gnunet-service-transport.c

Go to the documentation of this file.

/*
   This file is part of GNUnet.
   Copyright (C) 2010-2016, 2018-2019, 2026 GNUnet e.V.
 
   GNUnet is free software: you can redistribute it and/or modify it
   under the terms of the GNU Affero General Public License as published
   by the Free Software Foundation, either version 3 of the License,
   or (at your option) any later version.
 
   GNUnet is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Affero General Public License for more details.
 
   You should have received a copy of the GNU Affero General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     SPDX-License-Identifier: AGPL3.0-or-later
 */
#include "platform.h"
#include "gnunet_common.h"
#include "gnunet_util_lib.h"
#include "gnunet_statistics_service.h"
#include "gnunet_peerstore_service.h"
#include "gnunet_pils_service.h"
#include "gnunet_transport_communication_service.h"
#include "gnunet_nat_service.h"
#include "gnunet_hello_uri_lib.h"
#include "gnunet_signatures.h"
#include "transport.h"
 
#define RING_BUFFER_SIZE 16
 
#define MAX_FC_RETRANSMIT_COUNT 1000
 
#define MIN_FC_RETRANSMIT_DELAY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 100)
 
#define UNCONFIRMED_LINK_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define MAX_CUMMULATIVE_ACKS 64
 
#define FC_NO_CHANGE_REPLY_PROBABILITY 8
 
#define IN_PACKET_SIZE_WITHOUT_MTU 128
 
#define GOODPUT_AGING_SLOTS 4
 
#define DEFAULT_WINDOW_SIZE (128 * 1024)
 
#define MAX_INCOMING_REQUEST 16
 
#define MAX_DV_DISCOVERY_SELECTION 16
 
#define RECV_WINDOW_SIZE 4
 
#define CORE_FC_STALL_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 2)
 
#define MAX_STALLED_CMCS (4 * RECV_WINDOW_SIZE)
 
#define MIN_DV_PATH_LENGTH_FOR_INITIATOR 3
 
#define MAX_DV_HOPS_ALLOWED 16
 
#define MAX_DV_LEARN_PENDING 64
 
#define MAX_DV_PATHS_TO_TARGET 3
 
#define PILS_FEED_ADDRESSES_DELAY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 3)
 
#define DELAY_WARN_THRESHOLD \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
#define DV_FORWARD_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 60)
 
#define DEFAULT_ACK_WAIT_DURATION \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
 
#define MIN_ACK_WAIT_DURATION \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 10)
 
#define DV_QUALITY_RTT_THRESHOLD \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
 
#define DV_PATH_VALIDITY_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define BACKCHANNEL_INACTIVITY_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define DV_PATH_DISCOVERY_FREQUENCY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 4)
 
#define EPHEMERAL_VALIDITY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 4)
 
#define REASSEMBLY_EXPIRATION \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 4)
 
#define MAX_REASSEMBLY_CONTEXTS 32
 
#define FAST_VALIDATION_CHALLENGE_FREQ \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 1)
 
#define MAX_VALIDATION_CHALLENGE_FREQ \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_DAYS, 1)
 
#define WANTED_VALIDATION_CHALLENGE_FREQ \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define SUGGEST_RETRY_MIN \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
#define SUGGEST_RETRY_MAX \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define ACK_CUMMULATOR_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 4)
 
#define DV_LEARN_BASE_FREQUENCY GNUNET_TIME_UNIT_MINUTES
 
#define DV_LEARN_QUALITY_THRESHOLD 100
 
#define MAX_ADDRESS_VALID_UNTIL \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MONTHS, 1)
 
#define ADDRESS_VALIDATION_LIFETIME \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 4)
 
#define NEIGHBOUR_LIVENESS_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 15)
 
#define FC_KEEPALIVE_INTERVAL \
        GNUNET_TIME_relative_divide (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT, \
                                     2)
 
#define MIN_ADDRESS_REFRESH_INTERVAL \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 30)
 
#define MIN_DELAY_ADDRESS_VALIDATION GNUNET_TIME_UNIT_MILLISECONDS
 
#define VALIDATION_RTT_BUFFER_FACTOR 3
 
#define COMMUNICATOR_TOTAL_QUEUE_LIMIT 512
 
#define QUEUE_LENGTH_LIMIT 32
 
#define QUEUE_ENTRY_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
#define RTT_DIFF  \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
 
#define SHUTDOWN_CLIENT_GRACE_PERIOD \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
GNUNET_NETWORK_STRUCT_BEGIN
 
struct MessageUUIDP
{
  uint64_t uuid GNUNET_PACKED;
};
 
 
struct AcknowledgementUUIDP
{
  struct GNUNET_Uuid value;
};
 
struct TransportBackchannelEncapsulationMessage
{
  struct GNUNET_MessageHeader header;
 
  /* Followed by *another* message header which is the message to
     the communicator */
 
  /* Followed by a 0-terminated name of the communicator */
};
 
 
struct EphemeralConfirmationPS
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_TIME_AbsoluteNBO sender_monotonic_time;
 
  struct GNUNET_PeerIdentity target;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation ephemeral_key;
};
 
 
struct TransportDVBoxPayloadP
{
  struct GNUNET_PeerIdentity sender;
 
  struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
  struct GNUNET_TIME_AbsoluteNBO monotonic_time;
 
  /* Followed by a `struct GNUNET_MessageHeader` with a message
     for the target peer */
};
 
 
struct TransportReliabilityBoxMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t ack_countdown GNUNET_PACKED;
 
  struct AcknowledgementUUIDP ack_uuid;
};
 
 
struct TransportCummulativeAckPayloadP
{
  struct GNUNET_TIME_RelativeNBO ack_delay;
 
  struct AcknowledgementUUIDP ack_uuid;
};
 
 
struct TransportReliabilityAckMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t ack_counter GNUNET_PACKED;
 
  /* followed by any number of `struct TransportCummulativeAckPayloadP`
     messages providing ACKs */
};
 
 
struct TransportFragmentBoxMessage
{
  struct GNUNET_MessageHeader header;
 
  uint16_t frag_off GNUNET_PACKED;
 
  uint16_t msg_size GNUNET_PACKED;
 
  struct AcknowledgementUUIDP ack_uuid;
 
  struct MessageUUIDP msg_uuid;
};
 
 
struct DvInitPS
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_TIME_AbsoluteNBO monotonic_time;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
};
 
 
struct DvHopPS
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_PeerIdentity pred;
 
  struct GNUNET_PeerIdentity succ;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
};
 
 
struct DVPathEntryP
{
  struct GNUNET_PeerIdentity hop;
 
  struct GNUNET_CRYPTO_EddsaSignature hop_sig;
};
 
 
struct TransportDVLearnMessage
{
  struct GNUNET_MessageHeader header;
 
  uint16_t num_hops GNUNET_PACKED;
 
  uint16_t bidirectional GNUNET_PACKED;
 
  struct GNUNET_TIME_RelativeNBO non_network_delay;
 
  struct GNUNET_TIME_AbsoluteNBO monotonic_time;
 
  struct GNUNET_CRYPTO_EddsaSignature init_sig;
 
  struct GNUNET_PeerIdentity initiator;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
  /* Followed by @e num_hops `struct DVPathEntryP` values,
     excluding the initiator of the DV trace; the last entry is the
     current sender; the current peer must not be included. */
};
 
 
struct TransportDVBoxMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t without_fc GNUNET_PACKED;
 
  uint16_t total_hops GNUNET_PACKED;
 
  uint16_t num_hops GNUNET_PACKED;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation ephemeral_key;
 
  struct GNUNET_CRYPTO_AeadNonce iv;
 
  struct GNUNET_CRYPTO_AeadMac mac;
 
  uint16_t orig_size GNUNET_PACKED;
 
  /* Followed by @e num_hops `struct GNUNET_PeerIdentity` values;
     excluding the @e origin and the current peer, the last must be
     the ultimate target; if @e num_hops is zero, the receiver of this
     message is the ultimate target. */
 
  /* Followed by encrypted, variable-size payload, which
     must begin with a `struct TransportDVBoxPayloadP` */
 
  /* Followed by the actual message, which itself must not be a
     a DV_LEARN or DV_BOX message! */
};
 
 
struct TransportValidationChallengeMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t reserved GNUNET_PACKED;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
  struct GNUNET_TIME_AbsoluteNBO sender_time;
};
 
 
struct TransportValidationPS
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_TIME_RelativeNBO validity_duration;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
};
 
 
struct TransportValidationResponseMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t reserved GNUNET_PACKED;
 
  struct GNUNET_CRYPTO_EddsaSignature signature;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
  struct GNUNET_TIME_AbsoluteNBO origin_time;
 
  struct GNUNET_TIME_RelativeNBO validity_duration;
};
 
struct TransportGlobalNattedAddress
{
  uint32_t address_length GNUNET_PACKED;
 
  /* Followed by @e address_length bytes of the address. */
};
 
struct TransportFlowControlMessage
{
  struct GNUNET_MessageHeader header;
 
  uint32_t seq GNUNET_PACKED;
 
  uint64_t inbound_window_size GNUNET_PACKED;
 
  uint64_t outbound_sent GNUNET_PACKED;
 
  uint64_t outbound_window_size GNUNET_PACKED;
 
  struct GNUNET_TIME_AbsoluteNBO sender_time;
 
  struct GNUNET_TIME_RelativeNBO rtt;
 
  uint32_t sync_ready GNUNET_PACKED;
 
  uint32_t number_of_addresses GNUNET_PACKED;
 
  uint32_t size_of_addresses GNUNET_PACKED;
 
  /* Followed by @e number_of_addresses struct TransportGlobalNattedAddress. */
};
 
GNUNET_NETWORK_STRUCT_END
 
/* GNUNET_NETWORK_STRUCT_BEGIN/_END expand to nothing; only the per-member
   GNUNET_PACKED keeps these layouts free of compiler padding.  Pin the sizes
   so that adding an unpacked or non-fixed-width member cannot silently put
   padding bytes -- i.e. uninitialised stack -- on the wire again. */
GNUNET_static_assert (sizeof(struct TransportGlobalNattedAddress) == 4);
 
GNUNET_static_assert (sizeof(struct TransportFlowControlMessage) == 60);
GNUNET_static_assert (sizeof(struct TransportDVBoxMessage) == 86);
GNUNET_static_assert (sizeof(struct TransportDVLearnMessage) == 152);
GNUNET_static_assert (sizeof(struct TransportFragmentBoxMessage) == 32);
GNUNET_static_assert (sizeof(struct TransportReliabilityBoxMessage) == 24);
GNUNET_static_assert (sizeof(struct TransportReliabilityAckMessage) == 8);
GNUNET_static_assert (sizeof(struct TransportValidationChallengeMessage) == 48);
GNUNET_static_assert (sizeof(struct TransportValidationResponseMessage) == 120);
 
 
enum ClientType
{
  CT_NONE = 0,
 
  CT_CORE = 1,
 
  CT_MONITOR = 2,
 
  CT_COMMUNICATOR = 3,
 
  CT_APPLICATION = 4
};
 
 
enum RouteMessageOptions
{
  RMO_NONE = 0,
 
  RMO_DV_ALLOWED = 1,
 
  RMO_UNCONFIRMED_ALLOWED = 2,
 
  RMO_ANYTHING_GOES = (RMO_DV_ALLOWED | RMO_UNCONFIRMED_ALLOWED),
 
  RMO_REDUNDANT = 4
};
 
 
struct LearnLaunchEntry
{
  struct LearnLaunchEntry *prev;
 
  struct LearnLaunchEntry *next;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
  struct GNUNET_TIME_Absolute launch_time;
};
 
 
struct TransmissionHistoryEntry
{
  uint64_t bytes_sent;
 
  uint64_t bytes_received;
};
 
 
struct PerformanceData
{
  struct GNUNET_TIME_Relative aged_rtt;
 
  struct TransmissionHistoryEntry the[GOODPUT_AGING_SLOTS];
 
  unsigned int last_age;
};
 
 
struct TransportClient;
 
struct Neighbour;
 
struct DistanceVector;
 
struct Queue;
 
struct PendingMessage;
 
struct DistanceVectorHop;
 
struct VirtualLink;
 
 
struct CommunicatorMessageContext
{
  struct CommunicatorMessageContext *next;
 
  struct CommunicatorMessageContext *prev;
 
  struct TransportClient *tc;
 
  struct GNUNET_TRANSPORT_IncomingMessage im;
 
  const struct GNUNET_MessageHeader *mh;
 
  uint16_t total_hops;
 
  unsigned int ack_sent;
 
  unsigned int client_resumed;
};
 
 
struct RingBufferEntry
{
  struct CommunicatorMessageContext *cmc;
 
  struct GNUNET_MessageHeader *mh;
};
 
 
struct CoreSentContext
{
  struct CoreSentContext *next;
 
  struct CoreSentContext *prev;
 
  struct VirtualLink *vl;
 
  uint16_t size;
 
  uint16_t isize;
};
 
 
struct ReassemblyContext
{
  struct MessageUUIDP msg_uuid;
 
  struct VirtualLink *virtual_link;
 
  struct GNUNET_CONTAINER_HeapNode *hn;
 
  uint8_t *bitfield;
 
  struct GNUNET_TIME_Absolute reassembly_timeout;
 
  struct GNUNET_TIME_Absolute last_frag;
 
  uint16_t msg_size;
 
  uint16_t msg_missing;
 
  /* Followed by @e msg_size bytes of the (partially) defragmented original
   * message */
 
  /* Followed by @e bitfield data */
};
 
 
struct VirtualLink
{
  struct GNUNET_PeerIdentity target;
 
  struct GNUNET_CONTAINER_MultiHashMap32 *reassembly_map;
 
  struct GNUNET_CONTAINER_Heap *reassembly_heap;
 
  struct GNUNET_SCHEDULER_Task *reassembly_timeout_task;
 
  struct CommunicatorMessageContext *cmc_head;
 
  struct CommunicatorMessageContext *cmc_tail;
 
  unsigned int cmc_count;
 
  struct GNUNET_SCHEDULER_Task *core_fc_stall_task;
 
  struct PendingMessage *pending_msg_head;
 
  struct PendingMessage *pending_msg_tail;
 
  struct CoreSentContext *csc_tail;
 
  struct CoreSentContext *csc_head;
 
  struct GNUNET_SCHEDULER_Task *visibility_task;
 
  struct GNUNET_SCHEDULER_Task *fc_retransmit_task;
 
  struct GNUNET_SCHEDULER_Task *unconfirmed_timeout_task;
 
  struct GNUNET_StartBurstCls *sb_cls;
 
  char *burst_addr;
 
  unsigned int fc_retransmit_count;
 
  unsigned int confirmed;
 
  struct Neighbour *n;
 
  struct DistanceVector *dv;
 
  struct GNUNET_TIME_Absolute n_challenge_time;
 
  struct GNUNET_TIME_Absolute last_fc_transmission;
 
  struct GNUNET_TIME_Absolute last_fc_timestamp;
 
  struct GNUNET_TIME_Relative last_fc_rtt;
 
  struct GNUNET_TIME_Relative other_rtt;
 
  struct GNUNET_PEERSTORE_IterateContext *ic;
 
  uint64_t message_uuid_ctr;
 
  uint64_t available_fc_window_size;
 
  uint64_t incoming_fc_window_size_ram;
 
  uint64_t incoming_fc_window_size;
 
  uint64_t incoming_fc_window_size_used;
 
  int64_t incoming_fc_window_size_loss;
 
  uint64_t outbound_fc_window_size;
 
  uint64_t outbound_fc_window_size_used;
 
  uint64_t last_outbound_window_size_received;
 
  uint32_t fc_seq_gen;
 
  uint32_t last_fc_seq;
 
  int core_recv_window;
 
  enum GNUNET_GenericReturnValue sync_ready;
};
 
 
struct PendingAcknowledgement
{
  struct PendingAcknowledgement *next_pm;
 
  struct PendingAcknowledgement *prev_pm;
 
  struct PendingAcknowledgement *next_queue;
 
  struct PendingAcknowledgement *prev_queue;
 
  struct PendingAcknowledgement *next_dvh;
 
  struct PendingAcknowledgement *prev_dvh;
 
  struct AcknowledgementUUIDP ack_uuid;
 
  struct PendingMessage *pm;
 
  struct DistanceVectorHop *dvh;
 
  struct Queue *queue;
 
  struct GNUNET_TIME_Absolute transmission_time;
 
  uint16_t message_size;
 
  unsigned int num_send;
};
 
 
struct DistanceVectorHop
{
  struct DistanceVectorHop *next_dv;
 
  struct DistanceVectorHop *prev_dv;
 
  struct DistanceVectorHop *next_neighbour;
 
  struct DistanceVectorHop *prev_neighbour;
 
  struct PendingAcknowledgement *pa_head;
 
  struct PendingAcknowledgement *pa_tail;
 
  struct Neighbour *next_hop;
 
  struct DistanceVector *dv;
 
  const struct GNUNET_PeerIdentity *path;
 
  struct GNUNET_TIME_Absolute timeout;
 
  struct GNUNET_TIME_Absolute path_valid_until;
 
  struct PerformanceData pd;
 
  unsigned int distance;
};
 
 
struct DistanceVector
{
  struct GNUNET_PeerIdentity target;
 
  struct DistanceVectorHop *dv_head;
 
  struct DistanceVectorHop *dv_tail;
 
  struct GNUNET_SCHEDULER_Task *timeout_task;
 
  struct VirtualLink *vl;
 
  struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
  struct GNUNET_TIME_Absolute ephemeral_validity;
 
  struct GNUNET_TIME_Absolute monotime;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation ephemeral_key;
 
  struct GNUNET_ShortHashCode *km;
};
 
 
struct QueueEntry
{
  struct QueueEntry *next;
 
  struct QueueEntry *prev;
 
  struct Queue *queue;
 
  struct PendingMessage *pm;
 
  uint64_t mid;
 
  struct GNUNET_TIME_Absolute creation_timestamp;
};
 
 
struct Queue
{
  struct Queue *next_neighbour;
 
  struct Queue *prev_neighbour;
 
  struct Queue *prev_client;
 
  struct Queue *next_client;
 
  struct PendingAcknowledgement *pa_head;
 
  struct PendingAcknowledgement *pa_tail;
 
  struct QueueEntry *queue_head;
 
  struct QueueEntry *queue_tail;
 
  struct Neighbour *neighbour;
 
  struct TransportClient *tc;
 
  const char *address;
 
  unsigned int unlimited_length;
 
  struct GNUNET_SCHEDULER_Task *transmit_task;
 
  struct GNUNET_TIME_Absolute validated_until;
 
  struct PerformanceData pd;
 
  struct GNUNET_PEERSTORE_Monitor *mo;
 
  uint64_t mid_gen;
 
  uint32_t qid;
 
  uint32_t mtu;
 
  uint32_t num_msg_pending;
 
  uint32_t num_bytes_pending;
 
  unsigned int queue_length;
 
  uint64_t q_capacity;
 
  uint32_t priority;
 
  enum GNUNET_NetworkType nt;
 
  enum GNUNET_TRANSPORT_ConnectionStatus cs;
 
  int idle;
 
  enum GNUNET_GenericReturnValue is_global_natted;
};
 
 
struct Neighbour
{
  struct GNUNET_PeerIdentity pid;
 
  struct DistanceVectorHop *dv_head;
 
  struct DistanceVectorHop *dv_tail;
 
  struct GNUNET_TIME_Absolute last_inbound;
 
  struct Queue *queue_head;
 
  struct Queue *queue_tail;
 
  struct GNUNET_PEERSTORE_IterateContext *get;
 
  struct GNUNET_PEERSTORE_StoreContext *sc;
 
  struct VirtualLink *vl;
 
  struct GNUNET_TIME_Absolute last_dv_learn_monotime;
 
  int dv_monotime_available;
 
  struct GNUNET_CONTAINER_MultiPeerMap *natted_addresses;
 
  unsigned int number_of_addresses;
 
  size_t size_of_global_addresses;
 
  enum GNUNET_GenericReturnValue is_global_natted;
};
 
 
struct IncomingRequest
{
  struct IncomingRequest *next;
 
  struct IncomingRequest *prev;
 
  struct GNUNET_PEERSTORE_Monitor *nc;
 
  struct GNUNET_PeerIdentity pid;
};
 
 
struct PeerRequest
{
  struct GNUNET_PeerIdentity pid;
 
  struct TransportClient *tc;
 
  struct GNUNET_PEERSTORE_Monitor *nc;
 
  struct GNUNET_SCHEDULER_Task *retry_task;
 
  struct GNUNET_TIME_Relative retry_backoff;
 
  enum GNUNET_MQ_PriorityPreferences pk;
 
  struct GNUNET_BANDWIDTH_Value32NBO bw;
};
 
 
enum PendingMessageType
{
  PMT_CORE = 0,
 
  PMT_FRAGMENT_BOX = 1,
 
  PMT_RELIABILITY_BOX = 2,
 
  PMT_DV_BOX = 3
};
 
 
struct PendingMessage
{
  struct PendingMessage *next_vl;
 
  struct PendingMessage *prev_vl;
 
  struct PendingMessage *next_client;
 
  struct PendingMessage *prev_client;
 
  struct PendingMessage *next_frag;
 
  struct PendingMessage *prev_frag;
 
  struct PendingAcknowledgement *pa_head;
 
  struct PendingAcknowledgement *pa_tail;
 
  struct PendingMessage *bpm;
 
  struct VirtualLink *vl;
 
  struct GNUNET_PeerIdentity target;
 
  struct QueueEntry *qe;
 
  struct TransportClient *client;
 
  struct PendingMessage *head_frag;
 
  struct PendingMessage *tail_frag;
 
  struct PendingMessage *frag_parent;
 
  struct GNUNET_TIME_Absolute timeout;
 
  struct GNUNET_TIME_Absolute next_attempt;
 
  struct MessageUUIDP msg_uuid;
 
  uint64_t logging_uuid;
 
  enum PendingMessageType pmt;
 
  enum GNUNET_MQ_PriorityPreferences prefs;
 
  struct DistanceVectorHop *used_dvh;
 
  uint16_t bytes_msg;
 
  uint16_t frag_off;
 
  uint32_t frags_in_flight;
 
  uint32_t frags_in_flight_round;
 
  uint16_t frag_count;
 
  int16_t msg_uuid_set;
 
  int16_t client_credited;
 
  /* Followed by @e bytes_msg to transmit */
};
 
 
struct TransportCummulativeAckPayload
{
  struct GNUNET_TIME_Absolute receive_time;
 
  struct AcknowledgementUUIDP ack_uuid;
};
 
 
struct AcknowledgementCummulator
{
  struct GNUNET_PeerIdentity target;
 
  struct TransportCummulativeAckPayload ack_uuids[MAX_CUMMULATIVE_ACKS];
 
  struct GNUNET_SCHEDULER_Task *task;
 
  struct GNUNET_TIME_Absolute min_transmission_time;
 
  uint32_t ack_counter;
 
  unsigned int num_acks;
};
 
 
struct PilsAddressSignContext;
 
 
struct AddressListEntry
{
  struct AddressListEntry *next;
 
  struct AddressListEntry *prev;
 
  struct TransportClient *tc;
 
  struct GNUNET_PEERSTORE_StoreHelloContext *shc;
 
  struct PilsAddressSignContext *pc;
 
  const char *address;
 
  void *signed_address;
 
  size_t signed_address_len;
 
  struct GNUNET_PEERSTORE_StoreContext *sc;
 
  struct GNUNET_SCHEDULER_Task *st;
 
  struct GNUNET_TIME_Relative expiration;
 
  struct GNUNET_TIME_Relative pils_backoff;
 
  uint32_t aid;
 
  enum GNUNET_NetworkType nt;
};
 
 
struct TransportClient
{
  struct TransportClient *next;
 
  struct TransportClient *prev;
 
  struct GNUNET_SERVICE_Client *client;
 
  struct GNUNET_MQ_Handle *mq;
 
  enum ClientType type;
 
  union
  {
    struct
    {
      struct PendingMessage *pending_msg_head;
 
      struct PendingMessage *pending_msg_tail;
    } core;
 
    struct
    {
      struct GNUNET_PeerIdentity peer;
 
      int one_shot;
    } monitor;
 
 
    struct
    {
      char *address_prefix;
 
      struct Queue *queue_head;
 
      struct Queue *queue_tail;
 
      struct AddressListEntry *addr_head;
 
      struct AddressListEntry *addr_tail;
 
      unsigned int total_queue_length;
 
      struct GNUNET_SCHEDULER_Task *free_queue_entry_task;
 
      enum GNUNET_TRANSPORT_CommunicatorCharacteristics cc;
 
      enum GNUNET_GenericReturnValue can_burst;
 
    } communicator;
 
    struct
    {
      struct GNUNET_CONTAINER_MultiPeerMap *requests;
    } application;
  } details;
};
 
 
struct ValidationState
{
  struct GNUNET_PeerIdentity pid;
 
  struct GNUNET_TIME_Absolute valid_until;
 
  struct GNUNET_TIME_Absolute validated_until;
 
  struct GNUNET_TIME_Absolute first_challenge_use;
 
  struct GNUNET_TIME_Absolute last_challenge_use;
 
  struct GNUNET_TIME_Absolute next_challenge;
 
  struct GNUNET_TIME_Relative challenge_backoff;
 
  struct GNUNET_TIME_Relative validation_rtt;
 
  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
  struct GNUNET_HashCode hc;
 
  struct GNUNET_SCHEDULER_Task *revalidation_task;
 
  char *address;
 
  struct GNUNET_CONTAINER_HeapNode *hn;
 
  struct GNUNET_PEERSTORE_StoreContext *sc;
 
  uint32_t last_window_consum_limit;
 
  int awaiting_queue;
};
 
 
struct Backtalker
{
  struct GNUNET_PeerIdentity pid;
 
  struct GNUNET_TIME_Absolute monotonic_time;
 
  struct GNUNET_TIME_Absolute timeout;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation last_ephemeral;
 
  struct GNUNET_SCHEDULER_Task *task;
 
  struct CommunicatorMessageContext *cmc;
 
  struct GNUNET_PEERSTORE_IterateContext *get;
 
  struct GNUNET_PEERSTORE_StoreContext *sc;
 
  size_t body_size;
};
 
static struct RingBufferEntry *ring_buffer[RING_BUFFER_SIZE];
 
static unsigned int ring_buffer_head;
 
static unsigned int is_ring_buffer_full;
 
static struct PendingMessage *ring_buffer_dv[RING_BUFFER_SIZE];
 
static unsigned int ring_buffer_dv_head;
 
static unsigned int is_ring_buffer_dv_full;
 
static struct TransportClient *clients_head;
 
static struct TransportClient *clients_tail;
 
static struct GNUNET_STATISTICS_Handle *GST_stats;
 
static const struct GNUNET_CONFIGURATION_Handle *GST_cfg;
 
static struct GNUNET_SERVICE_Handle *GST_service;
 
static struct GNUNET_SCHEDULER_Task *client_grace_task;
 
struct GNUNET_HELLO_Builder *GST_my_hello;
 
static struct GNUNET_CONTAINER_MultiPeerMap *neighbours;
 
static struct GNUNET_CONTAINER_MultiPeerMap *backtalkers;
 
static struct GNUNET_CONTAINER_MultiPeerMap *ack_cummulators;
 
static struct GNUNET_CONTAINER_MultiUuidmap *pending_acks;
 
static struct GNUNET_CONTAINER_MultiPeerMap *dv_routes;
 
static struct GNUNET_CONTAINER_MultiPeerMap *validation_map;
 
static struct GNUNET_CONTAINER_MultiHashMap *revalidation_map;
 
static struct GNUNET_CONTAINER_MultiPeerMap *links;
 
static struct GNUNET_CONTAINER_MultiShortmap *dvlearn_map;
 
static struct LearnLaunchEntry *lle_head = NULL;
 
static struct LearnLaunchEntry *lle_tail = NULL;
 
static struct GNUNET_CONTAINER_Heap *validation_heap;
 
struct GNUNET_NAT_Handle *nh;
 
static struct GNUNET_PEERSTORE_Handle *peerstore;
 
static struct GNUNET_PILS_Handle *pils;
 
struct PilsRequest
{
  struct PilsRequest *prev;
 
  struct PilsRequest *next;
 
  struct GNUNET_PILS_Operation *op;
};
 
static struct PilsRequest *pils_requests_head;
 
static struct PilsRequest *pils_requests_tail;
 
static enum GNUNET_GenericReturnValue
sign_by_my_identity (const struct GNUNET_CRYPTO_SignaturePurpose *purpose,
                     struct GNUNET_CRYPTO_EddsaSignature *sig)
{
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
 
  my_private_key = GNUNET_PILS_get_private_key (pils);
  if (NULL == my_private_key)
  {
    /* #run() enables local key access, so this means the key on disk does
       not match the identity PILS announced, or no identity is known yet. */
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "No private key for our peer identity, cannot sign\n");
    GNUNET_STATISTICS_update (GST_stats,
                              "# signatures failed (no private key)",
                              1,
                              GNUNET_NO);
    return GNUNET_SYSERR;
  }
  return GNUNET_CRYPTO_eddsa_sign_ (my_private_key, purpose, sig);
}
 
 
static struct GNUNET_SCHEDULER_Task *dvlearn_task;
 
static struct GNUNET_TIME_Relative dvlearn_pils_backoff;
 
static struct GNUNET_SCHEDULER_Task *validation_task;
 
static struct GNUNET_SCHEDULER_Task *pils_feed_task;
 
static struct IncomingRequest *ir_head;
 
static struct IncomingRequest *ir_tail;
 
static unsigned int ir_total;
 
static unsigned long long logging_uuid_gen;
 
static enum GNUNET_GenericReturnValue burst_running;
 
static struct GNUNET_TIME_Absolute hello_mono_time;
 
static int in_shutdown;
 
static struct GNUNET_SCHEDULER_Task *burst_task;
 
static struct GNUNET_StartBurstCls *burst_task_cls;
 
struct GNUNET_SCHEDULER_Task *burst_timeout_task;
 
enum GNUNET_GenericReturnValue use_burst;
 
static unsigned int
get_age ()
{
  struct GNUNET_TIME_Absolute now;
 
  now = GNUNET_TIME_absolute_get ();
  return now.abs_value_us / GNUNET_TIME_UNIT_MINUTES.rel_value_us / 15;
}
 
 
static void
free_incoming_request (struct IncomingRequest *ir)
{
  GNUNET_CONTAINER_DLL_remove (ir_head, ir_tail, ir);
  GNUNET_assert (ir_total > 0);
  ir_total--;
  if (NULL != ir->nc)
    GNUNET_PEERSTORE_monitor_stop (ir->nc);
  ir->nc = NULL;
  GNUNET_free (ir);
}
 
 
static void
free_pending_acknowledgement (struct PendingAcknowledgement *pa)
{
  struct Queue *q = pa->queue;
  struct PendingMessage *pm = pa->pm;
  struct DistanceVectorHop *dvh = pa->dvh;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "free_pending_acknowledgement\n");
  if (NULL != q)
  {
    GNUNET_CONTAINER_MDLL_remove (queue, q->pa_head, q->pa_tail, pa);
    pa->queue = NULL;
  }
  if (NULL != pm)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "remove pa from message\n");
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "remove pa from message %" PRIu64 "\n",
                pm->logging_uuid);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "remove pa from message %u\n",
                pm->pmt);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "remove pa from message %s\n",
                GNUNET_uuid2s (&pa->ack_uuid.value));
    GNUNET_CONTAINER_MDLL_remove (pm, pm->pa_head, pm->pa_tail, pa);
    pa->pm = NULL;
  }
  if (NULL != dvh)
  {
    GNUNET_CONTAINER_MDLL_remove (dvh, dvh->pa_head, dvh->pa_tail, pa);
    pa->dvh = NULL;
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multiuuidmap_remove (pending_acks,
                                                       &pa->ack_uuid.value,
                                                       pa));
  GNUNET_free (pa);
}
 
 
static void
free_fragment_tree (struct PendingMessage *root)
{
  struct PendingMessage *frag;
 
  while (NULL != (frag = root->head_frag))
  {
    struct PendingAcknowledgement *pa;
 
    free_fragment_tree (frag);
    /* Release them: a `struct PendingAcknowledgement' whose @e pm is gone
       can never do anything useful again -- handle_acknowledged() would
       just free it -- but it stays in #pending_acks, and only an ACK that
       may never come takes it out.  Merely detaching it here leaked one
       entry per fragment that was not acknowledged before its message went
       away, which on a lossy link is unbounded growth. */
    while (NULL != (pa = frag->pa_head))
      free_pending_acknowledgement (pa);
    GNUNET_CONTAINER_MDLL_remove (frag, root->head_frag, root->tail_frag, frag);
    if (NULL != frag->qe)
    {
      GNUNET_assert (frag == frag->qe->pm);
      frag->qe->pm = NULL;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Free frag %p\n",
                frag);
    GNUNET_free (frag);
  }
}
 
 
static void
free_pending_message (struct PendingMessage *pm)
{
  struct TransportClient *tc = pm->client;
  struct VirtualLink *vl = pm->vl;
  struct PendingAcknowledgement *pa;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Freeing pm %p\n",
              pm);
  if (NULL != tc)
  {
    GNUNET_CONTAINER_MDLL_remove (client,
                                  tc->details.core.pending_msg_head,
                                  tc->details.core.pending_msg_tail,
                                  pm);
  }
  if ((NULL != vl) && (NULL == pm->frag_parent))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Removing pm %" PRIu64 "\n",
                pm->logging_uuid);
    GNUNET_CONTAINER_MDLL_remove (vl,
                                  vl->pending_msg_head,
                                  vl->pending_msg_tail,
                                  pm);
  }
  else if (NULL != pm->frag_parent && PMT_DV_BOX != pm->pmt)
  {
    struct PendingMessage *root = pm->frag_parent;
 
    while (NULL != root->frag_parent && PMT_DV_BOX != root->pmt)
      root = root->frag_parent;
 
    root->frag_count--;
  }
  /* Same as in #free_fragment_tree(): the message these acknowledgements
     belong to is going away, so they are garbage rather than orphans. */
  while (NULL != (pa = pm->pa_head))
    free_pending_acknowledgement (pa);
 
  free_fragment_tree (pm);
  if (NULL != pm->qe)
  {
    GNUNET_assert (pm == pm->qe->pm);
    pm->qe->pm = NULL;
  }
  if (NULL != pm->bpm)
  {
    free_fragment_tree (pm->bpm);
    /* @e bpm is released with GNUNET_free() rather than through
       #free_pending_message(), so nothing here ever unlinked the
       acknowledgements attached to the box itself -- only those of its
       fragments, via the call above.  They kept @e pm pointing into the
       block we are about to release, and #handle_acknowledged() follows
       that pointer when the ACK finally arrives. */
    while (NULL != (pa = pm->bpm->pa_head))
      free_pending_acknowledgement (pa);
    if (NULL != pm->bpm->qe)
    {
      struct QueueEntry *qe = pm->bpm->qe;
 
      qe->pm = NULL;
    }
    GNUNET_free (pm->bpm);
  }
 
  GNUNET_free (pm);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Freeing pm done\n");
}
 
 
static void
free_reassembly_context (struct ReassemblyContext *rc)
{
  struct VirtualLink *vl = rc->virtual_link;
 
  GNUNET_assert (rc == GNUNET_CONTAINER_heap_remove_node (rc->hn));
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap32_remove (vl->reassembly_map,
                                                         rc->msg_uuid.uuid,
                                                         rc));
  GNUNET_free (rc);
}
 
 
static void
reassembly_cleanup_task (void *cls)
{
  struct VirtualLink *vl = cls;
  struct ReassemblyContext *rc;
 
  vl->reassembly_timeout_task = NULL;
  while (NULL != (rc = GNUNET_CONTAINER_heap_peek (vl->reassembly_heap)))
  {
    if (0 == GNUNET_TIME_absolute_get_remaining (rc->reassembly_timeout)
        .rel_value_us)
    {
      free_reassembly_context (rc);
      continue;
    }
    GNUNET_assert (NULL == vl->reassembly_timeout_task);
    vl->reassembly_timeout_task =
      GNUNET_SCHEDULER_add_at (rc->reassembly_timeout,
                               &reassembly_cleanup_task,
                               vl);
    return;
  }
}
 
 
static int
free_reassembly_cb (void *cls, uint32_t key, void *value)
{
  struct ReassemblyContext *rc = value;
 
  (void) cls;
  (void) key;
  free_reassembly_context (rc);
  return GNUNET_OK;
}
 
 
static void
finish_cmc_handling_with_continue (struct CommunicatorMessageContext *cmc,
                                   unsigned int free_cmc);
 
 
static void
release_stalled_cmc (struct VirtualLink *vl,
                     struct CommunicatorMessageContext *cmc);
 
 
static void
free_burst_cls (struct GNUNET_StartBurstCls *sb_cls);
 
 
static void
send_ok_to_client (struct TransportClient *tc,
                   const struct GNUNET_PeerIdentity *pid)
{
  struct GNUNET_MQ_Envelope *env;
  struct SendOkMessage *so_msg;
 
  if (NULL == tc)
    return;
  env = GNUNET_MQ_msg (so_msg, GNUNET_MESSAGE_TYPE_TRANSPORT_SEND_OK);
  so_msg->peer = *pid;
  GNUNET_MQ_send (tc->mq, env);
}
 
 
static void
credit_client (struct PendingMessage *pm)
{
  if ((NULL == pm->client) || (GNUNET_YES == pm->client_credited))
    return;
  pm->client_credited = GNUNET_YES;
  send_ok_to_client (pm->client, &pm->vl->target);
}
 
 
static void
free_virtual_link (struct VirtualLink *vl)
{
  struct PendingMessage *pm;
  struct CoreSentContext *csc;
  struct CommunicatorMessageContext *cmc;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "free virtual link %p\n",
              vl);
 
  /* Communicators that are blocked on CORE flow control for this link MUST
     be resumed here.  Otherwise their `struct CommunicatorMessageContext's
     leak and -- worse -- those clients never get their
     GNUNET_SERVICE_client_continue() and stall forever. */
  while (NULL != (cmc = vl->cmc_head))
    release_stalled_cmc (vl, cmc);
  if (NULL != vl->core_fc_stall_task)
  {
    GNUNET_SCHEDULER_cancel (vl->core_fc_stall_task);
    vl->core_fc_stall_task = NULL;
  }
 
  if (NULL != vl->reassembly_map)
  {
    GNUNET_CONTAINER_multihashmap32_iterate (vl->reassembly_map,
                                             &free_reassembly_cb,
                                             NULL);
    GNUNET_CONTAINER_multihashmap32_destroy (vl->reassembly_map);
    vl->reassembly_map = NULL;
    GNUNET_CONTAINER_heap_destroy (vl->reassembly_heap);
    vl->reassembly_heap = NULL;
  }
  if (NULL != vl->reassembly_timeout_task)
  {
    GNUNET_SCHEDULER_cancel (vl->reassembly_timeout_task);
    vl->reassembly_timeout_task = NULL;
  }
  while (NULL != (pm = vl->pending_msg_head))
  {
    /* These never got transmitted, so #completed_pending_message() will not
       run for them and nobody else answers their SEND either.  Return the
       window credit anyway: CORE keeps its `struct Neighbour' -- and thus
       the window -- until it sees our DISCONNECT, and #handle_client_send()
       deliberately tolerates a SEND for a link that is already gone, so a
       client can easily still be sending while we free this. */
    credit_client (pm);
    free_pending_message (pm);
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multipeermap_remove (links, &vl->target, vl));
  if (NULL != vl->visibility_task)
  {
    GNUNET_SCHEDULER_cancel (vl->visibility_task);
    vl->visibility_task = NULL;
  }
  if (NULL != vl->fc_retransmit_task)
  {
    GNUNET_SCHEDULER_cancel (vl->fc_retransmit_task);
    vl->fc_retransmit_task = NULL;
  }
  while (NULL != (csc = vl->csc_head))
  {
    GNUNET_CONTAINER_DLL_remove (vl->csc_head, vl->csc_tail, csc);
    GNUNET_assert (vl == csc->vl);
    csc->vl = NULL;
  }
  if (NULL != vl->unconfirmed_timeout_task)
  {
    GNUNET_SCHEDULER_cancel (vl->unconfirmed_timeout_task);
    vl->unconfirmed_timeout_task = NULL;
  }
  if (NULL != vl->ic)
  {
    /* the closure of this iteration is @e sb_cls, released just below */
    GNUNET_PEERSTORE_iteration_stop (vl->ic);
    vl->ic = NULL;
  }
  if (NULL != vl->sb_cls)
  {
    /* Cancels #burst_task if that task's closure is ours: it would
       otherwise run on this (freed) link. */
    free_burst_cls (vl->sb_cls);
    GNUNET_assert (NULL == vl->sb_cls);
  }
  GNUNET_free (vl->burst_addr);
  GNUNET_break (NULL == vl->n);
  GNUNET_break (NULL == vl->dv);
  GNUNET_free (vl);
}
 
 
static void
free_validation_state (struct ValidationState *vs)
{
  if (NULL != vs->revalidation_task)
  {
    GNUNET_SCHEDULER_cancel (vs->revalidation_task);
    vs->revalidation_task = NULL;
  }
  /*memcpy (&hkey,
          &hc,
          sizeof (hkey));*/
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Remove key %s for address %s map size %u contains %u during freeing state\n",
              GNUNET_h2s (&vs->hc),
              vs->address,
              GNUNET_CONTAINER_multihashmap_size (revalidation_map),
              GNUNET_CONTAINER_multihashmap_contains (revalidation_map,
                                                      &vs->hc));
  GNUNET_CONTAINER_multihashmap_remove (revalidation_map, &vs->hc, vs);
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multipeermap_remove (validation_map, &vs->pid, vs));
  GNUNET_CONTAINER_heap_remove_node (vs->hn);
  vs->hn = NULL;
  if (NULL != vs->sc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "store cancel\n");
    GNUNET_PEERSTORE_store_cancel (vs->sc);
    vs->sc = NULL;
  }
  GNUNET_free (vs->address);
  GNUNET_free (vs);
}
 
 
static struct Neighbour *
lookup_neighbour (const struct GNUNET_PeerIdentity *pid)
{
  return GNUNET_CONTAINER_multipeermap_get (neighbours, pid);
}
 
 
static struct VirtualLink *
lookup_virtual_link (const struct GNUNET_PeerIdentity *pid)
{
  return GNUNET_CONTAINER_multipeermap_get (links, pid);
}
 
 
struct MonitorEvent
{
  struct GNUNET_TIME_Absolute last_validation;
  struct GNUNET_TIME_Absolute valid_until;
  struct GNUNET_TIME_Absolute next_validation;
 
  struct GNUNET_TIME_Relative rtt;
 
  enum GNUNET_TRANSPORT_ConnectionStatus cs;
 
  uint32_t num_msg_pending;
 
  uint32_t num_bytes_pending;
};
 
 
static void
free_distance_vector_hop (struct DistanceVectorHop *dvh)
{
  struct Neighbour *n = dvh->next_hop;
  struct DistanceVector *dv = dvh->dv;
  struct PendingAcknowledgement *pa;
 
  while (NULL != (pa = dvh->pa_head))
  {
    GNUNET_CONTAINER_MDLL_remove (dvh, dvh->pa_head, dvh->pa_tail, pa);
    pa->dvh = NULL;
  }
  GNUNET_CONTAINER_MDLL_remove (neighbour, n->dv_head, n->dv_tail, dvh);
  GNUNET_CONTAINER_MDLL_remove (dv, dv->dv_head, dv->dv_tail, dvh);
  GNUNET_free (dvh);
}
 
 
static void
check_link_down (void *cls);
 
 
static void
cores_send_disconnect_info (const struct GNUNET_PeerIdentity *pid)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Informing CORE clients about disconnect from %s\n",
              GNUNET_i2s (pid));
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    struct GNUNET_MQ_Envelope *env;
    struct DisconnectInfoMessage *dim;
 
    if (CT_CORE != tc->type)
      continue;
    env = GNUNET_MQ_msg (dim, GNUNET_MESSAGE_TYPE_TRANSPORT_DISCONNECT);
    dim->peer = *pid;
    GNUNET_MQ_send (tc->mq, env);
  }
}
 
 
static void
try_to_bring_link_up (const struct GNUNET_PeerIdentity *pid);
 
 
static void
disconnect_and_free_virtual_link (struct VirtualLink *vl)
{
  struct GNUNET_PeerIdentity target = vl->target;
 
  for (struct PendingMessage *pm = vl->pending_msg_head;
       NULL != pm;
       pm = pm->next_vl)
    credit_client (pm);
  cores_send_disconnect_info (&vl->target);
  free_virtual_link (vl);
  /* Start getting it back now.  Only #handle_validation_response() can
     rebuild it, and a successful validation parks @e revalidation_task just
     short of #ADDRESS_VALIDATION_LIFETIME -- four hours away. */
  try_to_bring_link_up (&target);
}
 
 
static void
free_dv_route (struct DistanceVector *dv)
{
  struct DistanceVectorHop *dvh;
  struct VirtualLink *vl;
 
  while (NULL != (dvh = dv->dv_head))
    free_distance_vector_hop (dvh);
 
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multipeermap_remove (dv_routes, &dv->target, dv));
  if (NULL != (vl = dv->vl))
  {
    GNUNET_assert (dv == vl->dv);
    vl->dv = NULL;
    if (NULL == vl->n)
    {
      disconnect_and_free_virtual_link (vl);
    }
    else
    {
      /* @e visibility_task is NULL while #check_link_down() itself runs, and
         #GNUNET_SCHEDULER_cancel() dereferences its argument. */
      if (NULL != vl->visibility_task)
        GNUNET_SCHEDULER_cancel (vl->visibility_task);
      vl->visibility_task = GNUNET_SCHEDULER_add_now (&check_link_down, vl);
    }
    dv->vl = NULL;
  }
 
  if (NULL != dv->timeout_task)
  {
    GNUNET_SCHEDULER_cancel (dv->timeout_task);
    dv->timeout_task = NULL;
  }
  GNUNET_free (dv->km);
  GNUNET_free (dv);
}
 
 
static void
notify_monitor (struct TransportClient *tc,
                const struct GNUNET_PeerIdentity *peer,
                const char *address,
                enum GNUNET_NetworkType nt,
                const struct MonitorEvent *me)
{
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_TRANSPORT_MonitorData *md;
  size_t addr_len = strlen (address) + 1;
 
  env = GNUNET_MQ_msg_extra (md,
                             addr_len,
                             GNUNET_MESSAGE_TYPE_TRANSPORT_MONITOR_DATA);
  md->nt = htonl ((uint32_t) nt);
  md->peer = *peer;
  md->last_validation = GNUNET_TIME_absolute_hton (me->last_validation);
  md->valid_until = GNUNET_TIME_absolute_hton (me->valid_until);
  md->next_validation = GNUNET_TIME_absolute_hton (me->next_validation);
  md->rtt = GNUNET_TIME_relative_hton (me->rtt);
  md->cs = htonl ((uint32_t) me->cs);
  md->num_msg_pending = htonl (me->num_msg_pending);
  md->num_bytes_pending = htonl (me->num_bytes_pending);
  memcpy (&md[1], address, addr_len);
  GNUNET_MQ_send (tc->mq, env);
}
 
 
static void
notify_monitors (const struct GNUNET_PeerIdentity *peer,
                 const char *address,
                 enum GNUNET_NetworkType nt,
                 const struct MonitorEvent *me)
{
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    if (CT_MONITOR != tc->type)
      continue;
    if (tc->details.monitor.one_shot)
      continue;
    if ((GNUNET_NO == GNUNET_is_zero (&tc->details.monitor.peer)) &&
        (0 != GNUNET_memcmp (&tc->details.monitor.peer, peer)))
      continue;
    notify_monitor (tc, peer, address, nt, me);
  }
}
 
 
static void *
client_connect_cb (void *cls,
                   struct GNUNET_SERVICE_Client *client,
                   struct GNUNET_MQ_Handle *mq)
{
  struct TransportClient *tc;
 
  (void) cls;
  tc = GNUNET_new (struct TransportClient);
  tc->client = client;
  tc->mq = mq;
  GNUNET_CONTAINER_DLL_insert (clients_head, clients_tail, tc);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Client %p of type %u connected\n",
              tc,
              tc->type);
  return tc;
}
 
 
static enum GNUNET_GenericReturnValue
remove_global_addresses (void *cls,
                         const struct GNUNET_PeerIdentity *pid,
                         void *value)
{
  struct TransportGlobalNattedAddress *tgna = value;
  (void) cls;
 
  GNUNET_free (tgna);
 
  return GNUNET_OK;
}
 
 
static void
free_neighbour (struct Neighbour *neighbour,
                enum GNUNET_GenericReturnValue drop_link)
{
  struct DistanceVectorHop *dvh;
  struct VirtualLink *vl;
 
  GNUNET_assert (NULL == neighbour->queue_head);
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multipeermap_remove (neighbours,
                                                       &neighbour->pid,
                                                       neighbour));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Freeing neighbour\n");
  GNUNET_CONTAINER_multipeermap_iterate (neighbour->natted_addresses,
                                         &remove_global_addresses,
                                         NULL);
  GNUNET_CONTAINER_multipeermap_destroy (neighbour->natted_addresses);
  while (NULL != (dvh = neighbour->dv_head))
  {
    struct DistanceVector *dv = dvh->dv;
 
    free_distance_vector_hop (dvh);
    if (NULL == dv->dv_head)
      free_dv_route (dv);
  }
  if (NULL != neighbour->get)
  {
    GNUNET_PEERSTORE_iteration_stop (neighbour->get);
    neighbour->get = NULL;
  }
  if (NULL != neighbour->sc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "store cancel\n");
    GNUNET_PEERSTORE_store_cancel (neighbour->sc);
    neighbour->sc = NULL;
  }
  if (NULL != (vl = neighbour->vl))
  {
    GNUNET_assert (neighbour == vl->n);
    vl->n = NULL;
    if ((GNUNET_YES == drop_link) || (NULL == vl->dv))
    {
      disconnect_and_free_virtual_link (vl);
    }
    else
    {
      /* See #free_dv_route(): may be NULL under #check_link_down(). */
      if (NULL != vl->visibility_task)
        GNUNET_SCHEDULER_cancel (vl->visibility_task);
      vl->visibility_task = GNUNET_SCHEDULER_add_now (&check_link_down, vl);
    }
    neighbour->vl = NULL;
  }
  GNUNET_free (neighbour);
}
 
 
static void
core_send_connect_info (struct TransportClient *tc,
                        const struct GNUNET_PeerIdentity *pid)
{
  struct GNUNET_MQ_Envelope *env;
  struct ConnectInfoMessage *cim;
 
  GNUNET_assert (CT_CORE == tc->type);
  env = GNUNET_MQ_msg (cim, GNUNET_MESSAGE_TYPE_TRANSPORT_CONNECT);
  cim->id = *pid;
  GNUNET_MQ_send (tc->mq, env);
}
 
 
static void
cores_send_connect_info (const struct GNUNET_PeerIdentity *pid)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Informing CORE clients about connection to %s\n",
              GNUNET_i2s (pid));
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    if (CT_CORE != tc->type)
      continue;
    core_send_connect_info (tc, pid);
  }
}
 
 
static void
transmit_on_queue (void *cls);
 
 
static unsigned int
check_for_queue_with_higher_prio (struct Queue *queue, struct Queue *queue_head)
{
  for (struct Queue *s = queue_head; NULL != s;
       s = s->next_neighbour)
  {
    if (s == queue)
      continue;
    if (s->tc->details.communicator.address_prefix !=
        queue->tc->details.communicator.address_prefix)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "queue address %s qid %u compare with queue: address %s qid %u\n",
                  queue->address,
                  queue->qid,
                  s->address,
                  s->qid);
      if ((s->priority > queue->priority) && (0 < s->q_capacity) &&
          (QUEUE_LENGTH_LIMIT > s->queue_length) )
        return GNUNET_YES;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Lower prio\n");
    }
  }
  return GNUNET_NO;
}
 
 
static void
arm_free_queue_entry_task (struct TransportClient *tc);
 
 
static void
schedule_transmit_on_queue (struct GNUNET_TIME_Relative delay,
                            struct Queue *queue,
                            enum GNUNET_SCHEDULER_Priority p)
{
  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
 
  if (queue->validated_until.abs_value_us < now.abs_value_us)
    return;
  if (check_for_queue_with_higher_prio (queue,
                                        queue->neighbour->queue_head))
    return;
 
  if (queue->tc->details.communicator.total_queue_length >=
      COMMUNICATOR_TOTAL_QUEUE_LIMIT)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transmission on queue %s (QID %u) throttled due to communicator queue limit\n",
                queue->address,
                queue->qid);
    GNUNET_STATISTICS_update (
      GST_stats,
      "# Transmission throttled due to communicator queue limit",
      1,
      GNUNET_NO);
    queue->idle = GNUNET_NO;
    /* @e total_queue_length is shared by every peer this communicator serves,
       so at the limit we can send to none of them, and the only things that
       lower it again are an ACK from the communicator, #free_queue() and
       #free_timedout_queue_entry().  If we got here because a peer stopped
       acknowledging, no ACK is coming; and we just declined to arm
       @e transmit_task, so #queue_send_msg() -- the *only* place that arms
       the sweeper -- will not run either.  That leaves nothing at all to
       recover the count, and the communicator stays mute towards every peer
       until some unrelated queue happens to go down.  Keep the sweeper
       going. */
    arm_free_queue_entry_task (queue->tc);
    return;
  }
  if (queue->queue_length >= QUEUE_LENGTH_LIMIT)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transmission on queue %s (QID %u) throttled due to communicator queue length limit\n",
                queue->address,
                queue->qid);
    GNUNET_STATISTICS_update (GST_stats,
                              "# Transmission throttled due to queue queue limit",
                              1,
                              GNUNET_NO);
    queue->idle = GNUNET_NO;
    /* Same reasoning as above, for the per-queue limit. */
    arm_free_queue_entry_task (queue->tc);
    return;
  }
  if (0 == queue->q_capacity)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transmission on queue %s (QID %u) throttled due to communicator message  has capacity %"
                PRIu64 ".\n",
                queue->address,
                queue->qid,
                queue->q_capacity);
    GNUNET_STATISTICS_update (GST_stats,
                              "# Transmission throttled due to message queue capacity",
                              1,
                              GNUNET_NO);
    queue->idle = GNUNET_NO;
    return;
  }
  /* queue might indeed be ready, schedule it */
  if (NULL != queue->transmit_task)
    GNUNET_SCHEDULER_cancel (queue->transmit_task);
  queue->transmit_task =
    GNUNET_SCHEDULER_add_delayed_with_priority (delay, p, &transmit_on_queue,
                                                queue);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Considering transmission on queue `%s' QID %llu to %s\n",
              queue->address,
              (unsigned long long) queue->qid,
              GNUNET_i2s (&queue->neighbour->pid));
}
 
 
static void
start_address_validation (const struct GNUNET_PeerIdentity *pid,
                          const char *address);
 
 
static void
check_link_down (void *cls)
{
  struct VirtualLink *vl = cls;
  struct DistanceVector *dv = vl->dv;
  struct Neighbour *n = vl->n;
  struct GNUNET_TIME_Absolute dvh_timeout;
  struct GNUNET_TIME_Absolute q_timeout;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Checking if link is down\n");
  vl->visibility_task = NULL;
  dvh_timeout = GNUNET_TIME_UNIT_ZERO_ABS;
  if (NULL != dv)
  {
    for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
         pos = pos->next_dv)
      dvh_timeout = GNUNET_TIME_absolute_max (dvh_timeout,
                                              pos->path_valid_until);
    if (0 == GNUNET_TIME_absolute_get_remaining (dvh_timeout).rel_value_us)
    {
      vl->dv->vl = NULL;
      vl->dv = NULL;
    }
  }
  q_timeout = GNUNET_TIME_UNIT_ZERO_ABS;
  /* NOTE: @e n may be NULL here: #free_neighbour() clears vl->n and then
     schedules us when the link still has a DV route. */
  if (NULL != n)
  {
    struct GNUNET_TIME_Absolute liveness_deadline;
 
    /* A successful validation is good for #ADDRESS_VALIDATION_LIFETIME (four
       hours).  Do not take a communicator's word for that long: cap what the
       queues are worth by how recently this neighbour actually said anything
       to us.  Otherwise a communicator that stops working without sending a
       QUEUE_TEARDOWN keeps this link -- and CORE's idea of the connection --
       alive until the validation expires. */
    liveness_deadline = GNUNET_TIME_absolute_add (n->last_inbound,
                                                  NEIGHBOUR_LIVENESS_TIMEOUT);
    for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
      q_timeout = GNUNET_TIME_absolute_max (q_timeout, q->validated_until);
    if (GNUNET_TIME_absolute_cmp (liveness_deadline, <, q_timeout))
    {
      if (0 ==
          GNUNET_TIME_absolute_get_remaining (liveness_deadline).rel_value_us)
      {
        /* Only reachable if a communicator failed to tear its queue down. */
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    "Neighbour %s was silent for %s while its communicator "
                    "kept claiming the queue works; treating link as down\n",
                    GNUNET_i2s (&vl->target),
                    GNUNET_STRINGS_relative_time_to_string (
                      NEIGHBOUR_LIVENESS_TIMEOUT,
                      GNUNET_YES));
        GNUNET_STATISTICS_update (GST_stats,
                                  "# links dropped (neighbour silent)",
                                  1,
                                  GNUNET_NO);
      }
      q_timeout = liveness_deadline;
    }
    if (0 == GNUNET_TIME_absolute_get_remaining (q_timeout).rel_value_us)
    {
      vl->n->vl = NULL;
      vl->n = NULL;
    }
  }
  if ((NULL == vl->n) && (NULL == vl->dv))
  {
    disconnect_and_free_virtual_link (vl);
    /* @e n (if any) outlives the link, and so do its queues: the liveness cap
       above drops a link whose addresses are still well inside
       #ADDRESS_VALIDATION_LIFETIME.  In that state nothing would ever ask for
       a fresh challenge -- @e revalidation_task does not fire until the four
       hour validity is nearly over, and the HELLO path reaches
       #start_address_validation() only to find an address that still counts
       as valid.  Since #handle_validation_response() is the only thing that
       can rebuild this link and tell CORE about the peer again, ask for that
       validation now, or CORE never hears about this peer again. */
    if (NULL != n)
      for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
        start_address_validation (&n->pid, q->address);
    return;
  }
  vl->visibility_task =
    GNUNET_SCHEDULER_add_at (GNUNET_TIME_absolute_max (q_timeout, dvh_timeout),
                             &check_link_down,
                             vl);
}
 
 
static void
free_queue (struct Queue *queue)
{
  struct Neighbour *neighbour = queue->neighbour;
  struct TransportClient *tc = queue->tc;
  struct MonitorEvent me = { .cs = GNUNET_TRANSPORT_CS_DOWN,
                             .rtt = GNUNET_TIME_UNIT_FOREVER_REL };
  struct QueueEntry *qe;
  int maxxed;
  struct PendingAcknowledgement *pa;
  struct VirtualLink *vl;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Cleaning up queue %u\n", queue->qid);
  if (NULL != queue->mo)
  {
    GNUNET_PEERSTORE_monitor_stop (queue->mo);
    queue->mo = NULL;
  }
  if (NULL != queue->transmit_task)
  {
    GNUNET_SCHEDULER_cancel (queue->transmit_task);
    queue->transmit_task = NULL;
  }
  while (NULL != (pa = queue->pa_head))
  {
    GNUNET_CONTAINER_MDLL_remove (queue, queue->pa_head, queue->pa_tail, pa);
    pa->queue = NULL;
  }
 
  GNUNET_CONTAINER_MDLL_remove (neighbour,
                                neighbour->queue_head,
                                neighbour->queue_tail,
                                queue);
  GNUNET_CONTAINER_MDLL_remove (client,
                                tc->details.communicator.queue_head,
                                tc->details.communicator.queue_tail,
                                queue);
  maxxed = (COMMUNICATOR_TOTAL_QUEUE_LIMIT <=
            tc->details.communicator.total_queue_length);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Cleaning up queue with length %u\n",
              queue->queue_length);
  while (NULL != (qe = queue->queue_head))
  {
    GNUNET_CONTAINER_DLL_remove (queue->queue_head, queue->queue_tail, qe);
    queue->queue_length--;
    tc->details.communicator.total_queue_length--;
    if (NULL != qe->pm)
    {
      GNUNET_assert (qe == qe->pm->qe);
      qe->pm->qe = NULL;
    }
    GNUNET_free (qe);
  }
  GNUNET_assert (0 == queue->queue_length);
  if ((maxxed) && (COMMUNICATOR_TOTAL_QUEUE_LIMIT >
                   tc->details.communicator.total_queue_length))
  {
    /* Communicator dropped below threshold, resume all _other_ queues */
    GNUNET_STATISTICS_update (
      GST_stats,
      "# Transmission throttled due to communicator queue limit",
      -1,
      GNUNET_NO);
    for (struct Queue *s = tc->details.communicator.queue_head; NULL != s;
         s = s->next_client)
      schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                  s,
                                  GNUNET_SCHEDULER_PRIORITY_DEFAULT);
  }
  notify_monitors (&neighbour->pid, queue->address, queue->nt, &me);
  GNUNET_free (queue);
 
  vl = lookup_virtual_link (&neighbour->pid);
  if ((NULL != vl) && (neighbour == vl->n))
  {
    /* See #free_dv_route(): may be NULL under #check_link_down(), which is
       also what clears it -- so the call below needs no re-arm here. */
    if (NULL != vl->visibility_task)
      GNUNET_SCHEDULER_cancel (vl->visibility_task);
    vl->visibility_task = NULL;
    check_link_down (vl);
  }
  if (NULL == neighbour->queue_head)
  {
    free_neighbour (neighbour, GNUNET_NO);
  }
}
 
 
static void
cancel_address_store (struct AddressListEntry *ale);
 
 
static void
free_address_list_entry (struct AddressListEntry *ale)
{
  struct TransportClient *tc = ale->tc;
 
  GNUNET_CONTAINER_DLL_remove (tc->details.communicator.addr_head,
                               tc->details.communicator.addr_tail,
                               ale);
  /* Cancels @e sc, @e shc and the pending PILS signature request, all of
     which would otherwise run their callbacks on this freed entry. */
  cancel_address_store (ale);
  if (NULL != ale->sc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "store cancel\n");
    GNUNET_PEERSTORE_store_cancel (ale->sc);
    ale->sc = NULL;
  }
  if (NULL != ale->shc)
  {
    GNUNET_PEERSTORE_hello_add_cancel (ale->shc);
    ale->shc = NULL;
  }
  if (NULL != ale->st)
  {
    GNUNET_SCHEDULER_cancel (ale->st);
    ale->st = NULL;
  }
  if (NULL != ale->signed_address)
    GNUNET_free (ale->signed_address);
  GNUNET_free (ale);
}
 
 
static int
stop_peer_request (void *cls,
                   const struct GNUNET_PeerIdentity *pid,
                   void *value)
{
  struct TransportClient *tc = cls;
  struct PeerRequest *pr = value;
 
  if (NULL != pr->retry_task)
  {
    GNUNET_SCHEDULER_cancel (pr->retry_task);
    pr->retry_task = NULL;
  }
  if (NULL != pr->nc)
    GNUNET_PEERSTORE_monitor_stop (pr->nc);
  pr->nc = NULL;
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multipeermap_remove (tc->details.application.requests,
                                          pid,
                                          pr));
  GNUNET_free (pr);
 
  return GNUNET_OK;
}
 
 
static void
do_shutdown (void *cls);
 
 
static enum GNUNET_GenericReturnValue
detach_cmcs_from_link (void *cls,
                       const struct GNUNET_PeerIdentity *pid,
                       void *value)
{
  const struct TransportClient *tc = cls;
  struct VirtualLink *vl = value;
 
  (void) pid;
  for (struct CommunicatorMessageContext *cmc = vl->cmc_head;
       NULL != cmc;
       cmc = cmc->next)
    if (tc == cmc->tc)
      cmc->tc = NULL;
  return GNUNET_OK;
}
 
 
static enum GNUNET_GenericReturnValue
detach_cmc_from_backtalker (void *cls,
                            const struct GNUNET_PeerIdentity *pid,
                            void *value)
{
  const struct TransportClient *tc = cls;
  struct Backtalker *b = value;
 
  (void) pid;
  if ((NULL != b->cmc) && (tc == b->cmc->tc))
    b->cmc->tc = NULL;
  return GNUNET_OK;
}
 
 
static void
detach_cmcs_from_client (const struct TransportClient *tc)
{
  GNUNET_CONTAINER_multipeermap_iterate (links,
                                         &detach_cmcs_from_link,
                                         (void *) tc);
  GNUNET_CONTAINER_multipeermap_iterate (backtalkers,
                                         &detach_cmc_from_backtalker,
                                         (void *) tc);
  for (unsigned int i = 0; i < RING_BUFFER_SIZE; i++)
    if ((NULL != ring_buffer[i]) &&
        (tc == ring_buffer[i]->cmc->tc))
      ring_buffer[i]->cmc->tc = NULL;
}
 
 
static void
client_disconnect_cb (void *cls,
                      struct GNUNET_SERVICE_Client *client,
                      void *app_ctx)
{
  struct TransportClient *tc = app_ctx;
 
  (void) cls;
  (void) client;
  GNUNET_CONTAINER_DLL_remove (clients_head, clients_tail, tc);
  switch (tc->type)
  {
  case CT_NONE:
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Unknown Client %p disconnected, cleaning up.\n",
                tc);
    break;
 
  case CT_CORE: {
      struct PendingMessage *pm;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "CORE Client %p disconnected, cleaning up.\n",
                  tc);
 
 
      while (NULL != (pm = tc->details.core.pending_msg_head))
      {
        GNUNET_CONTAINER_MDLL_remove (client,
                                      tc->details.core.pending_msg_head,
                                      tc->details.core.pending_msg_tail,
                                      pm);
        pm->client = NULL;
      }
    }
    break;
 
  case CT_MONITOR:
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "MONITOR Client %p disconnected, cleaning up.\n",
                tc);
 
    break;
 
  case CT_COMMUNICATOR: {
      struct Queue *q;
      struct AddressListEntry *ale;
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "COMMUNICATOR Client %p disconnected, cleaning up.\n",
                  tc);
 
      /* MUST come first: freeing the queues below can tear a virtual link
         down, and #free_virtual_link() releases the cmcs parked on it. */
      detach_cmcs_from_client (tc);
      if (NULL != tc->details.communicator.free_queue_entry_task)
        GNUNET_SCHEDULER_cancel (
          tc->details.communicator.free_queue_entry_task);
      while (NULL != (q = tc->details.communicator.queue_head))
        free_queue (q);
      while (NULL != (ale = tc->details.communicator.addr_head))
        free_address_list_entry (ale);
      GNUNET_free (tc->details.communicator.address_prefix);
    }
    break;
 
  case CT_APPLICATION:
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "APPLICATION Client %p disconnected, cleaning up.\n",
                tc);
 
    GNUNET_CONTAINER_multipeermap_iterate (tc->details.application.requests,
                                           &stop_peer_request,
                                           tc);
    GNUNET_CONTAINER_multipeermap_destroy (tc->details.application.requests);
    break;
  }
  GNUNET_free (tc);
  if ((GNUNET_YES == in_shutdown) && (NULL == clients_head))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Our last client disconnected\n");
    do_shutdown (cls);
  }
}
 
 
static int
notify_client_connect_info (void *cls,
                            const struct GNUNET_PeerIdentity *pid,
                            void *value)
{
  struct TransportClient *tc = cls;
  struct VirtualLink *vl = value;
 
  if ((NULL == vl) || (GNUNET_NO == vl->confirmed))
    return GNUNET_OK;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Telling new CORE client about existing connection to %s\n",
              GNUNET_i2s (pid));
  core_send_connect_info (tc, pid);
  return GNUNET_OK;
}
 
 
static void
finish_cmc_handling_with_continue (struct CommunicatorMessageContext *cmc,
                                   unsigned
                                   int free_cmc);
 
static enum GNUNET_GenericReturnValue
resume_communicators (void *cls,
                      const struct GNUNET_PeerIdentity *pid,
                      void *value)
{
  struct VirtualLink *vl = value;
  struct CommunicatorMessageContext *cmc;
 
  /* resume communicators */
  while (NULL != (cmc = vl->cmc_tail))
    release_stalled_cmc (vl, cmc);
  if (NULL != vl->core_fc_stall_task)
  {
    GNUNET_SCHEDULER_cancel (vl->core_fc_stall_task);
    vl->core_fc_stall_task = NULL;
  }
  /* A CORE client that just attached has nothing outstanding, so give it a
     full window.  The RECV_OKs that would have returned the credit spent by
     its predecessor died with that client, and #handle_client_recv_ok() is
     the only thing that ever raises this counter -- so without the reset
     every message on this link takes the "CORE ran out of window" path from
     here on, and only #core_fc_stalled() (after CORE_FC_STALL_TIMEOUT, and
     once per round) ever lets any through. */
  vl->core_recv_window = RECV_WINDOW_SIZE;
  return GNUNET_OK;
}
 
 
static void
handle_client_start (void *cls, const struct StartMessage *start)
{
  // const struct GNUNET_PeerIdentity *my_identity;
  struct TransportClient *tc = cls;
  // uint32_t options;
  //
  // my_identity = GNUNET_PILS_get_identity (pils);
  // GNUNET_assert (my_identity);
  //
  // FIXME ignore the check of the peer ids for now.
  //       (also deprecate the old way of obtaining our own peer ID)
  // options = ntohl (start->options);
  // if ((0 != (1 & options)) &&
  //    (0 != GNUNET_memcmp (&start->self, my_identity)))
  // {
  //  /* client thinks this is a different peer, reject */
  //  GNUNET_break (0);
  //  GNUNET_SERVICE_client_drop (tc->client);
  //  return;
  // }
  if (CT_NONE != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  tc->type = CT_CORE;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "New CORE client with PID %s registered\n",
              GNUNET_i2s (&start->self));
  GNUNET_CONTAINER_multipeermap_iterate (links,
                                         &notify_client_connect_info,
                                         tc);
  GNUNET_CONTAINER_multipeermap_iterate (links,
                                         &resume_communicators,
                                         NULL);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
check_client_send (void *cls, const struct OutboundMessage *obm)
{
  struct TransportClient *tc = cls;
  uint16_t size;
  const struct GNUNET_MessageHeader *obmm;
 
  if (CT_CORE != tc->type)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  size = ntohs (obm->header.size) - sizeof(struct OutboundMessage);
  if (size < sizeof(struct GNUNET_MessageHeader))
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  obmm = (const struct GNUNET_MessageHeader *) &obm[1];
  if (size != ntohs (obmm->size))
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
client_send_response (struct PendingMessage *pm)
{
  struct TransportClient *tc = pm->client;
  struct VirtualLink *vl = pm->vl;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "client send response\n");
  if (NULL != tc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Confirming transmission of <%" PRIu64 "> to %s\n",
                pm->logging_uuid,
                GNUNET_i2s (&vl->target));
    credit_client (pm);
  }
  free_pending_message (pm);
}
 
 
static unsigned int
pick_random_dv_hops (const struct DistanceVector *dv,
                     enum RouteMessageOptions options,
                     struct DistanceVectorHop **hops_array,
                     unsigned int hops_array_length)
{
  uint64_t choices[hops_array_length];
  uint64_t num_dv;
  unsigned int dv_count;
 
  /* Pick random vectors, but weighted by distance, giving more weight
     to shorter vectors */
  num_dv = 0;
  dv_count = 0;
  for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
       pos = pos->next_dv)
  {
    if ((0 == (options & RMO_UNCONFIRMED_ALLOWED)) &&
        (GNUNET_TIME_absolute_get_remaining (pos->path_valid_until)
         .rel_value_us == 0))
      continue;   /* pos unconfirmed and confirmed required */
    num_dv += MAX_DV_HOPS_ALLOWED - pos->distance;
    dv_count++;
  }
  if (0 == dv_count)
    return 0;
  if (dv_count <= hops_array_length)
  {
    dv_count = 0;
    for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
         pos = pos->next_dv)
      hops_array[dv_count++] = pos;
    return dv_count;
  }
  for (unsigned int i = 0; i < hops_array_length; i++)
  {
    int ok = GNUNET_NO;
    while (GNUNET_NO == ok)
    {
      choices[i] =
        GNUNET_CRYPTO_random_u64 (num_dv);
      ok = GNUNET_YES;
      for (unsigned int j = 0; j < i; j++)
        if (choices[i] == choices[j])
        {
          ok = GNUNET_NO;
          break;
        }
    }
  }
  dv_count = 0;
  num_dv = 0;
  for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
       pos = pos->next_dv)
  {
    uint32_t delta = MAX_DV_HOPS_ALLOWED - pos->distance;
 
    if ((0 == (options & RMO_UNCONFIRMED_ALLOWED)) &&
        (GNUNET_TIME_absolute_get_remaining (pos->path_valid_until)
         .rel_value_us == 0))
      continue;   /* pos unconfirmed and confirmed required */
    for (unsigned int i = 0; i < hops_array_length; i++)
      if ((num_dv <= choices[i]) && (num_dv + delta > choices[i]))
        hops_array[dv_count++] = pos;
    num_dv += delta;
  }
  return dv_count;
}
 
 
static int
check_communicator_available (
  void *cls,
  const struct GNUNET_TRANSPORT_CommunicatorAvailableMessage *cam)
{
  struct TransportClient *tc = cls;
  uint16_t size;
 
  if (CT_NONE != tc->type)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  tc->type = CT_COMMUNICATOR;
  size = ntohs (cam->header.size) - sizeof(*cam);
  if (0 == size)
    return GNUNET_OK; /* receive-only communicator */
  GNUNET_MQ_check_zero_termination (cam);
  return GNUNET_OK;
}
 
 
static void
send_cmc_ack (struct CommunicatorMessageContext *cmc)
{
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_TRANSPORT_IncomingMessageAck *ack;
 
  if (GNUNET_YES == cmc->ack_sent)
    return;
  cmc->ack_sent = GNUNET_YES;
  if (NULL == cmc->tc)
    return;   /* communicator is gone, see #detach_cmcs_from_client() */
  if (0 == ntohl (cmc->im.fc_on))
    return;   /* communicator did not ask for flow control */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Acknowledge message with flow control id %" PRIu64 "\n",
              cmc->im.fc_id);
  env = GNUNET_MQ_msg (ack, GNUNET_MESSAGE_TYPE_TRANSPORT_INCOMING_MSG_ACK);
  ack->reserved = htonl (0);
  ack->fc_id = cmc->im.fc_id;
  ack->sender = cmc->im.neighbour_sender;
  GNUNET_MQ_send (cmc->tc->mq, env);
}
 
 
static void
resume_cmc_client (struct CommunicatorMessageContext *cmc)
{
  if (GNUNET_YES == cmc->client_resumed)
    return;
  cmc->client_resumed = GNUNET_YES;
  if (NULL == cmc->tc)
    return;   /* communicator is gone, see #detach_cmcs_from_client() */
  GNUNET_SERVICE_client_continue (cmc->tc->client);
}
 
 
static void
finish_cmc_handling_with_continue (struct CommunicatorMessageContext *cmc,
                                   unsigned
                                   int free_cmc)
{
  send_cmc_ack (cmc);
  resume_cmc_client (cmc);
  if (GNUNET_YES == free_cmc)
  {
    GNUNET_free (cmc);
  }
}
 
 
static void
release_stalled_cmc (struct VirtualLink *vl,
                     struct CommunicatorMessageContext *cmc)
{
  GNUNET_CONTAINER_DLL_remove (vl->cmc_head, vl->cmc_tail, cmc);
  GNUNET_assert (0 < vl->cmc_count);
  vl->cmc_count--;
  finish_cmc_handling_with_continue (cmc, GNUNET_YES);
}
 
 
static void
finish_cmc_handling (struct CommunicatorMessageContext *cmc)
{
  finish_cmc_handling_with_continue (cmc, GNUNET_YES);
}
 
 
static void
handle_client_recv_ok (void *cls, const struct RecvOkMessage *rom)
{
  struct TransportClient *tc = cls;
  struct VirtualLink *vl;
  uint32_t delta;
  struct CommunicatorMessageContext *cmc;
 
  if (CT_CORE != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  vl = lookup_virtual_link (&rom->peer);
  if ((NULL == vl) || (GNUNET_NO == vl->confirmed))
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# RECV_OK dropped: virtual link unknown",
                              1,
                              GNUNET_NO);
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  delta = ntohl (rom->increase_window_delta);
  vl->core_recv_window += delta;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "CORE ack receiving message, increased CORE recv window to %d\n",
              vl->core_recv_window);
  GNUNET_SERVICE_client_continue (tc->client);
  if (vl->core_recv_window <= 0)
    return;
  /* release the flow control credit we withheld from the communicators */
  while (NULL != (cmc = vl->cmc_tail))
    release_stalled_cmc (vl, cmc);
  if (NULL != vl->core_fc_stall_task)
  {
    GNUNET_SCHEDULER_cancel (vl->core_fc_stall_task);
    vl->core_fc_stall_task = NULL;
  }
}
 
 
static void
handle_communicator_available (
  void *cls,
  const struct GNUNET_TRANSPORT_CommunicatorAvailableMessage *cam)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct TransportClient *tc = cls;
  uint16_t size;
 
  size = ntohs (cam->header.size) - sizeof(*cam);
  if (0 == size)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Receive-only communicator connected\n");
    /* Receive-only communicator: it has no address prefix, but we still
       MUST resume the client or we will never read from it again.  Use an
       empty prefix so that the various strcmp()s do not see NULL. */
    tc->details.communicator.address_prefix = GNUNET_strdup ("");
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  tc->details.communicator.address_prefix =
    GNUNET_strdup ((const char *) &cam[1]);
  tc->details.communicator.cc = ntohl (cam->cc);
  tc->details.communicator.can_burst = ntohl (cam->can_burst);
  my_identity = GNUNET_PILS_get_identity (pils);
  if (NULL != my_identity)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Communicator for peer %s with prefix '%s' connected %s\n",
                GNUNET_i2s (my_identity),
                tc->details.communicator.address_prefix,
                tc->details.communicator.can_burst ? "can burst" :
                "can not burst");
  }
  else
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Communicator for local peer with prefix '%s' connected %s\n",
                tc->details.communicator.address_prefix,
                tc->details.communicator.can_burst ? "can burst" :
                "can not burst");
  }
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
check_communicator_backchannel (
  void *cls,
  const struct GNUNET_TRANSPORT_CommunicatorBackchannel *cb)
{
  const struct GNUNET_MessageHeader *inbox;
  const char *is;
  uint16_t msize;
  uint16_t isize;
 
  (void) cls;
  msize = ntohs (cb->header.size) - sizeof(*cb);
  inbox = (const struct GNUNET_MessageHeader *) &cb[1];
  /* MUST bound the buffer before dereferencing @a inbox. */
  if (msize <= sizeof(struct GNUNET_MessageHeader))
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  isize = ntohs (inbox->size);
  if (isize >= msize)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  is = (const char *) inbox;
  is += isize;
  msize -= isize;
  GNUNET_assert (0 < msize);
  if ('\0' != is[msize - 1])
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static enum GNUNET_GenericReturnValue
sign_ephemeral (struct DistanceVector *dv)
{
  struct EphemeralConfirmationPS ec;
 
  dv->monotime = GNUNET_TIME_absolute_get_monotonic (GST_cfg);
  dv->ephemeral_validity =
    GNUNET_TIME_absolute_add (dv->monotime, EPHEMERAL_VALIDITY);
  ec.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL);
  ec.target = dv->target;
  ec.ephemeral_key = dv->ephemeral_key;
  ec.sender_monotonic_time = GNUNET_TIME_absolute_hton (dv->monotime);
  ec.purpose.size = htonl (sizeof(ec));
  return sign_by_my_identity (&ec.purpose, &dv->sender_sig);
}
 
 
static void
free_queue_entry (struct QueueEntry *qe,
                  struct TransportClient *tc);
 
 
static void
free_timedout_queue_entry (void *cls)
{
  struct TransportClient *tc = cls;
  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "freeing timedout queue entries\n");
 
  tc->details.communicator.free_queue_entry_task = NULL;
  for (struct Queue *queue = tc->details.communicator.queue_head; NULL != queue;
       queue = queue->next_client)
  {
    struct QueueEntry *qep = queue->queue_head;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "checking QID %u for timedout queue entries\n",
                queue->qid);
    while (NULL != qep)
    {
      struct QueueEntry *pos = qep;
      struct GNUNET_TIME_Relative diff = GNUNET_TIME_absolute_get_difference (
        pos->creation_timestamp, now);
      qep = qep->next;
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "diff to now %s \n",
                  GNUNET_TIME_relative2s (diff, GNUNET_NO));
      if (GNUNET_TIME_relative_cmp (QUEUE_ENTRY_TIMEOUT, <, diff))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Freeing timed out QueueEntry with MID %" PRIu64
                    " and QID %u\n",
                    pos->mid,
                    queue->qid);
        GNUNET_STATISTICS_update (GST_stats,
                                  "# QueueEntries timed out",
                                  1,
                                  GNUNET_NO);
        free_queue_entry (pos, tc);
      }
    }
  }
  /* Entries younger than #QUEUE_ENTRY_TIMEOUT are still to be reclaimed, and
     this task used to be a one-shot armed only by #queue_send_msg().  So the
     sweep that was supposed to bound how long an unacknowledged entry holds
     its slot only ever ran while *new* messages were being queued -- exactly
     not the case once the throttles in #schedule_transmit_on_queue() have
     stopped transmission.  Keep going as long as anything is outstanding. */
  arm_free_queue_entry_task (tc);
}
 
 
static void
arm_free_queue_entry_task (struct TransportClient *tc)
{
  if (NULL != tc->details.communicator.free_queue_entry_task)
    return;
  for (struct Queue *queue = tc->details.communicator.queue_head; NULL != queue;
       queue = queue->next_client)
  {
    if (NULL == queue->queue_head)
      continue;
    tc->details.communicator.free_queue_entry_task =
      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
                                    &free_timedout_queue_entry,
                                    tc);
    return;
  }
}
 
 
static void
queue_send_msg (struct Queue *queue,
                struct PendingMessage *pm,
                const void *payload,
                size_t payload_size)
{
  struct Neighbour *n = queue->neighbour;
  struct GNUNET_TRANSPORT_SendMessageTo *smt;
  struct GNUNET_MQ_Envelope *env;
  struct PendingAcknowledgement *pa;
 
  GNUNET_log (
    GNUNET_ERROR_TYPE_DEBUG,
    "Queueing %u bytes of payload for transmission <%" PRIu64
    "> on queue %llu to %s\n",
    (unsigned int) payload_size,
    (NULL == pm) ? 0 : pm->logging_uuid,
    (unsigned long long) queue->qid,
    GNUNET_i2s (&queue->neighbour->pid));
  env = GNUNET_MQ_msg_extra (smt,
                             payload_size,
                             GNUNET_MESSAGE_TYPE_TRANSPORT_SEND_MSG);
  smt->qid = htonl (queue->qid);
  smt->mid = GNUNET_htonll (queue->mid_gen);
  smt->receiver = n->pid;
  memcpy (&smt[1], payload, payload_size);
  {
    /* Pass the env to the communicator of queue for transmission. */
    struct QueueEntry *qe;
 
    qe = GNUNET_new (struct QueueEntry);
    qe->creation_timestamp = GNUNET_TIME_absolute_get ();
    qe->mid = queue->mid_gen;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Create QueueEntry with MID %" PRIu64
                " and QID %u and prefix %s\n",
                qe->mid,
                queue->qid,
                queue->tc->details.communicator.address_prefix);
    queue->mid_gen++;
    qe->queue = queue;
    if (NULL != pm)
    {
      qe->pm = pm;
      // TODO Why do we have a retransmission. When we know, make decision if we still want this.
      // GNUNET_assert (NULL == pm->qe);
      if (NULL != pm->qe)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Retransmitting message <%" PRIu64
                    "> remove pm from qe with MID: %llu \n",
                    pm->logging_uuid,
                    (unsigned long long) pm->qe->mid);
        pm->qe->pm = NULL;
      }
      pm->qe = qe;
    }
    GNUNET_assert (CT_COMMUNICATOR == queue->tc->type);
    if (0 == queue->q_capacity)
    {
      // Messages without FC or fragments can get here.
      if (NULL != pm)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Message %" PRIu64
                    " (pm type %u) was not send because queue has no capacity.\n",
                    pm->logging_uuid,
                    pm->pmt);
        pm->qe = NULL;
      }
      GNUNET_free (env);
      GNUNET_free (qe);
      return;
    }
    GNUNET_CONTAINER_DLL_insert (queue->queue_head, queue->queue_tail, qe);
    queue->queue_length++;
    queue->tc->details.communicator.total_queue_length++;
    if (GNUNET_NO == queue->unlimited_length)
      queue->q_capacity--;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Queue %s with qid %u has capacity %" PRIu64 "\n",
                queue->address,
                queue->qid,
                queue->q_capacity);
    if (COMMUNICATOR_TOTAL_QUEUE_LIMIT ==
        queue->tc->details.communicator.total_queue_length)
      queue->idle = GNUNET_NO;
    if (QUEUE_LENGTH_LIMIT == queue->queue_length)
      queue->idle = GNUNET_NO;
    if (0 == queue->q_capacity)
      queue->idle = GNUNET_NO;
 
    if (GNUNET_NO == queue->idle)
      arm_free_queue_entry_task (queue->tc);
    if (NULL != pm)
    {
      /* NOTE: @e next_pa was never the link of this list -- nothing ever
         assigned it, so it was NULL on every entry.  The MDLL that
         #prepare_pending_acknowledgement() inserts into is keyed `pm', and
         thus threaded through @e next_pm.  Walking @e next_pa dereferenced
         NULL the moment the head was not the entry we wanted. */
      for (pa = pm->pa_head; NULL != pa; pa = pa->next_pm)
        if (pm == pa->pm)
        {
          pa->num_send++;
          break;
        }
    }
    // GNUNET_CONTAINER_multiuuidmap_get (pending_acks, &ack[i].ack_uuid.value);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending message MID %" PRIu64
                " of type %u (%u) and size %lu with MQ %p queue %s (QID %u) pending %"
                PRIu64 "\n",
                GNUNET_ntohll (smt->mid),
                ntohs (((const struct GNUNET_MessageHeader *) payload)->type),
                ntohs (smt->header.size),
                (unsigned long) payload_size,
                queue->tc->mq,
                queue->address,
                queue->qid,
                (NULL == pm) ? 0 : pm->logging_uuid);
    GNUNET_MQ_send (queue->tc->mq, env);
  }
}
 
 
static struct GNUNET_TIME_Relative
route_via_neighbour (const struct Neighbour *n,
                     const struct GNUNET_MessageHeader *hdr,
                     enum RouteMessageOptions options)
{
  struct GNUNET_TIME_Absolute now;
  unsigned int candidates;
  unsigned int sel1;
  unsigned int sel2;
  struct GNUNET_TIME_Relative rtt;
 
  /* Pick one or two 'random' queues from n (under constraints of options) */
  now = GNUNET_TIME_absolute_get ();
  /* FIXME-OPTIMIZE: give queues 'weights' and pick proportional to
     weight in the future; weight could be assigned by observed
     bandwidth (note: not sure if we should do this for this type
     of control traffic though). */
  candidates = 0;
  for (struct Queue *pos = n->queue_head; NULL != pos;
       pos = pos->next_neighbour)
  {
    if ((0 != (options & RMO_UNCONFIRMED_ALLOWED)) ||
        (pos->validated_until.abs_value_us > now.abs_value_us))
      candidates++;
  }
  if (0 == candidates)
  {
    /* This can happen rarely if the last confirmed queue timed
       out just as we were beginning to process this message. */
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Could not route message of type %u to %s: no valid queue\n",
                ntohs (hdr->type),
                GNUNET_i2s (&n->pid));
    GNUNET_STATISTICS_update (GST_stats,
                              "# route selection failed (all no valid queue)",
                              1,
                              GNUNET_NO);
    return GNUNET_TIME_UNIT_FOREVER_REL;
  }
 
  rtt = GNUNET_TIME_UNIT_FOREVER_REL;
  sel1 = GNUNET_CRYPTO_random_u32 (candidates);
  if (0 == (options & RMO_REDUNDANT))
    sel2 = candidates; /* picks none! */
  else
    sel2 = GNUNET_CRYPTO_random_u32 (candidates);
  candidates = 0;
  for (struct Queue *pos = n->queue_head; NULL != pos;
       pos = pos->next_neighbour)
  {
    if ((0 != (options & RMO_UNCONFIRMED_ALLOWED)) ||
        (pos->validated_until.abs_value_us > now.abs_value_us))
    {
      if ((sel1 == candidates) || (sel2 == candidates))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Routing message of type %u to %s using %s (#%u)\n",
                    ntohs (hdr->type),
                    GNUNET_i2s (&n->pid),
                    pos->address,
                    (sel1 == candidates) ? 1 : 2);
        rtt = GNUNET_TIME_relative_min (rtt, pos->pd.aged_rtt);
        queue_send_msg (pos, NULL, hdr, ntohs (hdr->size));
      }
      candidates++;
    }
  }
  return rtt;
}
 
 
typedef void (*DVMessageHandler) (void *cls,
                                  struct Neighbour *next_hop,
                                  const struct GNUNET_MessageHeader *hdr,
                                  enum RouteMessageOptions options);
 
static struct GNUNET_TIME_Relative
encapsulate_for_dv (struct DistanceVector *dv,
                    unsigned int num_dvhs,
                    struct DistanceVectorHop **dvhs,
                    const struct GNUNET_MessageHeader *hdr,
                    DVMessageHandler use,
                    void *use_cls,
                    enum RouteMessageOptions options,
                    enum GNUNET_GenericReturnValue without_fc)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct TransportDVBoxMessage box_hdr;
  struct TransportDVBoxPayloadP *payload_hdr;
  uint16_t body_len_hbo = ntohs (hdr->size);
  unsigned char pt[sizeof(struct TransportDVBoxPayloadP) + body_len_hbo]
  GNUNET_ALIGN;
  unsigned char ct[sizeof(struct TransportDVBoxPayloadP) + body_len_hbo]
  GNUNET_ALIGN;
  struct GNUNET_TIME_Relative rtt;
  struct GNUNET_CRYPTO_AeadSecretKey km;
 
  payload_hdr = (struct TransportDVBoxPayloadP*) pt;
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  /* Encrypt payload */
  memset (&box_hdr, 0, sizeof (box_hdr));
  box_hdr.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_DV_BOX);
  box_hdr.total_hops = htons (0);
  box_hdr.without_fc = htonl (without_fc);
  // update_ephemeral (dv);
  if ((0 ==
       GNUNET_TIME_absolute_get_remaining (dv->ephemeral_validity).rel_value_us)
      || (NULL == dv->km))
  {
    GNUNET_CRYPTO_eddsa_kem_encaps (&dv->target.public_key,
                                    &dv->ephemeral_key,
                                    (struct GNUNET_ShortHashCode*) &km);
    GNUNET_free (dv->km);   /* do not leak the previous key material */
    dv->km = GNUNET_new (struct GNUNET_ShortHashCode);
    GNUNET_memcpy (dv->km, &km, sizeof(struct GNUNET_ShortHashCode));
    if (GNUNET_OK != sign_ephemeral (dv))
    {
      /* Without a matching signature the box is undecryptable noise to the
         receiver; do not spend the bandwidth.  Expire the ephemeral so the
         next attempt re-derives and re-signs rather than reusing it. */
      dv->ephemeral_validity = GNUNET_TIME_UNIT_ZERO_ABS;
      return GNUNET_TIME_UNIT_FOREVER_REL;
    }
  }
  else
  {
    /* The ephemeral key is still valid, so reuse the cached key material.
       Without this @a km stayed UNINITIALISED stack memory and the
       receiver could not decrypt the box. */
    GNUNET_memcpy (&km, dv->km, sizeof(struct GNUNET_ShortHashCode));
  }
  box_hdr.ephemeral_key = dv->ephemeral_key;
  payload_hdr->sender_sig = dv->sender_sig;
  memcpy (&payload_hdr[1], hdr, body_len_hbo);
  GNUNET_CRYPTO_random_block (&box_hdr.iv,
                              sizeof(box_hdr.iv));
  payload_hdr->sender = *my_identity;
  payload_hdr->monotonic_time = GNUNET_TIME_absolute_hton (dv->monotime);
  GNUNET_CRYPTO_aead_encrypt (sizeof pt,
                              pt,
                              0,
                              NULL,
                              &km,
                              &box_hdr.iv,
                              ct,
                              &box_hdr.mac);
  rtt = GNUNET_TIME_UNIT_FOREVER_REL;
  /* For each selected path, take the pre-computed header and body
     and add the path in the middle of the message; then send it. */
  for (unsigned int i = 0; i < num_dvhs; i++)
  {
    struct DistanceVectorHop *dvh = dvhs[i];
    unsigned int num_hops = dvh->distance + 1;
    char buf[sizeof(struct TransportDVBoxMessage)
             + sizeof(struct GNUNET_PeerIdentity) * num_hops
             + sizeof(struct TransportDVBoxPayloadP)
             + body_len_hbo] GNUNET_ALIGN;
    struct GNUNET_PeerIdentity *dhops;
 
    box_hdr.header.size = htons (sizeof(buf));
    box_hdr.orig_size = htons (sizeof(buf));
    box_hdr.num_hops = htons (num_hops);
    memcpy (buf, &box_hdr, sizeof(box_hdr));
    dhops = (struct GNUNET_PeerIdentity *) &buf[sizeof(box_hdr)];
    memcpy (dhops,
            dvh->path,
            dvh->distance * sizeof(struct GNUNET_PeerIdentity));
    dhops[dvh->distance] = dv->target;
    if (GNUNET_EXTRA_LOGGING > 0)
    {
      char *path;
 
      path = GNUNET_strdup (GNUNET_i2s (my_identity));
      for (unsigned int j = 0; j < num_hops; j++)
      {
        char *tmp;
 
        GNUNET_asprintf (&tmp, "%s-%s", path, GNUNET_i2s (&dhops[j]));
        GNUNET_free (path);
        path = tmp;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Routing message of type %u to %s using DV (#%u/%u) via %s\n",
                  ntohs (hdr->type),
                  GNUNET_i2s (&dv->target),
                  i + 1,
                  num_dvhs,
                  path);
      GNUNET_free (path);
    }
    rtt = GNUNET_TIME_relative_min (rtt, dvh->pd.aged_rtt);
    memcpy (&dhops[num_hops], ct, sizeof(ct));
    use (use_cls,
         dvh->next_hop,
         (const struct GNUNET_MessageHeader *) buf,
         options);
  }
  return rtt;
}
 
 
static void
send_dv_to_neighbour (void *cls,
                      struct Neighbour *next_hop,
                      const struct GNUNET_MessageHeader *hdr,
                      enum RouteMessageOptions options)
{
  (void) cls;
  (void) route_via_neighbour (next_hop, hdr, RMO_UNCONFIRMED_ALLOWED);
}
 
 
static struct GNUNET_TIME_Relative
route_control_message_without_fc (struct VirtualLink *vl,
// route_control_message_without_fc (const struct GNUNET_PeerIdentity *target,
                                  const struct GNUNET_MessageHeader *hdr,
                                  enum RouteMessageOptions options)
{
  // struct VirtualLink *vl;
  struct Neighbour *n;
  struct DistanceVector *dv;
  struct GNUNET_TIME_Relative rtt1;
  struct GNUNET_TIME_Relative rtt2;
  const struct GNUNET_PeerIdentity *target = &vl->target;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Trying to route message of type %u to %s without fc\n",
              ntohs (hdr->type),
              GNUNET_i2s (target));
 
  // TODO Do this elsewhere. vl should be given as parameter to method.
  // vl = lookup_virtual_link (target);
  /* An unconfirmed link is allowed here: it has no @e n and no @e dv of its
     own, so the "confirmed required" branch below resolves the route from
     #neighbours / #dv_routes.  Refusing to route at all is what deadlocks a
     pair of peers, see #consider_sending_fc(). */
  GNUNET_assert (NULL != vl);
  n = vl->n;
  dv = (0 != (options & RMO_DV_ALLOWED)) ? vl->dv : NULL;
  /* An unconfirmed link has neither @e n nor @e dv of its own, so resolve
     the route from #neighbours / #dv_routes.  This used to be done only
     while #RMO_UNCONFIRMED_ALLOWED was *not* set -- exactly backwards: with
     the flag set (the caller that needs it most) we would find no route at
     all and drop the message.  Whether an unvalidated queue or an
     unvalidated path may then be used is still decided by @a options, in
     #route_via_neighbour() and #pick_random_dv_hops(). */
  if (NULL == n)
    n = lookup_neighbour (target);
  if ((NULL == dv) && (0 != (options & RMO_DV_ALLOWED)))
    dv = GNUNET_CONTAINER_multipeermap_get (dv_routes, target);
  if ((NULL == n) && (NULL == dv))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Cannot route message of type %u to %s: no route\n",
                ntohs (hdr->type),
                GNUNET_i2s (target));
    GNUNET_STATISTICS_update (GST_stats,
                              "# Messages dropped in routing: no acceptable method",
                              1,
                              GNUNET_NO);
    return GNUNET_TIME_UNIT_FOREVER_REL;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Routing message of type %u to %s with options %X\n",
              ntohs (hdr->type),
              GNUNET_i2s (target),
              (unsigned int) options);
  /* If both dv and n are possible and we must choose:
     flip a coin for the choice between the two; for now 50/50 */
  if ((NULL != n) && (NULL != dv) && (0 == (options & RMO_REDUNDANT)))
  {
    if (0 == GNUNET_CRYPTO_random_u32 (2))
      n = NULL;
    else
      dv = NULL;
  }
  if ((NULL != n) && (NULL != dv))
    options &= ~RMO_REDUNDANT; /* We will do one DV and one direct, that's
                                  enough for redundancy, so clear the flag. */
  rtt1 = GNUNET_TIME_UNIT_FOREVER_REL;
  rtt2 = GNUNET_TIME_UNIT_FOREVER_REL;
  if (NULL != n)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Try to route message of type %u to %s without fc via neighbour\n",
                ntohs (hdr->type),
                GNUNET_i2s (target));
    rtt1 = route_via_neighbour (n, hdr, options);
  }
  if (NULL != dv)
  {
    struct DistanceVectorHop *hops[2];
    unsigned int res;
 
    res = pick_random_dv_hops (dv,
                               options,
                               hops,
                               (0 == (options & RMO_REDUNDANT)) ? 1 : 2);
    if (0 == res)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                  "Failed to route message, could not determine DV path\n");
      return rtt1;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "encapsulate_for_dv 1\n");
    rtt2 = encapsulate_for_dv (dv,
                               res,
                               hops,
                               hdr,
                               &send_dv_to_neighbour,
                               NULL,
                               options & (~RMO_REDUNDANT),
                               GNUNET_YES);
  }
  return GNUNET_TIME_relative_min (rtt1, rtt2);
}
 
 
static void
consider_sending_fc (void *cls);
 
static void
task_consider_sending_fc (void *cls)
{
  struct VirtualLink *vl = cls;
  vl->fc_retransmit_task = NULL;
  consider_sending_fc (cls);
}
 
 
static char *
get_address_without_port (const char *address);
 
 
struct AddGlobalAddressesContext
{
  size_t off;
 
  size_t size;
 
  char *tgnas;
};
 
 
static enum GNUNET_GenericReturnValue
add_global_addresses (void *cls,
                      const struct GNUNET_PeerIdentity *pid,
                      void *value)
{
  struct AddGlobalAddressesContext *ctx = cls;
  struct TransportGlobalNattedAddress *tgna = value;
  char *addr = (char *) &tgna[1];
  size_t alen = ntohl (tgna->address_length);
  size_t need = sizeof (struct TransportGlobalNattedAddress) + alen;
 
  /* NOTE: the address is NOT 0-terminated, it must be printed with an
     explicit precision. */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "sending address %.*s length %lu\n",
              (int) alen,
              addr,
              (unsigned long) alen);
  if (ctx->off + need > ctx->size)
  {
    GNUNET_break (0);
    return GNUNET_NO;
  }
  GNUNET_memcpy (&(ctx->tgnas[ctx->off]), tgna, need);
  ctx->off += need;
 
  return GNUNET_OK;
}
 
 
static struct GNUNET_TIME_Relative
calculate_rtt (struct DistanceVector *dv);
 
 
static void
consider_sending_fc (void *cls)
{
  struct VirtualLink *vl = cls;
  struct GNUNET_TIME_Absolute monotime;
  struct TransportFlowControlMessage *fc;
  struct GNUNET_TIME_Relative duration;
  struct GNUNET_TIME_Relative rtt;
  struct GNUNET_TIME_Relative rtt_average;
  struct Neighbour *n = vl->n;
  size_t addresses_size;
 
  /* Most of our callers are not the retransmit task but inbound events:
     handle_flow_control() ends in check_vl_transmission(), which calls us
     once per flow-control-stalled message, and the peer's answer to what we
     send here arrives as another handle_flow_control().  On a link whose
     head message does not fit the window that is a ping-pong with nothing
     to damp it -- the backoff and the MIN_FC_RETRANSMIT_DELAY floor at the
     bottom of this function only ever governed @e fc_retransmit_task, which
     these callers bypass.  If the chain is armed and we just sent one, let
     the task do it. */
  if ((NULL != vl->fc_retransmit_task) &&
      (GNUNET_TIME_absolute_get_duration (vl->last_fc_transmission).rel_value_us
       < MIN_FC_RETRANSMIT_DELAY.rel_value_us))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Not sending FC to %s: one went out less than %s ago\n",
                GNUNET_i2s (&vl->target),
                GNUNET_STRINGS_relative_time_to_string (
                  MIN_FC_RETRANSMIT_DELAY,
                  GNUNET_YES));
    return;
  }
  if ((GNUNET_YES != vl->confirmed) &&
      (NULL == lookup_neighbour (&vl->target)) &&
      (NULL == GNUNET_CONTAINER_multipeermap_get (dv_routes, &vl->target)))
  {
    /* Unconfirmed AND no way to reach the peer at all -- nothing to send on.
       An unconfirmed link that *does* have a route must still answer,
       see below.
 
       Do NOT just return: #task_consider_sending_fc() cleared
       @e fc_retransmit_task before calling us, and the only other place that
       arms it is #handle_flow_control() -- which only does so when it is
       already non-NULL.  Leaving without re-arming therefore ends the
       keepalive chain for this link permanently, and #check_link_down()
       tears it down #NEIGHBOUR_LIVENESS_TIMEOUT later. */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Not sending FC to %s: link unconfirmed and no route\n",
                GNUNET_i2s (&vl->target));
    if (NULL == vl->fc_retransmit_task)
      vl->fc_retransmit_task =
        GNUNET_SCHEDULER_add_delayed (FC_KEEPALIVE_INTERVAL,
                                      &task_consider_sending_fc,
                                      vl);
    return;
  }
  addresses_size = 0;
  if (NULL != n && 0 < n->number_of_addresses)
  {
    addresses_size =
      n->number_of_addresses * sizeof (struct TransportGlobalNattedAddress) + n
      ->size_of_global_addresses;
    if (addresses_size >
        UINT16_MAX - sizeof (struct TransportFlowControlMessage))
    {
      /* htons() below would silently truncate `header.size', leaving a
         message whose declared length does not match its contents. */
      GNUNET_break (0);
      addresses_size = 0;
    }
  }
  if (0 != addresses_size)
  {
    char *tgnas = GNUNET_malloc (addresses_size);
    struct AddGlobalAddressesContext ctx;
    ctx.off = 0;
    ctx.size = addresses_size;
    ctx.tgnas = tgnas;
 
    fc = GNUNET_malloc (sizeof (struct TransportFlowControlMessage)
                        + addresses_size);
    fc->header.size = htons (sizeof(struct TransportFlowControlMessage)
                             + addresses_size);
    fc->size_of_addresses = htonl ((uint32_t) n->size_of_global_addresses);
    fc->number_of_addresses = htonl (n->number_of_addresses);
    GNUNET_CONTAINER_multipeermap_iterate (n->natted_addresses,
                                           &add_global_addresses,
                                           &ctx);
    GNUNET_memcpy (&fc[1], tgnas, addresses_size);
    GNUNET_free (tgnas);
  }
  else
  {
    fc = GNUNET_malloc (sizeof (struct TransportFlowControlMessage));
    fc->header.size = htons (sizeof(struct TransportFlowControlMessage));
  }
 
  duration = GNUNET_TIME_absolute_get_duration (vl->last_fc_transmission);
  /* OPTIMIZE-FC-BDP: decide sane criteria on when to do this, instead of doing
     it always! */
  /* For example, we should probably ONLY do this if a bit more than
     an RTT has passed, or if the window changed "significantly" since
     then. See vl->last_fc_rtt! NOTE: to do this properly, we also
     need an estimate for the bandwidth-delay-product for the entire
     VL, as that determines "significantly". We have the delay, but
     the bandwidth statistics need to be added for the VL!*/(void) duration;
 
  if (NULL != vl->dv)
    rtt_average = calculate_rtt (vl->dv);
  else
    rtt_average = GNUNET_TIME_UNIT_FOREVER_REL;
  fc->rtt = GNUNET_TIME_relative_hton (rtt_average);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending FC seq %u to %s with new window %llu %lu %u\n",
              (unsigned int) vl->fc_seq_gen,
              GNUNET_i2s (&vl->target),
              (unsigned long long) vl->incoming_fc_window_size,
              (unsigned long) rtt_average.rel_value_us,
              vl->sync_ready);
  monotime = GNUNET_TIME_absolute_get_monotonic (GST_cfg);
  vl->last_fc_transmission = monotime;
  fc->sync_ready = htonl ((uint32_t) vl->sync_ready);
  fc->header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_FLOW_CONTROL);
  fc->seq = htonl (vl->fc_seq_gen++);
  fc->inbound_window_size = GNUNET_htonll (vl->incoming_fc_window_size
                                           + vl->incoming_fc_window_size_used
                                           + vl->incoming_fc_window_size_loss);
  fc->outbound_sent = GNUNET_htonll (vl->outbound_fc_window_size_used);
  fc->outbound_window_size = GNUNET_htonll (vl->outbound_fc_window_size);
  fc->sender_time = GNUNET_TIME_absolute_hton (monotime);
  /* On an unconfirmed link the only queues and paths we have are, by
     definition, unvalidated ones -- that is what "unconfirmed" means.
     Requiring a validated route here is what deadlocks the pair: the peer
     has a confirmed link to us and flow-controls us, we cannot answer, so
     its @e outbound_fc_window_size stays at zero and it cannot send us a
     single byte -- not its CORE handshake, not DHT traffic -- while its
     `gnunet-transport' shows an established link with messages pending
     forever.  It reached us over that queue, so answering on it is sound. */
  rtt = route_control_message_without_fc (vl,
                                          &fc->header,
                                          (GNUNET_YES == vl->confirmed)
                                          ? RMO_DV_ALLOWED
                                          : RMO_ANYTHING_GOES);
  if (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us == rtt.rel_value_us)
  {
    rtt = GNUNET_TIME_UNIT_SECONDS;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "FC retransmission to %s failed, will retry in %s\n",
                GNUNET_i2s (&vl->target),
                GNUNET_STRINGS_relative_time_to_string (rtt, GNUNET_YES));
    vl->last_fc_rtt = GNUNET_TIME_UNIT_ZERO;
  }
  else
  {
    /* OPTIMIZE-FC-BDP: rtt is not ideal, we can do better! */
    vl->last_fc_rtt = rtt;
  }
  if (NULL != vl->fc_retransmit_task)
    GNUNET_SCHEDULER_cancel (vl->fc_retransmit_task);
  /* Never re-arm with (near) zero delay: @a rtt is zero whenever we have no
     RTT sample yet, which turned this into a tight send loop. */
  rtt = GNUNET_TIME_relative_max (rtt, MIN_FC_RETRANSMIT_DELAY);
  {
    /* Back off while the peer stays silent.  Retransmitting at the plain RTT
       for #MAX_FC_RETRANSMIT_COUNT rounds is a flood on a link that is not
       being answered -- and a peer that cannot answer keeps *every* one of
       its links in exactly that state, which is enough traffic to make
       transport fall behind its communicators. */
    struct GNUNET_TIME_Relative cap = FC_KEEPALIVE_INTERVAL;
 
    for (unsigned int i = 0;
         (i < vl->fc_retransmit_count) && (rtt.rel_value_us < cap.rel_value_us);
         i++)
      rtt = GNUNET_TIME_relative_multiply (rtt, 2);
    rtt = GNUNET_TIME_relative_min (rtt, cap);
  }
  vl->fc_retransmit_task =
    GNUNET_SCHEDULER_add_delayed (rtt, &task_consider_sending_fc, vl);
  if (MAX_FC_RETRANSMIT_COUNT > vl->fc_retransmit_count)
    vl->fc_retransmit_count++;
  GNUNET_free (fc);
}
 
 
static void
check_vl_transmission (struct VirtualLink *vl)
{
  struct Neighbour *n = vl->n;
  struct DistanceVector *dv = vl->dv;
  struct GNUNET_TIME_Absolute now;
  struct VirtualLink *vl_next_hop;
  int elig;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "check_vl_transmission to target %s\n",
              GNUNET_i2s (&vl->target));
  /* Check that we have an eligible pending message!
     (cheaper than having #transmit_on_queue() find out!) */
  elig = GNUNET_NO;
  for (struct PendingMessage *pm = vl->pending_msg_head; NULL != pm;
       pm = pm->next_vl)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "check_vl_transmission loop\n");
    if (NULL != pm->qe)
      continue;   /* not eligible, is in a queue! */
    if (pm->bytes_msg + vl->outbound_fc_window_size_used >
        vl->outbound_fc_window_size)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Stalled message %" PRIu64
                  " transmission on VL %s due to flow control: %llu < %llu\n",
                  pm->logging_uuid,
                  GNUNET_i2s (&vl->target),
                  (unsigned long long) vl->outbound_fc_window_size,
                  (unsigned long long) (pm->bytes_msg
                                        + vl->outbound_fc_window_size_used));
      consider_sending_fc (vl);
      return;     /* We have a message, but flow control says "nope" */
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Target window on VL %s not stalled. Scheduling transmission on queue\n",
                GNUNET_i2s (&vl->target));
    /* Notify queues at direct neighbours that we are interested */
    now = GNUNET_TIME_absolute_get ();
    if (NULL != n)
    {
      for (struct Queue *queue = n->queue_head; NULL != queue;
           queue = queue->next_neighbour)
      {
        if ((GNUNET_YES == queue->idle) &&
            (queue->validated_until.abs_value_us > now.abs_value_us))
        {
          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                      "Direct neighbour %s not stalled\n",
                      GNUNET_i2s (&n->pid));
          schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                      queue,
                                      GNUNET_SCHEDULER_PRIORITY_DEFAULT);
          elig = GNUNET_YES;
        }
        else
          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                      "Neighbour Queue QID: %u (%u) busy or invalid\n",
                      queue->qid,
                      queue->idle);
      }
    }
    /* Notify queues via DV that we are interested */
    if (NULL != dv)
    {
      /* Do DV with lower scheduler priority, which effectively means that
         IF a neighbour exists and is available, we prefer it. */
      for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
           pos = pos->next_dv)
      {
        struct Neighbour *nh_iter = pos->next_hop;
 
 
        if (pos->path_valid_until.abs_value_us <= now.abs_value_us)
          continue;   /* skip this one: path not validated */
        else
        {
          /* The next hop is a neighbour we have queues to; it need not have
             a virtual link of its own, and then there is no window of it to
             respect either. */
          vl_next_hop = lookup_virtual_link (&nh_iter->pid);
          if ((NULL != vl_next_hop) &&
              (pm->bytes_msg + vl_next_hop->outbound_fc_window_size_used >
               vl_next_hop->outbound_fc_window_size))
          {
            GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                        "Stalled message %" PRIu64
                        " transmission on next hop %s due to flow control: %llu < %llu\n",
                        pm->logging_uuid,
                        GNUNET_i2s (&vl_next_hop->target),
                        (unsigned long
                         long) vl_next_hop->outbound_fc_window_size,
                        (unsigned long long) (pm->bytes_msg
                                              + vl_next_hop->
                                              outbound_fc_window_size_used));
            consider_sending_fc (vl_next_hop);
            continue; /* We have a message, but flow control says "nope" for the first hop of this path */
          }
          for (struct Queue *queue = nh_iter->queue_head; NULL != queue;
               queue = queue->next_neighbour)
            if ((GNUNET_YES == queue->idle) &&
                (queue->validated_until.abs_value_us > now.abs_value_us))
            {
              GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                          "Next hop neighbour %s not stalled\n",
                          GNUNET_i2s (&nh_iter->pid));
              schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                          queue,
                                          GNUNET_SCHEDULER_PRIORITY_BACKGROUND);
              elig = GNUNET_YES;
            }
            else
              GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                          "DV Queue QID: %u (%u) busy or invalid\n",
                          queue->qid,
                          queue->idle);
        }
      }
    }
    if (GNUNET_YES == elig)
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Eligible message %" PRIu64 " of size %u to %s: %llu/%llu\n",
                  pm->logging_uuid,
                  pm->bytes_msg,
                  GNUNET_i2s (&vl->target),
                  (unsigned long long) vl->outbound_fc_window_size,
                  (unsigned long long) (pm->bytes_msg
                                        + vl->outbound_fc_window_size_used));
    break;
  }
}
 
 
static void
handle_client_send (void *cls, const struct OutboundMessage *obm)
{
  struct TransportClient *tc = cls;
  struct PendingMessage *pm;
  const struct GNUNET_MessageHeader *obmm;
  uint32_t bytes_msg;
  struct VirtualLink *vl;
  enum GNUNET_MQ_PriorityPreferences pp;
 
  GNUNET_assert (CT_CORE == tc->type);
  obmm = (const struct GNUNET_MessageHeader *) &obm[1];
  bytes_msg = ntohs (obmm->size);
  pp = ntohl (obm->priority);
  vl = lookup_virtual_link (&obm->peer);
  if ((NULL == vl) || (GNUNET_NO == vl->confirmed))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Don't have %s as a neighbour (anymore).\n",
                GNUNET_i2s (&obm->peer));
    /* Failure: don't have this peer as a neighbour (anymore).
       Might have gone down asynchronously, so this is NOT
       a protocol violation by CORE. Still count the event,
       as this should be rare. */
    /* Precisely because this is not a protocol violation we leave the
       client's `struct Neighbour' -- and its send window -- in place, so we
       owe it the SEND_OK for the message we are dropping here.  Without it
       the window shrinks by one every time this happens and never grows
       back; after #SEND_WINDOW_SIZE such drops #mq_send_impl() parks every
       further message for this peer forever ("Flow control delays
       transmission to CORE until we see SEND_OK") and CORE goes mute
       towards a peer it still believes it is connected to -- while
       continuing to receive from it, so its own idle timeout is what
       eventually reports the peer down. */
    send_ok_to_client (tc, &obm->peer);
    GNUNET_SERVICE_client_continue (tc->client);
    GNUNET_STATISTICS_update (GST_stats,
                              "# messages dropped (neighbour unknown)",
                              1,
                              GNUNET_NO);
    return;
  }
 
  pm = GNUNET_malloc (sizeof(struct PendingMessage) + bytes_msg);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "1 created pm %p storing vl %p\n",
              pm,
              vl);
  pm->logging_uuid = logging_uuid_gen++;
  pm->prefs = pp;
  pm->client = tc;
  pm->vl = vl;
  pm->bytes_msg = bytes_msg;
  memcpy (&pm[1], obmm, bytes_msg);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending message of type %u  with %u bytes as <%" PRIu64
              "> to %s\n",
              ntohs (obmm->type),
              bytes_msg,
              pm->logging_uuid,
              GNUNET_i2s (&obm->peer));
  GNUNET_CONTAINER_MDLL_insert (client,
                                tc->details.core.pending_msg_head,
                                tc->details.core.pending_msg_tail,
                                pm);
  GNUNET_CONTAINER_MDLL_insert (vl,
                                vl->pending_msg_head,
                                vl->pending_msg_tail,
                                pm);
  check_vl_transmission (vl);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_communicator_backchannel (
  void *cls,
  const struct GNUNET_TRANSPORT_CommunicatorBackchannel *cb)
{
  struct Neighbour *n;
  struct VirtualLink *vl;
  struct TransportClient *tc = cls;
  const struct GNUNET_MessageHeader *inbox =
    (const struct GNUNET_MessageHeader *) &cb[1];
  uint16_t isize = ntohs (inbox->size);
  const char *is = ((const char *) &cb[1]) + isize;
  size_t slen = strlen (is) + 1;
  char
    mbuf[slen + isize
         + sizeof(struct
                  TransportBackchannelEncapsulationMessage)] GNUNET_ALIGN;
  struct TransportBackchannelEncapsulationMessage *be =
    (struct TransportBackchannelEncapsulationMessage *) mbuf;
 
  /* 0-termination of 'is' was checked already in
   #check_communicator_backchannel() */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Preparing backchannel transmission to %s:%s of type %u and size %u\n",
              GNUNET_i2s (&cb->pid),
              is,
              ntohs (inbox->type),
              ntohs (inbox->size));
  /* encapsulate and encrypt message */
  be->header.type =
    htons (GNUNET_MESSAGE_TYPE_TRANSPORT_BACKCHANNEL_ENCAPSULATION);
  be->header.size = htons (sizeof(mbuf));
  memcpy (&be[1], inbox, isize);
  memcpy (&mbuf[sizeof(struct TransportBackchannelEncapsulationMessage)
                + isize],
          is,
          strlen (is) + 1);
  // route_control_message_without_fc (&cb->pid, &be->header, RMO_DV_ALLOWED);
  vl = lookup_virtual_link (&cb->pid);
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
  {
    route_control_message_without_fc (vl, &be->header, RMO_DV_ALLOWED);
  }
  else
  {
    /* Use route via neighbour */
    n = lookup_neighbour (&cb->pid);
    if (NULL != n)
      route_via_neighbour (
        n,
        &be->header,
        RMO_NONE);
  }
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
check_add_address (void *cls,
                   const struct GNUNET_TRANSPORT_AddAddressMessage *aam)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  GNUNET_MQ_check_zero_termination (aam);
  return GNUNET_OK;
}
 
 
static void
store_pi (void *cls);
 
 
struct PilsAddressSignContext
{
 
  struct AddressListEntry *ale;
 
  struct PilsRequest *req;
 
 
  struct GNUNET_TIME_Absolute et;
};
 
 
static void
cancel_address_store (struct AddressListEntry *ale)
{
  struct PilsAddressSignContext *pc = ale->pc;
 
  if (NULL == pc)
    return;
  ale->pc = NULL;
  /* Each stage of the chain passes @a pc as its closure, so every handle
     that could still deliver one has to go before @a pc is released. */
  if (NULL != ale->sc)
  {
    GNUNET_PEERSTORE_store_cancel (ale->sc);
    ale->sc = NULL;
  }
  if (NULL != ale->shc)
  {
    GNUNET_PEERSTORE_hello_add_cancel (ale->shc);
    ale->shc = NULL;
  }
  if (NULL != pc->req)
  {
    if (NULL != pc->req->op)
      GNUNET_PILS_cancel (pc->req->op);
    GNUNET_CONTAINER_DLL_remove (pils_requests_head,
                                 pils_requests_tail,
                                 pc->req);
    GNUNET_free (pc->req);
    pc->req = NULL;
  }
  GNUNET_free (pc);
}
 
 
static void
shc_cont (void *cls, int success)
{
  struct PilsAddressSignContext *pc = cls;
 
  GNUNET_assert (NULL == pc->req);
  /* The store completed; the handle is dead and must not be cancelled
     later by #free_address_list_entry(). */
  pc->ale->shc = NULL;
  pc->ale->pc = NULL;
  if (GNUNET_OK != success)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Failed to store our address `%s' with peerstore\n",
                pc->ale->address);
    if (NULL == pc->ale->st)
    {
      pc->ale->st = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
                                                  &store_pi,
                                                  pc->ale);
    }
  }
  GNUNET_free (pc);
}
 
 
static void
pils_sign_hello_cb (void *cls,
                    const struct GNUNET_PeerIdentity *pid,
                    const struct GNUNET_CRYPTO_EddsaSignature *sig)
{
  struct PilsAddressSignContext *pc = cls;
  struct GNUNET_MQ_Envelope *env;
  const struct GNUNET_MessageHeader *msg;
 
  pc->req->op = NULL;
  GNUNET_CONTAINER_DLL_remove (pils_requests_head,
                               pils_requests_tail,
                               pc->req);
  GNUNET_free (pc->req);
  pc->req = NULL;
  env = GNUNET_HELLO_builder_to_env (
    GST_my_hello,
    pid,
    sig,
    pc->et);
  msg = GNUNET_MQ_env_get_msg (env);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "store_pi 1\n");
  pc->ale->shc = GNUNET_PEERSTORE_hello_add (peerstore,
                                             msg,
                                             shc_cont,
                                             pc);
  GNUNET_free (env);
}
 
 
static void
peerstore_store_own_cb (void *cls, int success)
{
  struct PilsAddressSignContext *pc = cls;
 
  pc->ale->sc = NULL;
  if (GNUNET_YES != success)
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to store our own address `%s' in peerstore!\n",
                pc->ale->address);
  else
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Successfully stored our own address `%s' in peerstore!\n",
                pc->ale->address);
  /* refresh period is 1/4 of expiration time, that should be plenty
     without being excessive. */
  if (NULL == pc->ale->st)
  {
    /* @e expiration comes straight off the wire in ADD_ADDRESS and is not
       validated anywhere, so a communicator reporting a very short (or
       zero) lifetime would have us re-sign the HELLO and store it again on
       the next scheduler pass, forever.  That is an EdDSA signature and a
       PEERSTORE round trip per iteration. */
    pc->ale->st =
      GNUNET_SCHEDULER_add_delayed (
        GNUNET_TIME_relative_max (
          MIN_ADDRESS_REFRESH_INTERVAL,
          GNUNET_TIME_relative_divide (pc->ale->expiration,
                                       4ULL)),
        &store_pi,
        pc->ale);
  }
 
  /* Now we have to update our HELLO! */
  pc->et = GNUNET_TIME_relative_to_absolute (GNUNET_HELLO_ADDRESS_EXPIRATION);
  pc->req = GNUNET_new (struct PilsRequest);
  GNUNET_CONTAINER_DLL_insert (pils_requests_head,
                               pils_requests_tail,
                               pc->req);
  pc->req->op = GNUNET_PILS_sign_hello (pils,
                                        GST_my_hello,
                                        pc->et,
                                        &pils_sign_hello_cb,
                                        pc);
}
 
 
static void
store_signed_address (struct PilsAddressSignContext *pc,
                      const struct GNUNET_PeerIdentity *pid,
                      const struct GNUNET_CRYPTO_EddsaSignature *sig)
{
  char *sig_str;
  void *result;
  size_t result_size;
 
  sig_str = NULL;
  (void) GNUNET_STRINGS_base64_encode (sig, sizeof(*sig), &sig_str);
  result_size =
    1 + GNUNET_asprintf (
      (char **) &result,
      "%s;%llu;%u;%s",
      sig_str,
      (unsigned long long) pc->et.abs_value_us,
      (unsigned int) pc->ale->nt,
      pc->ale->address);
  GNUNET_free (sig_str);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Build our HELLO URI `%s'\n",
              (char*) result);
 
  GNUNET_free (pc->ale->signed_address);
  pc->ale->signed_address = result;
  pc->ale->signed_address_len = result_size;
  struct GNUNET_TIME_Absolute expiration;
 
  expiration = GNUNET_TIME_relative_to_absolute (pc->ale->expiration);
  pc->ale->sc = GNUNET_PEERSTORE_store (peerstore,
                                        "transport",
                                        pid,
                                        GNUNET_PEERSTORE_TRANSPORT_HELLO_KEY,
                                        result,
                                        result_size,
                                        expiration,
                                        GNUNET_PEERSTORE_STOREOPTION_MULTIPLE,
                                        &peerstore_store_own_cb,
                                        pc);
}
 
 
struct SignedAddress
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_TIME_AbsoluteNBO mono_time;
 
  struct GNUNET_HashCode addr_hash GNUNET_PACKED;
};
 
 
void
pils_sign_address (
  struct AddressListEntry *ale,
  struct GNUNET_TIME_Absolute mono_time)
{
  struct SignedAddress sa;
  struct PilsAddressSignContext *pc;
  struct GNUNET_CRYPTO_EddsaSignature sig;
  const struct GNUNET_PeerIdentity *my_identity;
 
  sa.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS);
  sa.purpose.size = htonl (sizeof(sa));
  sa.mono_time = GNUNET_TIME_absolute_hton (mono_time);
  GNUNET_CRYPTO_hash (ale->address, strlen (ale->address), &sa.addr_hash);
  /* Only ever one chain per entry: the previous one (if any) still holds a
     pointer to @a ale and must be torn down first. */
  cancel_address_store (ale);
  my_identity = GNUNET_PILS_get_identity (pils);
  if ((NULL == my_identity) ||
      (GNUNET_OK != sign_by_my_identity (&sa.purpose, &sig)))
  {
    /* Nothing else re-arms @e st: #store_pi() cleared it before calling us,
       and the only other thing that sets it is #peerstore_store_own_cb(),
       which is on the far side of the store we just failed to start.  So a
       single failure to sign used to end the refresh cycle for this address
       for the rest of the process' life. */
    if (NULL == ale->st)
    {
      ale->pils_backoff = GNUNET_TIME_STD_BACKOFF (ale->pils_backoff);
      ale->st = GNUNET_SCHEDULER_add_delayed (ale->pils_backoff,
                                              &store_pi,
                                              ale);
    }
    return;
  }
  pc = GNUNET_new (struct PilsAddressSignContext);
  pc->ale = ale;
  pc->et = mono_time;
  ale->pc = pc;
  store_signed_address (pc, my_identity, &sig);
}
 
 
static void
store_pi (void *cls)
{
  struct AddressListEntry *ale = cls;
  const char *dash;
  char *address_uri;
  char *prefix;
  unsigned int add_success;
 
  if ((GNUNET_YES == in_shutdown) || (NULL == pils))
  {
    ale->st = NULL;
    return;
  }
  if (NULL == GNUNET_PILS_get_identity (pils))
  {
    /* Do NOT poll at 1kHz: that burns CPU and keeps the scheduler task
       list non-empty, which prevents the service from ever exiting. */
    ale->pils_backoff = GNUNET_TIME_STD_BACKOFF (ale->pils_backoff);
    ale->st = GNUNET_SCHEDULER_add_delayed (ale->pils_backoff,
                                            &store_pi,
                                            ale);
    return;
  }
  ale->pils_backoff = GNUNET_TIME_UNIT_ZERO;
  prefix = GNUNET_HELLO_address_to_prefix (ale->address);
  dash = strchr (ale->address, '-');
  GNUNET_assert (NULL != dash);
  dash++;
  GNUNET_asprintf (&address_uri,
                   "%s://%s",
                   prefix,
                   dash);
  GNUNET_free (prefix);
  ale->st = NULL;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Storing our address `%s' in peerstore until %s!\n",
              ale->address,
              GNUNET_STRINGS_absolute_time_to_string (hello_mono_time));
  add_success = GNUNET_HELLO_builder_add_address (GST_my_hello,
                                                  address_uri);
  /* NOTE: #GNUNET_HELLO_builder_add_address() answers GNUNET_NO for an
     address that is already in the builder, and on every call after the
     first one for a given address that is exactly what happens: nothing
     ever removes an address from @a GST_my_hello except
     #handle_del_address().  This function is the *refresh* cycle --
     #peerstore_store_own_cb() re-arms it at a quarter of the address'
     expiration -- so bailing out on GNUNET_NO here stopped the refresh
     after precisely one round.  Our own HELLO then expired
     (#GNUNET_HELLO_ADDRESS_EXPIRATION, twelve hours) and was never
     renewed: peers can no longer learn how to reach us, and a link that
     drops after that never comes back.  Only GNUNET_SYSERR -- a malformed
     URI, which retrying cannot fix -- is a reason not to store. */
  if (GNUNET_SYSERR == add_success)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Not storing our address `%s': not a valid HELLO URI\n",
                address_uri);
    GNUNET_free (address_uri);
    return;
  }
  GNUNET_log ((GNUNET_NO == add_success) ?
              GNUNET_ERROR_TYPE_DEBUG : GNUNET_ERROR_TYPE_INFO,
              "%s our address `%s' in PEERSTORE\n",
              (GNUNET_NO == add_success) ? "Refreshing" : "Storing",
              address_uri);
  // FIXME hello_mono_time used here?? What about expiration in ale?
  pils_sign_address (ale,
                     hello_mono_time);
  // TODO keep track of op and potentially cancel/clean
  GNUNET_free (address_uri);
}
 
 
static struct AddressListEntry *
create_address_entry (struct TransportClient *tc,
                      struct GNUNET_TIME_Relative expiration,
                      enum GNUNET_NetworkType nt,
                      const char *address,
                      uint32_t aid,
                      size_t slen)
{
  struct AddressListEntry *ale;
  char *address_without_port;
 
  ale = GNUNET_malloc (sizeof(struct AddressListEntry) + slen);
  ale->tc = tc;
  ale->address = (const char *) &ale[1];
  ale->expiration = expiration;
  ale->aid = aid;
  ale->nt = nt;
  memcpy (&ale[1], address, slen);
  address_without_port = get_address_without_port (ale->address);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Is this %s a local address (%s)\n",
              (NULL == address_without_port) ? "<unparsable>"
              : address_without_port,
              ale->address);
  if ((NULL == address_without_port) ||
      (0 != strcmp ("127.0.0.1", address_without_port)))
  {
    if (NULL != ale->st)
    {
      GNUNET_SCHEDULER_cancel (ale->st);
    }
    ale->st = GNUNET_SCHEDULER_add_now (&store_pi, ale);
  }
  GNUNET_free (address_without_port);
 
  return ale;
}
 
 
static void
feed_addresses_to_pils (void *cls)
{
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Feeding addresses to PILS\n");
  pils_feed_task = NULL;
 
  GNUNET_PILS_feed_addresses (pils,
                              GST_my_hello);
}
 
 
static void
handle_add_address (void *cls,
                    const struct GNUNET_TRANSPORT_AddAddressMessage *aam)
{
  struct TransportClient *tc = cls;
  struct AddressListEntry *ale;
  size_t slen;
  char *address;
 
  /* 0-termination of &aam[1] was checked in #check_add_address */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Communicator added address `%s'!\n",
              (const char *) &aam[1]);
  slen = ntohs (aam->header.size) - sizeof(*aam);
  address = GNUNET_malloc (slen);
  memcpy (address, &aam[1], slen);
  ale = create_address_entry (tc,
                              GNUNET_TIME_relative_ntoh (aam->expiration),
                              ntohl (aam->nt),
                              address,
                              aam->aid,
                              slen);
  GNUNET_CONTAINER_DLL_insert (tc->details.communicator.addr_head,
                               tc->details.communicator.addr_tail,
                               ale);
  {
    for (struct AddressListEntry *iter = tc->details.communicator.addr_head;
         NULL != iter;
         iter = iter->next)
    {
      char *address_uri;
      const char *dash = strchr (iter->address, '-');
      char *prefix = GNUNET_HELLO_address_to_prefix (iter->address);
      GNUNET_assert (NULL != dash);
      dash++;
      GNUNET_asprintf (&address_uri,
                       "%s://%s",
                       prefix,
                       dash);
      GNUNET_free (prefix);
      GNUNET_HELLO_builder_add_address (GST_my_hello, address_uri);
      GNUNET_free (address_uri);
    }
    if (NULL != pils_feed_task)
      GNUNET_SCHEDULER_cancel (pils_feed_task);
    pils_feed_task = GNUNET_SCHEDULER_add_delayed (PILS_FEED_ADDRESSES_DELAY,
                                                   &feed_addresses_to_pils,
                                                   NULL);
  }
  GNUNET_SERVICE_client_continue (tc->client);
  GNUNET_free (address);
}
 
 
static void
handle_del_address (void *cls,
                    const struct GNUNET_TRANSPORT_DelAddressMessage *dam)
{
  struct TransportClient *tc = cls;
  struct AddressListEntry *alen;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  for (struct AddressListEntry *ale = tc->details.communicator.addr_head;
       NULL != ale;
       ale = alen)
  {
    alen = ale->next;
    if (dam->aid != ale->aid)
      continue;
    GNUNET_assert (ale->tc == tc);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Communicator deleted address `%s'!\n",
                ale->address);
    GNUNET_HELLO_builder_del_address (GST_my_hello,
                                      ale->address);
    if (NULL != pils_feed_task)
      GNUNET_SCHEDULER_cancel (pils_feed_task);
    pils_feed_task = GNUNET_SCHEDULER_add_delayed (PILS_FEED_ADDRESSES_DELAY,
                                                   &feed_addresses_to_pils,
                                                   NULL);
    free_address_list_entry (ale);
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Communicator removed address we did not even have.\n");
  GNUNET_SERVICE_client_continue (tc->client);
  // GNUNET_SERVICE_client_drop (tc->client);
}
 
 
static void
demultiplex_with_cmc (struct CommunicatorMessageContext *cmc);
 
 
static void
core_env_sent_cb (void *cls)
{
  struct CoreSentContext *ctx = cls;
  struct VirtualLink *vl = ctx->vl;
 
  if (NULL == vl)
  {
    /* lost the link in the meantime, ignore */
    GNUNET_free (ctx);
    return;
  }
  GNUNET_CONTAINER_DLL_remove (vl->csc_head, vl->csc_tail, ctx);
  GNUNET_assert (vl->incoming_fc_window_size_ram >= ctx->size);
  vl->incoming_fc_window_size_ram -= ctx->size;
  vl->incoming_fc_window_size_used += ctx->isize;
  consider_sending_fc (vl);
  GNUNET_free (ctx);
}
 
 
static void
core_fc_stalled (void *cls)
{
  struct VirtualLink *vl = cls;
  struct CommunicatorMessageContext *cmc;
 
  vl->core_fc_stall_task = NULL;
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "CORE did not acknowledge messages from %s within %s; "
              "releasing the flow control credit anyway\n",
              GNUNET_i2s (&vl->target),
              GNUNET_STRINGS_relative_time_to_string (CORE_FC_STALL_TIMEOUT,
                                                      GNUNET_YES));
  GNUNET_STATISTICS_update (GST_stats,
                            "# CORE flow control stalls",
                            1,
                            GNUNET_NO);
  while (NULL != (cmc = vl->cmc_tail))
    release_stalled_cmc (vl, cmc);
  vl->core_recv_window = RECV_WINDOW_SIZE;
  consider_sending_fc (vl);
}
 
 
static void
finish_handling_raw_message (struct VirtualLink *vl,
                             const struct GNUNET_MessageHeader *mh,
                             struct CommunicatorMessageContext *cmc,
                             unsigned int free_cmc)
{
  uint16_t size = ntohs (mh->size);
  int have_core;
 
  if (vl->incoming_fc_window_size_ram > UINT_MAX - size)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# CORE messages dropped (FC arithmetic overflow)",
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "CORE messages of type %u with %u bytes dropped (FC arithmetic overflow)\n",
                (unsigned int) ntohs (mh->type),
                (unsigned int) ntohs (mh->size));
    if (GNUNET_YES == free_cmc)
      finish_cmc_handling_with_continue (cmc, GNUNET_YES);
    return;
  }
  if (vl->incoming_fc_window_size_ram + size > vl->available_fc_window_size)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# CORE messages dropped (FC window overflow)",
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "CORE messages of type %u with %u bytes dropped (FC window overflow)\n",
                (unsigned int) ntohs (mh->type),
                (unsigned int) ntohs (mh->size));
    if (GNUNET_YES == free_cmc)
      finish_cmc_handling_with_continue (cmc, GNUNET_YES);
    return;
  }
 
  /* Forward to all CORE clients */
  have_core = GNUNET_NO;
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    struct GNUNET_MQ_Envelope *env;
    struct InboundMessage *im;
    struct CoreSentContext *ctx;
 
    if (CT_CORE != tc->type)
      continue;
    vl->incoming_fc_window_size_ram += size;
    env = GNUNET_MQ_msg_extra (im, size, GNUNET_MESSAGE_TYPE_TRANSPORT_RECV);
    ctx = GNUNET_new (struct CoreSentContext);
    ctx->vl = vl;
    ctx->size = size;
    ctx->isize = (GNUNET_NO == have_core) ? size : 0;
    have_core = GNUNET_YES;
    GNUNET_CONTAINER_DLL_insert (vl->csc_head, vl->csc_tail, ctx);
    GNUNET_MQ_notify_sent (env, &core_env_sent_cb, ctx);
    im->peer = cmc->im.sender;
    memcpy (&im[1], mh, size);
    GNUNET_MQ_send (tc->mq, env);
    vl->core_recv_window--;
  }
  if (GNUNET_NO == have_core)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Dropped message to CORE: no CORE client connected!\n");
    /* Nevertheless, count window as used, as it is from the
       perspective of the other peer! */
    vl->incoming_fc_window_size_used += size;
    /* TODO-M1 */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Dropped message of type %u with %u bytes to CORE: no CORE client connected!\n",
                (unsigned int) ntohs (mh->type),
                (unsigned int) ntohs (mh->size));
    if (GNUNET_YES == free_cmc)
      finish_cmc_handling_with_continue (cmc, GNUNET_YES);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Delivered message from %s of type %u to CORE recv window %d\n",
              GNUNET_i2s (&cmc->im.sender),
              ntohs (mh->type),
              vl->core_recv_window);
  if (vl->core_recv_window > 0)
  {
    if (GNUNET_YES == free_cmc)
      finish_cmc_handling_with_continue (cmc, GNUNET_YES);
    return;
  }
  /* CORE ran out of receive window for *this* link.  Withhold the
     per-message ACK -- that is what expresses the backpressure -- but
     resume the client immediately.  The client is the communicator
     *process*, which carries every peer we reach through it, and a
     communicator we stop reading from does not stop receiving: it starts
     discarding, see "transport is too slow" in
     #GNUNET_TRANSPORT_communicator_receive().  Discarding is precisely
     what we cannot afford here, because among the messages dropped are
     the ones CORE needs in order to reopen the window it is waiting on. */
  if (GNUNET_YES == free_cmc)
  {
    resume_cmc_client (cmc);
    GNUNET_CONTAINER_DLL_insert (vl->cmc_head, vl->cmc_tail, cmc);
    vl->cmc_count++;
    /* Nothing stalls the producer any more, so bound the list ourselves. */
    while (MAX_STALLED_CMCS < vl->cmc_count)
      release_stalled_cmc (vl, vl->cmc_tail);
    /* ... and do not withhold the ACKs forever: see #core_fc_stalled(). */
    if (NULL == vl->core_fc_stall_task)
      vl->core_fc_stall_task =
        GNUNET_SCHEDULER_add_delayed (CORE_FC_STALL_TIMEOUT,
                                      &core_fc_stalled,
                                      vl);
  }
}
 
 
static void
handle_raw_message (void *cls, const struct GNUNET_MessageHeader *mh)
{
  struct CommunicatorMessageContext *cmc = cls;
  // struct CommunicatorMessageContext *cmc_copy =
  // GNUNET_new (struct CommunicatorMessageContext);
  struct GNUNET_MessageHeader *mh_copy;
  struct RingBufferEntry *rbe;
  struct VirtualLink *vl;
  uint16_t size = ntohs (mh->size);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Handling raw message of type %u with %u bytes\n",
              (unsigned int) ntohs (mh->type),
              (unsigned int) ntohs (mh->size));
 
  if ((size > UINT16_MAX - sizeof(struct InboundMessage)) ||
      (size < sizeof(struct GNUNET_MessageHeader)))
  {
    /* @a mh was unwrapped from what a *remote peer* sent us, so a bad size
       is that peer's protocol violation and says nothing about the
       communicator that carried it.  Dropping the client here disconnects
       the communicator process and with it every neighbour reachable
       through it -- see the rationale in #demultiplex_with_cmc(). */
    GNUNET_break_op (0);
    GNUNET_STATISTICS_update (GST_stats,
                              "# CORE messages dropped (bad size)",
                              1,
                              GNUNET_NO);
    finish_cmc_handling (cmc);
    return;
  }
  vl = lookup_virtual_link (&cmc->im.sender);
  if ((NULL == vl) || (GNUNET_NO == vl->confirmed))
  {
    /* FIXME: sender is giving us messages for CORE but we don't have
       the link up yet! I *suspect* this can happen right now (i.e.
       sender has verified us, but we didn't verify sender), but if
       we pass this on, CORE would be confused (link down, messages
       arrive).  We should investigate more if this happens often,
       or in a persistent manner, and possibly do "something" about
       it. Thus logging as error for now. */
 
    mh_copy = GNUNET_malloc (size);
    rbe = GNUNET_new (struct RingBufferEntry);
    rbe->cmc = cmc;
    /*cmc_copy->tc = cmc->tc;
       cmc_copy->im = cmc->im;*/
    GNUNET_memcpy (mh_copy, mh, size);
 
    rbe->mh = mh_copy;
 
    if (GNUNET_YES == is_ring_buffer_full)
    {
      struct RingBufferEntry *rbe_old = ring_buffer[ring_buffer_head];
      GNUNET_free (rbe_old->cmc);
      GNUNET_free (rbe_old->mh);
      GNUNET_free (rbe_old);
    }
    ring_buffer[ring_buffer_head] = rbe;// cmc_copy;
    // cmc_copy->mh = (const struct GNUNET_MessageHeader *) mh_copy;
    cmc->mh = (const struct GNUNET_MessageHeader *) mh_copy;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Storing message for %s and type %u (%u) in ring buffer head %u is full %u\n",
                GNUNET_i2s (&cmc->im.sender),
                (unsigned int) ntohs (mh->type),
                (unsigned int) ntohs (mh_copy->type),
                ring_buffer_head,
                is_ring_buffer_full);
    if (RING_BUFFER_SIZE - 1 == ring_buffer_head)
    {
      ring_buffer_head = 0;
      is_ring_buffer_full = GNUNET_YES;
    }
    else
      ring_buffer_head++;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "%u items stored in ring buffer\n",
                GNUNET_YES == is_ring_buffer_full ? RING_BUFFER_SIZE :
                ring_buffer_head);
 
    /*GNUNET_break_op (0);
    GNUNET_STATISTICS_update (GST_stats,
                              "# CORE messages dropped (virtual link still down)",
                              1,
                              GNUNET_NO);
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "CORE messages of type %u with %u bytes dropped (virtual link still down)\n",
                (unsigned int) ntohs (mh->type),
                (unsigned int) ntohs (mh->size));
    finish_cmc_handling (cmc);*/
    /* @a cmc lives on in the ring buffer; #send_cmc_ack() and
       #resume_cmc_client() have recorded that they ran, so replaying it
       from #send_msg_from_cache() cannot ACK or continue a second time. */
    finish_cmc_handling_with_continue (cmc, GNUNET_NO);
    return;
  }
  finish_handling_raw_message (vl, mh, cmc, GNUNET_YES);
}
 
 
static int
check_fragment_box (void *cls, const struct TransportFragmentBoxMessage *fb)
{
  uint16_t size = ntohs (fb->header.size);
  uint16_t bsize = size - sizeof(*fb);
 
  (void) cls;
  if (0 == bsize)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (bsize + ntohs (fb->frag_off) > ntohs (fb->msg_size))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (ntohs (fb->frag_off) >= ntohs (fb->msg_size))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_YES;
}
 
 
static void
destroy_ack_cummulator (void *cls)
{
  struct AcknowledgementCummulator *ac = cls;
 
  ac->task = NULL;
  GNUNET_assert (0 == ac->num_acks);
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multipeermap_remove (ack_cummulators, &ac->target, ac));
  GNUNET_free (ac);
}
 
 
static void
transmit_cummulative_ack_cb (void *cls)
{
  struct Neighbour *n;
  struct VirtualLink *vl;
  struct AcknowledgementCummulator *ac = cls;
  char buf[sizeof(struct TransportReliabilityAckMessage)
           + ac->num_acks
           * sizeof(struct TransportCummulativeAckPayloadP)] GNUNET_ALIGN;
  struct TransportReliabilityAckMessage *ack =
    (struct TransportReliabilityAckMessage *) buf;
  struct TransportCummulativeAckPayloadP *ap;
 
  ac->task = NULL;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending ACK with %u components to %s\n",
              ac->num_acks,
              GNUNET_i2s (&ac->target));
  GNUNET_assert (0 < ac->num_acks);
  ack->header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_RELIABILITY_ACK);
  ack->header.size =
    htons (sizeof(*ack)
           + ac->num_acks * sizeof(struct TransportCummulativeAckPayloadP));
  ack->ack_counter = htonl (ac->ack_counter += ac->num_acks);
  ap = (struct TransportCummulativeAckPayloadP *) &ack[1];
  for (unsigned int i = 0; i < ac->num_acks; i++)
  {
    ap[i].ack_uuid = ac->ack_uuids[i].ack_uuid;
    ap[i].ack_delay = GNUNET_TIME_relative_hton (
      GNUNET_TIME_absolute_get_duration (ac->ack_uuids[i].receive_time));
  }
  /*route_control_message_without_fc (
    &ac->target,
    &ack->header,
    RMO_DV_ALLOWED);*/
  vl = lookup_virtual_link (&ac->target);
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
  {
    route_control_message_without_fc (
      vl,
      &ack->header,
      RMO_DV_ALLOWED);
  }
  else
  {
    /* Use route via neighbour */
    n = lookup_neighbour (&ac->target);
    if (NULL != n)
      route_via_neighbour (
        n,
        &ack->header,
        RMO_NONE);
  }
  ac->num_acks = 0;
  /* The deadline belonged to the batch we just sent.  #cummulative_ack()
     only ever lowers it (GNUNET_TIME_absolute_min), so leaving it behind
     means every later ACK is armed with GNUNET_SCHEDULER_add_at() on a time
     that has already passed: the task fires on the next scheduler pass and
     the batching this whole structure exists for is gone for good -- one
     ACK message per received message, for the rest of the process' life. */
  ac->min_transmission_time = GNUNET_TIME_UNIT_FOREVER_ABS;
  ac->task = GNUNET_SCHEDULER_add_delayed (ACK_CUMMULATOR_TIMEOUT,
                                           &destroy_ack_cummulator,
                                           ac);
}
 
 
static void
cummulative_ack (const struct GNUNET_PeerIdentity *pid,
                 const struct AcknowledgementUUIDP *ack_uuid,
                 struct GNUNET_TIME_Absolute max_delay)
{
  struct AcknowledgementCummulator *ac;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Scheduling ACK %s for transmission to %s\n",
              GNUNET_uuid2s (&ack_uuid->value),
              GNUNET_i2s (pid));
  ac = GNUNET_CONTAINER_multipeermap_get (ack_cummulators, pid);
  if (NULL == ac)
  {
    ac = GNUNET_new (struct AcknowledgementCummulator);
    ac->target = *pid;
    ac->min_transmission_time = max_delay;
    GNUNET_assert (GNUNET_YES ==
                   GNUNET_CONTAINER_multipeermap_put (
                     ack_cummulators,
                     &ac->target,
                     ac,
                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  }
  else
  {
    if (MAX_CUMMULATIVE_ACKS == ac->num_acks)
    {
      /* Must run immediately, ack buffer full.  Cancel the pending task
         FIRST: #transmit_cummulative_ack_cb() clears @e task without
         cancelling it, which would leave the old task armed with its
         handle lost. */
      GNUNET_SCHEDULER_cancel (ac->task);
      ac->task = NULL;
      transmit_cummulative_ack_cb (ac);
    }
    GNUNET_SCHEDULER_cancel (ac->task);
    ac->min_transmission_time =
      GNUNET_TIME_absolute_min (ac->min_transmission_time, max_delay);
  }
  GNUNET_assert (ac->num_acks < MAX_CUMMULATIVE_ACKS);
  ac->ack_uuids[ac->num_acks].receive_time = GNUNET_TIME_absolute_get ();
  ac->ack_uuids[ac->num_acks].ack_uuid = *ack_uuid;
  ac->num_acks++;
  ac->task = GNUNET_SCHEDULER_add_at (ac->min_transmission_time,
                                      &transmit_cummulative_ack_cb,
                                      ac);
}
 
 
struct FindByMessageUuidContext
{
  struct MessageUUIDP message_uuid;
 
  struct ReassemblyContext *rc;
};
 
 
static int
find_by_message_uuid (void *cls, uint32_t key, void *value)
{
  struct FindByMessageUuidContext *fc = cls;
  struct ReassemblyContext *rc = value;
 
  (void) key;
  if (0 == GNUNET_memcmp (&fc->message_uuid, &rc->msg_uuid))
  {
    fc->rc = rc;
    return GNUNET_NO;
  }
  return GNUNET_YES;
}
 
 
static void
handle_fragment_box (void *cls, const struct TransportFragmentBoxMessage *fb)
{
  struct CommunicatorMessageContext *cmc = cls;
  struct VirtualLink *vl;
  struct ReassemblyContext *rc;
  const struct GNUNET_MessageHeader *msg;
  uint16_t msize;
  uint16_t fsize;
  uint16_t frag_off;
  char *target;
  struct GNUNET_TIME_Relative cdelay;
  struct FindByMessageUuidContext fc;
 
  vl = lookup_virtual_link (&cmc->im.sender);
  if ((NULL == vl) || (GNUNET_NO == vl->confirmed))
  {
    /* Entirely normal: fragments of a message that was already in flight
       keep arriving for a while after a link goes down, and a peer that has
       validated us may start sending before we have validated it.  This used
       to call #GNUNET_SERVICE_client_drop(), which disconnects the
       communicator *process* -- every queue it owns, hence every neighbour
       reachable through it, hence every CORE session.  On a peer with many
       neighbours a single ill-timed fragment therefore dropped all
       connections at once, and since the fragment comes from the network,
       any peer could cause it at will.  Drop the fragment, keep the
       communicator; see #demultiplex_with_cmc() for the same reasoning. */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "No virtual link for %s to handle fragment\n",
                GNUNET_i2s (&cmc->im.sender));
    GNUNET_STATISTICS_update (GST_stats,
                              "# fragments dropped (virtual link down)",
                              1,
                              GNUNET_NO);
    finish_cmc_handling (cmc);
    return;
  }
  if (NULL == vl->reassembly_map)
  {
    vl->reassembly_map = GNUNET_CONTAINER_multihashmap32_create (8);
    vl->reassembly_heap =
      GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
    vl->reassembly_timeout_task =
      GNUNET_SCHEDULER_add_delayed (REASSEMBLY_EXPIRATION,
                                    &reassembly_cleanup_task,
                                    vl);
  }
  msize = ntohs (fb->msg_size);
  fc.message_uuid = fb->msg_uuid;
  fc.rc = NULL;
  (void) GNUNET_CONTAINER_multihashmap32_get_multiple (vl->reassembly_map,
                                                       fb->msg_uuid.uuid,
                                                       &find_by_message_uuid,
                                                       &fc);
  fsize = ntohs (fb->header.size) - sizeof(*fb);
  if (NULL == (rc = fc.rc))
  {
    /* Bound the RAM a single sender can pin here: @e msg_size is chosen by
       the peer, not by us. */
    while (GNUNET_CONTAINER_multihashmap32_size (vl->reassembly_map) >=
           MAX_REASSEMBLY_CONTEXTS)
    {
      struct ReassemblyContext *drop;
 
      drop = GNUNET_CONTAINER_heap_peek (vl->reassembly_heap);
      GNUNET_assert (NULL != drop);
      GNUNET_STATISTICS_update (GST_stats,
                                "# Reassembly contexts dropped (limit reached)",
                                1,
                                GNUNET_NO);
      free_reassembly_context (drop);
    }
    rc = GNUNET_malloc (sizeof(*rc) + msize    /* reassembly payload buffer */
                        + (msize + 7) / 8 * sizeof(uint8_t) /* bitfield */);
    rc->msg_uuid = fb->msg_uuid;
    rc->virtual_link = vl;
    rc->msg_size = msize;
    rc->reassembly_timeout =
      GNUNET_TIME_relative_to_absolute (REASSEMBLY_EXPIRATION);
    rc->last_frag = GNUNET_TIME_absolute_get ();
    rc->hn = GNUNET_CONTAINER_heap_insert (vl->reassembly_heap,
                                           rc,
                                           rc->reassembly_timeout.abs_value_us);
    GNUNET_assert (GNUNET_OK ==
                   GNUNET_CONTAINER_multihashmap32_put (
                     vl->reassembly_map,
                     rc->msg_uuid.uuid,
                     rc,
                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
    target = (char *) &rc[1];
    rc->bitfield = (uint8_t *) (target + rc->msg_size);
    /* The bitfield loop below decrements @e msg_missing once per newly
       received byte, so this must always start at the full message size:
       initialising it to 0 for a single-fragment message made it
       underflow, and the message was then never delivered. */
    rc->msg_missing = rc->msg_size;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received fragment with size %u at offset %u/%u %u bytes missing from %s for NEW message %"
                PRIu64 "\n",
                fsize,
                ntohs (fb->frag_off),
                msize,
                rc->msg_missing,
                GNUNET_i2s (&cmc->im.sender),
                fb->msg_uuid.uuid);
  }
  else
  {
    target = (char *) &rc[1];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received fragment at offset %u/%u from %s for message %u\n",
                ntohs (fb->frag_off),
                msize,
                GNUNET_i2s (&cmc->im.sender),
                (unsigned int) fb->msg_uuid.uuid);
  }
  if (msize != rc->msg_size)
  {
    GNUNET_break (0);
    finish_cmc_handling (cmc);
    return;
  }
 
  /* reassemble */
  if (0 == fsize)
  {
    GNUNET_break (0);
    finish_cmc_handling (cmc);
    return;
  }
  frag_off = ntohs (fb->frag_off);
  if (frag_off + fsize > msize)
  {
    /* Fragment (plus fragment size) exceeds message size! */
    GNUNET_break_op (0);
    finish_cmc_handling (cmc);
    return;
  }
  memcpy (&target[frag_off], &fb[1], fsize);
  /* update bitfield and msg_missing */
  for (unsigned int i = frag_off; i < frag_off + fsize; i++)
  {
    if (0 == (rc->bitfield[i / 8] & (1 << (i % 8))))
    {
      rc->bitfield[i / 8] |= (1 << (i % 8));
      rc->msg_missing--;
    }
  }
 
  /* Compute cumulative ACK */
  cdelay = GNUNET_TIME_absolute_get_duration (rc->last_frag);
  cdelay = GNUNET_TIME_relative_multiply (cdelay, rc->msg_missing / fsize);
  if (0 == rc->msg_missing)
    cdelay = GNUNET_TIME_UNIT_ZERO;
  cummulative_ack (&cmc->im.sender,
                   &fb->ack_uuid,
                   GNUNET_TIME_relative_to_absolute (cdelay));
  rc->last_frag = GNUNET_TIME_absolute_get ();
  /* is reassembly complete? */
  if (0 != rc->msg_missing)
  {
    finish_cmc_handling (cmc);
    return;
  }
  /* reassembly is complete, verify result */
  msg = (const struct GNUNET_MessageHeader *) &rc[1];
  if (ntohs (msg->size) != rc->msg_size)
  {
    GNUNET_break (0);
    free_reassembly_context (rc);
    finish_cmc_handling (cmc);
    return;
  }
  /* successful reassembly */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Fragment reassembly complete for message %u\n",
              (unsigned int) fb->msg_uuid.uuid);
  /* FIXME: check that the resulting msg is NOT a
     DV Box or Reliability Box, as that is NOT allowed! */
  {
    uint16_t rsize = rc->msg_size;
    char rbuf[rsize] GNUNET_ALIGN;
 
    /* Copy the reassembled message out and release `rc' BEFORE
       demultiplexing: the inner message may tear down the virtual link,
       which frees every reassembly context of that link -- the old code
       then used and freed `rc' a second time afterwards. */
    memcpy (rbuf, msg, rsize);
    free_reassembly_context (rc);
    cmc->mh = (const struct GNUNET_MessageHeader *) rbuf;
    demultiplex_with_cmc (cmc);
  }
}
 
 
static int
check_reliability_box (void *cls,
                       const struct TransportReliabilityBoxMessage *rb)
{
  const struct GNUNET_MessageHeader *box =  (const struct
                                             GNUNET_MessageHeader *) &rb[1];
  (void) cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "check_send_msg with size %u: inner msg type %u and size %u (%lu %lu)\n",
              ntohs (rb->header.size),
              ntohs (box->type),
              ntohs (box->size),
              sizeof (struct TransportReliabilityBoxMessage),
              sizeof (struct GNUNET_MessageHeader));
  GNUNET_MQ_check_boxed_message (rb);
  return GNUNET_YES;
}
 
 
static void
handle_reliability_box (void *cls,
                        const struct TransportReliabilityBoxMessage *rb)
{
  struct CommunicatorMessageContext *cmc = cls;
  const struct GNUNET_MessageHeader *inbox =
    (const struct GNUNET_MessageHeader *) &rb[1];
  struct GNUNET_TIME_Relative rtt;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received reliability box from %s with UUID %s of type %u\n",
              GNUNET_i2s (&cmc->im.sender),
              GNUNET_uuid2s (&rb->ack_uuid.value),
              (unsigned int) ntohs (inbox->type));
  rtt = GNUNET_TIME_UNIT_SECONDS; /* FIXME: should base this on "RTT", but we
                                     do not really have an RTT for the
                                   * incoming* queue (should we have
                                     the sender add it to the rb message?) */
  cummulative_ack (
    &cmc->im.sender,
    &rb->ack_uuid,
    (0 == ntohl (rb->ack_countdown))
    ? GNUNET_TIME_UNIT_ZERO_ABS
    : GNUNET_TIME_relative_to_absolute (
      GNUNET_TIME_relative_divide (rtt, 8 /* FIXME: magic constant */)));
  /* continue with inner message */
  /* FIXME: check that inbox is NOT a DV Box, fragment or another
     reliability box (not allowed!) */
  cmc->mh = inbox;
  demultiplex_with_cmc (cmc);
}
 
 
static void
update_pd_age (struct PerformanceData *pd, unsigned int age)
{
  unsigned int sage;
 
  if (age == pd->last_age)
    return; /* nothing to do */
  sage = GNUNET_MAX (pd->last_age, age - 2 * GOODPUT_AGING_SLOTS);
  for (unsigned int i = sage; i <= age - GOODPUT_AGING_SLOTS; i++)
  {
    struct TransmissionHistoryEntry *the = &pd->the[i % GOODPUT_AGING_SLOTS];
 
    the->bytes_sent = 0;
    the->bytes_received = 0;
  }
  pd->last_age = age;
}
 
 
static void
update_performance_data (struct PerformanceData *pd,
                         struct GNUNET_TIME_Relative rtt,
                         uint16_t bytes_transmitted_ok)
{
  uint64_t nval = rtt.rel_value_us;
  uint64_t oval = pd->aged_rtt.rel_value_us;
  unsigned int age = get_age ();
  struct TransmissionHistoryEntry *the = &pd->the[age % GOODPUT_AGING_SLOTS];
 
  if (oval == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
    pd->aged_rtt = rtt;
  else
    pd->aged_rtt.rel_value_us = (nval + 7 * oval) / 8;
  update_pd_age (pd, age);
  the->bytes_received += bytes_transmitted_ok;
}
 
 
static void
update_queue_performance (struct Queue *q,
                          struct GNUNET_TIME_Relative rtt,
                          uint16_t bytes_transmitted_ok)
{
  update_performance_data (&q->pd, rtt, bytes_transmitted_ok);
}
 
 
static void
update_dvh_performance (struct DistanceVectorHop *dvh,
                        struct GNUNET_TIME_Relative rtt,
                        uint16_t bytes_transmitted_ok)
{
  update_performance_data (&dvh->pd, rtt, bytes_transmitted_ok);
}
 
 
static void
completed_pending_message (struct PendingMessage *pm)
{
  struct PendingMessage *pos;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Complete transmission of message %" PRIu64 " %u\n",
              pm->logging_uuid,
              pm->pmt);
  switch (pm->pmt)
  {
  case PMT_CORE:
  case PMT_RELIABILITY_BOX:
    /* Full message sent, we are done */
    client_send_response (pm);
    return;
 
  case PMT_FRAGMENT_BOX:
    /* Fragment sent over reliable channel */
    pos = pm->frag_parent;
    GNUNET_CONTAINER_MDLL_remove (frag, pos->head_frag, pos->tail_frag, pm);
    free_pending_message (pm);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "pos frag_off %lu pos bytes_msg %lu pmt %u parent %u\n",
                (unsigned long) pos->frag_off,
                (unsigned long) pos->bytes_msg,
                pos->pmt,
                NULL == pos->frag_parent ? 1 : 0);
    /* check if subtree is done */
    while ((NULL == pos->head_frag) && (pos->frag_off == (pos->bytes_msg
                                                          - sizeof(struct
                                                                   TransportFragmentBoxMessage)))
           &&
           (NULL != pos->frag_parent))
    {
      pm = pos;
      pos = pm->frag_parent;
      if ((NULL == pos) && (PMT_DV_BOX == pm->pmt))
      {
        client_send_response (pm);
        return;
      }
      else if (PMT_DV_BOX == pm->pmt)
      {
        client_send_response (pos);
        return;
      }
      GNUNET_CONTAINER_MDLL_remove (frag, pos->head_frag, pos->tail_frag, pm);
      free_pending_message (pm);
    }
 
    /* Was this the last applicable fragment?
 
       NOTE: @a pos may be a DV box here, and then it is NOT the message the
       client is waiting for -- its @e frag_parent is, and that parent's
       @e bpm points at @a pos.  Answering the client directly (and thereby
       releasing @a pos through #free_pending_message()) left @e bpm of a
       message that is still queued pointing at freed memory, which
       #transmit_on_queue() reads and may free a second time.  Hand it to
       ourselves instead: the #PMT_DV_BOX case below clears @e bpm and
       answers for the parent, and for every other @e pmt it does exactly
       what the direct call did. */
    if ((NULL == pos->head_frag) && (NULL == pos->frag_parent || PMT_DV_BOX ==
                                     pos->pmt) &&
        (pos->frag_off == pos->bytes_msg))
      completed_pending_message (pos);
    return;
 
  case PMT_DV_BOX:
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Completed transmission of message %" PRIu64 " (DV Box)\n",
                pm->logging_uuid);
    if (NULL != pm->frag_parent)
    {
      pos = pm->frag_parent;
      free_pending_message (pm);
      pos->bpm = NULL;
      client_send_response (pos);
    }
    else
      client_send_response (pm);
    return;
  }
}
 
 
static void
handle_acknowledged (struct PendingAcknowledgement *pa,
                     struct GNUNET_TIME_Relative ack_delay)
{
  struct GNUNET_TIME_Relative delay;
  struct PendingMessage *pm = pa->pm;
 
  delay = GNUNET_TIME_absolute_get_duration (pa->transmission_time);
  delay = GNUNET_TIME_relative_subtract (delay, ack_delay);
  if (NULL != pa->queue && 1 == pa->num_send)
    update_queue_performance (pa->queue, delay, pa->message_size);
  if (NULL != pa->dvh && 1 == pa->num_send)
    update_dvh_performance (pa->dvh, delay, pa->message_size);
  /* Retire @a pa BEFORE handing its message on.  completed_pending_message()
     ends in free_pending_message() for anything it finishes, and that now
     releases every acknowledgement still attached to the message -- this one
     included.  Freeing it afterwards is a double free, and it aborts on the
     GNUNET_assert() over multiuuidmap_remove() in
     free_pending_acknowledgement(), the map entry having gone with the first
     release.  Nothing below needs @a pa, only its message. */
  free_pending_acknowledgement (pa);
  if (NULL != pm)
    completed_pending_message (pm);
}
 
 
static int
check_reliability_ack (void *cls,
                       const struct TransportReliabilityAckMessage *ra)
{
  unsigned int n_acks;
 
  (void) cls;
  n_acks = (ntohs (ra->header.size) - sizeof(*ra))
           / sizeof(struct TransportCummulativeAckPayloadP);
  if (0 == n_acks)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if ((ntohs (ra->header.size) - sizeof(*ra)) !=
      n_acks * sizeof(struct TransportCummulativeAckPayloadP))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_reliability_ack (void *cls,
                        const struct TransportReliabilityAckMessage *ra)
{
  struct CommunicatorMessageContext *cmc = cls;
  const struct TransportCummulativeAckPayloadP *ack;
  unsigned int n_acks;
  uint32_t ack_counter;
 
  n_acks = (ntohs (ra->header.size) - sizeof(*ra))
           / sizeof(struct TransportCummulativeAckPayloadP);
  ack = (const struct TransportCummulativeAckPayloadP *) &ra[1];
  for (unsigned int i = 0; i < n_acks; i++)
  {
    struct PendingAcknowledgement *pa =
      GNUNET_CONTAINER_multiuuidmap_get (pending_acks, &ack[i].ack_uuid.value);
    if (NULL == pa)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                  "Received ACK from %s with UUID %s which is unknown to us!\n",
                  GNUNET_i2s (&cmc->im.sender),
                  GNUNET_uuid2s (&ack[i].ack_uuid.value));
      GNUNET_STATISTICS_update (
        GST_stats,
        "# FRAGMENT_ACKS dropped, no matching pending message",
        1,
        GNUNET_NO);
      continue;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ACK from %s with UUID %s\n",
                GNUNET_i2s (&cmc->im.sender),
                GNUNET_uuid2s (&ack[i].ack_uuid.value));
    handle_acknowledged (pa, GNUNET_TIME_relative_ntoh (ack[i].ack_delay));
  }
 
  ack_counter = ntohl (ra->ack_counter);
  (void) ack_counter;  /* silence compiler warning for now */
  // FIXME-OPTIMIZE: track ACK losses based on ack_counter somewhere!
  // (DV and/or Neighbour?)
  finish_cmc_handling (cmc);
}
 
 
static int
check_backchannel_encapsulation (
  void *cls,
  const struct TransportBackchannelEncapsulationMessage *be)
{
  uint16_t size = ntohs (be->header.size) - sizeof(*be);
  const struct GNUNET_MessageHeader *inbox =
    (const struct GNUNET_MessageHeader *) &be[1];
  const char *is;
  uint16_t isize;
 
  (void) cls;
  /* MUST bound the buffer before reading @a inbox: the size check below
     dereferences it, and a message consisting of nothing but the header
     leaves no bytes to read. */
  if (size <= sizeof(struct GNUNET_MessageHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (ntohs (inbox->size) >= size)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  isize = ntohs (inbox->size);
  is = ((const char *) inbox) + isize;
  size -= isize;
  if ('\0' != is[size - 1])
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_YES;
}
 
 
static void
handle_backchannel_encapsulation (
  void *cls,
  const struct TransportBackchannelEncapsulationMessage *be)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct CommunicatorMessageContext *cmc = cls;
  struct GNUNET_TRANSPORT_CommunicatorBackchannelIncoming *cbi;
  struct GNUNET_MQ_Envelope *env;
  struct TransportClient *tc;
  const struct GNUNET_MessageHeader *inbox =
    (const struct GNUNET_MessageHeader *) &be[1];
  uint16_t isize = ntohs (inbox->size);
  const char *target_communicator = ((const char *) inbox) + isize;
  char *sender;
  char *self;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  GNUNET_asprintf (&sender,
                   "%s",
                   GNUNET_i2s (&cmc->im.sender));
  GNUNET_asprintf (&self,
                   "%s",
                   GNUNET_i2s (my_identity));
 
  /* Find client providing this communicator */
  for (tc = clients_head; NULL != tc; tc = tc->next)
    if ((CT_COMMUNICATOR == tc->type) &&
        (NULL != tc->details.communicator.address_prefix) &&
        (0 ==
         strcmp (tc->details.communicator.address_prefix, target_communicator)))
      break;
  if (NULL == tc)
  {
    char *stastr;
 
    GNUNET_asprintf (
      &stastr,
      "# Backchannel message dropped: target communicator `%s' unknown",
      target_communicator);
    GNUNET_STATISTICS_update (GST_stats, stastr, 1, GNUNET_NO);
    GNUNET_free (stastr);
    GNUNET_free (sender);
    GNUNET_free (self);
    finish_cmc_handling (cmc);
    return;
  }
  /* Finally, deliver backchannel message to communicator */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Delivering backchannel message from %s to %s of type %u to %s\n",
              sender,
              self,
              ntohs (inbox->type),
              target_communicator);
  env = GNUNET_MQ_msg_extra (
    cbi,
    isize,
    GNUNET_MESSAGE_TYPE_TRANSPORT_COMMUNICATOR_BACKCHANNEL_INCOMING);
  cbi->pid = cmc->im.sender;
  memcpy (&cbi[1], inbox, isize);
  GNUNET_MQ_send (tc->mq, env);
  GNUNET_free (sender);
  GNUNET_free (self);
  finish_cmc_handling (cmc);
}
 
 
static void
path_cleanup_cb (void *cls)
{
  struct DistanceVector *dv = cls;
  struct DistanceVectorHop *pos;
  struct GNUNET_TIME_Absolute next;
 
  dv->timeout_task = NULL;
  /* @e dv_head is NOT sorted by @e timeout: learn_dv_path() inserts a new
     hop at the head, and moves a rediscovered one back to the head, so the
     list runs newest (i.e. latest deadline) first.  Stopping at the first
     live entry therefore inspected exactly the youngest hop and re-armed
     for *its* deadline, which is the last one of the whole set: expired
     hops behind it were never collected, and check_vl_transmission() kept
     skipping them one by one for as long as the route lived.  Sweep all of
     them and come back for the earliest survivor. */
  next = GNUNET_TIME_UNIT_FOREVER_ABS;
  pos = dv->dv_head;
  while (NULL != pos)
  {
    struct DistanceVectorHop *next_pos = pos->next_dv;
 
    GNUNET_assert (dv == pos->dv);
    if (0 == GNUNET_TIME_absolute_get_remaining (pos->timeout).rel_value_us)
      free_distance_vector_hop (pos);
    else
      next = GNUNET_TIME_absolute_min (next, pos->timeout);
    pos = next_pos;
  }
  if (NULL == dv->dv_head)
  {
    free_dv_route (dv);
    return;
  }
  dv->timeout_task =
    GNUNET_SCHEDULER_add_at (next, &path_cleanup_cb, dv);
}
 
 
static void
send_msg_from_cache (struct VirtualLink *vl)
{
 
  const struct GNUNET_PeerIdentity target = vl->target;
 
 
  if ((GNUNET_YES == is_ring_buffer_full) || (0 < ring_buffer_head))
  {
    struct RingBufferEntry *ring_buffer_copy[RING_BUFFER_SIZE];
    unsigned int tail = GNUNET_YES == is_ring_buffer_full ? ring_buffer_head :
                        0;
    unsigned int head = GNUNET_YES == is_ring_buffer_full ? RING_BUFFER_SIZE :
                        ring_buffer_head;
    struct GNUNET_TRANSPORT_IncomingMessage im;
    struct CommunicatorMessageContext *cmc;
    struct RingBufferEntry *rbe;
    struct GNUNET_MessageHeader *mh;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending from ring buffer, which has %u items\n",
                head);
 
    ring_buffer_head = 0;
    for (unsigned int i = 0; i < head; i++)
    {
      rbe = ring_buffer[(i + tail) % RING_BUFFER_SIZE];
      cmc = rbe->cmc;
      mh = rbe->mh;
 
      im = cmc->im;
      // mh = cmc->mh;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Sending message of type %u to ring buffer target %s using vl target %s index %u\n",
                  mh->type,
                  GNUNET_i2s (&im.sender),
                  GNUNET_i2s2 (&target),
                  (i + tail) % RING_BUFFER_SIZE);
      if (0 == GNUNET_memcmp (&target, &im.sender))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Finish handling message of type %u and size %u\n",
                    (unsigned int) ntohs (mh->type),
                    (unsigned int) ntohs (mh->size));
        finish_handling_raw_message (vl, mh, cmc, GNUNET_NO);
        GNUNET_free (mh);
        GNUNET_free (rbe->cmc);
        GNUNET_free (rbe);
      }
      else
      {
        ring_buffer_copy[ring_buffer_head] = rbe;
        ring_buffer_head++;
      }
    }
 
    if ((GNUNET_YES == is_ring_buffer_full) &&
        (RING_BUFFER_SIZE > ring_buffer_head))
    {
      is_ring_buffer_full = GNUNET_NO;
    }
 
    for (unsigned int i = 0; i < ring_buffer_head; i++)
    {
      ring_buffer[i] = ring_buffer_copy[i];
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "ring_buffer[i]->mh->type for i %u %u\n",
                  i,
                  ring_buffer[i]->mh->type);
    }
    /* MUST clear the consumed slots, we freed those entries above */
    for (unsigned int i = ring_buffer_head; i < RING_BUFFER_SIZE; i++)
      ring_buffer[i] = NULL;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "%u items still in ring buffer\n",
                ring_buffer_head);
    /* If we consumed nothing, compaction rewrote the buffer in place and
       left the write index one past the end.  #handle_raw_message() would
       then read ring_buffer[RING_BUFFER_SIZE] and free whatever that is.
       The buffer is still full, and compaction moved the oldest entry to
       slot 0, so that is where the next write belongs. */
    if (RING_BUFFER_SIZE == ring_buffer_head)
      ring_buffer_head = 0;
  }
 
  if ((GNUNET_YES == is_ring_buffer_dv_full) || (0 < ring_buffer_dv_head))
  {
    struct PendingMessage *ring_buffer_dv_copy[RING_BUFFER_SIZE];
    struct PendingMessage *pm;
    unsigned int tail = GNUNET_YES == is_ring_buffer_dv_full ?
                        ring_buffer_dv_head :
                        0;
    unsigned int head = GNUNET_YES == is_ring_buffer_dv_full ?
                        RING_BUFFER_SIZE :
                        ring_buffer_dv_head;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending from ring buffer dv, which has %u items\n",
                head);
 
    ring_buffer_dv_head = 0;
    for (unsigned int i = 0; i < head; i++)
    {
      pm = ring_buffer_dv[(i + tail) % RING_BUFFER_SIZE];
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Sending to ring buffer target %s using vl target %s\n",
                  GNUNET_i2s (&pm->target),
                  GNUNET_i2s2 (&target));
      if (0 == GNUNET_memcmp (&target, &pm->target))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Adding PendingMessage to vl, checking transmission.\n");
        pm->vl = vl;
        GNUNET_CONTAINER_MDLL_insert (vl,
                                      vl->pending_msg_head,
                                      vl->pending_msg_tail,
                                      pm);
 
        check_vl_transmission (vl);
      }
      else
      {
        ring_buffer_dv_copy[ring_buffer_dv_head] = pm;
        ring_buffer_dv_head++;
      }
    }
 
    if (is_ring_buffer_dv_full && (RING_BUFFER_SIZE > ring_buffer_dv_head))
    {
      is_ring_buffer_dv_full = GNUNET_NO;
    }
 
    for (unsigned int i = 0; i < ring_buffer_dv_head; i++)
      ring_buffer_dv[i] = ring_buffer_dv_copy[i];
    /* MUST clear the consumed slots: entries we handed to a VirtualLink are
       now owned by that link, and #forward_dv_box() would GNUNET_free() them
       again once the ring buffer wraps around. */
    for (unsigned int i = ring_buffer_dv_head; i < RING_BUFFER_SIZE; i++)
      ring_buffer_dv[i] = NULL;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "%u items still in ring buffer dv.\n",
                ring_buffer_dv_head);
    /* Same one-past-the-end hazard as above: #forward_dv_box() reads
       ring_buffer_dv[ring_buffer_dv_head] and GNUNET_free()s it. */
    if (RING_BUFFER_SIZE == ring_buffer_dv_head)
      ring_buffer_dv_head = 0;
  }
}
 
 
static void
activate_core_visible_dv_path (struct DistanceVectorHop *hop)
{
  struct DistanceVector *dv = hop->dv;
  struct VirtualLink *vl;
 
  vl = lookup_virtual_link (&dv->target);
  if (NULL == vl)
  {
 
    vl = GNUNET_new (struct VirtualLink);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Creating new virtual link %p to %s using DV!\n",
                vl,
                GNUNET_i2s (&dv->target));
    vl->burst_addr = NULL;
    vl->confirmed = GNUNET_YES;
    vl->message_uuid_ctr =
      GNUNET_CRYPTO_random_u64 (UINT64_MAX);
    vl->target = dv->target;
    vl->core_recv_window = RECV_WINDOW_SIZE;
    vl->available_fc_window_size = DEFAULT_WINDOW_SIZE;
    vl->incoming_fc_window_size = DEFAULT_WINDOW_SIZE;
    /* What the peer will grant us in its very first FLOW_CONTROL anyway
       (@e incoming_fc_window_size plus what we have sent, i.e. nothing).
       Starting at zero instead means a link that is up, validated and
       working carries nothing at all until an FC round trip completes --
       and if the peer cannot answer, not ever. */
    vl->outbound_fc_window_size = DEFAULT_WINDOW_SIZE;
    GNUNET_break (GNUNET_YES ==
                  GNUNET_CONTAINER_multipeermap_put (
                    links,
                    &vl->target,
                    vl,
                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
    vl->dv = dv;
    dv->vl = vl;
    vl->visibility_task =
      GNUNET_SCHEDULER_add_at (hop->path_valid_until, &check_link_down, vl);
    consider_sending_fc (vl);
    /* We lacked a confirmed connection to the target
       before, so tell CORE about it (finally!) */
    cores_send_connect_info (&dv->target);
    send_msg_from_cache (vl);
  }
  else
  {
    /* Link was already up, remember dv is also now available and we are done */
    vl->dv = dv;
    dv->vl = vl;
    if (GNUNET_NO == vl->confirmed)
    {
      vl->confirmed = GNUNET_YES;
      vl->visibility_task =
        GNUNET_SCHEDULER_add_at (hop->path_valid_until, &check_link_down, vl);
      consider_sending_fc (vl);
      /* We lacked a confirmed connection to the target
         before, so tell CORE about it (finally!) */
      cores_send_connect_info (&dv->target);
      send_msg_from_cache (vl);
    }
    else
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Virtual link to %s could now also use DV!\n",
                  GNUNET_i2s (&dv->target));
  }
}
 
 
static int
learn_dv_path (const struct GNUNET_PeerIdentity *path,
               unsigned int path_len,
               struct GNUNET_TIME_Relative network_latency,
               struct GNUNET_TIME_Absolute path_valid_until)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct DistanceVectorHop *hop;
  struct DistanceVector *dv;
  struct Neighbour *next_hop;
  unsigned int shorter_distance;
 
  if (path_len < 3)
  {
    /* what a boring path! not allowed! */
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  GNUNET_assert (0 == GNUNET_memcmp (my_identity, &path[0]));
  next_hop = lookup_neighbour (&path[1]);
  if (NULL == next_hop)
  {
    /* next hop must be a neighbour, otherwise this whole thing is useless! */
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  for (unsigned int i = 2; i < path_len; i++)
  {
    struct Neighbour *n = lookup_neighbour (&path[i]);
    struct GNUNET_TIME_Absolute q_timeout;
 
    if (NULL != n)
    {
      q_timeout = GNUNET_TIME_UNIT_ZERO_ABS;
      for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
        q_timeout = GNUNET_TIME_absolute_max (q_timeout, q->validated_until);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "remaining %lu to %s\n",
                  (unsigned long) GNUNET_TIME_absolute_get_remaining (q_timeout)
                  .rel_value_us,
                  GNUNET_i2s (&n->pid));
      if (0 != GNUNET_TIME_absolute_get_remaining (q_timeout).rel_value_us)
      {
        /* Useless path: we have a direct active connection to some hop
           in the middle of the path, so this one is not even
           terribly useful for redundancy */
        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                    "Path of %u hops useless: directly link to hop %u (%s)\n",
                    path_len,
                    i,
                    GNUNET_i2s (&path[i]));
        GNUNET_STATISTICS_update (GST_stats,
                                  "# Useless DV path ignored: hop is neighbour",
                                  1,
                                  GNUNET_NO);
        return GNUNET_SYSERR;
      }
    }
  }
  dv = GNUNET_CONTAINER_multipeermap_get (dv_routes, &path[path_len - 1]);
  if (NULL == dv)
  {
    dv = GNUNET_new (struct DistanceVector);
    dv->target = path[path_len - 1];
    dv->timeout_task = GNUNET_SCHEDULER_add_delayed (DV_PATH_VALIDITY_TIMEOUT,
                                                     &path_cleanup_cb,
                                                     dv);
    GNUNET_assert (GNUNET_OK ==
                   GNUNET_CONTAINER_multipeermap_put (
                     dv_routes,
                     &dv->target,
                     dv,
                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  }
  /* Check if we have this path already! */
  shorter_distance = 0;
  for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
       pos = pos->next_dv)
  {
    if (pos->distance < path_len - 3)
      shorter_distance++;
    /* Note that the distances in 'pos' excludes us (path[0]),
       the next_hop (path[1]) and the target so we need to subtract three
       and check next_hop explicitly */
    if ((pos->distance == path_len - 3) && (pos->next_hop == next_hop))
    {
      int match = GNUNET_YES;
 
      for (unsigned int i = 0; i < pos->distance; i++)
      {
        if (0 != GNUNET_memcmp (&pos->path[i], &path[i + 2]))
        {
          match = GNUNET_NO;
          break;
        }
      }
      if (GNUNET_YES == match)
      {
        struct GNUNET_TIME_Relative last_timeout;
 
        /* Re-discovered known path, update timeout */
        GNUNET_STATISTICS_update (GST_stats,
                                  "# Known DV path refreshed",
                                  1,
                                  GNUNET_NO);
        last_timeout = GNUNET_TIME_absolute_get_remaining (pos->timeout);
        pos->timeout =
          GNUNET_TIME_relative_to_absolute (DV_PATH_VALIDITY_TIMEOUT);
        pos->path_valid_until =
          GNUNET_TIME_absolute_max (pos->path_valid_until, path_valid_until);
        GNUNET_CONTAINER_MDLL_remove (dv, dv->dv_head, dv->dv_tail, pos);
        GNUNET_CONTAINER_MDLL_insert (dv, dv->dv_head, dv->dv_tail, pos);
        if (0 <
            GNUNET_TIME_absolute_get_remaining (path_valid_until).rel_value_us)
          activate_core_visible_dv_path (pos);
        if (last_timeout.rel_value_us <
            GNUNET_TIME_relative_subtract (DV_PATH_VALIDITY_TIMEOUT,
                                           DV_PATH_DISCOVERY_FREQUENCY)
            .rel_value_us)
        {
          /* Some peer send DV learn messages too often, we are learning
             the same path faster than it would be useful; do not forward! */
          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                      "Rediscovered path too quickly, not forwarding further\n")
          ;
          return GNUNET_NO;
        }
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Refreshed known path to %s valid until %s, forwarding further\n",
                    GNUNET_i2s (&dv->target),
                    GNUNET_STRINGS_absolute_time_to_string (
                      pos->path_valid_until));
        return GNUNET_YES;
      }
    }
  }
  /* Count how many shorter paths we have (incl. direct
     neighbours) before simply giving up on this one! */
  if (shorter_distance >= MAX_DV_PATHS_TO_TARGET)
  {
    /* We have a shorter path already! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Have many shorter DV paths %s, not forwarding further\n",
                GNUNET_i2s (&dv->target));
    return GNUNET_NO;
  }
  /* create new DV path entry */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Discovered new DV path to %s valid until %s\n",
              GNUNET_i2s (&dv->target),
              GNUNET_STRINGS_absolute_time_to_string (path_valid_until));
  hop = GNUNET_malloc (sizeof(struct DistanceVectorHop)
                       + sizeof(struct GNUNET_PeerIdentity) * (path_len - 3));
  hop->next_hop = next_hop;
  hop->dv = dv;
  hop->path = (const struct GNUNET_PeerIdentity *) &hop[1];
  memcpy (&hop[1],
          &path[2],
          sizeof(struct GNUNET_PeerIdentity) * (path_len - 3));
  hop->timeout = GNUNET_TIME_relative_to_absolute (DV_PATH_VALIDITY_TIMEOUT);
  hop->path_valid_until = path_valid_until;
  hop->distance = path_len - 3;
  hop->pd.aged_rtt = network_latency;
  GNUNET_CONTAINER_MDLL_insert (dv, dv->dv_head, dv->dv_tail, hop);
  GNUNET_CONTAINER_MDLL_insert (neighbour,
                                next_hop->dv_head,
                                next_hop->dv_tail,
                                hop);
  if (0 < GNUNET_TIME_absolute_get_remaining (path_valid_until).rel_value_us)
    activate_core_visible_dv_path (hop);
  return GNUNET_YES;
}
 
 
static int
check_dv_learn (void *cls, const struct TransportDVLearnMessage *dvl)
{
  const struct GNUNET_PeerIdentity *my_identity;
  uint16_t size = ntohs (dvl->header.size);
  uint16_t num_hops = ntohs (dvl->num_hops);
  const struct DVPathEntryP *hops = (const struct DVPathEntryP *) &dvl[1];
 
  (void) cls;
  if (size != sizeof(*dvl) + num_hops * sizeof(struct DVPathEntryP))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (num_hops > MAX_DV_HOPS_ALLOWED)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  for (unsigned int i = 0; i < num_hops; i++)
  {
    if (0 == GNUNET_memcmp (&dvl->initiator, &hops[i].hop))
    {
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
    if (0 == GNUNET_memcmp (my_identity, &hops[i].hop))
    {
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
  }
  return GNUNET_YES;
}
 
 
static void
forward_dv_learn (const struct GNUNET_PeerIdentity *next_hop,
                  const struct TransportDVLearnMessage *msg,
                  uint16_t bi_history,
                  uint16_t nhops,
                  const struct DVPathEntryP *hops,
                  struct GNUNET_TIME_Absolute in_time)
{
  struct DVPathEntryP *dhops;
  size_t fwd_size = sizeof(struct TransportDVLearnMessage)
                    + (nhops + 1) * sizeof(struct DVPathEntryP);
  /* Signing is synchronous and the routing calls below copy the message,
     so this never outlives the frame.  Keeping it on the stack matters:
     a hub forwards a DV learn to every eligible neighbour, so this is one
     of the hottest allocation sites in the service.  Size it by the hop
     limit rather than by @a nhops -- @a nhops is only asserted to be below
     that limit further down, and a VLA is sized before we get there. */
  char fwd_buf[sizeof(struct TransportDVLearnMessage)
               + (MAX_DV_HOPS_ALLOWED + 1)
               * sizeof(struct DVPathEntryP)] GNUNET_ALIGN;
  struct TransportDVLearnMessage *fwd
    = (struct TransportDVLearnMessage *) fwd_buf;
  struct GNUNET_TIME_Relative nnd;
  const struct GNUNET_PeerIdentity *my_identity;
  struct VirtualLink *vl;
  struct Neighbour *n;
 
  GNUNET_assert (nhops < MAX_DV_HOPS_ALLOWED);
  memset (fwd_buf, 0, fwd_size);
 
  /* compute message for forwarding */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Forwarding DV learn message originating from %s to %s\n",
              GNUNET_i2s (&msg->initiator),
              GNUNET_i2s2 (next_hop));
  GNUNET_assert (nhops < MAX_DV_HOPS_ALLOWED);
  fwd->header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_DV_LEARN);
  fwd->header.size = htons (sizeof(struct TransportDVLearnMessage)
                            + (nhops + 1) * sizeof(struct DVPathEntryP));
  fwd->num_hops = htons (nhops + 1);
  fwd->bidirectional = htons (bi_history);
  nnd = GNUNET_TIME_relative_add (GNUNET_TIME_absolute_get_duration (in_time),
                                  GNUNET_TIME_relative_ntoh (
                                    msg->non_network_delay));
  fwd->non_network_delay = GNUNET_TIME_relative_hton (nnd);
  fwd->init_sig = msg->init_sig;
  fwd->initiator = msg->initiator;
  fwd->challenge = msg->challenge;
  fwd->monotonic_time = msg->monotonic_time;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  dhops = (struct DVPathEntryP *) &fwd[1];
  GNUNET_memcpy (dhops, hops, sizeof(struct DVPathEntryP) * nhops);
  dhops[nhops].hop = *my_identity;
  {
    struct DvHopPS dhp = {
      .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_HOP),
      .purpose.size = htonl (sizeof(dhp)),
      .pred = (0 == nhops) ? msg->initiator : dhops[nhops - 1].hop,
      .succ = *next_hop,
      .challenge = msg->challenge
    };
 
    if (GNUNET_OK != sign_by_my_identity (&dhp.purpose,
                                          &dhops[nhops].hop_sig))
      return;   /* nobody would accept the path without our hop signature */
  }
  vl = lookup_virtual_link (next_hop);
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
  {
    route_control_message_without_fc (vl,
                                      &fwd->header,
                                      RMO_UNCONFIRMED_ALLOWED);
    return;
  }
  /* Use route via neighbour */
  n = lookup_neighbour (next_hop);
  if (NULL != n)
    route_via_neighbour (n,
                         &fwd->header,
                         RMO_UNCONFIRMED_ALLOWED);
}
 
 
static int
validate_dv_initiator_signature (
  struct GNUNET_TIME_AbsoluteNBO sender_monotonic_time,
  const struct GNUNET_PeerIdentity *init,
  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge,
  const struct GNUNET_CRYPTO_EddsaSignature *init_sig)
{
  struct DvInitPS ip = { .purpose.purpose = htonl (
                           GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_INITIATOR),
                         .purpose.size = htonl (sizeof(ip)),
                         .monotonic_time = sender_monotonic_time,
                         .challenge = *challenge };
 
  if (
    GNUNET_OK !=
    GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_INITIATOR,
                                &ip,
                                init_sig,
                                &init->public_key))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
struct NeighbourSelectionContext
{
  const struct TransportDVLearnMessage *dvl;
 
  const struct DVPathEntryP *hops;
 
  struct GNUNET_TIME_Absolute in_time;
 
  uint32_t selections[MAX_DV_DISCOVERY_SELECTION];
 
  unsigned int num_eligible;
 
  unsigned int num_selections;
 
  uint16_t nhops;
 
  uint16_t bi_history;
};
 
 
static int
dv_neighbour_selection (void *cls,
                        const struct GNUNET_PeerIdentity *pid,
                        void *value)
{
  struct NeighbourSelectionContext *nsc = cls;
 
  (void) value;
  if (0 == GNUNET_memcmp (pid, &nsc->dvl->initiator))
    return GNUNET_YES; /* skip initiator */
  for (unsigned int i = 0; i < nsc->nhops; i++)
    if (0 == GNUNET_memcmp (pid, &nsc->hops[i].hop))
      return GNUNET_YES;
  /* skip peers on path */
  nsc->num_eligible++;
  return GNUNET_YES;
}
 
 
static int
dv_neighbour_transmission (void *cls,
                           const struct GNUNET_PeerIdentity *pid,
                           void *value)
{
  struct NeighbourSelectionContext *nsc = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "transmission %s\n",
              GNUNET_i2s (pid));
  (void) value;
  if (0 == GNUNET_memcmp (pid, &nsc->dvl->initiator))
    return GNUNET_YES; /* skip initiator */
  for (unsigned int i = 0; i < nsc->nhops; i++)
    if (0 == GNUNET_memcmp (pid, &nsc->hops[i].hop))
      return GNUNET_YES;
  /* skip peers on path */
  for (unsigned int i = 0; i < nsc->num_selections; i++)
  {
    if (nsc->selections[i] == nsc->num_eligible)
    {
      forward_dv_learn (pid,
                        nsc->dvl,
                        nsc->bi_history,
                        nsc->nhops,
                        nsc->hops,
                        nsc->in_time);
      break;
    }
  }
  nsc->num_eligible++;
  return GNUNET_YES;
}
 
 
static unsigned int
calculate_fork_degree (unsigned int hops_taken,
                       unsigned int neighbour_count,
                       unsigned int eligible_count)
{
  double target_total = 50.0; /* FIXME: use LOG(NSE)? */
  double eligible_ratio =
    ((double) eligible_count) / ((double) neighbour_count);
  double boost_factor = eligible_ratio * eligible_ratio;
  unsigned int rnd;
  double left;
 
  if (hops_taken >= 64)
  {
    GNUNET_break (0);
    return 0;   /* precaution given bitshift below */
  }
  for (unsigned int i = 1; i < hops_taken; i++)
  {
    /* For each hop, subtract the expected number of targets
       reached at distance d (so what remains divided by 2^d) */
    target_total -= (target_total * boost_factor / (1LLU << i));
  }
  {
    double degree = target_total * boost_factor / (1LLU << hops_taken);
 
    rnd = (unsigned int) floor (degree);
    /* round up or down probabilistically depending on how close we were
       when floor()ing to rnd.  NOTE: this must be the fractional part of
       @e degree; using `target_total - rnd' here made the condition below
       true essentially always, so we always rounded up. */
    left = degree - (double) rnd;
  }
  if (UINT32_MAX * left >
      GNUNET_CRYPTO_random_u64 (UINT32_MAX))
    rnd++; /* round up */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Forwarding DV learn message of %u hops %u(/%u/%u) times\n",
              hops_taken,
              rnd,
              eligible_count,
              neighbour_count);
  return rnd;
}
 
 
static void
neighbour_store_dvmono_cb (void *cls, int success)
{
  struct Neighbour *n = cls;
 
  n->sc = NULL;
  if (GNUNET_YES != success)
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to store other peer's monotonic time in peerstore!\n");
}
 
 
static struct GNUNET_TIME_Relative
get_network_latency (const struct TransportDVLearnMessage *dvl)
{
  struct GNUNET_TIME_Relative host_latency_sum;
  struct GNUNET_TIME_Relative latency;
  struct GNUNET_TIME_Relative network_latency;
  uint16_t nhops = ntohs (dvl->num_hops);;
 
  /* We initiated this, learn the forward path! */
  host_latency_sum = GNUNET_TIME_relative_ntoh (dvl->non_network_delay);
 
  // Need also something to lookup initiation time
  // to compute RTT! -> add RTT argument here?
  latency = GNUNET_TIME_absolute_get_duration (GNUNET_TIME_absolute_ntoh (
                                                 dvl->monotonic_time));
  /* @e non_network_delay is fully attacker-controlled, and our clock may
     simply be behind the initiator's: never assert on this. */
  if (latency.rel_value_us < host_latency_sum.rel_value_us)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# DV learn with implausible non-network delay",
                              1,
                              GNUNET_NO);
    return GNUNET_TIME_UNIT_FOREVER_REL;
  }
  // latency = GNUNET_TIME_UNIT_FOREVER_REL;   // FIXME: initialize properly
  // (based on dvl->challenge, we can identify time of origin!)
 
  network_latency = GNUNET_TIME_relative_subtract (latency, host_latency_sum);
  /* assumption: latency on all links is the same */
  network_latency = GNUNET_TIME_relative_divide (network_latency, nhops);
 
  return network_latency;
}
 
 
static void
handle_dv_learn (void *cls, const struct TransportDVLearnMessage *dvl)
{
  struct CommunicatorMessageContext *cmc = cls;
  enum GNUNET_TRANSPORT_CommunicatorCharacteristics cc;
  int bi_hop;
  uint16_t nhops;
  uint16_t bi_history;
  const struct DVPathEntryP *hops;
  int do_fwd;
  int did_initiator;
  struct GNUNET_TIME_Absolute in_time;
  struct Neighbour *n;
  const struct GNUNET_PeerIdentity *my_identity;
 
  nhops = ntohs (dvl->num_hops);  /* 0 = sender is initiator */
  bi_history = ntohs (dvl->bidirectional);
  hops = (const struct DVPathEntryP *) &dvl[1];
  if (0 == nhops)
  {
    /* sanity check */
    if (0 != GNUNET_memcmp (&dvl->initiator, &cmc->im.sender))
    {
      GNUNET_break (0);
      finish_cmc_handling (cmc);
      return;
    }
    /* A zero-hop message we supposedly initiated ourselves would make the
       "we are the initiator" branch below read hops[0] and write past the
       end of its `path[nhops + 1]' array. */
    if (0 == GNUNET_memcmp (&dvl->initiator, GNUNET_PILS_get_identity (pils)))
    {
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
  }
  else
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "handle dv learn message last hop %s\n",
                GNUNET_i2s (&hops[nhops - 1].hop));
    /* sanity check */
    if (0 != GNUNET_memcmp (&hops[nhops - 1].hop, &cmc->im.sender))
    {
      GNUNET_break (0);
      finish_cmc_handling (cmc);
      return;
    }
  }
 
  GNUNET_assert (CT_COMMUNICATOR == cmc->tc->type);
  cc = cmc->tc->details.communicator.cc;
  bi_hop = (GNUNET_TRANSPORT_CC_RELIABLE ==
            cc); // FIXME: add bi-directional flag to cc?
  in_time = GNUNET_TIME_absolute_get ();
 
  /* continue communicator here, everything else can happen asynchronous! */
  finish_cmc_handling (cmc);
 
  n = lookup_neighbour (&dvl->initiator);
  if (NULL != n)
  {
    if ((n->dv_monotime_available == GNUNET_YES) &&
        (GNUNET_TIME_absolute_ntoh (dvl->monotonic_time).abs_value_us <
         n->last_dv_learn_monotime.abs_value_us))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "DV learn from %s discarded due to time travel",
                  GNUNET_i2s (&dvl->initiator));
      GNUNET_STATISTICS_update (GST_stats,
                                "# DV learn discarded due to time travel",
                                1,
                                GNUNET_NO);
      return;
    }
    if (GNUNET_OK != validate_dv_initiator_signature (dvl->monotonic_time,
                                                      &dvl->initiator,
                                                      &dvl->challenge,
                                                      &dvl->init_sig))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "DV learn signature from %s invalid\n",
                  GNUNET_i2s (&dvl->initiator));
      GNUNET_break_op (0);
      return;
    }
    n->last_dv_learn_monotime = GNUNET_TIME_absolute_ntoh (dvl->monotonic_time);
    if (GNUNET_YES == n->dv_monotime_available)
    {
      if (NULL != n->sc)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "store cancel\n");
        GNUNET_PEERSTORE_store_cancel (n->sc);
      }
      n->sc =
        GNUNET_PEERSTORE_store (peerstore,
                                "transport",
                                &dvl->initiator,
                                GNUNET_PEERSTORE_TRANSPORT_DVLEARN_MONOTIME,
                                &dvl->monotonic_time,
                                sizeof(dvl->monotonic_time),
                                GNUNET_TIME_UNIT_FOREVER_ABS,
                                GNUNET_PEERSTORE_STOREOPTION_REPLACE,
                                &neighbour_store_dvmono_cb,
                                n);
    }
  }
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  /* OPTIMIZE-FIXME: asynchronously (!) verify signatures!,
     If signature verification load too high, implement random drop strategy */
  for (unsigned int i = 0; i < nhops; i++)
  {
    struct DvHopPS dhp = { .purpose.purpose =
                             htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_HOP),
                           .purpose.size = htonl (sizeof(dhp)),
                           .pred = (0 == i) ? dvl->initiator : hops[i - 1].hop,
                           .succ = (nhops == i + 1) ? *my_identity
                                   : hops[i + 1].hop,
                           .challenge = dvl->challenge };
 
    if (GNUNET_OK !=
        GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_HOP,
                                    &dhp,
                                    &hops[i].hop_sig,
                                    &hops[i].hop.public_key))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "DV learn from %s signature of hop %u invalid\n",
                  GNUNET_i2s (&dvl->initiator),
                  i);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "signature of hop %s invalid\n",
                  GNUNET_i2s (&hops[i].hop));
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "pred %s\n",
                  GNUNET_i2s (&dhp.pred));
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "succ %s\n",
                  GNUNET_i2s (&dhp.succ));
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "hash %s\n",
                  GNUNET_sh2s (&dhp.challenge.value));
      GNUNET_break_op (0);
      return;
    }
  }
  if (GNUNET_EXTRA_LOGGING > 0)
  {
    char *path;
 
    path = GNUNET_strdup (GNUNET_i2s (&dvl->initiator));
    for (unsigned int i = 0; i < nhops; i++)
    {
      char *tmp;
 
      GNUNET_asprintf (&tmp,
                       "%s%s%s",
                       path,
                       (bi_history & (1 << (nhops - i))) ? "<->" : "-->",
                       GNUNET_i2s (&hops[i].hop));
      GNUNET_free (path);
      path = tmp;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received DVInit via %s%s%s\n",
                path,
                bi_hop ? "<->" : "-->",
                GNUNET_i2s (my_identity));
    GNUNET_free (path);
  }
  do_fwd = GNUNET_YES;
  if (0 == GNUNET_memcmp (my_identity, &dvl->initiator))
  {
    struct GNUNET_PeerIdentity path[nhops + 1];
    struct GNUNET_TIME_Relative network_latency;
 
    /* We initiated this, learn the forward path! */
    path[0] = *my_identity;
    path[1] = hops[0].hop;
 
    network_latency = get_network_latency (dvl);
 
    for (unsigned int i = 2; i <= nhops; i++)
    {
      struct GNUNET_TIME_Relative ilat;
 
      /* assumption: linear latency increase per hop */
      ilat = GNUNET_TIME_relative_multiply (network_latency, i);
      path[i] = hops[i - 1].hop;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Learned path with %u hops to %s with latency %s\n",
                  i,
                  GNUNET_i2s (&path[i]),
                  GNUNET_STRINGS_relative_time_to_string (ilat, GNUNET_YES));
      learn_dv_path (path,
                     i + 1,
                     ilat,
                     GNUNET_TIME_relative_to_absolute (
                       ADDRESS_VALIDATION_LIFETIME));
    }
    /* as we initiated, do not forward again (would be circular!) */
    do_fwd = GNUNET_NO;
    return;
  }
  if (bi_hop)
  {
    /* last hop was bi-directional, we could learn something here! */
    struct GNUNET_PeerIdentity path[nhops + 2];
    struct GNUNET_TIME_Relative ilat;
    struct GNUNET_TIME_Relative network_latency;
 
    path[0] = *my_identity;
    path[1] = hops[nhops - 1].hop;   /* direct neighbour == predecessor! */
    for (unsigned int i = 0; i < nhops; i++)
    {
      int iret;
 
      if (0 == (bi_history & (1 << i)))
        break;     /* i-th hop not bi-directional, stop learning! */
      if (i == nhops - 1)
      {
        path[i + 2] = dvl->initiator;
      }
      else
      {
        path[i + 2] = hops[nhops - i - 2].hop;
      }
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Learned inverse path with %u hops to %s\n",
                  i + 2,
                  GNUNET_i2s (&path[i + 2]));
      network_latency = get_network_latency (dvl);
      ilat = GNUNET_TIME_relative_multiply (network_latency, i + 2);
      iret = learn_dv_path (path,
                            i + 3,
                            ilat,
                            GNUNET_TIME_relative_to_absolute (
                              ADDRESS_VALIDATION_LIFETIME));
      if (GNUNET_SYSERR == iret)
      {
        /* path invalid or too long to be interesting for US, thus should also
           not be interesting to our neighbours, cut path when forwarding to
           'i' hops, except of course for the one that goes back to the
           initiator */
        GNUNET_STATISTICS_update (GST_stats,
                                  "# DV learn not forwarded due invalidity of path",
                                  1,
                                  GNUNET_NO);
        do_fwd = GNUNET_NO;
        break;
      }
      if ((GNUNET_NO == iret) && (nhops == i + 1))
      {
        /* we have better paths, and this is the longest target,
           so there cannot be anything interesting later */
        GNUNET_STATISTICS_update (GST_stats,
                                  "# DV learn not forwarded, got better paths",
                                  1,
                                  GNUNET_NO);
        do_fwd = GNUNET_NO;
        break;
      }
    }
  }
  if (MAX_DV_HOPS_ALLOWED == nhops)
  {
    /* At limit, we're out of here! */
    return;
  }
 
  /* Forward to initiator, if path non-trivial and possible */
  bi_history = (bi_history << 1) | (bi_hop ? 1 : 0);
  did_initiator = GNUNET_NO;
  if ((1 <= nhops) &&
      (GNUNET_YES ==
       GNUNET_CONTAINER_multipeermap_contains (neighbours, &dvl->initiator)))
  {
    /* send back to origin! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending DVL back to initiator %s\n",
                GNUNET_i2s (&dvl->initiator));
    forward_dv_learn (&dvl->initiator, dvl, bi_history, nhops, hops, in_time);
    did_initiator = GNUNET_YES;
  }
  /* We forward under two conditions: either we still learned something
     ourselves (do_fwd), or the path was darn short and thus the initiator is
     likely to still be very interested in this (and we did NOT already
     send it back to the initiator) */
  if ((do_fwd) || ((nhops < MIN_DV_PATH_LENGTH_FOR_INITIATOR) &&
                   (GNUNET_NO == did_initiator)))
  {
    /* Pick random neighbours that are not yet on the path */
    struct NeighbourSelectionContext nsc;
    unsigned int n_cnt;
    unsigned int n_eligible;
 
    n_cnt = GNUNET_CONTAINER_multipeermap_size (neighbours);
    nsc.nhops = nhops;
    nsc.dvl = dvl;
    nsc.bi_history = bi_history;
    nsc.hops = hops;
    nsc.in_time = in_time;
    nsc.num_eligible = 0;
    GNUNET_CONTAINER_multipeermap_iterate (neighbours,
                                           &dv_neighbour_selection,
                                           &nsc);
    if (0 == nsc.num_eligible)
      return;   /* done here, cannot forward to anyone else */
    n_eligible = nsc.num_eligible;
    nsc.num_selections = calculate_fork_degree (nhops, n_cnt, n_eligible);
    nsc.num_selections =
      GNUNET_MIN (MAX_DV_DISCOVERY_SELECTION, nsc.num_selections);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Forwarding DVL to %u other peers\n",
                nsc.num_selections);
    /* #dv_neighbour_transmission() counts ELIGIBLE peers only, so the
       offsets must be drawn from that range -- drawing from the total
       number of neighbours made us silently forward to fewer peers than
       #calculate_fork_degree() asked for. */
    for (unsigned int i = 0; i < nsc.num_selections; i++)
      nsc.selections[i] =
        (nsc.num_selections == n_eligible)
        ? i   /* all were selected, avoid collisions by chance */
        : GNUNET_CRYPTO_random_u32 (n_eligible);
    nsc.num_eligible = 0;
    GNUNET_CONTAINER_multipeermap_iterate (neighbours,
                                           &dv_neighbour_transmission,
                                           &nsc);
  }
}
 
 
static int
check_dv_box (void *cls, const struct TransportDVBoxMessage *dvb)
{
  uint16_t size = ntohs (dvb->header.size);
  uint16_t num_hops = ntohs (dvb->num_hops);
  uint16_t total_hops = ntohs (dvb->total_hops);
  uint16_t orig_size = ntohs (dvb->orig_size);
  const struct GNUNET_PeerIdentity *hops =
    (const struct GNUNET_PeerIdentity *) &dvb[1];
  const struct GNUNET_PeerIdentity *my_identity;
 
  (void) cls;
  if (size < sizeof(*dvb) + num_hops * sizeof(struct GNUNET_PeerIdentity)
      + sizeof(struct GNUNET_MessageHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if ((num_hops > MAX_DV_HOPS_ALLOWED) ||
      (total_hops > MAX_DV_HOPS_ALLOWED))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  /* #decaps_dv_box_cb() derives a VLA size from
     orig_size - sizeof(*dvb) - total_hops * sizeof (struct
     GNUNET_PeerIdentity); make sure that cannot underflow and that the
     remainder can plausibly hold a payload header plus a message. */
  if ((orig_size < size) ||
      (orig_size < sizeof(*dvb)
       + total_hops * sizeof(struct GNUNET_PeerIdentity)
       + sizeof(struct TransportDVBoxPayloadP)
       + sizeof(struct GNUNET_MessageHeader)))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  /* This peer must not be on the path */
  for (unsigned int i = 0; i < num_hops; i++)
    if (0 == GNUNET_memcmp (&hops[i], my_identity))
    {
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
  return GNUNET_YES;
}
 
 
static void
forward_dv_box (struct Neighbour *next_hop,
                struct TransportDVBoxMessage *hdr,
                uint16_t total_hops,
                uint16_t num_hops,
                const struct GNUNET_PeerIdentity *hops,
                const void *enc_payload,
                uint16_t enc_payload_size)
{
  struct VirtualLink *vl = next_hop->vl;
  struct PendingMessage *pm;
  size_t msg_size = sizeof(struct TransportDVBoxMessage)
                    + num_hops * sizeof(struct GNUNET_PeerIdentity)
                    + enc_payload_size;
  char *buf;
  char msg_buf[msg_size] GNUNET_ALIGN;
  struct GNUNET_PeerIdentity *dhops;
 
  hdr->num_hops = htons (num_hops);
  hdr->total_hops = htons (total_hops);
  hdr->header.size = htons (msg_size);
  memcpy (msg_buf, hdr, sizeof(*hdr));
  dhops = (struct GNUNET_PeerIdentity *) &msg_buf[sizeof(struct
                                                         TransportDVBoxMessage)]
  ;
  memcpy (dhops, hops, num_hops * sizeof(struct GNUNET_PeerIdentity));
  memcpy (&dhops[num_hops], enc_payload, enc_payload_size);
 
  if (GNUNET_YES == ntohl (hdr->without_fc))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Forwarding control message (payload size %u) in DV Box to next hop %s (%u/%u) \n",
                enc_payload_size,
                GNUNET_i2s (&next_hop->pid),
                (unsigned int) num_hops,
                (unsigned int) total_hops);
    route_via_neighbour (next_hop, (const struct
                                    GNUNET_MessageHeader *) msg_buf,
                         RMO_ANYTHING_GOES);
  }
  else
  {
    pm = GNUNET_malloc (sizeof(struct PendingMessage) + msg_size);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "2 created pm %p storing vl %p \n",
                pm,
                vl);
    pm->pmt = PMT_DV_BOX;
    pm->vl = vl;
    pm->target = next_hop->pid;
    pm->timeout = GNUNET_TIME_relative_to_absolute (DV_FORWARD_TIMEOUT);
    pm->logging_uuid = logging_uuid_gen++;
    pm->prefs = GNUNET_MQ_PRIO_BACKGROUND;
    pm->bytes_msg = msg_size;
    buf = (char *) &pm[1];
    memcpy (buf, msg_buf, msg_size);
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Created pending message %" PRIu64
                " for DV Box with next hop %s (%u/%u)\n",
                pm->logging_uuid,
                GNUNET_i2s (&next_hop->pid),
                (unsigned int) num_hops,
                (unsigned int) total_hops);
 
    if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
    {
      GNUNET_CONTAINER_MDLL_insert (vl,
                                    vl->pending_msg_head,
                                    vl->pending_msg_tail,
                                    pm);
 
      check_vl_transmission (vl);
    }
    else
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "The virtual link is not ready for forwarding a DV Box with payload, storing PendingMessage in ring buffer.\n");
 
      if (NULL != ring_buffer_dv[ring_buffer_dv_head])
      {
        struct PendingMessage *pm_old = ring_buffer_dv[ring_buffer_dv_head];
 
        GNUNET_free (pm_old);
      }
      ring_buffer_dv[ring_buffer_dv_head] = pm;
      if (RING_BUFFER_SIZE - 1 == ring_buffer_dv_head)
      {
        ring_buffer_dv_head = 0;
        is_ring_buffer_dv_full = GNUNET_YES;
      }
      else
        ring_buffer_dv_head++;
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "%u items stored in DV ring buffer\n",
                  GNUNET_YES == is_ring_buffer_dv_full ? RING_BUFFER_SIZE :
                  ring_buffer_dv_head);
    }
  }
}
 
 
static void
free_backtalker (struct Backtalker *b)
{
  if (NULL != b->get)
  {
    GNUNET_PEERSTORE_iteration_stop (b->get);
    b->get = NULL;
    GNUNET_assert (NULL != b->cmc);
    finish_cmc_handling (b->cmc);
    b->cmc = NULL;
  }
  if (NULL != b->task)
  {
    GNUNET_SCHEDULER_cancel (b->task);
    b->task = NULL;
  }
  if (NULL != b->sc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "store cancel\n");
    GNUNET_PEERSTORE_store_cancel (b->sc);
    b->sc = NULL;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Removing backtalker for %s\n",
              GNUNET_i2s (&b->pid));
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multipeermap_remove (backtalkers, &b->pid, b));
  GNUNET_free (b);
}
 
 
static int
free_backtalker_cb (void *cls,
                    const struct GNUNET_PeerIdentity *pid,
                    void *value)
{
  struct Backtalker *b = value;
 
  (void) cls;
  (void) pid;
  free_backtalker (b);
  return GNUNET_OK;
}
 
 
static void
backtalker_timeout_cb (void *cls)
{
  struct Backtalker *b = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "backtalker timeout.\n");
  b->task = NULL;
  if (0 != GNUNET_TIME_absolute_get_remaining (b->timeout).rel_value_us)
  {
    b->task = GNUNET_SCHEDULER_add_at (b->timeout, &backtalker_timeout_cb, b);
    return;
  }
  /* A monotime store may well still be in flight -- @e timeout is about how
     long the *peer* has been quiet, and says nothing about PEERSTORE.  This
     used to `GNUNET_assert (NULL == b->sc)', which aborted the service in
     exactly that case.  #free_backtalker() cancels the store. */
  free_backtalker (b);
}
 
 
static void
backtalker_monotime_cb (void *cls,
                        const struct GNUNET_PEERSTORE_Record *record,
                        const char *emsg)
{
  struct Backtalker *b = cls;
  struct GNUNET_TIME_AbsoluteNBO *mtbe;
  struct GNUNET_TIME_Absolute mt;
 
  (void) emsg;
  if (NULL == record)
  {
    struct CommunicatorMessageContext *cmc;
 
    /* we're done with #backtalker_monotime_cb() invocations,
       continue normal processing */
    b->get = NULL;
    GNUNET_assert (NULL != b->cmc);
    /* Take @e cmc out of @a b *before* dispatching: the dispatch runs
       arbitrary message handling, and writing `b->cmc = NULL' afterwards
       is a write to freed memory should anything on that path have
       released @a b.  #free_backtalker() keys its "must finish the parked
       cmc" decision off @e get, which is already NULL here, so clearing
       @e cmc early cannot lose the message either. */
    cmc = b->cmc;
    b->cmc = NULL;
    cmc->mh = (const struct GNUNET_MessageHeader *) &b[1];
    if (0 != b->body_size)
      demultiplex_with_cmc (cmc);
    else
      finish_cmc_handling (cmc);
    return;
  }
  if (sizeof(*mtbe) != record->value_size)
  {
    GNUNET_PEERSTORE_iteration_next (b->get, 1);
    GNUNET_break (0);
    return;
  }
  mtbe = record->value;
  mt = GNUNET_TIME_absolute_ntoh (*mtbe);
  if (mt.abs_value_us > b->monotonic_time.abs_value_us)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Backtalker message from %s dropped, monotime in the past\n",
                GNUNET_i2s (&b->pid));
    GNUNET_STATISTICS_update (
      GST_stats,
      "# Backchannel messages dropped: monotonic time not increasing",
      1,
      GNUNET_NO);
    b->monotonic_time = mt;
    /* Setting body_size to 0 prevents call to #forward_backchannel_payload()
     */
    b->body_size = 0;
  }
  GNUNET_PEERSTORE_iteration_next (b->get, 1);
}
 
 
static void
backtalker_monotime_store_cb (void *cls, int success)
{
  struct Backtalker *b = cls;
 
  if (GNUNET_OK != success)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to store backtalker's monotonic time in PEERSTORE!\n");
  }
  b->sc = NULL;
  /* @e task is armed for the whole life of @a b -- #backtalker_timeout_cb()
     re-arms itself whenever @e timeout has moved forward -- so there is
     nothing to do here beyond releasing the store.  It used to cancel and
     re-add the task, which is what made the task's existence depend on this
     callback ever running. */
  GNUNET_assert (NULL != b->task);
}
 
 
static void
update_backtalker_monotime (struct Backtalker *b)
{
  struct GNUNET_TIME_AbsoluteNBO mtbe;
 
  /* At most one store may be outstanding.  The value we are about to write
     supersedes whatever the previous one carried, and leaving the old
     context alive means its completion clears @e sc while the newer store
     is still in flight -- after which the next update sees a NULL @e sc and
     starts a third one.  Cancelling is also what keeps @e sc from being
     silently overwritten and leaked.
 
     Note what this must NOT do: touch @e task.  That task is the only thing
     that ever releases a `struct CommunicatorMessageContext' parked in
     @e cmc, and cancelling it here left its re-arming up to
     #backtalker_monotime_store_cb() -- i.e. up to PEERSTORE answering.  A
     lost store completion then stalled the parked communicator client for
     the life of the process.  #backtalker_timeout_cb() already re-arms
     itself against the current @e timeout, so the task needs no help. */
  if (NULL != b->sc)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Superseding in-flight backtalker monotime store %p\n",
                b->sc);
    GNUNET_PEERSTORE_store_cancel (b->sc);
    b->sc = NULL;
  }
  mtbe = GNUNET_TIME_absolute_hton (b->monotonic_time);
  b->sc =
    GNUNET_PEERSTORE_store (peerstore,
                            "transport",
                            &b->pid,
                            GNUNET_PEERSTORE_TRANSPORT_BACKCHANNEL_MONOTIME,
                            &mtbe,
                            sizeof(mtbe),
                            GNUNET_TIME_UNIT_FOREVER_ABS,
                            GNUNET_PEERSTORE_STOREOPTION_REPLACE,
                            &backtalker_monotime_store_cb,
                            b);
}
 
 
static void
decaps_dv_box_cont (struct CommunicatorMessageContext *cmc,
                    const struct TransportDVBoxMessage *dvb,
                    const struct GNUNET_ShortHashCode *km)
{
  const unsigned char *hdr;
  size_t hdr_len;
  struct GNUNET_CRYPTO_AeadSecretKey *key;
 
  key = (struct GNUNET_CRYPTO_AeadSecretKey*) km;
  /* We are the ultimate target, so #handle_dv_box() has established that no
     hop entries are left: the ciphertext directly follows the header, and
     its length is what we actually received.  Deriving it from orig_size
     and total_hops instead would only be equivalent if every forwarder
     accounted its skipped hops exactly. */
  hdr = (const unsigned char *) &dvb[1];
  {
    uint16_t size = ntohs (dvb->header.size);
 
    if (size < sizeof(*dvb)
        + sizeof(struct TransportDVBoxPayloadP)
        + sizeof(struct GNUNET_MessageHeader))
    {
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
    hdr_len = size - sizeof(*dvb);
  }
 
  /* begin actual decryption */
  {
    struct Backtalker *b;
    struct GNUNET_TIME_Absolute monotime;
    struct TransportDVBoxPayloadP *ppay;
    unsigned char pt[hdr_len + sizeof *ppay] GNUNET_ALIGN;
    unsigned char *body;
    const struct GNUNET_MessageHeader *mh;
 
    ppay = (struct TransportDVBoxPayloadP *) pt;
    body = &pt[sizeof *ppay];
    GNUNET_assert (hdr_len >=
                   sizeof(*ppay) + sizeof(struct GNUNET_MessageHeader));
    if (GNUNET_OK != GNUNET_CRYPTO_aead_decrypt (hdr_len,
                                                 hdr,
                                                 0,
                                                 NULL,
                                                 key,
                                                 &dvb->iv,
                                                 &dvb->mac,
                                                 pt))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                  "Error decrypting DV payload header\n");
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
    mh = (const struct GNUNET_MessageHeader *) body;
    /* NOTE: this used to compare against `sizeof (body)', i.e. the size of
       a pointer, which meant only 8-byte payloads were ever accepted. */
    if (ntohs (mh->size) != hdr_len - sizeof(*ppay))
    {
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
    /* need to prevent box-in-a-box (and DV_LEARN) so check inbox type! */
    switch (ntohs (mh->type))
    {
    case GNUNET_MESSAGE_TYPE_TRANSPORT_DV_BOX:
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
 
    case GNUNET_MESSAGE_TYPE_TRANSPORT_DV_LEARN:
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
 
    default:
      /* permitted, continue */
      break;
    }
    monotime = GNUNET_TIME_absolute_ntoh (ppay->monotonic_time);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Decrypted backtalk from %s\n",
                GNUNET_i2s (&ppay->sender));
    b = GNUNET_CONTAINER_multipeermap_get (backtalkers,
                                           &ppay->sender);
    if ((NULL != b) && (monotime.abs_value_us < b->monotonic_time.abs_value_us))
    {
      GNUNET_STATISTICS_update (
        GST_stats,
        "# Backchannel messages dropped: monotonic time not increasing",
        1,
        GNUNET_NO);
      finish_cmc_handling (cmc);
      return;
    }
    if ((NULL == b) ||
        (0 != GNUNET_memcmp (&b->last_ephemeral, &dvb->ephemeral_key)))
    {
      /* Check signature */
      const struct GNUNET_PeerIdentity *my_identity;
      struct EphemeralConfirmationPS ec;
 
      my_identity = GNUNET_PILS_get_identity (pils);
      GNUNET_assert (my_identity);
 
      ec.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL);
      ec.target = *my_identity;
      ec.ephemeral_key = dvb->ephemeral_key;
      ec.purpose.size =  htonl (sizeof(ec));
      ec.sender_monotonic_time = ppay->monotonic_time;
      if (
        GNUNET_OK !=
        GNUNET_CRYPTO_eddsa_verify (
          GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL,
          &ec,
          &ppay->sender_sig,
          &ppay->sender.public_key))
      {
        /* Signature invalid, discard! */
        GNUNET_break_op (0);
        finish_cmc_handling (cmc);
        return;
      }
    }
    /* Update sender, we now know the real origin! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "DVBox received for me from %s via %s\n",
                GNUNET_i2s2 (&ppay->sender),
                GNUNET_i2s (&cmc->im.sender));
    cmc->im.sender = ppay->sender;
 
    if (NULL != b)
    {
      /* update key cache and mono time */
      b->last_ephemeral = dvb->ephemeral_key;
      b->monotonic_time = monotime;
      update_backtalker_monotime (b);
      b->timeout =
        GNUNET_TIME_relative_to_absolute (BACKCHANNEL_INACTIVITY_TIMEOUT);
      cmc->mh = mh;
      demultiplex_with_cmc (cmc);
      return;
    }
    /* setup data structure to cache signature AND check
       monotonic time with PEERSTORE before forwarding backchannel payload */
    b = GNUNET_malloc (sizeof(struct Backtalker) + (hdr_len - sizeof(*ppay)));
    b->pid = ppay->sender;
    b->body_size = hdr_len - sizeof(*ppay);
    memcpy (&b[1], body, hdr_len - sizeof(*ppay));
    GNUNET_assert (GNUNET_YES ==
                   GNUNET_CONTAINER_multipeermap_put (
                     backtalkers,
                     &b->pid,
                     b,
                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
    b->monotonic_time = monotime; /* NOTE: to be checked still! */
    b->cmc = cmc;
    b->timeout =
      GNUNET_TIME_relative_to_absolute (BACKCHANNEL_INACTIVITY_TIMEOUT);
    b->task = GNUNET_SCHEDULER_add_at (b->timeout, &backtalker_timeout_cb, b);
    b->get =
      GNUNET_PEERSTORE_iteration_start (peerstore,
                                        "transport",
                                        &b->pid,
                                        GNUNET_PEERSTORE_TRANSPORT_BACKCHANNEL_MONOTIME,
                                        &backtalker_monotime_cb,
                                        b);
  } /* end actual decryption */
}
 
 
static void
handle_dv_box (void *cls, const struct TransportDVBoxMessage *dvb)
{
  struct CommunicatorMessageContext *cmc = cls;
  uint16_t size = ntohs (dvb->header.size) - sizeof(*dvb);
  uint16_t num_hops = ntohs (dvb->num_hops);
  const struct GNUNET_PeerIdentity *hops =
    (const struct GNUNET_PeerIdentity *) &dvb[1];
  const char *enc_payload = (const char *) &hops[num_hops];
  uint16_t enc_payload_size =
    size - (num_hops * sizeof(struct GNUNET_PeerIdentity));
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  if (GNUNET_EXTRA_LOGGING > 0)
  {
    char *path;
 
    path = GNUNET_strdup (GNUNET_i2s (my_identity));
    for (unsigned int i = 0; i < num_hops; i++)
    {
      char *tmp;
 
      GNUNET_asprintf (&tmp, "%s->%s", path, GNUNET_i2s (&hops[i]));
      GNUNET_free (path);
      path = tmp;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received DVBox with remaining path %s\n",
                path);
    GNUNET_free (path);
  }
 
  if (num_hops > 0)
  {
    /* We're trying from the end of the hops array, as we may be
       able to find a shortcut unknown to the origin that way */
    for (int i = num_hops - 1; i >= 0; i--)
    {
      struct Neighbour *n;
 
      if (0 == GNUNET_memcmp (&hops[i], my_identity))
      {
        GNUNET_break_op (0);
        finish_cmc_handling (cmc);
        return;
      }
      n = lookup_neighbour (&hops[i]);
      if (NULL == n)
        continue;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Skipping %u/%u hops ahead while routing DV Box\n",
                  i,
                  num_hops);
 
      forward_dv_box (n,
                      (struct TransportDVBoxMessage *) dvb,
                      /* we strip i+1 entries, and the receiver reconstructs
                         the ciphertext offset from total_hops */
                      ntohs (dvb->total_hops) + i + 1,
                      num_hops - i - 1,    /* number of hops left */
                      &hops[i + 1],    /* remaining hops */
                      enc_payload,
                      enc_payload_size);
      GNUNET_STATISTICS_update (GST_stats,
                                "# DV hops skipped routing boxes",
                                i,
                                GNUNET_NO);
      GNUNET_STATISTICS_update (GST_stats,
                                "# DV boxes routed (total)",
                                1,
                                GNUNET_NO);
      finish_cmc_handling (cmc);
      return;
    }
    /* Woopsie, next hop not in neighbours, drop! */
    GNUNET_STATISTICS_update (GST_stats,
                              "# DV Boxes dropped: next hop unknown",
                              1,
                              GNUNET_NO);
    finish_cmc_handling (cmc);
    return;
  }
  /* We are the target. Unbox and handle message. */
  GNUNET_STATISTICS_update (GST_stats,
                            "# DV boxes opened (ultimate target)",
                            1,
                            GNUNET_NO);
  cmc->total_hops = ntohs (dvb->total_hops);
 
  {
    // DH key derivation with received DV, could be garbage.
    const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
    struct GNUNET_ShortHashCode km;
 
    my_private_key = GNUNET_PILS_get_private_key (pils);
    if ( (NULL == my_private_key) ||
         (GNUNET_OK !=
          GNUNET_CRYPTO_eddsa_kem_decaps (my_private_key,
                                          &dvb->ephemeral_key,
                                          &km)) )
    {
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
    decaps_dv_box_cont (cmc,
                        dvb,
                        &km);
  }
}
 
 
static int
check_incoming_msg (void *cls,
                    const struct GNUNET_TRANSPORT_IncomingMessage *im)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  GNUNET_MQ_check_boxed_message (im);
  return GNUNET_OK;
}
 
 
struct CheckKnownAddressContext
{
  const char *address;
 
  struct ValidationState *vs;
};
 
 
static int
check_known_address (void *cls,
                     const struct GNUNET_PeerIdentity *pid,
                     void *value)
{
  struct CheckKnownAddressContext *ckac = cls;
  struct ValidationState *vs = value;
 
  (void) pid;
  if (0 != strcmp (vs->address, ckac->address))
    return GNUNET_OK;
  ckac->vs = vs;
  return GNUNET_NO;
}
 
 
static void
validation_start_cb (void *cls);
 
 
static void
update_next_challenge_time (struct ValidationState *vs,
                            struct GNUNET_TIME_Absolute new_time)
{
  struct GNUNET_TIME_Relative delta;
  struct ValidationState *next;
 
  /* NOTE: "be lazy" must not apply while #validation_task is unset.  Our
     only caller that can leave it unset is #validation_start_cb(), which
     NULLs it on entry and relies on us to arm it again -- and nothing else
     ever does.  Returning early there stops address (re)validation and the
     #suggest_to_connect() retries that go with it for *every* peer, for
     good. */
  if ((new_time.abs_value_us == vs->next_challenge.abs_value_us) &&
      (NULL != validation_task) &&
      (NULL != vs->hn))
    return; /* be lazy */
  vs->next_challenge = new_time;
  if (NULL == vs->hn)
    vs->hn =
      GNUNET_CONTAINER_heap_insert (validation_heap, vs, new_time.abs_value_us);
  else
    GNUNET_CONTAINER_heap_update_cost (vs->hn, new_time.abs_value_us);
  if ((vs != GNUNET_CONTAINER_heap_peek (validation_heap)) &&
      (NULL != validation_task))
    return;
  if (NULL != validation_task)
    GNUNET_SCHEDULER_cancel (validation_task);
  /* Arm for the earliest entry in the heap, which need NOT be @a vs:
     #validation_start_cb() calls us with @e validation_task unset and with
     @a vs already pushed out to its new @e challenge_backoff, which doubles
     up to #MAX_VALIDATION_CHALLENGE_FREQ (one day) while an address stays
     unanswered.  Arming for @a vs there parks the single global validation
     task for that long, no matter how many other addresses are due right
     now -- and every address of a peer we cannot reach (NAT) is such an
     address.  Everything that needs a validation then stops with it:
     bringing a lost link back up, and confirming the link to a peer that
     contacted us. */
  next = GNUNET_CONTAINER_heap_peek (validation_heap);
  if (NULL == next)
    return;
  /* randomize a bit */
  delta.rel_value_us =
    GNUNET_CRYPTO_random_u64 (MIN_DELAY_ADDRESS_VALIDATION.rel_value_us);
  validation_task =
    GNUNET_SCHEDULER_add_at (GNUNET_TIME_absolute_add (next->next_challenge,
                                                       delta),
                             &validation_start_cb,
                             NULL);
}
 
 
static enum GNUNET_GenericReturnValue
revalidate_now_cb (void *cls,
                   const struct GNUNET_PeerIdentity *pid,
                   void *value)
{
  struct ValidationState *vs = value;
  const struct GNUNET_TIME_Absolute now =
    GNUNET_TIME_absolute_get_monotonic (GST_cfg);
 
  (void) cls;
  (void) pid;
  /* What #start_address_validation() does for an address it hears about
     again, but without needing the address string. */
  vs->challenge_backoff =
    GNUNET_TIME_relative_min (FAST_VALIDATION_CHALLENGE_FREQ,
                              GNUNET_TIME_relative_divide (
                                vs->challenge_backoff,
                                2));
  if (GNUNET_TIME_absolute_cmp (vs->first_challenge_use, >, now))
    vs->first_challenge_use = now;
  update_next_challenge_time (vs,
                              GNUNET_TIME_relative_to_absolute (
                                vs->challenge_backoff));
  return GNUNET_OK;
}
 
 
static void
start_address_validation (const struct GNUNET_PeerIdentity *pid,
                          const char *address)
{
  struct GNUNET_TIME_Absolute now;
  struct ValidationState *vs;
  struct CheckKnownAddressContext ckac = { .address = address, .vs = NULL };
 
  (void) GNUNET_CONTAINER_multipeermap_get_multiple (validation_map,
                                                     pid,
                                                     &check_known_address,
                                                     &ckac);
  now = GNUNET_TIME_absolute_get_monotonic (GST_cfg);
  if (NULL != (vs = ckac.vs))
  {
    const struct VirtualLink *vl = lookup_virtual_link (pid);
 
    /* Speed up retrying the validation if 'vs' is not currently valid, or if
     * we have no confirmed virtual link to @a pid.  In the latter case the
     * address may still be well inside its validity window -- but the link is
     * down, and #handle_validation_response() is the only thing that can
     * rebuild it and tell CORE about the peer again.  Without this we would
     * wait for @e revalidation_task, which does not fire until
     * #ADDRESS_VALIDATION_LIFETIME is nearly over. */
    if ((vs->validated_until.abs_value_us < vs->next_challenge.abs_value_us) ||
        (NULL == vl) ||
        (GNUNET_NO == vl->confirmed))
    {
      /* reduce backoff as we got a fresh advertisement */
      vs->challenge_backoff =
        GNUNET_TIME_relative_min (FAST_VALIDATION_CHALLENGE_FREQ,
                                  GNUNET_TIME_relative_divide (
                                    vs->challenge_backoff,
                                    2));
      /* A successful validation parks @e first_challenge_use just before
         @e validated_until, so that the *next* challenge is not used before
         the current validation is about to expire.  #validation_start_cb()
         refuses to run while that time is still in the future, so pulling
         @e next_challenge in without this would only make it reschedule
         itself four hours out.  The challenge has not been used yet, so
         moving the start of its window to now stays truthful -- it is what
         the fresh-@a vs path below does as well. */
      if (GNUNET_TIME_absolute_cmp (vs->first_challenge_use, >, now))
        vs->first_challenge_use = now;
      update_next_challenge_time (vs,
                                  GNUNET_TIME_relative_to_absolute (
                                    vs->challenge_backoff));
    }
    return;
  }
  vs = GNUNET_new (struct ValidationState);
  vs->pid = *pid;
  vs->valid_until =
    GNUNET_TIME_relative_to_absolute (ADDRESS_VALIDATION_LIFETIME);
  vs->first_challenge_use = now;
  vs->validation_rtt = GNUNET_TIME_UNIT_FOREVER_REL;
  GNUNET_CRYPTO_random_block (&vs->challenge,
                              sizeof(vs->challenge));
  vs->address = GNUNET_strdup (address);
  {
    /* The peer identity MUST be part of @e hc: two peers behind the same NAT
       advertise the very same address string (`PROTO-IP:0'), and with an
       address-only key the second one's #revalidation_map entry would be
       rejected as a duplicate of the first one's. */
    struct GNUNET_HashContext *hsh;
 
    hsh = GNUNET_CRYPTO_hash_context_start ();
    GNUNET_CRYPTO_hash_context_read (hsh, vs->address, strlen (vs->address));
    GNUNET_CRYPTO_hash_context_read (hsh, &vs->pid, sizeof(vs->pid));
    GNUNET_CRYPTO_hash_context_finish (hsh, &vs->hc);
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Starting address validation `%s' of peer %s using challenge %s\n",
              address,
              GNUNET_i2s (pid),
              GNUNET_sh2s (&vs->challenge.value));
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multipeermap_put (
                   validation_map,
                   &vs->pid,
                   vs,
                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
  update_next_challenge_time (vs, now);
}
 
 
static struct Queue *
find_queue (const struct GNUNET_PeerIdentity *pid, const char *address);
 
 
static void
suggest_to_connect (const struct GNUNET_PeerIdentity *pid, const char *address);
 
 
static void
hello_for_incoming_cb (void *cls,
                       const struct GNUNET_PeerIdentity *pid,
                       const char *uri)
{
  struct Queue *q;
  int pfx_len;
  const char *eou;
  char *address;
  (void) cls;
 
  eou = strstr (uri,
                "://");
  if ((NULL == eou) || (eou == uri))
  {
    /* @a uri comes from a HELLO some remote peer published. */
    GNUNET_break_op (0);
    return;
  }
  pfx_len = eou - uri;
  eou += 3;
  GNUNET_asprintf (&address,
                   "%.*s-%s",
                   pfx_len,
                   uri,
                   eou);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "helo for client %s\n",
              address);
  q = find_queue (pid, address);
  if (NULL == q)
  {
    suggest_to_connect (pid, address);
  }
  else
    start_address_validation (pid, address);
  GNUNET_free (address);
}
 
 
static const struct GNUNET_MessageHeader *
hello_from_record (const struct GNUNET_PEERSTORE_Record *record)
{
  const struct GNUNET_MessageHeader *hello;
 
  if ((NULL == record) ||
      (NULL == record->value) ||
      (record->value_size < sizeof(*hello)))
  {
    GNUNET_break_op (0);
    return NULL;
  }
  hello = record->value;
  if (ntohs (hello->size) > record->value_size)
  {
    GNUNET_break_op (0);
    return NULL;
  }
  return hello;
}
 
 
static void
handle_hello_for_incoming (void *cls,
                           const struct GNUNET_PEERSTORE_Record *record,
                           const char *emsg)
{
  struct IncomingRequest *ir = cls;
  struct GNUNET_HELLO_Parser *parser;
  const struct GNUNET_MessageHeader *hello;
  const struct GNUNET_PeerIdentity *my_identity;
 
  if (NULL != emsg)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Got failure from PEERSTORE: %s\n",
                emsg);
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  if (NULL == record)
  {
    GNUNET_break (0);
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  hello = hello_from_record (record);
  if (NULL == hello)
  {
    /* MUST still ask for the next record: a bad one is not a reason to
       stall this monitor forever. */
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  my_identity = GNUNET_PILS_get_identity (pils);
  if (NULL == my_identity)
  {
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  if (0 == GNUNET_memcmp (&record->peer, my_identity))
  {
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  if (0 != GNUNET_memcmp (&record->peer, &ir->pid))
  {
    /* Not the peer this request is about. */
    GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
    return;
  }
  parser = GNUNET_HELLO_parser_from_msg (hello, &record->peer);
  if (NULL != parser)
  {
    GNUNET_HELLO_parser_iterate (parser,
                                 hello_for_incoming_cb,
                                 NULL);
    GNUNET_HELLO_parser_free (parser);
  }
  /* MUST ask for the next record, or this monitor stalls after one HELLO */
  GNUNET_PEERSTORE_monitor_next (ir->nc, 1);
}
 
 
static void
hello_for_incoming_error_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Error in PEERSTORE monitoring\n");
}
 
 
static void
hello_for_incoming_sync_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Done with initial PEERSTORE iteration during monitoring\n");
}
 
 
static void
try_to_bring_link_up (const struct GNUNET_PeerIdentity *pid)
{
  struct Neighbour *n;
  struct IncomingRequest *ir;
 
  if (GNUNET_YES == in_shutdown)
    return;
  /* (1) Addresses we already track.  These outlive the queues, which is the
     point: once a link is down the queue that carried it is usually gone,
     so there is no address string left for #start_address_validation(). */
  (void) GNUNET_CONTAINER_multipeermap_get_multiple (validation_map,
                                                     pid,
                                                     &revalidate_now_cb,
                                                     NULL);
  /* (2) Queues we still have; may cover an address with no validation state
     yet.  After (1), because it may insert into #validation_map. */
  n = lookup_neighbour (pid);
  if (NULL != n)
    for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
      start_address_validation (pid, q->address);
  /* (3) Failing that, look for an address in PEERSTORE. */
  for (ir = ir_head; NULL != ir; ir = ir->next)
  {
    if (0 == GNUNET_memcmp (&ir->pid, pid))
      return;   /* we are already trying */
  }
  ir = GNUNET_new (struct IncomingRequest);
  ir->pid = *pid;
  GNUNET_CONTAINER_DLL_insert (ir_head, ir_tail, ir);
  /* Monitor only @a pid: with NULL every request sees every HELLO in
     PEERSTORE, so each of the up to #MAX_INCOMING_REQUEST requests started
     a connection attempt and an address validation for peers it was not
     created for. */
  ir->nc = GNUNET_PEERSTORE_monitor_start (GST_cfg,
                                           GNUNET_YES,
                                           "peerstore",
                                           &ir->pid,
                                           GNUNET_PEERSTORE_HELLO_KEY,
                                           &hello_for_incoming_error_cb,
                                           NULL,
                                           &hello_for_incoming_sync_cb,
                                           NULL,
                                           &handle_hello_for_incoming,
                                           ir);
  ir_total++;
  /* Bound attempts we do in parallel here, might otherwise get excessive.
     Drop the OLDEST request: #ir_head is the one we just inserted, so
     freeing that would immediately undo the work above. */
  while (ir_total > MAX_INCOMING_REQUEST)
    free_incoming_request (ir_tail);
}
 
 
static void
send_t_validation_response (struct CommunicatorMessageContext *cmc,
                            struct TransportValidationResponseMessage tvr)
{
  struct VirtualLink *vl;
  struct Neighbour *n;
  struct GNUNET_PeerIdentity sender;
 
  sender = cmc->im.sender;
  vl = lookup_virtual_link (&sender);
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
  {
    // route_control_message_without_fc (&cmc->im.sender,
    route_control_message_without_fc (vl,
                                      &tvr.header,
                                      RMO_ANYTHING_GOES | RMO_REDUNDANT);
  }
  else
  {
    /* Use route via neighbour */
    n = lookup_neighbour (&sender);
    if (NULL != n)
      route_via_neighbour (n, &tvr.header,
                           RMO_ANYTHING_GOES | RMO_REDUNDANT
                           | RMO_UNCONFIRMED_ALLOWED);
  }
 
  finish_cmc_handling (cmc);
  /* An *unconfirmed* link is not a link -- it carries nothing, and CORE has
     never been told about the peer.  Bailing out on one merely because it
     exists is what deadlocks a pair of peers into permanent one-way state:
     the challenger validated us, so it believes the connection is up and
     starts sending us FLOW_CONTROL; #handle_flow_control() answers an
     unknown sender by allocating exactly such an unconfirmed link; and from
     then on every challenge it retransmits lands here, gets a response --
     which keeps *its* side confirmed and its RTT healthy -- and returns
     without ever validating an address of its own.  The unconfirmed link
     reaps itself after #UNCONFIRMED_LINK_TIMEOUT, but the next FLOW_CONTROL
     recreates it, and the peer keeps sending those precisely because it
     thinks it is connected.  Nothing ever breaks the tie, so CORE on this
     side never hears about the peer and never answers its handshake.
     Only a confirmed link means there is nothing left to do. */
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
    return;
 
  /* For us, the link is still down, but we need bi-directional
     connections (for flow-control and for this to be useful for
     CORE), so we must try to bring the link up! */
  try_to_bring_link_up (&sender);
}
 
 
static void
handle_validation_challenge (
  void *cls,
  const struct TransportValidationChallengeMessage *tvc)
{
  struct CommunicatorMessageContext *cmc = cls;
  struct TransportValidationResponseMessage tvr = { 0 };
  struct GNUNET_TIME_RelativeNBO validity_duration;
 
  /* DV-routed messages are not allowed for validation challenges */
  if (cmc->total_hops > 0)
  {
    GNUNET_break_op (0);
    finish_cmc_handling (cmc);
    return;
  }
  validity_duration = cmc->im.expected_address_validity;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received address validation challenge %s\n",
              GNUNET_sh2s (&tvc->challenge.value));
  /* If we have a virtual link, we use this mechanism to signal the
     size of the flow control window, and to allow the sender
     to ask for increases. If for us the virtual link is still down,
     we will always give a window size of zero. */
  tvr.header.type =
    htons (GNUNET_MESSAGE_TYPE_TRANSPORT_ADDRESS_VALIDATION_RESPONSE);
  tvr.header.size = htons (sizeof(tvr));
  tvr.reserved = htonl (0);
  tvr.challenge = tvc->challenge;
  tvr.origin_time = tvc->sender_time;
  tvr.validity_duration = validity_duration;
  {
    /* create signature */
    struct TransportValidationPS tvp = {
      .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_CHALLENGE),
      .purpose.size = htonl (sizeof(tvp)),
      .validity_duration = validity_duration,
      .challenge = tvc->challenge
    };
    if (GNUNET_OK != sign_by_my_identity (&tvp.purpose, &tvr.signature))
    {
      /* Not answering costs us this address validation; leaving @a cmc
         behind would cost us the communicator. */
      finish_cmc_handling (cmc);
      return;
    }
  }
  send_t_validation_response (cmc, tvr);
}
 
 
struct CheckKnownChallengeContext
{
  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge;
 
  struct ValidationState *vs;
};
 
 
static int
check_known_challenge (void *cls,
                       const struct GNUNET_PeerIdentity *pid,
                       void *value)
{
  struct CheckKnownChallengeContext *ckac = cls;
  struct ValidationState *vs = value;
 
  (void) pid;
  if (0 != GNUNET_memcmp (&vs->challenge, ckac->challenge))
    return GNUNET_OK;
  ckac->vs = vs;
  return GNUNET_NO;
}
 
 
static void
peerstore_store_validation_cb (void *cls, int success)
{
  struct ValidationState *vs = cls;
 
  vs->sc = NULL;
  if (GNUNET_YES == success)
    return;
  GNUNET_STATISTICS_update (GST_stats,
                            "# Peerstore failed to store foreign address",
                            1,
                            GNUNET_NO);
}
 
 
static struct Queue *
find_queue (const struct GNUNET_PeerIdentity *pid, const char *address)
{
  struct Neighbour *n;
 
  n = lookup_neighbour (pid);
  if (NULL == n)
    return NULL;
  for (struct Queue *pos = n->queue_head; NULL != pos;
       pos = pos->next_neighbour)
  {
    if (0 == strcmp (pos->address, address))
      return pos;
  }
  return NULL;
}
 
 
static struct Queue *
find_queue_by_ip (const struct GNUNET_PeerIdentity *pid, const char *address)
{
  struct Neighbour *n;
  struct Queue *ret = NULL;
  char *prefix;
  char *ip;
 
  n = lookup_neighbour (pid);
  if (NULL == n)
    return NULL;
  prefix = GNUNET_HELLO_address_to_prefix (address);
  ip = get_address_without_port (address);
  if ((NULL == prefix) || (NULL == ip))
  {
    GNUNET_free (prefix);
    GNUNET_free (ip);
    return NULL;
  }
  for (struct Queue *pos = n->queue_head; NULL != pos;
       pos = pos->next_neighbour)
  {
    char *q_prefix = GNUNET_HELLO_address_to_prefix (pos->address);
    char *q_ip = get_address_without_port (pos->address);
 
    /* Same communicator and same host -- only the port may differ. */
    if ((NULL != q_prefix) && (NULL != q_ip) &&
        (0 == strcmp (q_prefix, prefix)) &&
        (0 == strcmp (q_ip, ip)))
      ret = pos;
    GNUNET_free (q_prefix);
    GNUNET_free (q_ip);
    if (NULL != ret)
      break;
  }
  GNUNET_free (prefix);
  GNUNET_free (ip);
  return ret;
}
 
 
static void
validation_transmit_on_queue (struct Queue *q, struct ValidationState *vs);
 
static void
revalidation_start_cb (void *cls)
{
  struct ValidationState *vs = cls;
  struct Queue *q;
  struct GNUNET_TIME_Absolute now;
 
  vs->revalidation_task = NULL;
  q = find_queue (&vs->pid, vs->address);
  if (NULL == q)
  {
    now = GNUNET_TIME_absolute_get ();
    vs->awaiting_queue = GNUNET_YES;
    suggest_to_connect (&vs->pid, vs->address);
    update_next_challenge_time (vs, now);
  }
  else
    validation_transmit_on_queue (q, vs);
}
 
 
static enum GNUNET_GenericReturnValue
revalidate_map_it (
  void *cls,
  const struct GNUNET_HashCode *key,
  void *value)
{
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Key in revalidate map  %s \n",
              GNUNET_h2s (key));
  return GNUNET_YES;
}
 
 
static void
handle_validation_response (
  void *cls,
  const struct TransportValidationResponseMessage *tvr)
{
  struct CommunicatorMessageContext *cmc = cls;
  struct ValidationState *vs;
  struct CheckKnownChallengeContext ckac = { .challenge = &tvr->challenge,
                                             .vs = NULL};
  struct GNUNET_TIME_Absolute origin_time;
  struct Queue *q;
  struct Neighbour *n;
  struct VirtualLink *vl;
  const struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get_monotonic (
    GST_cfg);
 
  /* check this is one of our challenges */
  (void) GNUNET_CONTAINER_multipeermap_get_multiple (validation_map,
                                                     &cmc->im.sender,
                                                     &check_known_challenge,
                                                     &ckac);
  if (NULL == (vs = ckac.vs))
  {
    /* This can happen simply if we 'forgot' the challenge by now,
       i.e. because we received the validation response twice */
    GNUNET_STATISTICS_update (GST_stats,
                              "# Validations dropped, challenge unknown",
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Validation response %s dropped, challenge unknown\n",
                GNUNET_sh2s (&tvr->challenge.value));
    finish_cmc_handling (cmc);
    return;
  }
 
  /* sanity check on origin time */
  origin_time = GNUNET_TIME_absolute_ntoh (tvr->origin_time);
  if ((origin_time.abs_value_us < vs->first_challenge_use.abs_value_us) ||
      (origin_time.abs_value_us > vs->last_challenge_use.abs_value_us))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Diff first use %" PRIu64 " and last use %" PRIu64 "\n",
                vs->first_challenge_use.abs_value_us - origin_time.abs_value_us,
                origin_time.abs_value_us - vs->last_challenge_use.abs_value_us);
    GNUNET_break_op (0);
    finish_cmc_handling (cmc);
    return;
  }
 
  {
    /* check signature */
    struct TransportValidationPS tvp = {
      .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_CHALLENGE),
      .purpose.size = htonl (sizeof(tvp)),
      .validity_duration = tvr->validity_duration,
      .challenge = tvr->challenge
    };
 
    if (
      GNUNET_OK !=
      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_CHALLENGE,
                                  &tvp,
                                  &tvr->signature,
                                  &cmc->im.sender.public_key))
    {
      GNUNET_break_op (0);
      finish_cmc_handling (cmc);
      return;
    }
  }
 
  /* validity is capped by our willingness to keep track of the
     validation entry and the maximum the other peer allows */
  vs->valid_until = GNUNET_TIME_relative_to_absolute (
    GNUNET_TIME_relative_min (GNUNET_TIME_relative_ntoh (
                                tvr->validity_duration),
                              MAX_ADDRESS_VALID_UNTIL));
  vs->validated_until =
    GNUNET_TIME_absolute_min (vs->valid_until,
                              GNUNET_TIME_relative_to_absolute (
                                ADDRESS_VALIDATION_LIFETIME));
  vs->validation_rtt = GNUNET_TIME_absolute_get_duration (origin_time);
  vs->challenge_backoff = GNUNET_TIME_UNIT_ZERO;
  GNUNET_CRYPTO_random_block (&vs->challenge,
                              sizeof(vs->challenge));
  vs->first_challenge_use = GNUNET_TIME_absolute_subtract (
    vs->validated_until,
    GNUNET_TIME_relative_multiply (vs->validation_rtt,
                                   VALIDATION_RTT_BUFFER_FACTOR));
  if (GNUNET_TIME_absolute_cmp (vs->first_challenge_use, <, now))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "First challenge use is now %" PRIu64 " %s \n",
                vs->first_challenge_use.abs_value_us,
                GNUNET_sh2s (&vs->challenge.value));
    vs->first_challenge_use = now;
  }
  else
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "First challenge use is later %" PRIu64 " %s \n",
                vs->first_challenge_use.abs_value_us,
                GNUNET_sh2s (&vs->challenge.value));
  vs->last_challenge_use =
    GNUNET_TIME_UNIT_ZERO_ABS; /* challenge was not yet used */
  update_next_challenge_time (vs, vs->first_challenge_use);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Validation response %s from %s accepted, address valid until %s\n",
              GNUNET_sh2s (&tvr->challenge.value),
              GNUNET_i2s (&cmc->im.sender),
              GNUNET_STRINGS_absolute_time_to_string (vs->valid_until));
  /*memcpy (&hkey,
          &hc,
          sizeof (hkey));*/
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Key %s for address %s map size %u contains %u\n",
              GNUNET_h2s (&vs->hc),
              vs->address,
              GNUNET_CONTAINER_multihashmap_size (revalidation_map),
              GNUNET_CONTAINER_multihashmap_contains (revalidation_map,
                                                      &vs->hc));
  /* NOTE: @e hc hashes the address only, so two `struct ValidationState's
     for different peers can collide here.  That must not abort us. */
  if (GNUNET_YES !=
      GNUNET_CONTAINER_multihashmap_put (
        revalidation_map,
        &vs->hc,
        vs,
        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Address `%s' already tracked for revalidation\n",
                vs->address);
  GNUNET_CONTAINER_multihashmap_iterate (revalidation_map,
                                         revalidate_map_it,
                                         NULL);
  vs->revalidation_task =
    GNUNET_SCHEDULER_add_at (GNUNET_TIME_absolute_subtract (vs->next_challenge,
                                                            GNUNET_TIME_UNIT_MINUTES),
                             &revalidation_start_cb, vs);
  vs->sc = GNUNET_PEERSTORE_store (peerstore,
                                   "transport",
                                   &cmc->im.sender,
                                   GNUNET_PEERSTORE_TRANSPORT_URLADDRESS_KEY,
                                   vs->address,
                                   strlen (vs->address) + 1,
                                   vs->valid_until,
                                   GNUNET_PEERSTORE_STOREOPTION_MULTIPLE,
                                   &peerstore_store_validation_cb,
                                   vs);
  finish_cmc_handling (cmc);
 
  /* Finally, we now possibly have a confirmed (!) working queue,
     update queue status (if queue still is around) */
  q = find_queue (&vs->pid, vs->address);
  if (NULL == q)
  {
    /* The challenge may have gone out on a queue whose address is not
       literally @e address: #check_validation_request_pending() matches on
       the IP alone, precisely so that a validation waiting for the NAT
       address `PROTO-IP:0' can be answered over the queue that the peer
       actually established from `PROTO-IP:port'.  Insisting on an exact
       match here would silently discard that (successful!) validation and
       never bring the virtual link up. */
    q = find_queue_by_ip (&vs->pid, vs->address);
  }
  if (NULL == q)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# Queues lost at time of successful validation",
                              1,
                              GNUNET_NO);
    return;
  }
  q->validated_until = vs->validated_until;
  q->pd.aged_rtt = vs->validation_rtt;
  n = q->neighbour;
  vl = lookup_virtual_link (&vs->pid);
  if (NULL == vl)
  {
    vl = GNUNET_new (struct VirtualLink);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Creating new virtual link %p to %s using direct neighbour!\n",
                vl,
                GNUNET_i2s (&vs->pid));
    vl->burst_addr = NULL;
    vl->confirmed = GNUNET_YES;
    vl->message_uuid_ctr =
      GNUNET_CRYPTO_random_u64 (UINT64_MAX);
    vl->target = n->pid;
    vl->core_recv_window = RECV_WINDOW_SIZE;
    vl->available_fc_window_size = DEFAULT_WINDOW_SIZE;
    vl->incoming_fc_window_size = DEFAULT_WINDOW_SIZE;
    /* What the peer will grant us in its very first FLOW_CONTROL anyway
       (@e incoming_fc_window_size plus what we have sent, i.e. nothing).
       Starting at zero instead means a link that is up, validated and
       working carries nothing at all until an FC round trip completes --
       and if the peer cannot answer, not ever. */
    vl->outbound_fc_window_size = DEFAULT_WINDOW_SIZE;
    GNUNET_break (GNUNET_YES ==
                  GNUNET_CONTAINER_multipeermap_put (
                    links,
                    &vl->target,
                    vl,
                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
    vl->n = n;
    n->vl = vl;
    q->idle = GNUNET_YES;
    vl->visibility_task =
      GNUNET_SCHEDULER_add_at (q->validated_until, &check_link_down, vl);
    consider_sending_fc (vl);
    /* We lacked a confirmed connection to the target
       before, so tell CORE about it (finally!) */
    cores_send_connect_info (&n->pid);
    send_msg_from_cache (vl);
  }
  else
  {
    /* Link was already up, remember n is also now available and we are done */
    if (NULL == vl->n)
    {
      vl->n = n;
      n->vl = vl;
      if (GNUNET_YES == vl->confirmed)
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Virtual link to %s could now also use direct neighbour!\n",
                    GNUNET_i2s (&vs->pid));
    }
    else
    {
      GNUNET_assert (n == vl->n);
    }
    if (GNUNET_NO == vl->confirmed)
    {
      vl->confirmed = GNUNET_YES;
      q->idle = GNUNET_YES;
      vl->visibility_task =
        GNUNET_SCHEDULER_add_at (q->validated_until, &check_link_down, vl);
      consider_sending_fc (vl);
      /* We lacked a confirmed connection to the target
         before, so tell CORE about it (finally!) */
      cores_send_connect_info (&n->pid);
      send_msg_from_cache (vl);
    }
  }
}
 
 
static void
handle_incoming_msg (void *cls,
                     const struct GNUNET_TRANSPORT_IncomingMessage *im)
{
  struct TransportClient *tc = cls;
  struct Neighbour *n;
  struct CommunicatorMessageContext *cmc =
    GNUNET_new (struct CommunicatorMessageContext);
 
  cmc->tc = tc;
  cmc->im = *im;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received message with size %u and flow control id %" PRIu64
              " via communicator from peer %s\n",
              ntohs (im->header.size),
              im->fc_id,
              GNUNET_i2s (&im->sender));
  cmc->im.neighbour_sender = cmc->im.sender;
  /* A communicator got this straight from @a im->sender, so the queues to
     that neighbour demonstrably still work.  This is what #check_link_down()
     uses to bound how long a communicator that stopped working (without
     telling us) can keep a virtual link -- and CORE -- fooled. */
  if (NULL != (n = lookup_neighbour (&im->sender)))
    n->last_inbound = GNUNET_TIME_absolute_get ();
  cmc->mh = (const struct GNUNET_MessageHeader *) &im[1];
  demultiplex_with_cmc (cmc);
}
 
 
static int
check_flow_control (void *cls, const struct TransportFlowControlMessage *fc)
{
  unsigned int number_of_addresses = ntohl (fc->number_of_addresses);
  uint16_t msize = ntohs (fc->header.size);
  const char *tgnas;
  size_t avail;
  size_t off;
 
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Flow control header size %u size of addresses %u number of addresses %u size of message struct %lu second struct %lu\n",
              ntohs (fc->header.size),
              ntohl (fc->size_of_addresses),
              ntohl (fc->number_of_addresses),
              sizeof(struct TransportFlowControlMessage),
              sizeof (struct TransportGlobalNattedAddress));
  if (0 == number_of_addresses)
    return GNUNET_OK;
  if (msize < sizeof(struct TransportFlowControlMessage))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  avail = msize - sizeof(struct TransportFlowControlMessage);
  tgnas = (const char *) &fc[1];
  off = 0;
  /* Validate EVERY entry: checking only the aggregate size lets a single
     entry claim a bogus address_length and send #handle_flow_control()
     out of bounds. */
  for (unsigned int i = 0; i < number_of_addresses; i++)
  {
    const struct TransportGlobalNattedAddress *tgna;
    size_t alen;
 
    if (avail - off < sizeof(struct TransportGlobalNattedAddress))
    {
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
    tgna = (const struct TransportGlobalNattedAddress *) &tgnas[off];
    off += sizeof(struct TransportGlobalNattedAddress);
    alen = ntohl (tgna->address_length);
    if (avail - off < alen)
    {
      GNUNET_break_op (0);
      return GNUNET_SYSERR;
    }
    off += alen;
  }
  return GNUNET_OK;
}
 
 
static struct GNUNET_TIME_Relative
calculate_rtt (struct DistanceVector *dv)
{
  struct GNUNET_TIME_Relative ret = GNUNET_TIME_UNIT_ZERO;
  unsigned int n_hops = 0;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "calculate_rtt\n");
  for (struct DistanceVectorHop *pos = dv->dv_head; NULL != pos;
       pos = pos->next_dv)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "calculate_rtt %lu\n",
                (unsigned long) pos->pd.aged_rtt.rel_value_us);
    n_hops++;
    ret = GNUNET_TIME_relative_add (GNUNET_TIME_relative_multiply (pos->pd.
                                                                   aged_rtt, pos
                                                                   ->distance
                                                                   + 2), ret);
  }
 
  if (0 == n_hops)
    return GNUNET_TIME_UNIT_FOREVER_REL;
  return ret;
}
 
 
static void
iterate_address_start_burst (void *cls,
                             const struct GNUNET_PeerIdentity *pid,
                             const char *uri)
{
  struct VirtualLink *vl = cls;
  const char *slash;
  char *address_uri;
  char *prefix;
  char *uri_without_port;
 
  slash = strrchr (uri, '/');
  if ((NULL == slash) || (slash - uri < 2))
  {
    GNUNET_break_op (0);   /* @a uri comes from a remote HELLO */
    return;
  }
  prefix = GNUNET_strndup (uri, (slash - uri) - 2);
  slash++;
  GNUNET_asprintf (&address_uri,
                   "%s-%s",
                   prefix,
                   slash);
 
  uri_without_port = get_address_without_port (address_uri);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "iterate_address_start_burst %s %s %s %s\n",
              (NULL == uri_without_port) ? "<unparsable>" : uri_without_port,
              uri,
              address_uri,
              slash);
  GNUNET_free (vl->burst_addr);
  if ((NULL != uri_without_port) &&
      (0 == strcmp (uri_without_port, slash)))
    vl->burst_addr = GNUNET_strdup (uri_without_port);
 
  GNUNET_free (prefix);
  GNUNET_free (address_uri);
  GNUNET_free (uri_without_port);
}
 
 
static void
check_for_burst_address (void *cls,
                         const struct GNUNET_PEERSTORE_Record *record,
                         const char *emsg)
{
  struct GNUNET_StartBurstCls *sb_cls = cls;
  struct VirtualLink *vl = sb_cls->vl;
  const struct GNUNET_MessageHeader *hello;
  struct GNUNET_HELLO_Parser *parser;
 
  if (NULL != emsg)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Got failure from PEERSTORE: %s\n",
                emsg);
    /* @a emsg comes with a NULL record, which means the iteration is over
       and PEERSTORE is releasing the context itself -- stopping it here as
       well would free it twice.  Just drop our handle. */
    vl->ic = NULL;
    free_burst_cls (sb_cls);
    return;
  }
  if (NULL == record)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Hello iteration end for %s\n",
                GNUNET_i2s (&vl->target));
    /* PEERSTORE destroys the context itself once it signals the end. */
    vl->ic = NULL;
    free_burst_cls (sb_cls);
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "check_for_burst_address\n");
  /* @a hello was published by a remote peer, it may well be malformed. */
  hello = hello_from_record (record);
  if (NULL != hello)
  {
    parser = GNUNET_HELLO_parser_from_msg (hello, &record->peer);
    if (NULL != parser)
    {
      GNUNET_HELLO_parser_iterate (parser,
                                   &iterate_address_start_burst,
                                   vl);
      GNUNET_HELLO_parser_free (parser);
    }
  }
 
  /* MUST clear @e ic: #GNUNET_PEERSTORE_iteration_stop() frees it, and
     #free_virtual_link() would otherwise stop it a second time. */
  if (NULL != vl->ic)
  {
    GNUNET_PEERSTORE_iteration_stop (vl->ic);
    vl->ic = NULL;
  }
  free_burst_cls (sb_cls);
}
 
 
static void
burst_timeout (void *cls)
{
  burst_running = GNUNET_NO;
}
 
 
static void
start_burst (void *cls)
{
  struct GNUNET_StartBurstCls *sb_cls = cls;
  struct VirtualLink *vl = sb_cls->vl;
  struct GNUNET_TRANSPORT_StartBurst *sb;
  struct GNUNET_MQ_Envelope *env;
  char *uri_without_port = vl->burst_addr;
 
  burst_task = NULL;
  burst_task_cls = NULL;
  if (NULL == uri_without_port)
  {
    /* Lost the address in the meantime, nothing to burst to. */
    free_burst_cls (sb_cls);
    return;
  }
  /*char buf[strlen (uri_without_port) + 1];
 
  GNUNET_memcpy (buf, uri_without_port,  strlen (uri_without_port));
  buf[strlen (uri_without_port)] = '\0';*/
  env =
    GNUNET_MQ_msg_extra (sb,
                         strlen (uri_without_port) + 1,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_START_BURST);
  sb->rtt = GNUNET_TIME_relative_hton (sb_cls->rtt);
  sb->pid = vl->target;
  memcpy (&sb[1], uri_without_port, strlen (uri_without_port) + 1);
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    if (CT_COMMUNICATOR != tc->type)
      continue;   /* MUST come first: the log below reads the union! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "iterate_address_start_burst client tc prefix %s\n",
                tc->details.communicator.address_prefix);
    if (GNUNET_YES == tc->details.communicator.can_burst)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "iterate_address_start_burst %s call %lu %u rtt %lu\n",
                  uri_without_port,
                  strlen (uri_without_port),
                  ntohs (sb->header.size),
                  (unsigned long) sb_cls->rtt.rel_value_us);
      GNUNET_MQ_send (tc->mq, env);
      env = NULL;   /* MQ took ownership */
      burst_running = GNUNET_YES;
      burst_timeout_task = GNUNET_SCHEDULER_add_delayed (
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
                                       60),
        &burst_timeout,
        NULL);
      // TODO We need some algo to choose from available communicators. Can we run two bursts at once? Atm we only implemented udp burst.
      break;
    }
  }
  if (NULL != env)
    GNUNET_MQ_discard (env);
  free_burst_cls (sb_cls);
}
 
 
static void
free_burst_cls (struct GNUNET_StartBurstCls *sb_cls)
{
  struct VirtualLink *vl = sb_cls->vl;
 
  if (burst_task_cls == sb_cls)
  {
    if (NULL != burst_task)
    {
      GNUNET_SCHEDULER_cancel (burst_task);
      burst_task = NULL;
    }
    burst_task_cls = NULL;
  }
  if ((NULL != vl) && (vl->sb_cls == sb_cls))
    vl->sb_cls = NULL;
  GNUNET_free (sb_cls);
}
 
 
static void
queue_burst (void *cls)
{
  struct GNUNET_StartBurstCls *sb_cls = cls;
  struct VirtualLink *vl = sb_cls->vl;
 
  if (GNUNET_YES != use_burst)
  {
    /* MUST release: nobody else owns @a sb_cls, and #handle_flow_control()
       allocates one for every FLOW_CONTROL message we receive. */
    free_burst_cls (sb_cls);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "burst_task %p ready %s burst addr %s (%p)\n",
              burst_task,
              sb_cls->sync_ready ? "yes" : "no",
              vl->burst_addr,
              vl->burst_addr);
  if (NULL != burst_task && GNUNET_NO == sb_cls->sync_ready)
  {
    /* Cancel the pending burst.  Both closures (the scheduled task's and
       ours) are ours to release. */
    struct GNUNET_StartBurstCls *pending = burst_task_cls;
 
    GNUNET_SCHEDULER_cancel (burst_task);
    burst_task = NULL;
    burst_task_cls = NULL;
    if ((NULL != pending) && (pending != sb_cls))
      free_burst_cls (pending);
    free_burst_cls (sb_cls);
    return;
  }
  if (GNUNET_NO == burst_running && NULL != vl->burst_addr && NULL == burst_task
      )
  {
    burst_task = GNUNET_SCHEDULER_add_delayed (sb_cls->delay,
                                               &start_burst,
                                               sb_cls);
    burst_task_cls = sb_cls;
  }
  else if (NULL == vl->burst_addr)
  {
    if (NULL != vl->ic)
    {
      /* An address lookup is already running for this link; starting a
         second one would leak the first. */
      free_burst_cls (sb_cls);
      return;
    }
    vl->ic = GNUNET_PEERSTORE_iteration_start (peerstore,
                                               "peerstore",
                                               &vl->target,
                                               GNUNET_PEERSTORE_HELLO_KEY,
                                               check_for_burst_address,
                                               sb_cls);
  }
  else
  {
    /* A burst is already running or already scheduled; we have no use for
       this closure. */
    free_burst_cls (sb_cls);
  }
}
 
 
static void
unconfirmed_link_timeout (void *cls)
{
  struct VirtualLink *vl = cls;
 
  vl->unconfirmed_timeout_task = NULL;
  if ((GNUNET_YES == vl->confirmed) ||
      (NULL != vl->n) ||
      (NULL != vl->dv))
    return;   /* got promoted in the meantime, its owner will clean up */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Discarding unconfirmed virtual link to %s\n",
              GNUNET_i2s (&vl->target));
  GNUNET_STATISTICS_update (GST_stats,
                            "# Unconfirmed virtual links timed out",
                            1,
                            GNUNET_NO);
  free_virtual_link (vl);
}
 
 
static void
handle_flow_control (void *cls, const struct TransportFlowControlMessage *fc)
{
  struct CommunicatorMessageContext *cmc = cls;
  struct VirtualLink *vl;
  struct GNUNET_TIME_Absolute q_timeout = GNUNET_TIME_UNIT_ZERO_ABS;
  uint32_t seq;
  struct GNUNET_TIME_Absolute st;
  uint64_t os;
  uint64_t wnd;
  uint32_t random;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received FC from %s\n", GNUNET_i2s (&cmc->im.sender));
  vl = lookup_virtual_link (&cmc->im.sender);
  if (NULL == vl)
  {
    vl = GNUNET_new (struct VirtualLink);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "No virtual link for %p FC creating new unconfirmed virtual link to %s!\n",
                vl,
                GNUNET_i2s (&cmc->im.sender));
    vl->burst_addr = NULL;
    vl->confirmed = GNUNET_NO;
    vl->message_uuid_ctr =
      GNUNET_CRYPTO_random_u64 (UINT64_MAX);
    vl->target = cmc->im.sender;
    vl->core_recv_window = RECV_WINDOW_SIZE;
    vl->available_fc_window_size = DEFAULT_WINDOW_SIZE;
    vl->incoming_fc_window_size = DEFAULT_WINDOW_SIZE;
    /* What the peer will grant us in its very first FLOW_CONTROL anyway
       (@e incoming_fc_window_size plus what we have sent, i.e. nothing).
       Starting at zero instead means a link that is up, validated and
       working carries nothing at all until an FC round trip completes --
       and if the peer cannot answer, not ever. */
    vl->outbound_fc_window_size = DEFAULT_WINDOW_SIZE;
    GNUNET_break (GNUNET_YES ==
                  GNUNET_CONTAINER_multipeermap_put (
                    links,
                    &vl->target,
                    vl,
                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
    /* Nothing else owns this link yet, so it must reap itself if it never
       becomes confirmed -- otherwise any peer can make us allocate
       VirtualLinks without bound. */
    vl->unconfirmed_timeout_task =
      GNUNET_SCHEDULER_add_delayed (UNCONFIRMED_LINK_TIMEOUT,
                                    &unconfirmed_link_timeout,
                                    vl);
  }
  if (GNUNET_YES != vl->confirmed)
  {
    /* The peer flow-controls us, so it has a confirmed link to us -- but an
       unconfirmed link carries nothing and is never reported to CORE.  Only
       #handle_validation_response() breaks that tie, and nothing here used
       to ask for one, so the pair could sit one-way until the peer's own
       four hour revalidation came round. */
    try_to_bring_link_up (&cmc->im.sender);
  }
  if (NULL != vl->n)
  {
    for (struct Queue *q = vl->n->queue_head; NULL != q; q = q->next_neighbour)
      q_timeout = GNUNET_TIME_absolute_max (q_timeout, q->validated_until);
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "remaining %lu timeout for neighbour %p\n",
              (unsigned long) GNUNET_TIME_absolute_get_remaining (q_timeout).
              rel_value_us,
              vl->n);
  if (NULL == vl->n ||
      0 == GNUNET_TIME_absolute_get_remaining (q_timeout).rel_value_us)
  {
    struct GNUNET_TIME_Relative rtt;
    struct GNUNET_BurstSync burst_sync;
    struct GNUNET_StartBurstCls *bcls;
 
    if (NULL != vl->sb_cls)
    {
      /* A burst attempt for this link is already in flight.  Allocating a
         second closure would orphan the first one: @e sb_cls is how
         #free_virtual_link() finds (and cancels) the pending #burst_task,
         and a peer that just keeps sending us FLOW_CONTROL messages would
         otherwise make us leak one closure per message. */
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Burst attempt to %s already pending\n",
                  GNUNET_i2s (&vl->target));
    }
    else
    {
      bcls = GNUNET_new (struct GNUNET_StartBurstCls);
      bcls->vl = vl;
      vl->sb_cls = bcls;
      if (NULL != vl->dv)
        rtt = calculate_rtt (vl->dv);
      else
        rtt = GNUNET_TIME_UNIT_FOREVER_REL;
      burst_sync.rtt_average = fc->rtt;
      bcls->rtt = GNUNET_TIME_relative_ntoh (burst_sync.rtt_average);
      /* @e sync_ready of `struct GNUNET_BurstSync' is a host-order enum. */
      burst_sync.sync_ready =
        (enum GNUNET_GenericReturnValue) ntohl (fc->sync_ready);
 
      /* NOTE: #GNUNET_is_burst_ready() does NOT invoke the task unless both
         RTT estimates are known and close; #queue_burst() is thus not
         guaranteed to run, which is why @e sb_cls stays owned by @a vl. */
      GNUNET_is_burst_ready (rtt,
                             &burst_sync,
                             &queue_burst,
                             bcls);
    }
  }
  if (0 != ntohl (fc->number_of_addresses))
  {
    unsigned int number_of_addresses = ntohl (fc->number_of_addresses);
    const char *tgnas;
    unsigned int off = 0;
 
    tgnas = (const char *) &fc[1];
 
    for (unsigned int i = 0; i < number_of_addresses; i++)
    {
      struct TransportGlobalNattedAddress *tgna;
      char *addr;
      uint32_t address_length;
 
      tgna = (struct TransportGlobalNattedAddress*) &tgnas[off];
      addr = (char *) &tgna[1];
      address_length = ntohl (tgna->address_length);
      off += sizeof(struct TransportGlobalNattedAddress) + address_length;
 
      /* NOTE: the address is NOT 0-terminated (it comes straight off the
         wire), it must be printed with an explicit precision. */
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "received address %.*s length %u\n",
                  (int) address_length,
                  addr,
                  address_length);
 
      if (NULL != nh)
        GNUNET_NAT_add_global_address (nh, addr, ntohl (tgna->address_length));
    }
  }
  st = GNUNET_TIME_absolute_ntoh (fc->sender_time);
  if (st.abs_value_us < vl->last_fc_timestamp.abs_value_us)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "FC dropped: Message out of order\n");
    /* out of order, drop */
    GNUNET_STATISTICS_update (GST_stats,
                              "# FC dropped: message out of order",
                              1,
                              GNUNET_NO);
    finish_cmc_handling (cmc);
    return;
  }
  seq = ntohl (fc->seq);
  if (seq < vl->last_fc_seq)
  {
    /* Wrap-around/reset of other peer; start all counters from zero */
    vl->outbound_fc_window_size_used = 0;
  }
  vl->last_fc_seq = seq;
  vl->last_fc_timestamp = st;
  /* The peer is answering, so the backoff in #consider_sending_fc() starts
     over: @e fc_retransmit_count counts *unanswered* rounds. */
  vl->fc_retransmit_count = 0;
  vl->outbound_fc_window_size = GNUNET_ntohll (fc->inbound_window_size);
  os = GNUNET_ntohll (fc->outbound_sent);
  vl->incoming_fc_window_size_loss =
    (int64_t) (os - vl->incoming_fc_window_size_used);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received FC from %s, seq %u, new window %llu (loss at %lld)\n",
              GNUNET_i2s (&vl->target),
              (unsigned int) seq,
              (unsigned long long) vl->outbound_fc_window_size,
              (long long) vl->incoming_fc_window_size_loss);
  wnd = GNUNET_ntohll (fc->outbound_window_size);
  random = GNUNET_CRYPTO_random_u32 (UINT32_MAX);
  /* NOTE: this must NOT be restricted to a confirmed link.  @e
     outbound_fc_window_size starts at zero and is raised *only* here, from
     the peer's FC.  So a peer whose link to us is confirmed while ours to it
     is not cannot send us a single byte until we answer -- and it is exactly
     that peer that keeps asking.  Staying quiet deadlocks the pair: it shows
     an established virtual link with messages pending forever, we show none,
     and CORE never completes its handshake in either direction. */
  if ((wnd < vl->incoming_fc_window_size
       + vl->incoming_fc_window_size_used
       + vl->incoming_fc_window_size_loss) ||
      (vl->last_outbound_window_size_received != wnd) ||
      (0 == random % FC_NO_CHANGE_REPLY_PROBABILITY))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Consider re-sending our FC message, as clearly the other peer's idea of the window is not up-to-date (%llu vs %llu) or %llu last received differs, or random reply %u\n",
                (unsigned long long) wnd,
                (unsigned long long) vl->incoming_fc_window_size,
                (unsigned long long) vl->last_outbound_window_size_received,
                random % FC_NO_CHANGE_REPLY_PROBABILITY);
    consider_sending_fc (vl);
  }
  if ((wnd == vl->incoming_fc_window_size
       + vl->incoming_fc_window_size_used
       + vl->incoming_fc_window_size_loss) &&
      (vl->last_outbound_window_size_received == wnd))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Slowing FC transmission to %s to keepalive rate: peer is current at window %llu\n",
                GNUNET_i2s (&vl->target),
                (unsigned long long) wnd);
    /* NOTE: this used to also require @e fc_retransmit_task to be non-NULL
       and did nothing at all otherwise -- so a link whose chain had ended
       (see #consider_sending_fc()) could never pick the keepalive back up,
       even though the peer was demonstrably still talking to us. */
    if (NULL != vl->fc_retransmit_task)
      GNUNET_SCHEDULER_cancel (vl->fc_retransmit_task);
    vl->fc_retransmit_count = 0;
    /* Drop to the keepalive rate rather than stopping outright.  There is
       nothing left to retransmit -- but if we go completely quiet, and the
       peer does the same for the same reason, then neither end sees any
       traffic and #check_link_down() tears down a perfectly healthy link
       after #NEIGHBOUR_LIVENESS_TIMEOUT.  One tiny FC message every
       #FC_KEEPALIVE_INTERVAL is what keeps @e last_inbound moving on the
       other side (and, via their reply, on ours). */
    vl->fc_retransmit_task =
      GNUNET_SCHEDULER_add_delayed (FC_KEEPALIVE_INTERVAL,
                                    &task_consider_sending_fc,
                                    vl);
  }
  vl->last_outbound_window_size_received = wnd;
  /* FC window likely increased, check transmission possibilities! */
  check_vl_transmission (vl);
  finish_cmc_handling (cmc);
}
 
 
static void
demultiplex_with_cmc (struct CommunicatorMessageContext *cmc)
{
  struct GNUNET_MQ_MessageHandler handlers[] =
  { GNUNET_MQ_hd_var_size (fragment_box,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_FRAGMENT,
                           struct TransportFragmentBoxMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (reliability_box,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_RELIABILITY_BOX,
                           struct TransportReliabilityBoxMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (reliability_ack,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_RELIABILITY_ACK,
                           struct TransportReliabilityAckMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (backchannel_encapsulation,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_BACKCHANNEL_ENCAPSULATION,
                           struct TransportBackchannelEncapsulationMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (dv_learn,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_DV_LEARN,
                           struct TransportDVLearnMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (dv_box,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_DV_BOX,
                           struct TransportDVBoxMessage,
                           cmc),
    GNUNET_MQ_hd_var_size (flow_control,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_FLOW_CONTROL,
                           struct TransportFlowControlMessage,
                           cmc),
    GNUNET_MQ_hd_fixed_size (
      validation_challenge,
      GNUNET_MESSAGE_TYPE_TRANSPORT_ADDRESS_VALIDATION_CHALLENGE,
      struct TransportValidationChallengeMessage,
      cmc),
    GNUNET_MQ_hd_fixed_size (
      validation_response,
      GNUNET_MESSAGE_TYPE_TRANSPORT_ADDRESS_VALIDATION_RESPONSE,
      struct TransportValidationResponseMessage,
      cmc),
    GNUNET_MQ_handler_end () };
  int ret;
  const struct GNUNET_MessageHeader *msg = cmc->mh;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Handling message of type %u with %u bytes\n",
              (unsigned int) ntohs (msg->type),
              (unsigned int) ntohs (msg->size));
  /* @a handlers only covers the encapsulations *we* add; anything else is a
     payload for CORE and leaves through #handle_raw_message() below. So
     #GNUNET_NO is the common case here -- one per delivered CORE message --
     and not something to log about, which is why this is the "try" variant. */
  ret = GNUNET_MQ_try_handle_message (handlers, msg);
  if (GNUNET_SYSERR == ret)
  {
    /* @a msg is the message a *remote peer* sent us: #handle_incoming_msg()
       points @e mh into the payload of the
       #GNUNET_MESSAGE_TYPE_TRANSPORT_INCOMING_MSG the communicator
       delivered, and every other caller unwraps it from remote traffic as
       well.  So failing a check here is that peer's protocol violation, and
       it says nothing at all about the communicator that carried it.
 
       Dropping the client therefore punishes the wrong party, and it
       punishes it hard: #GNUNET_SERVICE_client_drop() disconnects the
       communicator *process*, which takes down every queue it owns and thus
       every neighbour reachable through it.  One malformed DV box on a
       shared UDP communicator disconnects every peer we have on it, CORE
       tears the sessions down, and the key exchanges that would rebuild
       them have to wait for the communicator to come back and revalidate.
       Since the offending bytes arrive from the network, any peer can do
       this to us at will, repeatedly.
 
       Drop the message and keep the communicator: resume it exactly as the
       success path does, so it still gets its flow-control ACK and its
       GNUNET_SERVICE_client_continue(). */
    GNUNET_break_op (0);
    GNUNET_STATISTICS_update (GST_stats,
                              "# malformed messages discarded",
                              1,
                              GNUNET_NO);
    finish_cmc_handling_with_continue (cmc, GNUNET_YES);
    return;
  }
  if (GNUNET_NO == ret)
  {
    /* unencapsulated 'raw' message */
    handle_raw_message (cmc, msg);
  }
}
 
 
static int
check_add_queue_message (void *cls,
                         const struct GNUNET_TRANSPORT_AddQueueMessage *aqm)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  GNUNET_MQ_check_zero_termination (aqm);
  return GNUNET_OK;
}
 
 
static void
set_pending_message_uuid (struct PendingMessage *pm)
{
  if (pm->msg_uuid_set)
    return;
  pm->msg_uuid.uuid = pm->vl->message_uuid_ctr++;
  pm->msg_uuid_set = GNUNET_YES;
}
 
 
static struct PendingAcknowledgement *
prepare_pending_acknowledgement (struct Queue *queue,
                                 struct DistanceVectorHop *dvh,
                                 struct PendingMessage *pm)
{
  struct PendingAcknowledgement *pa;
 
  pa = GNUNET_new (struct PendingAcknowledgement);
  pa->queue = queue;
  pa->dvh = dvh;
  pa->pm = pm;
  do
  {
    GNUNET_CRYPTO_random_block (&pa->ack_uuid,
                                sizeof(pa->ack_uuid));
  }
  while (GNUNET_YES != GNUNET_CONTAINER_multiuuidmap_put (
           pending_acks,
           &pa->ack_uuid.value,
           pa,
           GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  GNUNET_CONTAINER_MDLL_insert (queue, queue->pa_head, queue->pa_tail, pa);
  GNUNET_CONTAINER_MDLL_insert (pm, pm->pa_head, pm->pa_tail, pa);
  if (NULL != dvh)
    GNUNET_CONTAINER_MDLL_insert (dvh, dvh->pa_head, dvh->pa_tail, pa);
  pa->transmission_time = GNUNET_TIME_absolute_get ();
  pa->message_size = pm->bytes_msg;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Waiting for ACKnowledgment `%s' for <%" PRIu64 ">\n",
              GNUNET_uuid2s (&pa->ack_uuid.value),
              pm->logging_uuid);
  return pa;
}
 
 
static struct PendingMessage *
fragment_message (struct Queue *queue,
                  struct DistanceVectorHop *dvh,
                  struct PendingMessage *pm)
{
  struct PendingAcknowledgement *pa;
  struct PendingMessage *ff;
  uint16_t mtu;
  uint16_t msize;
 
  mtu = (UINT16_MAX == queue->mtu)
        ? UINT16_MAX - sizeof(struct GNUNET_TRANSPORT_SendMessageTo)
        : queue->mtu;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Fragmenting message <%" PRIu64
              "> with size %u to %s for MTU %u\n",
              pm->logging_uuid,
              pm->bytes_msg,
              GNUNET_i2s (&pm->vl->target),
              (unsigned int) mtu);
  set_pending_message_uuid (pm);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Fragmenting message %" PRIu64 " <%" PRIu64
              "> with size %u to %s for MTU %u\n",
              pm->msg_uuid.uuid,
              pm->logging_uuid,
              pm->bytes_msg,
              GNUNET_i2s (&pm->vl->target),
              (unsigned int) mtu);
 
  /* This invariant is established in #handle_add_queue_message() */
  GNUNET_assert (mtu > sizeof(struct TransportFragmentBoxMessage));
 
  /* select fragment for transmission, descending the tree if it has
     been expanded until we are at a leaf or at a fragment that is small
     enough
   */
  ff = pm;
  msize = ff->bytes_msg;
 
  while (((ff->bytes_msg > mtu) || (pm == ff)) &&
         (ff->frag_off == msize) && (NULL != ff->head_frag))
  {
    ff = ff->head_frag;   /* descent into fragmented fragments */
    msize = ff->bytes_msg - sizeof(struct TransportFragmentBoxMessage);
  }
 
  if (((ff->bytes_msg > mtu) || (pm == ff)) && (ff->frag_off < msize))
  {
    /* Did not yet calculate all fragments, calculate next fragment */
    struct PendingMessage *frag;
    struct TransportFragmentBoxMessage tfb;
    const char *orig;
    char *msg;
    uint16_t fragmax;
    uint16_t fragsize;
    uint16_t msize_ff;
    uint16_t xoff = 0;
    pm->frag_count++;
 
    orig = (const char *) &ff[1];
    msize_ff = ff->bytes_msg;
    if (pm != ff)
    {
      const struct TransportFragmentBoxMessage *tfbo;
 
      tfbo = (const struct TransportFragmentBoxMessage *) orig;
      orig += sizeof(struct TransportFragmentBoxMessage);
      msize_ff -= sizeof(struct TransportFragmentBoxMessage);
      xoff = ntohs (tfbo->frag_off);
    }
    fragmax = mtu - sizeof(struct TransportFragmentBoxMessage);
    fragsize = GNUNET_MIN (msize_ff - ff->frag_off, fragmax);
    frag =
      GNUNET_malloc (sizeof(struct PendingMessage)
                     + sizeof(struct TransportFragmentBoxMessage) + fragsize);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "3 created pm %p from pm %p storing vl %p from pm %p\n",
                frag,
                ff,
                pm->vl,
                pm);
    frag->logging_uuid = logging_uuid_gen++;
    frag->vl = pm->vl;
    frag->frag_parent = ff;
    frag->timeout = pm->timeout;
    frag->bytes_msg = sizeof(struct TransportFragmentBoxMessage) + fragsize;
    frag->pmt = PMT_FRAGMENT_BOX;
    msg = (char *) &frag[1];
    tfb.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_FRAGMENT);
    tfb.header.size =
      htons (sizeof(struct TransportFragmentBoxMessage) + fragsize);
    pa = prepare_pending_acknowledgement (queue, dvh, frag);
    tfb.ack_uuid = pa->ack_uuid;
    tfb.msg_uuid = pm->msg_uuid;
    tfb.frag_off = htons (ff->frag_off + xoff);
    tfb.msg_size = htons (pm->bytes_msg);
    memcpy (msg, &tfb, sizeof(tfb));
    memcpy (&msg[sizeof(tfb)], &orig[ff->frag_off], fragsize);
    GNUNET_CONTAINER_MDLL_insert (frag, ff->head_frag,
                                  ff->tail_frag, frag);
    ff->frag_off += fragsize;
    ff = frag;
  }
 
  if (pm == ff)
  {
    /* Neither the descent nor the branch above moved us off @a pm, so there
       is no fragment to send: @e head_frag is empty *and* @e frag_off says
       everything was already cut.  completed_pending_message() leaves
       exactly that state behind when the last outstanding fragment is
       acknowledged but its condition for finishing the root does not hold
       (@e frag_off having been advanced past the boxed payload size, or the
       root being a reliability box).  The rotate below then dereferences
       @e frag_parent, which is NULL for the message on @e pending_msg_head.
 
       Report "nothing to fragment" instead; the caller reschedules. */
    GNUNET_break (0);
    return NULL;
  }
  /* Move head to the tail and return it */
  GNUNET_CONTAINER_MDLL_remove (frag,
                                ff->frag_parent->head_frag,
                                ff->frag_parent->tail_frag,
                                ff);
  GNUNET_CONTAINER_MDLL_insert_tail (frag,
                                     ff->frag_parent->head_frag,
                                     ff->frag_parent->tail_frag,
                                     ff);
 
  return ff;
}
 
 
static struct PendingMessage *
reliability_box_message (struct Queue *queue,
                         struct DistanceVectorHop *dvh,
                         struct PendingMessage *pm)
{
  struct TransportReliabilityBoxMessage rbox;
  struct PendingAcknowledgement *pa;
  struct PendingMessage *bpm;
  char *msg;
 
  if ((PMT_CORE != pm->pmt) && (PMT_DV_BOX != pm->pmt))
    return pm; /* already fragmented or reliability boxed, or control message:
                  do nothing */
  if (NULL != pm->bpm)
    return pm->bpm; /* already computed earlier: do nothing */
  // TODO I guess we do not need this assertion. We might have a DLL with
  // fragments, because the MTU changed, and we do not need to fragment anymore.
  // But we should keep the fragments until message was completed, because
  // the MTU might change again.
  // GNUNET_assert (NULL == pm->head_frag);
  if (pm->bytes_msg + sizeof(rbox) > UINT16_MAX)
  {
    /* failed hard */
    GNUNET_break (0);
    client_send_response (pm);
    return NULL;
  }
 
  pa = prepare_pending_acknowledgement (queue, dvh, pm);
 
  bpm = GNUNET_malloc (sizeof(struct PendingMessage) + sizeof(rbox)
                       + pm->bytes_msg);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "4 created pm %p storing vl %p from pm %p\n",
              bpm,
              pm->vl,
              pm);
  bpm->logging_uuid = logging_uuid_gen++;
  bpm->vl = pm->vl;
  bpm->frag_parent = pm;
  // Why was this needed?
  // GNUNET_CONTAINER_MDLL_insert (frag, pm->head_frag, pm->tail_frag, bpm);
  bpm->timeout = pm->timeout;
  bpm->pmt = PMT_RELIABILITY_BOX;
  bpm->bytes_msg = pm->bytes_msg + sizeof(rbox);
  set_pending_message_uuid (bpm);
  rbox.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_RELIABILITY_BOX);
  rbox.header.size = htons (sizeof(rbox) + pm->bytes_msg);
  rbox.ack_countdown = htonl (0);  // FIXME: implement ACK countdown support
 
  rbox.ack_uuid = pa->ack_uuid;
  msg = (char *) &bpm[1];
  memcpy (msg, &rbox, sizeof(rbox));
  memcpy (&msg[sizeof(rbox)], &pm[1], pm->bytes_msg);
  pm->bpm = bpm;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Preparing reliability box for message <%" PRIu64
              "> of size %d (%d) to %s on queue %s\n",
              pm->logging_uuid,
              pm->bytes_msg,
              ntohs (((const struct GNUNET_MessageHeader *) &pm[1])->size),
              GNUNET_i2s (&pm->vl->target),
              queue->address);
  return bpm;
}
 
 
static void
reorder_root_pm (struct PendingMessage *pm,
                 struct GNUNET_TIME_Absolute next_attempt)
{
  struct VirtualLink *vl = pm->vl;
  struct PendingMessage *pos;
 
  /* Only a message without a parent is on vl->pending_msg_head; anything
     else is not ours to reorder and MDLL_remove() would abort on it. */
  if ((NULL == vl) ||
      (NULL != pm->frag_parent) ||
      ((NULL == pm->prev_vl) && (vl->pending_msg_head != pm)))
  {
    GNUNET_break (0);
    return;
  }
  /* re-insert sort in neighbour list */
  GNUNET_CONTAINER_MDLL_remove (vl,
                                vl->pending_msg_head,
                                vl->pending_msg_tail,
                                pm);
  pos = vl->pending_msg_tail;
  while ((NULL != pos) &&
         (next_attempt.abs_value_us > pos->next_attempt.abs_value_us))
    pos = pos->prev_vl;
  GNUNET_CONTAINER_MDLL_insert_after (vl,
                                      vl->pending_msg_head,
                                      vl->pending_msg_tail,
                                      pos,
                                      pm);
}
 
 
static unsigned int
check_next_attempt_tree (struct PendingMessage *pm, struct PendingMessage *root)
{
  struct PendingMessage *pos;
  /* MUST be initialised: for a leaf the loop below never runs */
  enum GNUNET_GenericReturnValue frags_in_flight = GNUNET_NO;
 
  pos = pm->head_frag;
  while (NULL != pos)
  {
    if (pos->frags_in_flight_round == pm->frags_in_flight_round ||
        GNUNET_NO == check_next_attempt_tree (pos, root))
      frags_in_flight = GNUNET_NO;
    else
    {
      frags_in_flight = GNUNET_YES;
      break;
    }
    pos = pos->next_frag;
  }
 
  return frags_in_flight;
}
 
 
static void
harmonize_flight_round (struct PendingMessage *pm)
{
  struct PendingMessage *pos;
 
  pos = pm->head_frag;
  while (NULL != pos)
  {
    pos->frags_in_flight_round = pm->frags_in_flight_round;
    harmonize_flight_round (pos);
    pos = pos->next_frag;
  }
}
 
 
static void
update_pm_next_attempt (struct PendingMessage *pm,
                        struct GNUNET_TIME_Absolute next_attempt)
{
  if (NULL == pm->frag_parent)
  {
    pm->next_attempt = next_attempt;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Next attempt for message <%" PRIu64 "> set to %" PRIu64 "\n",
                pm->logging_uuid,
                next_attempt.abs_value_us);
    reorder_root_pm (pm, next_attempt);
  }
  else if ((PMT_RELIABILITY_BOX == pm->pmt) || (PMT_DV_BOX == pm->pmt))// || (PMT_FRAGMENT_BOX == pm->pmt))
  {
    struct PendingMessage *root = pm->frag_parent;
 
    while (NULL != root->frag_parent)
      root = root->frag_parent;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Next attempt for root message <%" PRIu64 "> set to %s\n",
                root->logging_uuid,
                GNUNET_STRINGS_absolute_time_to_string (next_attempt));
    root->next_attempt = next_attempt;
    reorder_root_pm (root, next_attempt);
  }
  else
  {
    struct PendingMessage *root = pm->frag_parent;
 
    while (NULL != root->frag_parent && PMT_DV_BOX != root->pmt)
      root = root->frag_parent;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "frag_count next attempt %u\n",
                root->frag_count);
 
    if (GNUNET_NO == root->frags_in_flight)
    {
      root->next_attempt = next_attempt;
      harmonize_flight_round (root);
      root->frags_in_flight_round++;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Next attempt for fragmented message <%" PRIu64 "> (<%" PRIu64
                  ">)set to %" PRIu64 "\n",
                  pm->logging_uuid,
                  root->logging_uuid,
                  next_attempt.abs_value_us);
    }
 
    pm->next_attempt = root->next_attempt;
    pm->frags_in_flight_round = root->frags_in_flight_round;
    harmonize_flight_round (pm);
 
    if (root->bytes_msg == root->frag_off)
      root->frags_in_flight = check_next_attempt_tree (root, root);
    else
      root->frags_in_flight = GNUNET_YES;
 
    if (GNUNET_NO == root->frags_in_flight)
    {
      /* `root' deliberately stops at a DV box, which is itself a child of
         the message on vl->pending_msg_head.  Walk the rest of the way for
         the reorder: only the parentless message is on that list. */
      struct PendingMessage *vl_root = root;
 
      while (NULL != vl_root->frag_parent)
        vl_root = vl_root->frag_parent;
      vl_root->next_attempt = root->next_attempt;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "We have no fragments in flight for message %" PRIu64
                  ", reorder root %" PRIu64 "! Next attempt is %" PRIu64 "\n",
                  root->logging_uuid,
                  vl_root->logging_uuid,
                  vl_root->next_attempt.abs_value_us);
      reorder_root_pm (vl_root, vl_root->next_attempt);
    }
    else
    {
      double factor = ((double) root->frag_count - 1)
                      / (double) root->frag_count;
      struct GNUNET_TIME_Relative s1;
      struct GNUNET_TIME_Relative s2;
      struct GNUNET_TIME_Relative plus_mean =
        GNUNET_TIME_absolute_get_remaining (root->next_attempt);
      struct GNUNET_TIME_Relative plus = GNUNET_TIME_absolute_get_remaining (
        next_attempt);
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "frag_count %u after factor\n",
                  root->frag_count);
      s1 = GNUNET_TIME_relative_multiply_double (plus_mean,
                                                 factor);
      s2 = GNUNET_TIME_relative_divide (plus,
                                        root->frag_count);
      plus_mean = GNUNET_TIME_relative_add (s1, s2);
      root->next_attempt = GNUNET_TIME_relative_to_absolute (plus_mean);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "We have fragments in flight for message %" PRIu64
                  ", do not reorder root! Actual next attempt %" PRIu64 "\n",
                  root->logging_uuid,
                  root->next_attempt.abs_value_us);
    }
  }
}
 
 
struct PendingMessageScoreContext
{
  struct PendingMessage *best;
 
  struct DistanceVectorHop *dvh;
 
  size_t real_overhead;
 
  unsigned int consideration_counter;
 
  int frag;
 
  int relb;
 
  int to_early;
 
  unsigned int frags_in_flight;
 
  struct GNUNET_TIME_Relative to_early_retry_delay;
};
 
 
static void
select_best_pending_from_link (struct PendingMessageScoreContext *sc,
                               struct Queue *queue,
                               struct VirtualLink *vl,
                               struct DistanceVectorHop *dvh,
                               size_t overhead)
{
  struct GNUNET_TIME_Absolute now;
 
  now = GNUNET_TIME_absolute_get ();
  /* NOTE: @a sc accumulates across calls -- #transmit_on_queue() zeroes it
     once and then runs us for the direct link and for every DV hop in turn.
     Clearing the verdict here made each call discard what the previous ones
     found, so a message that was too early on the direct link was forgotten
     as soon as one DV hop had nothing to offer, and nothing rescheduled the
     queue at all. */
  for (struct PendingMessage *pos = vl->pending_msg_head; NULL != pos;
       pos = pos->next_vl)
  {
    size_t real_overhead = overhead;
    int frag;
    int relb;
 
    if ((NULL != dvh) && (PMT_DV_BOX == pos->pmt))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "DV messages must not be DV-routed to next hop!\n");
      continue;   /* DV messages must not be DV-routed to next hop! */
    }
    if (pos->next_attempt.abs_value_us > now.abs_value_us)
    {
      if (GNUNET_YES == pos->frags_in_flight)
      {
        sc->frags_in_flight = GNUNET_YES;
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Fragments in flight for message %" PRIu64 "\n",
                    pos->logging_uuid);
      }
      else
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Maybe too early, because message are sorted by next_attempt, if there are no fragments in flight.Checked message %"
                    PRIu64 "\n",
                    pos->logging_uuid);
        /* The *earliest* deadline is the one to come back for: @e
           pending_msg_head is sorted by @e next_attempt, so overwriting
           this on every iteration left the largest delay of the whole
           list -- the queue then slept past every message but the last
           one.  Across the calls for the direct link and each DV hop the
           same argument applies, hence the min() rather than an
           assignment. */
        sc->to_early_retry_delay =
          (GNUNET_YES == sc->to_early)
          ? GNUNET_TIME_relative_min (sc->to_early_retry_delay,
                                      GNUNET_TIME_absolute_get_remaining (
                                        pos->next_attempt))
          : GNUNET_TIME_absolute_get_remaining (pos->next_attempt);
        sc->to_early = GNUNET_YES;
        continue;
      }
      // break;   /* too early for all messages, they are sorted by next_attempt */
    }
    if (NULL != pos->qe)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "not eligible\n");
      continue;   /* not eligible */
    }
    sc->consideration_counter++;
    /* determine if we have to fragment, if so add fragmentation
       overhead! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "check %" PRIu64 " for sc->best\n",
                pos->logging_uuid);
    frag = GNUNET_NO;
    if (((0 != queue->mtu) &&
         (pos->bytes_msg + real_overhead > queue->mtu)) ||
        (pos->bytes_msg > UINT16_MAX - sizeof(struct
                                              GNUNET_TRANSPORT_SendMessageTo))
        ||
        (NULL != pos->head_frag /* fragments already exist, should
                                     respect that even if MTU is UINT16_MAX for
                                     this queue */))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "fragment msg with size %u, realoverhead is %lu\n",
                  pos->bytes_msg,
                  real_overhead);
      frag = GNUNET_YES;
      if (GNUNET_TRANSPORT_CC_RELIABLE == queue->tc->details.communicator.cc)
      {
        /* FIXME-FRAG-REL-UUID: we could use an optimized, shorter fragmentation
           header without the ACK UUID when using a *reliable* channel! */
      }
      real_overhead = overhead + sizeof(struct TransportFragmentBoxMessage);
    }
    /* determine if we have to reliability-box, if so add reliability box
       overhead */
    relb = GNUNET_NO;
    if ((GNUNET_NO == frag) &&
        (0 == (pos->prefs & GNUNET_MQ_PREF_UNRELIABLE)) &&
        (GNUNET_TRANSPORT_CC_RELIABLE != queue->tc->details.communicator.cc))
    {
      real_overhead += sizeof(struct TransportReliabilityBoxMessage);
 
      if ((0 != queue->mtu) && (pos->bytes_msg + real_overhead > queue->mtu))
      {
        frag = GNUNET_YES;
        real_overhead = overhead + sizeof(struct TransportFragmentBoxMessage);
      }
      else
      {
        relb = GNUNET_YES;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Create reliability box of msg with size %u, realoverhead is %lu %u %u %u\n",
                  pos->bytes_msg,
                  real_overhead,
                  queue->mtu,
                  frag,
                  relb);
    }
 
    /* Finally, compare to existing 'best' in sc to see if this 'pos' pending
       message would beat it! */
    if (GNUNET_NO == sc->frags_in_flight && NULL != sc->best)
    {
      /* CHECK if pos fits queue BETTER (=smaller) than pm, if not: continue;
         OPTIMIZE-ME: This is a heuristic, which so far has NOT been
         experimentally validated. There may be some huge potential for
         improvement here. Also, we right now only compare how well the
         given message fits _this_ queue, and do not consider how well other
         queues might suit the message. Taking other queues into consideration
         may further improve the result, but could also be expensive
         in terms of CPU time.  */
      long long sc_score = sc->frag * 40 + sc->relb * 20 + sc->real_overhead;
      long long pm_score = frag * 40 + relb * 20 + real_overhead;
      long long time_delta =
        (sc->best->next_attempt.abs_value_us - pos->next_attempt.abs_value_us)
        / 1000LL;
 
      /* "time_delta" considers which message has been 'ready' for transmission
         for longer, if a message has a preference for low latency, increase
         the weight of the time_delta by 10x if it is favorable for that message */
      if ((0 != (pos->prefs & GNUNET_MQ_PREF_LOW_LATENCY)) &&
          (0 != (sc->best->prefs & GNUNET_MQ_PREF_LOW_LATENCY)))
        time_delta *= 10;     /* increase weight (always, both are low latency) */
      else if ((0 != (pos->prefs & GNUNET_MQ_PREF_LOW_LATENCY)) &&
               (time_delta > 0))
        time_delta *= 10;     /* increase weight, favors 'pos', which is low latency */
      else if ((0 != (sc->best->prefs & GNUNET_MQ_PREF_LOW_LATENCY)) &&
               (time_delta < 0))
        time_delta *= 10;     /* increase weight, favors 'sc->best', which is low latency */
      if (0 != queue->mtu)
      {
        /* Grant bonus if we are below MTU, larger bonus the closer we will
           be to the MTU */
        if (queue->mtu > sc->real_overhead + sc->best->bytes_msg)
          sc_score -= queue->mtu - (sc->real_overhead + sc->best->bytes_msg);
        if (queue->mtu > real_overhead + pos->bytes_msg)
          pm_score -= queue->mtu - (real_overhead + pos->bytes_msg);
      }
      if (sc_score + time_delta > pm_score)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "sc_score of %" PRIu64 " larger, keep sc->best %" PRIu64
                    "\n",
                    pos->logging_uuid,
                    sc->best->logging_uuid);
        continue;     /* sc_score larger, keep sc->best */
      }
    }
    sc->best = pos;
    sc->dvh = dvh;
    sc->frag = frag;
    sc->relb = relb;
    sc->real_overhead = real_overhead;
  }
}
 
 
static void
extract_box_cb (void *cls,
                struct Neighbour *next_hop,
                const struct GNUNET_MessageHeader *hdr,
                enum RouteMessageOptions options)
{
  struct PendingMessageScoreContext *sc = cls;
  struct PendingMessage *pm = sc->best;
  struct PendingMessage *bpm;
  uint16_t bsize = ntohs (hdr->size);
 
  GNUNET_assert (NULL == pm->bpm);
  bpm = GNUNET_malloc (sizeof(struct PendingMessage) + bsize);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "5 created pm %p storing vl %p from pm %p\n",
              bpm,
              pm->vl,
              pm);
  bpm->logging_uuid = logging_uuid_gen++;
  bpm->pmt = PMT_DV_BOX;
  bpm->vl = pm->vl;
  bpm->timeout = pm->timeout;
  bpm->bytes_msg = bsize;
  bpm->frag_parent = pm;
  set_pending_message_uuid (bpm);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Creating DV Box %" PRIu64 " for original message %" PRIu64
              " (next hop is %s)\n",
              bpm->logging_uuid,
              pm->logging_uuid,
              GNUNET_i2s (&next_hop->pid));
  memcpy (&bpm[1], hdr, bsize);
  pm->bpm = bpm;
}
 
 
static void
transmit_on_queue (void *cls)
{
  struct Queue *queue = cls;
  struct Neighbour *n = queue->neighbour;
  struct PendingMessageScoreContext sc;
  struct PendingMessage *pm;
 
  queue->transmit_task = NULL;
  if ((NULL == n->vl) && (NULL == n->dv_head))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Virtual link `%s' is down, cannot have PM for queue `%s'\n",
                GNUNET_i2s (&n->pid),
                queue->address);
    queue->idle = GNUNET_YES;
    return;
  }
  memset (&sc, 0, sizeof(sc));
  /* @e n need not have a link of its own: it may serve only as the first
     hop of DV paths, and the traffic queued for those still has to go out. */
  if (NULL != n->vl)
    select_best_pending_from_link (&sc, queue, n->vl, NULL, 0);
  if (NULL == sc.best)
  {
    /* Also look at DVH that have the n as first hop! */
    for (struct DistanceVectorHop *dvh = n->dv_head; NULL != dvh;
         dvh = dvh->next_neighbour)
    {
      if (NULL == dvh->dv->vl)
        continue;   /* route not (yet) visible to CORE, no messages for it */
      select_best_pending_from_link (&sc,
                                     queue,
                                     dvh->dv->vl,
                                     dvh,
                                     sizeof(struct GNUNET_PeerIdentity)
                                     * (1 + dvh->distance)
                                     + sizeof(struct TransportDVBoxMessage)
                                     + sizeof(struct TransportDVBoxPayloadP));
    }
  }
  if (NULL == sc.best)
  {
    /* no message pending, nothing to do here! */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "No pending messages, queue `%s' to %s now idle\n",
                queue->address,
                GNUNET_i2s (&n->pid));
    if (GNUNET_YES == sc.to_early)
      schedule_transmit_on_queue (sc.to_early_retry_delay,
                                  queue,
                                  GNUNET_SCHEDULER_PRIORITY_DEFAULT);
    queue->idle = GNUNET_YES;
    return;
  }
  /* There is a message pending, we are certainly not idle */
  queue->idle = GNUNET_NO;
 
  /* Given selection in `sc`, do transmission */
  pm = sc.best;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Selected message <%" PRIu64 ">\n",
              pm->logging_uuid);
  if (NULL != sc.dvh)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Is this %u a DV box?\n",
                pm->pmt);
    GNUNET_assert (PMT_DV_BOX != pm->pmt);
    if ((NULL != sc.best->bpm) && (sc.best->bpm->used_dvh != sc.dvh))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Discard old box, because we have a new DV path.\n");
      free_pending_message (sc.best->bpm);
      sc.best->bpm = NULL;
    }
 
    if (NULL == sc.best->bpm)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "encapsulate_for_dv 2\n");
      encapsulate_for_dv (sc.dvh->dv,
                          1,
                          &sc.dvh,
                          (const struct GNUNET_MessageHeader *) &sc.best[1],
                          &extract_box_cb,
                          &sc,
                          RMO_NONE,
                          GNUNET_NO);
      GNUNET_assert (NULL != sc.best->bpm);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "%lu %lu %lu %lu %u\n",
                  sizeof(struct GNUNET_PeerIdentity),
                  sizeof(struct TransportDVBoxMessage),
                  sizeof(struct TransportDVBoxPayloadP),
                  sizeof(struct TransportFragmentBoxMessage),
                  ((const struct GNUNET_MessageHeader *) &sc.best[1])->size);
      sc.best->bpm->used_dvh = sc.dvh;
    }
    pm = sc.best->bpm;
  }
  if (GNUNET_YES == sc.frag)
  {
    pm = fragment_message (queue, sc.dvh, pm);
    if (NULL == pm)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Fragmentation failed queue %s to %s for <%" PRIu64
                  ">, trying again\n",
                  queue->address,
                  GNUNET_i2s (&n->pid),
                  sc.best->logging_uuid);
      /* NOT with a zero delay: nothing about @a queue or about the message
         changed between here and the next pass, so "trying again" at once
         is a busy loop that reproduces the failure at scheduler speed. */
      schedule_transmit_on_queue (MIN_ACK_WAIT_DURATION,
                                  queue,
                                  GNUNET_SCHEDULER_PRIORITY_DEFAULT);
      return;
    }
  }
  else if (GNUNET_YES == sc.relb)
  {
    pm = reliability_box_message (queue, sc.dvh, pm);
    if (NULL == pm)
    {
      /* Reliability boxing failed, try next message... */
      GNUNET_log (
        GNUNET_ERROR_TYPE_DEBUG,
        "Reliability boxing failed queue %s to %s for <%" PRIu64
        ">, trying again\n",
        queue->address,
        GNUNET_i2s (&n->pid),
        sc.best->logging_uuid);
      /* Same reasoning as for the fragmentation failure above. */
      schedule_transmit_on_queue (MIN_ACK_WAIT_DURATION,
                                  queue,
                                  GNUNET_SCHEDULER_PRIORITY_DEFAULT);
      return;
    }
  }
 
  /* Pass 'pm' for transission to the communicator */
  GNUNET_log (
    GNUNET_ERROR_TYPE_DEBUG,
    "Passing message <%" PRIu64
    "> to queue %s for peer %s (considered %u others)\n",
    pm->logging_uuid,
    queue->address,
    GNUNET_i2s (&n->pid),
    sc.consideration_counter);
 
  /* Flow control: increment amount of traffic sent; if we are routing
     via DV (and thus the ultimate target of the pending message is for
     a different virtual link than the one of the queue), then we need
     to use up not only the window of the direct link but also the
     flow control window for the DV link! */
  pm->vl->outbound_fc_window_size_used += pm->bytes_msg;
 
  if (pm->vl != queue->neighbour->vl)
  {
    /* If the virtual link of the queue differs, this better be distance
       vector routing! */
    GNUNET_assert (NULL != sc.dvh);
    /* If we do distance vector routing, we better not do this for a
       message that was itself DV-routed */
    GNUNET_assert (PMT_DV_BOX != sc.best->pmt);
    /* We use the size of the unboxed message here, to avoid counting
       the DV-Box header which is eaten up on the way by intermediaries.
       The next hop need not have a link of its own, in which case there is
       no window of it to charge. */
    if (NULL != queue->neighbour->vl)
      queue->neighbour->vl->outbound_fc_window_size_used += sc.best->bytes_msg;
  }
  else
  {
    GNUNET_assert (NULL == sc.dvh);
  }
 
  queue_send_msg (queue, pm, &pm[1], pm->bytes_msg);
 
  /* The message is with the communicator now, so return the CORE send
     window credit for it -- see #credit_client().
 
     It used to be returned here only for an unboxed message or a reliable
     communicator, and otherwise not until the *peer* acknowledged the
     message below.  That makes a window into a delivery confirmation: over
     an unreliable communicator every reliability-boxed or fragmented
     message holds one of the client's #SEND_WINDOW_SIZE slots for as long
     as its ACK takes, and a lost ACK holds it for the whole retransmission
     chain.  Four of those and CORE cannot send to that peer at all -- not
     payload, but also not its HEARTBEATs and not one message of its key
     exchange.  So the session times out for want of a heartbeat that is
     sitting in a queue, and the handshake that would rebuild it cannot go
     out either; CORE only recovers when a reconnect resets the window
     wholesale.  Acknowledgements still drive retransmission below, they
     just no longer gate the client. */
  credit_client (sc.best);
 
  /* Check if this transmission somehow conclusively finished handing 'pm'
     even without any explicit ACKs */
  if ((PMT_CORE == pm->pmt) ||
      (GNUNET_TRANSPORT_CC_RELIABLE == queue->tc->details.communicator.cc))
  {
    completed_pending_message (pm);
  }
  else
  {
    struct GNUNET_TIME_Relative wait_duration;
    unsigned int wait_multiplier;
 
    if (PMT_FRAGMENT_BOX == pm->pmt)
    {
      struct PendingMessage *root;
 
      root = pm->frag_parent;
      while (NULL != root->frag_parent && PMT_DV_BOX != root->pmt)
        root = root->frag_parent;
 
      if ((0 == root->frag_off) || (0 == root->frag_count))
      {
        wait_multiplier = 4;
      }
      else
      {
        double wm = ceil ((double) root->bytes_msg
                          / ((double) root->frag_off
                             / (double) root->frag_count)) * 4.0;
 
        if ((! (wm >= 1.0)) || (wm > 1024.0))
          wm = 4.0;   /* NaN, infinity or absurd: fall back to the default */
        wait_multiplier = (unsigned int) wm;
      }
    }
    else
    {
      // No fragments, we use 4 RTT before retransmitting.
      wait_multiplier = 4;
    }
 
    // Depending on how much pending message the VirtualLink is queueing, we wait longer.
    // wait_multiplier = wait_multiplier * pm->vl->pending_msg_num;
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Wait multiplier %u\n",
                wait_multiplier);
 
    /* Message not finished, waiting for acknowledgement.
       Update time by which we might retransmit 's' based on queue
       characteristics (i.e. RTT); it takes one RTT for the message to
       arrive and the ACK to come back in the best case; but the other
       side is allowed to delay ACKs by 2 RTTs, so we use 4 RTT before
       retransmitting.
 
       OPTIMIZE: Note that in the future this heuristic should likely
       be improved further (measure RTT stability, consider message
       urgency and size when delaying ACKs, etc.) */
 
    if (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us !=
        queue->pd.aged_rtt.rel_value_us)
      wait_duration = GNUNET_TIME_relative_max (queue->pd.aged_rtt,
                                                MIN_ACK_WAIT_DURATION);
    else
    {
      wait_duration = DEFAULT_ACK_WAIT_DURATION;
      wait_multiplier = 4;
    }
    {
      struct GNUNET_TIME_Absolute next = GNUNET_TIME_relative_to_absolute (
        GNUNET_TIME_relative_multiply (
          wait_duration, wait_multiplier));
      struct GNUNET_TIME_Relative plus = GNUNET_TIME_relative_multiply (
        wait_duration, wait_multiplier);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Waiting %s for ACK until %s\n",
                  GNUNET_STRINGS_relative_time_to_string (plus, GNUNET_NO),
                  GNUNET_STRINGS_absolute_time_to_string (next));
      update_pm_next_attempt (pm,
                              GNUNET_TIME_relative_to_absolute (
                                GNUNET_TIME_relative_multiply (wait_duration,
                                                               wait_multiplier))
                              );
    }
  }
  /* finally, re-schedule queue transmission task itself */
  schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                              queue,
                              GNUNET_SCHEDULER_PRIORITY_DEFAULT);
}
 
 
static void
handle_del_queue_message (void *cls,
                          const struct GNUNET_TRANSPORT_DelQueueMessage *dqm)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  for (struct Queue *queue = tc->details.communicator.queue_head; NULL != queue;
       queue = queue->next_client)
  {
    struct Neighbour *neighbour = queue->neighbour;
 
    if ((ntohl (dqm->qid) != queue->qid) ||
        (0 != GNUNET_memcmp (&dqm->receiver, &neighbour->pid)))
      continue;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Dropped queue %s to peer %s\n",
                queue->address,
                GNUNET_i2s (&neighbour->pid));
    free_queue (queue);
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  /* Not finding the queue is a race, not a protocol violation: we may have
     freed it ourselves already, or the communicator may be tearing down a
     queue we never fully learned about.  Do NOT drop the client over it --
     that runs #client_disconnect_cb(), which frees *every* queue this
     communicator owns, so one stale QUEUE_TEARDOWN would disconnect us from
     every peer it serves at once.  Compare #handle_send_message_ack(), which
     tolerates the same lookup miss. */
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "QUEUE_TEARDOWN for unknown queue QID %u to peer %s ignored\n",
              ntohl (dqm->qid),
              GNUNET_i2s (&dqm->receiver));
  GNUNET_STATISTICS_update (GST_stats,
                            "# QUEUE_TEARDOWN dropped: queue unknown",
                            1,
                            GNUNET_NO);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
free_queue_entry (struct QueueEntry *qe,
                  struct TransportClient *tc)
{
  struct PendingMessage *pm;
 
  GNUNET_CONTAINER_DLL_remove (qe->queue->queue_head,
                               qe->queue->queue_tail,
                               qe);
  qe->queue->queue_length--;
  tc->details.communicator.total_queue_length--;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received ACK on queue %s (QID %u) to peer %s (new length: %u/%u)\n",
              qe->queue->address,
              qe->queue->qid,
              GNUNET_i2s (&qe->queue->neighbour->pid),
              qe->queue->queue_length,
              tc->details.communicator.total_queue_length);
 
  /* if applicable, resume transmissions that waited on ACK */
  if (COMMUNICATOR_TOTAL_QUEUE_LIMIT - 1 ==
      tc->details.communicator.total_queue_length)
  {
    /* Communicator dropped below threshold, resume all queues
       incident with this client! */
    GNUNET_STATISTICS_update (
      GST_stats,
      "# Transmission throttled due to communicator queue limit",
      -1,
      GNUNET_NO);
    for (struct Queue *queue = tc->details.communicator.queue_head;
         NULL != queue;
         queue = queue->next_client)
    {
      schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                  queue,
                                  GNUNET_SCHEDULER_PRIORITY_DEFAULT);
    }
  }
  else if (QUEUE_LENGTH_LIMIT - 1 == qe->queue->queue_length)
  {
    /* queue dropped below threshold; only resume this one queue */
    GNUNET_STATISTICS_update (GST_stats,
                              "# Transmission throttled due to queue queue limit",
                              -1,
                              GNUNET_NO);
    schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                qe->queue,
                                GNUNET_SCHEDULER_PRIORITY_DEFAULT);
  }
  else if (1 == qe->queue->q_capacity)
  {
    // TODO I guess this will never happen, because the communicator triggers this by updating its queue length itself.
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transmission rescheduled due to communicator message queue with qid %u has capacity %"
                PRIu64 ".\n",
                qe->queue->qid,
                qe->queue->q_capacity);
    /* message queue has capacity; only resume this one queue */
    /* queue dropped below threshold; only resume this one queue */
    GNUNET_STATISTICS_update (GST_stats,
                              "# Transmission throttled due to message queue capacity",
                              -1,
                              GNUNET_NO);
    schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                qe->queue,
                                GNUNET_SCHEDULER_PRIORITY_DEFAULT);
  }
 
  if (NULL != (pm = qe->pm))
  {
    struct VirtualLink *vl;
 
    // GNUNET_assert (qe == pm->qe);
    pm->qe = NULL;
    /* If waiting for this communicator may have blocked transmission
       of pm on other queues for this neighbour, force schedule
       transmit on queue for queues of the neighbour */
    if (NULL == pm->frag_parent)
    {
      vl = pm->vl;
      if ((NULL != vl) &&
          (NULL != vl->pending_msg_head) &&
          (vl->pending_msg_head == pm))
        check_vl_transmission (vl);
    }
  }
  GNUNET_free (qe);
}
 
 
static void
handle_send_message_ack (void *cls,
                         const struct GNUNET_TRANSPORT_SendMessageToAck *sma)
{
  struct TransportClient *tc = cls;
  struct QueueEntry *qe;
  struct Queue *failed_queue = NULL;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
 
  /* find our queue entry matching the ACK */
  qe = NULL;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Looking for queue for PID %s\n",
              GNUNET_i2s (&sma->receiver));
  for (struct Queue *queue = tc->details.communicator.queue_head; NULL != queue;
       queue = queue->next_client)
  {
    if (0 != GNUNET_memcmp (&queue->neighbour->pid, &sma->receiver))
      continue;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Found PID %s\n",
                GNUNET_i2s (&queue->neighbour->pid));
 
 
    for (struct QueueEntry *qep = queue->queue_head; NULL != qep;
         qep = qep->next)
    {
      if (qep->mid != GNUNET_ntohll (sma->mid) || queue->qid != ntohl (
            sma->qid))
        continue;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "QueueEntry MID: %" PRIu64 " on queue QID: %u, Ack MID: %"
                  PRIu64 " Ack QID %u\n",
                  qep->mid,
                  queue->qid,
                  GNUNET_ntohll (sma->mid),
                  ntohl (sma->qid));
      qe = qep;
      if ((NULL != qe->pm) && (qe->pm->qe != qe))
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "For pending message %" PRIu64 " we had retransmissions.\n",
                    qe->pm->logging_uuid);
      break;
    }
  }
  if (GNUNET_OK != (int) ntohl (sma->status))
  {
    /* The communicator could not hand the message to the peer.  The only
       thing that produces this today is #handle_send_msg()'s "queue no
       longer exists" branch in `transport_api_communication.c', i.e. the
       communicator has already torn the queue down on its side and the
       QUEUE_TEARDOWN is merely still in flight (or was lost).
 
       Ignoring the status, as we used to, makes this self-sustaining:
       #free_queue_entry() releases the pending message and immediately
       reschedules transmission, #transmit_on_queue() picks the very same
       queue again -- transport still has it -- and we get another failure.
       Every round adds an envelope to the client MQ that is already
       congested, which is what shows up at the other end as
 
         communicator INFO Transmission failed, queue no longer exists.
 
       repeating at scheduler speed, and (because the service is busy
       servicing that loop) as
 
         communicator WARNING Dropping message: transport is too slow,
                              queue length N exceeded
 
       on every *other* communicator.  Treat the failure as the queue
       teardown it is and stop selecting this queue. */
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Communicator could not send MID %" PRIu64
                " on QID %u to %s; dropping that queue\n",
                GNUNET_ntohll (sma->mid),
                ntohl (sma->qid),
                GNUNET_i2s (&sma->receiver));
    GNUNET_STATISTICS_update (GST_stats,
                              "# queues dropped (communicator send failed)",
                              1,
                              GNUNET_NO);
    if (NULL != qe)
      failed_queue = qe->queue;
    else
      for (struct Queue *queue = tc->details.communicator.queue_head;
           NULL != queue;
           queue = queue->next_client)
        if ((ntohl (sma->qid) == queue->qid) &&
            (0 == GNUNET_memcmp (&queue->neighbour->pid, &sma->receiver)))
        {
          failed_queue = queue;
          break;
        }
    if (NULL != failed_queue)
    {
      /* #free_queue() releases every `struct QueueEntry' still on it --
         including @a qe -- and detaches their pending messages, so they are
         retried on whatever other queue this neighbour has. */
      free_queue (failed_queue);
      GNUNET_SERVICE_client_continue (tc->client);
      return;
    }
  }
  if (NULL == qe)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "No QueueEntry found for Ack MID %" PRIu64 " QID: %u\n",
                GNUNET_ntohll (sma->mid),
                ntohl (sma->qid));
    // TODO I guess this can happen, if the Ack from the peer comes before the Ack from the queue.
    // Update: Maybe QueueEntry was accidentally freed during freeing PendingMessage.
    /* this should never happen */
    // GNUNET_break (0);
    // GNUNET_SERVICE_client_drop (tc->client);
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  free_queue_entry (qe, tc);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_burst_finished (void *cls,
                       const struct GNUNET_TRANSPORT_BurstFinished *bf)
{
  struct TransportClient *tc = cls;
 
  (void) bf;
  burst_running = GNUNET_NO;
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
notify_client_queues (void *cls,
                      const struct GNUNET_PeerIdentity *pid,
                      void *value)
{
  struct TransportClient *tc = cls;
  struct Neighbour *neighbour = value;
 
  GNUNET_assert (CT_MONITOR == tc->type);
  for (struct Queue *q = neighbour->queue_head; NULL != q;
       q = q->next_neighbour)
  {
    struct MonitorEvent me = { .rtt = q->pd.aged_rtt,
                               .cs = q->cs,
                               .num_msg_pending = q->num_msg_pending,
                               .num_bytes_pending = q->num_bytes_pending };
 
    notify_monitor (tc, pid, q->address, q->nt, &me);
  }
  return GNUNET_OK;
}
 
 
static void
handle_monitor_start (void *cls,
                      const struct GNUNET_TRANSPORT_MonitorStart *start)
{
  struct TransportClient *tc = cls;
 
  if (CT_NONE != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  tc->type = CT_MONITOR;
  tc->details.monitor.peer = start->peer;
  tc->details.monitor.one_shot = ntohl (start->one_shot);
  GNUNET_CONTAINER_multipeermap_iterate (neighbours, &notify_client_queues, tc);
  GNUNET_SERVICE_client_mark_monitor (tc->client);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
struct LinkListContext
{
  struct TransportClient *tc;
 
  int include_unconfirmed;
};
 
 
static char *
communicator_list (struct Neighbour *n,
                   unsigned int *num_queues)
{
  char *ret = GNUNET_strdup ("");
 
  *num_queues = 0;
  if (NULL == n)
    return ret;
  for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
  {
    const char *prefix = q->tc->details.communicator.address_prefix;
    size_t plen = strlen (prefix);
    const char *pos;
    char *tmp;
 
    (*num_queues)++;
    if (0 == plen)
      continue;
    /* Several queues to one neighbour routinely share a communicator;
       name each one once. */
    for (pos = strstr (ret, prefix);
         NULL != pos;
         pos = strstr (pos + 1, prefix))
      if (((pos == ret) || (',' == pos[-1])) &&
          (('\0' == pos[plen]) || (',' == pos[plen])))
        break;
    if (NULL != pos)
      continue;
    GNUNET_asprintf (&tmp, "%s%s%s", ret, ('\0' == ret[0]) ? "" : ",", prefix);
    GNUNET_free (ret);
    ret = tmp;
  }
  return ret;
}
 
 
static enum GNUNET_GenericReturnValue
report_link (void *cls, const struct GNUNET_PeerIdentity *pid, void *value)
{
  struct LinkListContext *llc = cls;
  struct VirtualLink *vl = value;
  struct GNUNET_TRANSPORT_LinkListResponse *resp;
  struct GNUNET_MQ_Envelope *env;
  unsigned int pending = 0;
  unsigned int num_queues = 0;
  unsigned int distance = 0;
  struct Neighbour *hop;
  char *ccs;
  size_t clen;
 
  if ((GNUNET_YES != llc->include_unconfirmed) &&
      (GNUNET_YES != vl->confirmed))
    return GNUNET_OK;
  for (struct PendingMessage *pm = vl->pending_msg_head;
       NULL != pm;
       pm = pm->next_vl)
    pending++;
  if (NULL != vl->n)
  {
    hop = vl->n;
  }
  else
  {
    /* Report the best (shortest) of the paths we currently know, and the
       communicators that carry its first hop. */
    struct DistanceVectorHop *best = NULL;
 
    distance = UINT_MAX;
    if (NULL != vl->dv)
      for (struct DistanceVectorHop *pos = vl->dv->dv_head;
           NULL != pos;
           pos = pos->next_dv)
        if (pos->distance < distance)
        {
          distance = pos->distance;
          best = pos;
        }
    if (NULL == best)
      distance = 0;   /* no paths left; report the link as adjacent */
    hop = (NULL != best) ? best->next_hop : NULL;
  }
  ccs = communicator_list (hop, &num_queues);
  clen = strlen (ccs) + 1;
  env = GNUNET_MQ_msg_extra (resp,
                             clen,
                             GNUNET_MESSAGE_TYPE_TRANSPORT_LINK_LIST_RESPONSE);
  memcpy (&resp[1], ccs, clen);
  GNUNET_free (ccs);
  resp->target = *pid;
  resp->confirmed = htonl ((uint32_t) vl->confirmed);
  resp->route = htonl ((uint32_t) ((NULL != vl->n)
                                   ? GNUNET_TRANSPORT_LINK_ROUTE_DIRECT
                                   : GNUNET_TRANSPORT_LINK_ROUTE_DV));
  resp->distance = htonl ((uint32_t) distance);
  resp->num_queues = htonl ((uint32_t) num_queues);
  resp->core_recv_window = htonl ((int32_t) vl->core_recv_window);
  resp->stalled = htonl ((uint32_t) vl->cmc_count);
  resp->pending = htonl (pending);
  resp->fc_retransmit_count = htonl ((uint32_t) vl->fc_retransmit_count);
  resp->available_fc_window_size
    = GNUNET_htonll (vl->available_fc_window_size);
  resp->incoming_fc_window_size_ram
    = GNUNET_htonll (vl->incoming_fc_window_size_ram);
  resp->incoming_fc_window_size
    = GNUNET_htonll (vl->incoming_fc_window_size);
  resp->incoming_fc_window_size_used
    = GNUNET_htonll (vl->incoming_fc_window_size_used);
  resp->incoming_fc_window_size_loss
    = GNUNET_htonll ((uint64_t) vl->incoming_fc_window_size_loss);
  resp->outbound_fc_window_size
    = GNUNET_htonll (vl->outbound_fc_window_size);
  resp->outbound_fc_window_size_used
    = GNUNET_htonll (vl->outbound_fc_window_size_used);
  resp->last_fc_rtt = GNUNET_TIME_relative_hton (vl->last_fc_rtt);
  resp->other_rtt = GNUNET_TIME_relative_hton (vl->other_rtt);
  resp->last_fc_transmission
    = GNUNET_TIME_absolute_hton (vl->last_fc_transmission);
  GNUNET_MQ_send (llc->tc->mq, env);
  return GNUNET_OK;
}
 
 
static void
handle_link_list_request (
  void *cls,
  const struct GNUNET_TRANSPORT_LinkListRequest *lr)
{
  struct TransportClient *tc = cls;
  struct LinkListContext llc = {
    .tc = tc,
    .include_unconfirmed = (int) ntohl (lr->include_unconfirmed)
  };
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_MessageHeader *end;
 
  if (CT_NONE != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  if (GNUNET_YES == GNUNET_is_zero (&lr->peer))
  {
    GNUNET_CONTAINER_multipeermap_iterate (links, &report_link, &llc);
  }
  else
  {
    struct VirtualLink *vl = lookup_virtual_link (&lr->peer);
 
    if (NULL != vl)
      report_link (&llc, &lr->peer, vl);
  }
  env = GNUNET_MQ_msg (end,
                       GNUNET_MESSAGE_TYPE_TRANSPORT_LINK_LIST_RESPONSE_END);
  GNUNET_MQ_send (tc->mq, env);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static struct TransportClient *
lookup_communicator (const char *prefix)
{
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    if (CT_COMMUNICATOR != tc->type)
      continue;
    if (NULL == tc->details.communicator.address_prefix)
      continue;   /* receive-only communicator */
    if (0 == strcmp (prefix, tc->details.communicator.address_prefix))
      return tc;
  }
  GNUNET_log (
    GNUNET_ERROR_TYPE_DEBUG,
    "Someone suggested use of communicator for `%s', but we do not have such a communicator!\n",
    prefix);
  return NULL;
}
 
 
static void
suggest_to_connect (const struct GNUNET_PeerIdentity *pid, const char *address)
{
  static uint32_t idgen = 0;
  struct TransportClient *tc;
  char *prefix;
  struct GNUNET_TRANSPORT_CreateQueue *cqm;
  struct GNUNET_MQ_Envelope *env;
  size_t alen;
 
  prefix = GNUNET_HELLO_address_to_prefix (address);
  if (NULL == prefix)
  {
    GNUNET_break (0);  /* We got an invalid address!? */
    return;
  }
  tc = lookup_communicator (prefix);
  if (NULL == tc)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# Suggestions ignored due to missing communicator",
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Cannot connect to %s at `%s', no matching communicator present\n",
                GNUNET_i2s (pid),
                address);
    GNUNET_free (prefix);
    return;
  }
  /* forward suggestion for queue creation to communicator */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Request #%u for `%s' communicator to create queue to `%s' at `%s'\n",
              (unsigned int) idgen,
              prefix,
              GNUNET_i2s (pid),
              address);
  GNUNET_free (prefix);
  alen = strlen (address) + 1;
  env =
    GNUNET_MQ_msg_extra (cqm, alen, GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_CREATE);
  cqm->request_id = htonl (idgen++);
  cqm->receiver = *pid;
  memcpy (&cqm[1], address, alen);
  GNUNET_MQ_send (tc->mq, env);
}
 
 
static void
validation_transmit_on_queue (struct Queue *q, struct ValidationState *vs)
{
  struct TransportValidationChallengeMessage tvc;
  struct GNUNET_TIME_Absolute monotonic_time;
 
  if (NULL != vs->revalidation_task)
  {
    GNUNET_SCHEDULER_cancel (vs->revalidation_task);
    vs->revalidation_task = NULL;
  }
  /*memcpy (&hkey,
          &hc,
          sizeof (hkey));*/
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Remove key %s for address %s map size %u contains %u\n",
              GNUNET_h2s (&vs->hc),
              vs->address,
              GNUNET_CONTAINER_multihashmap_size (revalidation_map),
              GNUNET_CONTAINER_multihashmap_contains (revalidation_map,
                                                      &vs->hc));
  GNUNET_CONTAINER_multihashmap_remove (revalidation_map, &vs->hc, vs);
 
  monotonic_time  = GNUNET_TIME_absolute_get_monotonic (GST_cfg);
  if (GNUNET_TIME_UNIT_ZERO_ABS.abs_value_us ==
      vs->last_challenge_use.abs_value_us)
  {
    vs->first_challenge_use = monotonic_time;
  }
  vs->last_challenge_use = monotonic_time;
  tvc.header.type =
    htons (GNUNET_MESSAGE_TYPE_TRANSPORT_ADDRESS_VALIDATION_CHALLENGE);
  tvc.header.size = htons (sizeof(tvc));
  tvc.reserved = htonl (0);
  tvc.challenge = vs->challenge;
  tvc.sender_time = GNUNET_TIME_absolute_hton (vs->last_challenge_use);
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
              "Sending address validation challenge %s to %s\n",
              GNUNET_sh2s (&tvc.challenge.value),
              GNUNET_i2s (&q->neighbour->pid));
  queue_send_msg (q, NULL, &tvc, sizeof(tvc));
}
 
 
static struct GNUNET_TIME_Relative
validation_challenge_freq (const struct GNUNET_PeerIdentity *pid)
{
  const struct VirtualLink *vl = lookup_virtual_link (pid);
 
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
    return MAX_VALIDATION_CHALLENGE_FREQ;   /* we have what we want */
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    if (CT_APPLICATION != tc->type)
      continue;
    if (NULL != GNUNET_CONTAINER_multipeermap_get (
          tc->details.application.requests,
          pid))
      return WANTED_VALIDATION_CHALLENGE_FREQ;
  }
  return MAX_VALIDATION_CHALLENGE_FREQ;
}
 
 
static void
validation_start_cb (void *cls)
{
  struct ValidationState *vs;
  struct Queue *q;
  const struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get_monotonic (
    GST_cfg);
 
  (void) cls;
  validation_task = NULL;
  vs = GNUNET_CONTAINER_heap_peek (validation_heap);
  /* drop validations past their expiration */
  while (
    (NULL != vs) &&
    (0 == GNUNET_TIME_absolute_get_remaining (vs->valid_until).rel_value_us))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Validation response %s cleaned up\n",
                GNUNET_sh2s (&vs->challenge.value));
    free_validation_state (vs);
    vs = GNUNET_CONTAINER_heap_peek (validation_heap);
  }
  if (NULL == vs)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Address validation task not scheduled anymore, nothing to do\n");
    return;   /* woopsie, no more addresses known, should only
                 happen if we're really a lonely peer */
  }
  q = find_queue (&vs->pid, vs->address);
  if (GNUNET_TIME_absolute_cmp (vs->first_challenge_use, >, now))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "To early to start next address validation for challenge %s\n",
                GNUNET_sh2s (&vs->challenge.value));
    /* Do NOT just return: @e validation_task was set to NULL above and
       nothing re-arms it by itself.  #update_next_challenge_time() only
       schedules us again when it is called with a *changed* time for some
       validation state, so bailing out here leaves a non-empty
       #validation_heap with no task attached: address (re)validation and
       the #suggest_to_connect() retries that go with it stop for *every*
       peer until some unrelated event happens to come along.  A peer that
       just lost its only connection has no such events left. */
    validation_task =
      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_absolute_get_difference (
                                      now,
                                      vs->first_challenge_use),
                                    &validation_start_cb,
                                    NULL);
    return;
  }
  if (NULL == q)
  {
    vs->awaiting_queue = GNUNET_YES;
    suggest_to_connect (&vs->pid, vs->address);
  }
  else
    validation_transmit_on_queue (q, vs);
  /* Finally, reschedule next attempt */
  vs->challenge_backoff =
    GNUNET_TIME_randomized_backoff (vs->challenge_backoff,
                                    validation_challenge_freq (&vs->pid));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Address validation task will run again in %s\n",
              GNUNET_STRINGS_relative_time_to_string (vs->challenge_backoff,
                                                      GNUNET_YES));
  update_next_challenge_time (vs,
                              GNUNET_TIME_relative_to_absolute (
                                vs->challenge_backoff));
}
 
 
struct QueueQualityContext
{
  struct Queue *q;
 
  unsigned int quality_count;
 
  unsigned int num_queues;
 
  unsigned int k;
};
 
 
static int
check_connection_quality (void *cls,
                          const struct GNUNET_PeerIdentity *pid,
                          void *value)
{
  struct QueueQualityContext *ctx = cls;
  struct Neighbour *n = value;
  int do_inc;
 
  (void) pid;
  do_inc = GNUNET_NO;
  for (struct Queue *q = n->queue_head; NULL != q; q = q->next_neighbour)
  {
    ctx->num_queues++;
    if (0 == ctx->k--)
      ctx->q = q;
    /* FIXME-CONQ-STATISTICS: in the future, add reliability / goodput
       statistics and consider those as well here? */
    if (q->pd.aged_rtt.rel_value_us < DV_QUALITY_RTT_THRESHOLD.rel_value_us)
      do_inc = GNUNET_YES;
  }
  if (GNUNET_YES == do_inc)
    ctx->quality_count++;
  return GNUNET_OK;
}
 
 
static void
start_dv_learn (void *cls);
 
 
static void
transmit_dv_init (struct TransportDVLearnMessage dvl,
                  struct LearnLaunchEntry *lle,
                  struct QueueQualityContext qqc)
{
  if (0 == qqc.num_queues)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# DV learn aborted: no queue left",
                              1,
                              GNUNET_NO);
    return;
  }
  qqc.quality_count = 0;
  qqc.k = GNUNET_CRYPTO_random_u32 (qqc.num_queues);
  qqc.num_queues = 0;
  qqc.q = NULL;
  GNUNET_CONTAINER_multipeermap_iterate (neighbours,
                                         &check_connection_quality,
                                         &qqc);
  if (NULL == qqc.q)
  {
    GNUNET_STATISTICS_update (GST_stats,
                              "# DV learn aborted: no queue left",
                              1,
                              GNUNET_NO);
    return;
  }
 
  /* Do this as close to transmission time as possible! */
  lle->launch_time = GNUNET_TIME_absolute_get ();
 
  queue_send_msg (qqc.q, NULL, &dvl, sizeof(dvl));
  /* reschedule this job, randomizing the time it runs (but no
     actual backoff!) */
  if (NULL != dvlearn_task)
    GNUNET_SCHEDULER_cancel (dvlearn_task);
  dvlearn_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_randomize (
                                                 DV_LEARN_BASE_FREQUENCY),
                                               &start_dv_learn,
                                               NULL);
}
 
 
static void
start_dv_learn (void *cls)
{
  struct LearnLaunchEntry *lle;
  struct QueueQualityContext qqc;
  struct TransportDVLearnMessage dvl;
  const struct GNUNET_PeerIdentity *my_identity;
 
  (void) cls;
  dvlearn_task = NULL;
  if ((GNUNET_YES == in_shutdown) || (NULL == pils))
    return;
  if (0 == GNUNET_CONTAINER_multipeermap_size (neighbours))
    return; /* lost all connectivity, cannot do learning */
  my_identity = GNUNET_PILS_get_identity (pils);
  if (NULL == my_identity)
  {
    /* PILS has not handed us an identity yet.  The first queue arriving
       schedules us with add_now(), which routinely wins that race; retry
       instead of taking the service down. */
    dvlearn_pils_backoff = GNUNET_TIME_STD_BACKOFF (dvlearn_pils_backoff);
    dvlearn_task = GNUNET_SCHEDULER_add_delayed (dvlearn_pils_backoff,
                                                 &start_dv_learn,
                                                 NULL);
    return;
  }
  dvlearn_pils_backoff = GNUNET_TIME_UNIT_ZERO;
  qqc.quality_count = 0;
  qqc.num_queues = 0;
  qqc.k = GNUNET_CONTAINER_multipeermap_size (neighbours);
  GNUNET_CONTAINER_multipeermap_iterate (neighbours,
                                         &check_connection_quality,
                                         &qqc);
  if (qqc.quality_count > DV_LEARN_QUALITY_THRESHOLD)
  {
    struct GNUNET_TIME_Relative delay;
    unsigned int factor;
 
    /* scale our retries by how far we are above the threshold */
    factor = qqc.quality_count / DV_LEARN_QUALITY_THRESHOLD;
    delay = GNUNET_TIME_relative_multiply (DV_LEARN_BASE_FREQUENCY, factor);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "At connection quality %u, will launch DV learn in %s\n",
                qqc.quality_count,
                GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_YES));
    dvlearn_task = GNUNET_SCHEDULER_add_delayed (delay, &start_dv_learn, NULL);
    return;
  }
  /* remove old entries in #dvlearn_map if it has grown too big */
  while (MAX_DV_LEARN_PENDING <=
         GNUNET_CONTAINER_multishortmap_size (dvlearn_map))
  {
    lle = lle_tail;
    GNUNET_assert (GNUNET_YES ==
                   GNUNET_CONTAINER_multishortmap_remove (dvlearn_map,
                                                          &lle->challenge.value,
                                                          lle));
    GNUNET_CONTAINER_DLL_remove (lle_head, lle_tail, lle);
    GNUNET_free (lle);
  }
  /* setup data structure for learning */
  lle = GNUNET_new (struct LearnLaunchEntry);
  GNUNET_CRYPTO_random_block (&lle->challenge,
                              sizeof(lle->challenge));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Starting launch DV learn with challenge %s\n",
              GNUNET_sh2s (&lle->challenge.value));
  GNUNET_CONTAINER_DLL_insert (lle_head, lle_tail, lle);
  GNUNET_break (GNUNET_YES ==
                GNUNET_CONTAINER_multishortmap_put (
                  dvlearn_map,
                  &lle->challenge.value,
                  lle,
                  GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  dvl.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_DV_LEARN);
  dvl.header.size = htons (sizeof(dvl));
  dvl.num_hops = htons (0);
  dvl.bidirectional = htons (0);
  dvl.non_network_delay = GNUNET_TIME_relative_hton (GNUNET_TIME_UNIT_ZERO);
  dvl.monotonic_time =
    GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get_monotonic (GST_cfg));
  // We will set the below again later
  memset (&dvl.init_sig, 0, sizeof dvl.init_sig);
  dvl.challenge = lle->challenge;
  dvl.initiator = *my_identity;
  {
    struct DvInitPS dvip = {
      .purpose.purpose = htonl (
        GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_INITIATOR),
      .purpose.size = htonl (sizeof(dvip)),
      .monotonic_time = dvl.monotonic_time,
      .challenge = lle->challenge
    };
 
    if (GNUNET_OK != sign_by_my_identity (&dvip.purpose, &dvl.init_sig))
      return;
  }
  transmit_dv_init (dvl, lle, qqc);
}
 
 
static char *
get_address_without_port (const char *address)
{
  const char *dash;
  const char *colon;
 
  if (NULL == address)
    return NULL;
  dash = strchr (address, '-');
  if (NULL == dash)
    return NULL;
  colon = strchr (dash, ':');
  if (NULL == colon)
    return NULL;
  return GNUNET_strndup (dash + 1,
                         colon - (dash + 1));
}
 
 
static int
check_validation_request_pending (void *cls,
                                  const struct GNUNET_PeerIdentity *pid,
                                  void *value)
{
  struct Queue *q = cls;
  struct ValidationState *vs = value;
  char *address_without_port_vs;
  char *address_without_port_q;
  char *prefix_vs;
  char *prefix_q;
  int success = GNUNET_YES;
 
  // TODO Check if this is really necessary.
  address_without_port_vs = get_address_without_port (vs->address);
  address_without_port_q = get_address_without_port (q->address);
  prefix_vs = GNUNET_HELLO_address_to_prefix (vs->address);
  prefix_q = GNUNET_HELLO_address_to_prefix (q->address);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Check validation request pending for `%s' at `%s'/`%s' (vs)/(q)\n",
              GNUNET_i2s (pid),
              (NULL == address_without_port_vs) ? "<unparsable>"
              : address_without_port_vs,
              (NULL == address_without_port_q) ? "<unparsable>"
              : address_without_port_q);
  (void) pid;
  /* Only the port may differ: the address we asked to connect to is
     `PROTO-IP:0' for a NATed peer, while the queue that then materializes
     sits at `PROTO-IP:port'.  The communicator must match all the same --
     a challenge for a `tcp-' address is not answered by a `udp-' queue. */
  if ((GNUNET_YES == vs->awaiting_queue) &&
      (NULL != address_without_port_vs) &&
      (NULL != address_without_port_q) &&
      (NULL != prefix_vs) &&
      (NULL != prefix_q) &&
      (0 == strcmp (prefix_vs, prefix_q)) &&
      (0 == strcmp (address_without_port_vs, address_without_port_q)))
  {
 
    vs->awaiting_queue = GNUNET_NO;
    validation_transmit_on_queue (q, vs);
    success = GNUNET_NO;
  }
 
  GNUNET_free (address_without_port_vs);
  GNUNET_free (address_without_port_q);
  GNUNET_free (prefix_vs);
  GNUNET_free (prefix_q);
  return success;
}
 
 
static void
neighbour_dv_monotime_cb (void *cls,
                          const struct GNUNET_PEERSTORE_Record *record,
                          const char *emsg)
{
  struct Neighbour *n = cls;
  struct GNUNET_TIME_AbsoluteNBO *mtbe;
 
  (void) emsg;
  if (NULL == record)
  {
    /* we're done with #neighbour_dv_monotime_cb() invocations,
       continue normal processing */
    n->get = NULL;
    n->dv_monotime_available = GNUNET_YES;
    return;
  }
  if (0 == record->value_size)
  {
    GNUNET_PEERSTORE_iteration_next (n->get, 1);
    GNUNET_break (0);
    return;
  }
  mtbe = record->value;
  n->last_dv_learn_monotime =
    GNUNET_TIME_absolute_max (n->last_dv_learn_monotime,
                              GNUNET_TIME_absolute_ntoh (*mtbe));
  GNUNET_PEERSTORE_iteration_next (n->get, 1);
}
 
 
static void
iterate_address_and_compare_cb (void *cls,
                                const struct GNUNET_PeerIdentity *pid,
                                const char *uri)
{
  struct Queue *queue = cls;
  struct sockaddr_in v4;
  const char *slash;
  char *address_uri;
  char *prefix;
  char *uri_without_port;
  char *address_uri_without_port;
 
  slash = strrchr (uri, '/');
  if ((NULL == slash) || (slash - uri < 2))
  {
    GNUNET_break_op (0);   /* @a uri comes from a remote HELLO */
    return;
  }
  prefix = GNUNET_strndup (uri, (slash - uri) - 2);
  slash++;
  GNUNET_asprintf (&address_uri,
                   "%s-%s",
                   prefix,
                   slash);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "1 not global natted_address %u %s %s %s\n",
              queue->is_global_natted,
              uri,
              queue->address,
              slash);
 
  uri_without_port = get_address_without_port (address_uri);
  if ((NULL == uri_without_port) ||
      (1 != inet_pton (AF_INET, uri_without_port, &v4.sin_addr)))
  {
    GNUNET_free (prefix);
    GNUNET_free (address_uri);
    GNUNET_free (uri_without_port);
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "2 not global natted_address %u %s %s\n",
              queue->is_global_natted,
              uri,
              queue->address);
 
  if (GNUNET_NO == queue->is_global_natted)
  {
    GNUNET_free (prefix);
    GNUNET_free (address_uri);
    GNUNET_free (uri_without_port);
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "3 not global natted_address %u %s %s\n",
              queue->is_global_natted,
              uri,
              queue->address);
 
  if (0 == strcmp (uri_without_port, address_uri))
  {
    GNUNET_free (prefix);
    GNUNET_free (address_uri);
    GNUNET_free (uri_without_port);
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "4 not global natted_address %u %s %s\n",
              queue->is_global_natted,
              uri,
              queue->address);
 
  address_uri_without_port = get_address_without_port (queue->address);
  if ((NULL != address_uri_without_port) &&
      (0 == strcmp (uri_without_port, address_uri_without_port)))
  {
    queue->is_global_natted = GNUNET_NO;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "not global natted_address %u %s %s %s %s %s %u\n",
              queue->is_global_natted,
              uri,
              queue->address,
              uri_without_port,
              address_uri_without_port,
              prefix,
              GNUNET_NO);
  GNUNET_free (prefix);
  GNUNET_free (address_uri);
  GNUNET_free (address_uri_without_port);
  GNUNET_free (uri_without_port);
}
 
 
struct TransportGlobalNattedAddressClosure
{
  char *addr;
 
  struct TransportGlobalNattedAddress *tgna;
};
 
 
static enum GNUNET_GenericReturnValue
contains_address (void *cls,
                  const struct GNUNET_PeerIdentity *pid,
                  void *value)
{
  struct TransportGlobalNattedAddressClosure *tgna_cls = cls;
  struct TransportGlobalNattedAddress *tgna = value;
  char *addr = (char *) &tgna[1];
 
  /* NOTE: @a addr is NOT 0-terminated. */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Checking tgna %p with addr %.*s and length %u compare length %lu\n",
              tgna,
              (int) ntohl (tgna->address_length),
              addr,
              ntohl (tgna->address_length),
              strlen (tgna_cls->addr));
  if (strlen (tgna_cls->addr) == ntohl (tgna->address_length)
      && 0 == strncmp (addr, tgna_cls->addr, ntohl (tgna->address_length)))
  {
    tgna_cls->tgna = tgna;
    return GNUNET_NO;
  }
  return GNUNET_YES;
}
 
 
static void
check_for_global_natted_error_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Error in PEERSTORE monitoring for checking global natted\n");
}
 
 
static void
check_for_global_natted_sync_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Done with initial PEERSTORE iteration during monitoring  for checking global natted\n");
}
 
 
static void
check_for_global_natted (void *cls,
                         const struct GNUNET_PEERSTORE_Record *record,
                         const char *emsg)
{
  struct Queue *queue = cls;
  struct Neighbour *neighbour = queue->neighbour;
  struct GNUNET_HELLO_Parser *parser;
  const struct GNUNET_MessageHeader *hello;
  struct TransportGlobalNattedAddressClosure tgna_cls;
  size_t address_len_without_port;
 
  if (NULL != emsg)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Got failure from PEERSTORE: %s\n",
                emsg);
    GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
    return;
  }
  if (NULL == record)
  {
    GNUNET_break (0);
    GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
    return;
  }
  /* @a hello was published by a remote peer and may be malformed. */
  hello = hello_from_record (record);
  if (NULL == hello)
  {
    GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
    return;
  }
  queue->is_global_natted = GNUNET_YES;
  parser = GNUNET_HELLO_parser_from_msg (hello, &record->peer);
  if (NULL == parser)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "HELLO cannot be parsed!\n");
    GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "before not global natted %u\n",
              queue->is_global_natted);
  GNUNET_HELLO_parser_iterate (parser,
                               &iterate_address_and_compare_cb,
                               queue);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "after not global natted %u\n",
              queue->is_global_natted);
  GNUNET_HELLO_parser_free (parser);
 
  tgna_cls.addr = get_address_without_port (queue->address);
  if (NULL == tgna_cls.addr)
  {
    GNUNET_break (0);
    GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
    return;
  }
  address_len_without_port = strlen (tgna_cls.addr);
  /*{
    char buf[address_len_without_port + 1];
 
      GNUNET_memcpy (&buf, addr, address_len_without_port);
      buf[address_len_without_port] = '\0';
      GNUNET_free (addr);
      GNUNET_memcpy (tgna_cls.addr, buf, address_len_without_port + 1);
      }*/
  tgna_cls.tgna = NULL;
  GNUNET_CONTAINER_multipeermap_get_multiple (neighbour->natted_addresses,
                                              &neighbour->pid,
                                              &contains_address,
                                              &tgna_cls);
  if (NULL != tgna_cls.tgna)
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                " tgna_cls.tgna tgna %p %lu %u %u\n",
                tgna_cls.tgna,
                neighbour->size_of_global_addresses,
                ntohl (tgna_cls.tgna->address_length),
                neighbour->number_of_addresses);
  if (NULL == tgna_cls.tgna && GNUNET_YES == queue->is_global_natted)
  {
    struct TransportGlobalNattedAddress *tgna;
 
    tgna = GNUNET_malloc (sizeof (struct TransportGlobalNattedAddress)
                          + address_len_without_port);
    tgna->address_length = htonl (address_len_without_port);
    GNUNET_memcpy (&tgna[1], tgna_cls.addr, address_len_without_port);
    GNUNET_CONTAINER_multipeermap_put (neighbour->natted_addresses,
                                       &neighbour->pid,
                                       tgna,
                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
    neighbour->number_of_addresses++;
    /* MUST match what is subtracted on removal (and what
       #add_global_addresses() actually copies), or the accounting drifts. */
    neighbour->size_of_global_addresses += address_len_without_port;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Created tgna %p with address %s and length %lu\n",
                tgna,
                tgna_cls.addr,
                address_len_without_port + 1);
  }
  else if (NULL != tgna_cls.tgna && GNUNET_NO == queue->is_global_natted)
  {
    GNUNET_CONTAINER_multipeermap_remove (neighbour->natted_addresses,
                                          &neighbour->pid,
                                          tgna_cls.tgna);
    GNUNET_assert (neighbour->size_of_global_addresses >= ntohl (tgna_cls.tgna->
                                                                 address_length)
                   );
    neighbour->size_of_global_addresses -= ntohl (tgna_cls.tgna->address_length)
    ;
    GNUNET_assert (0 < neighbour->number_of_addresses);
    neighbour->number_of_addresses--;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "removed tgna %p\n",
                tgna_cls.tgna);
    GNUNET_free (tgna_cls.tgna);
  }
  GNUNET_PEERSTORE_monitor_next (queue->mo, 1);
  GNUNET_free (tgna_cls.addr);
}
 
 
static void
handle_add_queue_message (void *cls,
                          const struct GNUNET_TRANSPORT_AddQueueMessage *aqm)
{
  struct TransportClient *tc = cls;
  struct Queue *queue;
  struct Neighbour *neighbour;
  const char *addr;
  uint16_t addr_len;
 
  if (ntohl (aqm->mtu) <= sizeof(struct TransportFragmentBoxMessage))
  {
    /* MTU so small as to be useless for transmissions,
       required for #fragment_message()! */
    GNUNET_break_op (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  /* This may simply be a queue update.  Match on the peer as well as the
     QID: the communicator's key for a queue is the pair, and
     #handle_send_msg() on its side looks both of them up.  Matching on the
     QID alone let an ADD_QUEUE for a *different* peer be folded into an
     existing queue, leaving @e neighbour pointing at the old peer -- after
     which every SEND_MSG we put on it carries a receiver the communicator
     cannot match, and comes straight back as "queue no longer exists". */
  for (queue = tc->details.communicator.queue_head;
       NULL != queue;
       queue = queue->next_client)
  {
    if (queue->qid != ntohl (aqm->qid))
      continue;
    if (0 != GNUNET_memcmp (&queue->neighbour->pid, &aqm->receiver))
      continue;
    break;
  }
 
  if (NULL != queue)
  {
    neighbour = queue->neighbour;
  }
  else
  {
    struct GNUNET_TIME_Absolute validated_until = GNUNET_TIME_UNIT_ZERO_ABS;
 
    neighbour = lookup_neighbour (&aqm->receiver);
    if (NULL == neighbour)
    {
      neighbour = GNUNET_new (struct Neighbour);
      neighbour->natted_addresses = GNUNET_CONTAINER_multipeermap_create (16,
                                                                          GNUNET_YES);
      neighbour->pid = aqm->receiver;
      /* Give a fresh neighbour a full window to say something. */
      neighbour->last_inbound = GNUNET_TIME_absolute_get ();
      GNUNET_assert (GNUNET_OK ==
                     GNUNET_CONTAINER_multipeermap_put (
                       neighbours,
                       &neighbour->pid,
                       neighbour,
                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
      neighbour->get =
        GNUNET_PEERSTORE_iteration_start (peerstore,
                                          "transport",
                                          &neighbour->pid,
                                          GNUNET_PEERSTORE_TRANSPORT_DVLEARN_MONOTIME,
                                          &neighbour_dv_monotime_cb,
                                          neighbour);
    }
    addr_len = ntohs (aqm->header.size) - sizeof(*aqm);
    addr = (const char *) &aqm[1];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "New queue %s to %s available with QID %u and q_len %" PRIu64
                " and mtu %u\n",
                addr,
                GNUNET_i2s (&aqm->receiver),
                ntohl (aqm->qid),
                GNUNET_ntohll (aqm->q_len),
                ntohl (aqm->mtu));
    queue = GNUNET_malloc (sizeof(struct Queue) + addr_len);
    queue->tc = tc;
    for (struct Queue *q = neighbour->queue_head; NULL != q; q = q->
                                                                 next_neighbour)
      validated_until = GNUNET_TIME_absolute_max (validated_until, q->
                                                  validated_until);
    /* Inherit the validity of the sibling queues, but only while it is
       still in the future -- copying an already expired timestamp is
       pointless (and the condition used to be inverted). */
    if (0 != GNUNET_TIME_absolute_get_remaining (validated_until).rel_value_us)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "New queue with QID %u inherit validated until\n",
                  ntohl (aqm->qid));
      queue->validated_until = validated_until;
    }
    queue->address = (const char *) &queue[1];
    queue->pd.aged_rtt = GNUNET_TIME_UNIT_FOREVER_REL;
    queue->qid = ntohl (aqm->qid);
    queue->neighbour = neighbour;
    if (GNUNET_TRANSPORT_QUEUE_LENGTH_UNLIMITED == GNUNET_ntohll (aqm->q_len))
      queue->unlimited_length = GNUNET_YES;
    queue->q_capacity = GNUNET_ntohll (aqm->q_len);
    memcpy (&queue[1], addr, addr_len);
    /* notify monitors about new queue */
    {
      struct MonitorEvent me = { .rtt = queue->pd.aged_rtt, .cs = queue->cs };
 
      notify_monitors (&neighbour->pid, queue->address, queue->nt, &me);
    }
    GNUNET_CONTAINER_MDLL_insert (neighbour,
                                  neighbour->queue_head,
                                  neighbour->queue_tail,
                                  queue);
    GNUNET_CONTAINER_MDLL_insert (client,
                                  tc->details.communicator.queue_head,
                                  tc->details.communicator.queue_tail,
                                  queue);
 
  }
  queue->mtu = ntohl (aqm->mtu);
  queue->nt = ntohl (aqm->nt);
  queue->cs = ntohl (aqm->cs);
  queue->idle = GNUNET_YES;
 
  if (NULL == queue->mo)
  {
    /* Only for a NEW queue: on a queue update this used to start a second
       monitor and leak the first one. */
    struct sockaddr_in v4;
    char *addr_without = get_address_without_port (queue->address);
    if ((NULL != addr_without) &&
        (1 == inet_pton (AF_INET, addr_without, &v4.sin_addr)))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "start not global natted\n");
      queue->mo = GNUNET_PEERSTORE_monitor_start (GST_cfg,
                                                  GNUNET_YES,
                                                  "peerstore",
                                                  &neighbour->pid,
                                                  GNUNET_PEERSTORE_HELLO_KEY,
                                                  &
                                                  check_for_global_natted_error_cb,
                                                  NULL,
                                                  &
                                                  check_for_global_natted_sync_cb,
                                                  NULL,
                                                  &check_for_global_natted,
                                                  queue);
    }
    GNUNET_free (addr_without);
  }
  /* check if valdiations are waiting for the queue */
  if (GNUNET_YES == GNUNET_CONTAINER_multipeermap_contains (validation_map,
                                                            &aqm->receiver))
    (void) GNUNET_CONTAINER_multipeermap_get_multiple (
      validation_map,
      &aqm->receiver,
      &check_validation_request_pending,
      queue);
  /* Always (also) validate the address of the queue itself.  A pending
     validation served above may well be for a *different* address string:
     #check_validation_request_pending() matches on the IP only, so a
     validation state waiting for the NAT address `PROTO-IP:0' is happily
     satisfied by a queue at `PROTO-IP:12345'.  If we stopped here,
     #handle_validation_response() would later look for a queue at
     `PROTO-IP:0' -- which never exists -- and drop the successful
     validation on the floor without ever creating the virtual link.  That
     is exactly what happens to the second of two peers behind the same
     NAT, as both of them advertise the very same `PROTO-IP:0'. */
  start_address_validation (&aqm->receiver, queue->address);
  /* look for traffic for this queue */
  // TODO Check whether this makes any sense at all.
  /*schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
    queue, GNUNET_SCHEDULER_PRIORITY_DEFAULT);*/
  /* might be our first queue, try launching DV learning */
  if (NULL == dvlearn_task)
    dvlearn_task = GNUNET_SCHEDULER_add_now (&start_dv_learn, NULL);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_update_queue_message (void *cls,
                             const struct
                             GNUNET_TRANSPORT_UpdateQueueMessage *msg)
{
  struct TransportClient *tc = cls;
  struct Queue *target_queue = NULL;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    /* Without this we walk `details.communicator.queue_head' for a client
       whose union holds something else entirely. */
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received queue update message for %u with q_len %llu and mtu %u\n",
              ntohl (msg->qid),
              (unsigned long long) GNUNET_ntohll (msg->q_len),
              ntohl (msg->mtu));
  for (target_queue = tc->details.communicator.queue_head;
       NULL != target_queue;
       target_queue = target_queue->next_client)
  {
    if (ntohl (msg->qid) == target_queue->qid)
      break;
  }
  if (NULL == target_queue)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Queue to update no longer exists! Discarding update.\n");
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
 
  target_queue->nt = ntohl (msg->nt);
  target_queue->mtu = ntohl (msg->mtu);
  target_queue->cs = ntohl (msg->cs);
  target_queue->priority = ntohl (msg->priority);
  /* The update message indicates how many messages
   * the queue should be able to handle.
   */
  if (GNUNET_TRANSPORT_QUEUE_LENGTH_UNLIMITED == GNUNET_ntohll (msg->q_len))
    target_queue->unlimited_length = GNUNET_YES;
  else
    target_queue->unlimited_length = GNUNET_NO;
  target_queue->q_capacity += GNUNET_ntohll (msg->q_len);
  if (0 < target_queue->q_capacity)
    schedule_transmit_on_queue (GNUNET_TIME_UNIT_ZERO,
                                target_queue,
                                GNUNET_SCHEDULER_PRIORITY_DEFAULT);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_queue_create_ok (void *cls,
                        const struct GNUNET_TRANSPORT_CreateQueueResponse *cqr)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  GNUNET_STATISTICS_update (GST_stats,
                            "# Suggestions succeeded at communicator",
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Request #%u for communicator to create queue succeeded\n",
              (unsigned int) ntohs (cqr->request_id));
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_queue_create_fail (
  void *cls,
  const struct GNUNET_TRANSPORT_CreateQueueResponse *cqr)
{
  struct TransportClient *tc = cls;
 
  if (CT_COMMUNICATOR != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Request #%u for communicator to create queue failed\n",
              (unsigned int) ntohl (cqr->request_id));
  GNUNET_STATISTICS_update (GST_stats,
                            "# Suggestions failed in queue creation at communicator",
                            1,
                            GNUNET_NO);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
handle_suggest_cancel (void *cls, const struct ExpressPreferenceMessage *msg)
{
  struct TransportClient *tc = cls;
  struct PeerRequest *pr;
 
  if (CT_APPLICATION != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  pr = GNUNET_CONTAINER_multipeermap_get (tc->details.application.requests,
                                          &msg->peer);
  if (NULL == pr)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  (void) stop_peer_request (tc, &pr->pid, pr);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static void
hello_for_client_cb (void *cls,
                     const struct GNUNET_PeerIdentity *pid,
                     const char *uri)
{
  struct Queue *q;
  int pfx_len;
  const char *eou;
  char *address;
  (void) cls;
 
  eou = strstr (uri,
                "://");
  if ((NULL == eou) || (eou == uri))
  {
    /* @a uri comes from a HELLO some remote peer published. */
    GNUNET_break_op (0);
    return;
  }
  pfx_len = eou - uri;
  eou += 3;
  GNUNET_asprintf (&address,
                   "%.*s-%s",
                   pfx_len,
                   uri,
                   eou);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "hello for client %s\n",
              address);
 
  q = find_queue (pid, address);
  if (NULL == q)
  {
    suggest_to_connect (pid, address);
  }
  else
    start_address_validation (pid, address);
  GNUNET_free (address);
}
 
 
static void
handle_hello_for_client (void *cls,
                         const struct GNUNET_PEERSTORE_Record *record,
                         const char *emsg)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct PeerRequest *pr = cls;
  struct GNUNET_HELLO_Parser *parser;
  const struct GNUNET_MessageHeader *hello;
 
  if (NULL != emsg)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Got failure from PEERSTORE: %s\n",
                emsg);
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  if (NULL == record)
  {
    GNUNET_break (0);
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  my_identity = GNUNET_PILS_get_identity (pils);
  if (NULL == my_identity)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "No identity given yet!\n");
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  hello = hello_from_record (record);
  if (NULL == hello)
  {
    /* MUST still ask for the next record: a bad one is not a reason to
       stall this monitor forever. */
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  if (0 == GNUNET_memcmp (&record->peer, my_identity))
  {
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  parser = GNUNET_HELLO_parser_from_msg (hello, &record->peer);
  if (NULL == parser)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "HELLO cannot be parsed!\n");
    GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "HELLO for `%s' could be parsed, iterating addresses...!\n",
              GNUNET_i2s (GNUNET_HELLO_parser_get_id (parser)));
  GNUNET_HELLO_parser_iterate (parser,
                               hello_for_client_cb,
                               NULL);
  GNUNET_HELLO_parser_free (parser);
  /* MUST ask for the next record, or this monitor stalls after one HELLO */
  GNUNET_PEERSTORE_monitor_next (pr->nc, 1);
}
 
 
static void
hello_for_client_error_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Error in PEERSTORE monitoring\n");
}
 
 
static void
hello_for_client_sync_cb (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Done with initial PEERSTORE iteration during monitoring\n");
}
 
 
static void
start_peer_request_monitor (struct PeerRequest *pr)
{
  if (NULL != pr->nc)
    GNUNET_PEERSTORE_monitor_stop (pr->nc);
  /* Monitor only @e pid.  With NULL every application request sees every
     HELLO in PEERSTORE, so a client asking for one peer made us suggest a
     connection to -- and start an address validation for -- every peer we
     have ever heard of, once per request.  #try_to_bring_link_up() had the
     same bug and was already fixed the same way. */
  pr->nc =
    GNUNET_PEERSTORE_monitor_start (GST_cfg,
                                    GNUNET_YES,
                                    "peerstore",
                                    &pr->pid,
                                    GNUNET_PEERSTORE_HELLO_KEY,
                                    &hello_for_client_error_cb,
                                    NULL,
                                    &hello_for_client_sync_cb,
                                    NULL,
                                    &handle_hello_for_client,
                                    pr);
}
 
 
static void
suggest_retry_cb (void *cls)
{
  struct PeerRequest *pr = cls;
  struct VirtualLink *vl;
 
  pr->retry_task = NULL;
  vl = lookup_virtual_link (&pr->pid);
  if ((NULL != vl) && (GNUNET_YES == vl->confirmed))
  {
    /* The client has what it asked for.  Keep watching cheaply, and start
       over from the short interval when the link goes away again. */
    pr->retry_backoff = SUGGEST_RETRY_MIN;
    pr->retry_task = GNUNET_SCHEDULER_add_delayed (SUGGEST_RETRY_MAX,
                                                   &suggest_retry_cb,
                                                   pr);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Retrying to connect to %s, an application client wants it\n",
              GNUNET_i2s (&pr->pid));
  GNUNET_STATISTICS_update (GST_stats,
                            "# link setup retries for application clients",
                            1,
                            GNUNET_NO);
  /* Addresses we already track, queues we still have, and a fresh look in
     PEERSTORE. */
  try_to_bring_link_up (&pr->pid);
  /* ... plus a replay of what PEERSTORE has for this peer, which is the
     only way back once the validation state expired and the queues are
     gone. */
  start_peer_request_monitor (pr);
  pr->retry_backoff = GNUNET_TIME_randomized_backoff (pr->retry_backoff,
                                                      SUGGEST_RETRY_MAX);
  pr->retry_task = GNUNET_SCHEDULER_add_delayed (pr->retry_backoff,
                                                 &suggest_retry_cb,
                                                 pr);
}
 
 
static void
handle_suggest (void *cls, const struct ExpressPreferenceMessage *msg)
{
  struct TransportClient *tc = cls;
  const struct GNUNET_PeerIdentity *my_identity;
  struct PeerRequest *pr;
 
  if (CT_NONE == tc->type)
  {
    tc->type = CT_APPLICATION;
    tc->details.application.requests =
      GNUNET_CONTAINER_multipeermap_create (16, GNUNET_YES);
  }
  if (CT_APPLICATION != tc->type)
  {
    GNUNET_break (0);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  my_identity = GNUNET_PILS_get_identity (pils);
  if (NULL == my_identity)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Still waiting for own identity!\n");
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Client suggested we talk to %s with preference %d at rate %u\n",
              GNUNET_i2s (&msg->peer),
              (int) ntohl (msg->pk),
              (int) ntohl (msg->bw.value__));
  if (0 == GNUNET_memcmp (my_identity, &msg->peer))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Client suggested connection to ourselves, ignoring...\n");
    GNUNET_SERVICE_client_continue (tc->client);
    return;
  }
  pr = GNUNET_new (struct PeerRequest);
  pr->tc = tc;
  pr->pid = msg->peer;
  pr->bw = msg->bw;
  pr->pk = ntohl (msg->pk);
  if (GNUNET_YES != GNUNET_CONTAINER_multipeermap_put (
        tc->details.application.requests,
        &pr->pid,
        pr,
        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
  {
    GNUNET_break (0);
    GNUNET_free (pr);
    GNUNET_SERVICE_client_drop (tc->client);
    return;
  }
  start_peer_request_monitor (pr);
  /* The monitor alone only ever fires again if the HELLO *changes*.  Keep
     asking for the link ourselves for as long as the client wants it. */
  pr->retry_backoff = SUGGEST_RETRY_MIN;
  pr->retry_task = GNUNET_SCHEDULER_add_delayed (pr->retry_backoff,
                                                 &suggest_retry_cb,
                                                 pr);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
check_request_hello_validation (void *cls,
                                const struct RequestHelloValidationMessage *m)
{
  (void) cls;
  GNUNET_MQ_check_zero_termination (m);
  return GNUNET_OK;
}
 
 
static void
handle_request_hello_validation (void *cls,
                                 const struct RequestHelloValidationMessage *m)
{
  struct TransportClient *tc = cls;
  struct Queue *q;
 
  q = find_queue (&m->peer, (const char *) &m[1]);
  if (NULL == q)
  {
    suggest_to_connect (&m->peer, (const char *) &m[1]);
  }
  else
    start_address_validation (&m->peer, (const char *) &m[1]);
  GNUNET_SERVICE_client_continue (tc->client);
}
 
 
static int
free_neighbour_cb (void *cls,
                   const struct GNUNET_PeerIdentity *pid,
                   void *value)
{
  struct Neighbour *neighbour = value;
 
  (void) cls;
  (void) pid;
  GNUNET_break (0);  // should this ever happen?
  free_neighbour (neighbour, GNUNET_YES);
 
  return GNUNET_OK;
}
 
 
static int
free_virtual_link_cb (void *cls,
                      const struct GNUNET_PeerIdentity *pid,
                      void *value)
{
  struct VirtualLink *vl = value;
 
  (void) cls;
  (void) pid;
  free_virtual_link (vl);
 
  return GNUNET_OK;
}
 
 
static int
free_dv_routes_cb (void *cls,
                   const struct GNUNET_PeerIdentity *pid,
                   void *value)
{
  struct DistanceVector *dv = value;
 
  (void) cls;
  (void) pid;
  free_dv_route (dv);
 
  return GNUNET_OK;
}
 
 
static int
free_validation_state_cb (void *cls,
                          const struct GNUNET_PeerIdentity *pid,
                          void *value)
{
  struct ValidationState *vs = value;
 
  (void) cls;
  (void) pid;
  free_validation_state (vs);
  return GNUNET_OK;
}
 
 
static int
free_pending_ack_cb (void *cls, const struct GNUNET_Uuid *key, void *value)
{
  struct PendingAcknowledgement *pa = value;
 
  (void) cls;
  (void) key;
  free_pending_acknowledgement (pa);
  return GNUNET_OK;
}
 
 
static int
free_ack_cummulator_cb (void *cls,
                        const struct GNUNET_PeerIdentity *pid,
                        void *value)
{
  struct AcknowledgementCummulator *ac = value;
 
  (void) cls;
  (void) pid;
  /* @e task is armed for the whole life of @a ac -- but
     #transmit_cummulative_ack_cb() clears it before re-arming, and it
     routes a message while it is clear.  #GNUNET_SCHEDULER_cancel()
     dereferences its argument unconditionally. */
  if (NULL != ac->task)
  {
    GNUNET_SCHEDULER_cancel (ac->task);
    ac->task = NULL;
  }
  GNUNET_free (ac);
  return GNUNET_OK;
}
 
 
static void
do_shutdown (void *cls)
{
  static int shutdown_done;
  struct LearnLaunchEntry *lle;
  struct PilsRequest *pr;
  (void) cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "shutdown logic\n");
  if (GNUNET_YES == shutdown_done)
    return;   /* reachable both from #shutdown_task() and #client_disconnect_cb() */
  shutdown_done = GNUNET_YES;
  if (NULL != client_grace_task)
  {
    GNUNET_SCHEDULER_cancel (client_grace_task);
    client_grace_task = NULL;
  }
  if (NULL != nh)
  {
    GNUNET_NAT_unregister (nh);
    nh = NULL;
  }
  GNUNET_CONTAINER_multipeermap_iterate (neighbours,
                                         &free_neighbour_cb, NULL);
  /* Freeing a neighbour takes its virtual link with it, so whatever is
     left here is ownerless: a link we created from an inbound FLOW_CONTROL
     message that never got confirmed, kept alive only by its @e
     unconfirmed_timeout_task.  #GNUNET_SCHEDULER_shutdown() does not run
     that task, so leaving the link in place left the task armed against a
     map we destroy further down -- it fired afterwards and
     #free_virtual_link() called GNUNET_CONTAINER_multipeermap_remove() on
     NULL.  Drop them here, while every structure they touch is still
     alive. */
  GNUNET_CONTAINER_multipeermap_iterate (links,
                                         &free_virtual_link_cb,
                                         NULL);
  if (NULL != validation_task)
  {
    GNUNET_SCHEDULER_cancel (validation_task);
    validation_task = NULL;
  }
  if (NULL != dvlearn_task)
  {
    GNUNET_SCHEDULER_cancel (dvlearn_task);
    dvlearn_task = NULL;
  }
  if (NULL != burst_task)
  {
    GNUNET_SCHEDULER_cancel (burst_task);
    burst_task = NULL;
  }
  if (NULL != burst_timeout_task)
  {
    GNUNET_SCHEDULER_cancel (burst_timeout_task);
    burst_timeout_task = NULL;
  }
  burst_running = GNUNET_NO;
  GNUNET_CONTAINER_multishortmap_destroy (dvlearn_map);
  dvlearn_map = NULL;
  GNUNET_CONTAINER_multipeermap_iterate (dv_routes, &free_dv_routes_cb, NULL);
  GNUNET_CONTAINER_multipeermap_destroy (dv_routes);
  dv_routes = NULL;
  if (NULL != GST_stats)
  {
    GNUNET_STATISTICS_destroy (GST_stats, GNUNET_NO);
    GST_stats = NULL;
  }
  if (NULL != GST_my_hello)
  {
    GNUNET_HELLO_builder_free (GST_my_hello);
    GST_my_hello = NULL;
  }
  GNUNET_CONTAINER_multipeermap_iterate (ack_cummulators,
                                         &free_ack_cummulator_cb,
                                         NULL);
  GNUNET_CONTAINER_multipeermap_destroy (ack_cummulators);
  ack_cummulators = NULL;
  GNUNET_CONTAINER_multiuuidmap_iterate (pending_acks,
                                         &free_pending_ack_cb,
                                         NULL);
  GNUNET_CONTAINER_multiuuidmap_destroy (pending_acks);
  pending_acks = NULL;
  GNUNET_break (0 == GNUNET_CONTAINER_multipeermap_size (neighbours));
  GNUNET_CONTAINER_multipeermap_destroy (neighbours);
  neighbours = NULL;
  GNUNET_break (0 == GNUNET_CONTAINER_multipeermap_size (links));
  GNUNET_CONTAINER_multipeermap_destroy (links);
  links = NULL;
  GNUNET_CONTAINER_multipeermap_iterate (backtalkers,
                                         &free_backtalker_cb,
                                         NULL);
  GNUNET_CONTAINER_multipeermap_destroy (backtalkers);
  backtalkers = NULL;
  GNUNET_CONTAINER_multipeermap_iterate (validation_map,
                                         &free_validation_state_cb,
                                         NULL);
  GNUNET_CONTAINER_multipeermap_destroy (validation_map);
  validation_map = NULL;
  GNUNET_CONTAINER_heap_destroy (validation_heap);
  validation_heap = NULL;
  GNUNET_CONTAINER_multihashmap_destroy (revalidation_map);
  revalidation_map = NULL;
  while (NULL != ir_head)
    free_incoming_request (ir_head);
  GNUNET_assert (0 == ir_total);
  while (NULL != (lle = lle_head))
  {
    GNUNET_CONTAINER_DLL_remove (lle_head, lle_tail, lle);
    GNUNET_free (lle);
  }
  while (NULL != (pr = pils_requests_head))
  {
    GNUNET_CONTAINER_DLL_remove (pils_requests_head,
                                 pils_requests_tail,
                                 pr);
    if (NULL != pr->op)
      GNUNET_PILS_cancel (pr->op);
    GNUNET_free (pr);
  }
  if (NULL != pils_feed_task)
  {
    GNUNET_SCHEDULER_cancel (pils_feed_task);
    pils_feed_task = NULL;
  }
  if (NULL != pils)
  {
    GNUNET_PILS_disconnect (pils);
    pils = NULL;
  }
  if (NULL != peerstore)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Disconnecting from PEERSTORE service\n");
    GNUNET_PEERSTORE_disconnect (peerstore);
    peerstore = NULL;
  }
  GNUNET_SCHEDULER_shutdown ();
}
 
 
static const char*
get_client_type_name (enum ClientType type)
{
  switch (type)
  {
  case CT_CORE:
    return "CORE";
  case CT_MONITOR:
    return "MONITOR";
  case CT_COMMUNICATOR:
    return "COMMUNICATOR";
  case CT_APPLICATION:
    return "APPLICATION";
  default:
    return "UNKNOWN";
  }
}
 
 
static void
drop_remaining_clients (void *cls)
{
  client_grace_task = NULL;
  for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Client did not disconnect within the shutdown grace period, "
                "dropping it: %s\n",
                get_client_type_name (tc->type));
  }
  /* We use #GNUNET_SERVICE_OPTION_SOFT_SHUTDOWN, so the service will NOT
     drop clients for us.  Without this we would wait forever for them to
     leave on their own and never reach #do_shutdown(). */
  GNUNET_SERVICE_shutdown (GST_service);
  /* Dropping the clients ran #client_disconnect_cb() for each of them, so
     #do_shutdown() has normally run by now; it is idempotent, and this
     covers the case where there was nothing left to drop. */
  do_shutdown (cls);
}
 
 
static void
shutdown_task (void *cls)
{
  in_shutdown = GNUNET_YES;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Shutdown task executed\n");
  if (NULL != clients_head)
  {
    for (struct TransportClient *tc = clients_head; NULL != tc; tc = tc->next)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                  "Waiting for client to disconnect: %s\n",
                  get_client_type_name (tc->type));
    }
    /* Give them a chance to shut down cleanly; #client_disconnect_cb() calls
       #do_shutdown() once the last one is gone, and #do_shutdown() cancels
       this task. */
    client_grace_task =
      GNUNET_SCHEDULER_add_delayed (SHUTDOWN_CLIENT_GRACE_PERIOD,
                                    &drop_remaining_clients,
                                    cls);
    return;
  }
  do_shutdown (cls);
}
 
 
struct UpdateHelloFromPidCtx
{
  struct GNUNET_PEERSTORE_StoreHelloContext *sc;
};
 
static void
update_hello_from_pid_change_cb (void *cls, int success)
{
  struct UpdateHelloFromPidCtx *pc = cls;
 
  /* NOTE: @a success is GNUNET_OK even when #hello_add_iter() decided not to
     store anything because PEERSTORE already holds a HELLO that expires
     later; the API reports the desired state, not whether it wrote.  So this
     says "we have a current HELLO on record", not "we just wrote one". */
  if (GNUNET_OK != success)
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Failed to store our new hello with peerstore\n");
  else
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Our hello is current in peerstore\n");
  GNUNET_free (pc);
}
 
 
void
print_address_list (void *cls,
                    const struct GNUNET_PeerIdentity *pid,
                    const char *uri)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "%s\n", uri);
}
 
 
static void
pils_pid_change_cb (void *cls,
                    const struct GNUNET_HELLO_Parser *parser,
                    const struct GNUNET_HashCode *hash)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_MQ_Envelope *env;
  const struct GNUNET_MessageHeader *msg;
  struct UpdateHelloFromPidCtx *sc;
  struct GNUNET_HELLO_Builder *nbuilder;
  struct GNUNET_PeerIdentity npid;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  if (NULL == GST_my_hello)
    GST_my_hello = GNUNET_HELLO_builder_new ();
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
              "My current identity is `%s'\n",
              GNUNET_i2s_full (my_identity));
  nbuilder = GNUNET_HELLO_builder_from_parser (parser,
                                               &npid);
  if (GNUNET_NO ==
      GNUNET_HELLO_builder_address_list_cmp (GST_my_hello, nbuilder))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "New PID from PILS is derived from address list inconsistent with ours. Ignoring...\n");
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Proposed address list:\n");
    GNUNET_HELLO_builder_iterate (nbuilder, &print_address_list, NULL);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Current address list:\n");
    GNUNET_HELLO_builder_iterate (GST_my_hello, &print_address_list, NULL);
    GNUNET_HELLO_builder_free (nbuilder);
    return;
  }
  GNUNET_HELLO_builder_free (GST_my_hello);
  GST_my_hello = nbuilder;
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
              "My new identity is `%s'\n",
              GNUNET_i2s_full (my_identity));
  env = GNUNET_HELLO_parser_to_env (parser);
  msg = GNUNET_MQ_env_get_msg (env);
  sc = GNUNET_new (struct UpdateHelloFromPidCtx);
  sc->sc = GNUNET_PEERSTORE_hello_add (peerstore,
                                       msg,
                                       update_hello_from_pid_change_cb,
                                       sc);
  GNUNET_free (env);
}
 
 
static void
run (void *cls,
     const struct GNUNET_CONFIGURATION_Handle *c,
     struct GNUNET_SERVICE_Handle *service)
{
  (void) cls;
  /* setup globals */
  GST_service = service;
  hello_mono_time = GNUNET_TIME_absolute_get_monotonic (c);
  in_shutdown = GNUNET_NO;
  GST_cfg = c;
  backtalkers = GNUNET_CONTAINER_multipeermap_create (16, GNUNET_YES);
  pending_acks = GNUNET_CONTAINER_multiuuidmap_create (32768, GNUNET_YES);
  ack_cummulators = GNUNET_CONTAINER_multipeermap_create (256, GNUNET_YES);
  neighbours = GNUNET_CONTAINER_multipeermap_create (1024, GNUNET_YES);
  links = GNUNET_CONTAINER_multipeermap_create (512, GNUNET_YES);
  dv_routes = GNUNET_CONTAINER_multipeermap_create (1024, GNUNET_YES);
  dvlearn_map = GNUNET_CONTAINER_multishortmap_create (2 * MAX_DV_LEARN_PENDING,
                                                       GNUNET_YES);
  validation_map = GNUNET_CONTAINER_multipeermap_create (1024, GNUNET_YES);
  revalidation_map = GNUNET_CONTAINER_multihashmap_create (1024, GNUNET_YES);
  validation_heap =
    GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
  // TODO check for all uses of GST_my_hello that it is not used uninitialized
  use_burst = GNUNET_CONFIGURATION_get_value_yesno (GST_cfg,
                                                    "transport",
                                                    "USE_BURST_NAT");
  if (GNUNET_SYSERR == use_burst)
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Could not configure burst nat use. Default to no.\n");
  GST_my_hello = GNUNET_HELLO_builder_new ();
  GST_stats = GNUNET_STATISTICS_create ("transport", GST_cfg);
  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
  peerstore = GNUNET_PEERSTORE_connect (GST_cfg);
  nh = GNUNET_NAT_register (GST_cfg,
                            "transport",
                            0,
                            0,
                            NULL,
                            0,
                            NULL,
                            NULL,
                            NULL);
  if (NULL == peerstore)
  {
    GNUNET_break (0);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
  pils = GNUNET_PILS_connect (GST_cfg,
                              pils_pid_change_cb,
                              NULL);          // FIXME we need to wait for
  // our first peer id before
  // we can start the service
  // completely - PILS in turn
  // waits for the first
  // addresses from the
  // communicators in order to
  // be able to generate a
  // peer id
  if (NULL == pils)
  {
    GNUNET_break (0);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
  /* Decapsulate DV box ephemeral keys ourselves.  #handle_dv_box() needs
     the key material while it still has the box, which points into the
     communicator's inbound message and is gone the moment the handler
     returns -- so the asynchronous answer arrived to a dangling @a dvb. */
  if (GNUNET_OK !=
      GNUNET_PILS_enable_private_key (pils))
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _ ("Failed to load our private key, "
                   "cannot open DV boxes addressed to us\n"));
}
 
 
GNUNET_SERVICE_MAIN (
  GNUNET_OS_project_data_gnunet (),
  "transport",
  GNUNET_SERVICE_OPTION_SOFT_SHUTDOWN,
  &run,
  &client_connect_cb,
  &client_disconnect_cb,
  NULL,
  /* communication with applications */
  GNUNET_MQ_hd_fixed_size (suggest,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_SUGGEST,
                           struct ExpressPreferenceMessage,
                           NULL),
  GNUNET_MQ_hd_fixed_size (suggest_cancel,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_SUGGEST_CANCEL,
                           struct ExpressPreferenceMessage,
                           NULL),
  GNUNET_MQ_hd_var_size (request_hello_validation,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_REQUEST_HELLO_VALIDATION,
                         struct RequestHelloValidationMessage,
                         NULL),
  /* communication with core */
  GNUNET_MQ_hd_fixed_size (client_start,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_START,
                           struct StartMessage,
                           NULL),
  GNUNET_MQ_hd_var_size (client_send,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_SEND,
                         struct OutboundMessage,
                         NULL),
  GNUNET_MQ_hd_fixed_size (client_recv_ok,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_RECV_OK,
                           struct RecvOkMessage,
                           NULL),
  /* communication with communicators */
  GNUNET_MQ_hd_var_size (communicator_available,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_NEW_COMMUNICATOR,
                         struct GNUNET_TRANSPORT_CommunicatorAvailableMessage,
                         NULL),
  GNUNET_MQ_hd_var_size (communicator_backchannel,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_COMMUNICATOR_BACKCHANNEL,
                         struct GNUNET_TRANSPORT_CommunicatorBackchannel,
                         NULL),
  GNUNET_MQ_hd_var_size (add_address,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_ADD_ADDRESS,
                         struct GNUNET_TRANSPORT_AddAddressMessage,
                         NULL),
  GNUNET_MQ_hd_fixed_size (del_address,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_DEL_ADDRESS,
                           struct GNUNET_TRANSPORT_DelAddressMessage,
                           NULL),
  GNUNET_MQ_hd_var_size (incoming_msg,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_INCOMING_MSG,
                         struct GNUNET_TRANSPORT_IncomingMessage,
                         NULL),
  GNUNET_MQ_hd_fixed_size (queue_create_ok,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_CREATE_OK,
                           struct GNUNET_TRANSPORT_CreateQueueResponse,
                           NULL),
  GNUNET_MQ_hd_fixed_size (queue_create_fail,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_CREATE_FAIL,
                           struct GNUNET_TRANSPORT_CreateQueueResponse,
                           NULL),
  GNUNET_MQ_hd_var_size (add_queue_message,
                         GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_SETUP,
                         struct GNUNET_TRANSPORT_AddQueueMessage,
                         NULL),
  GNUNET_MQ_hd_fixed_size (update_queue_message,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_UPDATE,
                           struct GNUNET_TRANSPORT_UpdateQueueMessage,
                           NULL),
  GNUNET_MQ_hd_fixed_size (del_queue_message,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_QUEUE_TEARDOWN,
                           struct GNUNET_TRANSPORT_DelQueueMessage,
                           NULL),
  GNUNET_MQ_hd_fixed_size (send_message_ack,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_SEND_MSG_ACK,
                           struct GNUNET_TRANSPORT_SendMessageToAck,
                           NULL),
  GNUNET_MQ_hd_fixed_size (burst_finished,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_BURST_FINISHED,
                           struct GNUNET_TRANSPORT_BurstFinished,
                           NULL),
  /* communication with monitors */
  GNUNET_MQ_hd_fixed_size (monitor_start,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_MONITOR_START,
                           struct GNUNET_TRANSPORT_MonitorStart,
                           NULL),
  GNUNET_MQ_hd_fixed_size (link_list_request,
                           GNUNET_MESSAGE_TYPE_TRANSPORT_LINK_LIST_REQUEST,
                           struct GNUNET_TRANSPORT_LinkListRequest,
                           NULL),
  GNUNET_MQ_handler_end ());
 
 
/* end of file gnunet-service-transport.c */