNUNET_OK if the proof is valid for the given key.
- */
-int
-REGEX_BLOCK_check_proof (const char *proof,
-                         size_t proof_len,
-                         const struct GNUNET_HashCode *key);
-
-
-/**
- * Check if the regex block is well formed, including all edges.
- *
- * @param block The start of the block.
- * @param size The size of the @a block.
- * @param query the query for the @a block
- * @param xquery String describing the edge we are looking for.
- *               Can be NULL in case this is a put block.
- * @return #GNUNET_OK in case it's fine.
- *         #GNUNET_NO in case the xquery exists and is not found (IRRELEVANT).
- *         #GNUNET_SYSERR if the block is invalid.
- */
-int
-REGEX_BLOCK_check (const struct RegexBlock *block,
-                   size_t size,
-                   const struct GNUNET_HashCode *query,
-                   const char *xquery);
-
-
-/* FIXME: might want to use 'struct REGEX_BLOCK_Edge' here instead of 3 arguments! */
-
-/**
- * Iterator over edges in a block.
- *
- * @param cls Closure.
- * @param token Token that follows to next state.
- * @param len Length of token.
- * @param key Hash of next state.
- * @return #GNUNET_YES if should keep iterating, #GNUNET_NO otherwise.
- */
-typedef int
-(*REGEX_INTERNAL_EgdeIterator)(void *cls,
-                               const char *token,
-                               size_t len,
-                               const struct GNUNET_HashCode *key);
-
-
-/**
- * Iterate over all edges of a block of a regex state.
- *
- * @param block Block to iterate over.
- * @param size Size of block.
- * @param iterator Function to call on each edge in the block.
- * @param iter_cls Closure for the @a iterator.
- * @return #GNUNET_SYSERR if an error has been encountered.
- *         #GNUNET_OK if no error has been encountered.
- *           Note that if the iterator stops the iteration by returning
- *         #GNUNET_NO, the block will no longer be checked for further errors.
- *           The return value will be #GNUNET_OK meaning that no errors were
- *         found until the edge last notified to the iterator, but there might
- *         be errors in further edges.
- */
-int
-REGEX_BLOCK_iterate (const struct RegexBlock *block,
-                     size_t size,
-                     REGEX_INTERNAL_EgdeIterator iterator,
-                     void *iter_cls);
-
-
-/**
- * Obtain the key that a particular block is to be stored under.
- *
- * @param block block to get the key from
- * @param block_len number of bytes in @a block
- * @param key where to store the key
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the block is malformed
- */
-int
-REGEX_BLOCK_get_key (const struct RegexBlock *block,
-                     size_t block_len,
-                     struct GNUNET_HashCode *key);
-
-
-/**
- * Test if this block is marked as being an accept state.
- *
- * @param block block to test
- * @param size number of bytes in block
- * @return #GNUNET_YES if the block is accepting, #GNUNET_NO if not
- */
-int
-GNUNET_BLOCK_is_accepting (const struct RegexBlock *block,
-                           size_t block_len);
-
-
-/**
- * Construct a regex block to be stored in the DHT.
- *
- * @param proof proof string for the block
- * @param num_edges number of edges in the block
- * @param edges the edges of the block
- * @param accepting is this an accepting state
- * @param rsize set to the size of the returned block (OUT-only)
- * @return the regex block, NULL on error
- */
-struct RegexBlock *
-REGEX_BLOCK_create (const char *proof,
-                    unsigned int num_edges,
-                    const struct REGEX_BLOCK_Edge *edges,
-                    int accepting,
-                    size_t *rsize);
-
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef REGEX_BLOCK_LIB_H */
-#endif
-/* end of regex_block_lib.h */
diff --git a/src/service/regex/regex_internal_dht.c b/src/service/regex/regex_internal_dht.c
index bda979edb..9850f106f 100644
--- a/src/service/regex/regex_internal_dht.c
+++ b/src/service/regex/regex_internal_dht.c
@@ -25,7 +25,6 @@
  */
 #include "platform.h"
 #include "regex_internal_lib.h"
-#include "regex_block_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_constants.h"
diff --git a/src/service/regex/regex_internal_lib.h b/src/service/regex/regex_internal_lib.h
index 9baf84995..bfa3fc97d 100644
--- a/src/service/regex/regex_internal_lib.h
+++ b/src/service/regex/regex_internal_lib.h
@@ -29,7 +29,7 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_statistics_service.h"
-#include "regex_block_lib.h"
+#include "../../plugin/regex/regex_block_lib.h"
 
 #ifdef __cplusplus
 extern "C"
diff --git a/src/service/rest/Makefile.am b/src/service/rest/Makefile.am
index 401be36f4..60769e366 100644
--- a/src/service/rest/Makefile.am
+++ b/src/service/rest/Makefile.am
@@ -24,10 +24,35 @@ libexec_PROGRAMS = \
 EXTRA_DIST = \
  rest.conf
 
+if HAVE_JOSE
+OPENID_PLUGIN = \
+ openid_plugin.c \
+ oidc_helper.c
+OPENID_JOSE_LIBS = -ljose
+endif
+
 gnunet_rest_server_SOURCES = \
- gnunet-rest-server.c
+ gnunet-rest-server.c \
+ config_plugin.c \
+ copying_plugin.c \
+ identity_plugin.c \
+ namestore_plugin.c \
+ gns_plugin.c \
+ $(OPENID_PLUGIN) \
+ reclaim_plugin.c json_reclaim.c
 gnunet_rest_server_LDADD = \
   $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/lib/json/libgnunetjson.la \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecordjson.la \
+  $(top_builddir)/src/service/identity/libgnunetidentity.la \
+  $(top_builddir)/src/service/namestore/libgnunetnamestore.la \
+  $(top_builddir)/src/service/gns/libgnunetgns.la \
+  $(top_builddir)/src/service/reclaim/libgnunetreclaim.la \
+  libgnunetrest.la \
+        $(OPENID_JOSE_LIBS) \
+        -ljansson \
+        $(LIBGCRYPT_LIBS) \
   $(GN_LIBINTL) $(MHD_LIBS)
 gnunet_rest_server_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
 
diff --git a/src/service/rest/config_plugin.c b/src/service/rest/config_plugin.c
new file mode 100644
index 000000000..fd0ac011a
--- /dev/null
+++ b/src/service/rest/config_plugin.c
@@ -0,0 +1,438 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @file gns/plugin_rest_config.c
+ * @brief REST plugin for configuration
+ *
+ */
+
+#include "platform.h"
+#include "gnunet_rest_plugin.h"
+#include <gnunet_rest_lib.h>
+#include <gnunet_util_lib.h>
+#include <jansson.h>
+
+#define GNUNET_REST_API_NS_CONFIG "/config"
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+const struct GNUNET_CONFIGURATION_Handle *config_cfg;
+
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Handle to rest request
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * HTTP response code
+   */
+  int response_code;
+
+  /**
+   * The URL
+   */
+  char *url;
+
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+
+/**
+ * Cleanup request handle.
+ *
+ * @param handle Handle to clean up
+ */
+static void
+cleanup_handle (struct RequestHandle *handle)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on shutdown.  Cleans up everything.
+ *
+ * @param cls unused
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  resp = GNUNET_REST_create_response (NULL);
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  cleanup_handle (handle);
+}
+
+
+static void
+add_sections (void *cls,
+              const char *section,
+              const char *option,
+              const char *value)
+{
+  json_t *sections_obj = cls;
+  json_t *sec_obj;
+
+  sec_obj = json_object_get (sections_obj, section);
+  if (NULL != sec_obj)
+  {
+    json_object_set_new (sec_obj, option, json_string (value));
+    return;
+  }
+  sec_obj = json_object ();
+  json_object_set_new (sec_obj, option, json_string (value));
+  json_object_set_new (sections_obj, section, sec_obj);
+}
+
+
+static void
+add_section_contents (void *cls,
+                      const char *section,
+                      const char *option,
+                      const char *value)
+{
+  json_t *section_obj = cls;
+
+  json_object_set_new (section_obj, option, json_string (value));
+}
+
+
+/**
+ * Handle rest request
+ *
+ * @param handle the lookup handle
+ */
+static void
+get_cont (struct GNUNET_REST_RequestHandle *con_handle,
+          const char *url,
+          void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+  const char *section;
+  char *response;
+  json_t *result;
+
+  if (strlen (GNUNET_REST_API_NS_CONFIG) > strlen (handle->url))
+  {
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (strlen (GNUNET_REST_API_NS_CONFIG) == strlen (handle->url))
+  {
+    result = json_object ();
+    GNUNET_CONFIGURATION_iterate (config_cfg, &add_sections, result);
+  }
+  else
+  {
+    result = json_object ();
+    section = &handle->url[strlen (GNUNET_REST_API_NS_CONFIG) + 1];
+    GNUNET_CONFIGURATION_iterate_section_values (config_cfg,
+                                                 section,
+                                                 &add_section_contents,
+                                                 result);
+  }
+  response = json_dumps (result, 0);
+  resp = GNUNET_REST_create_response (response);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+  GNUNET_free (response);
+  json_decref (result);
+}
+
+
+struct GNUNET_CONFIGURATION_Handle *
+set_value (struct GNUNET_CONFIGURATION_Handle *config,
+           const char *section,
+           const char *option,
+           json_t *value)
+{
+  if (json_is_string (value))
+    GNUNET_CONFIGURATION_set_value_string (config, section, option,
+                                           json_string_value (value));
+  else if (json_is_number (value))
+    GNUNET_CONFIGURATION_set_value_number (config, section, option,
+                                           json_integer_value (value));
+  else if (json_is_null (value))
+    GNUNET_CONFIGURATION_set_value_string (config, section, option, NULL);
+  else if (json_is_true (value))
+    GNUNET_CONFIGURATION_set_value_string (config, section, option, "yes");
+  else if (json_is_false (value))
+    GNUNET_CONFIGURATION_set_value_string (config, section, option, "no");
+  else
+    return NULL;
+  return config; // for error handling (0 -> success, 1 -> error)
+}
+
+
+/**
+ * Handle REST POST request
+ *
+ * @param handle the lookup handle
+ */
+static void
+set_cont (struct GNUNET_REST_RequestHandle *con_handle,
+          const char *url,
+          void *cls)
+{
+  struct RequestHandle *handle = cls;
+  char term_data[handle->rest_handle->data_size + 1];
+  struct GNUNET_CONFIGURATION_Handle *out = GNUNET_CONFIGURATION_dup (config_cfg);
+
+  json_error_t err;
+  json_t *data_json;
+  const char *section;
+  const char *option;
+  json_t *sec_obj;
+  json_t *value;
+  char *cfg_fn;
+
+  // invalid url
+  if (strlen (GNUNET_REST_API_NS_CONFIG) > strlen (handle->url))
+  {
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // extract data from handle
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+
+  if (NULL == data_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse JSON Object from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // POST /config => {<section> : {<option> : <value>}}
+  if (strlen (GNUNET_REST_API_NS_CONFIG) == strlen (handle->url))   // POST /config
+  {
+    // iterate over sections
+    json_object_foreach (data_json, section, sec_obj)
+    {
+      // iterate over options
+      json_object_foreach (sec_obj, option, value)
+      {
+        out = set_value (out, section, option, value);
+        if (NULL == out)
+        {
+          handle->response_code = MHD_HTTP_BAD_REQUEST;
+          GNUNET_SCHEDULER_add_now (&do_error, handle);
+          json_decref (data_json);
+          return;
+        }
+      }
+    }
+  }
+  else // POST /config/<section> => {<option> : <value>}
+  {
+    // extract the "<section>" part from the url
+    section = &handle->url[strlen (GNUNET_REST_API_NS_CONFIG) + 1];
+    // iterate over options
+    json_object_foreach (data_json, option, value)
+    {
+      out = set_value (out, section, option, value);
+      if (NULL == out)
+      {
+        handle->response_code = MHD_HTTP_BAD_REQUEST;
+        GNUNET_SCHEDULER_add_now (&do_error, handle);
+        json_decref (data_json);
+        return;
+      }
+    }
+  }
+  json_decref (data_json);
+
+
+  // get cfg file path
+  cfg_fn = NULL;
+  const char *xdg = getenv ("XDG_CONFIG_HOME");
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfg_fn,
+                     "%s%s%s",
+                     xdg,
+                     DIR_SEPARATOR_STR,
+                     GNUNET_OS_project_data_get ()->config_file);
+  else
+    cfg_fn = GNUNET_strdup (GNUNET_OS_project_data_get ()->user_config_file);
+
+  GNUNET_CONFIGURATION_write (out, cfg_fn);
+  config_cfg = out;
+  handle->proc (handle->proc_cls,
+                GNUNET_REST_create_response (NULL),
+                MHD_HTTP_OK);
+  GNUNET_free (cfg_fn);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Handle rest request
+ *
+ * @param handle the lookup handle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    MHD_HTTP_METHOD_GET));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+}
+
+
+enum GNUNET_GenericReturnValue
+REST_config_process_request (void *plugin,
+                             struct GNUNET_REST_RequestHandle *conndata_handle,
+                             GNUNET_REST_ResultProcessor proc,
+                             void *proc_cls)
+{
+  static const struct GNUNET_REST_RequestHandler handlers[] = {
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_CONFIG, &get_cont },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_CONFIG, &set_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_CONFIG, &options_cont },
+    GNUNET_REST_HANDLER_END
+  };
+  (void) plugin;
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = conndata_handle;
+  handle->url = GNUNET_strdup (conndata_handle->url);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (conndata_handle, handlers, &err, handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+void
+REST_config_done (struct GNUNET_REST_Plugin *api)
+{
+  struct Plugin *plugin;
+
+  while (NULL != requests_head)
+    cleanup_handle (requests_head);
+  plugin = api->cls;
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "CONFIG REST plugin is finished\n");
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+REST_config_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+
+  config_cfg = c;
+  struct GNUNET_REST_Plugin *api;
+
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = c;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_CONFIG;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _ ("CONFIG REST API initialized\n"));
+  return api;
+}
+
+
+
+/* end of plugin_rest_config.c */
diff --git a/src/service/rest/config_plugin.h b/src/service/rest/config_plugin.h
new file mode 100644
index 000000000..c959a94f2
--- /dev/null
+++ b/src/service/rest/config_plugin.h
@@ -0,0 +1,37 @@
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_rest_plugin.h"
+
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_config_process_request (void *plugin,
+                             struct GNUNET_REST_RequestHandle *conndata_handle,
+                             GNUNET_REST_ResultProcessor proc,
+                             void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ */
+void *
+REST_config_init (const struct GNUNET_CONFIGURATION_Handle *cfg);
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_config_done (struct GNUNET_REST_Plugin *api);
+
diff --git a/src/service/rest/copying_plugin.c b/src/service/rest/copying_plugin.c
new file mode 100644
index 000000000..d907f6729
--- /dev/null
+++ b/src/service/rest/copying_plugin.c
@@ -0,0 +1,233 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @file gns/plugin_rest_copying.c
+ * @brief REST plugin that serves licensing information.
+ *
+ */
+
+#include "platform.h"
+#include "gnunet_rest_plugin.h"
+#include <gnunet_rest_lib.h>
+
+#define GNUNET_REST_API_NS_COPYING "/copying"
+
+#define GNUNET_REST_COPYING_TEXT \
+        "GNU Affero General Public License version 3 or later. See also: <http://www.gnu.org/licenses/>"
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Handle to rest request
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * HTTP response code
+   */
+  int response_code;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+/**
+ * Cleanup request handle.
+ *
+ * @param handle Handle to clean up
+ */
+static void
+cleanup_handle (struct RequestHandle *handle)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Cleaning up\n");
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Handle rest request
+ *
+ * @param handle the lookup handle
+ */
+static void
+get_cont (struct GNUNET_REST_RequestHandle *con_handle,
+          const char*url,
+          void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  resp = GNUNET_REST_create_response (GNUNET_REST_COPYING_TEXT);
+  handle->proc (handle->proc_cls,
+                resp,
+                MHD_HTTP_OK);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Handle rest request
+ *
+ * @param handle the lookup handle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char*url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    MHD_HTTP_METHOD_GET));
+  handle->proc (handle->proc_cls,
+                resp,
+                MHD_HTTP_OK);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_copying_process_request (void *plugin,
+                              struct GNUNET_REST_RequestHandle *conndata_handle,
+                              GNUNET_REST_ResultProcessor proc,
+                              void *proc_cls)
+{
+  static const struct GNUNET_REST_RequestHandler handlers[] = {
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_COPYING, &get_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_COPYING, &options_cont },
+    GNUNET_REST_HANDLER_END
+  };
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = conndata_handle;
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  return GNUNET_REST_handle_request (conndata_handle,
+                                     handlers,
+                                     &err,
+                                     handle);
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_copying_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+
+  struct GNUNET_REST_Plugin *api;
+
+  if (NULL != plugin.cfg)
+    return NULL;                /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = c;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_COPYING;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              _ ("COPYING REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_copying_done (struct GNUNET_REST_Plugin *api)
+{
+  struct Plugin *plugin = api->cls;
+
+  while (NULL != requests_head)
+    cleanup_handle (requests_head);
+  plugin->cfg = NULL;
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "COPYING REST plugin is finished\n");
+}
+
+
+/* end of plugin_rest_copying.c */
diff --git a/src/service/rest/copying_plugin.h b/src/service/rest/copying_plugin.h
new file mode 100644
index 000000000..4ba1a2e36
--- /dev/null
+++ b/src/service/rest/copying_plugin.h
@@ -0,0 +1,36 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_copying_process_request (void *plugin,
+                              struct GNUNET_REST_RequestHandle *conndata_handle,
+                              GNUNET_REST_ResultProcessor proc,
+                              void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_copying_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_copying_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/rest/gns_plugin.c b/src/service/rest/gns_plugin.c
new file mode 100644
index 000000000..0ea89d0cd
--- /dev/null
+++ b/src/service/rest/gns_plugin.c
@@ -0,0 +1,486 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Philippe Buschmann
+ * @file gns/plugin_rest_gns.c
+ * @brief GNUnet Gns REST plugin
+ */
+
+#include "platform.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_rest_lib.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_gnsrecord_json_lib.h"
+#include "gnunet_gns_service.h"
+#include "microhttpd.h"
+#include <jansson.h>
+
+/**
+ * Rest API GNS Namespace
+ */
+#define GNUNET_REST_API_NS_GNS "/gns"
+
+/**
+ * Rest API GNS Parameter record_type
+ */
+#define GNUNET_REST_GNS_PARAM_RECORD_TYPE "record_type"
+
+/**
+ * Rest API GNS ERROR Unknown Error
+ */
+#define GNUNET_REST_GNS_ERROR_UNKNOWN "Unknown Error"
+
+/**
+ * Rest API GNS ERROR Record not found
+ */
+#define GNUNET_REST_GNS_NOT_FOUND "Record not found"
+
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *gns_cfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * Connection to GNS
+ */
+static struct GNUNET_GNS_Handle *gns;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+/**
+ * The request handle
+ */
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Active GNS lookup
+   */
+  struct GNUNET_GNS_LookupWithTldRequest *gns_lookup;
+
+  /**
+   * Name to look up
+   */
+  char *name;
+
+  /**
+   * Record type to look up
+   */
+  int record_type;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * Error response message
+   */
+  char *emsg;
+
+  /**
+   * Response code
+   */
+  int response_code;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+/**
+ * Cleanup lookup handle
+ * @param cls `struct RequestHandle` to clean up
+ */
+static void
+cleanup_handle (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+
+  if (NULL != handle->gns_lookup)
+  {
+    GNUNET_GNS_lookup_with_tld_cancel (handle->gns_lookup);
+    handle->gns_lookup = NULL;
+  }
+  if (NULL != handle->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+    handle->timeout_task = NULL;
+  }
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  if (NULL != handle->name)
+    GNUNET_free (handle->name);
+  if (NULL != handle->emsg)
+    GNUNET_free (handle->emsg);
+
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on errors.  Reports an error and cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  json_t *json_error = json_object ();
+  char *response;
+
+  if (NULL != handle->timeout_task)
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+  handle->timeout_task = NULL;
+  if (NULL == handle->emsg)
+    handle->emsg = GNUNET_strdup (GNUNET_REST_GNS_ERROR_UNKNOWN);
+
+  json_object_set_new (json_error, "error", json_string (handle->emsg));
+
+  if (0 == handle->response_code)
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+  response = json_dumps (json_error, 0);
+  resp = GNUNET_REST_create_response (response);
+  MHD_add_response_header (resp, "Content-Type", "application/json");
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  json_decref (json_error);
+  GNUNET_free (response);
+  cleanup_handle (handle);
+}
+
+
+static void
+do_timeout (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->timeout_task = NULL;
+  handle->response_code = MHD_HTTP_REQUEST_TIMEOUT;
+  do_error (handle);
+}
+
+
+/**
+ * Iterator called on obtained result for a GNS lookup.
+ *
+ * @param cls closure with the object
+ * @param was_gns #GNUNET_NO if name was not a GNS name
+ * @param rd_count number of records in @a rd
+ * @param rd the records in reply
+ */
+static void
+handle_gns_response (void *cls,
+                     int was_gns,
+                     uint32_t rd_count,
+                     const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  json_t *result_obj;
+  char *result;
+
+  handle->gns_lookup = NULL;
+
+  if (GNUNET_NO == was_gns)
+  {
+    handle->response_code = MHD_HTTP_NOT_FOUND;
+    handle->emsg = GNUNET_strdup (GNUNET_REST_GNS_NOT_FOUND);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  result_obj = GNUNET_GNSRECORD_JSON_from_gnsrecord (handle->name, rd,
+                                                     rd_count);
+
+  result = json_dumps (result_obj, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result);
+  resp = GNUNET_REST_create_response (result);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result);
+  json_decref (result_obj);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Handle gns GET request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+get_gns_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_HashCode key;
+  char *record_type;
+  char *name;
+
+  name = NULL;
+  handle->name = NULL;
+  if (strlen (GNUNET_REST_API_NS_GNS) < strlen (handle->url))
+  {
+    name = &handle->url[strlen (GNUNET_REST_API_NS_GNS) + 1];
+  }
+
+  if (NULL == name)
+  {
+    handle->response_code = MHD_HTTP_NOT_FOUND;
+    handle->emsg = GNUNET_strdup (GNUNET_REST_GNS_NOT_FOUND);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (0 >= strlen (name))
+  {
+    handle->response_code = MHD_HTTP_NOT_FOUND;
+    handle->emsg = GNUNET_strdup (GNUNET_REST_GNS_NOT_FOUND);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->name = GNUNET_strdup (name);
+
+  handle->record_type = UINT32_MAX;
+  GNUNET_CRYPTO_hash (GNUNET_REST_GNS_PARAM_RECORD_TYPE,
+                      strlen (GNUNET_REST_GNS_PARAM_RECORD_TYPE),
+                      &key);
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (con_handle->url_param_map, &key))
+  {
+    record_type =
+      GNUNET_CONTAINER_multihashmap_get (con_handle->url_param_map, &key);
+    handle->record_type = GNUNET_GNSRECORD_typename_to_number (record_type);
+  }
+
+  if (UINT32_MAX == handle->record_type)
+  {
+    handle->record_type = GNUNET_GNSRECORD_TYPE_ANY;
+  }
+
+  handle->gns_lookup = GNUNET_GNS_lookup_with_tld (gns,
+                                                   handle->name,
+                                                   handle->record_type,
+                                                   GNUNET_GNS_LO_DEFAULT,
+                                                   &handle_gns_response,
+                                                   handle);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+  return;
+}
+
+
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for callback function
+ * @return GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_gns_process_request (void *plugin,
+                          struct GNUNET_REST_RequestHandle *rest_handle,
+                          GNUNET_REST_ResultProcessor proc,
+                          void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] =
+  { { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_GNS, &get_gns_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_GNS, &options_cont },
+    GNUNET_REST_HANDLER_END };
+
+  handle->response_code = 0;
+  handle->timeout =
+    GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 60);
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+  handle->url = GNUNET_strdup (rest_handle->url);
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_timeout, handle);
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+
+
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls Config info
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+REST_gns_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  gns_cfg = c;
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = gns_cfg;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_GNS;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s, %s, %s, %s",
+                   MHD_HTTP_METHOD_GET,
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_PUT,
+                   MHD_HTTP_METHOD_DELETE,
+                   MHD_HTTP_METHOD_OPTIONS);
+  gns = GNUNET_GNS_connect (gns_cfg);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, _ ("Gns REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+REST_gns_done (void *cls)
+{
+  struct GNUNET_REST_Plugin *api = cls;
+  struct RequestHandle *request;
+  struct Plugin *plugin;
+
+  while (NULL != (request = requests_head))
+    do_error (request);
+
+  if (NULL != gns)
+    GNUNET_GNS_disconnect (gns);
+
+  plugin = api->cls;
+
+  plugin->cfg = NULL;
+
+  GNUNET_free (allow_methods);
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Gns REST plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_rest_gns.c */
diff --git a/src/service/rest/gns_plugin.h b/src/service/rest/gns_plugin.h
new file mode 100644
index 000000000..13878c139
--- /dev/null
+++ b/src/service/rest/gns_plugin.h
@@ -0,0 +1,36 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_gns_process_request (void *plugin,
+                          struct GNUNET_REST_RequestHandle *conndata_handle,
+                          GNUNET_REST_ResultProcessor proc,
+                          void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_gns_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_gns_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/rest/gnunet-rest-server.c b/src/service/rest/gnunet-rest-server.c
index 5163c2271..ce81704ae 100644
--- a/src/service/rest/gnunet-rest-server.c
+++ b/src/service/rest/gnunet-rest-server.c
@@ -29,6 +29,16 @@
 #include "gnunet_rest_plugin.h"
 #include "gnunet_mhd_compat.h"
 
+#include "config_plugin.h"
+#include "copying_plugin.h"
+#include "identity_plugin.h"
+#include "namestore_plugin.h"
+#include "gns_plugin.h"
+#ifdef HAVE_JOSE
+#include "openid_plugin.h"
+#endif
+#include "reclaim_plugin.h"
+
 /**
  * Default Socks5 listen port.
  */
@@ -54,7 +64,7 @@
  * After how long do we clean up unused MHD SSL/TLS instances?
  */
 #define MHD_CACHE_TIMEOUT \
-  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
+        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
 #define GN_REST_STATE_INIT 0
 #define GN_REST_STATE_PROCESSING 1
@@ -178,7 +188,12 @@ struct PluginListEntry
   /**
    * The plugin
    */
-  struct GNUNET_REST_Plugin *plugin;
+  void *plugin;
+
+  /**
+   * Request function
+   */
+  GNUNET_REST_ProcessingFunction process_request;
 };
 
 /**
@@ -240,6 +255,21 @@ static struct AcceptedRequest *req_list_head;
  */
 static struct AcceptedRequest *req_list_tail;
 
+
+/**
+ * plugins
+ */
+
+struct GNUNET_REST_Plugin *config_plugin;
+struct GNUNET_REST_Plugin *copying_plugin;
+struct GNUNET_REST_Plugin *identity_plugin;
+struct GNUNET_REST_Plugin *namestore_plugin;
+struct GNUNET_REST_Plugin *gns_plugin;
+#ifdef HAVE_JOSE
+struct GNUNET_REST_Plugin *openid_plugin;
+#endif
+struct GNUNET_REST_Plugin *reclaim_plugin;
+
 /* ************************* Global helpers ********************* */
 
 
@@ -294,6 +324,7 @@ cleanup_url_map (void *cls, const struct GNUNET_HashCode *key, void *value)
   return GNUNET_YES;
 }
 
+
 static void
 cleanup_handle (struct MhdConnectionHandle *handle)
 {
@@ -323,6 +354,7 @@ cleanup_handle (struct MhdConnectionHandle *handle)
   GNUNET_free (handle);
 }
 
+
 static void
 cleanup_ar (struct AcceptedRequest *ar)
 {
@@ -334,7 +366,8 @@ cleanup_ar (struct AcceptedRequest *ar)
   {
     GNUNET_NETWORK_socket_free_memory_only_ (ar->sock);
   }
-  else {
+  else
+  {
     GNUNET_NETWORK_socket_close (ar->sock);
   }
   ar->sock = NULL;
@@ -344,6 +377,7 @@ cleanup_ar (struct AcceptedRequest *ar)
   GNUNET_free (ar);
 }
 
+
 static int
 header_iterator (void *cls,
                  enum MHD_ValueKind kind,
@@ -561,9 +595,10 @@ create_response (void *cls,
     con_handle->state = GN_REST_STATE_PROCESSING;
     for (ple = plugins_head; NULL != ple; ple = ple->next)
     {
-      if (GNUNET_YES == ple->plugin->process_request (rest_conndata_handle,
-                                                      &plugin_callback,
-                                                      con_handle))
+      if (GNUNET_YES == ple->process_request (ple->plugin,
+                                              rest_conndata_handle,
+                                              &plugin_callback,
+                                              con_handle))
         break; /* Request handled */
     }
     if (NULL == ple)
@@ -603,8 +638,8 @@ create_response (void *cls,
                          strlen ("chrome-extension://"))))
       {
         GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
-                                 MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
-                                 origin));
+                                                          MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
+                                                          origin));
       }
     }
     if (NULL != allow_origins)
@@ -615,9 +650,10 @@ create_response (void *cls,
       {
         if (0 == strncmp (allow_origin, origin, strlen (allow_origin)))
         {
-          GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
-                                   MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
-                                   allow_origin));
+          GNUNET_assert (MHD_NO != MHD_add_response_header (
+                           con_handle->response,
+                           MHD_HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
+                           allow_origin));
           break;
         }
         allow_origin = strtok (NULL, ",");
@@ -628,14 +664,14 @@ create_response (void *cls,
   if (NULL != allow_credentials)
   {
     GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
-                             "Access-Control-Allow-Credentials",
-                             allow_credentials));
+                                                      "Access-Control-Allow-Credentials",
+                                                      allow_credentials));
   }
   if (NULL != allow_headers)
   {
     GNUNET_assert (MHD_NO != MHD_add_response_header (con_handle->response,
-                             "Access-Control-Allow-Headers",
-                             allow_headers));
+                                                      "Access-Control-Allow-Headers",
+                                                      allow_headers));
   }
   run_mhd_now ();
   {
@@ -757,6 +793,7 @@ schedule_httpd ()
     GNUNET_NETWORK_fdset_destroy (wws);
 }
 
+
 /**
  * Function called when MHD first processes an incoming connection.
  * Gives us the respective URI information.
@@ -791,7 +828,6 @@ mhd_log_callback (void *cls,
 }
 
 
-
 /**
  * Function called when MHD decides that we are done with a connection.
  *
@@ -823,6 +859,7 @@ mhd_completed_cb (void *cls,
   *con_cls = NULL;
 }
 
+
 /**
  * Function called when MHD connection is opened or closed.
  *
@@ -886,7 +923,6 @@ mhd_connection_cb (void *cls,
 }
 
 
-
 /**
  * Task run whenever HTTP server operations are pending.
  *
@@ -977,10 +1013,17 @@ do_shutdown (void *cls)
     GNUNET_CONTAINER_DLL_remove (plugins_head,
                                  plugins_tail,
                                  ple);
-    GNUNET_PLUGIN_unload (ple->libname, ple->plugin);
     GNUNET_free (ple->libname);
     GNUNET_free (ple);
   }
+  REST_config_done (config_plugin);
+  REST_copying_done (copying_plugin);
+  REST_identity_done (identity_plugin);
+  REST_gns_done (gns_plugin);
+#ifdef HAVE_JOSE
+  REST_openid_done (openid_plugin);
+#endif
+  REST_reclaim_done (reclaim_plugin);
   GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Shutting down...\n");
   kill_httpd ();
   GNUNET_free (allow_credentials);
@@ -1065,28 +1108,30 @@ bind_v6 ()
  * @param libname the name of the library loaded
  * @param lib_ret the object returned by the plugin initializer
  */
-static void
-load_plugin (void *cls, const char *libname, void *lib_ret)
+static enum GNUNET_GenericReturnValue
+setup_plugin (const char *name,
+              GNUNET_REST_ProcessingFunction proc,
+              void *plugin_cls)
 {
-  struct GNUNET_REST_Plugin *plugin = lib_ret;
   struct PluginListEntry *ple;
 
-  if (NULL == lib_ret)
+  if (NULL == plugin_cls)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Could not load plugin `%s'\n",
-                libname);
-    return;
+                "Could not load plugin\n");
+    return GNUNET_SYSERR;
   }
-  GNUNET_assert (1 < strlen (plugin->name));
-  GNUNET_assert ('/' == *plugin->name);
+  GNUNET_assert (1 < strlen (name));
+  GNUNET_assert ('/' == *name);
   ple = GNUNET_new (struct PluginListEntry);
-  ple->libname = GNUNET_strdup (libname);
-  ple->plugin = plugin;
+  ple->libname = GNUNET_strdup (name);
+  ple->plugin = plugin_cls;
+  ple->process_request = proc;
   GNUNET_CONTAINER_DLL_insert (plugins_head,
                                plugins_tail,
                                ple);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Loaded plugin `%s'\n", libname);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Loaded plugin `%s'\n", name);
+  return GNUNET_OK;
 }
 
 
@@ -1201,7 +1246,8 @@ run (void *cls,
       memset (basic_auth_secret_tmp, 0, 16);
       if (GNUNET_SYSERR == GNUNET_DISK_fn_read (basic_auth_file,
                                                 basic_auth_secret_tmp,
-                                                sizeof (basic_auth_secret_tmp) - 1))
+                                                sizeof (basic_auth_secret_tmp)
+                                                - 1))
       {
         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                     "Unable to read basic auth secret file.\n");
@@ -1330,12 +1376,45 @@ run (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-/* Load plugins */
-  GNUNET_PLUGIN_load_all_in_context (GNUNET_OS_project_data_default (),
-                                     "libgnunet_plugin_rest",
-                                     (void *) cfg,
-                                     &load_plugin,
-                                     NULL);
+  /* Load plugins */
+  // FIXME: Use per-plugin rest plugin structs
+  struct GNUNET_REST_Plugin *config_plugin = REST_config_init (cfg);
+  if (GNUNET_OK != setup_plugin (config_plugin->name, &REST_config_process_request, config_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  struct GNUNET_REST_Plugin *copying_plugin = REST_copying_init (cfg);
+  if (GNUNET_OK != setup_plugin (copying_plugin->name, &REST_copying_process_request, copying_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  struct GNUNET_REST_Plugin *identity_plugin = REST_identity_init (cfg);
+  if (GNUNET_OK != setup_plugin (identity_plugin->name, &REST_identity_process_request, identity_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  struct GNUNET_REST_Plugin *namestore_plugin = REST_namestore_init (cfg);
+  if (GNUNET_OK != setup_plugin (namestore_plugin->name, &REST_namestore_process_request, namestore_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+  struct GNUNET_REST_Plugin *gns_plugin = REST_gns_init (cfg);
+  if (GNUNET_OK != setup_plugin (gns_plugin->name, &REST_gns_process_request, gns_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+#ifdef HAVE_JOSE
+  struct GNUNET_REST_Plugin *openid_plugin = REST_openid_init (cfg);
+  if (GNUNET_OK != setup_plugin (openid_plugin->name, &REST_openid_process_request, openid_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
+#endif
+  struct GNUNET_REST_Plugin *reclaim_plugin = REST_reclaim_init (cfg);
+  if (GNUNET_OK != setup_plugin (reclaim_plugin->name, &REST_reclaim_process_request, reclaim_plugin))
+  {
+    GNUNET_SCHEDULER_shutdown ();
+  }
   GNUNET_SCHEDULER_add_shutdown (&do_shutdown, NULL);
 }
 
diff --git a/src/service/rest/identity_plugin.c b/src/service/rest/identity_plugin.c
new file mode 100644
index 000000000..f6c9dd792
--- /dev/null
+++ b/src/service/rest/identity_plugin.c
@@ -0,0 +1,1287 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @author Philippe Buschmann
+ * @file identity/plugin_rest_identity.c
+ * @brief GNUnet Identity REST plugin
+ */
+
+#include "platform.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_identity_service.h"
+#include "gnunet_rest_lib.h"
+#include "../../service/identity/identity.h"
+#include "gnunet_util_lib.h"
+#include "microhttpd.h"
+#include <jansson.h>
+
+/**
+ * Identity Namespace
+ */
+#define GNUNET_REST_API_NS_IDENTITY "/identity"
+
+/**
+ * Identity Namespace with public key specifier
+ */
+#define GNUNET_REST_API_NS_IDENTITY_PUBKEY "/identity/pubkey"
+
+/**
+ * Identity Namespace with public key specifier
+ */
+#define GNUNET_REST_API_NS_IDENTITY_NAME "/identity/name"
+
+/**
+ * Identity Namespace with sign specifier
+ */
+#define GNUNET_REST_API_NS_SIGN "/sign"
+
+/**
+ * Parameter public key
+ */
+#define GNUNET_REST_IDENTITY_PARAM_PUBKEY "pubkey"
+
+/**
+ * Parameter private key
+ */
+#define GNUNET_REST_IDENTITY_PARAM_PRIVKEY "privkey"
+
+/**
+ * Parameter name
+ */
+#define GNUNET_REST_IDENTITY_PARAM_NAME "name"
+
+/**
+ * Parameter new name
+ */
+#define GNUNET_REST_IDENTITY_PARAM_NEWNAME "newname"
+
+/**
+ * Error message Missing identity name
+ */
+#define GNUNET_REST_IDENTITY_MISSING_NAME "Missing identity name"
+
+/**
+ * Error message Missing identity name
+ */
+#define GNUNET_REST_IDENTITY_MISSING_PUBKEY "Missing identity public key"
+
+/**
+ * Error message No data
+ */
+#define GNUNET_REST_ERROR_NO_DATA "No data"
+
+/**
+ * Error message Data invalid
+ */
+#define GNUNET_REST_ERROR_DATA_INVALID "Data invalid"
+
+/**
+ * State while collecting all egos
+ */
+#define ID_REST_STATE_INIT 0
+
+/**
+ * Done collecting egos
+ */
+#define ID_REST_STATE_POST_INIT 1
+
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *id_cfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_head;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_tail;
+
+/**
+ * The processing state
+ */
+static int state;
+
+/**
+ * Handle to Identity service.
+ */
+static struct GNUNET_IDENTITY_Handle *identity_handle;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+/**
+ * The ego list
+ */
+struct EgoEntry
+{
+  /**
+   * DLL
+   */
+  struct EgoEntry *next;
+
+  /**
+   * DLL
+   */
+  struct EgoEntry *prev;
+
+  /**
+   * Ego Identifier
+   */
+  char *identifier;
+
+  /**
+   * Public key string
+   */
+  char *keystring;
+
+  /**
+   * The Ego
+   */
+  struct GNUNET_IDENTITY_Ego *ego;
+};
+
+/**
+ * The request handle
+ */
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * The data from the REST request
+   */
+  const char *data;
+
+  /**
+   * The name to look up
+   */
+  char *name;
+
+  /**
+   * the length of the REST data
+   */
+  size_t data_size;
+
+  /**
+   * IDENTITY Operation
+   */
+  struct GNUNET_IDENTITY_Operation *op;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * Error code
+   */
+  enum GNUNET_ErrorCode ec;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+/**
+ * Cleanup lookup handle
+ * @param cls Handle to clean up
+ */
+static void
+cleanup_handle (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+    handle->timeout_task = NULL;
+  }
+
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  if (NULL != handle->name)
+    GNUNET_free (handle->name);
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on errors.  Reports an error and cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  json_t *json_error = json_object ();
+  char *response;
+  int response_code;
+
+  json_object_set_new (json_error, "error",
+                       json_string (GNUNET_ErrorCode_get_hint (handle->ec)));
+  json_object_set_new (json_error, "error_code", json_integer (handle->ec));
+  response_code = GNUNET_ErrorCode_get_http_status (handle->ec);
+  if (0 == response_code)
+    response_code = MHD_HTTP_OK;
+  response = json_dumps (json_error, 0);
+  resp = GNUNET_REST_create_response (response);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, response_code);
+  json_decref (json_error);
+  GNUNET_free (response);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Get EgoEntry from list with either a public key or a name
+ * If public key and name are not NULL, it returns the public key result first
+ *
+ * @param handle the RequestHandle
+ * @param pubkey the public key of an identity (only one can be NULL)
+ * @param name the name of an identity (only one can be NULL)
+ * @return EgoEntry or NULL if not found
+ */
+struct EgoEntry *
+get_egoentry (struct RequestHandle *handle, char *pubkey, char *name)
+{
+  struct EgoEntry *ego_entry;
+
+  if (NULL != pubkey)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (0 != strcasecmp (pubkey, ego_entry->keystring))
+        continue;
+      return ego_entry;
+    }
+  }
+  if (NULL != name)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (0 != strcasecmp (name, ego_entry->identifier))
+        continue;
+      return ego_entry;
+    }
+  }
+  return NULL;
+}
+
+
+/**
+ * Handle identity GET request - responds with all identities
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_get_all (struct GNUNET_REST_RequestHandle *con_handle,
+             const char *url,
+             void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  struct MHD_Response *resp;
+  struct GNUNET_HashCode key;
+  json_t *json_root;
+  json_t *json_ego;
+  char *result_str;
+  char *privkey_str;
+
+  json_root = json_array ();
+  // Return ego/egos
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+  {
+    json_ego = json_object ();
+    json_object_set_new (json_ego,
+                         GNUNET_REST_IDENTITY_PARAM_PUBKEY,
+                         json_string (ego_entry->keystring));
+    GNUNET_CRYPTO_hash ("private", strlen ("private"), &key);
+    if (GNUNET_YES ==
+        GNUNET_CONTAINER_multihashmap_contains (
+          handle->rest_handle->url_param_map, &key))
+    {
+      privkey_str = GNUNET_CRYPTO_private_key_to_string (
+        GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego));
+      json_object_set_new (json_ego,
+                           GNUNET_REST_IDENTITY_PARAM_PRIVKEY,
+                           json_string (privkey_str));
+      GNUNET_free (privkey_str);
+    }
+
+    json_object_set_new (json_ego,
+                         GNUNET_REST_IDENTITY_PARAM_NAME,
+                         json_string (ego_entry->identifier));
+    json_array_append (json_root, json_ego);
+    json_decref (json_ego);
+  }
+
+  result_str = json_dumps (json_root, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  json_decref (json_root);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result_str);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Responds with the ego_entry identity
+ *
+ * @param handle the struct RequestHandle
+ * @param ego_entry the struct EgoEntry for the response
+ */
+void
+ego_get_response (struct RequestHandle *handle, struct EgoEntry *ego_entry)
+{
+  struct MHD_Response *resp;
+  struct GNUNET_HashCode key;
+  json_t *json_ego;
+  char *result_str;
+  char *privkey_str;
+
+  json_ego = json_object ();
+  json_object_set_new (json_ego,
+                       GNUNET_REST_IDENTITY_PARAM_PUBKEY,
+                       json_string (ego_entry->keystring));
+  json_object_set_new (json_ego,
+                       GNUNET_REST_IDENTITY_PARAM_NAME,
+                       json_string (ego_entry->identifier));
+  GNUNET_CRYPTO_hash ("private", strlen ("private"), &key);
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (
+        handle->rest_handle->url_param_map, &key))
+  {
+    privkey_str = GNUNET_CRYPTO_private_key_to_string (
+      GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego));
+    json_object_set_new (json_ego,
+                         GNUNET_REST_IDENTITY_PARAM_PRIVKEY,
+                         json_string (privkey_str));
+    GNUNET_free (privkey_str);
+  }
+
+  result_str = json_dumps (json_ego, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  json_decref (json_ego);
+  GNUNET_free (result_str);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Handle identity GET request with a public key
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_get_pubkey (struct GNUNET_REST_RequestHandle *con_handle,
+                const char *url,
+                void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *keystring;
+
+  keystring = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  keystring = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) + 1];
+  ego_entry = get_egoentry (handle, keystring, NULL);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  ego_get_response (handle, ego_entry);
+}
+
+
+/**
+ * Handle identity GET request with a name
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_get_name (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *egoname;
+
+  egoname = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_NAME) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  egoname = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_NAME) + 1];
+  ego_entry = get_egoentry (handle, NULL, egoname);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  ego_get_response (handle, ego_entry);
+}
+
+
+/**
+ * Processing finished
+ *
+ * @param cls request handle
+ * @param ec error code
+ */
+static void
+do_finished (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  int response_code;
+
+  handle->op = NULL;
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (GNUNET_EC_NONE == handle->ec)
+    response_code = MHD_HTTP_NO_CONTENT;
+  else
+    response_code = GNUNET_ErrorCode_get_http_status (ec);
+  resp = GNUNET_REST_create_response (NULL);
+  handle->proc (handle->proc_cls, resp, response_code);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Processing finished, when creating an ego.
+ *
+ * @param cls request handle
+ * @param pk private key of the ego, or NULL on error
+ * @param ec error code
+ */
+static void
+do_finished_create (void *cls,
+                    const struct GNUNET_CRYPTO_PrivateKey *pk,
+                    enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+
+  (void) pk;
+  do_finished (handle, ec);
+}
+
+
+/**
+ * Processing edit ego with EgoEntry ego_entry
+ *
+ * @param handle the struct RequestHandle
+ * @param ego_entry the struct EgoEntry we want to edit
+ */
+void
+ego_edit (struct RequestHandle *handle, struct EgoEntry *ego_entry)
+{
+  json_t *data_js;
+  json_error_t err;
+  char *newname;
+  char term_data[handle->data_size + 1];
+  int json_state;
+
+  // if no data
+  if (0 >= handle->data_size)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  // if not json
+  term_data[handle->data_size] = '\0';
+  GNUNET_memcpy (term_data, handle->data, handle->data_size);
+  data_js = json_loads (term_data, JSON_DECODE_ANY, &err);
+
+  if (NULL == data_js)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  newname = NULL;
+  // NEW NAME
+  json_state = 0;
+  json_state = json_unpack (data_js,
+                            "{s:s!}",
+                            GNUNET_REST_IDENTITY_PARAM_NEWNAME,
+                            &newname);
+  // Change name with pubkey or name identifier
+  if (0 != json_state)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+
+  if (NULL == newname)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+
+  if (0 >= strlen (newname))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+
+  handle->op = GNUNET_IDENTITY_rename (identity_handle,
+                                       ego_entry->identifier,
+                                       newname,
+                                       &do_finished,
+                                       handle);
+  if (NULL == handle->op)
+  {
+    handle->ec = GNUNET_EC_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  json_decref (data_js);
+  return;
+}
+
+
+/**
+ * Handle identity PUT request with public key
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_edit_pubkey (struct GNUNET_REST_RequestHandle *con_handle,
+                 const char *url,
+                 void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *keystring;
+
+  keystring = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  keystring = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) + 1];
+  ego_entry = get_egoentry (handle, keystring, NULL);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  ego_edit (handle, ego_entry);
+}
+
+
+/**
+ * Handle identity PUT request with name
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_edit_name (struct GNUNET_REST_RequestHandle *con_handle,
+               const char *url,
+               void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *name;
+
+  name = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_NAME) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  name = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_NAME) + 1];
+  ego_entry = get_egoentry (handle, NULL, name);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  ego_edit (handle, ego_entry);
+}
+
+
+/**
+ * Handle identity POST request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_create (struct GNUNET_REST_RequestHandle *con_handle,
+            const char *url,
+            void *cls)
+{
+  struct RequestHandle *handle = cls;
+  json_t *data_js;
+  json_error_t err;
+  char *egoname;
+  char *privkey;
+  struct GNUNET_CRYPTO_PrivateKey pk;
+  struct GNUNET_CRYPTO_PrivateKey *pk_ptr;
+  int json_unpack_state;
+  char term_data[handle->data_size + 1];
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY) != strlen (handle->url))
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  if (0 >= handle->data_size)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  term_data[handle->data_size] = '\0';
+  GNUNET_memcpy (term_data, handle->data, handle->data_size);
+  data_js = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if (NULL == data_js)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  json_unpack_state = 0;
+  privkey = NULL;
+  json_unpack_state =
+    json_unpack (data_js, "{s:s, s?:s!}",
+                 GNUNET_REST_IDENTITY_PARAM_NAME, &egoname,
+                 GNUNET_REST_IDENTITY_PARAM_PRIVKEY, &privkey);
+  if (0 != json_unpack_state)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+
+  if (NULL == egoname)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  if (0 >= strlen (egoname))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_INVALID;
+    json_decref (data_js);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  GNUNET_STRINGS_utf8_tolower (egoname, egoname);
+  handle->name = GNUNET_strdup (egoname);
+  if (NULL != privkey)
+  {
+    GNUNET_STRINGS_string_to_data (privkey,
+                                   strlen (privkey),
+                                   &pk,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PrivateKey));
+    pk_ptr = &pk;
+  }
+  else
+    pk_ptr = NULL;
+  json_decref (data_js);
+  handle->op = GNUNET_IDENTITY_create (identity_handle,
+                                       handle->name,
+                                       pk_ptr,
+                                       GNUNET_PUBLIC_KEY_TYPE_ECDSA,
+                                       &do_finished_create,
+                                       handle);
+}
+
+
+/**
+ * Handle identity DELETE request with public key
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_delete_pubkey (struct GNUNET_REST_RequestHandle *con_handle,
+                   const char *url,
+                   void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *keystring;
+
+  keystring = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  keystring = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_PUBKEY) + 1];
+  ego_entry = get_egoentry (handle, keystring, NULL);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  handle->op = GNUNET_IDENTITY_delete (identity_handle,
+                                       ego_entry->identifier,
+                                       &do_finished,
+                                       handle);
+}
+
+
+/**
+ * Handle identity DELETE request with name
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_delete_name (struct GNUNET_REST_RequestHandle *con_handle,
+                 const char *url,
+                 void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *name;
+
+  name = NULL;
+
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_NAME) >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  name = &handle->url[strlen (GNUNET_REST_API_NS_IDENTITY_NAME) + 1];
+  ego_entry = get_egoentry (handle, NULL, name);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  handle->op = GNUNET_IDENTITY_delete (identity_handle,
+                                       ego_entry->identifier,
+                                       &do_finished,
+                                       handle);
+}
+
+
+struct ego_sign_data_cls
+{
+  void *data;
+  struct RequestHandle *handle;
+};
+
+void
+ego_sign_data_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
+{
+  struct RequestHandle *handle = ((struct ego_sign_data_cls *) cls)->handle;
+  unsigned char *data
+    = (unsigned char *) ((struct ego_sign_data_cls *) cls)->data; // data is url decoded
+  struct MHD_Response *resp;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  char *sig_str;
+  char *result;
+
+  if (ego == NULL)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  if (ntohl (ego->pk.type) != GNUNET_PUBLIC_KEY_TYPE_EDDSA)
+  {
+    handle->ec = GNUNET_EC_IDENTITY_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  if (GNUNET_OK != GNUNET_CRYPTO_eddsa_sign_raw (&(ego->pk.eddsa_key),
+                                                 (void *) data,
+                                                 strlen ( (char*) data),
+                                                 &sig))
+  {
+    handle->ec = GNUNET_EC_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  GNUNET_STRINGS_base64url_encode (&sig,
+                                   sizeof (struct GNUNET_CRYPTO_EddsaSignature),
+                                   &sig_str);
+
+  GNUNET_asprintf (&result,
+                   "{\"signature\": \"%s\"}",
+                   sig_str);
+
+  resp = GNUNET_REST_create_response (result);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+
+  free (data);
+  free (sig_str);
+  free (result);
+  free (cls);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+ego_sign_data (struct GNUNET_REST_RequestHandle *con_handle,
+               const char *url,
+               void *cls)
+{
+  // TODO: replace with precompiler #define
+  const char *username_key = "user";
+  const char *data_key = "data";
+
+  struct RequestHandle *handle = cls;
+  struct GNUNET_HashCode cache_key_username;
+  struct GNUNET_HashCode cache_key_data;
+  char *username;
+  char *data;
+
+  struct ego_sign_data_cls *cls2;
+
+  GNUNET_CRYPTO_hash (username_key, strlen (username_key), &cache_key_username);
+  GNUNET_CRYPTO_hash (data_key, strlen (data_key), &cache_key_data);
+
+  if ((GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (
+         handle->rest_handle->url_param_map,
+         &cache_key_username)) ||
+      (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (
+         handle->rest_handle->url_param_map,
+         &cache_key_data)))
+  {
+    handle->ec = GNUNET_EC_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  username = (char *) GNUNET_CONTAINER_multihashmap_get (
+    handle->rest_handle->url_param_map,
+    &cache_key_username);
+
+  data = (char *) GNUNET_CONTAINER_multihashmap_get (
+    handle->rest_handle->url_param_map,
+    &cache_key_data);
+
+  cls2 = malloc (sizeof(struct ego_sign_data_cls));
+  cls2->data = (void *) GNUNET_strdup (data);
+  cls2->handle = handle;
+
+  GNUNET_IDENTITY_ego_lookup (id_cfg,
+                              username,
+                              ego_sign_data_cb,
+                              cls2);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // For now, independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+  return;
+}
+
+
+static void
+list_ego (void *cls,
+          struct GNUNET_IDENTITY_Ego *ego,
+          void **ctx,
+          const char *identifier)
+{
+  struct EgoEntry *ego_entry;
+  struct GNUNET_CRYPTO_PublicKey pk;
+
+  if ((NULL == ego) && (ID_REST_STATE_INIT == state))
+  {
+    state = ID_REST_STATE_POST_INIT;
+    return;
+  }
+  if (NULL == ego)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Called with NULL ego\n");
+    return;
+  }
+  if (ID_REST_STATE_INIT == state)
+  {
+    ego_entry = GNUNET_new (struct EgoEntry);
+    GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+    ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+    ego_entry->ego = ego;
+    ego_entry->identifier = GNUNET_strdup (identifier);
+    GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                      ego_tail,
+                                      ego_entry);
+  }
+  /* Ego renamed or added */
+  if (identifier != NULL)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+      {
+        /* Rename */
+        GNUNET_free (ego_entry->identifier);
+        ego_entry->identifier = GNUNET_strdup (identifier);
+        break;
+      }
+    }
+    if (NULL == ego_entry)
+    {
+      /* Add */
+      ego_entry = GNUNET_new (struct EgoEntry);
+      GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+      ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+      ego_entry->ego = ego;
+      ego_entry->identifier = GNUNET_strdup (identifier);
+      GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                        ego_tail,
+                                        ego_entry);
+    }
+  }
+  else
+  {
+    /* Delete */
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+        break;
+    }
+    if (NULL == ego_entry)
+      return; /* Not found */
+
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 ego_entry);
+    GNUNET_free (ego_entry->identifier);
+    GNUNET_free (ego_entry->keystring);
+    GNUNET_free (ego_entry);
+    return;
+  }
+
+}
+
+
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for callback function
+ * @return GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_identity_process_request (void* plugin,
+                               struct GNUNET_REST_RequestHandle *rest_handle,
+                               GNUNET_REST_ResultProcessor proc,
+                               void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] =
+  { { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_IDENTITY_PUBKEY,
+      &ego_get_pubkey },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_IDENTITY_NAME, &ego_get_name },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_IDENTITY, &ego_get_all },
+    { MHD_HTTP_METHOD_PUT,
+      GNUNET_REST_API_NS_IDENTITY_PUBKEY,
+      &ego_edit_pubkey },
+    { MHD_HTTP_METHOD_PUT, GNUNET_REST_API_NS_IDENTITY_NAME, &ego_edit_name },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_IDENTITY, &ego_create },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_IDENTITY_PUBKEY,
+      &ego_delete_pubkey },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_IDENTITY_NAME,
+      &ego_delete_name },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_IDENTITY, &options_cont },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_SIGN, &ego_sign_data},
+    GNUNET_REST_HANDLER_END };
+
+
+  handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+  handle->data = rest_handle->data;
+  handle->data_size = rest_handle->data_size;
+
+  handle->url = GNUNET_strdup (rest_handle->url);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_error, handle);
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connecting...\n");
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connected\n");
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls Config info
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+REST_identity_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  id_cfg = c;
+  if (NULL != plugin.cfg)
+    return NULL; /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = c;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_IDENTITY;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s, %s, %s, %s",
+                   MHD_HTTP_METHOD_GET,
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_PUT,
+                   MHD_HTTP_METHOD_DELETE,
+                   MHD_HTTP_METHOD_OPTIONS);
+  state = ID_REST_STATE_INIT;
+  identity_handle = GNUNET_IDENTITY_connect (id_cfg, &list_ego, NULL);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, _ ("Identity REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_identity_done (struct GNUNET_REST_Plugin *api)
+{
+  struct Plugin *plugin = api->cls;
+  struct EgoEntry *ego_entry;
+  struct EgoEntry *ego_tmp;
+
+  plugin->cfg = NULL;
+  while (NULL != requests_head)
+    cleanup_handle (requests_head);
+  if (NULL != identity_handle)
+    GNUNET_IDENTITY_disconnect (identity_handle);
+
+  for (ego_entry = ego_head; NULL != ego_entry;)
+  {
+    ego_tmp = ego_entry;
+    ego_entry = ego_entry->next;
+    GNUNET_free (ego_tmp->identifier);
+    GNUNET_free (ego_tmp->keystring);
+    GNUNET_free (ego_tmp);
+  }
+
+  GNUNET_free (allow_methods);
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Identity REST plugin is finished\n");
+}
+
+
+/* end of plugin_rest_identity.c */
diff --git a/src/service/rest/identity_plugin.h b/src/service/rest/identity_plugin.h
new file mode 100644
index 000000000..0886156c1
--- /dev/null
+++ b/src/service/rest/identity_plugin.h
@@ -0,0 +1,36 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_identity_process_request (void *plugin,
+                               struct GNUNET_REST_RequestHandle *conndata_handle,
+                               GNUNET_REST_ResultProcessor proc,
+                               void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_identity_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_identity_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/rest/json_reclaim.c b/src/service/rest/json_reclaim.c
new file mode 100644
index 000000000..b1ca7a4a5
--- /dev/null
+++ b/src/service/rest/json_reclaim.c
@@ -0,0 +1,398 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2009-2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file rest-plugins/json_reclaim.c
+ * @brief JSON handling of reclaim data
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_reclaim_lib.h"
+#include "gnunet_reclaim_service.h"
+
+
+/**
+ * Parse given JSON object to a claim
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_attr (void *cls, json_t *root, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Attribute *attr;
+  const char *name_str = NULL;
+  const char *val_str = NULL;
+  const char *type_str = NULL;
+  const char *id_str = NULL;
+  const char *cred_str = NULL;
+  const char *flag_str = NULL;
+  char *data;
+  int unpack_state;
+  uint32_t type;
+  size_t data_size;
+
+  GNUNET_assert (NULL != root);
+
+  if (! json_is_object (root))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error json is not array nor object!\n");
+    return GNUNET_SYSERR;
+  }
+  // interpret single attribute
+  unpack_state = json_unpack (root,
+                              "{s:s, s?s, s?s, s:s, s:s, s?s!}",
+                              "name",
+                              &name_str,
+                              "id",
+                              &id_str,
+                              "credential",
+                              &cred_str,
+                              "type",
+                              &type_str,
+                              "value",
+                              &val_str,
+                              "flag",
+                              &flag_str);
+  if ((0 != unpack_state) || (NULL == name_str) || (NULL == val_str) ||
+      (NULL == type_str))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error json object has a wrong format!\n");
+    return GNUNET_SYSERR;
+  }
+  type = GNUNET_RECLAIM_attribute_typename_to_number (type_str);
+  if (GNUNET_SYSERR ==
+      (GNUNET_RECLAIM_attribute_string_to_value (type,
+                                                 val_str,
+                                                 (void **) &data,
+                                                 &data_size)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Attribute value invalid!\n");
+    return GNUNET_SYSERR;
+  }
+  attr = GNUNET_RECLAIM_attribute_new (name_str, NULL,
+                                       type, data, data_size);
+  GNUNET_free (data);
+  if ((NULL != cred_str) && (0 != strlen (cred_str)))
+  {
+    GNUNET_STRINGS_string_to_data (cred_str,
+                                   strlen (cred_str),
+                                   &attr->credential,
+                                   sizeof(attr->credential));
+  }
+  if ((NULL == id_str) || (0 == strlen (id_str)))
+    memset (&attr->id, 0, sizeof (attr->id));
+  else
+    GNUNET_STRINGS_string_to_data (id_str,
+                                   strlen (id_str),
+                                   &attr->id,
+                                   sizeof(attr->id));
+
+  *(struct GNUNET_RECLAIM_Attribute **) spec->ptr = attr;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing RSA public key.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_attr (void *cls, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Attribute **attr;
+
+  attr = (struct GNUNET_RECLAIM_Attribute **) spec->ptr;
+  if (NULL != *attr)
+  {
+    GNUNET_free (*attr);
+    *attr = NULL;
+  }
+}
+
+
+/**
+ * JSON Specification for Reclaim claims.
+ *
+ * @param ticket struct of GNUNET_RECLAIM_Attribute to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_attribute (struct GNUNET_RECLAIM_Attribute **attr)
+{
+  struct GNUNET_JSON_Specification ret = { .parser = &parse_attr,
+                                           .cleaner = &clean_attr,
+                                           .cls = NULL,
+                                           .field = NULL,
+                                           .ptr = attr,
+                                           .ptr_size = 0,
+                                           .size_ptr = NULL };
+
+  *attr = NULL;
+  return ret;
+}
+
+
+/**
+ * Parse given JSON object to a ticket
+ *
+ * @param cls closure, NULL
+ * @param root the json object representing data
+ * @param spec where to write the data
+ * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+ */
+static int
+parse_ticket (void *cls, json_t *root, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Ticket *ticket;
+  const char *rnd_str;
+  const char *aud_str;
+  const char *id_str;
+  int unpack_state;
+
+  GNUNET_assert (NULL != root);
+
+  if (! json_is_object (root))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error json is not array nor object!\n");
+    return GNUNET_SYSERR;
+  }
+  // interpret single ticket
+  unpack_state = json_unpack (root,
+                              "{s:s, s:s, s:s!}",
+                              "rnd",
+                              &rnd_str,
+                              "audience",
+                              &aud_str,
+                              "issuer",
+                              &id_str);
+  if (0 != unpack_state)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Error json object has a wrong format!\n");
+    return GNUNET_SYSERR;
+  }
+  ticket = GNUNET_new (struct GNUNET_RECLAIM_Ticket);
+  if (GNUNET_OK != GNUNET_STRINGS_string_to_data (rnd_str,
+                                                  strlen (rnd_str),
+                                                  &ticket->rnd,
+                                                  sizeof(ticket->rnd)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Rnd invalid\n");
+    GNUNET_free (ticket);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (id_str,
+                                     strlen (id_str),
+                                     &ticket->identity,
+                                     sizeof(ticket->identity)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Identity invalid\n");
+    GNUNET_free (ticket);
+    return GNUNET_SYSERR;
+  }
+
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (aud_str,
+                                     strlen (aud_str),
+                                     &ticket->audience,
+                                     sizeof(ticket->audience)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Audience invalid\n");
+    GNUNET_free (ticket);
+    return GNUNET_SYSERR;
+  }
+
+  *(struct GNUNET_RECLAIM_Ticket **) spec->ptr = ticket;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing RSA public key.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_ticket (void *cls, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Ticket **ticket;
+
+  ticket = (struct GNUNET_RECLAIM_Ticket **) spec->ptr;
+  if (NULL != *ticket)
+  {
+    GNUNET_free (*ticket);
+    *ticket = NULL;
+  }
+}
+
+
+/**
+ * JSON Specification for Reclaim tickets.
+ *
+ * @param ticket struct of GNUNET_RECLAIM_Ticket to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_ticket (struct GNUNET_RECLAIM_Ticket **ticket)
+{
+  struct GNUNET_JSON_Specification ret = { .parser = &parse_ticket,
+                                           .cleaner = &clean_ticket,
+                                           .cls = NULL,
+                                           .field = NULL,
+                                           .ptr = ticket,
+                                           .ptr_size = 0,
+                                           .size_ptr = NULL };
+
+  *ticket = NULL;
+  return ret;
+}
+
+
+/**
+   * Parse given JSON object to a credential claim
+   *
+   * @param cls closure, NULL
+   * @param root the json object representing data
+   * @param spec where to write the data
+   * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
+   */
+static int
+parse_credential (void *cls, json_t *root, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Credential *cred;
+  const char *name_str = NULL;
+  const char *type_str = NULL;
+  const char *id_str = NULL;
+  json_t *val_json;
+  char *data = NULL;
+  char *val_str = NULL;
+  int unpack_state;
+  uint32_t type;
+  size_t data_size;
+
+  GNUNET_assert (NULL != root);
+
+  if (! json_is_object (root))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error json is not array nor object!\n");
+    return GNUNET_SYSERR;
+  }
+  // interpret single attribute
+  unpack_state = json_unpack (root,
+                              "{s:s, s?s, s:s, s:o!}",
+                              "name",
+                              &name_str,
+                              "id",
+                              &id_str,
+                              "type",
+                              &type_str,
+                              "value",
+                              &val_json);
+  if ((0 != unpack_state) || (NULL == name_str) || (NULL == val_json) ||
+      (NULL == type_str))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error json object has a wrong format!\n");
+    return GNUNET_SYSERR;
+  }
+  if (json_is_string (val_json)) {
+    val_str = GNUNET_strdup (json_string_value (val_json));
+  } else {
+    val_str = json_dumps (val_json, JSON_COMPACT);
+  }
+  type = GNUNET_RECLAIM_credential_typename_to_number (type_str);
+  if (GNUNET_SYSERR ==
+      (GNUNET_RECLAIM_credential_string_to_value (type,
+                                                  val_str,
+                                                  (void **) &data,
+                                                  &data_size)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Credential value invalid!\n");
+    return GNUNET_SYSERR;
+  }
+  cred = GNUNET_RECLAIM_credential_new (name_str, type, data, data_size);
+  GNUNET_free (data);
+  if ((NULL == id_str) || (0 == strlen (id_str)))
+    memset (&cred->id, 0, sizeof (cred->id));
+  else
+    GNUNET_STRINGS_string_to_data (id_str,
+                                   strlen (id_str),
+                                   &cred->id,
+                                   sizeof(cred->id));
+
+  *(struct GNUNET_RECLAIM_Credential **) spec->ptr = cred;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cleanup data left from parsing RSA public key.
+ *
+ * @param cls closure, NULL
+ * @param[out] spec where to free the data
+ */
+static void
+clean_credential (void *cls, struct GNUNET_JSON_Specification *spec)
+{
+  struct GNUNET_RECLAIM_Credential **attr;
+
+  attr = (struct GNUNET_RECLAIM_Credential **) spec->ptr;
+  if (NULL != *attr)
+  {
+    GNUNET_free (*attr);
+    *attr = NULL;
+  }
+}
+
+
+/**
+ * JSON Specification for credential claims.
+ *
+ * @param attr struct of GNUNET_RECLAIM_Credential to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_credential (struct
+                                     GNUNET_RECLAIM_Credential **cred)
+{
+  struct GNUNET_JSON_Specification ret = { .parser = &parse_credential,
+                                           .cleaner = &clean_credential,
+                                           .cls = NULL,
+                                           .field = NULL,
+                                           .ptr = cred,
+                                           .ptr_size = 0,
+                                           .size_ptr = NULL };
+
+  *cred = NULL;
+  return ret;
+}
diff --git a/src/service/rest/json_reclaim.h b/src/service/rest/json_reclaim.h
new file mode 100644
index 000000000..613ddf873
--- /dev/null
+++ b/src/service/rest/json_reclaim.h
@@ -0,0 +1,57 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2009-2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file rest-plugins/json_reclaim.h
+ * @brief JSON handling of reclaim data
+ * @author Martin Schanzenbach
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_json_lib.h"
+#include "gnunet_reclaim_service.h"
+#include "gnunet_reclaim_lib.h"
+
+/**
+ * JSON Specification for Reclaim claims.
+ *
+ * @param attr struct of GNUNET_RECLAIM_Attribute to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_attribute (struct GNUNET_RECLAIM_Attribute **attr);
+
+/**
+ * JSON Specification for Reclaim tickets.
+ *
+ * @param ticket struct of GNUNET_RECLAIM_Ticket to fill
+ * @return JSON Specification
+ */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_ticket (struct GNUNET_RECLAIM_Ticket **ticket);
+
+/**
+    * JSON Specification for credentials.
+    *
+    * @param cred struct of GNUNET_RECLAIM_Credential to fill
+    * @return JSON Specification
+    */
+struct GNUNET_JSON_Specification
+GNUNET_RECLAIM_JSON_spec_credential (struct  GNUNET_RECLAIM_Credential **cred);
diff --git a/src/service/rest/meson.build b/src/service/rest/meson.build
index 316724fdb..347cbb852 100644
--- a/src/service/rest/meson.build
+++ b/src/service/rest/meson.build
@@ -1,6 +1,16 @@
 libgnunetrest_src = ['rest.c']
 
-gnunetservicerest_src = ['gnunet-rest-server.c']
+gnunetservicerest_src = ['gnunet-rest-server.c',
+                         'config_plugin.c',
+                         'copying_plugin.c',
+                         'identity_plugin.c',
+                         'namestore_plugin.c',
+                         'gns_plugin.c',
+                         'openid_plugin.c',
+                         'oidc_helper.c',
+                         'json_reclaim.c',
+                         'reclaim_plugin.c',
+                         ]
 
 configure_file(input : 'rest.conf',
                output : 'rest.conf',
@@ -30,7 +40,19 @@ libgnunetrest_dep = declare_dependency(link_with : libgnunetrest)
 
 executable ('gnunet-rest-server',
             gnunetservicerest_src,
-            dependencies: [libgnunetrest_dep, libgnunetutil_dep, mhd_dep],
+            dependencies: [libgnunetrest_dep,
+                           libgnunetutil_dep,
+                           libgnunetidentity_dep,
+                           libgnunetgns_dep,
+                           libgnunetreclaim_dep,
+                           libgnunetnamestore_dep,
+                           libgnunetjson_dep,
+                           libgnunetgnsrecord_dep,
+                           libgnunetgnsrecordjson_dep,
+                           json_dep,
+                           jose_dep,
+                           gcrypt_dep,
+                           mhd_dep],
             include_directories: [incdir, configuration_inc],
             install: true,
             install_dir: get_option('libdir') / 'gnunet' / 'libexec')
diff --git a/src/service/rest/namestore_plugin.c b/src/service/rest/namestore_plugin.c
new file mode 100644
index 000000000..8c5b8b824
--- /dev/null
+++ b/src/service/rest/namestore_plugin.c
@@ -0,0 +1,1364 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @author Philippe Buschmann
+ * @file namestore/plugin_rest_namestore.c
+ * @brief GNUnet Namestore REST plugin
+ */
+
+#include "platform.h"
+#include "gnunet_error_codes.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_gns_service.h"
+#include "gnunet_namestore_service.h"
+#include "gnunet_identity_service.h"
+#include "gnunet_rest_lib.h"
+#include "gnunet_gnsrecord_json_lib.h"
+#include "microhttpd.h"
+#include <jansson.h>
+
+/**
+ * Namestore namespace
+ */
+#define GNUNET_REST_API_NS_NAMESTORE "/namestore"
+
+/**
+ * Namestore import API namespace
+ */
+#define GNUNET_REST_API_NS_NAMESTORE_IMPORT "/namestore/import"
+
+/**
+ * State while collecting all egos
+ */
+#define ID_REST_STATE_INIT 0
+
+/**
+ * Done collecting egos
+ */
+#define ID_REST_STATE_POST_INIT 1
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *ns_cfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_head;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_tail;
+
+/**
+ * The processing state
+ */
+static int state;
+
+/**
+ * Handle to NAMESTORE
+ */
+static struct GNUNET_NAMESTORE_Handle *ns_handle;
+
+/**
+ * Handle to Identity service.
+ */
+static struct GNUNET_IDENTITY_Handle *identity_handle;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+/**
+ * The default namestore ego
+ */
+struct EgoEntry
+{
+  /**
+   * DLL
+   */
+  struct EgoEntry *next;
+
+  /**
+   * DLL
+   */
+  struct EgoEntry *prev;
+
+  /**
+   * Ego Identifier
+   */
+  char *identifier;
+
+  /**
+   * Public key string
+   */
+  char *keystring;
+
+  /**
+   * The Ego
+   */
+  struct GNUNET_IDENTITY_Ego *ego;
+};
+
+
+enum UpdateStrategy
+{
+  UPDATE_STRATEGY_REPLACE,
+  UPDATE_STRATEGY_APPEND
+};
+
+/**
+ * The request handle
+ */
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Records to store
+   */
+  char *record_name;
+
+  /**
+   * Record type filter
+   */
+  uint32_t record_type;
+
+  /**
+   * How to update the record set
+   */
+  enum UpdateStrategy update_strategy;
+
+  /**
+   * Records to store
+   */
+  struct GNUNET_GNSRECORD_Data *rd;
+
+  /**
+   * Number of records in rd
+   */
+  unsigned int rd_count;
+
+  /**
+   * RecordInfo array
+   */
+  struct GNUNET_NAMESTORE_RecordInfo *ri;
+
+  /**
+   * Size of record info
+   */
+  unsigned int rd_set_count;
+
+  /**
+   * Position of record info
+   */
+  unsigned int rd_set_pos;
+
+  /**
+   * NAMESTORE Operation
+   */
+  struct GNUNET_NAMESTORE_QueueEntry *ns_qe;
+
+  /**
+   * For bulk import, we need a dedicated Namestore handle
+   */
+  struct GNUNET_NAMESTORE_Handle *nc;
+
+  /**
+   * Response object
+   */
+  json_t *resp_object;
+
+
+  /**
+   * Handle to NAMESTORE it
+   */
+  struct GNUNET_NAMESTORE_ZoneIterator *list_it;
+
+  /**
+   * Private key for the zone
+   */
+  const struct GNUNET_CRYPTO_PrivateKey *zone_pkey;
+
+  /**
+   * IDENTITY Operation
+   */
+  struct EgoEntry *ego_entry;
+
+  /**
+   * IDENTITY Operation
+   */
+  struct GNUNET_IDENTITY_Operation *op;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * Error code
+   */
+  enum GNUNET_ErrorCode ec;
+
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+
+/**
+ * Cleanup lookup handle
+ * @param cls Handle to clean up
+ */
+static void
+cleanup_handle (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+    handle->timeout_task = NULL;
+  }
+  if (NULL != handle->record_name)
+    GNUNET_free (handle->record_name);
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  if (NULL != handle->rd)
+  {
+    for (int i = 0; i < handle->rd_count; i++)
+    {
+      if (NULL != handle->rd[i].data)
+        GNUNET_free_nz ((void *) handle->rd[i].data);
+    }
+    GNUNET_free (handle->rd);
+  }
+  if (NULL != handle->timeout_task)
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+  if (NULL != handle->list_it)
+    GNUNET_NAMESTORE_zone_iteration_stop (handle->list_it);
+  if (NULL != handle->ns_qe)
+    GNUNET_NAMESTORE_cancel (handle->ns_qe);
+  if (NULL != handle->nc)
+    GNUNET_NAMESTORE_disconnect (handle->nc);
+  if (NULL != handle->resp_object)
+  {
+    json_decref (handle->resp_object);
+  }
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on errors.  Reports an error and cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  json_t *json_error = json_object ();
+  char *response;
+  const char*emsg;
+  int response_code;
+
+  emsg = GNUNET_ErrorCode_get_hint (handle->ec);
+  json_object_set_new (json_error, "error", json_string (emsg));
+  json_object_set_new (json_error, "error_code", json_integer (handle->ec));
+  response_code = GNUNET_ErrorCode_get_http_status (handle->ec);
+  if (0 == response_code)
+    response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+  response = json_dumps (json_error, 0);
+  resp = GNUNET_REST_create_response (response);
+  GNUNET_assert (MHD_YES ==
+                 MHD_add_response_header (resp, "Content-Type",
+                                          "application/json"));
+  handle->proc (handle->proc_cls, resp, response_code);
+  json_decref (json_error);
+  GNUNET_free (response);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Get EgoEntry from list with either a public key or a name
+ * If public key and name are not NULL, it returns the public key result first
+ *
+ * @param handle the RequestHandle
+ * @param pubkey the public key of an identity (only one can be NULL)
+ * @param name the name of an identity (only one can be NULL)
+ * @return EgoEntry or NULL if not found
+ */
+struct EgoEntry *
+get_egoentry_namestore (struct RequestHandle *handle, char *name)
+{
+  struct EgoEntry *ego_entry;
+  char *copy = GNUNET_strdup (name);
+  char *tmp;
+
+  if (NULL == name)
+    return NULL;
+  tmp = strtok (copy, "/");
+  if (NULL == tmp)
+    return NULL;
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+  {
+    if (0 != strcasecmp (tmp, ego_entry->identifier))
+      continue;
+    GNUNET_free (copy);
+    return ego_entry;
+  }
+  GNUNET_free (copy);
+  return NULL;
+}
+
+
+/**
+ * Does internal server error when iteration failed.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+namestore_iteration_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->ec = GNUNET_EC_NAMESTORE_ITERATION_FAILED;
+  GNUNET_SCHEDULER_add_now (&do_error, handle);
+  return;
+}
+
+
+static void
+create_finished (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  handle->ns_qe = NULL;
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  resp = GNUNET_REST_create_response (NULL);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_NO_CONTENT);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+static void
+del_finished (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->ns_qe = NULL;
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->proc (handle->proc_cls,
+                GNUNET_REST_create_response (NULL),
+                MHD_HTTP_NO_CONTENT);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Iteration over all results finished, build final
+ * response.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+namestore_list_finished (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  char *result_str;
+  struct MHD_Response *resp;
+
+  handle->list_it = NULL;
+
+  if (NULL == handle->resp_object)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_EMPTY;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  result_str = json_dumps (handle->resp_object, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  GNUNET_assert (MHD_YES ==
+                 MHD_add_response_header (resp, "Content-Type",
+                                          "application/json"));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result_str);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Create a response with requested records
+ *
+ * @param handle the RequestHandle
+ */
+static void
+namestore_list_iteration (void *cls,
+                          const struct GNUNET_CRYPTO_PrivateKey *zone_key,
+                          const char *rname,
+                          unsigned int rd_len,
+                          const struct GNUNET_GNSRECORD_Data *rd,
+                          struct GNUNET_TIME_Absolute expiry)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_GNSRECORD_Data rd_filtered[rd_len];
+  json_t *record_obj;
+  int i = 0;
+  int j = 0;
+
+  if (rd_len == 0)
+  {
+    /** skip **/
+    GNUNET_NAMESTORE_zone_iterator_next (handle->list_it, 1);
+    return;
+  }
+
+  for (i = 0; i < rd_len; i++)
+  {
+    if ((GNUNET_GNSRECORD_TYPE_ANY != handle->record_type) &&
+        (rd[i].record_type != handle->record_type))
+      continue; /* Apply filter */
+    rd_filtered[j] = rd[i];
+    rd_filtered[j].data = rd[i].data;
+    j++;
+  }
+  /** Only add if not empty **/
+  if (j > 0)
+  {
+    if (NULL == handle->resp_object)
+      handle->resp_object = json_array ();
+    record_obj = GNUNET_GNSRECORD_JSON_from_gnsrecord (rname,
+                                                       rd_filtered,
+                                                       j);
+    json_array_append_new (handle->resp_object, record_obj);
+  }
+  GNUNET_NAMESTORE_zone_iterator_next (handle->list_it, 1);
+}
+
+
+/**
+ * Handle lookup error
+ *
+ * @param cls the request handle
+ */
+static void
+ns_lookup_error_cb (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->ec = GNUNET_EC_NAMESTORE_LOOKUP_ERROR;
+  GNUNET_SCHEDULER_add_now (&do_error, handle);
+}
+
+
+static void
+ns_get_lookup_cb (void *cls,
+                  const struct GNUNET_CRYPTO_PrivateKey *zone,
+                  const char *label,
+                  unsigned int rd_len,
+                  const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_GNSRECORD_Data rd_filtered[rd_len];
+  int i = 0;
+  int j = 0;
+
+  handle->ns_qe = NULL;
+  for (i = 0; i < rd_len; i++)
+  {
+    if ((GNUNET_GNSRECORD_TYPE_ANY != handle->record_type) &&
+        (rd[i].record_type != handle->record_type))
+      continue; /* Apply filter */
+    rd_filtered[j] = rd[i];
+    rd_filtered[j].data = rd[i].data;
+    j++;
+  }
+  /** Return 404 if no set was found **/
+  if (j == 0)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_RECORD_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->resp_object = GNUNET_GNSRECORD_JSON_from_gnsrecord (label,
+                                                              rd_filtered,
+                                                              j);
+  GNUNET_SCHEDULER_add_now (&namestore_list_finished, handle);
+}
+
+
+/**
+ * Handle namestore GET request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_get (struct GNUNET_REST_RequestHandle *con_handle,
+               const char *url,
+               void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  struct GNUNET_HashCode key;
+  enum GNUNET_GNSRECORD_Filter filter_flags;
+  char *egoname;
+  char *labelname;
+  char *typename;
+  char *boolstring;
+
+  egoname = NULL;
+  ego_entry = NULL;
+
+  // set zone to name if given
+  if (strlen (GNUNET_REST_API_NS_NAMESTORE) + 1  >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  egoname = &handle->url[strlen (GNUNET_REST_API_NS_NAMESTORE) + 1];
+  ego_entry = get_egoentry_namestore (handle, egoname);
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->zone_pkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+
+  GNUNET_CRYPTO_hash ("record_type", strlen ("record_type"), &key);
+  handle->record_type = GNUNET_GNSRECORD_TYPE_ANY;
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (con_handle->url_param_map, &key))
+  {
+    typename = GNUNET_CONTAINER_multihashmap_get (con_handle->url_param_map,
+                                                  &key);
+    if (NULL != typename)
+      handle->record_type = GNUNET_GNSRECORD_typename_to_number (typename);
+  }
+  GNUNET_CRYPTO_hash ("omit_private", strlen ("omit_private"), &key);
+  filter_flags = GNUNET_GNSRECORD_FILTER_NONE;
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (con_handle->url_param_map, &key))
+  {
+    boolstring = GNUNET_CONTAINER_multihashmap_get (con_handle->url_param_map,
+                                                    &key);
+    if ((0 == strcmp (boolstring, "1")) ||
+        (0 == strcmp (boolstring, "yes")) ||
+        (0 == strcmp (boolstring, "true")))
+      filter_flags = GNUNET_GNSRECORD_FILTER_OMIT_PRIVATE;
+  }
+  GNUNET_CRYPTO_hash ("include_maintenance", strlen ("include_maintenance"),
+                      &key);
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (con_handle->url_param_map, &key))
+  {
+    boolstring = GNUNET_CONTAINER_multihashmap_get (con_handle->url_param_map,
+                                                    &key);
+    if ((0 == strcmp (boolstring, "1")) ||
+        (0 == strcmp (boolstring, "yes")) ||
+        (0 == strcmp (boolstring, "true")))
+      filter_flags |= GNUNET_GNSRECORD_FILTER_INCLUDE_MAINTENANCE;
+  }
+  labelname = &egoname[strlen (ego_entry->identifier)];
+  if (1 >= strlen (labelname))
+  {
+    /* Iterate over all records */
+    handle->list_it =
+      GNUNET_NAMESTORE_zone_iteration_start2 (ns_handle,
+                                              handle->zone_pkey,
+                                              &namestore_iteration_error,
+                                              handle,
+                                              &namestore_list_iteration,
+                                              handle,
+                                              &namestore_list_finished,
+                                              handle,
+                                              filter_flags);
+    if (NULL == handle->list_it)
+    {
+      handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+      GNUNET_SCHEDULER_add_now (&do_error, handle);
+      return;
+    }
+    return;
+  }
+  handle->record_name = GNUNET_strdup (labelname + 1);
+  handle->ns_qe = GNUNET_NAMESTORE_records_lookup2 (ns_handle,
+                                                    handle->zone_pkey,
+                                                    handle->record_name,
+                                                    &ns_lookup_error_cb,
+                                                    handle,
+                                                    &ns_get_lookup_cb,
+                                                    handle,
+                                                    filter_flags);
+  if (NULL == handle->ns_qe)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+}
+
+
+static void
+ns_lookup_cb (void *cls,
+              const struct GNUNET_CRYPTO_PrivateKey *zone,
+              const char *label,
+              unsigned int rd_count,
+              const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_GNSRECORD_Data rd_new[rd_count + handle->rd_count];
+  int i = 0;
+  int j = 0;
+
+  if (UPDATE_STRATEGY_APPEND == handle->update_strategy)
+  {
+    for (i = 0; i < rd_count; i++)
+      rd_new[i] = rd[i];
+  }
+  for (j = 0; j < handle->rd_count; j++)
+    rd_new[i + j] = handle->rd[j];
+  handle->ns_qe = GNUNET_NAMESTORE_records_store (ns_handle,
+                                                  handle->zone_pkey,
+                                                  handle->record_name,
+                                                  i + j,
+                                                  rd_new,
+                                                  &create_finished,
+                                                  handle);
+  if (NULL == handle->ns_qe)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+}
+
+
+static void
+bulk_tx_commit_cb (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  handle->ns_qe = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Commit finished (%d)\n", ec);
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  resp = GNUNET_REST_create_response (NULL);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_NO_CONTENT);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+static void
+import_next_cb (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Import finished (%d)\n", ec);
+  handle->ns_qe = NULL;
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  unsigned int remaining = handle->rd_set_count - handle->rd_set_pos;
+  if (0 == remaining)
+  {
+    handle->ns_qe = GNUNET_NAMESTORE_transaction_commit (handle->nc,
+                                                         &bulk_tx_commit_cb,
+                                                         handle);
+    return;
+  }
+  unsigned int sent_rds = 0;
+  // Find the smallest set of records we can send with our message size
+  // restriction of 16 bit
+  handle->ns_qe = GNUNET_NAMESTORE_records_store2 (handle->nc,
+                                                   handle->zone_pkey,
+                                                   remaining,
+                                                   &handle->ri[handle->
+                                                               rd_set_pos],
+                                                   &sent_rds,
+                                                   &import_next_cb,
+                                                   handle);
+  if ((NULL == handle->ns_qe) && (0 == sent_rds))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->rd_set_pos += sent_rds;
+}
+
+
+static void
+bulk_tx_start (void *cls, enum GNUNET_ErrorCode ec)
+{
+  struct RequestHandle *handle = cls;
+  json_t *data_js;
+  json_error_t err;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Transaction started...\n");
+  handle->ec = ec;
+  if (GNUNET_EC_NONE != ec)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (0 >= handle->rest_handle->data_size)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_NO_RECORDS_GIVEN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  char term_data[handle->rest_handle->data_size + 1];
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_js = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if (NULL == data_js)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID;
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error parsing data: %s", err.text);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (! json_is_array (data_js))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  handle->rd_set_count = json_array_size (data_js);
+  handle->ri = GNUNET_malloc (handle->rd_set_count
+                              * sizeof (struct GNUNET_NAMESTORE_RecordInfo));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got record set of size %d\n", handle->rd_set_count);
+  char *albl;
+  size_t index;
+  json_t *value;
+  json_array_foreach (data_js, index, value) {
+    {
+      struct GNUNET_GNSRECORD_Data *rd;
+      struct GNUNET_JSON_Specification gnsspec[] =
+      { GNUNET_GNSRECORD_JSON_spec_gnsrecord (&rd,
+                                              &handle->ri[index].a_rd_count,
+                                              &albl),
+        GNUNET_JSON_spec_end () };
+      if (GNUNET_OK != GNUNET_JSON_parse (value, gnsspec, NULL, NULL))
+      {
+        handle->ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID;
+        GNUNET_SCHEDULER_add_now (&do_error, handle);
+        json_decref (data_js);
+        return;
+      }
+      handle->ri[index].a_rd = rd;
+      handle->ri[index].a_label = albl;
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Parsed record set for name %s\n",
+                  handle->ri[index].a_label);
+    }
+  }
+  // json_decref (data_js);
+
+  unsigned int sent_rds = 0;
+  // Find the smallest set of records we can send with our message size
+  // restriction of 16 bit
+  handle->ns_qe = GNUNET_NAMESTORE_records_store2 (handle->nc,
+                                                   handle->zone_pkey,
+                                                   handle->rd_set_count,
+                                                   handle->ri,
+                                                   &sent_rds,
+                                                   &import_next_cb,
+                                                   handle);
+  if ((NULL == handle->ns_qe) && (0 == sent_rds))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->rd_set_pos += sent_rds;
+}
+
+
+/**
+ * Handle namestore POST import
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_import (struct GNUNET_REST_RequestHandle *con_handle,
+                  const char *url,
+                  void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *egoname;
+
+  // set zone to name if given
+  if (strlen (GNUNET_REST_API_NS_NAMESTORE_IMPORT) + 1 >= strlen (
+        handle->url))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  ego_entry = NULL;
+
+  egoname = &handle->url[strlen (GNUNET_REST_API_NS_NAMESTORE_IMPORT) + 1];
+  ego_entry = get_egoentry_namestore (handle, egoname);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->zone_pkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+
+  // We need a per-client connection for a transactional bulk import
+  handle->nc = GNUNET_NAMESTORE_connect (ns_cfg);
+  if (NULL == handle->nc)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->ns_qe = GNUNET_NAMESTORE_transaction_begin (handle->nc,
+                                                      &bulk_tx_start,
+                                                      handle);
+}
+
+
+/**
+ * Handle namestore POST/PUT request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_add_or_update (struct GNUNET_REST_RequestHandle *con_handle,
+                         const char *url,
+                         void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *egoname;
+  json_t *data_js;
+  json_error_t err;
+
+  char term_data[handle->rest_handle->data_size + 1];
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_NO_RECORDS_GIVEN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_js = json_loads (term_data, JSON_DECODE_ANY, &err);
+  struct GNUNET_JSON_Specification gnsspec[] =
+  { GNUNET_GNSRECORD_JSON_spec_gnsrecord (&handle->rd, &handle->rd_count,
+                                          &handle->record_name),
+    GNUNET_JSON_spec_end () };
+  if (GNUNET_OK != GNUNET_JSON_parse (data_js, gnsspec, NULL, NULL))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  GNUNET_JSON_parse_free (gnsspec);
+  if (0 >= strlen (handle->record_name))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_RECORD_DATA_INVALID;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    json_decref (data_js);
+    return;
+  }
+  json_decref (data_js);
+
+  egoname = NULL;
+  ego_entry = NULL;
+
+  // set zone to name if given
+  if (strlen (GNUNET_REST_API_NS_NAMESTORE) + 1 >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  egoname = &handle->url[strlen (GNUNET_REST_API_NS_NAMESTORE) + 1];
+  ego_entry = get_egoentry_namestore (handle, egoname);
+
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->zone_pkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  handle->ns_qe = GNUNET_NAMESTORE_records_lookup (ns_handle,
+                                                   handle->zone_pkey,
+                                                   handle->record_name,
+                                                   &ns_lookup_error_cb,
+                                                   handle,
+                                                   &ns_lookup_cb,
+                                                   handle);
+  if (NULL == handle->ns_qe)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+}
+
+
+/**
+ * Handle namestore PUT request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_update (struct GNUNET_REST_RequestHandle *con_handle,
+                  const char *url,
+                  void *cls)
+{
+  struct RequestHandle *handle = cls;
+  handle->update_strategy = UPDATE_STRATEGY_REPLACE;
+  namestore_add_or_update (con_handle, url, cls);
+}
+
+
+/**
+ * Handle namestore POST request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_add (struct GNUNET_REST_RequestHandle *con_handle,
+               const char *url,
+               void *cls)
+{
+  struct RequestHandle *handle = cls;
+  handle->update_strategy = UPDATE_STRATEGY_APPEND;
+  namestore_add_or_update (con_handle, url, cls);
+}
+
+
+/**
+ * Handle namestore DELETE request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+void
+namestore_delete (struct GNUNET_REST_RequestHandle *con_handle,
+                  const char *url,
+                  void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *egoname;
+  char *labelname;
+
+  egoname = NULL;
+  ego_entry = NULL;
+
+  // set zone to name if given
+  if (strlen (GNUNET_REST_API_NS_NAMESTORE) + 1 >= strlen (handle->url))
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  egoname = &handle->url[strlen (GNUNET_REST_API_NS_NAMESTORE) + 1];
+  ego_entry = get_egoentry_namestore (handle, egoname);
+  if (NULL == ego_entry)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->zone_pkey = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  labelname = &egoname[strlen (ego_entry->identifier)];
+  // set zone to name if given
+  if (1 >= strlen (labelname))
+  {
+    /* label is only "/" */
+    handle->ec = GNUNET_EC_NAMESTORE_NO_LABEL_GIVEN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+  }
+
+  handle->record_name = GNUNET_strdup (labelname + 1);
+  handle->ns_qe = GNUNET_NAMESTORE_records_store (ns_handle,
+                                                  handle->zone_pkey,
+                                                  handle->record_name,
+                                                  0,
+                                                  NULL,
+                                                  &del_finished,
+                                                  handle);
+  if (NULL == handle->ns_qe)
+  {
+    handle->ec = GNUNET_EC_NAMESTORE_UNKNOWN;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_YES ==
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+  return;
+}
+
+
+static void
+list_ego (void *cls,
+          struct GNUNET_IDENTITY_Ego *ego,
+          void **ctx,
+          const char *identifier)
+{
+  struct EgoEntry *ego_entry;
+  struct GNUNET_CRYPTO_PublicKey pk;
+
+  if ((NULL == ego) && (ID_REST_STATE_INIT == state))
+  {
+    state = ID_REST_STATE_POST_INIT;
+    return;
+  }
+  if (NULL == ego)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Called with NULL ego\n");
+    return;
+  }
+  if (ID_REST_STATE_INIT == state)
+  {
+    ego_entry = GNUNET_new (struct EgoEntry);
+    GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+    ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+    ego_entry->ego = ego;
+    ego_entry->identifier = GNUNET_strdup (identifier);
+    GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                      ego_tail,
+                                      ego_entry);
+  }
+  /* Ego renamed or added */
+  if (identifier != NULL)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+      {
+        /* Rename */
+        GNUNET_free (ego_entry->identifier);
+        ego_entry->identifier = GNUNET_strdup (identifier);
+        break;
+      }
+    }
+    if (NULL == ego_entry)
+    {
+      /* Add */
+      ego_entry = GNUNET_new (struct EgoEntry);
+      GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+      ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+      ego_entry->ego = ego;
+      ego_entry->identifier = GNUNET_strdup (identifier);
+      GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                        ego_tail,
+                                        ego_entry);
+    }
+  }
+  else
+  {
+    /* Delete */
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+        break;
+    }
+    if (NULL == ego_entry)
+      return;   /* Not found */
+
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 ego_entry);
+    GNUNET_free (ego_entry->identifier);
+    GNUNET_free (ego_entry->keystring);
+    GNUNET_free (ego_entry);
+    return;
+  }
+
+}
+
+
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for callback function
+ * @return GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_namestore_process_request (void *plugin,
+                                struct GNUNET_REST_RequestHandle *rest_handle,
+                                GNUNET_REST_ResultProcessor proc,
+                                void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] =
+  { { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_NAMESTORE, &namestore_get },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_NAMESTORE_IMPORT,
+      &namestore_import },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_NAMESTORE, &namestore_add },
+    { MHD_HTTP_METHOD_PUT, GNUNET_REST_API_NS_NAMESTORE, &namestore_update },
+    { MHD_HTTP_METHOD_DELETE, GNUNET_REST_API_NS_NAMESTORE,
+      &namestore_delete },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_NAMESTORE, &options_cont },
+    GNUNET_REST_HANDLER_END };
+
+  handle->ec = GNUNET_EC_NONE;
+  handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+  handle->zone_pkey = NULL;
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_error, handle);
+  handle->url = GNUNET_strdup (rest_handle->url);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connecting...\n");
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err,
+                                  handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connected\n");
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls Config info
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+REST_namestore_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  ns_cfg = c;
+  if (NULL != plugin.cfg)
+    return NULL;   /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = c;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_NAMESTORE;
+  state = ID_REST_STATE_INIT;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s, %s, %s, %s",
+                   MHD_HTTP_METHOD_GET,
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_PUT,
+                   MHD_HTTP_METHOD_DELETE,
+                   MHD_HTTP_METHOD_OPTIONS);
+  ns_handle = GNUNET_NAMESTORE_connect (ns_cfg);
+  identity_handle = GNUNET_IDENTITY_connect (ns_cfg, &list_ego, NULL);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, _ (
+                "Namestore REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_namestore_done (struct GNUNET_REST_Plugin *api)
+{
+  struct Plugin *plugin = api->cls;
+  struct RequestHandle *request;
+  struct EgoEntry *ego_entry;
+  struct EgoEntry *ego_tmp;
+
+  plugin->cfg = NULL;
+  while (NULL != (request = requests_head))
+    do_error (request);
+  if (NULL != identity_handle)
+    GNUNET_IDENTITY_disconnect (identity_handle);
+  if (NULL != ns_handle)
+    GNUNET_NAMESTORE_disconnect (ns_handle);
+
+  for (ego_entry = ego_head; NULL != ego_entry;)
+  {
+    ego_tmp = ego_entry;
+    ego_entry = ego_entry->next;
+    GNUNET_free (ego_tmp->identifier);
+    GNUNET_free (ego_tmp->keystring);
+    GNUNET_free (ego_tmp);
+  }
+
+  GNUNET_free (allow_methods);
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Namestore REST plugin is finished\n");
+}
+
+
+/* end of plugin_rest_namestore.c */
diff --git a/src/service/rest/namestore_plugin.h b/src/service/rest/namestore_plugin.h
new file mode 100644
index 000000000..2bdf77546
--- /dev/null
+++ b/src/service/rest/namestore_plugin.h
@@ -0,0 +1,37 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_namestore_process_request (void *plugin,
+                                struct GNUNET_REST_RequestHandle *
+                                conndata_handle,
+                                GNUNET_REST_ResultProcessor proc,
+                                void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_namestore_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_namestore_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/rest/oidc_helper.c b/src/service/rest/oidc_helper.c
new file mode 100644
index 000000000..a2da7312b
--- /dev/null
+++ b/src/service/rest/oidc_helper.c
@@ -0,0 +1,1026 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2010-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim/oidc_helper.c
+ * @brief helper library for OIDC related functions
+ * @author Martin Schanzenbach
+ * @author Tristan Schwieren
+ */
+#include "platform.h"
+#include <inttypes.h>
+#include <jansson.h>
+#include <jose/jose.h>
+#include "gnunet_util_lib.h"
+#include "gnunet_reclaim_lib.h"
+#include "gnunet_reclaim_service.h"
+#include "gnunet_signatures.h"
+#include "oidc_helper.h"
+// #include "benchmark.h"
+#include <gcrypt.h>
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * The signature used to generate the authorization code
+ */
+struct OIDC_Parameters
+{
+  /**
+   * The reclaim ticket
+   */
+  struct GNUNET_RECLAIM_Ticket ticket;
+
+  /**
+   * The nonce length
+   */
+  uint32_t nonce_len GNUNET_PACKED;
+
+  /**
+   * The length of the PKCE code_challenge
+   */
+  uint32_t code_challenge_len GNUNET_PACKED;
+
+  /**
+   * The length of the attributes list
+   */
+  uint32_t attr_list_len GNUNET_PACKED;
+
+  /**
+   * The length of the presentation list
+   */
+  uint32_t pres_list_len GNUNET_PACKED;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+/**
+ * Standard claims represented by the "profile" scope in OIDC
+ */
+static char OIDC_profile_claims[14][32] = {
+  "name", "family_name", "given_name", "middle_name", "nickname",
+  "preferred_username", "profile", "picture", "website", "gender", "birthdate",
+  "zoneinfo", "locale", "updated_at"
+};
+
+/**
+ * Standard claims represented by the "email" scope in OIDC
+ */
+static char OIDC_email_claims[2][16] = {
+  "email", "email_verified"
+};
+
+/**
+ * Standard claims represented by the "phone" scope in OIDC
+ */
+static char OIDC_phone_claims[2][32] = {
+  "phone_number", "phone_number_verified"
+};
+
+/**
+ * Standard claims represented by the "address" scope in OIDC
+ */
+static char OIDC_address_claims[5][32] = {
+  "street_address", "locality", "region", "postal_code", "country"
+};
+
+static enum GNUNET_GenericReturnValue
+is_claim_in_address_scope (const char *claim)
+{
+  int i;
+  for (i = 0; i < 5; i++)
+  {
+    if (0 == strcmp (claim, OIDC_address_claims[i]))
+    {
+      return GNUNET_YES;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+static char *
+create_jwt_hmac_header (void)
+{
+  json_t *root;
+  char *json_str;
+
+  root = json_object ();
+  json_object_set_new (root, JWT_ALG, json_string (JWT_ALG_VALUE_HMAC));
+  json_object_set_new (root, JWT_TYP, json_string (JWT_TYP_VALUE));
+
+  json_str = json_dumps (root, JSON_INDENT (0) | JSON_COMPACT);
+  json_decref (root);
+  return json_str;
+}
+
+
+static void
+replace_char (char *str, char find, char replace)
+{
+  char *current_pos = strchr (str, find);
+
+  while (current_pos)
+  {
+    *current_pos = replace;
+    current_pos = strchr (current_pos, find);
+  }
+}
+
+
+// RFC4648
+static void
+fix_base64 (char *str)
+{
+  // Replace + with -
+  replace_char (str, '+', '-');
+
+  // Replace / with _
+  replace_char (str, '/', '_');
+}
+
+
+static json_t*
+generate_userinfo_json (const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                        const struct GNUNET_RECLAIM_AttributeList *attrs,
+                        const struct
+                        GNUNET_RECLAIM_PresentationList *presentations)
+{
+  struct GNUNET_RECLAIM_AttributeListEntry *le;
+  struct GNUNET_RECLAIM_PresentationListEntry *ple;
+  char *subject;
+  char *source_name;
+  char *attr_val_str;
+  char *pres_val_str;
+  json_t *body;
+  json_t *aggr_names;
+  json_t *aggr_sources;
+  json_t *aggr_sources_jwt;
+  json_t *addr_claim = NULL;
+  int num_presentations = 0;
+  for (le = attrs->list_head; NULL != le; le = le->next)
+  {
+    if (GNUNET_NO == GNUNET_RECLAIM_id_is_zero (&le->attribute->credential))
+      num_presentations++;
+  }
+
+  subject =
+    GNUNET_STRINGS_data_to_string_alloc (sub_key,
+                                         sizeof(struct
+                                                GNUNET_CRYPTO_PublicKey));
+  body = json_object ();
+  aggr_names = json_object ();
+  aggr_sources = json_object ();
+
+  // iss REQUIRED case sensitive server uri with https
+  // The issuer is the local reclaim instance (e.g.
+  // https://reclaim.id/api/openid)
+  json_object_set_new (body, "iss", json_string (SERVER_ADDRESS));
+  // sub REQUIRED public key identity, not exceed 255 ASCII  length
+  json_object_set_new (body, "sub", json_string (subject));
+  GNUNET_free (subject);
+  pres_val_str = NULL;
+  source_name = NULL;
+  int i = 0;
+  for (ple = presentations->list_head; NULL != ple; ple = ple->next)
+  {
+    // New presentation
+    GNUNET_asprintf (&source_name,
+                     "src%d",
+                     i);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Adding new presentation source #%d\n", i);
+    aggr_sources_jwt = json_object ();
+    pres_val_str =
+      GNUNET_RECLAIM_presentation_value_to_string (ple->presentation->type,
+                                                   ple->presentation->data,
+                                                   ple->presentation->data_size);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Presentation is: %s\n", pres_val_str);
+    json_object_set_new (aggr_sources_jwt,
+                         GNUNET_RECLAIM_presentation_number_to_typename (
+                           ple->presentation->type),
+                         json_string (pres_val_str) );
+    json_object_set_new (aggr_sources, source_name, aggr_sources_jwt);
+    GNUNET_free (pres_val_str);
+    GNUNET_free (source_name);
+    source_name = NULL;
+    i++;
+  }
+
+  int addr_is_aggregated = GNUNET_NO;
+  int addr_is_normal = GNUNET_NO;
+  for (le = attrs->list_head; NULL != le; le = le->next)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Processing %s for userinfo body\n",
+                le->attribute->name);
+    if (GNUNET_YES == GNUNET_RECLAIM_id_is_zero (&le->attribute->credential))
+    {
+      attr_val_str =
+        GNUNET_RECLAIM_attribute_value_to_string (le->attribute->type,
+                                                  le->attribute->data,
+                                                  le->attribute->data_size);
+      /**
+       * There is this weird quirk that the individual address claim(s) must be
+       * inside a JSON object of the "address" claim.
+       */
+      if (GNUNET_YES == is_claim_in_address_scope (le->attribute->name))
+      {
+        if (GNUNET_YES == addr_is_aggregated)
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                      "Address is set as aggregated claim. Skipping self-issued value...\n");
+          GNUNET_free (attr_val_str);
+          continue;
+        }
+        addr_is_normal = GNUNET_YES;
+
+        if (NULL == addr_claim)
+        {
+          addr_claim = json_object ();
+          json_object_set_new (body, "address", addr_claim);
+        }
+        json_object_set_new (addr_claim, le->attribute->name,
+                             json_string (attr_val_str));
+
+      }
+      else
+      {
+        json_object_set_new (body, le->attribute->name,
+                             json_string (attr_val_str));
+      }
+      GNUNET_free (attr_val_str);
+    }
+    else
+    {
+      // Check if presentation is there
+      int j = 0;
+      for (ple = presentations->list_head; NULL != ple; ple = ple->next)
+      {
+        if (GNUNET_YES ==
+            GNUNET_RECLAIM_id_is_equal (&ple->presentation->credential_id,
+                                        &le->attribute->credential))
+          break;
+        j++;
+      }
+      if (NULL == ple)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Presentation for `%s' missing...\n",
+                    le->attribute->name);
+        continue;
+      }
+      /**
+       * There is this weird quirk that the individual address claim(s) must be
+       * inside a JSON object of the "address" claim.
+       */
+      if (GNUNET_YES == is_claim_in_address_scope (le->attribute->name))
+      {
+        if (GNUNET_YES == addr_is_normal)
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                      "Address is already set as normal claim. Skipping attested value...\n");
+          continue;
+        }
+        addr_is_aggregated = GNUNET_YES;
+        /** This is/can only be set once! **/
+        if (NULL != addr_claim)
+          continue;
+        addr_claim = json_object ();
+        GNUNET_asprintf (&source_name,
+                         "src%d",
+                         j);
+        json_object_set_new (aggr_names, "address",
+                             json_string (source_name));
+        GNUNET_free (source_name);
+      }
+      else
+      {
+        // Presentation exists, hence take the respective source str
+        GNUNET_asprintf (&source_name,
+                         "src%d",
+                         j);
+        json_object_set_new (aggr_names, le->attribute->name,
+                             json_string (source_name));
+        GNUNET_free (source_name);
+      }
+    }
+  }
+  if (0 != i)
+  {
+    json_object_set_new (body, "_claim_names", aggr_names);
+    json_object_set_new (body, "_claim_sources", aggr_sources);
+  }
+
+  return body;
+}
+
+
+/**
+ * Generate userinfo JSON as string
+ *
+ * @param sub_key the subject (user)
+ * @param attrs user attribute list
+ * @param presentations credential presentation list (may be empty)
+ * @return Userinfo JSON
+ */
+char *
+OIDC_generate_userinfo (const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                        const struct GNUNET_RECLAIM_AttributeList *attrs,
+                        const struct
+                        GNUNET_RECLAIM_PresentationList *presentations)
+{
+  char *body_str;
+  json_t*body = generate_userinfo_json (sub_key,
+                                        attrs,
+                                        presentations);
+  body_str = json_dumps (body, JSON_INDENT (0) | JSON_COMPACT);
+  json_decref (body);
+  return body_str;
+}
+
+
+char *
+generate_id_token_body (const struct GNUNET_CRYPTO_PublicKey *aud_key,
+                        const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                        const struct GNUNET_RECLAIM_AttributeList *attrs,
+                        const struct
+                        GNUNET_RECLAIM_PresentationList *presentations,
+                        const struct GNUNET_TIME_Relative *expiration_time,
+                        const char *nonce)
+{
+  struct GNUNET_TIME_Absolute exp_time;
+  struct GNUNET_TIME_Absolute time_now;
+  json_t *body;
+  char *audience;
+  char *subject;
+  char *body_str;
+
+  body = generate_userinfo_json (sub_key,
+                                 attrs,
+                                 presentations);
+  // iat REQUIRED time now
+  time_now = GNUNET_TIME_absolute_get ();
+  // exp REQUIRED time expired from config
+  exp_time = GNUNET_TIME_absolute_add (time_now, *expiration_time);
+  // auth_time only if max_age
+  // nonce only if nonce
+  // OPTIONAL acr,amr,azp
+  subject =
+    GNUNET_STRINGS_data_to_string_alloc (sub_key,
+                                         sizeof(struct
+                                                GNUNET_CRYPTO_PublicKey));
+  audience =
+    GNUNET_STRINGS_data_to_string_alloc (aud_key,
+                                         sizeof(struct
+                                                GNUNET_CRYPTO_PublicKey));
+
+  // aud REQUIRED public key client_id must be there
+  json_object_set_new (body, "aud", json_string (audience));
+  // iat
+  json_object_set_new (body,
+                       "iat",
+                       json_integer (time_now.abs_value_us / (1000 * 1000)));
+  // exp
+  json_object_set_new (body,
+                       "exp",
+                       json_integer (exp_time.abs_value_us / (1000 * 1000)));
+  // nbf
+  json_object_set_new (body,
+                       "nbf",
+                       json_integer (time_now.abs_value_us / (1000 * 1000)));
+  // nonce
+  if (NULL != nonce)
+    json_object_set_new (body, "nonce", json_string (nonce));
+
+  // Error checking
+  body_str = json_dumps (body, JSON_INDENT (2) | JSON_COMPACT);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"ID-Token: %s\n", body_str);
+
+  json_decref (body);
+  GNUNET_free (subject);
+  GNUNET_free (audience);
+
+  return body_str;
+}
+
+
+char *
+OIDC_generate_id_token_rsa (const struct GNUNET_CRYPTO_PublicKey *aud_key,
+                            const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                            const struct GNUNET_RECLAIM_AttributeList *attrs,
+                            const struct
+                            GNUNET_RECLAIM_PresentationList *presentations,
+                            const struct GNUNET_TIME_Relative *expiration_time,
+                            const char *nonce,
+                            const json_t *secret_rsa_key)
+{
+  json_t *jws;
+  char *body_str;
+  char *result;
+
+  // Generate the body of the JSON Web Signature
+  body_str = generate_id_token_body (aud_key,
+                                     sub_key,
+                                     attrs,
+                                     presentations,
+                                     expiration_time,
+                                     nonce);
+
+  if (NULL == body_str)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Body for the JWS could not be generated\n");
+    return NULL;
+  }
+
+  // Creating the JSON Web Signature.
+  jws = json_pack ("{s:o}", "payload",
+                   jose_b64_enc (body_str, strlen (body_str)));
+  GNUNET_free (body_str);
+
+  if (! jose_jws_sig (NULL, jws, NULL, secret_rsa_key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Signature generation failed\n");
+    return NULL;
+  }
+
+  // Encoding JSON as compact JSON Web Signature
+  GNUNET_asprintf (&result, "%s.%s.%s",
+                   json_string_value (json_object_get (jws, "protected")),
+                   json_string_value (json_object_get (jws, "payload")),
+                   json_string_value (json_object_get (jws, "signature")) );
+
+  json_decref (jws);
+  return result;
+}
+
+/**
+ * Create a JWT using HMAC (HS256) from attributes
+ *
+ * @param aud_key the public of the audience
+ * @param sub_key the public key of the subject
+ * @param attrs the attribute list
+ * @param presentations credential presentation list (may be empty)
+ * @param expiration_time the validity of the token
+ * @param secret_key the key used to sign the JWT
+ * @return a new base64-encoded JWT string.
+ */
+char *
+OIDC_generate_id_token_hmac (const struct GNUNET_CRYPTO_PublicKey *aud_key,
+                             const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                             const struct GNUNET_RECLAIM_AttributeList *attrs,
+                             const struct
+                             GNUNET_RECLAIM_PresentationList *presentations,
+                             const struct GNUNET_TIME_Relative *expiration_time,
+                             const char *nonce,
+                             const char *secret_key)
+{
+  struct GNUNET_HashCode signature;
+  char *header;
+  char *header_base64;
+  char *body_str;
+  char *body_base64;
+  char *signature_target;
+  char *signature_base64;
+  char *result;
+
+  // Generate and encode Header
+  header = create_jwt_hmac_header ();
+  if (NULL == header)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Header for the JWS could not be generated\n");
+    return NULL;
+  }
+  GNUNET_STRINGS_base64url_encode (header, strlen (header), &header_base64);
+  GNUNET_free (header);
+  fix_base64 (header_base64);
+
+  // Generate and encode the body of the JSON Web Signature
+  body_str = generate_id_token_body (aud_key,
+                                     sub_key,
+                                     attrs,
+                                     presentations,
+                                     expiration_time,
+                                     nonce);
+
+  if (NULL == body_str)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Body for the JWS could not be generated\n");
+    GNUNET_free (header_base64);
+    return NULL;
+  }
+
+  GNUNET_STRINGS_base64url_encode (body_str, strlen (body_str), &body_base64);
+  fix_base64 (body_base64);
+
+  /**
+   * Creating the JWT signature. This might not be
+   * standards compliant, check.
+   */
+  GNUNET_asprintf (&signature_target, "%s.%s", header_base64, body_base64);
+  GNUNET_CRYPTO_hmac_raw (secret_key,
+                          strlen (secret_key),
+                          signature_target,
+                          strlen (signature_target),
+                          &signature);
+  GNUNET_STRINGS_base64url_encode ((const char *) &signature,
+                                   sizeof(struct GNUNET_HashCode),
+                                   &signature_base64);
+  fix_base64 (signature_base64);
+
+  GNUNET_asprintf (&result,
+                   "%s.%s.%s",
+                   header_base64,
+                   body_base64,
+                   signature_base64);
+
+  GNUNET_free (header_base64);
+  GNUNET_free (body_str);
+  GNUNET_free (body_base64);
+  GNUNET_free (signature_target);
+  GNUNET_free (signature_base64);
+  return result;
+}
+
+
+/**
+ * Builds an OIDC authorization code including
+ * a reclaim ticket and nonce
+ *
+ * @param issuer the issuer of the ticket, used to sign the ticket and nonce
+ * @param ticket the ticket to include in the code
+ * @param attrs list of attributes which are shared
+ * @param presentations credential presentation list (may be empty)
+ * @param nonce the nonce to include in the code
+ * @param code_challenge PKCE code challenge
+ * @return a new authorization code (caller must free)
+ */
+char *
+OIDC_build_authz_code (const struct GNUNET_CRYPTO_PrivateKey *issuer,
+                       const struct GNUNET_RECLAIM_Ticket *ticket,
+                       const struct GNUNET_RECLAIM_AttributeList *attrs,
+                       const struct
+                       GNUNET_RECLAIM_PresentationList *presentations,
+                       const char *nonce_str,
+                       const char *code_challenge)
+{
+  struct OIDC_Parameters params;
+  char *code_payload;
+  char *payload;
+  char *tmp;
+  char *code_str;
+  char *buf_ptr = NULL;
+  size_t payload_len;
+  size_t code_payload_len;
+  size_t attr_list_len = 0;
+  size_t pres_list_len = 0;
+  size_t code_challenge_len = 0;
+  uint32_t nonce_len = 0;
+  struct GNUNET_CRYPTO_EccSignaturePurpose *purpose;
+
+  /** PLAINTEXT **/
+  // Assign ticket
+  memset (&params, 0, sizeof(params));
+  params.ticket = *ticket;
+  // Assign nonce
+  payload_len = sizeof(struct OIDC_Parameters);
+  if ((NULL != nonce_str) && (strcmp ("", nonce_str) != 0))
+  {
+    nonce_len = strlen (nonce_str);
+    payload_len += nonce_len;
+  }
+  params.nonce_len = htonl (nonce_len);
+  // Assign code challenge
+  if (NULL != code_challenge)
+    code_challenge_len = strlen (code_challenge);
+  payload_len += code_challenge_len;
+  params.code_challenge_len = htonl (code_challenge_len);
+  // Assign attributes
+  if (NULL != attrs)
+  {
+    // Get length
+    attr_list_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
+    params.attr_list_len = htonl (attr_list_len);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Length of serialized attributes: %lu\n",
+                attr_list_len);
+    // Get serialized attributes
+    payload_len += attr_list_len;
+  }
+  if (NULL != presentations)
+  {
+    // Get length
+    // FIXME only add presentations relevant for attribute list!!!
+    // This is important because of the distinction between id_token and
+    // userinfo in OIDC
+    pres_list_len =
+      GNUNET_RECLAIM_presentation_list_serialize_get_size (presentations);
+    params.pres_list_len = htonl (pres_list_len);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Length of serialized presentations: %lu\n",
+                pres_list_len);
+    // Get serialized attributes
+    payload_len += pres_list_len;
+  }
+
+  // Get plaintext length
+  payload = GNUNET_malloc (payload_len);
+  memcpy (payload, &params, sizeof(params));
+  tmp = payload + sizeof(params);
+  if (0 < code_challenge_len)
+  {
+    memcpy (tmp, code_challenge, code_challenge_len);
+    tmp += code_challenge_len;
+  }
+  if (0 < nonce_len)
+  {
+    memcpy (tmp, nonce_str, nonce_len);
+    tmp += nonce_len;
+  }
+  if (0 < attr_list_len)
+    GNUNET_RECLAIM_attribute_list_serialize (attrs, tmp);
+  tmp += attr_list_len;
+  if (0 < pres_list_len)
+    GNUNET_RECLAIM_presentation_list_serialize (presentations, tmp);
+  tmp += pres_list_len;
+
+  /** END **/
+
+  // Get length
+  code_payload_len = sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                     + payload_len + sizeof(struct
+                                            GNUNET_CRYPTO_Signature);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Length of data to encode: %lu\n",
+              code_payload_len);
+
+  // Initialize code payload
+  code_payload = GNUNET_malloc (code_payload_len);
+  GNUNET_assert (NULL != code_payload);
+  purpose = (struct GNUNET_CRYPTO_EccSignaturePurpose *) code_payload;
+  purpose->size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                         + payload_len);
+  purpose->purpose = htonl (GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN);
+  // Store pubkey
+  buf_ptr = (char *) &purpose[1];
+  memcpy (buf_ptr, payload, payload_len);
+  GNUNET_free (payload);
+  buf_ptr += payload_len;
+  // Sign and store signature
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_sign_ (issuer,
+                             purpose,
+                             (struct GNUNET_CRYPTO_Signature *)
+                             buf_ptr))
+  {
+    GNUNET_break (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Unable to sign code\n");
+    GNUNET_free (code_payload);
+    return NULL;
+  }
+  GNUNET_STRINGS_base64url_encode (code_payload, code_payload_len, &code_str);
+  GNUNET_free (code_payload);
+  return code_str;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_code_challenge (const char *code_challenge,
+                      uint32_t code_challenge_len,
+                      const char *code_verifier)
+{
+  char *code_verifier_hash;
+  char *expected_code_challenge;
+
+  if (0 == code_challenge_len) /* Only check if this code requires a CV */
+    return GNUNET_OK;
+  if (NULL == code_verifier)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected code verifier!\n");
+    return GNUNET_SYSERR;
+  }
+  code_verifier_hash = GNUNET_malloc (256 / 8);
+  // hash code verifier
+  gcry_md_hash_buffer (GCRY_MD_SHA256,
+                       code_verifier_hash,
+                       code_verifier,
+                       strlen (code_verifier));
+  // encode code verifier
+  GNUNET_STRINGS_base64url_encode (code_verifier_hash, 256 / 8,
+                                   &expected_code_challenge);
+  GNUNET_free (code_verifier_hash);
+  if (0 !=
+      strncmp (expected_code_challenge, code_challenge, code_challenge_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Invalid code verifier! Expected: %s, Got: %.*s\n",
+                expected_code_challenge,
+                code_challenge_len,
+                code_challenge);
+    GNUNET_free (expected_code_challenge);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_free (expected_code_challenge);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse reclaim ticket and nonce from
+ * authorization code.
+ * This also verifies the signature in the code.
+ *
+ * @param audience the expected audience of the code
+ * @param code the string representation of the code
+ * @param code_verfier PKCE code verifier. Optional, must be provided
+ *                     if used in request.
+ * @param ticket where to store the ticket
+ * @param attrs the attributes in the code
+ * @param presentations credential presentation list
+ * @param nonce_str where to store the nonce (if contained)
+ * @return GNUNET_OK if successful, else GNUNET_SYSERR
+ */
+int
+OIDC_parse_authz_code (const struct GNUNET_CRYPTO_PublicKey *audience,
+                       const char *code,
+                       const char *code_verifier,
+                       struct GNUNET_RECLAIM_Ticket *ticket,
+                       struct GNUNET_RECLAIM_AttributeList **attrs,
+                       struct GNUNET_RECLAIM_PresentationList **presentations,
+                       char **nonce_str,
+                       enum OIDC_VerificationOptions opts)
+{
+  char *code_payload;
+  char *ptr;
+  char *plaintext;
+  char *attrs_ser;
+  char *presentations_ser;
+  char *code_challenge;
+  struct GNUNET_CRYPTO_EccSignaturePurpose *purpose;
+  struct GNUNET_CRYPTO_Signature *signature;
+  uint32_t code_challenge_len;
+  uint32_t attrs_ser_len;
+  uint32_t pres_ser_len;
+  size_t plaintext_len;
+  size_t code_payload_len;
+  uint32_t nonce_len = 0;
+  struct OIDC_Parameters *params;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Trying to decode `%s'\n", code);
+  code_payload = NULL;
+  code_payload_len =
+    GNUNET_STRINGS_base64url_decode (code, strlen (code),
+                                     (void **) &code_payload);
+  if (code_payload_len < sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+      + sizeof(struct OIDC_Parameters)
+      + sizeof(struct GNUNET_CRYPTO_Signature))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Authorization code malformed\n");
+    GNUNET_free (code_payload);
+    return GNUNET_SYSERR;
+  }
+
+  purpose = (struct GNUNET_CRYPTO_EccSignaturePurpose *) code_payload;
+  plaintext_len = code_payload_len;
+  plaintext_len -= sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose);
+  ptr = (char *) &purpose[1];
+  plaintext_len -= sizeof(struct GNUNET_CRYPTO_Signature);
+  plaintext = ptr;
+  ptr += plaintext_len;
+  signature = (struct GNUNET_CRYPTO_Signature *) ptr;
+  params = (struct OIDC_Parameters *) plaintext;
+
+  // cmp code_challenge code_verifier
+  code_challenge_len = ntohl (params->code_challenge_len);
+  code_challenge = ((char *) &params[1]);
+  if (! (opts & OIDC_VERIFICATION_NO_CODE_VERIFIER))
+  {
+    if (GNUNET_OK != check_code_challenge (code_challenge,
+                                           code_challenge_len,
+                                           code_verifier))
+    {
+      GNUNET_free (code_payload);
+      return GNUNET_SYSERR;
+    }
+  }
+  nonce_len = ntohl (params->nonce_len);
+  if (0 != nonce_len)
+  {
+    *nonce_str = GNUNET_strndup (code_challenge + code_challenge_len,
+                                 nonce_len);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Got nonce: %s\n", *nonce_str);
+  }
+
+  // Ticket
+  memcpy (ticket, &params->ticket, sizeof(params->ticket));
+  // Signature
+  // GNUNET_CRYPTO_ecdsa_key_get_public (ecdsa_priv, &ecdsa_pub);
+  if (0 != GNUNET_memcmp (audience, &ticket->audience))
+  {
+    GNUNET_free (code_payload);
+    if (NULL != *nonce_str)
+      GNUNET_free (*nonce_str);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Audience in ticket does not match client!\n");
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_signature_verify_ (
+        GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN,
+        purpose,
+        signature,
+        &(ticket->identity)))
+  {
+    GNUNET_free (code_payload);
+    if (NULL != *nonce_str)
+      GNUNET_free (*nonce_str);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Signature of AuthZ code invalid!\n");
+    return GNUNET_SYSERR;
+  }
+  // Attributes
+  attrs_ser = ((char *) &params[1]) + code_challenge_len + nonce_len;
+  attrs_ser_len = ntohl (params->attr_list_len);
+  *attrs = GNUNET_RECLAIM_attribute_list_deserialize (attrs_ser, attrs_ser_len);
+  presentations_ser = ((char*) attrs_ser) + attrs_ser_len;
+  pres_ser_len = ntohl (params->pres_list_len);
+  *presentations =
+    GNUNET_RECLAIM_presentation_list_deserialize (presentations_ser,
+                                                  pres_ser_len);
+
+  GNUNET_free (code_payload);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Build a token response for a token request
+ * TODO: Maybe we should add the scope here?
+ *
+ * @param access_token the access token to include
+ * @param id_token the id_token to include
+ * @param expiration_time the expiration time of the token(s)
+ * @param token_response where to store the response
+ */
+void
+OIDC_build_token_response (const char *access_token,
+                           const char *id_token,
+                           const struct GNUNET_TIME_Relative *expiration_time,
+                           char **token_response)
+{
+  json_t *root_json;
+
+  root_json = json_object ();
+
+  GNUNET_assert (NULL != access_token);
+  GNUNET_assert (NULL != id_token);
+  GNUNET_assert (NULL != expiration_time);
+  json_object_set_new (root_json, "access_token", json_string (access_token));
+  json_object_set_new (root_json, "token_type", json_string ("Bearer"));
+  json_object_set_new (root_json,
+                       "expires_in",
+                       json_integer (expiration_time->rel_value_us
+                                     / (1000 * 1000)));
+  json_object_set_new (root_json, "id_token", json_string (id_token));
+  *token_response = json_dumps (root_json, JSON_INDENT (0) | JSON_COMPACT);
+  json_decref (root_json);
+}
+
+
+/**
+ * Generate a new access token
+ */
+char *
+OIDC_access_token_new (const struct GNUNET_RECLAIM_Ticket *ticket)
+{
+  char *access_token;
+
+  GNUNET_STRINGS_base64_encode (ticket,
+                                sizeof(*ticket),
+                                &access_token);
+  return access_token;
+}
+
+
+/**
+ * Parse an access token
+ */
+int
+OIDC_access_token_parse (const char *token,
+                         struct GNUNET_RECLAIM_Ticket **ticket)
+{
+  size_t sret;
+  char *decoded;
+  sret = GNUNET_STRINGS_base64_decode (token,
+                                       strlen (token),
+                                       (void**) &decoded);
+  if (sizeof (struct GNUNET_RECLAIM_Ticket) != sret)
+  {
+    GNUNET_free (decoded);
+    return GNUNET_SYSERR;
+  }
+  *ticket = (struct GNUNET_RECLAIM_Ticket *) decoded;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Checks if a claim is implicitly requested through standard
+ * scope(s) or explicitly through non-standard scope.
+ *
+ * @param scopes the scopes which have been requested
+ * @param attr the attribute name to check
+ * @return GNUNET_YES if attribute is implcitly requested
+ */
+enum GNUNET_GenericReturnValue
+OIDC_check_scopes_for_claim_request (const char*scopes,
+                                     const char*attr)
+{
+  char *scope_variables;
+  char *scope_variable;
+  char delimiter[] = " ";
+  int i;
+
+  scope_variables = GNUNET_strdup (scopes);
+  scope_variable = strtok (scope_variables, delimiter);
+  while (NULL != scope_variable)
+  {
+    if (0 == strcmp ("profile", scope_variable))
+    {
+      for (i = 0; i < 14; i++)
+      {
+        if (0 == strcmp (attr, OIDC_profile_claims[i]))
+        {
+          GNUNET_free (scope_variables);
+          return GNUNET_YES;
+        }
+      }
+    }
+    else if (0 == strcmp ("address", scope_variable))
+    {
+      for (i = 0; i < 5; i++)
+      {
+        if (0 == strcmp (attr, OIDC_address_claims[i]))
+        {
+          GNUNET_free (scope_variables);
+          return GNUNET_YES;
+        }
+      }
+    }
+    else if (0 == strcmp ("email", scope_variable))
+    {
+      for (i = 0; i < 2; i++)
+      {
+        if (0 == strcmp (attr, OIDC_email_claims[i]))
+        {
+          GNUNET_free (scope_variables);
+          return GNUNET_YES;
+        }
+      }
+    }
+    else if (0 == strcmp ("phone", scope_variable))
+    {
+      for (i = 0; i < 2; i++)
+      {
+        if (0 == strcmp (attr, OIDC_phone_claims[i]))
+        {
+          GNUNET_free (scope_variables);
+          return GNUNET_YES;
+        }
+      }
+
+    }
+    else if (0 == strcmp (attr, scope_variable))
+    {
+      /** attribute matches requested scope **/
+      GNUNET_free (scope_variables);
+      return GNUNET_YES;
+    }
+    scope_variable = strtok (NULL, delimiter);
+  }
+  GNUNET_free (scope_variables);
+  return GNUNET_NO;
+
+}
diff --git a/src/service/rest/oidc_helper.h b/src/service/rest/oidc_helper.h
new file mode 100644
index 000000000..de788fbdb
--- /dev/null
+++ b/src/service/rest/oidc_helper.h
@@ -0,0 +1,196 @@
+/*
+   This file is part of GNUnet
+   Copyright (C) 2010-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file reclaim/oidc_helper.h
+ * @brief helper library for OIDC related functions
+ * @author Martin Schanzenbach
+ */
+
+#ifndef JWT_H
+#define JWT_H
+
+#define JWT_ALG "alg"
+#define JWT_TYP "typ"
+#define JWT_TYP_VALUE "jwt"
+
+#define JWT_ALG_VALUE_HMAC "HS512"
+#define JWT_ALG_VALUE_RSA "RS256"
+
+#define SERVER_ADDRESS "http://localhost:7776"
+
+enum OIDC_VerificationOptions
+{
+  /**
+   * Strict verification
+   */
+  OIDC_VERIFICATION_DEFAULT = 0,
+
+  /**
+   * Do not check code verifier even if expected
+   */
+  OIDC_VERIFICATION_NO_CODE_VERIFIER = 1
+};
+
+/**
+ * Create a JWT using RSA256 algorithm from attributes
+ *
+ * @param aud_key the public of the audience
+ * @param sub_key the public key of the subject
+ * @param attrs the attribute list
+ * @param presentations credential presentation list (may be empty)
+ * @param expiration_time the validity of the token
+ * @param secret_rsa_key the key used to sign the JWT
+ * @return a new base64-encoded JWT string.
+ */
+char *
+OIDC_generate_id_token_rsa (const struct GNUNET_CRYPTO_PublicKey *aud_key,
+                            const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                            const struct GNUNET_RECLAIM_AttributeList *attrs,
+                            const struct
+                            GNUNET_RECLAIM_PresentationList *presentations,
+                            const struct GNUNET_TIME_Relative *expiration_time,
+                            const char *nonce,
+                            const json_t *secret_rsa_key);
+
+/**
+ * Create a JWT using HMAC (HS256) from attributes
+ *
+ * @param aud_key the public of the audience
+ * @param sub_key the public key of the subject
+ * @param attrs the attribute list
+ * @param presentations credential presentation list (may be empty)
+ * @param expiration_time the validity of the token
+ * @param secret_key the key used to sign the JWT
+ * @return a new base64-encoded JWT string.
+ */
+char*
+OIDC_generate_id_token_hmac (const struct GNUNET_CRYPTO_PublicKey *aud_key,
+                             const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                             const struct GNUNET_RECLAIM_AttributeList *attrs,
+                             const struct
+                             GNUNET_RECLAIM_PresentationList *presentations,
+                             const struct GNUNET_TIME_Relative *expiration_time,
+                             const char *nonce,
+                             const char *secret_key);
+
+/**
+ * Builds an OIDC authorization code including
+ * a reclaim ticket and nonce
+ *
+ * @param issuer the issuer of the ticket, used to sign the ticket and nonce
+ * @param ticket the ticket to include in the code
+ * @param attrs list of attributes to share
+ * @param presentations credential presentation list
+ * @param nonce the nonce to include in the code
+ * @param code_challenge PKCE code challenge
+ * @param opts verification options
+ * @return a new authorization code (caller must free)
+ */
+char*
+OIDC_build_authz_code (const struct GNUNET_CRYPTO_PrivateKey *issuer,
+                       const struct GNUNET_RECLAIM_Ticket *ticket,
+                       const struct GNUNET_RECLAIM_AttributeList *attrs,
+                       const struct
+                       GNUNET_RECLAIM_PresentationList *presentations,
+                       const char *nonce,
+                       const char *code_challenge);
+
+/**
+ * Parse reclaim ticket and nonce from
+ * authorization code.
+ * This also verifies the signature in the code.
+ *
+ * @param ecdsa_priv the audience of the ticket
+ * @param code the string representation of the code
+ * @param code_verfier PKCE code verifier
+ * @param ticket where to store the ticket
+ * @param attrs the attributes found in the code
+ * @param presentations credential presentation list
+ * @param nonce where to store the nonce
+ * @return GNUNET_OK if successful, else GNUNET_SYSERR
+ */
+int
+OIDC_parse_authz_code (const struct GNUNET_CRYPTO_PublicKey *ecdsa_pub,
+                       const char *code,
+                       const char *code_verifier,
+                       struct GNUNET_RECLAIM_Ticket *ticket,
+                       struct GNUNET_RECLAIM_AttributeList **attrs,
+                       struct GNUNET_RECLAIM_PresentationList **presentations,
+                       char **nonce,
+                       enum OIDC_VerificationOptions opts);
+
+/**
+ * Build a token response for a token request
+ * TODO: Maybe we should add the scope here?
+ *
+ * @param access_token the access token to include
+ * @param id_token the id_token to include
+ * @param expiration_time the expiration time of the token(s)
+ * @param token_response where to store the response
+ */
+void
+OIDC_build_token_response (const char *access_token,
+                           const char *id_token,
+                           const struct GNUNET_TIME_Relative *expiration_time,
+                           char **token_response);
+
+/**
+ * Generate a new access token
+ */
+char*
+OIDC_access_token_new (const struct GNUNET_RECLAIM_Ticket *ticket);
+
+/**
+ * Parse an access token
+ */
+int
+OIDC_access_token_parse (const char *token,
+                         struct GNUNET_RECLAIM_Ticket **ticket);
+
+
+/**
+ * Checks if a claim is implicitly requested through standard
+ * scope(s)
+ *
+ * @param scopes the scopes which have been requested
+ * @param attr the attribute name to check
+ * @return GNUNET_YES if attribute is implcitly requested
+ */
+enum GNUNET_GenericReturnValue
+OIDC_check_scopes_for_claim_request (const char *scopes,
+                                     const char *attr);
+
+
+/**
+ * Generate userinfo JSON as string
+ *
+ * @param sub_key the subject (user)
+ * @param attrs user attribute list
+ * @param presentations credential presentation list
+ * @return Userinfo JSON
+ */
+char *
+OIDC_generate_userinfo (const struct GNUNET_CRYPTO_PublicKey *sub_key,
+                        const struct GNUNET_RECLAIM_AttributeList *attrs,
+                        const struct
+                        GNUNET_RECLAIM_PresentationList *presentations);
+
+#endif
diff --git a/src/service/rest/openid_plugin.c b/src/service/rest/openid_plugin.c
new file mode 100644
index 000000000..a4f082d2a
--- /dev/null
+++ b/src/service/rest/openid_plugin.c
@@ -0,0 +1,3169 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2018 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @author Philippe Buschmann
+ * @author Tristan Schwieren
+ * @file identity/plugin_rest_openid_connect.c
+ * @brief GNUnet Namestore REST plugin
+ *
+ */
+#include "platform.h"
+#include <inttypes.h>
+#include <jansson.h>
+#include <jose/jose.h>
+
+#include "gnunet_util_lib.h"
+#include "gnunet_gns_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_identity_service.h"
+#include "gnunet_namestore_service.h"
+#include "gnunet_reclaim_lib.h"
+#include "gnunet_reclaim_service.h"
+#include "gnunet_rest_lib.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_signatures.h"
+#include "microhttpd.h"
+#include "oidc_helper.h"
+
+/**
+ * REST root namespace
+ */
+#define GNUNET_REST_API_NS_OIDC "/openid"
+
+/**
+ * OIDC config
+ */
+#define GNUNET_REST_API_NS_OIDC_CONFIG "/.well-known/openid-configuration"
+
+/**
+ * Authorize endpoint
+ */
+#define GNUNET_REST_API_NS_AUTHORIZE "/openid/authorize"
+
+/**
+ * Token endpoint
+ */
+#define GNUNET_REST_API_NS_TOKEN "/openid/token"
+
+/**
+ * JSON Web Keys endpoint
+ */
+#define GNUNET_REST_API_JWKS "/jwks.json"
+
+/**
+ * UserInfo endpoint
+ */
+#define GNUNET_REST_API_NS_USERINFO "/openid/userinfo"
+
+/**
+ * Login namespace
+ */
+#define GNUNET_REST_API_NS_LOGIN "/openid/login"
+
+/**
+ * State while collecting all egos
+ */
+#define ID_REST_STATE_INIT 0
+
+/**
+ * Done collecting egos
+ */
+#define ID_REST_STATE_POST_INIT 1
+
+/**
+ * OIDC grant_type key
+ */
+#define OIDC_GRANT_TYPE_KEY "grant_type"
+
+/**
+ * OIDC grant_type key
+ */
+#define OIDC_GRANT_TYPE_VALUE "authorization_code"
+
+/**
+ * OIDC code key
+ */
+#define OIDC_CODE_KEY "code"
+
+/**
+ * OIDC response_type key
+ */
+#define OIDC_RESPONSE_TYPE_KEY "response_type"
+
+/**
+ * OIDC client_id key
+ */
+#define OIDC_CLIENT_ID_KEY "client_id"
+
+/**
+ * OIDC scope key
+ */
+#define OIDC_SCOPE_KEY "scope"
+
+/**
+ * OIDC redirect_uri key
+ */
+#define OIDC_REDIRECT_URI_KEY "redirect_uri"
+
+/**
+ * OIDC state key
+ */
+#define OIDC_STATE_KEY "state"
+
+/**
+ * OIDC nonce key
+ */
+#define OIDC_NONCE_KEY "nonce"
+
+/**
+ * OIDC claims key
+ */
+#define OIDC_CLAIMS_KEY "claims"
+
+/**
+ * OIDC PKCE code challenge
+ */
+#define OIDC_CODE_CHALLENGE_KEY "code_challenge"
+
+/**
+ * OIDC PKCE code verifier
+ */
+#define OIDC_CODE_VERIFIER_KEY "code_verifier"
+
+/**
+ * OIDC cookie expiration (in seconds)
+ */
+#define OIDC_COOKIE_EXPIRATION 3
+
+/**
+ * OIDC cookie header key
+ */
+#define OIDC_COOKIE_HEADER_KEY "cookie"
+
+/**
+ * OIDC cookie header information key
+ */
+#define OIDC_AUTHORIZATION_HEADER_KEY "authorization"
+
+/**
+ * OIDC cookie header information key
+ */
+#define OIDC_COOKIE_HEADER_INFORMATION_KEY "Identity="
+
+/**
+ * OIDC cookie header if user cancelled
+ */
+#define OIDC_COOKIE_HEADER_ACCESS_DENIED "Identity=Denied"
+
+/**
+ * OIDC expected response_type while authorizing
+ */
+#define OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE "code"
+
+/**
+ * OIDC expected scope part while authorizing
+ */
+#define OIDC_EXPECTED_AUTHORIZATION_SCOPE "openid"
+
+/**
+ * OIDC error key for invalid client
+ */
+#define OIDC_ERROR_KEY_INVALID_CLIENT "invalid_client"
+
+/**
+ * OIDC error key for invalid scopes
+ */
+#define OIDC_ERROR_KEY_INVALID_SCOPE "invalid_scope"
+
+/**
+ * OIDC error key for invalid requests
+ */
+#define OIDC_ERROR_KEY_INVALID_REQUEST "invalid_request"
+
+/**
+ * OIDC error key for invalid tokens
+ */
+#define OIDC_ERROR_KEY_INVALID_TOKEN "invalid_token"
+
+/**
+ * OIDC error key for invalid cookies
+ */
+#define OIDC_ERROR_KEY_INVALID_COOKIE "invalid_cookie"
+
+/**
+ * OIDC error key for generic server errors
+ */
+#define OIDC_ERROR_KEY_SERVER_ERROR "server_error"
+
+/**
+ * OIDC error key for unsupported grants
+ */
+#define OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE "unsupported_grant_type"
+
+/**
+ * OIDC error key for unsupported response types
+ */
+#define OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE "unsupported_response_type"
+
+/**
+ * OIDC error key for unauthorized clients
+ */
+#define OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT "unauthorized_client"
+
+/**
+ * OIDC error key for denied access
+ */
+#define OIDC_ERROR_KEY_ACCESS_DENIED "access_denied"
+
+/**
+ * OIDC key store file name
+ */
+#define OIDC_JWK_RSA_FILENAME "jwk_rsa.json"
+
+/**
+ * How long to wait for a consume in userinfo endpoint
+ */
+#define CONSUME_TIMEOUT GNUNET_TIME_relative_multiply ( \
+          GNUNET_TIME_UNIT_SECONDS,2)
+
+/**
+ * OIDC ignored parameter array
+ */
+static char *OIDC_ignored_parameter_array[] = { "display",
+                                                "prompt",
+                                                "ui_locales",
+                                                "response_mode",
+                                                "id_token_hint",
+                                                "login_hint",
+                                                "acr_values" };
+
+/**
+ * OIDC hashmap for cached access tokens and codes
+ */
+struct GNUNET_CONTAINER_MultiHashMap *oidc_code_cache;
+
+/**
+ * OIDC hashmap that keeps track of issued cookies
+ */
+struct GNUNET_CONTAINER_MultiHashMap *OIDC_cookie_jar_map;
+
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *oid_cfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_head;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_tail;
+
+/**
+ * The processing state
+ */
+static int state;
+
+/**
+ * Handle to Identity service.
+  */
+static struct GNUNET_IDENTITY_Handle *identity_handle;
+
+/**
+ * GNS handle
+ */
+static struct GNUNET_GNS_Handle *gns_handle;
+
+/**
+ * Identity Provider
+ */
+static struct GNUNET_RECLAIM_Handle *idp;
+
+/**
+ * Timeout for consume call on userinfo
+ */
+static struct GNUNET_TIME_Relative consume_timeout;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+/**
+ * @brief The RSA key used by the oidc enpoint
+ */
+json_t *oidc_jwk;
+
+/**
+ * OIDC needed variables
+ */
+struct OIDC_Variables
+{
+  /**
+   * The RP client public key
+   */
+  struct GNUNET_CRYPTO_PublicKey client_pkey;
+
+  /**
+   * The OIDC client id of the RP
+   */
+  char *client_id;
+
+  /**
+   * The OIDC redirect uri
+   */
+  char *redirect_uri;
+
+  /**
+   * The list of oidc scopes
+   */
+  char *scope;
+
+  /**
+   * The OIDC state
+   */
+  char *state;
+
+  /**
+   * The OIDC nonce
+   */
+  char *nonce;
+
+  /**
+   * The OIDC claims
+   */
+  char *claims;
+
+  /**
+   * The OIDC response type
+   */
+  char *response_type;
+
+  /**
+   * The identity chosen by the user to login
+   */
+  char *login_identity;
+
+  /**
+   * User cancelled authorization/login
+   */
+  int user_cancelled;
+
+  /**
+   * The PKCE code_challenge
+   */
+  char *code_challenge;
+
+  /**
+   * The PKCE code_verifier
+   */
+  char *code_verifier;
+
+};
+
+/**
+ * The ego list
+ */
+struct EgoEntry
+{
+  /**
+   * DLL
+   */
+  struct EgoEntry *next;
+
+  /**
+   * DLL
+   */
+  struct EgoEntry *prev;
+
+  /**
+   * Ego Identifier
+   */
+  char *identifier;
+
+  /**
+   * Public key string
+   */
+  char *keystring;
+
+  /**
+   * The Ego
+   */
+  struct GNUNET_IDENTITY_Ego *ego;
+};
+
+
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Selected ego
+   */
+  struct EgoEntry *ego_entry;
+
+  /**
+   * Pointer to ego private key
+   */
+  struct GNUNET_CRYPTO_PrivateKey priv_key;
+
+  /**
+   * OIDC variables
+   */
+  struct OIDC_Variables *oidc;
+
+  /**
+   * GNS lookup op
+   */
+  struct GNUNET_GNS_LookupRequest *gns_op;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Attribute claim list for id_token
+   */
+  struct GNUNET_RECLAIM_AttributeList *attr_idtoken_list;
+
+  /**
+   * Attribute claim list for userinfo
+   */
+  struct GNUNET_RECLAIM_AttributeList *attr_userinfo_list;
+
+  /**
+   * Credentials
+   */
+  struct GNUNET_RECLAIM_CredentialList *credentials;
+
+  /**
+   * Presentations
+   */
+  struct GNUNET_RECLAIM_PresentationList *presentations;
+
+  /**
+   * IDENTITY Operation
+   */
+  struct GNUNET_IDENTITY_Operation *op;
+
+
+  /**
+   * Idp Operation
+   */
+  struct GNUNET_RECLAIM_Operation *idp_op;
+
+  /**
+   * Timeout task for consume
+   */
+  struct GNUNET_SCHEDULER_Task *consume_timeout_op;
+
+  /**
+   * Attribute iterator
+   */
+  struct GNUNET_RECLAIM_AttributeIterator *attr_it;
+
+  /**
+   * Credential iterator
+   */
+  struct GNUNET_RECLAIM_CredentialIterator *cred_it;
+
+
+  /**
+   * Ticket iterator
+   */
+  struct GNUNET_RECLAIM_TicketIterator *ticket_it;
+
+  /**
+   * A ticket
+   */
+  struct GNUNET_RECLAIM_Ticket ticket;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * The passed access token
+   */
+  char *access_token;
+
+  /**
+   * The tld for redirect
+   */
+  char *tld;
+
+  /**
+   * The redirect prefix
+   */
+  char *redirect_prefix;
+
+  /**
+   * The redirect suffix
+   */
+  char *redirect_suffix;
+
+  /**
+   * Error response message
+   */
+  char *emsg;
+
+  /**
+   * Error response description
+   */
+  char *edesc;
+
+  /**
+   * Response code
+   */
+  int response_code;
+
+  /**
+   * Public client
+   */
+  int public_client;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+
+/**
+ * Cleanup lookup handle
+ * @param handle Handle to clean up
+ */
+static void
+cleanup_handle (struct RequestHandle *handle)
+{
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->timeout_task)
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+  if (NULL != handle->attr_it)
+    GNUNET_RECLAIM_get_attributes_stop (handle->attr_it);
+  if (NULL != handle->cred_it)
+    GNUNET_RECLAIM_get_credentials_stop (handle->cred_it);
+  if (NULL != handle->ticket_it)
+    GNUNET_RECLAIM_ticket_iteration_stop (handle->ticket_it);
+  if (NULL != handle->idp_op)
+    GNUNET_RECLAIM_cancel (handle->idp_op);
+  if (NULL != handle->consume_timeout_op)
+    GNUNET_SCHEDULER_cancel (handle->consume_timeout_op);
+  GNUNET_free (handle->url);
+  GNUNET_free (handle->tld);
+  GNUNET_free (handle->redirect_prefix);
+  GNUNET_free (handle->redirect_suffix);
+  GNUNET_free (handle->emsg);
+  GNUNET_free (handle->edesc);
+  if (NULL != handle->gns_op)
+    GNUNET_GNS_lookup_cancel (handle->gns_op);
+  if (NULL != handle->oidc)
+  {
+    GNUNET_free (handle->oidc->client_id);
+    GNUNET_free (handle->oidc->login_identity);
+    GNUNET_free (handle->oidc->nonce);
+    GNUNET_free (handle->oidc->redirect_uri);
+    GNUNET_free (handle->oidc->response_type);
+    GNUNET_free (handle->oidc->scope);
+    GNUNET_free (handle->oidc->state);
+    if (NULL != handle->oidc->claims)
+      GNUNET_free (handle->oidc->claims);
+    if (NULL != handle->oidc->code_challenge)
+      GNUNET_free (handle->oidc->code_challenge);
+    GNUNET_free (handle->oidc);
+  }
+  if (NULL!=handle->attr_idtoken_list)
+    GNUNET_RECLAIM_attribute_list_destroy (handle->attr_idtoken_list);
+  if (NULL!=handle->attr_userinfo_list)
+    GNUNET_RECLAIM_attribute_list_destroy (handle->attr_userinfo_list);
+  if (NULL!=handle->credentials)
+    GNUNET_RECLAIM_credential_list_destroy (handle->credentials);
+  if (NULL!=handle->presentations)
+    GNUNET_RECLAIM_presentation_list_destroy (handle->presentations);
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  if (NULL != handle->access_token)
+    GNUNET_free (handle->access_token);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on error, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *json_error;
+
+  GNUNET_asprintf (&json_error,
+                   "{ \"error\" : \"%s\", \"error_description\" : \"%s\"%s%s%s}",
+                   handle->emsg,
+                   (NULL != handle->edesc) ? handle->edesc : "",
+                   (NULL != handle->oidc->state) ? ", \"state\":\"" : "",
+                   (NULL != handle->oidc->state) ? handle->oidc->state : "",
+                   (NULL != handle->oidc->state) ? "\"" : "");
+  if (0 == handle->response_code)
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+  resp = GNUNET_REST_create_response (json_error);
+  if (MHD_HTTP_UNAUTHORIZED == handle->response_code)
+    GNUNET_assert (MHD_NO !=
+                   MHD_add_response_header (resp,
+                                            MHD_HTTP_HEADER_WWW_AUTHENTICATE,
+                                            "Basic"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    MHD_HTTP_HEADER_CONTENT_TYPE,
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  cleanup_handle (handle);
+  GNUNET_free (json_error);
+}
+
+
+/**
+ * Task run on error in userinfo endpoint, sends error header. Cleans up
+ * everything
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_userinfo_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *error;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Error: %s\n", handle->edesc);
+  GNUNET_asprintf (&error,
+                   "error=\"%s\", error_description=\"%s\"",
+                   handle->emsg,
+                   (NULL != handle->edesc) ? handle->edesc : "");
+  resp = GNUNET_REST_create_response ("");
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          MHD_HTTP_HEADER_WWW_AUTHENTICATE,
+                                          "Bearer"));
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  cleanup_handle (handle);
+  GNUNET_free (error);
+}
+
+
+/**
+ * Task run on error, sends error message and redirects. Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_redirect_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *redirect;
+
+  GNUNET_asprintf (&redirect,
+                   "%s?error=%s&error_description=%s%s%s",
+                   handle->oidc->redirect_uri,
+                   handle->emsg,
+                   handle->edesc,
+                   (NULL != handle->oidc->state) ? "&state=" : "",
+                   (NULL != handle->oidc->state) ? handle->oidc->state : "");
+  resp = GNUNET_REST_create_response ("");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Location", redirect));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
+  cleanup_handle (handle);
+  GNUNET_free (redirect);
+}
+
+
+/**
+ * Task run on timeout, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_timeout (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->timeout_task = NULL;
+  do_error (handle);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // For now, independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+  return;
+}
+
+
+/**
+ * Interprets cookie header and pass its identity keystring to handle
+ */
+static void
+cookie_identity_interpretation (struct RequestHandle *handle)
+{
+  struct GNUNET_HashCode cache_key;
+  char *cookies;
+  struct GNUNET_TIME_Absolute current_time, *relog_time;
+  char delimiter[] = "; ";
+  char *tmp_cookies;
+  char *token;
+  char *value;
+
+  // gets identity of login try with cookie
+  GNUNET_CRYPTO_hash (OIDC_COOKIE_HEADER_KEY,
+                      strlen (OIDC_COOKIE_HEADER_KEY),
+                      &cache_key);
+  if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                           ->header_param_map,
+                                                           &cache_key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "No cookie found\n");
+    return;
+  }
+  // splits cookies and find 'Identity' cookie
+  tmp_cookies =
+    GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
+                                       &cache_key);
+  cookies = GNUNET_strdup (tmp_cookies);
+  token = strtok (cookies, delimiter);
+  handle->oidc->user_cancelled = GNUNET_NO;
+  handle->oidc->login_identity = NULL;
+  if (NULL == token)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse cookie: %s\n",
+                cookies);
+    GNUNET_free (cookies);
+    return;
+  }
+
+  while (NULL != token)
+  {
+    if (0 == strcmp (token, OIDC_COOKIE_HEADER_ACCESS_DENIED))
+    {
+      handle->oidc->user_cancelled = GNUNET_YES;
+      GNUNET_free (cookies);
+      return;
+    }
+    if (NULL != strstr (token, OIDC_COOKIE_HEADER_INFORMATION_KEY))
+      break;
+    token = strtok (NULL, delimiter);
+  }
+  if (NULL == token)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No cookie value to process: %s\n",
+                cookies);
+    GNUNET_free (cookies);
+    return;
+  }
+  GNUNET_CRYPTO_hash (token, strlen (token), &cache_key);
+  if (GNUNET_NO ==
+      GNUNET_CONTAINER_multihashmap_contains (OIDC_cookie_jar_map, &cache_key))
+  {
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_WARNING,
+      "Found cookie `%s', but no corresponding expiration entry present...\n",
+      token);
+    GNUNET_free (cookies);
+    return;
+  }
+  relog_time =
+    GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
+  current_time = GNUNET_TIME_absolute_get ();
+  // 30 min after old login -> redirect to login
+  if (current_time.abs_value_us > relog_time->abs_value_us)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Found cookie `%s', but it is expired.\n",
+                token);
+    GNUNET_free (cookies);
+    return;
+  }
+  value = strtok (token, OIDC_COOKIE_HEADER_INFORMATION_KEY);
+  GNUNET_assert (NULL != value);
+  handle->oidc->login_identity = GNUNET_strdup (value);
+  GNUNET_free (cookies);
+}
+
+
+/**
+ * @brief Read the the JSON Web Key in the given file and return it.
+ * Return NULL and emit warning if JSON can not be decoded or the key is
+ * invalid
+ *
+ * @param filename the file to read the JWK from
+ * @return json_t* the reed JWK
+ */
+json_t *
+read_jwk_from_file (const char *filename)
+{
+  json_t *jwk;
+  json_error_t error;
+
+  jwk = json_load_file (filename, JSON_DECODE_ANY, &error);
+
+  if (! jwk)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                ("Could not read OIDC RSA key from config file; %s\n"),
+                error.text);
+  }
+
+  return jwk;
+}
+
+
+/**
+ * @brief Write the JWK to file. If unsuccessful emit warning
+ *
+ * @param filename the name of the file the JWK is writen to
+ * @param jwk the JWK that is going to be written
+ * @return int Return GNUNET_OK if write is sucessfull
+ */
+static int
+write_jwk_to_file (const char *filename,
+                   json_t *jwk)
+{
+  if (json_dump_file (jwk, filename, JSON_INDENT (2)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                ("Could not write OIDC RSA key to file %s\n"),
+                filename);
+    return GNUNET_ERROR_TYPE_WARNING;
+  }
+  else
+    return GNUNET_OK;
+}
+
+
+/**
+ * @brief Generate a new RSA JSON Web Key
+ *
+ * @return json_t* the generated JWK
+ */
+json_t *
+generate_jwk ()
+{
+  json_t *jwk;
+  jwk = json_pack ("{s:s,s:i}", "kty", "RSA", "bits", 2048);
+  jose_jwk_gen (NULL, jwk);
+  json_incref (jwk);
+  return jwk;
+}
+
+
+/**
+ * Return the path to the oidc directory path
+ *
+ * @param cls the RequestHandle
+ */
+char *
+get_oidc_dir_path (void *cls)
+{
+  char *oidc_directory;
+  struct RequestHandle *handle = cls;
+
+  // Read OIDC directory from config
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (oid_cfg,
+                                                            "reclaim-rest-plugin",
+                                                            "oidc_dir",
+                                                            &oidc_directory))
+  {
+    // Could not read Config file
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc = GNUNET_strdup ("gnunet configuration failed");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return NULL;
+  }
+
+  return oidc_directory;
+}
+
+
+/**
+ * Return the path to the RSA JWK key file
+ *
+ * @param cls the RequestHandle
+ */
+char *
+get_oidc_jwk_path (void *cls)
+{
+  char *oidc_directory;
+  char *oidc_jwk_path;
+
+  oidc_directory = get_oidc_dir_path (cls);
+
+  // Create path to file
+  GNUNET_asprintf (&oidc_jwk_path, "%s/%s", oidc_directory,
+                   OIDC_JWK_RSA_FILENAME);
+
+  return oidc_jwk_path;
+}
+
+
+/**
+ * Redirects to login page stored in configuration file
+ */
+static void
+login_redirect (void *cls)
+{
+  char *login_base_url;
+  char *new_redirect;
+  char *tmp;
+  struct MHD_Response *resp;
+  struct GNUNET_Buffer buf = { 0 };
+  struct RequestHandle *handle = cls;
+
+  if (GNUNET_OK == GNUNET_CONFIGURATION_get_value_string (oid_cfg,
+                                                          "reclaim-rest-plugin",
+                                                          "address",
+                                                          &login_base_url))
+  {
+    GNUNET_buffer_write_str (&buf, login_base_url);
+    GNUNET_buffer_write_fstr (&buf,
+                              "?%s=%s",
+                              OIDC_RESPONSE_TYPE_KEY,
+                              handle->oidc->response_type);
+    GNUNET_buffer_write_fstr (&buf,
+                              "&%s=%s",
+                              OIDC_CLIENT_ID_KEY,
+                              handle->oidc->client_id);
+    GNUNET_STRINGS_urlencode (handle->oidc->redirect_uri,
+                              strlen (handle->oidc->redirect_uri),
+                              &tmp);
+    GNUNET_buffer_write_fstr (&buf,
+                              "&%s=%s",
+                              OIDC_REDIRECT_URI_KEY,
+                              tmp);
+    GNUNET_free (tmp);
+    GNUNET_STRINGS_urlencode (handle->oidc->scope,
+                              strlen (handle->oidc->scope),
+                              &tmp);
+    GNUNET_buffer_write_fstr (&buf,
+                              "&%s=%s",
+                              OIDC_SCOPE_KEY,
+                              tmp);
+    GNUNET_free (tmp);
+    if (NULL != handle->oidc->state)
+    {
+      GNUNET_STRINGS_urlencode (handle->oidc->state,
+                                strlen (handle->oidc->state),
+                                &tmp);
+      GNUNET_buffer_write_fstr (&buf,
+                                "&%s=%s",
+                                OIDC_STATE_KEY,
+                                handle->oidc->state);
+      GNUNET_free (tmp);
+    }
+    if (NULL != handle->oidc->code_challenge)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "&%s=%s",
+                                OIDC_CODE_CHALLENGE_KEY,
+                                handle->oidc->code_challenge);
+    }
+    if (NULL != handle->oidc->nonce)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "&%s=%s",
+                                OIDC_NONCE_KEY,
+                                handle->oidc->nonce);
+    }
+    if (NULL != handle->oidc->claims)
+    {
+      GNUNET_STRINGS_urlencode (handle->oidc->claims,
+                                strlen (handle->oidc->claims),
+                                &tmp);
+      GNUNET_buffer_write_fstr (&buf,
+                                "&%s=%s",
+                                OIDC_CLAIMS_KEY,
+                                tmp);
+      GNUNET_free (tmp);
+    }
+    new_redirect = GNUNET_buffer_reap_str (&buf);
+    resp = GNUNET_REST_create_response ("");
+    MHD_add_response_header (resp, "Location", new_redirect);
+    GNUNET_free (login_base_url);
+  }
+  else
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc = GNUNET_strdup ("gnunet configuration failed");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
+  GNUNET_free (new_redirect);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Does internal server error when iteration failed.
+ */
+static void
+oidc_iteration_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+  handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+  GNUNET_SCHEDULER_add_now (&do_error, handle);
+}
+
+
+/**
+ * Issues ticket and redirects to relying party with the authorization code as
+ * parameter. Otherwise redirects with error
+ */
+static void
+oidc_ticket_issue_cb (void *cls,
+                      const struct GNUNET_RECLAIM_Ticket *ticket,
+                      const struct
+                      GNUNET_RECLAIM_PresentationList *presentation)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *ticket_str;
+  char *redirect_uri;
+  char *code_string;
+
+  handle->idp_op = NULL;
+  if (NULL == ticket)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc = GNUNET_strdup ("Server cannot generate ticket.");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+  handle->ticket = *ticket;
+  ticket_str =
+    GNUNET_STRINGS_data_to_string_alloc (&handle->ticket,
+                                         sizeof(struct GNUNET_RECLAIM_Ticket));
+  code_string = OIDC_build_authz_code (&handle->priv_key,
+                                       &handle->ticket,
+                                       handle->attr_idtoken_list,
+                                       presentation,
+                                       handle->oidc->nonce,
+                                       handle->oidc->code_challenge);
+  if ((NULL != handle->redirect_prefix) && (NULL != handle->redirect_suffix) &&
+      (NULL != handle->tld))
+  {
+    GNUNET_asprintf (&redirect_uri,
+                     "%s.%s/%s%s%s=%s&state=%s",
+                     handle->redirect_prefix,
+                     handle->tld,
+                     handle->redirect_suffix,
+                     (NULL == strchr (handle->redirect_suffix, '?') ? "?" :
+                      "&"),
+                     handle->oidc->response_type,
+                     code_string,
+                     handle->oidc->state);
+  }
+  else
+  {
+    GNUNET_asprintf (&redirect_uri,
+                     "%s%s%s=%s&state=%s",
+                     handle->oidc->redirect_uri,
+                     (NULL == strchr (handle->oidc->redirect_uri, '?') ? "?" :
+                      "&"),
+                     handle->oidc->response_type,
+                     code_string,
+                     handle->oidc->state);
+  }
+  resp = GNUNET_REST_create_response ("");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Location", redirect_uri));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
+  cleanup_handle (handle);
+  GNUNET_free (redirect_uri);
+  GNUNET_free (ticket_str);
+  GNUNET_free (code_string);
+}
+
+
+static struct GNUNET_RECLAIM_AttributeList*
+attribute_list_merge (struct GNUNET_RECLAIM_AttributeList *list_a,
+                      struct GNUNET_RECLAIM_AttributeList *list_b)
+{
+  struct GNUNET_RECLAIM_AttributeList *merged_list;
+  struct GNUNET_RECLAIM_AttributeListEntry *le_a;
+  struct GNUNET_RECLAIM_AttributeListEntry *le_b;
+  struct GNUNET_RECLAIM_AttributeListEntry *le_m;
+
+  merged_list = GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+  for (le_a = list_a->list_head; NULL != le_a; le_a = le_a->next)
+  {
+    le_m = GNUNET_new (struct GNUNET_RECLAIM_AttributeListEntry);
+    le_m->attribute = GNUNET_RECLAIM_attribute_new (le_a->attribute->name,
+                                                    &le_a->attribute->
+                                                    credential,
+                                                    le_a->attribute->type,
+                                                    le_a->attribute->data,
+                                                    le_a->attribute->data_size);
+    le_m->attribute->id = le_a->attribute->id;
+    le_m->attribute->flag = le_a->attribute->flag;
+    le_m->attribute->credential = le_a->attribute->credential;
+    GNUNET_CONTAINER_DLL_insert (merged_list->list_head,
+                                 merged_list->list_tail,
+                                 le_m);
+  }
+  le_m = NULL;
+  for (le_b = list_b->list_head; NULL != le_b; le_b = le_b->next)
+  {
+    for (le_m = merged_list->list_head; NULL != le_m; le_m = le_m->next)
+    {
+      if (GNUNET_YES == GNUNET_RECLAIM_id_is_equal (&le_m->attribute->id,
+                                                    &le_b->attribute->id))
+        break; /** Attribute already in list **/
+    }
+    if (NULL != le_m)
+      continue; /** Attribute already in list **/
+    le_m = GNUNET_new (struct GNUNET_RECLAIM_AttributeListEntry);
+    le_m->attribute = GNUNET_RECLAIM_attribute_new (le_b->attribute->name,
+                                                    &le_b->attribute->
+                                                    credential,
+                                                    le_b->attribute->type,
+                                                    le_b->attribute->data,
+                                                    le_b->attribute->data_size);
+    le_m->attribute->id = le_b->attribute->id;
+    le_m->attribute->flag = le_b->attribute->flag;
+    le_m->attribute->credential = le_b->attribute->credential;
+    GNUNET_CONTAINER_DLL_insert (merged_list->list_head,
+                                 merged_list->list_tail,
+                                 le_m);
+  }
+  return merged_list;
+}
+
+
+static void
+oidc_cred_collect_finished_cb (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_AttributeList *merged_list;
+  struct GNUNET_RECLAIM_AttributeListEntry *le_m;
+
+  handle->cred_it = NULL;
+  merged_list = attribute_list_merge (handle->attr_idtoken_list,
+                                      handle->attr_userinfo_list);
+  for (le_m = merged_list->list_head; NULL != le_m; le_m = le_m->next)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "List Attribute in ticket to issue: %s\n",
+                le_m->attribute->name);
+  handle->idp_op = GNUNET_RECLAIM_ticket_issue (idp,
+                                                &handle->priv_key,
+                                                &handle->oidc->client_pkey,
+                                                merged_list,
+                                                &oidc_ticket_issue_cb,
+                                                handle);
+  GNUNET_RECLAIM_attribute_list_destroy (merged_list);
+}
+
+
+/**
+ * Collects all attributes for an ego if in scope parameter
+ */
+static void
+oidc_cred_collect (void *cls,
+                   const struct GNUNET_CRYPTO_PublicKey *identity,
+                   const struct GNUNET_RECLAIM_Credential *cred)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_AttributeListEntry *le;
+  struct GNUNET_RECLAIM_CredentialListEntry *ale;
+
+  for (ale = handle->credentials->list_head; NULL != ale; ale = ale->next)
+  {
+    if (GNUNET_NO == GNUNET_RECLAIM_id_is_equal (&ale->credential->id,
+                                                 &cred->id))
+      continue;
+    /** Credential already in list **/
+    GNUNET_RECLAIM_get_credentials_next (handle->cred_it);
+    return;
+  }
+
+  for (le = handle->attr_idtoken_list->list_head; NULL != le; le = le->next)
+  {
+    if (GNUNET_NO == GNUNET_RECLAIM_id_is_equal (&le->attribute->credential,
+                                                 &cred->id))
+      continue;
+    /** Credential matches for attribute, add **/
+    ale = GNUNET_new (struct GNUNET_RECLAIM_CredentialListEntry);
+    ale->credential = GNUNET_RECLAIM_credential_new (cred->name,
+                                                     cred->type,
+                                                     cred->data,
+                                                     cred->data_size);
+    GNUNET_CONTAINER_DLL_insert (handle->credentials->list_head,
+                                 handle->credentials->list_tail,
+                                 ale);
+  }
+  GNUNET_RECLAIM_get_credentials_next (handle->cred_it);
+}
+
+
+static void
+oidc_attr_collect_finished_cb (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->attr_it = NULL;
+  handle->ticket_it = NULL;
+  if (NULL == handle->attr_idtoken_list->list_head)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
+    handle->edesc = GNUNET_strdup ("The requested scope is not available.");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+  handle->credentials = GNUNET_new (struct GNUNET_RECLAIM_CredentialList);
+  handle->cred_it =
+    GNUNET_RECLAIM_get_credentials_start (idp,
+                                          &handle->priv_key,
+                                          &oidc_iteration_error,
+                                          handle,
+                                          &oidc_cred_collect,
+                                          handle,
+                                          &oidc_cred_collect_finished_cb,
+                                          handle);
+
+}
+
+
+static int
+attr_in_claims_request (struct RequestHandle *handle,
+                        const char *attr_name,
+                        const char *claims_parameter)
+{
+  int ret = GNUNET_NO;
+  json_t *root;
+  json_error_t error;
+  json_t *claims_j;
+  const char *key;
+  json_t *value;
+
+  /** Check if attribute is requested through a scope **/
+  if (GNUNET_YES == OIDC_check_scopes_for_claim_request (handle->oidc->scope,
+                                                         attr_name))
+    return GNUNET_YES;
+
+  /** Try claims parameter if not in scope */
+  if (NULL != handle->oidc->claims)
+  {
+    root = json_loads (handle->oidc->claims, JSON_DECODE_ANY, &error);
+    claims_j = json_object_get (root, claims_parameter);
+    /* obj is a JSON object */
+    if (NULL != claims_j)
+    {
+      json_object_foreach (claims_j, key, value) {
+        if (0 != strcmp (attr_name, key))
+          continue;
+        ret = GNUNET_YES;
+        break;
+      }
+    }
+    json_decref (root);
+  }
+  return ret;
+}
+
+
+static int
+attr_in_idtoken_request (struct RequestHandle *handle,
+                         const char *attr_name)
+{
+  return attr_in_claims_request (handle, attr_name, "id_token");
+}
+
+
+static int
+attr_in_userinfo_request (struct RequestHandle *handle,
+                          const char *attr_name)
+{
+  return attr_in_claims_request (handle, attr_name, "userinfo");
+}
+
+
+/**
+ * Collects all attributes for an ego if in scope parameter
+ */
+static void
+oidc_attr_collect (void *cls,
+                   const struct GNUNET_CRYPTO_PublicKey *identity,
+                   const struct GNUNET_RECLAIM_Attribute *attr)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_AttributeListEntry *le;
+  if (GNUNET_YES == attr_in_idtoken_request (handle, attr->name))
+  {
+    le = GNUNET_new (struct GNUNET_RECLAIM_AttributeListEntry);
+    le->attribute = GNUNET_RECLAIM_attribute_new (attr->name,
+                                                  &attr->credential,
+                                                  attr->type,
+                                                  attr->data,
+                                                  attr->data_size);
+    le->attribute->id = attr->id;
+    le->attribute->flag = attr->flag;
+    le->attribute->credential = attr->credential;
+    GNUNET_CONTAINER_DLL_insert (handle->attr_idtoken_list->list_head,
+                                 handle->attr_idtoken_list->list_tail,
+                                 le);
+  }
+  if (GNUNET_YES == attr_in_userinfo_request (handle, attr->name))
+  {
+    le = GNUNET_new (struct GNUNET_RECLAIM_AttributeListEntry);
+    le->attribute = GNUNET_RECLAIM_attribute_new (attr->name,
+                                                  &attr->credential,
+                                                  attr->type,
+                                                  attr->data,
+                                                  attr->data_size);
+    le->attribute->id = attr->id;
+    le->attribute->flag = attr->flag;
+    le->attribute->credential = attr->credential;
+    GNUNET_CONTAINER_DLL_insert (handle->attr_userinfo_list->list_head,
+                                 handle->attr_userinfo_list->list_tail,
+                                 le);
+  }
+
+  GNUNET_RECLAIM_get_attributes_next (handle->attr_it);
+}
+
+
+/**
+ * Checks time and cookie and redirects accordingly
+ */
+static void
+code_redirect (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_TIME_Absolute current_time;
+  struct GNUNET_TIME_Absolute *relog_time;
+  struct GNUNET_CRYPTO_PublicKey pubkey;
+  struct GNUNET_CRYPTO_PublicKey ego_pkey;
+  struct GNUNET_HashCode cache_key;
+  char *identity_cookie;
+
+  GNUNET_asprintf (&identity_cookie,
+                   "Identity=%s",
+                   handle->oidc->login_identity);
+  GNUNET_CRYPTO_hash (identity_cookie, strlen (identity_cookie), &cache_key);
+  GNUNET_free (identity_cookie);
+  // No login time for identity -> redirect to login
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multihashmap_contains (OIDC_cookie_jar_map, &cache_key))
+  {
+    relog_time =
+      GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
+    current_time = GNUNET_TIME_absolute_get ();
+    // 30 min after old login -> redirect to login
+    if (current_time.abs_value_us <= relog_time->abs_value_us)
+    {
+      if (GNUNET_OK !=
+          GNUNET_CRYPTO_public_key_from_string (handle->oidc
+                                                ->login_identity,
+                                                &pubkey))
+      {
+        handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_COOKIE);
+        handle->edesc =
+          GNUNET_strdup ("The cookie of a login identity is not valid");
+        GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+        return;
+      }
+      // iterate over egos and compare their public key
+      for (handle->ego_entry = ego_head; NULL != handle->ego_entry;
+           handle->ego_entry = handle->ego_entry->next)
+      {
+        GNUNET_IDENTITY_ego_get_public_key (handle->ego_entry->ego, &ego_pkey);
+        if (0 == GNUNET_memcmp (&ego_pkey, &pubkey))
+        {
+          handle->priv_key =
+            *GNUNET_IDENTITY_ego_get_private_key (handle->ego_entry->ego);
+          handle->attr_idtoken_list =
+            GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+          handle->attr_userinfo_list =
+            GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+          handle->attr_it =
+            GNUNET_RECLAIM_get_attributes_start (idp,
+                                                 &handle->priv_key,
+                                                 &oidc_iteration_error,
+                                                 handle,
+                                                 &oidc_attr_collect,
+                                                 handle,
+                                                 &oidc_attr_collect_finished_cb,
+                                                 handle);
+          return;
+        }
+      }
+      GNUNET_SCHEDULER_add_now (&login_redirect, handle);
+      return;
+    }
+  }
+}
+
+
+static void
+build_redirect (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *redirect_uri;
+
+  if (GNUNET_YES == handle->oidc->user_cancelled)
+  {
+    if ((NULL != handle->redirect_prefix) &&
+        (NULL != handle->redirect_suffix) && (NULL != handle->tld))
+    {
+      GNUNET_asprintf (&redirect_uri,
+                       "%s.%s/%s?error=%s&error_description=%s&state=%s",
+                       handle->redirect_prefix,
+                       handle->tld,
+                       handle->redirect_suffix,
+                       "access_denied",
+                       "User denied access",
+                       handle->oidc->state);
+    }
+    else
+    {
+      GNUNET_asprintf (&redirect_uri,
+                       "%s?error=%s&error_description=%s&state=%s",
+                       handle->oidc->redirect_uri,
+                       "access_denied",
+                       "User denied access",
+                       handle->oidc->state);
+    }
+    resp = GNUNET_REST_create_response ("");
+    GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                      "Location",
+                                                      redirect_uri));
+    handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
+    cleanup_handle (handle);
+    GNUNET_free (redirect_uri);
+    return;
+  }
+  GNUNET_SCHEDULER_add_now (&code_redirect, handle);
+}
+
+
+static void
+lookup_redirect_uri_result (void *cls,
+                            uint32_t rd_count,
+                            const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct RequestHandle *handle = cls;
+  char *tmp;
+  char *tmp_key_str;
+  char *pos;
+  struct GNUNET_CRYPTO_PublicKey redirect_zone;
+
+  handle->gns_op = NULL;
+  if (0 == rd_count)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc =
+      GNUNET_strdup ("Server cannot generate ticket, redirect uri not found.");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+  for (int i = 0; i < rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT != rd[i].record_type)
+      continue;
+    if (0 != strncmp (rd[i].data, handle->oidc->redirect_uri, rd[i].data_size))
+      continue;
+    tmp = GNUNET_strndup (rd[i].data, rd[i].data_size);
+    if (NULL == strstr (tmp, handle->oidc->client_id))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Redirect uri %s does not contain client_id %s\n",
+                  tmp,
+                  handle->oidc->client_id);
+    }
+    else
+    {
+      pos = strrchr (tmp, (unsigned char) '.');
+      if (NULL == pos)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Redirect uri %s contains client_id but is malformed\n",
+                    tmp);
+        GNUNET_free (tmp);
+        continue;
+      }
+      *pos = '\0';
+      handle->redirect_prefix = GNUNET_strdup (tmp);
+      tmp_key_str = pos + 1;
+      pos = strchr (tmp_key_str, (unsigned char) '/');
+      if (NULL == pos)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Redirect uri %s contains client_id but is malformed\n",
+                    tmp);
+        GNUNET_free (tmp);
+        continue;
+      }
+      *pos = '\0';
+      handle->redirect_suffix = GNUNET_strdup (pos + 1);
+
+      GNUNET_STRINGS_string_to_data (tmp_key_str,
+                                     strlen (tmp_key_str),
+                                     &redirect_zone,
+                                     sizeof(redirect_zone));
+    }
+    GNUNET_SCHEDULER_add_now (&build_redirect, handle);
+    GNUNET_free (tmp);
+    return;
+  }
+  handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+  handle->edesc =
+    GNUNET_strdup ("Server cannot generate ticket, redirect uri not found.");
+  GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+}
+
+
+/**
+ * Initiate redirect back to client.
+ */
+static void
+client_redirect (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  /* Lookup client redirect uri to verify request */
+  handle->gns_op =
+    GNUNET_GNS_lookup (gns_handle,
+                       GNUNET_GNS_EMPTY_LABEL_AT,
+                       &handle->oidc->client_pkey,
+                       GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT,
+                       GNUNET_GNS_LO_DEFAULT,
+                       &lookup_redirect_uri_result,
+                       handle);
+}
+
+
+static char *
+get_url_parameter_copy (const struct RequestHandle *handle, const char *key)
+{
+  struct GNUNET_HashCode hc;
+  char *value;
+  char *res;
+
+  GNUNET_CRYPTO_hash (key, strlen (key), &hc);
+  if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                            ->url_param_map,
+                                                            &hc))
+    return NULL;
+  value =
+    GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map, &hc);
+  if (NULL == value)
+    return NULL;
+  GNUNET_STRINGS_urldecode (value, strlen (value), &res);
+  return res;
+}
+
+
+/**
+ * Iteration over all results finished, build final
+ * response.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+build_authz_response (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_HashCode cache_key;
+
+  char *expected_scope;
+  char delimiter[] = " ";
+  int number_of_ignored_parameter, iterator;
+
+
+  // REQUIRED value: redirect_uri
+  handle->oidc->redirect_uri =
+    get_url_parameter_copy (handle, OIDC_REDIRECT_URI_KEY);
+  if (NULL == handle->oidc->redirect_uri)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("missing parameter redirect_uri");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // REQUIRED value: response_type
+  handle->oidc->response_type =
+    get_url_parameter_copy (handle, OIDC_RESPONSE_TYPE_KEY);
+  if (NULL == handle->oidc->response_type)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("missing parameter response_type");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+
+  // REQUIRED value: scope
+  handle->oidc->scope = get_url_parameter_copy (handle, OIDC_SCOPE_KEY);
+  if (NULL == handle->oidc->scope)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
+    handle->edesc = GNUNET_strdup ("missing parameter scope");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+
+  // OPTIONAL value: nonce
+  handle->oidc->nonce = get_url_parameter_copy (handle, OIDC_NONCE_KEY);
+
+  // OPTIONAL value: claims
+  handle->oidc->claims = get_url_parameter_copy (handle, OIDC_CLAIMS_KEY);
+
+  // TODO check other values if needed
+  number_of_ignored_parameter =
+    sizeof(OIDC_ignored_parameter_array) / sizeof(char *);
+  for (iterator = 0; iterator < number_of_ignored_parameter; iterator++)
+  {
+    GNUNET_CRYPTO_hash (OIDC_ignored_parameter_array[iterator],
+                        strlen (OIDC_ignored_parameter_array[iterator]),
+                        &cache_key);
+    if (GNUNET_YES ==
+        GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                ->url_param_map,
+                                                &cache_key))
+    {
+      handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_ACCESS_DENIED);
+      GNUNET_asprintf (&handle->edesc,
+                       "Server will not handle parameter: %s",
+                       OIDC_ignored_parameter_array[iterator]);
+      GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+      return;
+    }
+  }
+
+  // We only support authorization code flows.
+  if (0 != strcmp (handle->oidc->response_type,
+                   OIDC_EXPECTED_AUTHORIZATION_RESPONSE_TYPE))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNSUPPORTED_RESPONSE_TYPE);
+    handle->edesc = GNUNET_strdup ("The authorization server does not support "
+                                   "obtaining this authorization code.");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    return;
+  }
+
+  // Checks if scope contains 'openid'
+  expected_scope = GNUNET_strdup (handle->oidc->scope);
+  char *test;
+  test = strtok (expected_scope, delimiter);
+  while (NULL != test)
+  {
+    if (0 == strcmp (OIDC_EXPECTED_AUTHORIZATION_SCOPE, expected_scope))
+      break;
+    test = strtok (NULL, delimiter);
+  }
+  if (NULL == test)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_SCOPE);
+    handle->edesc =
+      GNUNET_strdup ("The requested scope is invalid, unknown, or malformed.");
+    GNUNET_SCHEDULER_add_now (&do_redirect_error, handle);
+    GNUNET_free (expected_scope);
+    return;
+  }
+
+  GNUNET_free (expected_scope);
+  if ((NULL == handle->oidc->login_identity) &&
+      (GNUNET_NO == handle->oidc->user_cancelled))
+    GNUNET_SCHEDULER_add_now (&login_redirect, handle);
+  else
+    GNUNET_SCHEDULER_add_now (&client_redirect, handle);
+}
+
+
+/**
+ * Iterate over tlds in config
+ */
+static void
+tld_iter (void *cls, const char *section, const char *option, const char *value)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_CRYPTO_PublicKey pkey;
+
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_public_key_from_string (value, &pkey))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Skipping non key %s\n", value);
+    return;
+  }
+  if (0 == GNUNET_memcmp (&pkey, &handle->oidc->client_pkey))
+    handle->tld = GNUNET_strdup (option + 1);
+}
+
+
+/**
+ * Responds to authorization GET and url-encoded POST request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+authorize_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
+                    const char *url,
+                    void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *tmp_ego;
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct GNUNET_CRYPTO_PublicKey pkey;
+
+  cookie_identity_interpretation (handle);
+
+  // RECOMMENDED value: state - REQUIRED for answers
+  handle->oidc->state = get_url_parameter_copy (handle, OIDC_STATE_KEY);
+
+  // REQUIRED value: client_id
+  handle->oidc->client_id = get_url_parameter_copy (handle, OIDC_CLIENT_ID_KEY);
+  if (NULL == handle->oidc->client_id)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("missing parameter client_id");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // OPTIONAL value: code_challenge
+  handle->oidc->code_challenge = get_url_parameter_copy (handle,
+                                                         OIDC_CODE_CHALLENGE_KEY);
+  if (NULL == handle->oidc->code_challenge)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "OAuth authorization request does not contain PKCE parameters!\n");
+  }
+
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_public_key_from_string (handle->oidc->client_id,
+                                            &handle->oidc->client_pkey))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNAUTHORIZED_CLIENT);
+    handle->edesc = GNUNET_strdup ("The client is not authorized to request an "
+                                   "authorization code using this method.");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // If we know this identity, translated the corresponding TLD
+  // TODO: We might want to have a reverse lookup functionality for TLDs?
+  for (tmp_ego = ego_head; NULL != tmp_ego; tmp_ego = tmp_ego->next)
+  {
+    priv_key = GNUNET_IDENTITY_ego_get_private_key (tmp_ego->ego);
+    GNUNET_CRYPTO_key_get_public (priv_key, &pkey);
+    if (0 == GNUNET_memcmp (&pkey, &handle->oidc->client_pkey))
+    {
+      handle->tld = GNUNET_strdup (tmp_ego->identifier);
+      handle->ego_entry = ego_tail;
+    }
+  }
+  if (NULL == handle->tld)
+    GNUNET_CONFIGURATION_iterate_section_values (oid_cfg, "gns", tld_iter,
+                                                 handle);
+  if (NULL == handle->tld)
+    handle->tld = GNUNET_strdup (handle->oidc->client_id);
+  GNUNET_SCHEDULER_add_now (&build_authz_response, handle);
+}
+
+
+/**
+ * Combines an identity with a login time and responds OK to login request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+login_cont (struct GNUNET_REST_RequestHandle *con_handle,
+            const char *url,
+            void *cls)
+{
+  struct MHD_Response *resp = GNUNET_REST_create_response ("");
+  struct RequestHandle *handle = cls;
+  struct GNUNET_HashCode cache_key;
+  struct GNUNET_TIME_Absolute *current_time;
+  struct GNUNET_TIME_Absolute *last_time;
+  char *cookie;
+  char *header_val;
+  json_t *root;
+  json_error_t error;
+  json_t *identity;
+  char term_data[handle->rest_handle->data_size + 1];
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  root = json_loads (term_data, JSON_DECODE_ANY, &error);
+  identity = json_object_get (root, "identity");
+  if (! json_is_string (identity))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error parsing json string from %s\n",
+                term_data);
+    handle->proc (handle->proc_cls, resp, MHD_HTTP_BAD_REQUEST);
+    json_decref (root);
+    cleanup_handle (handle);
+    return;
+  }
+  GNUNET_asprintf (&cookie, "Identity=%s", json_string_value (identity));
+  GNUNET_asprintf (&header_val,
+                   "%s;Max-Age=%d",
+                   cookie,
+                   OIDC_COOKIE_EXPIRATION);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Set-Cookie", header_val));
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          "POST"));
+  GNUNET_CRYPTO_hash (cookie, strlen (cookie), &cache_key);
+
+  if (0 != strcmp (json_string_value (identity), "Denied"))
+  {
+    current_time = GNUNET_new (struct GNUNET_TIME_Absolute);
+    *current_time = GNUNET_TIME_relative_to_absolute (
+      GNUNET_TIME_relative_multiply (GNUNET_TIME_relative_get_second_ (),
+                                     OIDC_COOKIE_EXPIRATION));
+    last_time =
+      GNUNET_CONTAINER_multihashmap_get (OIDC_cookie_jar_map, &cache_key);
+    GNUNET_free (last_time);
+    GNUNET_CONTAINER_multihashmap_put (OIDC_cookie_jar_map,
+                                       &cache_key,
+                                       current_time,
+                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  }
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (cookie);
+  GNUNET_free (header_val);
+  json_decref (root);
+  cleanup_handle (handle);
+}
+
+
+static int
+parse_credentials_basic_auth (struct RequestHandle *handle,
+                              char **client_id,
+                              char **client_secret)
+{
+  struct GNUNET_HashCode cache_key;
+  char *authorization;
+  char *credentials;
+  char *basic_authorization;
+  char *client_id_tmp;
+  char *pass;
+
+  GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
+                      strlen (OIDC_AUTHORIZATION_HEADER_KEY),
+                      &cache_key);
+  if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                           ->header_param_map,
+                                                           &cache_key))
+    return GNUNET_SYSERR;
+  authorization =
+    GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
+                                       &cache_key);
+
+  // split header in "Basic" and [content]
+  credentials = strtok (authorization, " ");
+  if ((NULL == credentials) || (0 != strcmp ("Basic", credentials)))
+    return GNUNET_SYSERR;
+  credentials = strtok (NULL, " ");
+  if (NULL == credentials)
+    return GNUNET_SYSERR;
+  GNUNET_STRINGS_base64_decode (credentials,
+                                strlen (credentials),
+                                (void **) &basic_authorization);
+
+  if (NULL == basic_authorization)
+    return GNUNET_SYSERR;
+  client_id_tmp = strtok (basic_authorization, ":");
+  if (NULL == client_id_tmp)
+  {
+    GNUNET_free (basic_authorization);
+    return GNUNET_SYSERR;
+  }
+  pass = strtok (NULL, ":");
+  if (NULL == pass)
+  {
+    GNUNET_free (basic_authorization);
+    return GNUNET_SYSERR;
+  }
+  *client_id = strdup (client_id_tmp);
+  *client_secret = strdup (pass);
+  GNUNET_free (basic_authorization);
+  return GNUNET_OK;
+}
+
+
+static int
+parse_credentials_post_body (struct RequestHandle *handle,
+                             char **client_id,
+                             char **client_secret)
+{
+  struct GNUNET_HashCode cache_key;
+  char *client_id_tmp;
+  char *pass;
+
+  GNUNET_CRYPTO_hash ("client_id",
+                      strlen ("client_id"),
+                      &cache_key);
+  if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                           ->url_param_map,
+                                                           &cache_key))
+    return GNUNET_SYSERR;
+  client_id_tmp = GNUNET_CONTAINER_multihashmap_get (
+    handle->rest_handle->url_param_map,
+    &cache_key);
+  if (NULL == client_id_tmp)
+    return GNUNET_SYSERR;
+  *client_id = strdup (client_id_tmp);
+  GNUNET_CRYPTO_hash ("client_secret",
+                      strlen ("client_secret"),
+                      &cache_key);
+  if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                           ->url_param_map,
+                                                           &cache_key))
+  {
+    GNUNET_free (*client_id);
+    *client_id = NULL;
+    return GNUNET_SYSERR;
+  }
+  pass = GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map,
+                                            &cache_key);
+  if (NULL == pass)
+  {
+    GNUNET_free (*client_id);
+    *client_id = NULL;
+    return GNUNET_SYSERR;
+  }
+  *client_secret = strdup (pass);
+  return GNUNET_OK;
+}
+
+
+static int
+check_authorization (struct RequestHandle *handle,
+                     struct GNUNET_CRYPTO_PublicKey *cid)
+{
+  char *expected_pass;
+  char *received_cid;
+  char *received_cpw;
+  char *pkce_cv;
+
+  if (GNUNET_OK == parse_credentials_basic_auth (handle,
+                                                 &received_cid,
+                                                 &received_cpw))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received client credentials in HTTP AuthZ header\n");
+  }
+  else if (GNUNET_OK == parse_credentials_post_body (handle,
+                                                     &received_cid,
+                                                     &received_cpw))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received client credentials in POST body\n");
+  }
+  else
+  {
+    /** Allow public clients with PKCE **/
+    pkce_cv = get_url_parameter_copy (handle, OIDC_CODE_VERIFIER_KEY);
+    if (NULL == pkce_cv)
+    {
+      handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
+      handle->response_code = MHD_HTTP_UNAUTHORIZED;
+      return GNUNET_SYSERR;
+    }
+    handle->public_client = GNUNET_YES;
+    GNUNET_free (pkce_cv);
+    received_cid = get_url_parameter_copy (handle, OIDC_CLIENT_ID_KEY);
+    GNUNET_STRINGS_string_to_data (received_cid,
+                                   strlen (received_cid),
+                                   cid,
+                                   sizeof(struct GNUNET_CRYPTO_PublicKey));
+    GNUNET_free (received_cid);
+    return GNUNET_OK;
+
+  }
+
+  // check client password
+  if (GNUNET_OK == GNUNET_CONFIGURATION_get_value_string (oid_cfg,
+                                                          "reclaim-rest-plugin",
+                                                          "OIDC_CLIENT_HMAC_SECRET",
+                                                          &expected_pass))
+  {
+    if (0 != strcmp (expected_pass, received_cpw))
+    {
+      GNUNET_free (expected_pass);
+      handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
+      handle->response_code = MHD_HTTP_UNAUTHORIZED;
+      GNUNET_free (received_cpw);
+      GNUNET_free (received_cid);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_free (expected_pass);
+  }
+  else
+  {
+    GNUNET_free (received_cpw);
+    GNUNET_free (received_cid);
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc = GNUNET_strdup ("gnunet configuration failed");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    return GNUNET_SYSERR;
+  }
+  // check client_id
+  for (handle->ego_entry = ego_head; NULL != handle->ego_entry;
+       handle->ego_entry = handle->ego_entry->next)
+  {
+    if (0 == strcmp (handle->ego_entry->keystring, received_cid))
+      break;
+  }
+  if (NULL == handle->ego_entry)
+  {
+    GNUNET_free (received_cpw);
+    GNUNET_free (received_cid);
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_CLIENT);
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    return GNUNET_SYSERR;
+  }
+  GNUNET_STRINGS_string_to_data (received_cid,
+                                 strlen (received_cid),
+                                 cid,
+                                 sizeof(struct GNUNET_CRYPTO_PublicKey));
+
+  GNUNET_free (received_cpw);
+  GNUNET_free (received_cid);
+  return GNUNET_OK;
+}
+
+
+const struct EgoEntry *
+find_ego (struct RequestHandle *handle,
+          struct GNUNET_CRYPTO_PublicKey *test_key)
+{
+  struct EgoEntry *ego_entry;
+  struct GNUNET_CRYPTO_PublicKey pub_key;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+  {
+    GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &pub_key);
+    if (0 == GNUNET_memcmp (&pub_key, test_key))
+      return ego_entry;
+  }
+  return NULL;
+}
+
+
+/**
+ * Responds to token url-encoded POST request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
+                const char *url,
+                void *cls)
+{
+  struct RequestHandle *handle = cls;
+  const struct EgoEntry *ego_entry = NULL;
+  struct GNUNET_TIME_Relative expiration_time;
+  struct GNUNET_RECLAIM_AttributeList *cl = NULL;
+  struct GNUNET_RECLAIM_PresentationList *pl = NULL;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  struct GNUNET_CRYPTO_PublicKey cid;
+  struct GNUNET_HashCode cache_key;
+  struct MHD_Response *resp = NULL;
+  char *grant_type = NULL;
+  char *code = NULL;
+  char *json_response = NULL;
+  char *id_token = NULL;
+  char *access_token = NULL;
+  char *jwa = NULL;
+  char *jwt_secret = NULL;
+  char *nonce = NULL;
+  char *code_verifier = NULL;
+  json_t *oidc_jwk = NULL;
+  char *oidc_jwk_path = NULL;
+  char *oidc_directory = NULL;
+  char *tmp_at = NULL;
+
+  /*
+   * Check Authorization
+   */
+  if (GNUNET_SYSERR == check_authorization (handle, &cid))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "OIDC authorization for token endpoint failed\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  /*
+   * Check parameter
+   */
+
+  // TODO Do not allow multiple equal parameter names
+  // REQUIRED grant_type
+  GNUNET_CRYPTO_hash (OIDC_GRANT_TYPE_KEY,
+                      strlen (OIDC_GRANT_TYPE_KEY),
+                      &cache_key);
+  grant_type = get_url_parameter_copy (handle, OIDC_GRANT_TYPE_KEY);
+  if (NULL == grant_type)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("missing parameter grant_type");
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // Check parameter grant_type == "authorization_code"
+  if (0 != strcmp (OIDC_GRANT_TYPE_VALUE, grant_type))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_UNSUPPORTED_GRANT_TYPE);
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_free (grant_type);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  GNUNET_free (grant_type);
+  // REQUIRED code
+  code = get_url_parameter_copy (handle, OIDC_CODE_KEY);
+  if (NULL == code)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("missing parameter code");
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  ego_entry = find_ego (handle, &cid);
+  if (NULL == ego_entry)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("Unknown client");
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_free (code);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // REQUIRED code verifier
+  code_verifier = get_url_parameter_copy (handle, OIDC_CODE_VERIFIER_KEY);
+  if (NULL == code_verifier)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "OAuth authorization request does not contain PKCE parameters!\n");
+
+  }
+
+  // decode code
+  if (GNUNET_OK != OIDC_parse_authz_code (&cid, code, code_verifier, &ticket,
+                                          &cl, &pl, &nonce,
+                                          OIDC_VERIFICATION_DEFAULT))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("invalid code");
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_free (code);
+    if (NULL != code_verifier)
+      GNUNET_free (code_verifier);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (NULL != code_verifier)
+    GNUNET_free (code_verifier);
+
+  // create jwt
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_time (oid_cfg,
+                                                        "reclaim-rest-plugin",
+                                                        "expiration_time",
+                                                        &expiration_time))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_SERVER_ERROR);
+    handle->edesc = GNUNET_strdup ("gnunet configuration failed");
+    handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+    GNUNET_free (code);
+    if (NULL != nonce)
+      GNUNET_free (nonce);
+    GNUNET_RECLAIM_attribute_list_destroy (cl);
+    GNUNET_RECLAIM_presentation_list_destroy (pl);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // Check if HMAC or RSA should be used
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (oid_cfg,
+                                                          "reclaim-rest-plugin",
+                                                          "oidc_json_web_algorithm",
+                                                          &jwa))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Could not read OIDC JSON Web Algorithm config attribute."
+                "Defaulting to RS256.");
+    jwa = JWT_ALG_VALUE_RSA;
+  }
+
+  if (! strcmp (jwa, JWT_ALG_VALUE_RSA))
+  {
+    // Replace for now
+    oidc_jwk_path = get_oidc_jwk_path (cls);
+    oidc_jwk = read_jwk_from_file (oidc_jwk_path);
+
+    // Check if secret JWK exists
+    if (! oidc_jwk)
+    {
+      // Generate and save a new key
+      oidc_jwk = generate_jwk ();
+      oidc_directory = get_oidc_dir_path (cls);
+
+      // Create new oidc directory
+      if (GNUNET_OK != GNUNET_DISK_directory_create (oidc_directory))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    ("Failed to create directory `%s' for storing oidc data\n"),
+                    oidc_directory);
+      }
+      else
+      {
+        write_jwk_to_file (oidc_jwk_path, oidc_jwk);
+      }
+    }
+
+    // Generate oidc token
+    id_token = OIDC_generate_id_token_rsa (&ticket.audience,
+                                           &ticket.identity,
+                                           cl,
+                                           pl,
+                                           &expiration_time,
+                                           (NULL != nonce) ? nonce : NULL,
+                                           oidc_jwk);
+  }
+  else if (! strcmp (jwa, JWT_ALG_VALUE_HMAC))
+  {
+    // TODO OPTIONAL acr,amr,azp
+    if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (oid_cfg,
+                                                            "reclaim-rest-plugin",
+                                                            "jwt_secret",
+                                                            &jwt_secret))
+    {
+      handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+      handle->edesc = GNUNET_strdup ("No signing secret configured!");
+      handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
+      GNUNET_free (code);
+      GNUNET_RECLAIM_attribute_list_destroy (cl);
+      GNUNET_RECLAIM_presentation_list_destroy (pl);
+      if (NULL != nonce)
+        GNUNET_free (nonce);
+      GNUNET_SCHEDULER_add_now (&do_error, handle);
+      return;
+    }
+
+    id_token = OIDC_generate_id_token_hmac (&ticket.audience,
+                                            &ticket.identity,
+                                            cl,
+                                            pl,
+                                            &expiration_time,
+                                            (NULL != nonce) ? nonce : NULL,
+                                            jwt_secret);
+
+    GNUNET_free (jwt_secret);
+  }
+  else
+  {
+    // TODO: OPTION NOT FOUND ERROR
+  }
+
+  if (NULL != nonce)
+    GNUNET_free (nonce);
+  access_token = OIDC_access_token_new (&ticket);
+  /**
+   * Store mapping from access token to code so we can later
+   * fall back on the provided attributes in userinfo one time.
+   */
+  GNUNET_CRYPTO_hash (access_token,
+                      strlen (access_token),
+                      &cache_key);
+  /**
+   * Note to future self: This cache has the following purpose:
+   * Some OIDC plugins call the userendpoint right after receiving an
+   * ID token and access token. There are reasons why this would make sense.
+   * Others not so much.
+   * In any case, in order to smoothen out the user experience upon login
+   * (authorization), we speculatively cache the next
+   * userinfo response in case the actual resolution through reclaim/GNS
+   * takes too long.
+   */
+  tmp_at = GNUNET_CONTAINER_multihashmap_get (oidc_code_cache,
+                                              &cache_key);
+  GNUNET_CONTAINER_multihashmap_put (oidc_code_cache,
+                                     &cache_key,
+                                     code,
+                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  /* If there was a previous code in there, free the old value */
+  if (NULL != tmp_at)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "OIDC access token already issued. Cleanup.\n");
+    GNUNET_free (tmp_at);
+  }
+
+  OIDC_build_token_response (access_token,
+                             id_token,
+                             &expiration_time,
+                             &json_response);
+
+  resp = GNUNET_REST_create_response (json_response);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Cache-Control",
+                                                    "no-store"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Pragma", "no-cache"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_RECLAIM_attribute_list_destroy (cl);
+  GNUNET_RECLAIM_presentation_list_destroy (pl);
+  GNUNET_free (access_token);
+  GNUNET_free (json_response);
+  GNUNET_free (id_token);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Collects claims and stores them in handle
+ */
+static void
+consume_ticket (void *cls,
+                const struct GNUNET_CRYPTO_PublicKey *identity,
+                const struct GNUNET_RECLAIM_Attribute *attr,
+                const struct GNUNET_RECLAIM_Presentation *presentation)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_AttributeListEntry *ale;
+  struct GNUNET_RECLAIM_PresentationListEntry *atle;
+  struct MHD_Response *resp;
+  struct GNUNET_HashCode cache_key;
+  char *result_str;
+  char *cached_code;
+
+  if (NULL != handle->consume_timeout_op)
+    GNUNET_SCHEDULER_cancel (handle->consume_timeout_op);
+  handle->consume_timeout_op = NULL;
+  handle->idp_op = NULL;
+
+  /**
+   * We received a reply. In any case clear the cache.
+   */
+  GNUNET_CRYPTO_hash (handle->access_token,
+                      strlen (handle->access_token),
+                      &cache_key);
+  cached_code = GNUNET_CONTAINER_multihashmap_get (oidc_code_cache,
+                                                   &cache_key);
+  if (NULL != cached_code)
+  {
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_remove (oidc_code_cache,
+                                                         &cache_key,
+                                                         cached_code));
+    GNUNET_free (cached_code);
+  }
+
+
+  if (NULL == identity)
+  {
+    result_str = OIDC_generate_userinfo (&handle->ticket.identity,
+                                         handle->attr_userinfo_list,
+                                         handle->presentations);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Userinfo: %s\n", result_str);
+    resp = GNUNET_REST_create_response (result_str);
+    handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+    GNUNET_free (result_str);
+    cleanup_handle (handle);
+    return;
+  }
+  ale = GNUNET_new (struct GNUNET_RECLAIM_AttributeListEntry);
+  ale->attribute = GNUNET_RECLAIM_attribute_new (attr->name,
+                                                 &attr->credential,
+                                                 attr->type,
+                                                 attr->data,
+                                                 attr->data_size);
+  ale->attribute->id = attr->id;
+  ale->attribute->flag = attr->flag;
+  ale->attribute->credential = attr->credential;
+  GNUNET_CONTAINER_DLL_insert (handle->attr_userinfo_list->list_head,
+                               handle->attr_userinfo_list->list_tail,
+                               ale);
+  if (NULL == presentation)
+    return;
+  for (atle = handle->presentations->list_head;
+       NULL != atle; atle = atle->next)
+  {
+    if (GNUNET_NO == GNUNET_RECLAIM_id_is_equal (
+          &atle->presentation->credential_id,
+          &presentation->credential_id))
+      continue;
+    break; /** already in list **/
+  }
+  if (NULL == atle)
+  {
+    /** Credential matches for attribute, add **/
+    atle = GNUNET_new (struct GNUNET_RECLAIM_PresentationListEntry);
+    atle->presentation = GNUNET_RECLAIM_presentation_new (presentation->type,
+                                                          presentation->data,
+                                                          presentation->
+                                                          data_size);
+    atle->presentation->credential_id = presentation->credential_id;
+    GNUNET_CONTAINER_DLL_insert (handle->presentations->list_head,
+                                 handle->presentations->list_tail,
+                                 atle);
+  }
+}
+
+
+static void
+consume_fail (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_HashCode cache_key;
+  struct GNUNET_RECLAIM_AttributeList *cl = NULL;
+  struct GNUNET_RECLAIM_PresentationList *pl = NULL;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  struct MHD_Response *resp;
+  char *nonce;
+  char *cached_code;
+  char *result_str;
+
+
+  handle->consume_timeout_op = NULL;
+  if (NULL != handle->idp_op)
+    GNUNET_RECLAIM_cancel (handle->idp_op);
+  handle->idp_op = NULL;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+              "Ticket consumptioned timed out. Using cache...\n");
+  GNUNET_CRYPTO_hash (handle->access_token,
+                      strlen (handle->access_token),
+                      &cache_key);
+  cached_code = GNUNET_CONTAINER_multihashmap_get (oidc_code_cache,
+                                                   &cache_key);
+  if (NULL == cached_code)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("No Access Token in cache!");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    return;
+  }
+  /**
+   * Remove the cached item
+   */
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (oidc_code_cache,
+                                                       &cache_key,
+                                                       cached_code));
+
+  // decode code
+  if (GNUNET_OK != OIDC_parse_authz_code (&handle->ticket.audience,
+                                          cached_code, NULL, &ticket,
+                                          &cl, &pl, &nonce,
+                                          OIDC_VERIFICATION_NO_CODE_VERIFIER))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_REQUEST);
+    handle->edesc = GNUNET_strdup ("invalid code");
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+    GNUNET_free (cached_code);
+    if (NULL != nonce)
+      GNUNET_free (nonce);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  GNUNET_free (cached_code);
+
+  result_str = OIDC_generate_userinfo (&handle->ticket.identity,
+                                       cl,
+                                       pl);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Userinfo: %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result_str);
+  GNUNET_free (nonce);
+  GNUNET_RECLAIM_attribute_list_destroy (cl);
+  GNUNET_RECLAIM_presentation_list_destroy (pl);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Responds to userinfo GET and url-encoded POST request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+userinfo_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
+                   const char *url,
+                   void *cls)
+{
+  // TODO expiration time
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_Ticket *ticket;
+  char delimiter[] = " ";
+  struct GNUNET_HashCode cache_key;
+  char *authorization;
+  char *authorization_type;
+  char *authorization_access_token;
+  const struct EgoEntry *aud_ego;
+  const struct GNUNET_CRYPTO_PrivateKey *privkey;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Getting userinfo\n");
+  GNUNET_CRYPTO_hash (OIDC_AUTHORIZATION_HEADER_KEY,
+                      strlen (OIDC_AUTHORIZATION_HEADER_KEY),
+                      &cache_key);
+  if (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains (handle->rest_handle
+                                                           ->header_param_map,
+                                                           &cache_key))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("No Access Token");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    return;
+  }
+  authorization =
+    GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->header_param_map,
+                                       &cache_key);
+
+  // split header in "Bearer" and access_token
+  authorization = GNUNET_strdup (authorization);
+  authorization_type = strtok (authorization, delimiter);
+  if ((NULL == authorization_type) ||
+      (0 != strcmp ("Bearer", authorization_type)))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("No Access Token");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    GNUNET_free (authorization);
+    return;
+  }
+  authorization_access_token = strtok (NULL, delimiter);
+  if (NULL == authorization_access_token)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("Access token missing");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    GNUNET_free (authorization);
+    return;
+  }
+
+  if (GNUNET_OK != OIDC_access_token_parse (authorization_access_token,
+                                            &ticket))
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("The access token is invalid");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    GNUNET_free (authorization);
+    return;
+
+  }
+  GNUNET_assert (NULL != ticket);
+  handle->ticket = *ticket;
+  GNUNET_free (ticket);
+  aud_ego = find_ego (handle, &handle->ticket.audience);
+  if (NULL == aud_ego)
+  {
+    handle->emsg = GNUNET_strdup (OIDC_ERROR_KEY_INVALID_TOKEN);
+    handle->edesc = GNUNET_strdup ("The access token expired");
+    handle->response_code = MHD_HTTP_UNAUTHORIZED;
+    GNUNET_SCHEDULER_add_now (&do_userinfo_error, handle);
+    GNUNET_free (authorization);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Consuming ticket\n");
+  privkey = GNUNET_IDENTITY_ego_get_private_key (aud_ego->ego);
+  handle->attr_userinfo_list =
+    GNUNET_new (struct GNUNET_RECLAIM_AttributeList);
+  handle->presentations =
+    GNUNET_new (struct GNUNET_RECLAIM_PresentationList);
+
+  /* If the consume takes too long, we use values from the cache */
+  handle->access_token = GNUNET_strdup (authorization_access_token);
+  handle->consume_timeout_op = GNUNET_SCHEDULER_add_delayed (consume_timeout,
+                                                             &consume_fail,
+                                                             handle);
+  handle->idp_op = GNUNET_RECLAIM_ticket_consume (idp,
+                                                  privkey,
+                                                  &handle->ticket,
+                                                  &consume_ticket,
+                                                  handle);
+  GNUNET_free (authorization);
+}
+
+
+/**
+ * Responds to /jwks.json
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+jwks_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
+               const char *url,
+               void *cls)
+{
+  char *oidc_directory;
+  char *oidc_jwk_path;
+  char *oidc_jwk_pub_str;
+  json_t *oidc_jwk;
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  oidc_jwk_path = get_oidc_jwk_path (cls);
+  oidc_jwk = read_jwk_from_file (oidc_jwk_path);
+
+  // Check if secret JWK exists
+  if (! oidc_jwk)
+  {
+    // Generate and save a new key
+    oidc_jwk = generate_jwk ();
+    oidc_directory = get_oidc_dir_path (cls);
+
+    // Create new oidc directory
+    if (GNUNET_OK != GNUNET_DISK_directory_create (oidc_directory))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  ("Failed to create directory `%s' for storing oidc data\n"),
+                  oidc_directory);
+    }
+    else
+    {
+      write_jwk_to_file (oidc_jwk_path, oidc_jwk);
+    }
+  }
+
+  // Convert secret JWK to public JWK
+  jose_jwk_pub (NULL, oidc_jwk);
+
+  // Encode JWK as string and return to API endpoint
+  oidc_jwk_pub_str = json_dumps (oidc_jwk, JSON_INDENT (1));
+  resp = GNUNET_REST_create_response (oidc_jwk_pub_str);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  json_decref (oidc_jwk);
+  GNUNET_free (oidc_jwk_pub_str);
+  GNUNET_free (oidc_jwk_pub_str);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * If listing is enabled, prints information about the egos.
+ *
+ * This function is initially called for all egos and then again
+ * whenever a ego's identifier changes or if it is deleted.  At the
+ * end of the initial pass over all egos, the function is once called
+ * with 'NULL' for 'ego'. That does NOT mean that the callback won't
+ * be invoked in the future or that there was an error.
+ *
+ * When used with 'GNUNET_IDENTITY_create' or 'GNUNET_IDENTITY_get', this
+ * function is only called ONCE, and 'NULL' being passed in 'ego' does
+ * indicate an error (for example because name is taken or no default value is
+ * known).  If 'ego' is non-NULL and if '*ctx' is set in those callbacks, the
+ * value WILL be passed to a subsequent call to the identity callback of
+ * 'GNUNET_IDENTITY_connect' (if that one was not NULL).
+ *
+ * When an identity is renamed, this function is called with the
+ * (known) ego but the NEW identifier.
+ *
+ * When an identity is deleted, this function is called with the
+ * (known) ego and "NULL" for the 'identifier'.  In this case,
+ * the 'ego' is henceforth invalid (and the 'ctx' should also be
+ * cleaned up).
+ *
+ * @param cls closure
+ * @param ego ego handle
+ * @param ctx context for application to store data for this ego
+ *                 (during the lifetime of this process, initially NULL)
+ * @param identifier identifier assigned by the user for this ego,
+ *                   NULL if the user just deleted the ego and it
+ *                   must thus no longer be used
+ */
+static void
+list_ego (void *cls,
+          struct GNUNET_IDENTITY_Ego *ego,
+          void **ctx,
+          const char *identifier)
+{
+  struct EgoEntry *ego_entry;
+  struct GNUNET_CRYPTO_PublicKey pk;
+
+  if (NULL == ego)
+  {
+    state = ID_REST_STATE_POST_INIT;
+    return;
+  }
+  if (ID_REST_STATE_INIT == state)
+
+  {
+    ego_entry = GNUNET_new (struct EgoEntry);
+    GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+    ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+    ego_entry->ego = ego;
+    ego_entry->identifier = GNUNET_strdup (identifier);
+    GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                      ego_tail,
+                                      ego_entry);
+    return;
+  }
+  /* Ego renamed or added */
+  if (identifier != NULL)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+      {
+        /* Rename */
+        GNUNET_free (ego_entry->identifier);
+        ego_entry->identifier = GNUNET_strdup (identifier);
+        break;
+      }
+    }
+    if (NULL == ego_entry)
+    {
+      /* Add */
+      ego_entry = GNUNET_new (struct EgoEntry);
+      GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+      ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+      ego_entry->ego = ego;
+      ego_entry->identifier = GNUNET_strdup (identifier);
+      GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                        ego_tail,
+                                        ego_entry);
+    }
+  }
+  else
+  {
+    /* Delete */
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+        break;
+    }
+    if (NULL == ego_entry)
+      return; /* Not found */
+
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 ego_entry);
+    GNUNET_free (ego_entry->identifier);
+    GNUNET_free (ego_entry->keystring);
+    GNUNET_free (ego_entry);
+    return;
+  }
+}
+
+
+static void
+oidc_config_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
+                      const char *url,
+                      void *cls)
+{
+  json_t *oidc_config;
+  json_t *auth_methods;
+  json_t *sig_algs;
+  json_t *scopes;
+  json_t *response_types;
+  json_t *sub_types;
+  json_t *claim_types;
+  char *oidc_config_str;
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  oidc_config = json_object ();
+  // FIXME get from config?
+  json_object_set_new (oidc_config,
+                       "issuer", json_string ("http://localhost:7776"));
+  json_object_set_new (oidc_config,
+                       "authorization_endpoint",
+                       json_string ("https://api.reclaim/openid/authorize"));
+  json_object_set_new (oidc_config,
+                       "token_endpoint",
+                       json_string ("http://localhost:7776/openid/token"));
+  auth_methods = json_array ();
+  json_array_append_new (auth_methods,
+                         json_string ("client_secret_basic"));
+  json_array_append_new (auth_methods,
+                         json_string ("client_secret_post"));
+  json_object_set_new (oidc_config,
+                       "token_endpoint_auth_methods_supported",
+                       auth_methods);
+  sig_algs = json_array ();
+  json_array_append_new (sig_algs,
+                         json_string ("HS512"));
+  json_array_append_new (sig_algs,
+                         json_string ("RS256"));
+  json_object_set_new (oidc_config,
+                       "id_token_signing_alg_values_supported",
+                       sig_algs);
+  json_object_set_new (oidc_config,
+                       "jwks_uri",
+                       json_string ("http://localhost:7776/jwks.json"));
+  json_object_set_new (oidc_config,
+                       "userinfo_endpoint",
+                       json_string ("http://localhost:7776/openid/userinfo"));
+  scopes = json_array ();
+  json_array_append_new (scopes,
+                         json_string ("openid"));
+  json_array_append_new (scopes,
+                         json_string ("profile"));
+  json_array_append_new (scopes,
+                         json_string ("email"));
+  json_array_append_new (scopes,
+                         json_string ("address"));
+  json_array_append_new (scopes,
+                         json_string ("phone"));
+  json_object_set_new (oidc_config,
+                       "scopes_supported",
+                       scopes);
+  response_types = json_array ();
+  json_array_append_new (response_types,
+                         json_string ("code"));
+  json_object_set_new (oidc_config,
+                       "response_types_supported",
+                       response_types);
+  sub_types = json_array ();
+  json_array_append_new (sub_types,
+                         json_string ("public"));  /* no pairwise support */
+  json_object_set_new (oidc_config,
+                       "subject_types_supported",
+                       sub_types);
+  claim_types = json_array ();
+  json_array_append_new (claim_types,
+                         json_string ("normal"));
+  json_array_append_new (claim_types,
+                         json_string ("aggregated"));
+  json_object_set_new (oidc_config,
+                       "claim_types_supported",
+                       claim_types);
+  json_object_set_new (oidc_config,
+                       "claims_parameter_supported",
+                       json_boolean (1));
+  oidc_config_str = json_dumps (oidc_config, JSON_INDENT (1));
+  resp = GNUNET_REST_create_response (oidc_config_str);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  json_decref (oidc_config);
+  GNUNET_free (oidc_config_str);
+  cleanup_handle (handle);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+oidc_config_cors (struct GNUNET_REST_RequestHandle *con_handle,
+                  const char *url,
+                  void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // For now, independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          allow_methods));
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Origin",
+                                          "*"));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+  return;
+}
+
+
+enum GNUNET_GenericReturnValue
+REST_openid_process_request (void *plugin,
+                             struct GNUNET_REST_RequestHandle *rest_handle,
+                             GNUNET_REST_ResultProcessor proc,
+                             void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] =
+  { { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_AUTHORIZE, &authorize_endpoint },   // url-encoded
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_LOGIN, &login_cont },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_TOKEN, &token_endpoint },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
+    { MHD_HTTP_METHOD_POST, GNUNET_REST_API_NS_USERINFO, &userinfo_endpoint },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_JWKS, &jwks_endpoint },
+    { MHD_HTTP_METHOD_GET, GNUNET_REST_API_NS_OIDC_CONFIG,
+      &oidc_config_endpoint },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_OIDC_CONFIG,
+      &oidc_config_cors },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_OIDC, &options_cont },
+    GNUNET_REST_HANDLER_END };
+
+  handle->oidc = GNUNET_new (struct OIDC_Variables);
+  if (NULL == OIDC_cookie_jar_map)
+    OIDC_cookie_jar_map = GNUNET_CONTAINER_multihashmap_create (10,
+                                                                GNUNET_NO);
+  if (NULL == oidc_code_cache)
+    oidc_code_cache = GNUNET_CONTAINER_multihashmap_create (10,
+                                                            GNUNET_NO);
+
+  handle->response_code = 0;
+  handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+  handle->url = GNUNET_strdup (rest_handle->url);
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_timeout, handle);
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
+    return GNUNET_NO;
+
+  return GNUNET_YES;
+}
+
+
+/**
+   * Entry point for the plugin.
+   *
+   * @param cls Config info
+   * @return NULL on error, otherwise the plugin context
+   */
+void *
+REST_openid_init (const struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  oid_cfg = c;
+  if (NULL != plugin.cfg)
+    return NULL;     /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = oid_cfg;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_OIDC;
+  identity_handle = GNUNET_IDENTITY_connect (oid_cfg, &list_ego, NULL);
+  gns_handle = GNUNET_GNS_connect (oid_cfg);
+  idp = GNUNET_RECLAIM_connect (oid_cfg);
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_time (oid_cfg,
+                                                        "reclaim-rest-plugin",
+                                                        "OIDC_USERINFO_CONSUME_TIMEOUT",
+                                                        &consume_timeout))
+  {
+    consume_timeout = CONSUME_TIMEOUT;
+  }
+
+
+  state = ID_REST_STATE_INIT;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s, %s, %s, %s",
+                   MHD_HTTP_METHOD_GET,
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_PUT,
+                   MHD_HTTP_METHOD_DELETE,
+                   MHD_HTTP_METHOD_OPTIONS);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              _ ("OpenID Connect REST API initialized\n"));
+  return api;
+}
+
+
+static int
+cleanup_hashmap (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  GNUNET_free (value);
+  return GNUNET_YES;
+}
+
+
+/**
+   * Exit point from the plugin.
+   *
+   * @param cls the plugin context (as returned by "init")
+   * @return always NULL
+   */
+void *
+REST_openid_done (void *cls)
+{
+  struct GNUNET_REST_Plugin *api = cls;
+  struct Plugin *plugin = api->cls;
+  struct EgoEntry *ego_entry;
+
+  plugin->cfg = NULL;
+  while (NULL != requests_head)
+    cleanup_handle (requests_head);
+  if (NULL != OIDC_cookie_jar_map)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (OIDC_cookie_jar_map,
+                                           &cleanup_hashmap,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (OIDC_cookie_jar_map);
+  }
+  if (NULL != oidc_code_cache)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (oidc_code_cache,
+                                           &cleanup_hashmap,
+                                           NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (oidc_code_cache);
+  }
+
+  GNUNET_free (allow_methods);
+  if (NULL != gns_handle)
+    GNUNET_GNS_disconnect (gns_handle);
+  if (NULL != identity_handle)
+    GNUNET_IDENTITY_disconnect (identity_handle);
+  if (NULL != idp)
+    GNUNET_RECLAIM_disconnect (idp);
+  while (NULL != (ego_entry = ego_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 ego_entry);
+    GNUNET_free (ego_entry->identifier);
+    GNUNET_free (ego_entry->keystring);
+    GNUNET_free (ego_entry);
+  }
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "OpenID Connect REST plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_rest_openid_connect.c */
diff --git a/src/service/rest/openid_plugin.h b/src/service/rest/openid_plugin.h
new file mode 100644
index 000000000..65545ac66
--- /dev/null
+++ b/src/service/rest/openid_plugin.h
@@ -0,0 +1,36 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_openid_process_request (void *plugin,
+                             struct GNUNET_REST_RequestHandle *conndata_handle,
+                             GNUNET_REST_ResultProcessor proc,
+                             void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_openid_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_openid_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/rest/pabc_plugin.c b/src/service/rest/pabc_plugin.c
new file mode 100644
index 000000000..4b7d21df3
--- /dev/null
+++ b/src/service/rest/pabc_plugin.c
@@ -0,0 +1,667 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @file reclaim/plugin_rest_pabc.c
+ * @brief GNUnet pabc REST plugin
+ *
+ */
+#include "platform.h"
+#include "microhttpd.h"
+#include <inttypes.h>
+#include <jansson.h>
+#include <pabc/pabc.h>
+#include "gnunet_reclaim_lib.h"
+#include "gnunet_reclaim_service.h"
+#include "gnunet_rest_lib.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_signatures.h"
+#include "pabc_helper.h"
+
+/**
+ * REST root namespace
+ */
+#define GNUNET_REST_API_NS_PABC "/pabc"
+
+/**
+ * Credential request endpoint
+ */
+#define GNUNET_REST_API_NS_PABC_CR "/pabc/cr"
+
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * Error response message
+   */
+  char *emsg;
+
+  /**
+   * Response code
+   */
+  int response_code;
+
+  /**
+   * Response object
+   */
+  json_t *resp_object;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+
+/**
+ * Cleanup lookup handle
+ * @param handle Handle to clean up
+ */
+static void
+cleanup_handle (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->resp_object)
+    json_decref (handle->resp_object);
+  if (NULL != handle->timeout_task)
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  if (NULL != handle->emsg)
+    GNUNET_free (handle->emsg);
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on error, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *json_error;
+
+  GNUNET_asprintf (&json_error, "{ \"error\" : \"%s\" }", handle->emsg);
+  if (0 == handle->response_code)
+  {
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+  }
+  resp = GNUNET_REST_create_response (json_error);
+  MHD_add_response_header (resp, "Content-Type", "application/json");
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  cleanup_handle (handle);
+  GNUNET_free (json_error);
+}
+
+
+/**
+ * Task run on timeout, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_timeout (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->timeout_task = NULL;
+  do_error (handle);
+}
+
+
+static void
+return_response (void *cls)
+{
+  char *result_str;
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  result_str = json_dumps (handle->resp_object, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result_str);
+  cleanup_handle (handle);
+}
+
+
+static enum pabc_status
+set_attributes_from_idtoken (const struct pabc_context *ctx,
+                             const struct pabc_public_parameters *pp,
+                             struct pabc_user_context *usr_ctx,
+                             const char *id_token)
+{
+  json_t *payload_json;
+  json_t *value;
+  json_error_t json_err;
+  const char *key;
+  const char *jwt_body;
+  char *decoded_jwt;
+  char delim[] = ".";
+  char *jwt_string;
+  const char *pabc_key;
+  enum pabc_status status;
+
+  // FIXME parse JWT
+  jwt_string = GNUNET_strndup (id_token, strlen (id_token));
+  jwt_body = strtok (jwt_string, delim);
+  jwt_body = strtok (NULL, delim);
+  GNUNET_STRINGS_base64url_decode (jwt_body, strlen (jwt_body),
+                                   (void **) &decoded_jwt);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Decoded ID Token: %s\n", decoded_jwt);
+  payload_json = json_loads (decoded_jwt, JSON_DECODE_ANY, &json_err);
+  GNUNET_free (decoded_jwt);
+
+  json_object_foreach (payload_json, key, value)
+  {
+    pabc_key = key;
+    if (0 == strcmp ("iss", key))
+      pabc_key = "issuer"; // rename
+    if (0 == strcmp ("sub", key))
+      pabc_key = "subject"; // rename
+    if (0 == strcmp ("jti", key))
+      continue;
+    if (0 == strcmp ("exp", key))
+      pabc_key = "expiration"; // rename
+    if (0 == strcmp ("iat", key))
+      continue;
+    if (0 == strcmp ("nbf", key))
+      continue;
+    if (0 == strcmp ("aud", key))
+      continue;
+    char *tmp_val;
+    if (json_is_string (value))
+      tmp_val = GNUNET_strdup (json_string_value (value));
+    else
+      tmp_val = json_dumps (value, JSON_ENCODE_ANY);
+    if (NULL == tmp_val)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Unable to encode JSON value for `%s'\n", key);
+      continue;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Setting `%s' to `%s'\n", key, tmp_val);
+    status = pabc_set_attribute_value_by_name (ctx, pp, usr_ctx,
+                                               pabc_key,
+                                               tmp_val);
+    GNUNET_free (tmp_val);
+    if (PABC_OK != status)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Failed to set attribute `%s'.\n", key);
+    }
+  }
+  GNUNET_free (jwt_string);
+  return PABC_OK;
+}
+
+
+static enum GNUNET_GenericReturnValue
+setup_new_user_context (struct pabc_context *ctx,
+                        struct pabc_public_parameters *pp,
+                        struct pabc_user_context **usr_ctx)
+{
+  if (PABC_OK != pabc_new_user_context (ctx, pp, usr_ctx))
+    return GNUNET_SYSERR;
+
+  if (PABC_OK != pabc_populate_user_context (ctx, *usr_ctx))
+  {
+    pabc_free_user_context (ctx, pp, usr_ctx);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static void
+cr_cont (struct GNUNET_REST_RequestHandle *con_handle,
+         const char *url,
+         void *cls)
+{
+  struct RequestHandle *handle = cls;
+  char term_data[handle->rest_handle->data_size + 1];
+  char *response_str;
+  json_t *data_json;
+  json_t *nonce_json;
+  json_t *pp_json;
+  json_t *idtoken_json;
+  json_t *iss_json;
+  json_t *identity_json;
+  json_error_t err;
+  struct pabc_public_parameters *pp = NULL;
+  struct pabc_context *ctx = NULL;
+  struct pabc_user_context *usr_ctx = NULL;
+  struct pabc_credential_request *cr = NULL;
+  struct pabc_nonce *nonce = NULL;
+  enum pabc_status status;
+
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Credential request...\n");
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if (NULL == data_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse %s\n", term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (! json_is_object (data_json))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse %s\n", term_data);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  nonce_json = json_object_get (data_json, "nonce");
+  if (NULL == nonce_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse nonce\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  iss_json = json_object_get (data_json, "issuer");
+  if (NULL == iss_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse issuer\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity_json = json_object_get (data_json, "identity");
+  if (NULL == identity_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse identity\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  idtoken_json = json_object_get (data_json, "id_token");
+  if (NULL == idtoken_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse id_token\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  pp_json = json_object_get (data_json, "public_params");
+  if (NULL == pp_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse public parameters\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  PABC_ASSERT (pabc_new_ctx (&ctx));
+  char *pp_str = json_dumps (pp_json, JSON_ENCODE_ANY);
+  status = pabc_decode_and_new_public_parameters (ctx,
+                                                  &pp,
+                                                  pp_str);
+  char *ppid;
+  GNUNET_assert (PABC_OK == pabc_cred_get_ppid_from_pp (pp_str, &ppid));
+  GNUNET_free (pp_str);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read public parameters: %s\n",
+                pp_str);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  // (Over)write parameters
+  status = PABC_write_public_parameters (json_string_value (iss_json),
+                                         pp);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to write public parameters.\n");
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  status = PABC_read_usr_ctx (json_string_value (identity_json),
+                              json_string_value (iss_json),
+                              ctx, pp, &usr_ctx);
+  if (PABC_OK != status)
+  {
+    if (GNUNET_OK != setup_new_user_context (ctx, pp, &usr_ctx))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to setup user context.\n");
+      pabc_free_public_parameters (ctx, &pp);
+      json_decref (data_json);
+      GNUNET_SCHEDULER_add_now (&do_error, handle);
+      return;
+    }
+    PABC_write_usr_ctx (json_string_value (identity_json),
+                        json_string_value (iss_json),
+                        ctx, pp, usr_ctx);
+  }
+
+  // Set attributes from JWT to context
+  status = set_attributes_from_idtoken (ctx,
+                                        pp,
+                                        usr_ctx,
+                                        json_string_value (idtoken_json));
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to set attributes.\n");
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+
+  // nonce
+  status = pabc_new_nonce (ctx, &nonce);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to allocate nonce.\n");
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  char *nonce_str = json_dumps (nonce_json, JSON_ENCODE_ANY);
+  status = pabc_decode_nonce (ctx, nonce, nonce_str);
+  if (status != PABC_OK)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to decode nonce.\n");
+    pabc_free_nonce (ctx, &nonce);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  // cr
+  status = pabc_new_credential_request (ctx, pp, &cr);
+  if (PABC_OK != status)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to allocate cr.\n");
+    pabc_free_nonce (ctx, &nonce);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  status = pabc_gen_credential_request (ctx, pp, usr_ctx, nonce, cr);
+  if (PABC_OK != status)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to generate cr.\n");
+    pabc_free_nonce (ctx, &nonce);
+    pabc_free_credential_request (ctx, pp, &cr);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  handle->resp_object = json_object ();
+  GNUNET_assert (PABC_OK == pabc_cred_encode_cr (ctx, pp, cr,
+                                                 json_string_value (
+                                                   identity_json),
+                                                 ppid, &response_str));
+  if (PABC_OK != status)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Failed to serialize cr.\n");
+    pabc_free_nonce (ctx, &nonce);
+    pabc_free_credential_request (ctx, pp, &cr);
+    pabc_free_user_context (ctx, pp, &usr_ctx);
+    pabc_free_public_parameters (ctx, &pp);
+    json_decref (data_json);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  json_decref (handle->resp_object);
+  handle->resp_object = json_loads (response_str, JSON_DECODE_ANY, &err);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "%s\n", response_str);
+  GNUNET_free (response_str);
+
+  // clean up
+  pabc_free_nonce (ctx, &nonce);
+  pabc_free_credential_request (ctx, pp, &cr);
+  pabc_free_user_context (ctx, pp, &usr_ctx);
+  pabc_free_public_parameters (ctx, &pp);
+  GNUNET_SCHEDULER_add_now (&return_response, handle);
+  json_decref (data_json);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // For now, independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+  return;
+}
+
+
+static enum GNUNET_GenericReturnValue
+rest_identity_process_request (struct GNUNET_REST_RequestHandle *rest_handle,
+                               GNUNET_REST_ResultProcessor proc,
+                               void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] = {
+    {MHD_HTTP_METHOD_POST,
+     GNUNET_REST_API_NS_PABC_CR, &cr_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_PABC, &options_cont },
+    GNUNET_REST_HANDLER_END
+  };
+
+  handle->response_code = 0;
+  handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+
+  handle->url = GNUNET_strdup (rest_handle->url);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_timeout, handle);
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls Config info
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+libgnunet_plugin_rest_pabc_init (void *cls)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  cfg = cls;
+  if (NULL != plugin.cfg)
+    return NULL; /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = cfg;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_PABC;
+  api->process_request = &rest_identity_process_request;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s",
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_OPTIONS);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              _ ("Identity Provider REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+libgnunet_plugin_rest_reclaim_done (void *cls)
+{
+  struct GNUNET_REST_Plugin *api = cls;
+  struct Plugin *plugin = api->cls;
+  struct RequestHandle *request;
+
+  plugin->cfg = NULL;
+  while (NULL != (request = requests_head))
+    do_error (request);
+
+  GNUNET_free (allow_methods);
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "PABC REST plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_rest_reclaim.c */
diff --git a/src/service/rest/reclaim_plugin.c b/src/service/rest/reclaim_plugin.c
new file mode 100644
index 000000000..677a6a676
--- /dev/null
+++ b/src/service/rest/reclaim_plugin.c
@@ -0,0 +1,1565 @@
+/*
+   This file is part of GNUnet.
+   Copyright (C) 2012-2015 GNUnet e.V.
+
+   GNUnet is free software: you can redistribute it and/or modify it
+   under the terms of the GNU Affero General Public License as published
+   by the Free Software Foundation, either version 3 of the License,
+   or (at your option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Affero General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+   SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Martin Schanzenbach
+ * @author Philippe Buschmann
+ * @file reclaim/plugin_rest_reclaim.c
+ * @brief GNUnet reclaim REST plugin
+ *
+ */
+#include "platform.h"
+#include "microhttpd.h"
+#include <inttypes.h>
+#include <jansson.h>
+#include "gnunet_gns_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_identity_service.h"
+#include "gnunet_reclaim_lib.h"
+#include "gnunet_reclaim_service.h"
+#include "gnunet_rest_lib.h"
+#include "gnunet_rest_plugin.h"
+#include "gnunet_signatures.h"
+#include "json_reclaim.h"
+/**
+ * REST root namespace
+ */
+#define GNUNET_REST_API_NS_RECLAIM "/reclaim"
+
+/**
+ * Attribute namespace
+ */
+#define GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES "/reclaim/attributes"
+
+/**
+ * Credential namespace
+ */
+#define GNUNET_REST_API_NS_RECLAIM_CREDENTIAL "/reclaim/credential"
+
+/**
+ * Ticket namespace
+ */
+#define GNUNET_REST_API_NS_IDENTITY_TICKETS "/reclaim/tickets"
+
+/**
+ * Revoke namespace
+ */
+#define GNUNET_REST_API_NS_IDENTITY_REVOKE "/reclaim/revoke"
+
+/**
+ * Revoke namespace
+ */
+#define GNUNET_REST_API_NS_IDENTITY_CONSUME "/reclaim/consume"
+
+/**
+ * State while collecting all egos
+ */
+#define ID_REST_STATE_INIT 0
+
+/**
+ * Done collecting egos
+ */
+#define ID_REST_STATE_POST_INIT 1
+
+/**
+ * The configuration handle
+ */
+const struct GNUNET_CONFIGURATION_Handle *rcfg;
+
+/**
+ * HTTP methods allows for this plugin
+ */
+static char *allow_methods;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_head;
+
+/**
+ * Ego list
+ */
+static struct EgoEntry *ego_tail;
+
+/**
+ * The processing state
+ */
+static int state;
+
+/**
+ * Handle to Identity service.
+ */
+static struct GNUNET_IDENTITY_Handle *identity_handle;
+
+/**
+ * Identity Provider
+ */
+static struct GNUNET_RECLAIM_Handle *idp;
+
+/**
+ * @brief struct returned by the initialization function of the plugin
+ */
+struct Plugin
+{
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+};
+
+/**
+ * The ego list
+ */
+struct EgoEntry
+{
+  /**
+   * DLL
+   */
+  struct EgoEntry *next;
+
+  /**
+   * DLL
+   */
+  struct EgoEntry *prev;
+
+  /**
+   * Ego Identifier
+   */
+  char *identifier;
+
+  /**
+   * Public key string
+   */
+  char *keystring;
+
+  /**
+   * The Ego
+   */
+  struct GNUNET_IDENTITY_Ego *ego;
+};
+
+
+struct RequestHandle
+{
+  /**
+   * DLL
+   */
+  struct RequestHandle *next;
+
+  /**
+   * DLL
+   */
+  struct RequestHandle *prev;
+
+  /**
+   * Selected ego
+   */
+  struct EgoEntry *ego_entry;
+
+  /**
+   * Pointer to ego private key
+   */
+  struct GNUNET_CRYPTO_PrivateKey priv_key;
+
+  /**
+   * Rest connection
+   */
+  struct GNUNET_REST_RequestHandle *rest_handle;
+
+  /**
+   * Attribute claim list
+   */
+  struct GNUNET_RECLAIM_AttributeList *attr_list;
+
+  /**
+   * IDENTITY Operation
+   */
+  struct GNUNET_IDENTITY_Operation *op;
+
+  /**
+   * Idp Operation
+   */
+  struct GNUNET_RECLAIM_Operation *idp_op;
+
+  /**
+   * Attribute iterator
+   */
+  struct GNUNET_RECLAIM_AttributeIterator *attr_it;
+
+  /**
+   * Attribute iterator
+   */
+  struct GNUNET_RECLAIM_CredentialIterator *cred_it;
+
+  /**
+   * Ticket iterator
+   */
+  struct GNUNET_RECLAIM_TicketIterator *ticket_it;
+
+  /**
+   * A ticket
+   */
+  struct GNUNET_RECLAIM_Ticket ticket;
+
+  /**
+   * Desired timeout for the lookup (default is no timeout).
+   */
+  struct GNUNET_TIME_Relative timeout;
+
+  /**
+   * ID of a task associated with the resolution process.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * The plugin result processor
+   */
+  GNUNET_REST_ResultProcessor proc;
+
+  /**
+   * The closure of the result processor
+   */
+  void *proc_cls;
+
+  /**
+   * The url
+   */
+  char *url;
+
+  /**
+   * Error response message
+   */
+  char *emsg;
+
+  /**
+   * Response code
+   */
+  int response_code;
+
+  /**
+   * Response object
+   */
+  json_t *resp_object;
+};
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_head;
+
+/**
+ * DLL
+ */
+static struct RequestHandle *requests_tail;
+
+
+/**
+ * Cleanup lookup handle
+ * @param handle Handle to clean up
+ */
+static void
+cleanup_handle (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Cleaning up\n");
+  if (NULL != handle->resp_object)
+    json_decref (handle->resp_object);
+  if (NULL != handle->timeout_task)
+    GNUNET_SCHEDULER_cancel (handle->timeout_task);
+  if (NULL != handle->attr_it)
+    GNUNET_RECLAIM_get_attributes_stop (handle->attr_it);
+  if (NULL != handle->cred_it)
+    GNUNET_RECLAIM_get_credentials_stop (handle->cred_it);
+  if (NULL != handle->ticket_it)
+    GNUNET_RECLAIM_ticket_iteration_stop (handle->ticket_it);
+  if (NULL != handle->url)
+    GNUNET_free (handle->url);
+  if (NULL != handle->emsg)
+    GNUNET_free (handle->emsg);
+  if (NULL != handle->attr_list)
+    GNUNET_RECLAIM_attribute_list_destroy (handle->attr_list);
+  GNUNET_CONTAINER_DLL_remove (requests_head,
+                               requests_tail,
+                               handle);
+  GNUNET_free (handle);
+}
+
+
+/**
+ * Task run on error, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_error (void *cls)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+  char *json_error;
+
+  GNUNET_asprintf (&json_error, "{ \"error\" : \"%s\" }", handle->emsg);
+  if (0 == handle->response_code)
+  {
+    handle->response_code = MHD_HTTP_BAD_REQUEST;
+  }
+  resp = GNUNET_REST_create_response (json_error);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp, "Content-Type",
+                                                    "application/json"));
+  handle->proc (handle->proc_cls, resp, handle->response_code);
+  cleanup_handle (handle);
+  GNUNET_free (json_error);
+}
+
+
+/**
+ * Task run on timeout, sends error message.  Cleans up everything.
+ *
+ * @param cls the `struct RequestHandle`
+ */
+static void
+do_timeout (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  handle->timeout_task = NULL;
+  do_error (handle);
+}
+
+
+static void
+collect_error_cb (void *cls)
+{
+  GNUNET_SCHEDULER_add_now (&do_error, cls);
+}
+
+
+static void
+finished_cont (void *cls, int32_t success, const char *emsg)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  handle->idp_op = NULL;
+  if (GNUNET_OK != success)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  resp = GNUNET_REST_create_response (emsg);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+static void
+delete_finished_cb (void *cls, int32_t success, const char *emsg)
+{
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  if (GNUNET_OK != success)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  resp = GNUNET_REST_create_response (emsg);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
+}
+
+
+/**
+ * Return attributes for identity
+ *
+ * @param cls the request handle
+ */
+static void
+return_response (void *cls)
+{
+  char *result_str;
+  struct RequestHandle *handle = cls;
+  struct MHD_Response *resp;
+
+  result_str = json_dumps (handle->resp_object, 0);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
+  resp = GNUNET_REST_create_response (result_str);
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  GNUNET_free (result_str);
+  cleanup_handle (handle);
+}
+
+
+static void
+collect_finished_cb (void *cls)
+{
+  struct RequestHandle *handle = cls;
+
+  // Done
+  handle->attr_it = NULL;
+  handle->cred_it = NULL;
+  handle->ticket_it = NULL;
+  GNUNET_SCHEDULER_add_now (&return_response, handle);
+}
+
+
+/**
+ * Collect all attributes for an ego
+ *
+ */
+static void
+ticket_collect (void *cls, const struct GNUNET_RECLAIM_Ticket *ticket)
+{
+  json_t *json_resource;
+  struct RequestHandle *handle = cls;
+  json_t *value;
+  char *tmp;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding ticket\n");
+  tmp = GNUNET_STRINGS_data_to_string_alloc (&ticket->rnd, sizeof(ticket->rnd));
+  json_resource = json_object ();
+  GNUNET_free (tmp);
+  json_array_append (handle->resp_object, json_resource);
+
+  tmp =
+    GNUNET_STRINGS_data_to_string_alloc (&ticket->identity,
+                                         sizeof(struct
+                                                GNUNET_CRYPTO_PublicKey));
+  value = json_string (tmp);
+  json_object_set_new (json_resource, "issuer", value);
+  GNUNET_free (tmp);
+  tmp =
+    GNUNET_STRINGS_data_to_string_alloc (&ticket->audience,
+                                         sizeof(struct
+                                                GNUNET_CRYPTO_PublicKey));
+  value = json_string (tmp);
+  json_object_set_new (json_resource, "audience", value);
+  GNUNET_free (tmp);
+  tmp = GNUNET_STRINGS_data_to_string_alloc (&ticket->rnd, sizeof(ticket->rnd));
+  value = json_string (tmp);
+  json_object_set_new (json_resource, "rnd", value);
+  GNUNET_free (tmp);
+  GNUNET_RECLAIM_ticket_iteration_next (handle->ticket_it);
+}
+
+
+static void
+add_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                     const char *url,
+                     void *cls)
+{
+  struct RequestHandle *handle = cls;
+  const struct GNUNET_CRYPTO_PrivateKey *identity_priv;
+  const char *identity;
+  struct EgoEntry *ego_entry;
+  struct GNUNET_RECLAIM_Credential *attribute;
+  struct GNUNET_TIME_Relative exp;
+  char term_data[handle->rest_handle->data_size + 1];
+  json_t *data_json;
+  json_error_t err;
+  struct GNUNET_JSON_Specification attrspec[] =
+  { GNUNET_RECLAIM_JSON_spec_credential (&attribute),
+    GNUNET_JSON_spec_end () };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Adding an credential for %s.\n",
+              handle->url);
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) >= strlen (
+        handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity = handle->url + strlen (
+    GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) + 1;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+
+  if (NULL == ego_entry)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Identity unknown (%s)\n", identity);
+    return;
+  }
+  identity_priv = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if (GNUNET_OK != GNUNET_JSON_parse (data_json, attrspec, NULL, NULL))
+  {
+    json_decref (data_json);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse JSON from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  json_decref (data_json);
+  if (NULL == attribute)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse credential from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  /**
+   * New ID for attribute
+   */
+  if (GNUNET_YES == GNUNET_RECLAIM_id_is_zero (&attribute->id))
+    GNUNET_RECLAIM_id_generate (&attribute->id);
+  exp = GNUNET_TIME_UNIT_HOURS;
+  handle->idp_op = GNUNET_RECLAIM_credential_store (idp,
+                                                    identity_priv,
+                                                    attribute,
+                                                    &exp,
+                                                    &finished_cont,
+                                                    handle);
+  GNUNET_JSON_parse_free (attrspec);
+}
+
+
+/**
+ * Collect all credentials for an ego
+ *
+ */
+static void
+cred_collect (void *cls,
+              const struct GNUNET_CRYPTO_PublicKey *identity,
+              const struct GNUNET_RECLAIM_Credential *cred)
+{
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_AttributeList *attrs;
+  struct GNUNET_RECLAIM_AttributeListEntry *ale;
+  struct GNUNET_TIME_Absolute exp;
+  json_t *attr_obj;
+  json_t *cred_obj;
+  const char *type;
+  char *tmp_value;
+  char *id_str;
+  char *issuer;
+
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding credential: %s\n",
+              cred->name);
+  attrs = GNUNET_RECLAIM_credential_get_attributes (cred);
+  issuer = GNUNET_RECLAIM_credential_get_issuer (cred);
+  tmp_value = GNUNET_RECLAIM_credential_value_to_string (cred->type,
+                                                         cred->data,
+                                                         cred->data_size);
+  cred_obj = json_object ();
+  json_object_set_new (cred_obj, "value", json_string (tmp_value));
+  json_object_set_new (cred_obj, "name", json_string (cred->name));
+  type = GNUNET_RECLAIM_credential_number_to_typename (cred->type);
+  json_object_set_new (cred_obj, "type", json_string (type));
+  if (NULL != issuer)
+  {
+    json_object_set_new (cred_obj, "issuer", json_string (issuer));
+    GNUNET_free (issuer);
+  }
+  if (GNUNET_OK == GNUNET_RECLAIM_credential_get_expiration (cred,
+                                                             &exp))
+  {
+    json_object_set_new (cred_obj, "expiration", json_integer (
+                           exp.abs_value_us));
+  }
+  id_str = GNUNET_STRINGS_data_to_string_alloc (&cred->id,
+                                                sizeof(cred->id));
+  json_object_set_new (cred_obj, "id", json_string (id_str));
+  GNUNET_free (tmp_value);
+  GNUNET_free (id_str);
+  if (NULL != attrs)
+  {
+    json_t *attr_arr = json_array ();
+    for (ale = attrs->list_head; NULL != ale; ale = ale->next)
+    {
+      tmp_value =
+        GNUNET_RECLAIM_attribute_value_to_string (ale->attribute->type,
+                                                  ale->attribute->data,
+                                                  ale->attribute->data_size);
+      attr_obj = json_object ();
+      json_object_set_new (attr_obj, "value", json_string (tmp_value));
+      json_object_set_new (attr_obj, "name", json_string (
+                             ale->attribute->name));
+
+      json_object_set_new (attr_obj, "flag", json_string ("1")); // FIXME
+      type = GNUNET_RECLAIM_attribute_number_to_typename (ale->attribute->type);
+      json_object_set_new (attr_obj, "type", json_string (type));
+      json_object_set_new (attr_obj, "id", json_string (""));
+      json_object_set_new (attr_obj, "credential", json_string (""));
+      json_array_append_new (attr_arr, attr_obj);
+      GNUNET_free (tmp_value);
+    }
+    json_object_set_new (cred_obj, "attributes", attr_arr);
+  }
+  json_array_append_new (handle->resp_object, cred_obj);
+  if (NULL != attrs)
+    GNUNET_RECLAIM_attribute_list_destroy (attrs);
+  GNUNET_RECLAIM_get_credentials_next (handle->cred_it);
+}
+
+
+/**
+ * Lists credential for identity request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+list_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                      const char *url,
+                      void *cls)
+{
+  struct RequestHandle *handle = cls;
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct EgoEntry *ego_entry;
+  char *identity;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Getting credentials for %s.\n",
+              handle->url);
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) >= strlen (
+        handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity = handle->url + strlen (
+    GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) + 1;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+  handle->resp_object = json_array ();
+
+
+  if (NULL == ego_entry)
+  {
+    // Done
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ego %s not found.\n", identity);
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+  priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  handle->cred_it = GNUNET_RECLAIM_get_credentials_start (idp,
+                                                          priv_key,
+                                                          &collect_error_cb,
+                                                          handle,
+                                                          &cred_collect,
+                                                          handle,
+                                                          &
+                                                          collect_finished_cb,
+                                                          handle);
+}
+
+
+/**
+ * Deletes credential from an identity
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+delete_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                        const char *url,
+                        void *cls)
+{
+  struct RequestHandle *handle = cls;
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct GNUNET_RECLAIM_Credential attr;
+  struct EgoEntry *ego_entry;
+  char *identity_id_str;
+  char *identity;
+  char *id;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Deleting credential.\n");
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) >= strlen (
+        handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity_id_str =
+    strdup (handle->url + strlen (
+              GNUNET_REST_API_NS_RECLAIM_CREDENTIAL) + 1);
+  identity = strtok (identity_id_str, "/");
+  id = strtok (NULL, "/");
+  if ((NULL == identity) || (NULL == id))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Malformed request.\n");
+    GNUNET_free (identity_id_str);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+  handle->resp_object = json_array ();
+  if (NULL == ego_entry)
+  {
+    // Done
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ego %s not found.\n", identity);
+    GNUNET_free (identity_id_str);
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+  priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  memset (&attr, 0, sizeof(struct GNUNET_RECLAIM_Credential));
+  GNUNET_STRINGS_string_to_data (id, strlen (id), &attr.id, sizeof(attr.id));
+  attr.name = "";
+  handle->idp_op = GNUNET_RECLAIM_credential_delete (idp,
+                                                     priv_key,
+                                                     &attr,
+                                                     &delete_finished_cb,
+                                                     handle);
+  GNUNET_free (identity_id_str);
+}
+
+
+/**
+ * List tickets for identity request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+list_tickets_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                   const char *url,
+                   void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *identity;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Getting tickets for %s.\n",
+              handle->url);
+  if (strlen (GNUNET_REST_API_NS_IDENTITY_TICKETS) >= strlen (handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity = handle->url + strlen (GNUNET_REST_API_NS_IDENTITY_TICKETS) + 1;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+  handle->resp_object = json_array ();
+
+  if (NULL == ego_entry)
+  {
+    // Done
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ego %s not found.\n", identity);
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+  priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  handle->ticket_it =
+    GNUNET_RECLAIM_ticket_iteration_start (idp,
+                                           priv_key,
+                                           &collect_error_cb,
+                                           handle,
+                                           &ticket_collect,
+                                           handle,
+                                           &collect_finished_cb,
+                                           handle);
+}
+
+
+static void
+add_attribute_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                    const char *url,
+                    void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *identity_priv;
+  const char *identity;
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  struct GNUNET_RECLAIM_Attribute *attribute;
+  struct GNUNET_TIME_Relative exp;
+  char term_data[handle->rest_handle->data_size + 1];
+  json_t *data_json;
+  json_error_t err;
+  struct GNUNET_JSON_Specification attrspec[] =
+  { GNUNET_RECLAIM_JSON_spec_attribute (&attribute), GNUNET_JSON_spec_end () };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Adding an attribute for %s.\n",
+              handle->url);
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) >= strlen (handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity = handle->url + strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) + 1;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+
+  if (NULL == ego_entry)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Identity unknown (%s)\n", identity);
+    return;
+  }
+  identity_priv = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_JSON_parse (data_json, attrspec, NULL, NULL));
+  json_decref (data_json);
+  if (NULL == attribute)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse attribute from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  /**
+   * New ID for attribute
+   */
+  if (GNUNET_YES == GNUNET_RECLAIM_id_is_zero (&attribute->id))
+    GNUNET_RECLAIM_id_generate (&attribute->id);
+  exp = GNUNET_TIME_UNIT_HOURS;
+  handle->idp_op = GNUNET_RECLAIM_attribute_store (idp,
+                                                   identity_priv,
+                                                   attribute,
+                                                   &exp,
+                                                   &finished_cont,
+                                                   handle);
+  GNUNET_JSON_parse_free (attrspec);
+}
+
+
+/**
+ * Parse a JWT and return the respective claim value as Attribute
+ *
+ * @param cred the jwt credential
+ * @param claim the name of the claim in the JWT
+ *
+ * @return a GNUNET_RECLAIM_Attribute, containing the new value
+ */
+struct GNUNET_RECLAIM_Attribute *
+parse_jwt (const struct GNUNET_RECLAIM_Credential *cred,
+           const char *claim)
+{
+  char *jwt_string;
+  struct GNUNET_RECLAIM_Attribute *attr;
+  char delim[] = ".";
+  const char *type_str = NULL;
+  const char *val_str = NULL;
+  char *data;
+  size_t data_size;
+  uint32_t type;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Parsing JWT attributes.\n");
+  char *decoded_jwt;
+  json_t *json_val;
+  json_error_t *json_err = NULL;
+
+  jwt_string = GNUNET_RECLAIM_credential_value_to_string (cred->type,
+                                                          cred->data,
+                                                          cred->data_size);
+  char *jwt_body = strtok (jwt_string, delim);
+  jwt_body = strtok (NULL, delim);
+  GNUNET_STRINGS_base64_decode (jwt_body, strlen (jwt_body),
+                                (void **) &decoded_jwt);
+  json_val = json_loads (decoded_jwt, JSON_DECODE_ANY, json_err);
+  const char *key;
+  json_t *value;
+  json_object_foreach (json_val, key, value) {
+    if (0 == strcasecmp (key,claim))
+    {
+      val_str = json_dumps (value, JSON_ENCODE_ANY);
+    }
+  }
+  type_str = "String";
+  type = GNUNET_RECLAIM_attribute_typename_to_number (type_str);
+  if (GNUNET_SYSERR == GNUNET_RECLAIM_attribute_string_to_value (type,val_str,
+                                                                 (void **) &data,
+                                                                 &data_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Attribute value from JWT Parser invalid!\n");
+    GNUNET_RECLAIM_attribute_string_to_value (type,
+                                              "Error: Referenced Claim Name not Found",
+                                              (void **) &data,
+                                              &data_size);
+    attr = GNUNET_RECLAIM_attribute_new (claim, &cred->id,
+                                         type, data, data_size);
+    attr->id = cred->id;
+    attr->flag = 1;
+  }
+  else
+  {
+    attr = GNUNET_RECLAIM_attribute_new (claim, &cred->id,
+                                         type, data, data_size);
+    attr->id = cred->id;
+    attr->flag = 1;
+  }
+  return attr;
+}
+
+
+/**
+ * Collect all attributes for an ego
+ *
+ */
+static void
+attr_collect (void *cls,
+              const struct GNUNET_CRYPTO_PublicKey *identity,
+              const struct GNUNET_RECLAIM_Attribute *attr)
+{
+  struct RequestHandle *handle = cls;
+  json_t *attr_obj;
+  const char *type;
+  char *id_str;
+
+  char *tmp_value;
+  tmp_value = GNUNET_RECLAIM_attribute_value_to_string (attr->type,
+                                                        attr->data,
+                                                        attr->data_size);
+  attr_obj = json_object ();
+  json_object_set_new (attr_obj, "value", json_string (tmp_value));
+  json_object_set_new (attr_obj, "name", json_string (attr->name));
+
+  if (GNUNET_RECLAIM_id_is_zero (&attr->credential))
+    json_object_set_new (attr_obj, "flag", json_string ("0"));
+  else
+    json_object_set_new (attr_obj, "flag", json_string ("1"));
+  type = GNUNET_RECLAIM_attribute_number_to_typename (attr->type);
+  json_object_set_new (attr_obj, "type", json_string (type));
+  id_str = GNUNET_STRINGS_data_to_string_alloc (&attr->id,
+                                                sizeof(attr->id));
+  json_object_set_new (attr_obj, "id", json_string (id_str));
+  GNUNET_free (id_str);
+  id_str = GNUNET_STRINGS_data_to_string_alloc (&attr->credential,
+                                                sizeof(attr->credential));
+  json_object_set_new (attr_obj, "credential", json_string (id_str));
+  GNUNET_free (id_str);
+  json_array_append (handle->resp_object, attr_obj);
+  json_decref (attr_obj);
+  GNUNET_free (tmp_value);
+  GNUNET_RECLAIM_get_attributes_next (handle->attr_it);
+}
+
+
+/**
+ * List attributes for identity request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+list_attribute_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                     const char *url,
+                     void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  char *identity;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Getting attributes for %s.\n",
+              handle->url);
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) >= strlen (handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity = handle->url + strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) + 1;
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+  handle->resp_object = json_array ();
+
+
+  if (NULL == ego_entry)
+  {
+    // Done
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ego %s not found.\n", identity);
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+  priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  handle->attr_it = GNUNET_RECLAIM_get_attributes_start (idp,
+                                                         priv_key,
+                                                         &collect_error_cb,
+                                                         handle,
+                                                         &attr_collect,
+                                                         handle,
+                                                         &collect_finished_cb,
+                                                         handle);
+}
+
+
+/**
+ * List attributes for identity request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+delete_attribute_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                       const char *url,
+                       void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *priv_key;
+  struct RequestHandle *handle = cls;
+  struct GNUNET_RECLAIM_Attribute attr;
+  struct EgoEntry *ego_entry;
+  char *identity_id_str;
+  char *identity;
+  char *id;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Deleting attributes.\n");
+  if (strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) >= strlen (handle->url))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "No identity given.\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  identity_id_str =
+    strdup (handle->url + strlen (GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES) + 1);
+  identity = strtok (identity_id_str, "/");
+  id = strtok (NULL, "/");
+  if ((NULL == identity) || (NULL == id))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Malformed request.\n");
+    GNUNET_free (identity_id_str);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+    if (0 == strcmp (identity, ego_entry->identifier))
+      break;
+  handle->resp_object = json_array ();
+  if (NULL == ego_entry)
+  {
+    // Done
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Ego %s not found.\n", identity);
+    GNUNET_free (identity_id_str);
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+  priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  memset (&attr, 0, sizeof(struct GNUNET_RECLAIM_Attribute));
+  GNUNET_STRINGS_string_to_data (id, strlen (id), &attr.id, sizeof(attr.id));
+  attr.name = "";
+  handle->idp_op = GNUNET_RECLAIM_attribute_delete (idp,
+                                                    priv_key,
+                                                    &attr,
+                                                    &delete_finished_cb,
+                                                    handle);
+  GNUNET_free (identity_id_str);
+}
+
+
+static void
+revoke_ticket_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                    const char *url,
+                    void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *identity_priv;
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  struct GNUNET_RECLAIM_Ticket *ticket = NULL;
+  struct GNUNET_CRYPTO_PublicKey tmp_pk;
+  char term_data[handle->rest_handle->data_size + 1];
+  json_t *data_json;
+  json_error_t err;
+  struct GNUNET_JSON_Specification tktspec[] =
+  { GNUNET_RECLAIM_JSON_spec_ticket (&ticket), GNUNET_JSON_spec_end () };
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if ((NULL == data_json) ||
+      (GNUNET_OK != GNUNET_JSON_parse (data_json, tktspec, NULL, NULL)))
+  {
+    handle->emsg = GNUNET_strdup ("Not a ticket!\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    GNUNET_JSON_parse_free (tktspec);
+    if (NULL != data_json)
+      json_decref (data_json);
+    return;
+  }
+  json_decref (data_json);
+  if (NULL == ticket)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse ticket from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+  {
+    GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &tmp_pk);
+    if (0 == memcmp (&ticket->identity,
+                     &tmp_pk,
+                     sizeof(struct GNUNET_CRYPTO_PublicKey)))
+      break;
+  }
+  if (NULL == ego_entry)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Identity unknown\n");
+    GNUNET_JSON_parse_free (tktspec);
+    return;
+  }
+  identity_priv = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+
+  handle->idp_op = GNUNET_RECLAIM_ticket_revoke (idp,
+                                                 identity_priv,
+                                                 ticket,
+                                                 &finished_cont,
+                                                 handle);
+  GNUNET_JSON_parse_free (tktspec);
+}
+
+
+static void
+consume_cont (void *cls,
+              const struct GNUNET_CRYPTO_PublicKey *identity,
+              const struct GNUNET_RECLAIM_Attribute *attr,
+              const struct GNUNET_RECLAIM_Presentation *presentation)
+{
+  struct RequestHandle *handle = cls;
+  char *val_str;
+  json_t *value;
+
+  if (NULL == identity)
+  {
+    GNUNET_SCHEDULER_add_now (&return_response, handle);
+    return;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding attribute: %s\n", attr->name);
+  val_str = GNUNET_RECLAIM_attribute_value_to_string (attr->type,
+                                                      attr->data,
+                                                      attr->data_size);
+  if (NULL == val_str)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to parse value for: %s\n",
+                attr->name);
+    return;
+  }
+  value = json_string (val_str);
+  json_object_set_new (handle->resp_object, attr->name, value);
+  json_decref (value);
+  GNUNET_free (val_str);
+}
+
+
+static void
+consume_ticket_cont (struct GNUNET_REST_RequestHandle *con_handle,
+                     const char *url,
+                     void *cls)
+{
+  const struct GNUNET_CRYPTO_PrivateKey *identity_priv;
+  struct RequestHandle *handle = cls;
+  struct EgoEntry *ego_entry;
+  struct GNUNET_RECLAIM_Ticket *ticket;
+  struct GNUNET_CRYPTO_PublicKey tmp_pk;
+  char term_data[handle->rest_handle->data_size + 1];
+  json_t *data_json;
+  json_error_t err;
+  struct GNUNET_JSON_Specification tktspec[] =
+  { GNUNET_RECLAIM_JSON_spec_ticket (&ticket), GNUNET_JSON_spec_end () };
+
+  if (0 >= handle->rest_handle->data_size)
+  {
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+
+  term_data[handle->rest_handle->data_size] = '\0';
+  GNUNET_memcpy (term_data,
+                 handle->rest_handle->data,
+                 handle->rest_handle->data_size);
+  data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
+  if (NULL == data_json)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse JSON Object from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
+  if (GNUNET_OK != GNUNET_JSON_parse (data_json, tktspec, NULL, NULL))
+  {
+    handle->emsg = GNUNET_strdup ("Not a ticket!\n");
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    GNUNET_JSON_parse_free (tktspec);
+    json_decref (data_json);
+    return;
+  }
+  for (ego_entry = ego_head; NULL != ego_entry;
+       ego_entry = ego_entry->next)
+  {
+    GNUNET_IDENTITY_ego_get_public_key (ego_entry->ego, &tmp_pk);
+    if (0 == memcmp (&ticket->audience,
+                     &tmp_pk,
+                     sizeof(struct GNUNET_CRYPTO_PublicKey)))
+      break;
+  }
+  if (NULL == ego_entry)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Identity unknown\n");
+    GNUNET_JSON_parse_free (tktspec);
+    return;
+  }
+  identity_priv = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
+  handle->resp_object = json_object ();
+  handle->idp_op = GNUNET_RECLAIM_ticket_consume (idp,
+                                                  identity_priv,
+                                                  ticket,
+                                                  &consume_cont,
+                                                  handle);
+  GNUNET_JSON_parse_free (tktspec);
+}
+
+
+/**
+ * Respond to OPTIONS request
+ *
+ * @param con_handle the connection handle
+ * @param url the url
+ * @param cls the RequestHandle
+ */
+static void
+options_cont (struct GNUNET_REST_RequestHandle *con_handle,
+              const char *url,
+              void *cls)
+{
+  struct MHD_Response *resp;
+  struct RequestHandle *handle = cls;
+
+  // For now, independent of path return all options
+  resp = GNUNET_REST_create_response (NULL);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
+  handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
+  cleanup_handle (handle);
+  return;
+}
+
+
+/**
+ * If listing is enabled, prints information about the egos.
+ *
+ * This function is initially called for all egos and then again
+ * whenever a ego's identifier changes or if it is deleted.  At the
+ * end of the initial pass over all egos, the function is once called
+ * with 'NULL' for 'ego'. That does NOT mean that the callback won't
+ * be invoked in the future or that there was an error.
+ *
+ * When used with 'GNUNET_IDENTITY_create' or 'GNUNET_IDENTITY_get', this
+ * function is only called ONCE, and 'NULL' being passed in 'ego' does
+ * indicate an error (for example because name is taken or no default value is
+ * known).  If 'ego' is non-NULL and if '*ctx' is set in those callbacks, the
+ * value WILL be passed to a subsequent call to the identity callback of
+ * 'GNUNET_IDENTITY_connect' (if that one was not NULL).
+ *
+ * When an identity is renamed, this function is called with the
+ * (known) ego but the NEW identifier.
+ *
+ * When an identity is deleted, this function is called with the
+ * (known) ego and "NULL" for the 'identifier'.  In this case,
+ * the 'ego' is henceforth invalid (and the 'ctx' should also be
+ * cleaned up).
+ *
+ * @param cls closure
+ * @param ego ego handle
+ * @param ctx context for application to store data for this ego
+ *                 (during the lifetime of this process, initially NULL)
+ * @param identifier identifier assigned by the user for this ego,
+ *                   NULL if the user just deleted the ego and it
+ *                   must thus no longer be used
+ */
+static void
+list_ego (void *cls,
+          struct GNUNET_IDENTITY_Ego *ego,
+          void **ctx,
+          const char *identifier)
+{
+  struct EgoEntry *ego_entry;
+  struct GNUNET_CRYPTO_PublicKey pk;
+
+  if (NULL == ego)
+  {
+    state = ID_REST_STATE_POST_INIT;
+    return;
+  }
+  if (ID_REST_STATE_INIT == state)
+  {
+    ego_entry = GNUNET_new (struct EgoEntry);
+    GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+    ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+    ego_entry->ego = ego;
+    ego_entry->identifier = GNUNET_strdup (identifier);
+    GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                      ego_tail,
+                                      ego_entry);
+  }
+  /* Ego renamed or added */
+  if (identifier != NULL)
+  {
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+      {
+        /* Rename */
+        GNUNET_free (ego_entry->identifier);
+        ego_entry->identifier = GNUNET_strdup (identifier);
+        break;
+      }
+    }
+    if (NULL == ego_entry)
+    {
+      /* Add */
+      ego_entry = GNUNET_new (struct EgoEntry);
+      GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
+      ego_entry->keystring = GNUNET_CRYPTO_public_key_to_string (&pk);
+      ego_entry->ego = ego;
+      ego_entry->identifier = GNUNET_strdup (identifier);
+      GNUNET_CONTAINER_DLL_insert_tail (ego_head,
+                                        ego_tail,
+                                        ego_entry);
+    }
+  }
+  else
+  {
+    /* Delete */
+    for (ego_entry = ego_head; NULL != ego_entry;
+         ego_entry = ego_entry->next)
+    {
+      if (ego_entry->ego == ego)
+        break;
+    }
+    if (NULL == ego_entry)
+      return; /* Not found */
+
+    GNUNET_CONTAINER_DLL_remove (ego_head,
+                                 ego_tail,
+                                 ego_entry);
+    GNUNET_free (ego_entry->identifier);
+    GNUNET_free (ego_entry->keystring);
+    GNUNET_free (ego_entry);
+    return;
+  }
+
+}
+
+
+enum GNUNET_GenericReturnValue
+REST_reclaim_process_request (struct GNUNET_REST_RequestHandle *rest_handle,
+                              GNUNET_REST_ResultProcessor proc,
+                              void *proc_cls)
+{
+  struct RequestHandle *handle = GNUNET_new (struct RequestHandle);
+  struct GNUNET_REST_RequestHandlerError err;
+  static const struct GNUNET_REST_RequestHandler handlers[] =
+  { { MHD_HTTP_METHOD_GET,
+      GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &list_attribute_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &add_attribute_cont },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &delete_attribute_cont },
+    { MHD_HTTP_METHOD_GET,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &list_credential_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &add_credential_cont },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &delete_credential_cont },
+    { MHD_HTTP_METHOD_GET,
+      GNUNET_REST_API_NS_IDENTITY_TICKETS, &list_tickets_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_IDENTITY_REVOKE, &revoke_ticket_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_IDENTITY_CONSUME, &consume_ticket_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_RECLAIM, &options_cont },
+    GNUNET_REST_HANDLER_END};
+
+  handle->response_code = 0;
+  handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
+  handle->proc_cls = proc_cls;
+  handle->proc = proc;
+  handle->rest_handle = rest_handle;
+
+  handle->url = GNUNET_strdup (rest_handle->url);
+  if (handle->url[strlen (handle->url) - 1] == '/')
+    handle->url[strlen (handle->url) - 1] = '\0';
+  handle->timeout_task =
+    GNUNET_SCHEDULER_add_delayed (handle->timeout, &do_timeout, handle);
+  GNUNET_CONTAINER_DLL_insert (requests_head,
+                               requests_tail,
+                               handle);
+  if (GNUNET_NO ==
+      GNUNET_REST_handle_request (handle->rest_handle, handlers, &err, handle))
+  {
+    cleanup_handle (handle);
+    return GNUNET_NO;
+  }
+
+  return GNUNET_YES;
+}
+
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls Config info
+ * @return NULL on error, otherwise the plugin context
+ */
+void *
+REST_reclaim_init (struct GNUNET_CONFIGURATION_Handle *c)
+{
+  static struct Plugin plugin;
+  struct GNUNET_REST_Plugin *api;
+
+  rcfg = c;
+  if (NULL != plugin.cfg)
+    return NULL; /* can only initialize once! */
+  memset (&plugin, 0, sizeof(struct Plugin));
+  plugin.cfg = rcfg;
+  api = GNUNET_new (struct GNUNET_REST_Plugin);
+  api->cls = &plugin;
+  api->name = GNUNET_REST_API_NS_RECLAIM;
+  GNUNET_asprintf (&allow_methods,
+                   "%s, %s, %s, %s, %s",
+                   MHD_HTTP_METHOD_GET,
+                   MHD_HTTP_METHOD_POST,
+                   MHD_HTTP_METHOD_PUT,
+                   MHD_HTTP_METHOD_DELETE,
+                   MHD_HTTP_METHOD_OPTIONS);
+  identity_handle = GNUNET_IDENTITY_connect (rcfg, &list_ego, NULL);
+  state = ID_REST_STATE_INIT;
+  idp = GNUNET_RECLAIM_connect (rcfg);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              _ ("Identity Provider REST API initialized\n"));
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void *
+REST_reclaim_done (struct GNUNET_REST_Plugin *api)
+{
+  struct Plugin *plugin = api->cls;
+  struct RequestHandle *request;
+  struct EgoEntry *ego_entry;
+  struct EgoEntry *ego_tmp;
+
+  plugin->cfg = NULL;
+  while (NULL != (request = requests_head))
+    do_error (request);
+  if (NULL != idp)
+    GNUNET_RECLAIM_disconnect (idp);
+  if (NULL != identity_handle)
+    GNUNET_IDENTITY_disconnect (identity_handle);
+  for (ego_entry = ego_head; NULL != ego_entry;)
+  {
+    ego_tmp = ego_entry;
+    ego_entry = ego_entry->next;
+    GNUNET_free (ego_tmp->identifier);
+    GNUNET_free (ego_tmp->keystring);
+    GNUNET_free (ego_tmp);
+  }
+
+  GNUNET_free (allow_methods);
+  GNUNET_free (api);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Identity Provider REST plugin is finished\n");
+  return NULL;
+}
+
+
+/* end of plugin_rest_reclaim.c */
diff --git a/src/service/rest/reclaim_plugin.h b/src/service/rest/reclaim_plugin.h
new file mode 100644
index 000000000..102fd827e
--- /dev/null
+++ b/src/service/rest/reclaim_plugin.h
@@ -0,0 +1,36 @@
+#include "gnunet_rest_plugin.h"
+/**
+ * Function processing the REST call
+ *
+ * @param method HTTP method
+ * @param url URL of the HTTP request
+ * @param data body of the HTTP request (optional)
+ * @param data_size length of the body
+ * @param proc callback function for the result
+ * @param proc_cls closure for @a proc
+ * @return #GNUNET_OK if request accepted
+ */
+enum GNUNET_GenericReturnValue
+REST_reclaim_process_request (void *plugin,
+                               struct GNUNET_REST_RequestHandle *conndata_handle,
+                               GNUNET_REST_ResultProcessor proc,
+                               void *proc_cls);
+
+/**
+ * Entry point for the plugin.
+ *
+ * @param cls the "struct GNUNET_NAMESTORE_PluginEnvironment*"
+ * @return NULL on error, otherwise the plugin context
+ */
+void*
+REST_reclaim_init (const struct GNUNET_CONFIGURATION_Handle *c);
+
+
+/**
+ * Exit point from the plugin.
+ *
+ * @param cls the plugin context (as returned by "init")
+ * @return always NULL
+ */
+void
+REST_reclaim_done (struct GNUNET_REST_Plugin *api);
diff --git a/src/service/revocation/Makefile.am b/src/service/revocation/Makefile.am
index 726c75ab6..18bf21fb0 100644
--- a/src/service/revocation/Makefile.am
+++ b/src/service/revocation/Makefile.am
@@ -29,7 +29,7 @@ libgnunetrevocation_la_SOURCES = \
   revocation_api.c revocation.h
 libgnunetrevocation_la_LIBADD = \
   $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(top_builddir)/src/service/identity/libgnunetidentity.la \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la \
   $(LIBGCRYPT_LIBS) \
   $(GN_LIBINTL) $(XLIB) -lgcrypt
 libgnunetrevocation_la_LDFLAGS = \
@@ -46,7 +46,7 @@ gnunet_service_revocation_LDADD = \
   $(top_builddir)/src/service/core/libgnunetcore.la \
   $(top_builddir)/src/service/setu/libgnunetsetu.la \
   $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/service/identity/libgnunetidentity.la  \
+  $(top_builddir)/src/lib/gnsrecord/libgnunetgnsrecord.la  \
   $(top_builddir)/src/lib/util/libgnunetutil.la \
   -lm \
   $(GN_LIBINTL)
diff --git a/src/service/revocation/gnunet-service-revocation.c b/src/service/revocation/gnunet-service-revocation.c
index 3755b87e5..8a8610758 100644
--- a/src/service/revocation/gnunet-service-revocation.c
+++ b/src/service/revocation/gnunet-service-revocation.c
@@ -38,6 +38,7 @@
 #include "platform.h"
 #include <math.h>
 #include "gnunet_util_lib.h"
+#include "gnunet_gnsrecord_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
@@ -172,13 +173,13 @@ new_peer_entry (const struct GNUNET_PeerIdentity *peer)
 static enum GNUNET_GenericReturnValue
 verify_revoke_message (const struct RevokeMessage *rm)
 {
-  const struct GNUNET_REVOCATION_PowP *pow
-    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+  const struct GNUNET_GNSRECORD_PowP *pow
+    = (const struct GNUNET_GNSRECORD_PowP *) &rm[1];
 
   if (GNUNET_YES !=
-      GNUNET_REVOCATION_check_pow (pow,
-                                   (unsigned int) revocation_work_required,
-                                   epoch_duration))
+      GNUNET_GNSRECORD_check_pow (pow,
+                                  (unsigned int) revocation_work_required,
+                                  epoch_duration))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Proof of work invalid!\n");
@@ -221,6 +222,7 @@ client_disconnect_cb (void *cls,
   GNUNET_assert (client == app_cls);
 }
 
+
 static int
 check_query_message (void *cls,
                      const struct QueryMessage *qm)
@@ -261,7 +263,7 @@ handle_query_message (void *cls,
   key_len = ntohl (qm->key_len);
   if ((GNUNET_SYSERR ==
        GNUNET_CRYPTO_read_public_key_from_buffer (&qm[1], key_len,
-                                                    &zone, &read)) ||
+                                                  &zone, &read)) ||
       (read != key_len))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -342,8 +344,8 @@ publicize_rm (const struct RevokeMessage *rm)
   struct GNUNET_HashCode hc;
   struct GNUNET_SETU_Element e;
   ssize_t pklen;
-  const struct GNUNET_REVOCATION_PowP *pow
-    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+  const struct GNUNET_GNSRECORD_PowP *pow
+    = (const struct GNUNET_GNSRECORD_PowP *) &rm[1];
   const struct GNUNET_CRYPTO_PublicKey *pk
     = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
 
@@ -980,8 +982,8 @@ run (void *cls,
       GNUNET_free (fn);
       return;
     }
-    struct GNUNET_REVOCATION_PowP *pow = (struct
-                                          GNUNET_REVOCATION_PowP *) &rm[1];
+    struct GNUNET_GNSRECORD_PowP *pow = (struct
+                                         GNUNET_GNSRECORD_PowP *) &rm[1];
     ssize_t ksize;
     pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
     ksize = GNUNET_CRYPTO_public_key_get_length (pk);
diff --git a/src/service/revocation/meson.build b/src/service/revocation/meson.build
index 14e352ffa..57f19f115 100644
--- a/src/service/revocation/meson.build
+++ b/src/service/revocation/meson.build
@@ -19,7 +19,9 @@ libgnunetrevocation = library('gnunetrevocation',
         libgnunetrevocation_src,
         soversion: '0',
         version: '0.0.0',
-        dependencies: [libgnunetutil_dep, libgnunetidentity_dep],
+        dependencies: [libgnunetutil_dep,
+                       libgnunetgnsrecord_dep,
+                       libgnunetidentity_dep],
         include_directories: [incdir, configuration_inc],
         install: true,
         install_dir: get_option('libdir'))
@@ -34,6 +36,7 @@ executable ('gnunet-service-revocation',
                            libgnunetstatistics_dep,
                            libgnunetcore_dep,
                            libgnunetsetu_dep,
+                           libgnunetgnsrecord_dep,
                            libgnunetidentity_dep],
             include_directories: [incdir, configuration_inc],
             install: true,
diff --git a/src/service/revocation/revocation.h b/src/service/revocation/revocation.h
index 90b8c7da0..cbb36acfb 100644
--- a/src/service/revocation/revocation.h
+++ b/src/service/revocation/revocation.h
@@ -112,13 +112,4 @@ struct RevocationResponseMessage
 
 GNUNET_NETWORK_STRUCT_END
 
-/**
- * Create the revocation metadata to sign for a revocation message
- *
- * @param pow the PoW to sign
- * @return the signature purpose
- */
-struct GNUNET_REVOCATION_SignaturePurposePS *
-REV_create_signature_message (const struct GNUNET_REVOCATION_PowP *pow);
-
 #endif
diff --git a/src/service/revocation/revocation_api.c b/src/service/revocation/revocation_api.c
index 3b7d83710..0e3641af8 100644
--- a/src/service/revocation/revocation_api.c
+++ b/src/service/revocation/revocation_api.c
@@ -52,60 +52,6 @@ struct GNUNET_REVOCATION_Query
 
 
 /**
- * Helper struct that holds a found pow nonce
- * and the corresponding number of leading zeros.
- */
-struct BestPow
-{
-  /**
-   * PoW nonce
-   */
-  uint64_t pow;
-
-  /**
-   * Corresponding zero bits in hash
-   */
-  unsigned int bits;
-};
-
-
-/**
- * The handle to a PoW calculation.
- * Used in iterative PoW rounds.
- */
-struct GNUNET_REVOCATION_PowCalculationHandle
-{
-  /**
-   * Current set of found PoWs
-   */
-  struct BestPow best[POW_COUNT];
-
-  /**
-   * The final PoW result data structure.
-   */
-  struct GNUNET_REVOCATION_PowP *pow;
-
-  /**
-   * The current nonce to try
-   */
-  uint64_t current_pow;
-
-  /**
-   * Epochs how long the PoW should be valid.
-   * This is added on top of the difficulty in the PoW.
-   */
-  unsigned int epochs;
-
-  /**
-   * The difficulty (leading zeros) to achieve.
-   */
-  unsigned int difficulty;
-
-};
-
-static struct GNUNET_CRYPTO_PowSalt salt = { "GnsRevocationPow" };
-
-/**
  * Generic error handler, called with the appropriate
  * error code and the same closure specified at the creation of
  * the message queue.
@@ -301,7 +247,7 @@ handle_revocation_response (void *cls,
  */
 struct GNUNET_REVOCATION_Handle *
 GNUNET_REVOCATION_revoke (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                          const struct GNUNET_REVOCATION_PowP *pow,
+                          const struct GNUNET_GNSRECORD_PowP *pow,
                           GNUNET_REVOCATION_Callback func,
                           void *func_cls)
 {
@@ -339,9 +285,9 @@ GNUNET_REVOCATION_revoke (const struct GNUNET_CONFIGURATION_Handle *cfg,
     GNUNET_free (h);
     return NULL;
   }
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
-                                                 (unsigned int) matching_bits,
-                                                 epoch_duration))
+  if (GNUNET_YES != GNUNET_GNSRECORD_check_pow (pow,
+                                                (unsigned int) matching_bits,
+                                                epoch_duration))
   {
     GNUNET_break (0);
     GNUNET_free (h);
@@ -361,7 +307,7 @@ GNUNET_REVOCATION_revoke (const struct GNUNET_CONFIGURATION_Handle *cfg,
   }
   h->func = func;
   h->func_cls = func_cls;
-  size_t extra_len = GNUNET_REVOCATION_proof_get_size (pow);
+  size_t extra_len = GNUNET_GNSRECORD_proof_get_size (pow);
   env = GNUNET_MQ_msg_extra (rm,
                              extra_len,
                              GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
@@ -385,380 +331,4 @@ GNUNET_REVOCATION_revoke_cancel (struct GNUNET_REVOCATION_Handle *h)
 }
 
 
-/**
- * Calculate the average zeros in the pows.
- *
- * @param ph the PowHandle
- * @return the average number of zeros.
- */
-static unsigned int
-calculate_score (const struct GNUNET_REVOCATION_PowCalculationHandle *ph)
-{
-  double sum = 0.0;
-  for (unsigned int j = 0; j<POW_COUNT; j++)
-    sum += ph->best[j].bits;
-  double avg = sum / POW_COUNT;
-  return avg;
-}
-
-
-struct GNUNET_REVOCATION_SignaturePurposePS *
-REV_create_signature_message (const struct GNUNET_REVOCATION_PowP *pow)
-{
-  struct GNUNET_REVOCATION_SignaturePurposePS *spurp;
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-  size_t ksize;
-
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
-  spurp = GNUNET_malloc (sizeof (*spurp) + ksize);
-  spurp->timestamp = pow->timestamp;
-  spurp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_REVOCATION);
-  spurp->purpose.size = htonl (sizeof(*spurp) + ksize);
-  GNUNET_CRYPTO_write_public_key_to_buffer (pk,
-                                              (char*) &spurp[1],
-                                              ksize);
-  return spurp;
-}
-
-
-enum GNUNET_GenericReturnValue
-check_signature_identity (const struct GNUNET_REVOCATION_PowP *pow,
-                          const struct GNUNET_CRYPTO_PublicKey *key)
-{
-  struct GNUNET_REVOCATION_SignaturePurposePS *spurp;
-  unsigned char *sig;
-  size_t ksize;
-  int ret;
-
-  ksize = GNUNET_CRYPTO_public_key_get_length (key);
-  spurp = REV_create_signature_message (pow);
-  sig = ((unsigned char*) &pow[1] + ksize);
-  ret =
-    GNUNET_CRYPTO_signature_verify_raw_ (
-      GNUNET_SIGNATURE_PURPOSE_GNS_REVOCATION,
-      &spurp->purpose,
-      sig,
-      key);
-  GNUNET_free (spurp);
-  return ret == GNUNET_OK ? GNUNET_OK : GNUNET_SYSERR;
-}
-
-
-enum GNUNET_GenericReturnValue
-check_signature (const struct GNUNET_REVOCATION_PowP *pow)
-{
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-  return check_signature_identity (pow, pk);
-}
-
-
-/**
- * Check if the given proof-of-work is valid.
- *
- * @param pow proof of work
- * @param difficulty how many bits must match (configuration) LSD0001: D
- * @param epoch_duration length of single epoch in configuration
- * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
- */
-enum GNUNET_GenericReturnValue
-GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
-                             unsigned int difficulty,
-                             struct GNUNET_TIME_Relative epoch_duration)
-{
-  char buf[sizeof(struct GNUNET_CRYPTO_PublicKey)
-           + sizeof (struct GNUNET_TIME_AbsoluteNBO)
-           + sizeof (uint64_t)] GNUNET_ALIGN;
-  struct GNUNET_HashCode result;
-  struct GNUNET_TIME_Absolute ts;
-  struct GNUNET_TIME_Absolute exp;
-  struct GNUNET_TIME_Relative ttl;
-  struct GNUNET_TIME_Relative buffer;
-  /* LSD0001: D' */
-  unsigned int score = 0;
-  unsigned int tmp_score = 0;
-  unsigned int epochs;
-  uint64_t pow_val;
-  ssize_t pklen;
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-
-  /**
-   * Check if signature valid
-   */
-  if (GNUNET_OK != check_signature (pow))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Proof of work signature invalid!\n");
-    return GNUNET_SYSERR;
-  }
-
-  /**
-   * First, check if PoW set is strictly monotically increasing
-   */
-  for (unsigned int i = 0; i < POW_COUNT - 1; i++)
-  {
-    if (GNUNET_ntohll (pow->pow[i]) >= GNUNET_ntohll (pow->pow[i + 1]))
-      return GNUNET_NO;
-  }
-  GNUNET_memcpy (&buf[sizeof(uint64_t)],
-                 &pow->timestamp,
-                 sizeof (uint64_t));
-  pklen = GNUNET_CRYPTO_public_key_get_length (pk);
-  if (0 > pklen)
-  {
-    GNUNET_break (0);
-    return GNUNET_NO;
-  }
-  GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
-                 pk,
-                 pklen);
-  for (unsigned int i = 0; i < POW_COUNT; i++)
-  {
-    pow_val = GNUNET_ntohll (pow->pow[i]);
-    GNUNET_memcpy (buf, &pow->pow[i], sizeof(uint64_t));
-    GNUNET_CRYPTO_pow_hash (&salt,
-                            buf,
-                            sizeof(buf),
-                            &result);
-    tmp_score = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Score %u with %" PRIu64 " (#%u)\n",
-                tmp_score, pow_val, i);
-
-    score += tmp_score;
-
-  }
-  score = score / POW_COUNT;
-  if (score < difficulty)
-    return GNUNET_NO;
-  /* LSD0001: (D'-D+1) */
-  epochs = score - difficulty + 1;
-
-  /**
-   * Check expiration
-   */
-  ts = GNUNET_TIME_absolute_ntoh (pow->timestamp);
-  ttl = GNUNET_TIME_relative_multiply (epoch_duration,
-                                       epochs);
-  /**
-   * Extend by 10% for unsynchronized clocks
-   */
-  buffer = GNUNET_TIME_relative_divide (epoch_duration,
-                                        10);
-  exp = GNUNET_TIME_absolute_add (ts, ttl);
-  exp = GNUNET_TIME_absolute_add (exp,
-                                  buffer);
-
-  if (0 != GNUNET_TIME_absolute_get_remaining (ts).rel_value_us)
-    return GNUNET_NO; /* Not yet valid. */
-  /* Revert to actual start time */
-  ts = GNUNET_TIME_absolute_add (ts,
-                                 buffer);
-
-  if (0 == GNUNET_TIME_absolute_get_remaining (exp).rel_value_us)
-    return GNUNET_NO; /* expired */
-  return GNUNET_YES;
-}
-
-
-enum GNUNET_GenericReturnValue
-sign_pow_identity (const struct GNUNET_CRYPTO_PrivateKey *key,
-                   struct GNUNET_REVOCATION_PowP *pow)
-{
-  struct GNUNET_TIME_Absolute ts = GNUNET_TIME_absolute_get ();
-  struct GNUNET_REVOCATION_SignaturePurposePS *rp;
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-  size_t ksize;
-  char *sig;
-
-  /**
-   * Predate the validity period to prevent rejections due to
-   * unsynchronized clocks
-   */
-  ts = GNUNET_TIME_absolute_subtract (ts,
-                                      GNUNET_TIME_UNIT_WEEKS);
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
-  pow->timestamp = GNUNET_TIME_absolute_hton (ts);
-  rp = REV_create_signature_message (pow);
-  sig = ((char*) &pow[1]) + ksize;
-  int result = GNUNET_CRYPTO_sign_raw_ (key,
-                                          &rp->purpose,
-                                          (void*) sig);
-  GNUNET_free (rp);
-  if (result == GNUNET_SYSERR)
-    return GNUNET_NO;
-  else
-    return result;
-}
-
-
-enum GNUNET_GenericReturnValue
-sign_pow (const struct GNUNET_CRYPTO_PrivateKey *key,
-          struct GNUNET_REVOCATION_PowP *pow)
-{
-  struct GNUNET_CRYPTO_PublicKey *pk;
-
-  pk = (struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-  GNUNET_CRYPTO_key_get_public (key, pk);
-  return sign_pow_identity (key, pow);
-}
-
-
-/**
- * Initializes a fresh PoW computation.
- *
- * @param key the key to calculate the PoW for.
- * @param[out] pow starting point for PoW calculation (not yet valid)
- */
-void
-GNUNET_REVOCATION_pow_init (const struct GNUNET_CRYPTO_PrivateKey *key,
-                            struct GNUNET_REVOCATION_PowP *pow)
-{
-  GNUNET_assert (GNUNET_OK == sign_pow (key, pow));
-}
-
-
-struct GNUNET_REVOCATION_PowCalculationHandle*
-GNUNET_REVOCATION_pow_start (struct GNUNET_REVOCATION_PowP *pow,
-                             int epochs,
-                             unsigned int difficulty)
-{
-  struct GNUNET_REVOCATION_PowCalculationHandle *pc;
-  struct GNUNET_TIME_Relative ttl;
-
-
-  pc = GNUNET_new (struct GNUNET_REVOCATION_PowCalculationHandle);
-  pc->pow = pow;
-  ttl = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS,
-                                       epochs);
-  pc->pow->ttl = GNUNET_TIME_relative_hton (ttl);
-  pc->current_pow = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                              UINT64_MAX);
-  pc->difficulty = difficulty;
-  pc->epochs = epochs;
-  return pc;
-}
-
-
-/**
- * Comparison function for quicksort
- *
- * @param a left element
- * @param b right element
- * @return a-b
- */
-static int
-cmp_pow_value (const void *a, const void *b)
-{
-  return (GNUNET_ntohll (*(uint64_t*) a) - GNUNET_ntohll (*(uint64_t*) b));
-}
-
-
-/**
- * Calculate a key revocation valid for broadcasting for a number
- * of epochs.
- *
- * @param pc handle to the PoW, initially called with NULL.
- * @param epochs number of epochs for which the revocation must be valid.
- * @param pow current pow value to try
- * @param difficulty current base difficulty to achieve
- * @return #GNUNET_YES if the @a pow is acceptable, #GNUNET_NO if not
- */
-enum GNUNET_GenericReturnValue
-GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
-{
-  char buf[sizeof(struct GNUNET_CRYPTO_PublicKey)
-           + sizeof (uint64_t)
-           + sizeof (uint64_t)] GNUNET_ALIGN;
-  struct GNUNET_HashCode result;
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-  unsigned int zeros;
-  int ret;
-  uint64_t pow_nbo;
-  ssize_t ksize;
-
-  pc->current_pow++;
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &(pc->pow[1]);
-
-  /**
-   * Do not try duplicates
-   */
-  for (unsigned int i = 0; i < POW_COUNT; i++)
-    if (pc->current_pow == pc->best[i].pow)
-      return GNUNET_NO;
-  pow_nbo = GNUNET_htonll (pc->current_pow);
-  GNUNET_memcpy (buf, &pow_nbo, sizeof(uint64_t));
-  GNUNET_memcpy (&buf[sizeof(uint64_t)],
-                 &pc->pow->timestamp,
-                 sizeof (uint64_t));
-  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
-  GNUNET_assert (0 < ksize);
-  GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
-                 pk,
-                 ksize);
-  GNUNET_CRYPTO_pow_hash (&salt,
-                          buf,
-                          sizeof(buf),
-                          &result);
-  zeros = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
-  for (unsigned int i = 0; i < POW_COUNT; i++)
-  {
-    if (pc->best[i].bits < zeros)
-    {
-      pc->best[i].bits = zeros;
-      pc->best[i].pow = pc->current_pow;
-      pc->pow->pow[i] = pow_nbo;
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "New best score %u with %" PRIu64 " (#%u)\n",
-                  zeros, pc->current_pow, i);
-
-      break;
-    }
-  }
-  ret = calculate_score (pc) >= pc->difficulty + pc->epochs ? GNUNET_YES :
-        GNUNET_NO;
-  if (GNUNET_YES == ret)
-  {
-    /* Sort POWs) */
-    qsort (pc->pow->pow, POW_COUNT, sizeof (uint64_t), &cmp_pow_value);
-  }
-  return ret;
-}
-
-
-/**
- * Stop a PoW calculation
- *
- * @param pc the calculation to clean up
- * @return #GNUNET_YES if pow valid, #GNUNET_NO if pow was set but is not
- * valid
- */
-void
-GNUNET_REVOCATION_pow_stop (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
-{
-  GNUNET_free (pc);
-}
-
-
-size_t
-GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow)
-{
-  size_t size;
-  size_t ksize;
-  const struct GNUNET_CRYPTO_PublicKey *pk;
-
-  size = sizeof (struct GNUNET_REVOCATION_PowP);
-  pk = (const struct GNUNET_CRYPTO_PublicKey *) &pow[1];
-  ksize = GNUNET_CRYPTO_public_key_get_length (pk);
-  size += ksize;
-  size += GNUNET_CRYPTO_signature_get_raw_length_by_type (pk->type);
-  return size;
-}
-
-
 /* end of revocation_api.c */
diff --git a/src/service/seti/Makefile.am b/src/service/seti/Makefile.am
index c2d31df9c..00923d56d 100644
--- a/src/service/seti/Makefile.am
+++ b/src/service/seti/Makefile.am
@@ -68,19 +68,5 @@ test_seti_api_LDADD = \
   $(top_builddir)/src/service/testing/libgnunettesting.la \
   libgnunetseti.la
 
-plugin_LTLIBRARIES = \
-  libgnunet_plugin_block_seti_test.la
-
-libgnunet_plugin_block_seti_test_la_SOURCES = \
-  plugin_block_seti_test.c
-libgnunet_plugin_block_seti_test_la_LIBADD = \
-  $(top_builddir)/src/lib/block/libgnunetblock.la \
-  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(LTLIBINTL)
-libgnunet_plugin_block_seti_test_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
 EXTRA_DIST = \
   test_seti.conf
diff --git a/src/service/seti/meson.build b/src/service/seti/meson.build
index 8538917d8..1743e327d 100644
--- a/src/service/seti/meson.build
+++ b/src/service/seti/meson.build
@@ -26,12 +26,6 @@ libgnunetseti = library('gnunetseti',
 pkg.generate(libgnunetseti, url: 'https://www.gnunet.org',
              description : 'Provides API for accessing the set intersection service')
 libgnunetseti_dep = declare_dependency(link_with : libgnunetseti)
-shared_module('gnunet_plugin_block_seti_test',
-              ['plugin_block_seti_test.c'],
-              dependencies: libgnunetutil_dep,
-              include_directories: [incdir, configuration_inc],
-              install:true,
-              install_dir: get_option('libdir')/'gnunet')
 executable ('gnunet-service-seti',
             gnunetserviceseti_src,
             dependencies: [libgnunetseti_dep,
diff --git a/src/service/seti/plugin_block_seti_test.c b/src/service/seti/plugin_block_seti_test.c
deleted file mode 100644
index 5b9196cef..000000000
--- a/src/service/seti/plugin_block_seti_test.c
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2017 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file seti/plugin_block_seti_test.c
- * @brief set test block, recognizes elements with non-zero first byte as invalid
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_block_plugin.h"
-#include "gnunet_block_group_lib.h"
-
-
-/**
- * Function called to validate a query.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_seti_test_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
-{
-  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called to validate a block for storage.
- *
- * @param cls closure
- * @param type block type
- * @param block block data to validate
- * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_seti_test_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const void *block,
-                                    size_t block_size)
-{
-  (void) cls;
-  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  if ((NULL == block) ||
-      (0 == block_size) ||
-      (0 != ((char *) block)[0]))
-    return GNUNET_SYSERR;
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called to validate a reply to a request.  Note that it is assumed
- * that the reply has already been matched to the key (and signatures checked)
- * as it would be done with the GetKeyFunction and the
- * BlockEvaluationFunction.
- *
- * @param cls closure
- * @param type block type
- * @param group which block group to use for evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_ReplyEvaluationResult
-block_plugin_seti_test_check_reply (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
-{
-  (void) cls;
-  (void) xquery;
-  (void) xquery_size;
-  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-  if ( (NULL == reply_block) ||
-       (0 == reply_block_size) ||
-       (0 != ((char *) reply_block)[0]) )
-    GNUNET_assert (0);
-  return GNUNET_BLOCK_REPLY_OK_MORE;
-}
-
-
-/**
- * Function called to obtain the key for a block.
- *
- * @param cls closure
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes in block
- * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_seti_test_get_key (void *cls,
-                                enum GNUNET_BLOCK_Type type,
-                                const void *block,
-                                size_t block_size,
-                                struct GNUNET_HashCode *key)
-{
-  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_NO;
-}
-
-
-/**
- * Entry point for the plugin.
- */
-void *
-libgnunet_plugin_block_seti_test_init (void *cls)
-{
-  static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_SETI_TEST,
-    GNUNET_BLOCK_TYPE_ANY       /* end of list */
-  };
-  struct GNUNET_BLOCK_PluginFunctions *api;
-
-  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->get_key = &block_plugin_seti_test_get_key;
-  api->check_query = &block_plugin_seti_test_check_query;
-  api->check_block = &block_plugin_seti_test_check_block;
-  api->check_reply = &block_plugin_seti_test_check_reply;
-  api->types = types;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- */
-void *
-libgnunet_plugin_block_seti_test_done (void *cls)
-{
-  struct GNUNET_BLOCK_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_block_seti_test.c */
diff --git a/src/service/setu/Makefile.am b/src/service/setu/Makefile.am
index f7f8ed394..f0cf9fdbc 100644
--- a/src/service/setu/Makefile.am
+++ b/src/service/setu/Makefile.am
@@ -88,19 +88,5 @@ perf_setu_api_LDADD = \
   libgnunetsetu.la
 
 
-plugin_LTLIBRARIES = \
-  libgnunet_plugin_block_setu_test.la
-
-libgnunet_plugin_block_setu_test_la_SOURCES = \
-  plugin_block_setu_test.c
-libgnunet_plugin_block_setu_test_la_LIBADD = \
-  $(top_builddir)/src/lib/block/libgnunetblock.la \
-  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
-  $(top_builddir)/src/lib/util/libgnunetutil.la \
-  $(LTLIBINTL)
-libgnunet_plugin_block_setu_test_la_LDFLAGS = \
- $(GN_PLUGIN_LDFLAGS)
-
-
 EXTRA_DIST = \
   test_setu.conf
diff --git a/src/service/setu/meson.build b/src/service/setu/meson.build
index 974f16274..ccfa5762b 100644
--- a/src/service/setu/meson.build
+++ b/src/service/setu/meson.build
@@ -28,12 +28,6 @@ libgnunetsetu = library('gnunetsetu',
 pkg.generate(libgnunetsetu, url: 'https://www.gnunet.org',
              description : 'Provides API for accessing the set union service')
 libgnunetsetu_dep = declare_dependency(link_with : libgnunetsetu)
-shared_module('gnunet_plugin_block_setu_test',
-              ['plugin_block_setu_test.c'],
-              dependencies: libgnunetutil_dep,
-              include_directories: [incdir, configuration_inc],
-              install:true,
-              install_dir: get_option('libdir')/'gnunet')
 executable ('gnunet-service-setu',
             gnunetservicesetu_src,
             dependencies: [libgnunetsetu_dep,
diff --git a/src/service/setu/plugin_block_setu_test.c b/src/service/setu/plugin_block_setu_test.c
deleted file mode 100644
index 178ad3314..000000000
--- a/src/service/setu/plugin_block_setu_test.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2017 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file setu/plugin_block_setu_test.c
- * @brief set test block, recognizes elements with non-zero first byte as invalid
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_block_plugin.h"
-#include "gnunet_block_group_lib.h"
-
-
-/**
- * Function called to validate a query.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_setu_test_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
-{
-  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called to validate a block for storage.
- *
- * @param cls closure
- * @param type block type
- * @param block block data to validate
- * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_setu_test_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const void *block,
-                                    size_t block_size)
-{
-  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  if ( (NULL == block) ||
-       (0 == block_size) ||
-       (0 != ((char *) block)[0]) )
-    return GNUNET_NO;
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called to validate a reply to a request.  Note that it is assumed
- * that the reply has already been matched to the key (and signatures checked)
- * as it would be done with the GetKeyFunction and the
- * BlockEvaluationFunction.
- *
- * @param cls closure
- * @param type block type
- * @param group which block group to use for evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_ReplyEvaluationResult
-block_plugin_setu_test_check_reply (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
-{
-  (void) cls;
-  (void) xquery;
-  (void) xquery_size;
-  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  }
-  if ( (NULL == reply_block) ||
-       (0 == reply_block_size) ||
-       (0 != ((char *) reply_block)[0]) )
-    GNUNET_assert (0);
-  return GNUNET_BLOCK_REPLY_OK_MORE;
-}
-
-
-/**
- * Function called to obtain the key for a block.
- *
- * @param cls closure
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes in block
- * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
- */
-static enum GNUNET_GenericReturnValue
-block_plugin_setu_test_get_key (void *cls,
-                                enum GNUNET_BLOCK_Type type,
-                                const void *block,
-                                size_t block_size,
-                                struct GNUNET_HashCode *key)
-{
-  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_NO;
-}
-
-
-/**
- * Entry point for the plugin.
- */
-void *
-libgnunet_plugin_block_setu_test_init (void *cls)
-{
-  static enum GNUNET_BLOCK_Type types[] = {
-                                           GNUNET_BLOCK_TYPE_SETU_TEST,
-    GNUNET_BLOCK_TYPE_ANY       /* end of list */
-  };
-  struct GNUNET_BLOCK_PluginFunctions *api;
-
-  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->get_key = &block_plugin_setu_test_get_key;
-  api->check_query = &block_plugin_setu_test_check_query;
-  api->check_block = &block_plugin_setu_test_check_block;
-  api->check_reply = &block_plugin_setu_test_check_reply;
-  api->types = types;
-  return api;
-}
-
-
-/**
- * Exit point from the plugin.
- */
-void *
-libgnunet_plugin_block_setu_test_done (void *cls)
-{
-  struct GNUNET_BLOCK_PluginFunctions *api = cls;
-
-  GNUNET_free (api);
-  return NULL;
-}
-
-
-/* end of plugin_block_setu_test.c */
diff --git a/src/service/topology/gnunet-daemon-topology.c b/src/service/topology/gnunet-daemon-topology.c
index efabac0fc..71cc5bd19 100644
--- a/src/service/topology/gnunet-daemon-topology.c
+++ b/src/service/topology/gnunet-daemon-topology.c
@@ -641,35 +641,26 @@ consider_for_advertising (const struct GNUNET_MessageHeader *hello)
   int num_addresses_old;
   int num_addresses_new;
   struct GNUNET_HELLO_Builder *builder = GNUNET_HELLO_builder_from_msg (hello);
-  struct GNUNET_PeerIdentity *pid = GNUNET_HELLO_builder_get_id (builder);
+  struct GNUNET_PeerIdentity pid;
   struct Peer *peer;
   uint16_t size;
 
   GNUNET_HELLO_builder_iterate (builder,
-                                pid,
+                                &pid,
                                 &address_iterator,
                                 &num_addresses_new);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "consider 0 for %s\n",
-              GNUNET_i2s (pid));
+              GNUNET_i2s (&pid));
   if (0 == num_addresses_new)
   {
     GNUNET_HELLO_builder_free (builder);
     return; /* no point in advertising this one... */
   }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "consider 1\n");
-  if (NULL == pid)
-  {
-    GNUNET_HELLO_builder_free (builder);
-    return;
-  }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "consider 2\n");
-  peer = GNUNET_CONTAINER_multipeermap_get (peers, pid);
+  peer = GNUNET_CONTAINER_multipeermap_get (peers, &pid);
   if (NULL == peer)
   {
-    peer = make_peer (pid, hello);
+    peer = make_peer (&pid, hello);
   }
   else if (NULL != peer->hello)
   {
@@ -679,10 +670,10 @@ consider_for_advertising (const struct GNUNET_MessageHeader *hello)
     struct GNUNET_TIME_Absolute old_hello_exp =
       GNUNET_HELLO_builder_get_expiration_time (peer->hello);
     struct GNUNET_HELLO_Builder *builder_old = GNUNET_HELLO_builder_from_msg (peer->hello);
-    struct GNUNET_PeerIdentity *pid_old = GNUNET_HELLO_builder_get_id (builder_old);
+    struct GNUNET_PeerIdentity pid_old;
 
     GNUNET_HELLO_builder_iterate (builder_old,
-                                  pid_old,
+                                  &pid_old,
                                   &address_iterator,
                                   &num_addresses_old);
     if (GNUNET_TIME_absolute_cmp (new_hello_exp, >, now) &&
@@ -710,7 +701,7 @@ consider_for_advertising (const struct GNUNET_MessageHeader *hello)
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Found HELLO from peer `%s' for advertising\n",
-              GNUNET_i2s (pid));
+              GNUNET_i2s (&pid));
   if (NULL != peer->filter)
   {
     GNUNET_CONTAINER_bloomfilter_free (peer->filter);
@@ -828,7 +819,7 @@ check_hello (void *cls, const struct GNUNET_MessageHeader *message)
 {
   struct GNUNET_HELLO_Builder *builder = GNUNET_HELLO_builder_from_msg (
     message);
-  struct GNUNET_PeerIdentity *pid = GNUNET_HELLO_builder_get_id (builder);
+  const struct GNUNET_PeerIdentity *pid = GNUNET_HELLO_builder_get_id (builder);
 
   if (NULL == pid)
   {
@@ -858,10 +849,8 @@ handle_hello (void *cls, const struct GNUNET_MessageHeader *message)
 {
   struct GNUNET_PEERSTORE_StoreHelloContext *shc;
   const struct GNUNET_PeerIdentity *other = cls;
-  struct Peer *peer;
   struct GNUNET_HELLO_Builder *builder = GNUNET_HELLO_builder_from_msg (
     message);
-  struct GNUNET_PeerIdentity *pid = GNUNET_HELLO_builder_get_id (builder);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received encrypted HELLO from peer `%s'",
@@ -871,6 +860,7 @@ handle_hello (void *cls, const struct GNUNET_MessageHeader *message)
                             1,
                             GNUNET_NO);
   GNUNET_HELLO_builder_from_msg (message);
+  // FIXME this is not working shc uninitialized
   shc = GNUNET_PEERSTORE_hello_add (ps, message, &shc_cont, shc);
   GNUNET_HELLO_builder_free (builder);
 }