gnunet-service-cadet_tunnels.c

Go to the documentation of this file.

/*
     This file is part of GNUnet.
     Copyright (C) 2013, 2017, 2018 GNUnet e.V.
 
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
     by the Free Software Foundation, either version 3 of the License,
     or (at your option) any later version.
 
     GNUnet is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Affero General Public License for more details.
 
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     SPDX-License-Identifier: AGPL3.0-or-later
 */
#include "gnunet_common.h"
#include "gnunet_pils_service.h"
#include "gnunet_scheduler_lib.h"
#include "platform.h"
#include "gnunet_util_lib.h"
#include "gnunet_statistics_service.h"
#include "cadet_protocol.h"
#include "gnunet-service-cadet_channel.h"
#include "gnunet-service-cadet_connection.h"
#include "gnunet-service-cadet_tunnels.h"
#include "gnunet-service-cadet_peer.h"
#include "gnunet-service-cadet_paths.h"
 
 
#define LOG(level, ...) GNUNET_log_from (level, "cadet-tun", __VA_ARGS__)
 
#define MAX_UNVERIFIED_ATTEMPTS 16
 
#define IDLE_DESTROY_DELAY GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_SECONDS, 90)
 
#define INITIAL_KX_RETRY_DELAY GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_MILLISECONDS, 250)
 
#define MAX_SKIPPED_KEYS 64
 
#define MAX_KEY_GAP 256
 
 
struct CadetTunnelSkippedKey
{
  struct CadetTunnelSkippedKey *next;
 
  struct CadetTunnelSkippedKey *prev;
 
  struct GNUNET_TIME_Absolute timestamp;
 
  struct GNUNET_CRYPTO_AeadSecretKey HK;
 
  struct GNUNET_CRYPTO_AeadSecretKey MK;
 
  unsigned int Kn;
};
 
 
struct CadetTunnelAxolotl
{
  struct CadetTunnelSkippedKey *skipped_head;
 
  struct CadetTunnelSkippedKey *skipped_tail;
 
  struct GNUNET_CRYPTO_AeadSecretKey RK;
 
  struct GNUNET_CRYPTO_AeadSecretKey HKs;
 
  struct GNUNET_CRYPTO_AeadSecretKey HKr;
 
  struct GNUNET_CRYPTO_AeadSecretKey NHKs;
 
  struct GNUNET_CRYPTO_AeadSecretKey NHKr;
 
  struct GNUNET_CRYPTO_AeadSecretKey CKs;
 
  struct GNUNET_CRYPTO_AeadSecretKey CKr;
 
  struct GNUNET_CRYPTO_EcdhePrivateKey kx_0;
 
  struct GNUNET_CRYPTO_EcdhePrivateKey DHRs;
 
  struct GNUNET_CRYPTO_EcdhePublicKey DHRr;
 
  struct GNUNET_CRYPTO_EcdhePublicKey last_ephemeral;
 
  struct GNUNET_TIME_Absolute ratchet_expiration;
 
  unsigned int skipped;
 
  uint32_t Ns;
 
  uint32_t Nr;
 
  uint32_t PNs;
 
  int ratchet_flag;
 
  int ratchet_allowed;
 
  unsigned int ratchet_counter;
};
 
 
typedef void
(*CadetTunnelAxolotlCallback) (void *cls,
                               enum GNUNET_GenericReturnValue res);
 
 
struct CadetTunnelAsync
{
  struct CadetTunnelAxolotl ax;
 
  struct GNUNET_PeerIdentity peer_id;
 
  struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
  struct GNUNET_CRYPTO_EcdhePublicKey ratchet_key;
 
  struct GNUNET_HashCode auth;
 
  uint32_t flags;
 
  struct GNUNET_PILS_Operation *ecdh_op;
 
  void *cb_cls;
 
  CadetTunnelAxolotlCallback cb;
};
 
 
struct CadetTunnelQueueEntry
{
  struct CadetTunnelQueueEntry *next;
 
  struct CadetTunnelQueueEntry *prev;
 
  struct CadetTunnel *t;
 
  GCT_SendContinuation cont;
 
  void *cont_cls;
 
  struct GNUNET_MQ_Envelope *env;
 
  struct GNUNET_CADET_ConnectionTunnelIdentifier *cid;
};
 
 
struct CadetTunnel
{
  struct CadetPeer *destination;
 
  struct GNUNET_CRYPTO_EcdhePublicKey peers_ephemeral_key;
 
  struct GNUNET_CRYPTO_AeadSecretKey e_key;
 
  struct GNUNET_CRYPTO_AeadSecretKey d_key;
 
  struct CadetTunnelAxolotl ax;
 
  struct CadetTunnelAxolotl *unverified_ax;
 
  struct CadetTunnelAsync as;
 
  struct GNUNET_SCHEDULER_Task *destroy_task;
 
  struct GNUNET_SCHEDULER_Task *maintain_connections_task;
 
  struct GNUNET_SCHEDULER_Task *send_task;
 
  struct GNUNET_SCHEDULER_Task *kx_task;
 
  struct GNUNET_MessageStreamTokenizer *mst;
 
  struct GNUNET_MQ_Handle *mq;
 
  struct CadetTConnection *connection_ready_head;
 
  struct CadetTConnection *connection_ready_tail;
 
  struct CadetTConnection *connection_busy_head;
 
  struct CadetTConnection *connection_busy_tail;
 
  struct GNUNET_CONTAINER_MultiHashMap32 *channels;
 
  struct GNUNET_CADET_ChannelTunnelNumber next_ctn;
 
  struct CadetTunnelQueueEntry *tq_head;
 
  struct CadetTunnelQueueEntry *tq_tail;
 
  struct CadetTConnection *current_ct;
 
  struct GNUNET_TIME_Relative kx_retry_delay;
 
  struct GNUNET_TIME_Absolute next_kx_attempt;
 
  unsigned int num_ready_connections;
 
  unsigned int num_busy_connections;
 
  unsigned int unverified_attempts;
 
  unsigned int tq_len;
 
  enum CadetTunnelEState estate;
 
  int kx_auth_requested;
};
 
 
int
GCT_alice_or_betty (const struct GNUNET_PeerIdentity *other)
{
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  if (0 > GNUNET_memcmp (my_identity, other))
    return GNUNET_YES;
  else if (0 < GNUNET_memcmp (my_identity, other))
    return GNUNET_NO;
  else
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
}
 
 
static void
mark_connection_unready (struct CadetTConnection *ct)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                               t->connection_ready_tail,
                               ct);
  GNUNET_assert (0 < t->num_ready_connections);
  t->num_ready_connections--;
  ct->is_ready = GNUNET_NO;
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
}
 
 
const char *
GCT_2s (const struct CadetTunnel *t)
{
  static char buf[64];
 
  if (NULL == t)
    return "Tunnel(NULL)";
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "Tunnel %s",
                   GNUNET_i2s (GCP_get_id (t->destination)));
  return buf;
}
 
 
static const char *
estate2s (enum CadetTunnelEState es)
{
  static char buf[32];
 
  switch (es)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    return "CADET_TUNNEL_KEY_UNINITIALIZED";
  case CADET_TUNNEL_KEY_AX_RECV:
    return "CADET_TUNNEL_KEY_AX_RECV";
  case CADET_TUNNEL_KEY_AX_SENT:
    return "CADET_TUNNEL_KEY_AX_SENT";
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    return "CADET_TUNNEL_KEY_AX_SENT_AND_RECV";
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    return "CADET_TUNNEL_KEY_AX_AUTH_SENT";
  case CADET_TUNNEL_KEY_OK:
    return "CADET_TUNNEL_KEY_OK";
  }
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "%u (UNKNOWN STATE)",
                   es);
  return buf;
}
 
 
struct CadetPeer *
GCT_get_destination (struct CadetTunnel *t)
{
  return t->destination;
}
 
 
unsigned int
GCT_count_channels (struct CadetTunnel *t)
{
  return GNUNET_CONTAINER_multihashmap32_size (t->channels);
}
 
 
static struct CadetChannel *
lookup_channel (struct CadetTunnel *t,
                struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  return GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ntohl (ctn.cn));
}
 
 
unsigned int
GCT_count_any_connections (const struct CadetTunnel *t)
{
  return t->num_ready_connections + t->num_busy_connections;
}
 
 
static struct CadetTConnection *
get_ready_connection (struct CadetTunnel *t)
{
  struct CadetTConnection *hd = t->connection_ready_head;
 
  GNUNET_assert ((NULL == hd) ||
                 (GNUNET_YES == hd->is_ready));
  return hd;
}
 
 
enum CadetTunnelEState
GCT_get_estate (struct CadetTunnel *t)
{
  return t->estate;
}
 
 
static void
trigger_transmissions (void *cls);
 
 
/* ************************************** start core crypto ***************************** */
 
 
static void
new_ephemeral (struct CadetTunnelAxolotl *ax)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Creating new ephemeral ratchet key (DHRs)\n");
  GNUNET_CRYPTO_ecdhe_key_create (&ax->DHRs);
}
 
 
static void
t_ax_hmac_hash (const struct GNUNET_CRYPTO_AeadSecretKey *key,
                struct GNUNET_HashCode *hash,
                const void *source,
                unsigned int len)
{
  static const char ctx[] = "axolotl HMAC-HASH";
  struct GNUNET_CRYPTO_AuthKey auth_key;
 
  GNUNET_CRYPTO_hkdf_gnunet (
    &auth_key,
    sizeof auth_key,
    ctx,
    sizeof(ctx),
    key,
    sizeof *key);
  GNUNET_CRYPTO_hmac (&auth_key,
                      source,
                      len,
                      hash);
}
 
 
static void
t_hmac_derive_key (const struct GNUNET_CRYPTO_AeadSecretKey *key,
                   struct GNUNET_CRYPTO_AeadSecretKey *out,
                   const void *source,
                   unsigned int len)
{
  static const char ctx[] = "axolotl derive key";
  struct GNUNET_HashCode h;
 
  t_ax_hmac_hash (key,
                  &h,
                  source,
                  len);
  GNUNET_CRYPTO_hkdf_gnunet (
    out, sizeof(*out),
    ctx, sizeof(ctx),
    &h, sizeof(h));
}
 
 
static void
t_ax_encrypt (struct CadetTunnelAxolotl *ax,
              void *dst,
              const void *src,
              size_t size)
{
  struct GNUNET_CRYPTO_AeadSecretKey MK;
  struct GNUNET_CRYPTO_AeadNonce iv;
  struct GNUNET_CRYPTO_AeadMac *mac;
 
  ax->ratchet_counter++;
  if ((GNUNET_YES == ax->ratchet_allowed) &&
      ((ratchet_messages <= ax->ratchet_counter) ||
       (0 == GNUNET_TIME_absolute_get_remaining (
          ax->ratchet_expiration).rel_value_us)))
  {
    ax->ratchet_flag = GNUNET_YES;
  }
  if (GNUNET_YES == ax->ratchet_flag)
  {
    /* Advance ratchet */
    struct GNUNET_CRYPTO_AeadSecretKey keys[3];
    struct GNUNET_HashCode dh;
    struct GNUNET_HashCode hmac;
    static const char ctx[] = "axolotl ratchet";
 
    new_ephemeral (ax);
    ax->HKs = ax->NHKs;
 
    /* RK, NHKs, CKs = KDF( HMAC-HASH(RK, DH(DHRs, DHRr)) ) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            &ax->DHRr,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh,
                    sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
    ax->RK = keys[0];
    ax->NHKs = keys[1];
    ax->CKs = keys[2];
 
    ax->PNs = ax->Ns;
    ax->Ns = 0;
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_allowed = GNUNET_NO;
    ax->ratchet_counter = 0;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  t_hmac_derive_key (&ax->CKs,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
 
  mac = (struct GNUNET_CRYPTO_AeadMac*) &((char*) dst)[size];
  GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_aead_encrypt (size,
                                                          src,
                                                          0,
                                                          NULL,
                                                          &MK,
                                                          &iv,
                                                          dst,
                                                          mac));
  t_hmac_derive_key (&ax->CKs,
                     &ax->CKs,
                     "1",
                     1);
}
 
 
static enum GNUNET_GenericReturnValue
t_ax_decrypt (struct CadetTunnelAxolotl *ax,
              void *dst,
              const void *src,
              size_t size)
{
  struct GNUNET_CRYPTO_AeadSecretKey MK;
  struct GNUNET_CRYPTO_AeadNonce iv;
  struct GNUNET_CRYPTO_AeadMac *mac;
  size_t macoffset;
 
  /* A short (or absent) payload is what a remote peer sends, not something
     we may compute @a macoffset from: the subtraction below underflows. */
  if (size < sizeof(struct GNUNET_MessageHeader)
      + sizeof(struct GNUNET_CRYPTO_AeadMac))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  macoffset = size - sizeof (struct GNUNET_CRYPTO_AeadMac);
  t_hmac_derive_key (&ax->CKr,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
  mac = (struct GNUNET_CRYPTO_AeadMac*) &((char*) src)[macoffset];
  /* Failing to authenticate is what a corrupt or forged ciphertext looks
     like, and the callers all handle it -- #try_old_ax_keys() returns -1 on
     exactly this.  Aborting here let any peer take the service down. */
  if (GNUNET_OK != GNUNET_CRYPTO_aead_decrypt (size,
                                               src,
                                               0,
                                               NULL,
                                               &MK,
                                               &iv,
                                               mac,
                                               dst))
    return GNUNET_SYSERR;
  /* Only a message we actually accepted advances the receive chain. */
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
  return GNUNET_OK;
}
 
 
static void
t_h_encrypt (struct CadetTunnelAxolotl *ax,
             struct GNUNET_CADET_TunnelEncryptedMessage *msg,
             size_t additional_data_size,
             const unsigned char *additional_data)
{
  struct GNUNET_CRYPTO_AeadNonce nonce;
 
  GNUNET_CRYPTO_hkdf_gnunet (&nonce,
                             sizeof nonce,
                             NULL,
                             0,
                             &ax->HKs,
                             sizeof ax->HKs);
  GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_aead_encrypt (sizeof(msg->ax_header)
                                                          ,
                                                          (unsigned char*) &msg
                                                          ->ax_header,
                                                          additional_data_size,
                                                          additional_data,
                                                          &ax->HKs,
                                                          &nonce,
                                                          &msg->ax_header,
                                                          &msg->mac));
}
 
 
static enum GNUNET_GenericReturnValue
t_h_decrypt (const struct GNUNET_CRYPTO_AeadSecretKey *hkr,
             const struct GNUNET_CADET_TunnelEncryptedMessage *src,
             size_t esize,
             struct GNUNET_CADET_TunnelEncryptedMessage *dst)
{
  struct GNUNET_CRYPTO_AeadNonce iv;
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             hkr,
                             sizeof *hkr);
 
 
  return GNUNET_CRYPTO_aead_decrypt (sizeof(struct GNUNET_CADET_AxHeader),
                                     (unsigned char*) &src->ax_header,
                                     esize,
                                     (unsigned char*) &src[1],
                                     hkr,
                                     &iv,
                                     &dst->mac,
                                     &dst->ax_header);
}
 
 
static void
delete_skipped_key (struct CadetTunnelAxolotl *ax,
                    struct CadetTunnelSkippedKey *key)
{
  GNUNET_CONTAINER_DLL_remove (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  GNUNET_free (key);
  ax->skipped--;
}
 
 
static ssize_t
try_old_ax_keys (struct CadetTunnelAxolotl *ax,
                 void *dst,
                 const struct GNUNET_CADET_TunnelEncryptedMessage *src,
                 size_t size)
{
  struct CadetTunnelSkippedKey *key;
  struct GNUNET_CRYPTO_AeadNonce iv;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  struct GNUNET_CRYPTO_AeadSecretKey *valid_HK;
  size_t esize;
  size_t len;
  unsigned int N;
  const unsigned char *payload;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying skipped keys\n");
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
  len = esize;
  /* @a size comes off the wire; #check_tunnel_encrypted() used to accept
     anything, so this must not be an assertion. */
  if ((size <= sizeof(struct GNUNET_CADET_TunnelEncryptedMessage)) ||
      (len < sizeof(struct GNUNET_MessageHeader)
       + sizeof(struct GNUNET_CRYPTO_AeadMac)))
  {
    GNUNET_break_op (0);
    return -1;
  }
  payload = (const unsigned char *) &src[1];
 
  /* Find a correct Header Key */
  valid_HK = NULL;
  for (key = ax->skipped_head; NULL != key; key = key->next)
  {
    /* Try decrypt header */
    if (GNUNET_OK == t_h_decrypt (&key->HK,
                                  src,
                                  esize,
                                  &plaintext_header))
    {
      valid_HK = &key->HK;
      break;
    }
  }
  if (NULL == key)
    return -1;
 
  /* Find the correct message key */
  N = ntohl (plaintext_header.ax_header.Ns);
  while ((NULL != key) &&
         (N != key->Kn))
    key = key->next;
  if ((NULL == key) ||
      (0 != GNUNET_memcmp (&key->HK,
                           valid_HK)))
    return -1;
 
  /* Decrypt payload */
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &key->MK,
                             sizeof key->MK);
 
  /* NOTE: the MAC sits at the end of the *payload*.  Indexing @a src, a
     `struct GNUNET_CADET_TunnelEncryptedMessage *', scaled the offset by the
     size of that struct and read far past the end of the message -- so this
     never authenticated anything it was given and no skipped key ever
     worked. */
  if (GNUNET_OK != GNUNET_CRYPTO_aead_decrypt (
        len,
        payload,
        0,
        NULL,
        &key->MK,
        &iv,
        (const struct GNUNET_CRYPTO_AeadMac*)
        &payload[len - sizeof (struct GNUNET_CRYPTO_AeadMac)],
        dst))
  {
    return -1;
  }
  delete_skipped_key (ax,
                      key);
  return len - sizeof (struct GNUNET_CRYPTO_AeadMac);
}
 
 
static void
store_skipped_key (struct CadetTunnelAxolotl *ax,
                   const struct GNUNET_CRYPTO_AeadSecretKey *HKr)
{
  struct CadetTunnelSkippedKey *key;
 
  key = GNUNET_new (struct CadetTunnelSkippedKey);
  key->timestamp = GNUNET_TIME_absolute_get ();
  key->Kn = ax->Nr;
  key->HK = ax->HKr;
  t_hmac_derive_key (&ax->CKr,
                     &key->MK,
                     "0",
                     1);
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
  GNUNET_CONTAINER_DLL_insert (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  ax->skipped++;
  ax->Nr++;
}
 
 
static int
store_ax_keys (struct CadetTunnelAxolotl *ax,
               const struct GNUNET_CRYPTO_AeadSecretKey *HKr,
               uint32_t Np)
{
  int gap;
 
  gap = Np - ax->Nr;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Storing skipped keys [%u, %u)\n",
       ax->Nr,
       Np);
  if (MAX_KEY_GAP < gap)
  {
    /* Avoid DoS (forcing peer to do more than #MAX_KEY_GAP HMAC operations) */
    /* TODO: start new key exchange on return */
    GNUNET_break_op (0);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "Got message %u, expected %u+\n",
         Np,
         ax->Nr);
    return GNUNET_SYSERR;
  }
  if (0 > gap)
  {
    /* Delayed message: don't store keys, flag to try old keys. */
    return GNUNET_SYSERR;
  }
 
  while (ax->Nr < Np)
    store_skipped_key (ax,
                       HKr);
 
  while (ax->skipped > MAX_SKIPPED_KEYS)
    delete_skipped_key (ax,
                        ax->skipped_tail);
  return GNUNET_OK;
}
 
 
static ssize_t
t_ax_decrypt_and_validate (struct CadetTunnelAxolotl *ax,
                           void *dst,
                           const struct
                           GNUNET_CADET_TunnelEncryptedMessage *src,
                           size_t size)
{
  struct GNUNET_HashCode hmac;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  uint32_t Np;
  uint32_t PNp;
  size_t esize; /* Size of encrypted payload */
 
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
 
  if (GNUNET_OK == t_h_decrypt (&ax->HKr,
                                src,
                                esize,
                                &plaintext_header))
  {
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
  }
  else
  {
    static const char ctx[] = "axolotl ratchet";
    struct GNUNET_CRYPTO_AeadSecretKey keys[3];   /* RKp, NHKp, CKp */
    struct GNUNET_CRYPTO_AeadSecretKey HK;
    struct GNUNET_HashCode dh;
    struct GNUNET_CRYPTO_EcdhePublicKey *DHRp;
 
    /* Try Next HK */
    if (GNUNET_OK == t_h_decrypt (&ax->NHKr,
                                  src,
                                  esize,
                                  &plaintext_header))
    {
      /* Try the skipped keys, if that fails, we're out of luck. */
      return try_old_ax_keys (ax,
                              dst,
                              src,
                              size);
    }
    HK = ax->HKr;
    ax->HKr = ax->NHKr;
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
    DHRp = &plaintext_header.ax_header.DHRs;
    store_ax_keys (ax,
                   &HK,
                   PNp);
 
    /* RKp, NHKp, CKp = KDF (HMAC-HASH (RK, DH (DHRp, DHRs))) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            DHRp,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh, sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
 
    /* Commit "purported" keys */
    ax->RK = keys[0];
    ax->NHKr = keys[1];
    ax->CKr = keys[2];
    ax->DHRr = *DHRp;
    ax->Nr = 0;
    ax->ratchet_allowed = GNUNET_YES;
 
  }
  if ((Np != ax->Nr) &&
      (GNUNET_OK != store_ax_keys (ax,
                                   &ax->HKr,
                                   Np)))
  {
    /* Try the skipped keys, if that fails, we're out of luck. */
    return try_old_ax_keys (ax,
                            dst,
                            src,
                            size);
  }
 
  if (GNUNET_OK != t_ax_decrypt (ax,
                                 dst,
                                 &src[1],
                                 esize))
    return -1;
  ax->Nr = Np + 1;
  return esize - sizeof (struct GNUNET_CRYPTO_AeadMac);
}
 
 
static int
notify_tunnel_up_cb (void *cls,
                     uint32_t key,
                     void *value)
{
  struct CadetChannel *ch = value;
 
  GCCH_tunnel_up (ch);
  return GNUNET_OK;
}
 
 
void
GCT_change_estate (struct CadetTunnel *t,
                   enum CadetTunnelEState state)
{
  enum CadetTunnelEState old = t->estate;
 
  t->estate = state;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s estate changed from %s to %s\n",
       GCT_2s (t),
       estate2s (old),
       estate2s (state));
 
  if ((CADET_TUNNEL_KEY_OK != old) &&
      (CADET_TUNNEL_KEY_OK == t->estate))
  {
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    /* notify all channels that have been waiting */
    GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                             &notify_tunnel_up_cb,
                                             t);
    if (NULL != t->send_task)
      GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                             t);
  }
}
 
 
static void
send_kx (struct CadetTunnel *t,
         struct CadetTConnection *ct,
         struct CadetTunnelAxolotl *ax)
{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if (GNUNET_YES != GCT_alice_or_betty (GCP_get_id (t->destination)))
    return; /* only Alice may send KX */
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send %s in state %s, but no connection is ready, deferring\n",
         GCT_2s (t),
         estate2s (t->estate));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    return;
  }
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX);
  flags = GNUNET_CADET_KX_FLAG_FORCE_REPLY; /* always for KX */
  msg->flags = htonl (flags);
  msg->cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->ephemeral_key);
#if DEBUG_KX
  msg->ephemeral_key_XXX = ax->kx_0;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_sh2s (&msg->cid.connection_of_tunnel));
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->ratchet_key);
  mark_connection_unready (ct);
  t->kx_retry_delay = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT);
  else if (CADET_TUNNEL_KEY_AX_RECV == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX transmitted",
                            1,
                            GNUNET_NO);
}
 
 
static void
send_kx_auth (struct CadetTunnel *t,
              struct CadetTConnection *ct,
              struct CadetTunnelAxolotl *ax,
              int force_reply)
{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send KX_AUTH on %s, but no connection is ready, deferring\n",
         GCT_2s (t));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    t->kx_auth_requested = GNUNET_YES;   /* queue KX_AUTH independent of estate */
    return;
  }
  t->kx_auth_requested = GNUNET_NO; /* clear flag */
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX_AUTH);
  flags = GNUNET_CADET_KX_FLAG_NONE;
  if (GNUNET_YES == force_reply)
    flags |= GNUNET_CADET_KX_FLAG_FORCE_REPLY;
  msg->kx.flags = htonl (flags);
  msg->kx.cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->kx.ephemeral_key);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->kx.ratchet_key);
#if DEBUG_KX
  msg->kx.ephemeral_key_XXX = ax->kx_0;
  msg->r_ephemeral_key_XXX = ax->last_ephemeral;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX_AUTH message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key),
       GNUNET_sh2s (&msg->kx.cid.connection_of_tunnel));
 
  /* Compute authenticator (this is the main difference to #send_kx()) */
  GNUNET_CRYPTO_hash (&ax->RK,
                      sizeof(ax->RK),
                      &msg->auth);
  /* Compute when to be triggered again; actual job will
     be scheduled via #connection_ready_cb() */
  t->kx_retry_delay
    = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt
    = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
 
  /* Send via cc, mark it as unready */
  mark_connection_unready (ct);
 
  /* Update state machine, unless we are already OK */
  if (CADET_TUNNEL_KEY_OK != t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_AUTH_SENT);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH transmitted",
                            1,
                            GNUNET_NO);
}
 
 
static void
cleanup_ax (struct CadetTunnelAxolotl *ax)
{
  while (NULL != ax->skipped_head)
    delete_skipped_key (ax,
                        ax->skipped_head);
  GNUNET_assert (0 == ax->skipped);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->kx_0);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->DHRs);
}
 
 
static void
update_ax_by_kx (void *cls,
                 const struct GNUNET_HashCode *key_result)
{
  struct CadetTunnelAsync *as;
  struct GNUNET_HashCode key_material[3];
  struct GNUNET_CRYPTO_AeadSecretKey keys[5];
  struct CadetTunnelAxolotl *ax;
  const struct GNUNET_PeerIdentity *pid;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ephemeral_key;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ratchet_key;
  const char salt[] = "CADET Axolotl salt";
  int am_I_alice;
 
  as = cls;
  ax = &as->ax;
  pid = &as->peer_id;
  ephemeral_key = &as->ephemeral_key;
  ratchet_key = &as->ratchet_key;
 
  as->ecdh_op = NULL;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Updating AX by KX with result from ECDH using ephemeral %s\n",
       GNUNET_e2s (ephemeral_key));
 
  if (GNUNET_SYSERR == (am_I_alice = GCT_alice_or_betty (pid)))
  {
    GNUNET_break_op (0);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_SYSERR);
    return;
  }
 
  if (0 == GNUNET_memcmp (&ax->DHRr,
                          ratchet_key))
  {
    GNUNET_STATISTICS_update (stats,
                              "# Ratchet key already known",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ratchet key already known. Ignoring KX.\n");
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->DHRr = *ratchet_key;
  ax->last_ephemeral = *ephemeral_key;
  /* ECDH A B0 */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_memcpy (&key_material[0], key_result,
                   sizeof (*key_result));
  }
  else
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* b0 */
                              &pid->public_key,     /* A */
                              &key_material[0]);
  }
  /* ECDH A0 B */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* a0 */
                              &pid->public_key,     /* B */
                              &key_material[1]);
  }
  else
  {
    GNUNET_memcpy (&key_material[1], key_result,
                   sizeof (*key_result));
  }
 
  /* ECDH A0 B0 */
  GNUNET_CRYPTO_ecc_ecdh (&ax->kx_0,              /* a0 or b0 */
                          ephemeral_key,         /* B0 or A0 */
                          &key_material[2]);
  /* KDF */
  GNUNET_CRYPTO_hkdf_gnunet (
    keys, sizeof(keys),
    salt, sizeof(salt),
    &key_material, sizeof(key_material));
 
  if (0 == memcmp (&ax->RK,
                   &keys[0],
                   sizeof(ax->RK)))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Root key already known. Ignoring KX.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Root key already known",
                              1,
                              GNUNET_NO);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->RK = keys[0];
  if (GNUNET_YES == am_I_alice)
  {
    ax->HKr = keys[1];
    ax->NHKs = keys[2];
    ax->NHKr = keys[3];
    ax->CKr = keys[4];
    ax->ratchet_flag = GNUNET_YES;
  }
  else
  {
    ax->HKs = keys[1];
    ax->NHKr = keys[2];
    ax->NHKs = keys[3];
    ax->CKs = keys[4];
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  if (as->cb)
    as->cb (as->cb_cls, GNUNET_OK);
}
 
 
static void
retry_kx (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax;
 
  t->kx_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying to make KX progress on %s in state %s\n",
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:   /* first attempt */
  case CADET_TUNNEL_KEY_AX_SENT:         /* trying again */
    send_kx (t,
             NULL,
             &t->ax);
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Must have been the *other* peer asking us to
       respond with a KX_AUTH. */
    if (NULL != t->unverified_ax)
    {
      /* Sending AX_AUTH in response to AX so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* Sending AX_AUTH in response to AX_AUTH */
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  GNUNET_NO);
    break;
  }
}
 
 
static void
cont_GCT_handle_kx (void *cls,
                    enum GNUNET_GenericReturnValue ret)
{
  struct CadetTunnel *t = cls;
 
  if (t->unverified_ax)
    *(t->unverified_ax) = t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX message from %s from %s\n",
       GCT_2s (t),
       GNUNET_i2s (GCP_get_id (t->destination)));
 
  GNUNET_break (GNUNET_SYSERR != ret);
  if (GNUNET_OK != ret)
  {
    GNUNET_STATISTICS_update (stats,
                              "# Useless KX",
                              1,
                              GNUNET_NO);
    return;   /* duplicate KX, nothing to do */
  }
  /* move ahead in our state machine */
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_RECV);
  else if (CADET_TUNNEL_KEY_AX_SENT == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
 
  /* KX is still not done, try again our end. */
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    if (NULL != t->kx_task)
      GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task
      = GNUNET_SCHEDULER_add_now (&retry_kx,
                                  t);
  }
}
 
 
void
GCT_handle_kx (struct CadetTConnection *ct,
               const struct GNUNET_CADET_TunnelKeyExchangeMessage *msg)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX received",
                            1,
                            GNUNET_NO);
  if (GNUNET_YES ==
      GCT_alice_or_betty (GCP_get_id (t->destination)))
  {
    /* Betty/Bob is not allowed to send KX! */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KX message from %s with ephemeral %s from %s on connection %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_i2s (GCP_get_id (t->destination)),
       GCC_2s (ct->cc));
#if 1
  if ((0 ==
       memcmp (&t->ax.DHRr,
               &msg->ratchet_key,
               sizeof(msg->ratchet_key))) &&
      (0 ==
       memcmp (&t->ax.last_ephemeral,
               &msg->ephemeral_key,
               sizeof(msg->ephemeral_key))))
 
  {
    GNUNET_STATISTICS_update (stats,
                              "# Duplicate KX received",
                              1,
                              GNUNET_NO);
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_NO);
    return;
  }
#endif
  /* We only keep ONE unverified KX around, so if there is an existing one,
     clean it up. */
  if (NULL != t->unverified_ax)
  {
    if ((0 ==
         memcmp (&t->unverified_ax->DHRr,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->unverified_ax->last_ephemeral,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      GNUNET_STATISTICS_update (stats,
                                "# Duplicate unverified KX received",
                                1,
                                GNUNET_NO);
#if 1
      send_kx_auth (t,
                    ct,
                    t->unverified_ax,
                    GNUNET_NO);
      return;
#endif
    }
    if ((t->as.ecdh_op) &&
        (0 ==
         memcmp (&t->as.ratchet_key,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->as.ephemeral_key,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Waiting for previous ECDH operation\n");
      return;
    }
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Dropping old unverified KX state.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Unverified KX dropped for fresh KX",
                              1,
                              GNUNET_NO);
    GNUNET_break (NULL == t->unverified_ax->skipped_head);
    memset (t->unverified_ax,
            0,
            sizeof(struct CadetTunnelAxolotl));
  }
  else
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Creating fresh unverified KX for %s\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# Fresh KX setup",
                              1,
                              GNUNET_NO);
    t->unverified_ax = GNUNET_new (struct CadetTunnelAxolotl);
  }
  /* Set as the 'current' RK/DHRr the one we are currently using,
     so that the duplicate-detection logic of
   #update_ax_by_kx can work. */
  t->unverified_ax->RK = t->ax.RK;
  t->unverified_ax->DHRr = t->ax.DHRr;
  t->unverified_ax->DHRs = t->ax.DHRs;
  t->unverified_ax->kx_0 = t->ax.kx_0;
  t->unverified_attempts = 0;
 
  t->as.ax = *(t->unverified_ax);
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->ratchet_key,
                 sizeof (t->as.ratchet_key));
  memset (&t->as.auth, 0, sizeof (t->as.auth));
  t->as.flags = 0;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}
 
 
static void
cont_GCT_handle_kx_auth (void *cls,
                         enum GNUNET_GenericReturnValue ret)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax_tmp;
  struct GNUNET_HashCode kx_auth;
 
  ax_tmp = &t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX_AUTH message from %s\n",
       GCT_2s (t));
 
  if (GNUNET_OK != ret)
  {
    if (GNUNET_NO == ret)
      GNUNET_STATISTICS_update (stats,
                                "# redundant KX_AUTH received",
                                1,
                                GNUNET_NO);
    else
      GNUNET_break (0);  /* connect to self!? */
    return;
  }
  GNUNET_CRYPTO_hash (&ax_tmp->RK,
                      sizeof(ax_tmp->RK),
                      &kx_auth);
  if (0 != GNUNET_memcmp (&kx_auth,
                          &t->as.auth))
  {
    /* This KX_AUTH is not using the latest KX/KX_AUTH data
       we transmitted to the sender, refuse it, try KX again. */
    GNUNET_STATISTICS_update (stats,
                              "# KX_AUTH not using our last KX received (auth failure)",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "KX AUTH mismatch!\n");
#if DEBUG_KX
    {
      struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
      GNUNET_CRYPTO_ecdhe_key_get_public (&ax_tmp.kx_0,
                                          &ephemeral_key);
      if (0 != GNUNET_memcmp (&ephemeral_key,
                              &msg->r_ephemeral_key_XXX))
      {
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "My ephemeral is %s!\n",
             GNUNET_e2s (&ephemeral_key));
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "Response is for ephemeral %s!\n",
             GNUNET_e2s (&msg->r_ephemeral_key_XXX));
      }
    }
#endif
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    return;
  }
  /* Yep, we're good. */
  t->ax = *ax_tmp;
  if (NULL != t->unverified_ax)
  {
    /* We got some "stale" KX before, drop that. */
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
    t->unverified_ax = NULL;
  }
 
  /* move ahead in our state machine */
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* Checked above, this is impossible. */
    GNUNET_assert (0);
    break;
 
  case CADET_TUNNEL_KEY_AX_SENT:      /* This is the normal case */
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:   /* both peers started KX */
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:   /* both peers now did KX_AUTH */
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_OK);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Did not expect another KX_AUTH, but so what, still acceptable.
       Nothing to do here. */
    break;
  }
  if (0 != (GNUNET_CADET_KX_FLAG_FORCE_REPLY & ntohl (t->as.flags)))
  {
    send_kx_auth (t,
                  NULL,
                  &t->ax,
                  GNUNET_NO);
  }
}
 
 
void
GCT_handle_kx_auth (struct CadetTConnection *ct,
                    const struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH received",
                            1,
                            GNUNET_NO);
  if ((CADET_TUNNEL_KEY_UNINITIALIZED == t->estate) ||
      (CADET_TUNNEL_KEY_AX_RECV == t->estate))
  {
    /* Confusing, we got a KX_AUTH before we even send our own
       KX. This should not happen. We'll send our own KX ASAP anyway,
       so let's ignore this here. */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Handling KX_AUTH message from %s with ephemeral %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key));
  if ((t->as.ecdh_op) &&
      (0 ==
       memcmp (&t->as.ratchet_key,
               &msg->kx.ratchet_key,
               sizeof(msg->kx.ratchet_key))) &&
      (0 ==
       memcmp (&t->as.ephemeral_key,
               &msg->kx.ephemeral_key,
               sizeof(msg->kx.ephemeral_key))))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Waiting for previous ECDH operation\n");
    return;
  }
  /* We do everything in a copy until we've checked the authentication
     so we don't clobber anything we care about by accident. */
  t->as.ax = t->ax;
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->kx.ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->kx.ratchet_key,
                 sizeof (t->as.ratchet_key));
  t->as.auth = msg->auth;
  t->as.flags = msg->kx.flags;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx_auth;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  /* Update 'ax' by the new key material */
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->kx.ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}
 
 
/* ************************************** end core crypto ***************************** */
 
 
static struct GNUNET_CADET_ChannelTunnelNumber
get_next_free_ctn (struct CadetTunnel *t)
{
#define HIGH_BIT 0x08000000
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_CADET_ChannelTunnelNumber ret;
  uint32_t ctn;
  int cmp;
  uint32_t highbit;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  cmp = GNUNET_memcmp (my_identity,
                       GCP_get_id (GCT_get_destination (t)));
  if (0 < cmp)
    highbit = HIGH_BIT;
  else if (0 > cmp)
    highbit = 0;
  else
    GNUNET_assert (0); // loopback must never go here!
  ctn = ntohl (t->next_ctn.cn);
  while (NULL !=
         GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ctn | highbit))
  {
    ctn = ((ctn + 1) & (~HIGH_BIT));
  }
  t->next_ctn.cn = htonl ((ctn + 1) & (~HIGH_BIT));
  ret.cn = htonl (ctn | highbit);
  return ret;
}
 
 
struct GNUNET_CADET_ChannelTunnelNumber
GCT_add_channel (struct CadetTunnel *t,
                 struct CadetChannel *ch)
{
  struct GNUNET_CADET_ChannelTunnelNumber ctn;
 
  ctn = get_next_free_ctn (t);
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Adding %s to %s with state %d\n",
       GCCH_2s (ch),
       GCT_2s (t),
       t->estate);
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    /* waiting for connection to start KX */
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* we're currently waiting for KX to complete */
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* waiting for OTHER peer to send us data,
       we might need to prompt more aggressively! */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* We are ready. Tell the new channel that we are up. */
    GCCH_tunnel_up (ch);
    break;
  }
  return ctn;
}
 
 
void
GCT_connection_lost (struct CadetTConnection *ct)
{
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_YES == ct->is_ready)
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                                 t->connection_ready_tail,
                                 ct);
    t->num_ready_connections--;
  }
  else
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                                 t->connection_busy_tail,
                                 ct);
    t->num_busy_connections--;
  }
  GNUNET_free (ct);
}
 
 
static void
destroy_t_connection (void *cls,
                      struct CadetTConnection *ct)
{
  struct CadetTunnel *t = cls;
  struct CadetConnection *cc = ct->cc;
 
  GNUNET_assert (ct->t == t);
  GCT_connection_lost (ct);
  GCC_destroy_without_tunnel (cc);
}
 
 
static void
destroy_tunnel (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelQueueEntry *tq;
 
  t->destroy_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Destroying idle %s\n",
       GCT_2s (t));
  GNUNET_assert (0 == GCT_count_channels (t));
  GCT_iterate_connections (t,
                           &destroy_t_connection,
                           t);
  GNUNET_assert (NULL == t->connection_ready_head);
  GNUNET_assert (NULL == t->connection_busy_head);
  while (NULL != (tq = t->tq_head))
  {
    if (NULL != tq->cont)
      tq->cont (tq->cont_cls,
                NULL);
    GCT_send_cancel (tq);
  }
  GCP_drop_tunnel (t->destination,
                   t);
  GNUNET_CONTAINER_multihashmap32_destroy (t->channels);
  if (NULL != t->maintain_connections_task)
  {
    GNUNET_SCHEDULER_cancel (t->maintain_connections_task);
    t->maintain_connections_task = NULL;
  }
  if (NULL != t->send_task)
  {
    GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = NULL;
  }
  if (NULL != t->kx_task)
  {
    GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task = NULL;
  }
  if (NULL != t->as.ecdh_op)
  {
    GNUNET_PILS_cancel (t->as.ecdh_op);
    t->as.ecdh_op = NULL;
  }
  GNUNET_MST_destroy (t->mst);
  GNUNET_MQ_destroy (t->mq);
  if (NULL != t->unverified_ax)
  {
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
  }
  cleanup_ax (&t->ax);
  GNUNET_assert (NULL == t->destroy_task);
  GNUNET_free (t);
}
 
 
void
GCT_remove_channel (struct CadetTunnel *t,
                    struct CadetChannel *ch,
                    struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Removing %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_remove (t->channels,
                                                         ntohl (ctn.cn),
                                                         ch));
  if ((0 ==
       GCT_count_channels (t)) &&
      (NULL == t->destroy_task))
  {
    t->destroy_task
      = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                      &destroy_tunnel,
                                      t);
  }
}
 
 
static int
destroy_remaining_channels (void *cls,
                            uint32_t key,
                            void *value)
{
  struct CadetChannel *ch = value;
 
  GCCH_handle_remote_destroy (ch,
                              NULL);
  return GNUNET_OK;
}
 
 
void
GCT_destroy_tunnel_now (struct CadetTunnel *t)
{
  GNUNET_assert (GNUNET_YES == shutting_down);
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &destroy_remaining_channels,
                                           t);
  GNUNET_assert (0 ==
                 GCT_count_channels (t));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  destroy_tunnel (t);
}
 
 
static void
try_send_normal_payload (struct CadetTunnel *t,
                         struct CadetTConnection *ct)
{
  struct CadetTunnelQueueEntry *tq;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  tq = t->tq_head;
  if (NULL == tq)
  {
    /* no messages pending right now */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Not sending payload of %s on ready %s (nothing pending)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    return;
  }
  /* ready to send message 'tq' on tunnel 'ct' */
  GNUNET_assert (t == tq->t);
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  if (NULL != tq->cid)
    *tq->cid = *GCC_get_id (ct->cc);
  mark_connection_unready (ct);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending payload of %s on %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  GCC_transmit (ct->cc,
                tq->env);
  if (NULL != tq->cont)
    tq->cont (tq->cont_cls,
              GCC_get_id (ct->cc));
  GNUNET_free (tq);
}
 
 
static void
connection_ready_cb (void *cls,
                     int is_ready)
{
  struct CadetTConnection *ct = cls;
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_NO == is_ready)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s no longer ready for %s\n",
         GCC_2s (ct->cc),
         GCT_2s (t));
    mark_connection_unready (ct);
    return;
  }
  GNUNET_assert (GNUNET_NO == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  GNUNET_assert (0 < t->num_busy_connections);
  t->num_busy_connections--;
  ct->is_ready = GNUNET_YES;
  GNUNET_CONTAINER_DLL_insert_tail (t->connection_ready_head,
                                    t->connection_ready_tail,
                                    ct);
  t->num_ready_connections++;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s now ready for %s in state %s\n",
       GCC_2s (ct->cc),
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Do not begin KX for %s if WE have no channels waiting. Retrying after %llu\n",
         GCT_2s (t),
         (unsigned long long) GNUNET_TIME_absolute_get_remaining (
           t->next_kx_attempt).rel_value_us);
    /* Do not begin KX if WE have no channels waiting! */
    if (0 != GNUNET_TIME_absolute_get_remaining (
          t->next_kx_attempt).rel_value_us)
      return;   /* wait for timeout before retrying */
    /* We are uninitialized, just transmit immediately,
       without undue delay. */
 
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Why for %s \n",
         GCT_2s (t));
 
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    if ((0 ==
         GCT_count_channels (t)) &&
        (NULL == t->destroy_task))
    {
      t->destroy_task
        = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                        &destroy_tunnel,
                                        t);
    }
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* we're currently waiting for KX to complete, schedule job */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    if (GNUNET_YES == t->kx_auth_requested)
    {
      if (0 != GNUNET_TIME_absolute_get_remaining (
            t->next_kx_attempt).rel_value_us)
        return;     /* wait for timeout */
      if (NULL != t->kx_task)
      {
        GNUNET_SCHEDULER_cancel (t->kx_task);
        t->kx_task = NULL;
      }
      send_kx_auth (t,
                    ct,
                    &t->ax,
                    GNUNET_NO);
      return;
    }
    try_send_normal_payload (t,
                             ct);
    break;
  }
}
 
 
static void
trigger_transmissions (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTConnection *ct;
 
  t->send_task = NULL;
  if (NULL == t->tq_head)
    return; /* no messages pending right now */
  ct = get_ready_connection (t);
  if (NULL == ct)
    return; /* no connections ready */
  try_send_normal_payload (t,
                           ct);
}
 
 
struct EvaluationSummary
{
  unsigned int min_length;
 
  unsigned int max_length;
 
  GNUNET_CONTAINER_HeapCostType min_desire;
 
  GNUNET_CONTAINER_HeapCostType max_desire;
 
  struct CadetPeerPath *path;
 
  struct CadetTConnection *worst;
 
  double worst_score;
 
  int duplicate;
};
 
 
static void
evaluate_connection (void *cls,
                     struct CadetTConnection *ct)
{
  struct EvaluationSummary *es = cls;
  struct CadetConnection *cc = ct->cc;
  unsigned int ct_length;
  struct CadetPeerPath *ps;
  const struct CadetConnectionMetrics *metrics;
  GNUNET_CONTAINER_HeapCostType ct_desirability;
  struct GNUNET_TIME_Relative uptime;
  struct GNUNET_TIME_Relative last_use;
  double score;
  double success_rate;
 
  ps = GCC_get_path (cc,
                     &ct_length);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating path %s of existing %s\n",
       GCPP_2s (ps),
       GCC_2s (cc));
  if (ps == es->path)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring duplicate path %s.\n",
         GCPP_2s (es->path));
    es->duplicate = GNUNET_YES;
    return;
  }
  if (NULL != es->path)
  {
    int duplicate = GNUNET_YES;
 
    for (unsigned int i = 0; i < ct_length; i++)
    {
      GNUNET_assert (GCPP_get_length (es->path) > i);
      if (GCPP_get_peer_at_offset (es->path,
                                   i) !=
          GCPP_get_peer_at_offset (ps,
                                   i))
      {
        duplicate = GNUNET_NO;
        break;
      }
    }
    if (GNUNET_YES == duplicate)
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Ignoring overlapping path %s.\n",
           GCPP_2s (es->path));
      es->duplicate = GNUNET_YES;
      return;
    }
    else
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Known path %s differs from proposed path\n",
           GCPP_2s (ps));
    }
  }
 
  ct_desirability = GCPP_get_desirability (ps);
  metrics = GCC_get_metrics (cc);
  uptime = GNUNET_TIME_absolute_get_duration (metrics->age);
  last_use = GNUNET_TIME_absolute_get_duration (metrics->last_use);
  /* We add 1.0 here to avoid division by zero. */
  success_rate = (metrics->num_acked_transmissions + 1.0)
                 / (metrics->num_successes + 1.0);
  score
    = ct_desirability
      + 100.0 / (1.0 + ct_length) /* longer paths = better */
      + sqrt (uptime.rel_value_us / 60000000LL) /* larger uptime = better */
      - last_use.rel_value_us / 1000L;        /* longer idle = worse */
  score *= success_rate;        /* weigh overall by success rate */
 
  if ((NULL == es->worst) ||
      (score < es->worst_score))
  {
    es->worst = ct;
    es->worst_score = score;
  }
  es->min_length = GNUNET_MIN (es->min_length,
                               ct_length);
  es->max_length = GNUNET_MAX (es->max_length,
                               ct_length);
  es->min_desire = GNUNET_MIN (es->min_desire,
                               ct_desirability);
  es->max_desire = GNUNET_MAX (es->max_desire,
                               ct_desirability);
}
 
 
static int
consider_path_cb (void *cls,
                  struct CadetPeerPath *path,
                  unsigned int off)
{
  struct CadetTunnel *t = cls;
  struct EvaluationSummary es;
  struct CadetTConnection *ct;
 
  GNUNET_assert (off < GCPP_get_length (path));
  GNUNET_assert (GCPP_get_peer_at_offset (path,
                                          off) == t->destination);
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = path;
  es.duplicate = GNUNET_NO;
  es.worst = NULL;
 
  /* Compute evaluation summary over existing connections. */
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating proposed path %s for target %s\n",
       GCPP_2s (path),
       GCT_2s (t));
  /* FIXME: suspect this does not ACTUALLY iterate
     over all existing paths, otherwise dup detection
     should work!!! */
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if (GNUNET_YES == es.duplicate)
    return GNUNET_YES;
 
  /* FIXME: not sure we should really just count
     'num_connections' here, as they may all have
     consistently failed to connect. */
 
  /* We iterate by increasing path length; if we have enough paths and
     this one is more than twice as long than what we are currently
     using, then ignore all of these super-long ones! */
  if ((GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length * 2 < off) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring paths of length %u, they are way too long.\n",
         es.min_length * 2);
    return GNUNET_NO;
  }
  /* If we have enough paths and this one looks no better, ignore it. */
  if ((GCT_count_any_connections (t) >= DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length < GCPP_get_length (path)) &&
      (es.min_desire > GCPP_get_desirability (path)) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring path (%u/%llu) to %s, got something better already.\n",
         GCPP_get_length (path),
         (unsigned long long) GCPP_get_desirability (path),
         GCP_2s (t->destination));
    return GNUNET_YES;
  }
 
  /* Path is interesting (better by some metric, or we don't have
     enough paths yet). */
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create (t->destination,
                       path,
                       off,
                       ct,
                       &connection_ready_cb,
                       ct);
 
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Found interesting path %s for %s, created %s\n",
       GCPP_2s (path),
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_YES;
}
 
 
static void
maintain_connections_cb (void *cls)
{
  struct CadetTunnel *t = cls;
  struct GNUNET_TIME_Relative delay;
  struct EvaluationSummary es;
 
  t->maintain_connections_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Performing connection maintenance for %s.\n",
       GCT_2s (t));
 
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = NULL;
  es.worst = NULL;
  es.duplicate = GNUNET_NO;
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if ((NULL != es.worst) &&
      (GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL))
  {
    /* Clear out worst-performing connection 'es.worst'. */
    destroy_t_connection (t,
                          es.worst);
  }
 
  /* Consider additional paths */
  (void) GCP_iterate_paths (t->destination,
                            &consider_path_cb,
                            t);
 
  /* FIXME: calculate when to try again based on how well we are doing;
     in particular, if we have to few connections, we might be able
     to do without this (as PATHS should tell us whenever a new path
     is available instantly; however, need to make sure this job is
     restarted after that happens).
     Furthermore, if the paths we do know are in a reasonably narrow
     quality band and are plentyful, we might also consider us stabilized
     and then reduce the frequency accordingly.  */delay = GNUNET_TIME_UNIT_MINUTES;
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_delayed (delay,
                                    &maintain_connections_cb,
                                    t);
}
 
 
void
GCT_consider_path (struct CadetTunnel *t,
                   struct CadetPeerPath *p,
                   unsigned int off)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Considering %s for %s (offset %u)\n",
       GCPP_2s (p),
       GCT_2s (t),
       off);
  (void) consider_path_cb (t,
                           p,
                           off);
}
 
 
static void
handle_plaintext_keepalive (void *cls,
                            const struct GNUNET_MessageHeader *msg)
{
  struct CadetTunnel *t = cls;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KEEPALIVE on %s\n",
       GCT_2s (t));
  GNUNET_STATISTICS_update (stats,
                            "# keepalives received",
                            1,
                            GNUNET_NO);
}
 
 
static int
check_plaintext_data (void *cls,
                      const struct GNUNET_CADET_ChannelAppDataMessage *msg)
{
  return GNUNET_OK;
}
 
 
static void
handle_plaintext_data (void *cls,
                       const struct GNUNET_CADET_ChannelAppDataMessage *msg)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       msg->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received %u bytes of application data for unknown channel %u, sending DESTROY\n",
         (unsigned int) (ntohs (msg->header.size) - sizeof(*msg)),
         ntohl (msg->ctn.cn));
    GCT_send_channel_destroy (t,
                              msg->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data (ch,
                                      GCC_get_id (t->current_ct->cc),
                                      msg);
}
 
 
static void
handle_plaintext_data_ack (void *cls,
                           const struct GNUNET_CADET_ChannelDataAckMessage *ack)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       ack->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received DATA_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (ack->ctn.cn));
    GCT_send_channel_destroy (t,
                              ack->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data_ack (ch,
                                          GCC_get_id (t->current_ct->cc),
                                          ack);
}
 
 
static void
handle_plaintext_channel_open (void *cls,
                               const struct
                               GNUNET_CADET_ChannelOpenMessage *copen)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                            ntohl (copen->ctn.cn));
  if (NULL != ch)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received duplicate channel CHANNEL_OPEN on h_port %s from %s (%s), resending ACK\n",
         GNUNET_h2s (&copen->h_port),
         GCT_2s (t),
         GCCH_2s (ch));
    GCCH_handle_duplicate_open (ch,
                                GCC_get_id (t->current_ct->cc));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received CHANNEL_OPEN on h_port %s from %s\n",
       GNUNET_h2s (&copen->h_port),
       GCT_2s (t));
  ch = GCCH_channel_incoming_new (t,
                                  copen->ctn,
                                  &copen->h_port,
                                  ntohl (copen->opt));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (copen->ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
}
 
 
void
GCT_send_channel_destroy (struct CadetTunnel *t,
                          struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  struct GNUNET_CADET_ChannelDestroyMessage msg;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending DESTROY message for channel ID %u\n",
       ntohl (ctn.cn));
  msg.header.size = htons (sizeof(msg));
  msg.header.type = htons (GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY);
  msg.reserved = htonl (0);
  msg.ctn = ctn;
  GCT_send (t,
            &msg.header,
            NULL,
            NULL,
            &ctn);
}
 
 
static void
handle_plaintext_channel_open_ack (void *cls,
                                   const struct
                                   GNUNET_CADET_ChannelOpenAckMessage *cm)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel OPEN_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (cm->ctn.cn));
    GCT_send_channel_destroy (t,
                              cm->ctn);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel OPEN_ACK on channel %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_channel_open_ack (ch,
                                GCC_get_id (t->current_ct->cc),
                                &cm->port);
}
 
 
static void
handle_plaintext_channel_destroy (void *cls,
                                  const struct
                                  GNUNET_CADET_ChannelDestroyMessage *cm)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel DESTROY for unknown channel %u. Ignoring.\n",
         ntohl (cm->ctn.cn));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel DESTROY on %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_remote_destroy (ch,
                              GCC_get_id (t->current_ct->cc));
}
 
 
static int
handle_decrypted (void *cls,
                  const struct GNUNET_MessageHeader *msg)
{
  struct CadetTunnel *t = cls;
 
  GNUNET_assert (NULL != t->current_ct);
  GNUNET_MQ_inject_message (t->mq,
                            msg);
  return GNUNET_OK;
}
 
 
static void
decrypted_error_cb (void *cls,
                    enum GNUNET_MQ_Error error)
{
  GNUNET_break_op (0);
}
 
 
struct CadetTunnel *
GCT_create_tunnel (struct CadetPeer *destination)
{
  struct CadetTunnel *t = GNUNET_new (struct CadetTunnel);
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_fixed_size (plaintext_keepalive,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_KEEPALIVE,
                             struct GNUNET_MessageHeader,
                             t),
    GNUNET_MQ_hd_var_size (plaintext_data,
                           GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA,
                           struct GNUNET_CADET_ChannelAppDataMessage,
                           t),
    GNUNET_MQ_hd_fixed_size (plaintext_data_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA_ACK,
                             struct GNUNET_CADET_ChannelDataAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN,
                             struct GNUNET_CADET_ChannelOpenMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN_ACK,
                             struct GNUNET_CADET_ChannelOpenAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_destroy,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY,
                             struct GNUNET_CADET_ChannelDestroyMessage,
                             t),
    GNUNET_MQ_handler_end ()
  };
 
  t->kx_retry_delay = INITIAL_KX_RETRY_DELAY;
  new_ephemeral (&t->ax);
  GNUNET_CRYPTO_ecdhe_key_create (&t->ax.kx_0);
  t->destination = destination;
  t->channels = GNUNET_CONTAINER_multihashmap32_create (8);
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_now (&maintain_connections_cb,
                                t);
  t->mq = GNUNET_MQ_queue_for_callbacks (NULL,
                                         NULL,
                                         NULL,
                                         NULL,
                                         handlers,
                                         &decrypted_error_cb,
                                         t);
  t->mst = GNUNET_MST_create (&handle_decrypted,
                              t);
  return t;
}
 
 
int
GCT_add_inbound_connection (struct CadetTunnel *t,
                            const struct
                            GNUNET_CADET_ConnectionTunnelIdentifier *cid,
                            struct CadetPeerPath *path)
{
  struct CadetTConnection *ct;
 
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create_inbound (t->destination,
                               path,
                               ct,
                               cid,
                               &connection_ready_cb,
                               ct);
  if (NULL == ct->cc)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s refused inbound %s (duplicate)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    GNUNET_free (ct);
    return GNUNET_SYSERR;
  }
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s has new %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_OK;
}
 
 
void
GCT_handle_encrypted (struct CadetTConnection *ct,
                      const struct GNUNET_CADET_TunnelEncryptedMessage *msg)
{
  struct CadetTunnel *t = ct->t;
  uint16_t size = ntohs (msg->header.size);
  char cbuf[size] GNUNET_ALIGN;
  ssize_t decrypted_size;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s received %u bytes of encrypted data in state %d\n",
       GCT_2s (t),
       (unsigned int) size,
       t->estate);
 
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* We did not even SEND our KX, how can the other peer
       send us encrypted data? Must have been that we went
       down and the other peer still things we are up.
       Let's send it KX back. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without any KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We send KX, and other peer send KX to us at the same time.
       Neither KX is AUTH'ed, so let's try KX_AUTH this time. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX_AUTH",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_YES);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT:
    /* We did not get the KX of the other peer, but that
       might have been lost.  Send our KX again immediately. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
  /* Great, first payload, we might graduate to OK! */
  case CADET_TUNNEL_KEY_OK:
    /* We are up and running, all good. */
    break;
  }
 
  decrypted_size = -1;
  if (CADET_TUNNEL_KEY_OK == t->estate)
  {
    /* We have well-established key material available,
       try that. (This is the common case.) */
    decrypted_size = t_ax_decrypt_and_validate (&t->ax,
                                                cbuf,
                                                msg,
                                                size);
  }
 
  if ((-1 == decrypted_size) &&
      (NULL != t->unverified_ax))
  {
    /* We have un-authenticated KX material available. We should try
       this as a back-up option, in case the sender crashed and
       switched keys. */
    decrypted_size = t_ax_decrypt_and_validate (t->unverified_ax,
                                                cbuf,
                                                msg,
                                                size);
    if (-1 != decrypted_size)
    {
      /* It worked! Treat this as authentication of the AX data! */
      cleanup_ax (&t->ax);
      t->ax = *t->unverified_ax;
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
    if (CADET_TUNNEL_KEY_AX_AUTH_SENT == t->estate)
    {
      /* First time it worked, move tunnel into production! */
      GCT_change_estate (t,
                         CADET_TUNNEL_KEY_OK);
      if (NULL != t->send_task)
        GNUNET_SCHEDULER_cancel (t->send_task);
      t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                               t);
    }
  }
  if (NULL != t->unverified_ax)
  {
    /* We had unverified KX material that was useless; so increment
       counter and eventually move to ignore it.  Note that we even do
       this increment if we successfully decrypted with the old KX
       material and thus didn't even both with the new one.  This is
       the ideal case, as a malicious injection of bogus KX data
       basically only causes us to increment a counter a few times. */t->unverified_attempts++;
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Failed to decrypt message with unverified KX data %u times\n",
         t->unverified_attempts);
    if (t->unverified_attempts > MAX_UNVERIFIED_ATTEMPTS)
    {
      cleanup_ax (t->unverified_ax);
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
  }
 
  if (-1 == decrypted_size)
  {
    /* Decryption failed for good, complain. */
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "%s failed to decrypt and validate encrypted data, retrying KX\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# unable to decrypt",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
  }
  GNUNET_STATISTICS_update (stats,
                            "# decrypted bytes",
                            decrypted_size,
                            GNUNET_NO);
 
  /* The MST will ultimately call #handle_decrypted() on each message. */
  t->current_ct = ct;
  GNUNET_break_op (GNUNET_OK ==
                   GNUNET_MST_from_buffer (t->mst,
                                           cbuf,
                                           decrypted_size,
                                           GNUNET_YES,
                                           GNUNET_NO));
  t->current_ct = NULL;
}
 
 
struct CadetTunnelQueueEntry *
GCT_send (struct CadetTunnel *t,
          const struct GNUNET_MessageHeader *message,
          GCT_SendContinuation cont,
          void *cont_cls,
          struct GNUNET_CADET_ChannelTunnelNumber *ctn)
{
  struct CadetTunnelQueueEntry *tq;
  uint16_t message_size;
  uint16_t payload_size;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelEncryptedMessage *ax_msg;
  struct CadetChannel *ch;
 
  if (NULL != ctn)
  {
    ch = lookup_channel (t,
                         *ctn);
    if ((NULL != ch) && GCCH_is_type_to_drop (ch, message))
    {
      GNUNET_break (0);
      return NULL;
    }
  }
 
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    GNUNET_break (0);
    return NULL;
  }
  message_size = ntohs (message->size);
  payload_size = message_size + sizeof (struct GNUNET_CRYPTO_AeadMac);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Encrypting %u bytes for %s\n",
       (unsigned int) message_size,
       GCT_2s (t));
  env = GNUNET_MQ_msg_extra (ax_msg,
                             payload_size,
                             GNUNET_MESSAGE_TYPE_CADET_TUNNEL_ENCRYPTED);
  t_ax_encrypt (&t->ax,
                &ax_msg[1],
                message,
                message_size);
  GNUNET_STATISTICS_update (stats,
                            "# encrypted bytes",
                            payload_size,
                            GNUNET_NO);
  ax_msg->ax_header.Ns = htonl (t->ax.Ns++);
  ax_msg->ax_header.PNs = htonl (t->ax.PNs);
  /* FIXME: we should do this once, not once per message;
     this is a point multiplication, and DHRs does not
     change all the time. */
  GNUNET_CRYPTO_ecdhe_key_get_public (&t->ax.DHRs,
                                      &ax_msg->ax_header.DHRs);
  t_h_encrypt (&t->ax,
               ax_msg,
               payload_size,
               (unsigned char*) &ax_msg[1]);
 
  tq = GNUNET_malloc (sizeof(*tq));
  tq->t = t;
  tq->env = env;
  tq->cid = &ax_msg->cid; /* will initialize 'ax_msg->cid' once we know the connection */
  tq->cont = cont;
  tq->cont_cls = cont_cls;
  GNUNET_CONTAINER_DLL_insert_tail (t->tq_head,
                                    t->tq_tail,
                                    tq);
  if (NULL != t->send_task)
    GNUNET_SCHEDULER_cancel (t->send_task);
  t->send_task
    = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                t);
  return tq;
}
 
 
void
GCT_send_cancel (struct CadetTunnelQueueEntry *tq)
{
  struct CadetTunnel *t = tq->t;
 
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  GNUNET_MQ_discard (tq->env);
  GNUNET_free (tq);
}
 
 
void
GCT_iterate_connections (struct CadetTunnel *t,
                         GCT_ConnectionIterator iter,
                         void *iter_cls)
{
  struct CadetTConnection *n;
 
  for (struct CadetTConnection *ct = t->connection_ready_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
  for (struct CadetTConnection *ct = t->connection_busy_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
}
 
 
struct ChanIterCls
{
  GCT_ChannelIterator iter;
 
  void *iter_cls;
};
 
 
static int
iterate_channels_cb (void *cls,
                     uint32_t key,
                     void *value)
{
  struct ChanIterCls *ctx = cls;
  struct CadetChannel *ch = value;
 
  ctx->iter (ctx->iter_cls,
             ch);
  return GNUNET_OK;
}
 
 
void
GCT_iterate_channels (struct CadetTunnel *t,
                      GCT_ChannelIterator iter,
                      void *iter_cls)
{
  struct ChanIterCls ctx;
 
  ctx.iter = iter;
  ctx.iter_cls = iter_cls;
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &iterate_channels_cb,
                                           &ctx);
}
 
 
static int
debug_channel (void *cls,
               uint32_t key,
               void *value)
{
  const enum GNUNET_ErrorType *level = cls;
  struct CadetChannel *ch = value;
 
  GCCH_debug (ch, *level);
  return GNUNET_OK;
}
 
 
#define LOG2(level, ...) GNUNET_log_from_nocheck (level, "cadet-tun", \
                                                  __VA_ARGS__)
 
 
void
GCT_debug (const struct CadetTunnel *t,
           enum GNUNET_ErrorType level)
{
#if ! defined(GNUNET_CULL_LOGGING)
  struct CadetTConnection *iter_c;
  int do_log;
 
  do_log = GNUNET_get_log_call_status (level & (~GNUNET_ERROR_TYPE_BULK),
                                       "cadet-tun",
                                       __FILE__, __FUNCTION__, __LINE__);
  if (0 == do_log)
    return;
 
  LOG2 (level,
        "TTT TUNNEL TOWARDS %s in estate %s tq_len: %u #cons: %u\n",
        GCT_2s (t),
        estate2s (t->estate),
        t->tq_len,
        GCT_count_any_connections (t));
  LOG2 (level,
        "TTT channels:\n");
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &debug_channel,
                                           &level);
  LOG2 (level,
        "TTT connections:\n");
  for (iter_c = t->connection_ready_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
  for (iter_c = t->connection_busy_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
 
  LOG2 (level,
        "TTT TUNNEL END\n");
#endif
}
 
 
/* end of gnunet-service-cadet_tunnels.c */