gnunet-communicator-udp.c

Go to the documentation of this file.

/*
     This file is part of GNUnet
     Copyright (C) 2010-2014, 2018, 2019, 2026 GNUnet e.V.
 
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
     by the Free Software Foundation, either version 3 of the License,
     or (at your option) any later version.
 
     GNUnet is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Affero General Public License for more details.
 :
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     SPDX-License-Identifier: AGPL3.0-or-later
 */
 
#include "platform.h"
#include "gnunet_common.h"
#include "gnunet_util_lib.h"
#include "gnunet_protocols.h"
#include "gnunet_signatures.h"
#include "gnunet_constants.h"
#include "gnunet_pils_service.h"
#include "gnunet_nat_service.h"
#include "gnunet_statistics_service.h"
#include "gnunet_transport_application_service.h"
#include "gnunet_transport_communication_service.h"
 
/* Shorthand for Logging */
#define LOG(kind, ...) GNUNET_log_from (kind, "communicator-udp", __VA_ARGS__)
 
#define DEFAULT_REKEY_TIME_INTERVAL GNUNET_TIME_UNIT_DAYS
 
#define PROTO_QUEUE_TIMEOUT GNUNET_TIME_UNIT_MINUTES
 
#define PEER_LIVENESS_TIMEOUT GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT
 
#define BROADCAST_FREQUENCY GNUNET_TIME_UNIT_MINUTES
 
#define INTERFACE_SCAN_FREQUENCY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define ADDRESS_VALIDITY_PERIOD GNUNET_TIME_UNIT_HOURS
 
#define WORKING_QUEUE_INTERVALL \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MICROSECONDS,1)
 
#define AES_KEY_SIZE (256 / 8)
 
#define AES_IV_SIZE (96 / 8)
 
#define GCM_TAG_SIZE (128 / 8)
 
#define GENERATE_AT_ONCE 64
 
#define KCN_THRESHOLD 96
 
#define KCN_TARGET 128
 
#define MAX_SQN_DELTA 160
 
#define MAX_SECRETS 256
 
#define DEFAULT_REKEY_MAX_BYTES (1024LLU * 1024 * 1024 * 4LLU)
 
#define COMMUNICATOR_ADDRESS_PREFIX "udp"
 
#define COMMUNICATOR_CONFIG_SECTION "communicator-udp"
 
GNUNET_NETWORK_STRUCT_BEGIN
 
 
struct UdpHandshakeSignature
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_PeerIdentity sender;
 
  struct GNUNET_PeerIdentity receiver;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation enc;
 
  struct GNUNET_TIME_AbsoluteNBO monotonic_time;
};
 
 
struct InitialKX
{
  struct GNUNET_CRYPTO_HpkeEncapsulation enc;
 
  uint8_t gcm_tag[GCM_TAG_SIZE];
 
};
 
 
struct UDPConfirmation
{
  struct GNUNET_PeerIdentity sender;
 
  struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
  struct GNUNET_TIME_AbsoluteNBO monotonic_time;
 
  /* followed by messages */
 
  /* padding may follow actual messages */
};
 
 
struct UDPAck
{
  struct GNUNET_MessageHeader header;
 
  uint32_t sequence_ack GNUNET_PACKED;
 
  struct GNUNET_HashCode cmac;
};
 
 
struct UdpBroadcastSignature
{
  struct GNUNET_CRYPTO_SignaturePurpose purpose;
 
  struct GNUNET_PeerIdentity sender;
 
  struct GNUNET_HashCode h_address;
};
 
 
struct UDPBroadcast
{
  struct GNUNET_PeerIdentity sender;
 
  struct GNUNET_CRYPTO_EddsaSignature sender_sig;
};
 
 
struct UDPBox
{
  struct GNUNET_ShortHashCode kid;
 
  uint8_t gcm_tag[GCM_TAG_SIZE];
 
};
 
struct UDPRekey
{
  struct GNUNET_MessageHeader header;
 
  struct GNUNET_CRYPTO_HpkeEncapsulation ephemeral;
};
 
GNUNET_NETWORK_STRUCT_END
 
struct SharedSecret;
 
 
struct KeyCacheEntry
{
  struct KeyCacheEntry *next;
 
  struct KeyCacheEntry *prev;
 
  struct GNUNET_ShortHashCode kid;
 
  struct SharedSecret *ss;
 
  uint32_t sequence_number;
};
 
 
struct SenderAddress;
 
struct ReceiverAddress;
 
struct SharedSecret
{
  struct SharedSecret *next;
 
  struct SharedSecret *prev;
 
  struct KeyCacheEntry *kce_head;
 
  struct KeyCacheEntry *kce_tail;
 
  struct SenderAddress *sender;
 
  struct ReceiverAddress *receiver;
 
  struct GNUNET_ShortHashCode master;
 
  struct GNUNET_HashCode cmac;
 
  uint32_t sequence_used;
 
  uint32_t sequence_allowed;
 
  unsigned int active_kce_count;
 
  size_t bytes_sent;
 
  int rekey_initiated;
 
  int override_available_acks;
};
 
 
struct SenderAddress
{
  struct GNUNET_PeerIdentity target;
 
  struct GNUNET_CONTAINER_HeapNode *hn;
 
  struct SharedSecret *ss_head;
 
  struct SharedSecret *ss_tail;
 
  struct sockaddr *address;
 
  socklen_t address_len;
 
  struct GNUNET_HashCode key;
 
  struct GNUNET_TIME_Absolute timeout;
 
  unsigned int num_secrets;
 
  unsigned int acks_available;
 
  enum GNUNET_NetworkType nt;
 
  int sender_destroy_called;
 
  struct GNUNET_SCHEDULER_Task *kce_task;
 
  int kce_task_finished;
 
  int kce_send_ack_on_finish;
};
 
 
struct ReceiverAddress
{
  struct GNUNET_TIME_Absolute rekey_timeout;
 
  struct GNUNET_PeerIdentity target;
 
  struct GNUNET_CRYPTO_HpkePublicKey target_hpke_key;
 
  struct GNUNET_HashCode key;
 
  struct SharedSecret *ss_head;
 
  struct SharedSecret *ss_tail;
 
  char *foreign_addr;
 
  struct sockaddr *address;
 
  socklen_t address_len;
 
  struct GNUNET_CONTAINER_HeapNode *hn;
 
  struct GNUNET_MQ_Handle *kx_mq;
 
  struct GNUNET_MQ_Handle *d_mq;
 
  struct GNUNET_TRANSPORT_QueueHandle *kx_qh;
 
  struct GNUNET_TRANSPORT_QueueHandle *d_qh;
 
  struct GNUNET_TIME_Absolute timeout;
 
  struct GNUNET_TIME_Absolute last_ack;
 
  struct GNUNET_NETWORK_Handle *udp_sock;
 
  struct GNUNET_SCHEDULER_Task *read_task;
 
  size_t kx_mtu;
 
  size_t d_mtu;
 
  unsigned int num_secrets;
 
  unsigned int acks_available;
 
  enum GNUNET_NetworkType nt;
 
  int receiver_destroy_called;
};
 
struct BroadcastInterface
{
  struct BroadcastInterface *next;
 
  struct BroadcastInterface *prev;
 
  struct GNUNET_SCHEDULER_Task *broadcast_task;
 
  struct sockaddr *sa;
 
  struct sockaddr *ba;
 
  struct UDPBroadcast bcm;
 
  struct ipv6_mreq mcreq;
 
  socklen_t salen;
 
  int found;
};
 
static struct GNUNET_PILS_KeyRing *key_ring;
 
static struct GNUNET_PILS_Handle *pils;
 
static struct GNUNET_TIME_Relative rekey_interval;
 
static unsigned long long rekey_max_bytes;
 
static struct GNUNET_CONTAINER_MultiShortmap *key_cache;
 
static struct GNUNET_SCHEDULER_Task *read_v4_task;
 
static struct GNUNET_SCHEDULER_Task *read_v6_task;
 
static struct GNUNET_SCHEDULER_Task *timeout_task;
 
static struct GNUNET_SCHEDULER_Task *broadcast_task;
 
static struct GNUNET_STATISTICS_Handle *stats;
 
static struct GNUNET_TRANSPORT_CommunicatorHandle *ch;
 
static struct GNUNET_CONTAINER_MultiHashMap *receivers;
 
static struct GNUNET_CONTAINER_MultiHashMap *senders;
 
static struct GNUNET_CONTAINER_Heap *senders_heap;
 
static struct GNUNET_CONTAINER_Heap *receivers_heap;
 
static struct BroadcastInterface *bi_head;
 
static struct BroadcastInterface *bi_tail;
 
static struct GNUNET_NETWORK_Handle *default_v4_sock;
 
static struct GNUNET_NETWORK_Handle *default_v6_sock;
 
static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
static struct GNUNET_TRANSPORT_ApplicationHandle *ah;
 
static struct GNUNET_NT_InterfaceScanner *is;
 
static struct GNUNET_NAT_Handle *nat;
 
static uint16_t my_port;
 
char *my_ipv4;
 
static int disable_v6;
 
static struct GNUNET_SCHEDULER_Task *burst_task;
 
 
static void
eddsa_priv_to_hpke_key (const struct GNUNET_CRYPTO_EddsaPrivateKey *edpk,
                        struct GNUNET_CRYPTO_HpkePrivateKey *pk)
{
  struct GNUNET_CRYPTO_BlindablePrivateKey key;
  key.type = htonl (GNUNET_PUBLIC_KEY_TYPE_EDDSA);
  key.eddsa_key = *edpk;
  GNUNET_CRYPTO_hpke_sk_to_x25519 (&key,
                                   pk);
}
 
 
static void
eddsa_pub_to_hpke_key (const struct GNUNET_CRYPTO_EddsaPublicKey *edpk,
                       struct GNUNET_CRYPTO_HpkePublicKey *pk)
{
  struct GNUNET_CRYPTO_BlindablePublicKey key;
  key.type = htonl (GNUNET_PUBLIC_KEY_TYPE_EDDSA);
  key.eddsa_key = *edpk;
  GNUNET_CRYPTO_hpke_pk_to_x25519 (&key,
                                   pk);
}
 
 
static void
bi_destroy (struct BroadcastInterface *bi)
{
  if (AF_INET6 == bi->sa->sa_family)
  {
    /* Leave the multicast group */
    if (GNUNET_OK != GNUNET_NETWORK_socket_setsockopt (default_v6_sock,
                                                       IPPROTO_IPV6,
                                                       IPV6_LEAVE_GROUP,
                                                       &bi->mcreq,
                                                       sizeof(bi->mcreq)))
    {
      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "setsockopt");
    }
  }
  GNUNET_CONTAINER_DLL_remove (bi_head, bi_tail, bi);
  GNUNET_SCHEDULER_cancel (bi->broadcast_task);
  GNUNET_free (bi->sa);
  GNUNET_free (bi->ba);
  GNUNET_free (bi);
}
 
 
static int
secret_destroy (struct SharedSecret *ss);
 
static void
receiver_destroy (struct ReceiverAddress *receiver)
{
  struct SharedSecret *ss;
  receiver->receiver_destroy_called = GNUNET_YES;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Disconnecting receiver for peer `%s'\n",
              GNUNET_i2s (&receiver->target));
  if (NULL != receiver->kx_qh)
  {
    GNUNET_TRANSPORT_communicator_mq_del (receiver->kx_qh);
    receiver->kx_qh = NULL;
    receiver->kx_mq = NULL;
  }
  if (NULL != receiver->d_qh)
  {
    GNUNET_TRANSPORT_communicator_mq_del (receiver->d_qh);
    receiver->d_qh = NULL;
  }
  else if (NULL != receiver->d_mq)
  {
    GNUNET_MQ_destroy (receiver->d_mq);
    receiver->d_mq = NULL;
  }
  if (NULL != receiver->udp_sock)
  {
    GNUNET_break (GNUNET_OK ==
                  GNUNET_NETWORK_socket_close (receiver->udp_sock));
    receiver->udp_sock = NULL;
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap_remove (receivers,
                                                       &receiver->key,
                                                       receiver));
  GNUNET_assert (receiver == GNUNET_CONTAINER_heap_remove_node (receiver->hn));
  GNUNET_STATISTICS_set (stats,
                         "# receivers active",
                         GNUNET_CONTAINER_multihashmap_size (receivers),
                         GNUNET_NO);
  while (NULL != (ss = receiver->ss_head))
  {
    secret_destroy (ss);
  }
  GNUNET_free (receiver->address);
  GNUNET_free (receiver->foreign_addr);
  GNUNET_free (receiver);
}
 
 
static void
kce_destroy (struct KeyCacheEntry *kce)
{
  struct SharedSecret *ss = kce->ss;
 
  ss->active_kce_count--;
  /* @e acks_available is "how many BOX keys do we have ready for this
     sender", so it must be maintained here, where a key actually goes away,
     and nowhere else.  #kce_generate() is the only place one comes into
     existence. */
  if (NULL != ss->sender)
  {
    GNUNET_break (0 < ss->sender->acks_available);
    if (0 < ss->sender->acks_available)
      ss->sender->acks_available--;
  }
  GNUNET_CONTAINER_DLL_remove (ss->kce_head, ss->kce_tail, kce);
  GNUNET_assert (GNUNET_YES == GNUNET_CONTAINER_multishortmap_remove (key_cache,
                                                                      &kce->kid,
                                                                      kce));
  GNUNET_free (kce);
}
 
 
static void
get_kid (const struct GNUNET_ShortHashCode *msec,
         uint32_t serial,
         struct GNUNET_ShortHashCode *kid)
{
  uint32_t sid = htonl (serial);
  struct GNUNET_ShortHashCode prk;
  GNUNET_CRYPTO_hkdf_extract (&prk,
                              &sid, sizeof (sid),
                              msec, sizeof (*msec));
 
  GNUNET_CRYPTO_hkdf_expand (
    kid,
    sizeof(*kid),
    &prk,
    GNUNET_CRYPTO_kdf_arg_string ("gnunet-communicator-udp-kid"));
}
 
 
static void
kce_generate (struct SharedSecret *ss, uint32_t seq)
{
  struct KeyCacheEntry *kce;
 
  GNUNET_assert (0 < seq);
  kce = GNUNET_new (struct KeyCacheEntry);
  kce->ss = ss;
  kce->sequence_number = seq;
  get_kid (&ss->master, seq, &kce->kid);
  GNUNET_CONTAINER_DLL_insert (ss->kce_head, ss->kce_tail, kce);
  ss->active_kce_count++;
  ss->sender->acks_available++;
  (void) GNUNET_CONTAINER_multishortmap_put (
    key_cache,
    &kce->kid,
    kce,
    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
  GNUNET_STATISTICS_set (stats,
                         "# KIDs active",
                         GNUNET_CONTAINER_multishortmap_size (key_cache),
                         GNUNET_NO);
}
 
 
static int
secret_destroy (struct SharedSecret *ss)
{
  struct SenderAddress *sender;
  struct ReceiverAddress *receiver;
  struct KeyCacheEntry *kce;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "secret %s destroy %u\n",
              GNUNET_sh2s (&ss->master),
              ss->sequence_allowed);
  if (NULL != (sender = ss->sender))
  {
    GNUNET_CONTAINER_DLL_remove (sender->ss_head, sender->ss_tail, ss);
    sender->num_secrets--;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "%u sender->num_secrets %u allowed %u used, %u available\n",
                sender->num_secrets, ss->sequence_allowed, ss->sequence_used,
                sender->acks_available);
    /* NOTE: this used to subtract `sequence_allowed - sequence_used', which
       is not the number of keys this secret still holds.  Keys also go away
       without @e sequence_used moving: #consider_ss_ack() drops entries past
       #MAX_SQN_DELTA, and #decrypt_box() destroys the entry of a datagram
       that failed to decrypt.  Over-subtracting wraps this unsigned counter
       to ~4e9, after which `KCN_THRESHOLD > acks_available' is false
       forever: we never generate another key, never send another UDPAck,
       and the peer -- which can only send BOXes for sequence numbers we
       acknowledged -- falls back to a full key exchange per datagram for
       good.  The #kce_destroy() loop below now accounts for exactly the keys
       that existed. */
    if (NULL != ss->sender->kce_task)
    {
      GNUNET_SCHEDULER_cancel (ss->sender->kce_task);
      ss->sender->kce_task = NULL;
    }
  }
  if (NULL != (receiver = ss->receiver))
  {
    GNUNET_CONTAINER_DLL_remove (receiver->ss_head, receiver->ss_tail, ss);
    receiver->num_secrets--;
    receiver->acks_available -= (ss->sequence_allowed - ss->sequence_used);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "%u receiver->num_secrets\n",
                receiver->num_secrets);
  }
  while (NULL != (kce = ss->kce_head))
    kce_destroy (kce);
  GNUNET_STATISTICS_update (stats, "# Secrets active", -1, GNUNET_NO);
  GNUNET_STATISTICS_set (stats,
                         "# KIDs active",
                         GNUNET_CONTAINER_multishortmap_size (key_cache),
                         GNUNET_NO);
  GNUNET_free (ss);
  return GNUNET_YES;
}
 
 
static void
sender_destroy (struct SenderAddress *sender)
{
  struct SharedSecret *ss;
  sender->sender_destroy_called = GNUNET_YES;
  GNUNET_assert (
    GNUNET_YES ==
    GNUNET_CONTAINER_multihashmap_remove (senders, &sender->key, sender));
  GNUNET_assert (sender == GNUNET_CONTAINER_heap_remove_node (sender->hn));
  GNUNET_STATISTICS_set (stats,
                         "# senders active",
                         GNUNET_CONTAINER_multihashmap_size (senders),
                         GNUNET_NO);
  while (NULL != (ss = sender->ss_head))
  {
    secret_destroy (ss);
  }
  GNUNET_free (sender->address);
  GNUNET_free (sender);
}
 
 
static void
get_iv_key (const struct GNUNET_ShortHashCode *msec,
            uint32_t serial,
            char key[AES_KEY_SIZE],
            char iv[AES_IV_SIZE])
{
  uint32_t sid = htonl (serial);
 
  GNUNET_CRYPTO_hkdf_expand (
    key,
    AES_KEY_SIZE,
    msec,
    GNUNET_CRYPTO_kdf_arg_string ("gnunet-communicator-udp-key"),
    GNUNET_CRYPTO_kdf_arg_auto (&sid));
  GNUNET_CRYPTO_hkdf_expand (
    iv,
    AES_IV_SIZE,
    msec,
    GNUNET_CRYPTO_kdf_arg_string ("gnunet-communicator-udp-iv"),
    GNUNET_CRYPTO_kdf_arg_auto (&sid));
}
 
 
static void
reschedule_sender_timeout (struct SenderAddress *sender)
{
  sender->timeout =
    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
  GNUNET_CONTAINER_heap_update_cost (sender->hn, sender->timeout.abs_value_us);
}
 
 
static void
reschedule_receiver_timeout (struct ReceiverAddress *receiver)
{
  receiver->timeout =
    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
  GNUNET_CONTAINER_heap_update_cost (receiver->hn,
                                     receiver->timeout.abs_value_us);
}
 
 
static enum GNUNET_GenericReturnValue
check_peer_alive (struct ReceiverAddress *receiver)
{
  if (GNUNET_TIME_relative_cmp (
        GNUNET_TIME_absolute_get_duration (receiver->last_ack),
        <=,
        PEER_LIVENESS_TIMEOUT))
    return GNUNET_YES;
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
              "Peer `%s' did not acknowledge a single datagram for %s while we "
              "kept transmitting, considering it disconnected\n",
              GNUNET_i2s (&receiver->target),
              GNUNET_STRINGS_relative_time_to_string (PEER_LIVENESS_TIMEOUT,
                                                      GNUNET_YES));
  GNUNET_STATISTICS_update (stats,
                            "# receivers destroyed (peer unresponsive)",
                            1,
                            GNUNET_NO);
  if (GNUNET_YES != receiver->receiver_destroy_called)
    receiver_destroy (receiver);
  return GNUNET_NO;
}
 
 
static void
check_timeouts (void *cls)
{
  struct GNUNET_TIME_Relative st;
  struct GNUNET_TIME_Relative rt;
  struct GNUNET_TIME_Relative delay;
  struct ReceiverAddress *receiver;
  struct SenderAddress *sender;
 
  (void) cls;
  timeout_task = NULL;
  rt = GNUNET_TIME_UNIT_FOREVER_REL;
  while (NULL != (receiver = GNUNET_CONTAINER_heap_peek (receivers_heap)))
  {
    rt = GNUNET_TIME_absolute_get_remaining (receiver->timeout);
    if (0 != rt.rel_value_us)
      break;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Receiver timed out\n");
    receiver_destroy (receiver);
  }
  st = GNUNET_TIME_UNIT_FOREVER_REL;
  while (NULL != (sender = GNUNET_CONTAINER_heap_peek (senders_heap)))
  {
    /* NOTE: no @e sender_destroy_called check here -- #sender_destroy()
       removes the node from the heap, so anything we can peek at is live.
       Skipping instead of breaking would spin forever on the same node. */
    st = GNUNET_TIME_absolute_get_remaining (sender->timeout);
    if (0 != st.rel_value_us)
      break;
    sender_destroy (sender);
  }
  delay = GNUNET_TIME_relative_min (rt, st);
  if (delay.rel_value_us < GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
    timeout_task = GNUNET_SCHEDULER_add_delayed (delay, &check_timeouts, NULL);
}
 
 
static void
calculate_cmac (struct SharedSecret *ss)
{
  GNUNET_CRYPTO_hkdf_expand (
    &ss->cmac,
    sizeof(ss->cmac),
    &ss->master,
    GNUNET_CRYPTO_kdf_arg_string ("gnunet-communicator-udp-cmac"));
}
 
 
static void
pass_plaintext_to_core (struct SenderAddress *sender,
                        const void *plaintext,
                        size_t plaintext_len)
{
  const struct GNUNET_MessageHeader *hdr = plaintext;
  const char *pos = plaintext;
 
  while (ntohs (hdr->size) <= plaintext_len)
  {
    GNUNET_STATISTICS_update (stats,
                              "# bytes given to core",
                              ntohs (hdr->size),
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Giving %u bytes to TNG\n", ntohs (hdr->size));
    GNUNET_assert (GNUNET_SYSERR !=
                   GNUNET_TRANSPORT_communicator_receive (ch,
                                                          &sender->target,
                                                          hdr,
                                                          ADDRESS_VALIDITY_PERIOD,
                                                          NULL /* no flow control possible */
                                                          ,
                                                          NULL));
    /* move on to next message, if any */
    plaintext_len -= ntohs (hdr->size);
    if (plaintext_len < sizeof(*hdr))
      break;
    pos += ntohs (hdr->size);
    hdr = (const struct GNUNET_MessageHeader *) pos;
    // TODO for now..., we do not actually sen >1msg or have a way of telling
    // if we are done
    break;
  }
  GNUNET_STATISTICS_update (stats,
                            "# bytes padding discarded",
                            plaintext_len,
                            GNUNET_NO);
}
 
 
static void
setup_cipher (const struct GNUNET_ShortHashCode *msec,
              uint32_t serial,
              gcry_cipher_hd_t *cipher)
{
  char key[AES_KEY_SIZE];
  char iv[AES_IV_SIZE];
  int rc;
 
  GNUNET_assert (0 ==
                 gcry_cipher_open (cipher,
                                   GCRY_CIPHER_AES256 /* low level: go for speed */
                                   ,
                                   GCRY_CIPHER_MODE_GCM,
                                   0 /* flags */));
  get_iv_key (msec, serial, key, iv);
  rc = gcry_cipher_setkey (*cipher, key, sizeof(key));
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
  rc = gcry_cipher_setiv (*cipher, iv, sizeof(iv));
  GNUNET_assert ((0 == rc) || ((char) rc == GPG_ERR_WEAK_KEY));
}
 
 
static int
try_decrypt (const struct SharedSecret *ss,
             const uint8_t *tag,
             uint32_t serial,
             const char *in_buf,
             size_t in_buf_size,
             char *out_buf)
{
  gcry_cipher_hd_t cipher;
 
  setup_cipher (&ss->master, serial, &cipher);
  GNUNET_assert (
    0 ==
    gcry_cipher_decrypt (cipher, out_buf, in_buf_size, in_buf, in_buf_size));
  if (0 != gcry_cipher_checktag (cipher, tag, GCM_TAG_SIZE))
  {
    gcry_cipher_close (cipher);
    GNUNET_STATISTICS_update (stats,
                              "# AEAD authentication failures",
                              1,
                              GNUNET_NO);
    return GNUNET_SYSERR;
  }
  gcry_cipher_close (cipher);
  return GNUNET_OK;
}
 
 
static struct SharedSecret *
setup_shared_secret_dec (const struct GNUNET_CRYPTO_HpkeEncapsulation *ephemeral
                         )
{
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  struct SharedSecret *ss;
 
  my_private_key = GNUNET_PILS_key_ring_get_private_key (key_ring);
  GNUNET_assert (my_private_key);
 
  ss = GNUNET_new (struct SharedSecret);
  GNUNET_CRYPTO_eddsa_kem_decaps (my_private_key,
                                  ephemeral,
                                  &ss->master);
  calculate_cmac (ss);
  return ss;
}
 
 
static struct SharedSecret *
setup_initial_shared_secret_dec (const struct
                                 GNUNET_CRYPTO_HpkeEncapsulation *c)
{
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  struct GNUNET_CRYPTO_HpkePrivateKey my_hpke_key;
  struct SharedSecret *ss;
 
  my_private_key = GNUNET_PILS_key_ring_get_private_key (key_ring);
  GNUNET_assert (my_private_key);
 
  eddsa_priv_to_hpke_key (my_private_key, &my_hpke_key);
 
  ss = GNUNET_new (struct SharedSecret);
  GNUNET_CRYPTO_hpke_elligator_kem_decaps (&my_hpke_key, c,
                                           &ss->master);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "New receiver SS master: %s\n", GNUNET_sh2s (&ss->master));
  calculate_cmac (ss);
  return ss;
}
 
 
static struct SharedSecret *
setup_shared_secret_ephemeral (struct GNUNET_CRYPTO_HpkeEncapsulation *ephemeral
                               ,
                               struct ReceiverAddress *receiver)
{
  struct SharedSecret *ss;
 
  ss = GNUNET_new (struct SharedSecret);
  GNUNET_CRYPTO_eddsa_kem_encaps (&receiver->target.public_key,
                                  ephemeral,
                                  &ss->master);
  calculate_cmac (ss);
  ss->receiver = receiver;
  GNUNET_CONTAINER_DLL_insert (receiver->ss_head, receiver->ss_tail, ss);
  receiver->num_secrets++;
  GNUNET_STATISTICS_update (stats, "# Secrets active", 1, GNUNET_NO);
  return ss;
}
 
 
static struct SharedSecret *
setup_initial_shared_secret_ephemeral (
  struct GNUNET_CRYPTO_HpkeEncapsulation *c,
  struct ReceiverAddress *receiver)
{
  struct SharedSecret *ss;
 
  ss = GNUNET_new (struct SharedSecret);
  GNUNET_CRYPTO_hpke_elligator_kem_encaps (&receiver->target_hpke_key,
                                           c, &ss->master);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "New sender SS master: %s\n", GNUNET_sh2s (&ss->master));
  calculate_cmac (ss);
  ss->receiver = receiver;
  GNUNET_CONTAINER_DLL_insert (receiver->ss_head, receiver->ss_tail, ss);
  receiver->num_secrets++;
  GNUNET_STATISTICS_update (stats, "# Secrets active", 1, GNUNET_NO);
  return ss;
}
 
 
static void
setup_receiver_mq (struct ReceiverAddress *receiver);
 
 
static unsigned int
purge_secrets (struct SharedSecret *ss_list_tail)
{
  struct SharedSecret *pos;
  struct SharedSecret *ss_to_purge;
  unsigned int deleted = 0;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Purging secrets.\n");
  pos = ss_list_tail;
  while (NULL != pos)
  {
    ss_to_purge = pos;
    pos = pos->prev;
 
    // FIXME we may also want to purge old unacked.
    if (rekey_max_bytes <= ss_to_purge->bytes_sent)
    {
      secret_destroy (ss_to_purge);
      deleted++;
    }
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Finished purging all, deleted %u.\n", deleted);
  return deleted;
}
 
 
static void
add_acks (struct SharedSecret *ss, int acks_to_add)
{
 
  struct ReceiverAddress *receiver = ss->receiver;
 
  GNUNET_assert (NULL != ss);
  GNUNET_assert (NULL != receiver);
 
  if (NULL == receiver->d_qh)
  {
    receiver->d_qh =
      GNUNET_TRANSPORT_communicator_mq_add (ch,
                                            &receiver->target,
                                            receiver->foreign_addr,
                                            receiver->d_mtu,
                                            acks_to_add,
                                            1, /* Priority */
                                            receiver->nt,
                                            GNUNET_TRANSPORT_CS_OUTBOUND,
                                            receiver->d_mq);
  }
  else
  {
    GNUNET_TRANSPORT_communicator_mq_update (ch,
                                             receiver->d_qh,
                                             acks_to_add,
                                             1);
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Tell transport we have %u more acks!\n",
              acks_to_add);
 
  // Until here for alternative 1
 
  /* move ss to head to avoid discarding it anytime soon! */
 
  // GNUNET_CONTAINER_DLL_remove (receiver->ss_head, receiver->ss_tail, ss);
  // GNUNET_CONTAINER_DLL_insert (receiver->ss_head, receiver->ss_tail, ss);
}
 
 
static int
handle_ack (void *cls, const struct GNUNET_HashCode *key, void *value)
{
  const struct UDPAck *ack = cls;
  struct ReceiverAddress *receiver = value;
  uint32_t acks_to_add;
  uint32_t allowed;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "in handle ack with cmac %s\n",
              GNUNET_h2s (&ack->cmac));
 
  (void) key;
  for (struct SharedSecret *ss = receiver->ss_head; NULL != ss; ss = ss->next)
  {
    if (0 == memcmp (&ack->cmac, &ss->cmac, sizeof(struct GNUNET_HashCode)))
    {
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Found matching cmac\n");
 
      /* Whatever window it grants us, this ACK proves the peer is alive.
         Note that this is the *only* inbound signal tied to a receiver. */
      receiver->last_ack = GNUNET_TIME_absolute_get ();
 
      allowed = ntohl (ack->sequence_ack);
 
      if (allowed <= ss->sequence_allowed)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Ignoring ack, not giving us increased window\n.");
        return GNUNET_NO;
      }
      acks_to_add = (allowed - ss->sequence_allowed);
      GNUNET_assert (0 != acks_to_add);
      receiver->acks_available += (allowed - ss->sequence_allowed);
      ss->sequence_allowed = allowed;
      add_acks (ss, acks_to_add);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "New sequence allows until %u (+%u). Acks available to us: %u. For secret %s\n",
                  allowed,
                  acks_to_add,
                  receiver->acks_available,
                  GNUNET_sh2s (&ss->master));
      return GNUNET_NO;
    }
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Matching cmac not found for ack!\n");
  return GNUNET_YES;
}
 
 
struct AckInfo
{
  const struct UDPAck *ack;
 
  const struct GNUNET_PeerIdentity *sender;
};
 
 
static int
handle_ack_by_sender (void *cls, const struct GNUNET_HashCode *key, void *value)
{
  struct ReceiverAddress *receiver = value;
  struct AckInfo *ai = cls;
 
  if (0 != GNUNET_memcmp (ai->sender, &receiver->target))
  {
    return GNUNET_YES;
  }
  handle_ack ((void*) ai->ack, key, receiver);
  return GNUNET_YES;
}
 
 
static void
consider_ss_ack (struct SharedSecret *ss)
{
  struct UDPAck ack;
  GNUNET_assert (NULL != ss->sender);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Considering SS UDPAck %s\n",
              GNUNET_i2s_full (&ss->sender->target));
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sender has %u acks available.\n",
              ss->sender->acks_available);
  /* drop ancient KeyCacheEntries */
  while ((NULL != ss->kce_head) &&
         (MAX_SQN_DELTA <
          ss->kce_head->sequence_number - ss->kce_tail->sequence_number))
    kce_destroy (ss->kce_tail);
 
 
  ack.header.type = htons (GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_ACK);
  ack.header.size = htons (sizeof(ack));
  ack.sequence_ack = htonl (ss->sequence_allowed);
  ack.cmac = ss->cmac;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Notifying transport with UDPAck %s, sequence %u and master %s\n",
              GNUNET_i2s_full (&ss->sender->target),
              ss->sequence_allowed,
              GNUNET_sh2s (&(ss->master)));
  GNUNET_TRANSPORT_communicator_notify (ch,
                                        &ss->sender->target,
                                        COMMUNICATOR_ADDRESS_PREFIX,
                                        &ack.header);
}
 
 
static void
kce_generate_cb (void *cls)
{
  struct SharedSecret *ss = cls;
  ss->sender->kce_task = NULL;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Precomputing %u keys for master %s\n",
              GENERATE_AT_ONCE,
              GNUNET_sh2s (&ss->master));
  if ((ss->override_available_acks != GNUNET_YES) &&
      (KCN_TARGET < ss->sender->acks_available) &&
      (0 != ss->sequence_allowed))
  {
    /* Enough keys for this sender overall, and this secret already has some
       the peer may use.
       Do NOT just return: @e kce_task_finished is a latch that decides which
       of the two places that arm this task is allowed to do so -- the KX
       path only arms it while it is #GNUNET_NO, #decrypt_box() only while it
       is #GNUNET_YES.  Leaving it #GNUNET_NO here means #decrypt_box() can
       never ask for more keys again, so the sender's supply runs down to
       zero and stays there.  And the peer is waiting on the UDPAck that says
       how far it may count with this secret; without it, it can only reach
       us by doing a full key exchange per datagram. */
    ss->sender->kce_task_finished = GNUNET_YES;
    ss->override_available_acks = GNUNET_NO;
    if (GNUNET_YES == ss->sender->kce_send_ack_on_finish)
      consider_ss_ack (ss);
    return;
  }
  for (int i = 0; i < GENERATE_AT_ONCE; i++)
    kce_generate (ss, ++ss->sequence_allowed);
 
  if (KCN_TARGET > ss->sender->acks_available)
  {
    ss->sender->kce_task = GNUNET_SCHEDULER_add_delayed (
      WORKING_QUEUE_INTERVALL,
      kce_generate_cb,
      ss);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "We have enough keys (ACKs: %u).\n", ss->sender->acks_available);
  ss->sender->kce_task_finished = GNUNET_YES;
  ss->override_available_acks = GNUNET_NO;
  if (ss->sender->kce_send_ack_on_finish == GNUNET_YES)
    consider_ss_ack (ss);
}
 
 
static void
try_handle_plaintext (struct SenderAddress *sender,
                      const void *buf,
                      size_t buf_size)
{
  const struct GNUNET_MessageHeader *hdr;
  const struct UDPAck *ack;
  const struct UDPRekey *rekey;
  struct SharedSecret *ss_rekey;
  const char *buf_pos = buf;
  size_t bytes_remaining = buf_size;
  uint16_t type;
 
  hdr = (struct GNUNET_MessageHeader*) buf_pos;
  if (sizeof(*hdr) > bytes_remaining)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Plaintext too short, dropping...\n");
    return; /* no data left */
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "try_handle_plaintext of size %llu (%u %lu) and type %u\n",
              (unsigned long long) bytes_remaining,
              ntohs (hdr->size),
              sizeof(*hdr),
              ntohs (hdr->type));
  if (ntohs (hdr->size) > bytes_remaining)
    return; /* buffer too short for indicated message length */
  type = ntohs (hdr->type);
  switch (type)
  {
  case GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_REKEY:
    rekey = (struct UDPRekey*) buf_pos;
    if (ntohs (hdr->size) < sizeof (struct UDPRekey))
    {
      GNUNET_break_op (0);
      return;
    }
    ss_rekey = setup_shared_secret_dec (&rekey->ephemeral);
    ss_rekey->sender = sender;
    GNUNET_CONTAINER_DLL_insert (sender->ss_head, sender->ss_tail, ss_rekey);
    sender->num_secrets++;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received rekey secret with cmac %s\n",
                GNUNET_h2s (&(ss_rekey->cmac)));
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received secret with master %s.\n",
                GNUNET_sh2s (&(ss_rekey->master)));
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "We have %u sequence_allowed.\n",
                ss_rekey->sequence_allowed);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "We have a sender %p\n",
                ss_rekey->sender);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "We have %u acks available.\n",
                ss_rekey->sender->acks_available);
    GNUNET_STATISTICS_update (stats,
                              "# rekeying successful",
                              1,
                              GNUNET_NO);
    ss_rekey->sender->kce_send_ack_on_finish = GNUNET_YES;
    ss_rekey->override_available_acks = GNUNET_YES;
    /* Go through @e kce_task rather than calling #kce_generate_cb() inline.
       That function starts with `sender->kce_task = NULL', so calling it
       directly dropped the handle of a task that may well have been armed
       for another of this sender's secrets: it still fires, but nothing can
       cancel it any more -- including #secret_destroy(), which then leaves
       it pointing at a freed `struct SharedSecret'. */
    if (NULL != ss_rekey->sender->kce_task)
      GNUNET_SCHEDULER_cancel (ss_rekey->sender->kce_task);
    ss_rekey->sender->kce_task = GNUNET_SCHEDULER_add_now (&kce_generate_cb,
                                                           ss_rekey);
    // FIXME: Theoretically, this could be an Ack
    buf_pos += ntohs (hdr->size);
    bytes_remaining -= ntohs (hdr->size);
    pass_plaintext_to_core (sender, buf_pos, bytes_remaining);
    if (0 == purge_secrets (sender->ss_tail))
    {
      // No secret purged. Delete oldest.
      if (sender->num_secrets > MAX_SECRETS)
      {
        secret_destroy (sender->ss_tail);
      }
    }
    break;
  case GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_ACK:
    /* lookup master secret by 'cmac', then update sequence_max */
    ack = (struct UDPAck*) buf_pos;
    if (ntohs (hdr->size) < sizeof (struct UDPAck))
    {
      GNUNET_break_op (0);
      return;
    }
    {
      /* NOTE: @e key of a sender is H(source address || peer), that of a
         receiver H(address we send to || peer).  Looking @a receivers up by
         the sender's key therefore only ever hits when the peer reached us
         from exactly the address we send to -- i.e. never for a peer behind
         a NAT, which is the case that needs the ACK most.  Match on the peer
         instead, the same way #enc_notify_cb() does for the backchannel. */
      struct AckInfo ai = {
        .ack = ack,
        .sender = &sender->target
      };
 
      GNUNET_CONTAINER_multihashmap_iterate (receivers,
                                             &handle_ack_by_sender,
                                             &ai);
    }
    /* There could be more messages after the ACK, handle those as well */
    buf_pos += ntohs (hdr->size);
    bytes_remaining -= ntohs (hdr->size);
    pass_plaintext_to_core (sender, buf_pos, bytes_remaining);
    break;
 
  case GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_PAD:
    /* skip padding */
    break;
 
  default:
    pass_plaintext_to_core (sender, buf_pos, bytes_remaining);
  }
  return;
}
 
 
static void
decrypt_box (const struct UDPBox *box,
             size_t box_len,
             struct KeyCacheEntry *kce)
{
  struct SharedSecret *ss = kce->ss;
  struct SharedSecret *ss_c = ss->sender->ss_tail;
  struct SharedSecret *ss_tmp;
  int ss_destroyed = 0;
  char out_buf[box_len - sizeof(*box)];
 
  GNUNET_assert (NULL != ss->sender);
  if (GNUNET_OK != try_decrypt (ss,
                                box->gcm_tag,
                                kce->sequence_number,
                                (const char *) &box[1],
                                sizeof(out_buf),
                                out_buf))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Failed decryption.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Decryption failures with valid KCE",
                              1,
                              GNUNET_NO);
    /* NOTE: no `acks_available--' here or below -- #kce_destroy() does it.
       Doing it here as well double-counted, and on this path (decryption
       failure) @e sequence_used does *not* advance, so #secret_destroy()'s
       old `sequence_allowed - sequence_used' could not have compensated for
       it either. */
    kce_destroy (kce);
    return;
  }
  kce_destroy (kce);
  kce = NULL;
  ss->bytes_sent += box_len;
  ss->sequence_used++;
  GNUNET_STATISTICS_update (stats,
                            "# bytes decrypted with BOX",
                            sizeof(out_buf),
                            GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            "# messages decrypted with BOX",
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "decrypted UDPBox with kid %s\n",
              GNUNET_sh2s (&box->kid));
  try_handle_plaintext (ss->sender, out_buf, sizeof(out_buf));
 
  while (NULL != ss_c)
  {
    if (ss_c->bytes_sent >= rekey_max_bytes)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Removing SS because rekey bytes reached.\n");
      ss_tmp = ss_c->prev;
      if (ss == ss_c)
        ss_destroyed = 1;
      secret_destroy (ss_c);
      ss_c = ss_tmp;
      continue;
    }
    ss_c = ss_c->prev;
  }
  if (1 == ss_destroyed)
    return;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sender has %u ack left.\n",
              ss->sender->acks_available);
  if ((KCN_THRESHOLD > ss->sender->acks_available) &&
      (NULL == ss->sender->kce_task) &&
      (GNUNET_YES == ss->sender->kce_task_finished))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sender has %u ack left which is under threshold.\n",
                ss->sender->acks_available);
    ss->sender->kce_send_ack_on_finish = GNUNET_YES;
    ss->sender->kce_task = GNUNET_SCHEDULER_add_now (
      kce_generate_cb,
      ss);
  }
}
 
 
struct SearchContext
{
  const struct sockaddr *address;
 
  socklen_t address_len;
 
  struct SenderAddress *sender;
};
 
 
static struct SenderAddress *
setup_sender (const struct GNUNET_PeerIdentity *target,
              const struct sockaddr *address,
              socklen_t address_len,
              int *is_new)
{
  struct SenderAddress *sender;
  struct GNUNET_HashContext *hsh;
  struct GNUNET_HashCode sender_key;
 
  hsh = GNUNET_CRYPTO_hash_context_start ();
  GNUNET_CRYPTO_hash_context_read (hsh, address, address_len);
  GNUNET_CRYPTO_hash_context_read (hsh, target, sizeof(*target));
  GNUNET_CRYPTO_hash_context_finish (hsh, &sender_key);
 
  if (NULL != is_new)
    *is_new = GNUNET_NO;
  sender = GNUNET_CONTAINER_multihashmap_get (senders, &sender_key);
  if (NULL != sender)
  {
    reschedule_sender_timeout (sender);
    return sender;
  }
  if (NULL != is_new)
    *is_new = GNUNET_YES;
  sender = GNUNET_new (struct SenderAddress);
  sender->key = sender_key;
  sender->target = *target;
  sender->address = GNUNET_memdup (address, address_len);
  sender->address_len = address_len;
  (void) GNUNET_CONTAINER_multihashmap_put (
    senders,
    &sender->key,
    sender,
    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
  GNUNET_STATISTICS_set (stats,
                         "# senders active",
                         GNUNET_CONTAINER_multihashmap_size (senders),
                         GNUNET_NO);
  sender->timeout =
    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
  sender->hn = GNUNET_CONTAINER_heap_insert (senders_heap,
                                             sender,
                                             sender->timeout.abs_value_us);
  sender->nt = GNUNET_NT_scanner_get_type (is, address, address_len);
  if (NULL == timeout_task)
    timeout_task = GNUNET_SCHEDULER_add_now (&check_timeouts, NULL);
  return sender;
}
 
 
static int
verify_confirmation (const struct GNUNET_CRYPTO_HpkeEncapsulation *enc,
                     const struct UDPConfirmation *uc)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct UdpHandshakeSignature uhs;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  uhs.purpose.purpose = htonl (
    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE);
  uhs.purpose.size = htonl (sizeof(uhs));
  uhs.sender = uc->sender;
  uhs.receiver = *my_identity;
  uhs.enc = *enc;
  uhs.monotonic_time = uc->monotonic_time;
  return GNUNET_CRYPTO_eddsa_verify (
    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE,
    &uhs,
    &uc->sender_sig,
    &uc->sender.public_key);
}
 
 
static char *
sockaddr_to_udpaddr_string (const struct sockaddr *address,
                            socklen_t address_len)
{
  char *ret;
 
  switch (address->sa_family)
  {
  case AF_INET:
    GNUNET_asprintf (&ret,
                     "%s-%s",
                     COMMUNICATOR_ADDRESS_PREFIX,
                     GNUNET_a2s (address, address_len));
    break;
 
  case AF_INET6:
    GNUNET_asprintf (&ret,
                     "%s-%s",
                     COMMUNICATOR_ADDRESS_PREFIX,
                     GNUNET_a2s (address, address_len));
    break;
 
  default:
    GNUNET_assert (0);
  }
  return ret;
}
 
 
static struct GNUNET_NETWORK_Handle *
get_socket (struct ReceiverAddress *receiver)
{
  struct GNUNET_NETWORK_Handle *udp_sock;
 
  if (NULL == receiver->udp_sock)
  {
    if (AF_INET6 == receiver->address->sa_family)
      udp_sock = default_v6_sock;
    else
      udp_sock = default_v4_sock;
  }
  else
    udp_sock = receiver->udp_sock;
 
  return udp_sock;
}
 
 
static struct sockaddr *
udp_address_to_sockaddr (const char *bindto,
                         sa_family_t family,
                         socklen_t *sock_len)
{
  struct sockaddr *in;
  unsigned int port;
  char dummy[2];
  char *colon;
  char *cp;
 
  if (1 == sscanf (bindto, "%u%1s", &port, dummy))
  {
    /* interpreting value as just a PORT number */
    if (port > UINT16_MAX)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                  "BINDTO specification `%s' invalid: value too large for port\n",
                  bindto);
      return NULL;
    }
    if ((AF_INET == family) || (GNUNET_YES == disable_v6))
    {
      struct sockaddr_in *i4;
 
      i4 = GNUNET_malloc (sizeof(struct sockaddr_in));
      i4->sin_family = AF_INET;
      i4->sin_port = htons ((uint16_t) port);
      *sock_len = sizeof(struct sockaddr_in);
      in = (struct sockaddr *) i4;
    }
    else
    {
      struct sockaddr_in6 *i6;
 
      i6 = GNUNET_malloc (sizeof(struct sockaddr_in6));
      i6->sin6_family = AF_INET6;
      i6->sin6_port = htons ((uint16_t) port);
      *sock_len = sizeof(struct sockaddr_in6);
      in = (struct sockaddr *) i6;
    }
    return in;
  }
  cp = GNUNET_strdup (bindto);
  colon = strrchr (cp, ':');
  if (NULL != colon)
  {
    /* interpret value after colon as port */
    *colon = '\0';
    colon++;
    if (1 == sscanf (colon, "%u%1s", &port, dummy))
    {
      /* interpreting value as just a PORT number */
      if (port > UINT16_MAX)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                    "BINDTO specification `%s' invalid: value too large for port\n",
                    bindto);
        GNUNET_free (cp);
        return NULL;
      }
    }
    else
    {
      GNUNET_log (
        GNUNET_ERROR_TYPE_ERROR,
        "BINDTO specification `%s' invalid: last ':' not followed by number\n",
        bindto);
      GNUNET_free (cp);
      return NULL;
    }
  }
  else
  {
    /* interpret missing port as 0, aka pick any free one */
    port = 0;
  }
  if (AF_INET6 != family)
  {
    /* try IPv4 */
    struct sockaddr_in v4;
 
    memset (&v4, 0, sizeof(v4));
    if (1 == inet_pton (AF_INET, cp, &v4.sin_addr))
    {
      v4.sin_family = AF_INET;
      v4.sin_port = htons ((uint16_t) port);
#if HAVE_SOCKADDR_IN_SIN_LEN
      v4.sin_len = sizeof(struct sockaddr_in);
#endif
      in = GNUNET_memdup (&v4, sizeof(struct sockaddr_in));
      *sock_len = sizeof(struct sockaddr_in);
      GNUNET_free (cp);
      return in;
    }
  }
  if (AF_INET != family)
  {
    /* try IPv6 */
    struct sockaddr_in6 v6;
    const char *start;
 
    memset (&v6, 0, sizeof(v6));
    start = cp;
    if (('[' == *cp) && (']' == cp[strlen (cp) - 1]))
    {
      start++;   /* skip over '[' */
      cp[strlen (cp) - 1] = '\0';  /* eat ']' */
    }
    if (1 == inet_pton (AF_INET6, start, &v6.sin6_addr))
    {
      v6.sin6_family = AF_INET6;
      v6.sin6_port = htons ((uint16_t) port);
#if HAVE_SOCKADDR_IN_SIN_LEN
      v6.sin6_len = sizeof(struct sockaddr_in6);
#endif
      in = GNUNET_memdup (&v6, sizeof(v6));
      *sock_len = sizeof(v6);
      GNUNET_free (cp);
      return in;
    }
  }
  /* #5528 FIXME (feature!): maybe also try getnameinfo()? */
  GNUNET_free (cp);
  return NULL;
}
 
 
static void
sock_read (void *cls);
 
 
static enum GNUNET_GenericReturnValue
create_receiver (const struct GNUNET_PeerIdentity *peer,
                 const char *address,
                 struct GNUNET_NETWORK_Handle *udp_sock)
{
  struct GNUNET_HashContext *hsh;
  struct ReceiverAddress *receiver;
  struct GNUNET_HashCode receiver_key;
  const char *path;
  struct sockaddr *in;
  socklen_t in_len;
 
  if (0 != strncmp (address,
                    COMMUNICATOR_ADDRESS_PREFIX "-",
                    strlen (COMMUNICATOR_ADDRESS_PREFIX "-")))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  path = &address[strlen (COMMUNICATOR_ADDRESS_PREFIX "-")];
  in = udp_address_to_sockaddr (path, AF_UNSPEC, &in_len);
 
  if (NULL == in)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to setup UDP socket address\n");
    return GNUNET_SYSERR;
  }
  if ((AF_INET6 == in->sa_family) &&
      (GNUNET_YES == disable_v6))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "IPv6 disabled, skipping %s\n", address);
    GNUNET_free (in);
    return GNUNET_SYSERR;
  }
  else if (AF_INET == in->sa_family)
  {
    struct sockaddr_in *sin = (struct sockaddr_in *) in;
    if (0 == sin->sin_port)
    {
      GNUNET_free (in);
      return GNUNET_NO;
    }
  }
 
  hsh = GNUNET_CRYPTO_hash_context_start ();
  GNUNET_CRYPTO_hash_context_read (hsh, in, in_len);
  GNUNET_CRYPTO_hash_context_read (hsh, peer, sizeof(*peer));
  GNUNET_CRYPTO_hash_context_finish (hsh, &receiver_key);
 
  receiver = GNUNET_CONTAINER_multihashmap_get (receivers, &receiver_key);
  if (NULL != receiver)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "receiver %s already exist or is being connected to\n",
                address);
    /* Only the new-receiver path below takes ownership of @a in. */
    GNUNET_free (in);
    return GNUNET_NO;
  }
 
  receiver = GNUNET_new (struct ReceiverAddress);
  receiver->udp_sock = udp_sock;
  receiver->key = receiver_key;
  receiver->address = in;
  receiver->address_len = in_len;
  receiver->target = *peer;
  eddsa_pub_to_hpke_key (&receiver->target.public_key,
                         &receiver->target_hpke_key);
  receiver->nt = GNUNET_NT_scanner_get_type (is, in, in_len);
  (void) GNUNET_CONTAINER_multihashmap_put (
    receivers,
    &receiver->key,
    receiver,
    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Added %s to receivers with address %s and sock %p\n",
              GNUNET_i2s_full (&receiver->target),
              address,
              udp_sock);
  receiver->timeout =
    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
  /* Give a fresh receiver a full window to produce its first ACK. */
  receiver->last_ack = GNUNET_TIME_absolute_get ();
  receiver->hn = GNUNET_CONTAINER_heap_insert (receivers_heap,
                                               receiver,
                                               receiver->timeout.abs_value_us);
  GNUNET_STATISTICS_set (stats,
                         "# receivers active",
                         GNUNET_CONTAINER_multihashmap_size (receivers),
                         GNUNET_NO);
  receiver->foreign_addr =
    sockaddr_to_udpaddr_string (receiver->address, receiver->address_len);
  if (NULL != udp_sock)
    receiver->read_task = GNUNET_SCHEDULER_add_read_net (
      GNUNET_TIME_UNIT_FOREVER_REL,
      udp_sock,
      &sock_read,
      udp_sock);
  setup_receiver_mq (receiver);
  if (NULL == timeout_task)
    timeout_task = GNUNET_SCHEDULER_add_now (&check_timeouts, NULL);
  return GNUNET_OK;
}
 
 
static void
consider_reflexive_address (const struct GNUNET_PeerIdentity *target,
                            const struct sockaddr *address,
                            socklen_t address_len)
{
  char *addr_s;
 
  addr_s = sockaddr_to_udpaddr_string (address, address_len);
  /* #create_receiver() is keyed by (address, peer), so this is a cheap
     no-op whenever the peer reached us from an address we already have. */
  if (GNUNET_OK == create_receiver (target, addr_s, NULL))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Learned return path %s for peer `%s' from the source of an "
                "authenticated datagram\n",
                addr_s,
                GNUNET_i2s (target));
    GNUNET_STATISTICS_update (stats,
                              "# receivers added (reflexive address)",
                              1,
                              GNUNET_NO);
  }
  GNUNET_free (addr_s);
}
 
 
static void
sock_read (void *cls)
{
  struct sockaddr_storage sa;
  struct sockaddr_in *addr_verify;
  socklen_t salen = sizeof(sa);
  char buf[UINT16_MAX];
  ssize_t rcvd;
 
  struct GNUNET_NETWORK_Handle *udp_sock = cls;
 
  if (default_v4_sock == udp_sock)
    read_v4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
                                                  udp_sock,
                                                  &sock_read,
                                                  udp_sock);
  if (default_v6_sock == udp_sock)
    read_v6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
                                                  udp_sock,
                                                  &sock_read,
                                                  udp_sock);
  while (1)
  {
    rcvd = GNUNET_NETWORK_socket_recvfrom (udp_sock,
                                           buf,
                                           sizeof(buf),
                                           (struct sockaddr *) &sa,
                                           &salen);
    if (-1 == rcvd)
    {
      struct sockaddr *addr = (struct sockaddr*) &sa;
 
      if (EAGAIN == errno)
        break; // We are done reading data
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                  "Failed to recv from %s family %d failed sock %p\n",
                  GNUNET_a2s ((struct sockaddr*) &sa,
                              salen),
                  addr->sa_family,
                  udp_sock);
      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "recv");
      return;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Read %llu bytes\n",
                (unsigned long long) rcvd);
    if (0 == rcvd)
    {
      GNUNET_break_op (0);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Read 0 bytes from UDP socket\n");
      return;
    }
 
    /* first, see if it is a GNUNET_BurstMessage */
    if (rcvd == sizeof (struct GNUNET_BurstMessage))
    {
      struct GNUNET_BurstMessage *bm = (struct GNUNET_BurstMessage *) buf;
      struct sockaddr *addr = (struct sockaddr*) &sa;
      /* NOTE: @a salen, not `sizeof (*addr)' -- the latter is 16, which
         truncates an IPv6 source to the point where #GNUNET_a2s() renders
         "<invalid v6 address>" and #create_receiver() then fails to parse
         it, silently breaking burst NAT traversal over IPv6. */
      char *address = sockaddr_to_udpaddr_string (addr, salen);
 
      if (0 != bm->local_port)
      {
        GNUNET_break_op (0);
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Received a burst message on port %u\n",
                    bm->local_port);
        return;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Received a burst message for default port\n");
      create_receiver (&bm->peer,
                       address,
                       NULL);
      if (AF_INET6 == addr->sa_family)
        GNUNET_stop_burst (default_v6_sock);
      else
        GNUNET_stop_burst (default_v4_sock);
      GNUNET_TRANSPORT_communicator_burst_finished (ch);
      GNUNET_free (address);
      return;
    }
    /* second, see if it is a UDPBox */
    if (rcvd > sizeof(struct UDPBox))
    {
      const struct UDPBox *box;
      struct KeyCacheEntry *kce;
 
      box = (const struct UDPBox *) buf;
      kce = GNUNET_CONTAINER_multishortmap_get (key_cache, &box->kid);
      if (NULL != kce)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Found KCE with kid %s\n",
                    GNUNET_sh2s (&box->kid));
        decrypt_box (box, (size_t) rcvd, kce);
        continue;
      }
    }
 
    /* next, check if it is a broadcast */
    if (sizeof(struct UDPBroadcast) == rcvd)
    {
      const struct GNUNET_PeerIdentity *my_identity;
      const struct UDPBroadcast *ub;
      struct UdpBroadcastSignature uhs;
      struct GNUNET_PeerIdentity sender;
 
      my_identity = GNUNET_PILS_get_identity (pils);
      GNUNET_assert (my_identity);
 
      addr_verify = GNUNET_memdup (&sa, salen);
      addr_verify->sin_port = 0;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "received UDPBroadcast from %s\n",
                  GNUNET_a2s ((const struct sockaddr *) addr_verify, salen));
      ub = (const struct UDPBroadcast *) buf;
      uhs.purpose.purpose = htonl (
        GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST);
      uhs.purpose.size = htonl (sizeof(uhs));
      uhs.sender = ub->sender;
      sender = ub->sender;
      if (0 == memcmp (&sender, my_identity, sizeof (struct
                                                     GNUNET_PeerIdentity)))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Received our own broadcast\n");
        GNUNET_free (addr_verify);
        continue;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "checking UDPBroadcastSignature for %s\n",
                  GNUNET_i2s (&sender));
      GNUNET_CRYPTO_hash ((struct sockaddr *) addr_verify, salen,
                          &uhs.h_address);
      if (GNUNET_OK ==
          GNUNET_CRYPTO_eddsa_verify (
            GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST,
            &uhs,
            &ub->sender_sig,
            &ub->sender.public_key))
      {
        char *addr_s;
        enum GNUNET_NetworkType nt;
 
        addr_s =
          sockaddr_to_udpaddr_string ((const struct sockaddr *) &sa, salen);
        GNUNET_STATISTICS_update (stats, "# broadcasts received", 1, GNUNET_NO);
        /* use our own mechanism to determine network type */
        nt =
          GNUNET_NT_scanner_get_type (is, (const struct sockaddr *) &sa, salen);
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "validating address %s received from UDPBroadcast\n",
                    GNUNET_i2s (&sender));
        GNUNET_TRANSPORT_application_validate (ah, &sender, nt, addr_s);
        GNUNET_free (addr_s);
        GNUNET_free (addr_verify);
        continue;
      }
      else
      {
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    "VerifyingPeer %s is verifying UDPBroadcast\n",
                    GNUNET_i2s (GNUNET_PILS_get_identity (pils)));
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    "Verifying UDPBroadcast from %s failed\n",
                    GNUNET_i2s (&ub->sender));
      }
      GNUNET_free (addr_verify);
      /* continue with KX, mostly for statistics... */
    }
 
 
    /* finally, test if it is a KX */
    if (rcvd < sizeof(struct UDPConfirmation) + sizeof(struct InitialKX))
    {
      GNUNET_STATISTICS_update (stats,
                                "# messages dropped (no kid, too small for KX)",
                                1,
                                GNUNET_NO);
      continue;
    }
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Got KX\n");
    {
      const struct InitialKX *kx;
      struct SharedSecret *ss;
      char pbuf[rcvd - sizeof(struct InitialKX)];
      const struct UDPConfirmation *uc;
      struct SenderAddress *sender;
      int sender_is_new;
 
      kx = (const struct InitialKX *) buf;
      ss = setup_initial_shared_secret_dec (&kx->enc);
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Before DEC\n");
 
      if (GNUNET_OK != try_decrypt (ss,
                                    kx->gcm_tag,
                                    0,
                                    &buf[sizeof(*kx)],
                                    sizeof(pbuf),
                                    pbuf))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Unable to decrypt tag, dropping...\n");
        GNUNET_free (ss);
        GNUNET_STATISTICS_update (
          stats,
          "# messages dropped (no kid, AEAD decryption failed)",
          1,
          GNUNET_NO);
        continue;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Before VERIFY\n");
 
      uc = (const struct UDPConfirmation *) pbuf;
 
      if (GNUNET_OK != verify_confirmation (&kx->enc, uc)) // TODO: need ephemeral instead of representative
      {
        GNUNET_break_op (0);
        GNUNET_free (ss);
        GNUNET_STATISTICS_update (stats,
                                  "# messages dropped (sender signature invalid)",
                                  1,
                                  GNUNET_NO);
        continue;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Before SETUP_SENDER\n");
 
      calculate_cmac (ss);
      sender = setup_sender (&uc->sender,
                             (const struct sockaddr *) &sa,
                             salen,
                             &sender_is_new);
      ss->sender = sender;
      /* The signature in @a uc is verified, so we know who sent this.
         Only on a *new* sender: #setup_sender() is keyed on (address, peer),
         so this fires exactly once per source address per peer instead of on
         every KX datagram.  A peer with no ACK credit left sends every
         message as a KX, and doing the string formatting plus the map lookup
         underneath #consider_reflexive_address() for each of those is pure
         waste -- and worse, it makes any address churn (a NAT rotating its
         mapping) add a transport queue per datagram.
 
         Restricted to the shared sockets: #create_receiver() takes ownership
         of any socket handed to it (#receiver_destroy() closes it), so the
         per-receiver sockets the burst code hands out must not be passed on
         here, and replying from a socket other than the one the datagram
         arrived on would leave the peer's NAT mapping unused anyway. */
      if ((GNUNET_YES == sender_is_new) &&
          ((default_v4_sock == udp_sock) || (default_v6_sock == udp_sock)))
        consider_reflexive_address (&uc->sender,
                                    (const struct sockaddr *) &sa,
                                    salen);
      GNUNET_CONTAINER_DLL_insert (sender->ss_head, sender->ss_tail, ss);
      if ((KCN_THRESHOLD > ss->sender->acks_available) &&
          (NULL == ss->sender->kce_task) &&
          (GNUNET_NO == ss->sender->kce_task_finished))
      {
        // TODO This task must be per sender! FIXME: This is a nice todo, but I do not know what must be done here to fix.
        ss->sender->kce_send_ack_on_finish = GNUNET_YES;
        ss->sender->kce_task = GNUNET_SCHEDULER_add_now (
          kce_generate_cb,
          ss);
      }
      sender->num_secrets++;
      GNUNET_STATISTICS_update (stats, "# Secrets active", 1, GNUNET_NO);
      GNUNET_STATISTICS_update (stats,
                                "# messages decrypted without BOX",
                                1,
                                GNUNET_NO);
      try_handle_plaintext (sender, &uc[1], sizeof(pbuf) - sizeof(*uc));
      if (0 == purge_secrets (sender->ss_tail))
      {
        // No secret purged. Delete oldest.
        if (sender->num_secrets > MAX_SECRETS)
        {
          secret_destroy (sender->ss_tail);
        }
      }
    }
  }
}
 
 
static void
do_pad (gcry_cipher_hd_t out_cipher, char *dgram, size_t pad_size)
{
  char pad[pad_size];
 
  GNUNET_CRYPTO_random_block (pad,
                              sizeof(pad));
  if (sizeof(pad) > sizeof(struct GNUNET_MessageHeader))
  {
    struct GNUNET_MessageHeader hdr =
    { .size = htons (sizeof(pad)),
      .type = htons (GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_PAD) };
 
    memcpy (pad, &hdr, sizeof(hdr));
  }
  GNUNET_assert (
    0 ==
    gcry_cipher_encrypt (out_cipher, dgram, sizeof(pad), pad, sizeof(pad)));
}
 
 
static void
send_msg_with_kx (const struct GNUNET_MessageHeader *msg, struct
                  ReceiverAddress *receiver,
                  struct GNUNET_MQ_Handle *mq)
{
  const struct GNUNET_PeerIdentity *my_identity;
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  uint16_t msize = ntohs (msg->size);
  struct UdpHandshakeSignature uhs;
  struct UDPConfirmation uc;
  struct InitialKX kx;
  char dgram[receiver->kx_mtu + sizeof(uc) + sizeof(kx)];
  size_t dpos;
  gcry_cipher_hd_t out_cipher;
  struct SharedSecret *ss;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  my_private_key = GNUNET_PILS_key_ring_get_private_key (key_ring);
  GNUNET_assert ((my_identity) && (my_private_key));
 
  if (msize > receiver->kx_mtu)
  {
    GNUNET_break (0);
    if (GNUNET_YES != receiver->receiver_destroy_called)
      receiver_destroy (receiver);
    return;
  }
  reschedule_receiver_timeout (receiver);
 
  /* setup key material */
  ss = setup_initial_shared_secret_ephemeral (&uhs.enc, receiver);
 
  if (0 == purge_secrets (receiver->ss_tail))
  {
    // No secret purged. Delete oldest.
    if (receiver->num_secrets > MAX_SECRETS)
    {
      secret_destroy (receiver->ss_tail);
    }
  }
 
  setup_cipher (&ss->master, 0, &out_cipher);
  /* compute 'uc' */
  uc.sender = *my_identity;
  uc.monotonic_time =
    GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get_monotonic (cfg));
  uhs.purpose.purpose = htonl (
    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE);
  uhs.purpose.size = htonl (sizeof(uhs));
  uhs.sender = *my_identity;
  uhs.receiver = receiver->target;
  uhs.monotonic_time = uc.monotonic_time;
  GNUNET_CRYPTO_eddsa_sign (my_private_key,
                            &uhs,
                            &uc.sender_sig);
  /* Leave space for kx */
  dpos = sizeof(kx);
  /* Append encrypted uc to dgram */
  GNUNET_assert (0 == gcry_cipher_encrypt (out_cipher,
                                           &dgram[dpos],
                                           sizeof(uc),
                                           &uc,
                                           sizeof(uc)));
  dpos += sizeof(uc);
  /* Append encrypted payload to dgram */
  GNUNET_assert (
    0 == gcry_cipher_encrypt (out_cipher, &dgram[dpos], msize, msg, msize));
  dpos += msize;
  do_pad (out_cipher, &dgram[dpos], sizeof(dgram) - dpos);
  /* Datagram starts with kx */
  kx.enc = uhs.enc;
  GNUNET_assert (
    0 == gcry_cipher_gettag (out_cipher, kx.gcm_tag, sizeof(kx.gcm_tag)));
  gcry_cipher_close (out_cipher);
  memcpy (dgram, &kx, sizeof(kx));
  if (-1 == GNUNET_NETWORK_socket_sendto (get_socket (receiver),
                                          dgram,
                                          sizeof(dgram),
                                          receiver->address,
                                          receiver->address_len))
  {
    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "send");
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Sending KX with payload size %u to %s family %d failed sock %p\n",
                msize,
                GNUNET_a2s (receiver->address,
                            receiver->address_len),
                receiver->address->sa_family,
                get_socket (receiver));
    GNUNET_MQ_impl_send_continue (mq);
    receiver_destroy (receiver);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending KX with payload size %u to %s with socket %p\n",
              msize,
              GNUNET_a2s (receiver->address,
                          receiver->address_len),
              get_socket (receiver));
  GNUNET_MQ_impl_send_continue (mq);
}
 
 
static void
mq_send_kx (struct GNUNET_MQ_Handle *mq,
            const struct GNUNET_MessageHeader *msg,
            void *impl_state)
{
  struct ReceiverAddress *receiver = impl_state;
 
  GNUNET_assert (mq == receiver->kx_mq);
  if (GNUNET_NO == check_peer_alive (receiver))
    return;   /* @a receiver has been freed */
  send_msg_with_kx (msg, receiver, mq);
}
 
 
static void
create_rekey (struct ReceiverAddress *receiver, struct SharedSecret *ss, struct
              UDPRekey *rekey)
{
  struct SharedSecret *ss_rekey;
 
  ss->rekey_initiated = GNUNET_YES;
  /* setup key material */
  ss_rekey = setup_shared_secret_ephemeral (&rekey->ephemeral,
                                            receiver);
  ss_rekey->sequence_allowed = 0;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Setup secret with k = %s\n",
              GNUNET_sh2s (&ss_rekey->master));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Setup secret with H(k) = %s\n",
              GNUNET_h2s (&(ss_rekey->cmac)));
 
  /* Append encrypted payload to dgram */
  rekey->header.type = htons (GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_REKEY);
  rekey->header.size = htons (sizeof (struct UDPRekey));
}
 
 
static void
mq_send_d (struct GNUNET_MQ_Handle *mq,
           const struct GNUNET_MessageHeader *msg,
           void *impl_state)
{
  struct ReceiverAddress *receiver = impl_state;
  struct UDPRekey rekey;
  struct SharedSecret *ss;
  int inject_rekey = GNUNET_NO;
  uint16_t msize = ntohs (msg->size);
 
  GNUNET_assert (mq == receiver->d_mq);
  if (GNUNET_NO == check_peer_alive (receiver))
    return;   /* @a receiver has been freed */
  if (msize > receiver->d_mtu)
  {
    /* Transport handed us more than the MTU we advertised for this queue;
       that is a bug on its side and we cannot box it. */
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "msize: %u, mtu: %llu\n",
                (unsigned int) msize,
                (unsigned long long) receiver->d_mtu);
    GNUNET_break (0);
    if (GNUNET_YES != receiver->receiver_destroy_called)
      receiver_destroy (receiver);
    return;
  }
  if (0 == receiver->acks_available)
  {
    /* Out of ACK credit.  This is NOT a protocol violation and must not cost
       us the connection.  Transport's idea of our window can only ever drift
       *upwards*: #GNUNET_TRANSPORT_communicator_mq_update() takes an
       unsigned @a q_len that #handle_update_queue_message() *adds* to
       `q_capacity', so there is no way to hand credit back once
       #secret_destroy() reclaims a shared secret that still had unused
       sequence numbers -- which #purge_secrets() and the rekey path below do
       routinely.  Given enough uptime the two counters therefore always
       diverge, and tearing the receiver down here turns that bookkeeping
       drift into a dropped link.
 
       Fall back to KX instead, exactly as the tail of this function already
       does when it finds no usable shared secret.  That also fixes itself:
       a KX makes the peer generate key cache entries and ACK them, which is
       what replenishes the credit. */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "No ACKs available for %s, sending as KX\n",
                GNUNET_i2s (&receiver->target));
    GNUNET_STATISTICS_update (stats,
                              "# messages sent via KX (no ACKs available)",
                              1,
                              GNUNET_NO);
    reschedule_receiver_timeout (receiver);
    send_msg_with_kx (msg, receiver, mq);
    return;
  }
  reschedule_receiver_timeout (receiver);
 
  if (receiver->num_secrets > MAX_SECRETS)
  {
    if ((0 == purge_secrets (receiver->ss_tail)) &&
        (NULL != receiver->ss_tail))
    {
      // No secret purged. Delete oldest.
      secret_destroy (receiver->ss_tail);
    }
  }
  /* begin "BOX" encryption method, scan for ACKs from tail! */
  ss = receiver->ss_tail;
  while (NULL != ss)
  {
    size_t payload_len = sizeof(struct UDPBox) + receiver->d_mtu;
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Considering SS %s sequence used: %u sequence allowed: %u bytes sent: %lu.\n",
                GNUNET_sh2s (&ss->master), ss->sequence_used,
                ss->sequence_allowed, ss->bytes_sent);
    if (ss->sequence_used >= ss->sequence_allowed)
    {
      //  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
      //              "Skipping ss because no acks to use.\n");
      ss = ss->prev;
      continue;
    }
    if (ss->bytes_sent >= rekey_max_bytes)
    {
      struct SharedSecret *ss_tmp;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Skipping ss because rekey bytes reached.\n");
      // FIXME cleanup ss with too many bytes sent!
      ss_tmp = ss->prev;
      secret_destroy (ss);
      ss = ss_tmp;
      continue;
    }
    if (ss->bytes_sent > rekey_max_bytes * 0.7)
    {
      if (ss->rekey_initiated == GNUNET_NO)
      {
        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                    "Injecting rekey for ss with byte sent %lu\n",
                    (unsigned long) ss->bytes_sent);
        create_rekey (receiver, ss, &rekey);
        inject_rekey = GNUNET_YES;
        payload_len += sizeof (rekey);
        ss->rekey_initiated = GNUNET_YES;
      }
    }
    if (0 < ss->sequence_used)
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Trying to send UDPBox with shared secret %s sequence_used %u and ss->sequence_allowed %u\n",
                  GNUNET_sh2s (&ss->master),
                  ss->sequence_used,
                  ss->sequence_allowed);
    {
      char dgram[payload_len];
      struct UDPBox *box;
      gcry_cipher_hd_t out_cipher;
      size_t dpos;
 
      box = (struct UDPBox *) dgram;
      ss->sequence_used++;
      get_kid (&ss->master, ss->sequence_used, &box->kid);
      setup_cipher (&ss->master, ss->sequence_used, &out_cipher);
      /* Append encrypted payload to dgram */
      dpos = sizeof(struct UDPBox);
      if (GNUNET_YES == inject_rekey)
      {
        GNUNET_assert (
          0 == gcry_cipher_encrypt (out_cipher, &dgram[dpos], sizeof (rekey),
                                    &rekey, sizeof (rekey)));
        dpos += sizeof (rekey);
      }
      GNUNET_assert (
        0 == gcry_cipher_encrypt (out_cipher, &dgram[dpos], msize, msg, msize));
      dpos += msize;
      do_pad (out_cipher, &dgram[dpos], sizeof(dgram) - dpos);
      GNUNET_assert (0 == gcry_cipher_gettag (out_cipher,
                                              box->gcm_tag,
                                              sizeof(box->gcm_tag)));
      gcry_cipher_close (out_cipher);
 
      if (-1 == GNUNET_NETWORK_socket_sendto (get_socket (receiver),
                                              dgram,
                                              payload_len, // FIXME why always send sizeof dgram?
                                              receiver->address,
                                              receiver->address_len))
      {
        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "send");
        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                    "Sending UDPBox to %s family %d failed sock %p failed\n",
                    GNUNET_a2s (receiver->address,
                                receiver->address_len),
                    receiver->address->sa_family,
                    get_socket (receiver));
        receiver_destroy (receiver);
        return;
      }
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Sending UDPBox with payload size %u, %u acks left, %lu bytes sent with socket %p\n",
                  msize,
                  receiver->acks_available,
                  (unsigned long) ss->bytes_sent,
                  get_socket (receiver));
      ss->bytes_sent += sizeof (dgram);
      receiver->acks_available--;
      GNUNET_MQ_impl_send_continue (mq);
      return;
    }
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "No suitable ss found, sending as KX...\n");
  send_msg_with_kx (msg, receiver, mq);
}
 
 
static void
mq_destroy_d (struct GNUNET_MQ_Handle *mq, void *impl_state)
{
  struct ReceiverAddress *receiver = impl_state;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Default MQ destroyed\n");
  if (mq == receiver->d_mq)
  {
    receiver->d_mq = NULL;
    if (GNUNET_YES != receiver->receiver_destroy_called)
      receiver_destroy (receiver);
  }
}
 
 
static void
mq_destroy_kx (struct GNUNET_MQ_Handle *mq, void *impl_state)
{
  struct ReceiverAddress *receiver = impl_state;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "KX MQ destroyed\n");
  if (mq == receiver->kx_mq)
  {
    receiver->kx_mq = NULL;
    if (GNUNET_YES != receiver->receiver_destroy_called)
      receiver_destroy (receiver);
  }
}
 
 
static void
mq_cancel (struct GNUNET_MQ_Handle *mq, void *impl_state)
{
  /* Cancellation is impossible with UDP; bail */
  GNUNET_assert (0);
}
 
 
static void
mq_error (void *cls, enum GNUNET_MQ_Error error)
{
  struct ReceiverAddress *receiver = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
              "MQ error in queue to %s: %d\n",
              GNUNET_i2s (&receiver->target),
              (int) error);
  receiver_destroy (receiver);
}
 
 
static void
setup_receiver_mq (struct ReceiverAddress *receiver)
{
  size_t base_mtu;
 
  switch (receiver->address->sa_family)
  {
  case AF_INET:
    base_mtu = 1480     /* Ethernet MTU, 1500 - Ethernet header - VLAN tag */
               - sizeof(struct GNUNET_TUN_IPv4Header) /* 20 */
               - sizeof(struct GNUNET_TUN_UdpHeader) /* 8 */;
    break;
 
  case AF_INET6:
    base_mtu = 1280     /* Minimum MTU required by IPv6 */
               - sizeof(struct GNUNET_TUN_IPv6Header) /* 40 */
               - sizeof(struct GNUNET_TUN_UdpHeader) /* 8 */;
    break;
 
  default:
    GNUNET_assert (0);
    break;
  }
  /* MTU based on full KX messages */
  receiver->kx_mtu = base_mtu - sizeof(struct InitialKX)   /* 48 */
                     - sizeof(struct UDPConfirmation); /* 104 */
  /* MTU based on BOXed messages */
  receiver->d_mtu = base_mtu - sizeof(struct UDPBox);
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Setting up MQs and QHs\n");
  /* => Effective MTU for CORE will range from 1080 (IPv6 + KX) to
     1404 (IPv4 + Box) bytes, depending on circumstances... */
  if (NULL == receiver->kx_mq)
    receiver->kx_mq = GNUNET_MQ_queue_for_callbacks (&mq_send_kx,
                                                     &mq_destroy_kx,
                                                     &mq_cancel,
                                                     receiver,
                                                     NULL,
                                                     &mq_error,
                                                     receiver);
  if (NULL == receiver->d_mq)
    receiver->d_mq = GNUNET_MQ_queue_for_callbacks (&mq_send_d,
                                                    &mq_destroy_d,
                                                    &mq_cancel,
                                                    receiver,
                                                    NULL,
                                                    &mq_error,
                                                    receiver);
 
  receiver->kx_qh =
    GNUNET_TRANSPORT_communicator_mq_add (ch,
                                          &receiver->target,
                                          receiver->foreign_addr,
                                          receiver->kx_mtu,
                                          GNUNET_TRANSPORT_QUEUE_LENGTH_UNLIMITED,
                                          0, /* Priority */
                                          receiver->nt,
                                          GNUNET_TRANSPORT_CS_OUTBOUND,
                                          receiver->kx_mq);
}
 
 
static int
mq_init (void *cls, const struct GNUNET_PeerIdentity *peer, const char *address)
{
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "create receiver for mq_init\n");
  return create_receiver (peer,
                          address,
                          NULL);
}
 
 
static int
get_receiver_delete_it (void *cls,
                        const struct GNUNET_HashCode *target,
                        void *value)
{
  struct ReceiverAddress *receiver = value;
 
  (void) cls;
  (void) target;
  receiver_destroy (receiver);
  return GNUNET_OK;
}
 
 
static int
get_sender_delete_it (void *cls,
                      const struct GNUNET_HashCode *target,
                      void *value)
{
  struct SenderAddress *sender = value;
 
  (void) cls;
  (void) target;
 
 
  sender_destroy (sender);
  return GNUNET_OK;
}
 
 
static void
do_shutdown (void *cls)
{
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "do_shutdown\n");
  GNUNET_stop_burst (NULL);
  if (NULL != nat)
  {
    GNUNET_NAT_unregister (nat);
    nat = NULL;
  }
  while (NULL != bi_head)
    bi_destroy (bi_head);
  if (NULL != broadcast_task)
  {
    GNUNET_SCHEDULER_cancel (broadcast_task);
    broadcast_task = NULL;
  }
  if (NULL != timeout_task)
  {
    GNUNET_SCHEDULER_cancel (timeout_task);
    timeout_task = NULL;
  }
  if (NULL != read_v6_task)
  {
    GNUNET_SCHEDULER_cancel (read_v6_task);
    read_v6_task = NULL;
  }
  if (NULL != read_v4_task)
  {
    GNUNET_SCHEDULER_cancel (read_v4_task);
    read_v4_task = NULL;
  }
  if (NULL != default_v6_sock)
  {
    GNUNET_break (GNUNET_OK ==
                  GNUNET_NETWORK_socket_close (default_v6_sock));
    default_v6_sock = NULL;
  }
  if (NULL != default_v4_sock)
  {
    GNUNET_break (GNUNET_OK ==
                  GNUNET_NETWORK_socket_close (default_v4_sock));
    default_v4_sock = NULL;
  }
  GNUNET_CONTAINER_multihashmap_iterate (receivers,
                                         &get_receiver_delete_it,
                                         NULL);
  GNUNET_CONTAINER_multihashmap_destroy (receivers);
  GNUNET_CONTAINER_multihashmap_iterate (senders,
                                         &get_sender_delete_it,
                                         NULL);
  GNUNET_CONTAINER_multihashmap_destroy (senders);
  GNUNET_CONTAINER_multishortmap_destroy (key_cache);
  GNUNET_CONTAINER_heap_destroy (senders_heap);
  GNUNET_CONTAINER_heap_destroy (receivers_heap);
  if (NULL != timeout_task)
  {
    GNUNET_SCHEDULER_cancel (timeout_task);
    timeout_task = NULL;
  }
  if (NULL != ch)
  {
    GNUNET_TRANSPORT_communicator_address_remove_all (ch);
    GNUNET_TRANSPORT_communicator_disconnect (ch);
    ch = NULL;
  }
  if (NULL != ah)
  {
    GNUNET_TRANSPORT_application_done (ah);
    ah = NULL;
  }
  if (NULL != pils)
  {
    GNUNET_PILS_disconnect (pils);
    pils = NULL;
  }
  if (NULL != key_ring)
  {
    GNUNET_PILS_destroy_key_ring (key_ring);
    key_ring = NULL;
  }
  if (NULL != stats)
  {
    GNUNET_STATISTICS_destroy (stats, GNUNET_YES);
    stats = NULL;
  }
  if (NULL != is)
  {
    GNUNET_NT_scanner_done (is);
    is = NULL;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "do_shutdown finished\n");
}
 
 
static void
enc_notify_cb (void *cls,
               const struct GNUNET_PeerIdentity *sender,
               const struct GNUNET_MessageHeader *msg)
{
  struct AckInfo ai;
 
  (void) cls;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Storing UDPAck received from backchannel from %s\n",
              GNUNET_i2s_full (sender));
  if ((ntohs (msg->type) != GNUNET_MESSAGE_TYPE_COMMUNICATOR_UDP_ACK) ||
      (ntohs (msg->size) != sizeof(struct UDPAck)))
  {
    GNUNET_break_op (0);
    return;
  }
  ai.ack = (const struct UDPAck *) msg;
  ai.sender = sender;
  GNUNET_CONTAINER_multihashmap_iterate (receivers,
                                         &handle_ack_by_sender,
                                         &ai);
}
 
 
static void
nat_address_cb (void *cls,
                void **app_ctx,
                int add_remove,
                enum GNUNET_NAT_AddressClass ac,
                const struct sockaddr *addr,
                socklen_t addrlen)
{
  char *my_addr;
  struct GNUNET_TRANSPORT_AddressIdentifier *ai;
 
  if (GNUNET_YES == add_remove)
  {
    enum GNUNET_NetworkType nt;
 
    GNUNET_asprintf (&my_addr,
                     "%s-%s",
                     COMMUNICATOR_ADDRESS_PREFIX,
                     GNUNET_a2s (addr, addrlen));
    nt = GNUNET_NT_scanner_get_type (is, addr, addrlen);
    ai =
      GNUNET_TRANSPORT_communicator_address_add (ch,
                                                 my_addr,
                                                 nt,
                                                 GNUNET_TIME_UNIT_FOREVER_REL);
    GNUNET_free (my_addr);
    *app_ctx = ai;
  }
  else
  {
    ai = *app_ctx;
    GNUNET_TRANSPORT_communicator_address_remove (ai);
    *app_ctx = NULL;
  }
}
 
 
static void
ifc_broadcast (void *cls)
{
  struct BroadcastInterface *bi = cls;
  struct GNUNET_TIME_Relative delay;
 
  delay = BROADCAST_FREQUENCY;
  delay.rel_value_us =
    GNUNET_CRYPTO_random_u64 (delay.rel_value_us);
  bi->broadcast_task =
    GNUNET_SCHEDULER_add_delayed (delay, &ifc_broadcast, bi);
 
  switch (bi->sa->sa_family)
  {
  case AF_INET: {
      static int yes = 1;
      static int no = 0;
      ssize_t sent;
 
      if (GNUNET_OK !=
          GNUNET_NETWORK_socket_setsockopt (default_v4_sock,
                                            SOL_SOCKET,
                                            SO_BROADCAST,
                                            &yes,
                                            sizeof(int)))
        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
                             "setsockopt");
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "creating UDPBroadcast from %s\n",
                  GNUNET_i2s (&(bi->bcm.sender)));
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "sending UDPBroadcast to add %s\n",
                  GNUNET_a2s (bi->ba, bi->salen));
      sent = GNUNET_NETWORK_socket_sendto (default_v4_sock,
                                           &bi->bcm,
                                           sizeof(bi->bcm),
                                           bi->ba,
                                           bi->salen);
      if (-1 == sent)
        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
                             "sendto");
      if (GNUNET_OK != GNUNET_NETWORK_socket_setsockopt (default_v4_sock,
                                                         SOL_SOCKET,
                                                         SO_BROADCAST,
                                                         &no,
                                                         sizeof(int)))
        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
                             "setsockopt");
      break;
    }
 
  case AF_INET6: {
      ssize_t sent;
      struct sockaddr_in6 dst;
 
      dst.sin6_family = AF_INET6;
      dst.sin6_port = htons (my_port);
      dst.sin6_addr = bi->mcreq.ipv6mr_multiaddr;
      dst.sin6_scope_id = ((struct sockaddr_in6 *) bi->ba)->sin6_scope_id;
 
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "sending UDPBroadcast\n");
      sent = GNUNET_NETWORK_socket_sendto (default_v6_sock,
                                           &bi->bcm,
                                           sizeof(bi->bcm),
                                           (const struct sockaddr *) &dst,
                                           sizeof(dst));
      if (-1 == sent)
        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "sendto");
      break;
    }
 
  default:
    GNUNET_break (0);
    break;
  }
}
 
 
static int
iface_proc (void *cls,
            const char *name,
            int isDefault,
            const struct sockaddr *addr,
            const struct sockaddr *broadcast_addr,
            const struct sockaddr *netmask,
            socklen_t addrlen)
{
  const struct GNUNET_PeerIdentity *my_identity;
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  struct BroadcastInterface *bi;
  enum GNUNET_NetworkType network;
  struct UdpBroadcastSignature ubs;
 
  (void) cls;
  (void) netmask;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  my_private_key = GNUNET_PILS_key_ring_get_private_key (key_ring);
 
  if ((NULL == my_identity) || (NULL == my_private_key))
    return GNUNET_YES;
  if (NULL == addr)
    return GNUNET_YES; /* need to know our address! */
  network = GNUNET_NT_scanner_get_type (is, addr, addrlen);
  if (GNUNET_NT_LOOPBACK == network)
  {
    /* Broadcasting on loopback does not make sense */
    return GNUNET_YES;
  }
  for (bi = bi_head; NULL != bi; bi = bi->next)
  {
    if ((bi->salen == addrlen) && (0 == memcmp (addr, bi->sa, addrlen)))
    {
      bi->found = GNUNET_YES;
      return GNUNET_OK;
    }
  }
 
  if ((AF_INET6 == addr->sa_family) && (NULL == broadcast_addr))
    return GNUNET_OK; /* broadcast_addr is required for IPv6! */
  if ((AF_INET6 == addr->sa_family) && (NULL == default_v6_sock))
    return GNUNET_OK; /* not using IPv6 */
 
  bi = GNUNET_new (struct BroadcastInterface);
  bi->sa = GNUNET_memdup (addr,
                          addrlen);
  if ( (NULL != broadcast_addr) &&
       (addrlen == sizeof (struct sockaddr_in)) )
  {
    struct sockaddr_in *ba;
 
    ba = GNUNET_memdup (broadcast_addr,
                        addrlen);
    ba->sin_port = htons (2086); /* always GNUnet port, ignore configuration! */
    bi->ba = (struct sockaddr *) ba;
  }
  bi->salen = addrlen;
  bi->found = GNUNET_YES;
  bi->bcm.sender = *my_identity;
  ubs.purpose.purpose = htonl (
    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST);
  ubs.purpose.size = htonl (sizeof(ubs));
  ubs.sender = *my_identity;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "creating UDPBroadcastSignature for %s\n",
              GNUNET_a2s (addr, addrlen));
  GNUNET_CRYPTO_hash (addr, addrlen, &ubs.h_address);
  GNUNET_CRYPTO_eddsa_sign (my_private_key,
                            &ubs,
                            &bi->bcm.sender_sig);
  if (NULL != bi->ba)
  {
    bi->broadcast_task = GNUNET_SCHEDULER_add_now (&ifc_broadcast, bi);
    GNUNET_CONTAINER_DLL_insert (bi_head, bi_tail, bi);
  }
  if ((AF_INET6 == addr->sa_family) && (NULL != broadcast_addr))
  {
    /* Create IPv6 multicast request */
    const struct sockaddr_in6 *s6 =
      (const struct sockaddr_in6 *) broadcast_addr;
 
    GNUNET_assert (
      1 == inet_pton (AF_INET6, "FF05::13B", &bi->mcreq.ipv6mr_multiaddr));
 
    /* http://tools.ietf.org/html/rfc2553#section-5.2:
     *
     * IPV6_JOIN_GROUP
     *
     * Join a multicast group on a specified local interface.  If the
     * interface index is specified as 0, the kernel chooses the local
     * interface.  For example, some kernels look up the multicast
     * group in the normal IPv6 routing table and using the resulting
     * interface; we do this for each interface, so no need to use
     * zero (anymore...).
     */
    bi->mcreq.ipv6mr_interface = s6->sin6_scope_id;
 
    /* Join the multicast group */
    if (GNUNET_OK != GNUNET_NETWORK_socket_setsockopt (default_v6_sock,
                                                       IPPROTO_IPV6,
                                                       IPV6_JOIN_GROUP,
                                                       &bi->mcreq,
                                                       sizeof(bi->mcreq)))
    {
      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "setsockopt");
    }
  }
  return GNUNET_OK;
}
 
 
static void
do_broadcast (void *cls)
{
  struct BroadcastInterface *bin;
 
  (void) cls;
  for (struct BroadcastInterface *bi = bi_head; NULL != bi; bi = bi->next)
    bi->found = GNUNET_NO;
  GNUNET_OS_network_interfaces_list (&iface_proc, NULL);
  for (struct BroadcastInterface *bi = bi_head; NULL != bi; bi = bin)
  {
    bin = bi->next;
    if (GNUNET_NO == bi->found)
      bi_destroy (bi);
  }
  broadcast_task = GNUNET_SCHEDULER_add_delayed (INTERFACE_SCAN_FREQUENCY,
                                                 &do_broadcast,
                                                 NULL);
}
 
 
static void
try_connection_reversal (void *cls,
                         const struct sockaddr *addr,
                         socklen_t addrlen)
{
  /* FIXME: support reversal: #5529 */
  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
              "No connection reversal implemented!\n");
}
 
 
static void
udp_socket_notify (struct GNUNET_UdpSocketInfo *sock_info)
{
  // FIXME: This sizeof application truncates IPv6 addresses!
  char *address = sockaddr_to_udpaddr_string (sock_info->actual_address,
                                              sizeof (*sock_info->actual_address
                                                      ));
  create_receiver (sock_info->pid,
                   address,
                   default_v4_sock == sock_info->udp_sock ||
                   default_v6_sock == sock_info->udp_sock ?
                   NULL : sock_info->udp_sock);
  GNUNET_TRANSPORT_communicator_burst_finished (ch);
  GNUNET_free (sock_info);
}
 
 
static void
start_burst (const char *addr,
             struct GNUNET_TIME_Relative rtt,
             struct GNUNET_PeerIdentity *pid)
{
  struct GNUNET_UdpSocketInfo *sock_info;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Communicator was called to start burst to address %s from %s\n",
              addr,
              my_ipv4);
 
  GNUNET_stop_burst (NULL);
 
  sock_info = GNUNET_new (struct GNUNET_UdpSocketInfo);
  sock_info->pid = GNUNET_new (struct GNUNET_PeerIdentity);
  sock_info->address = GNUNET_strdup (addr);
  sock_info->bind_address = my_ipv4;
  sock_info->has_port = GNUNET_YES;
  sock_info->udp_sock = default_v4_sock;
  sock_info->rtt = rtt;
  GNUNET_memcpy (sock_info->pid, pid, sizeof (struct GNUNET_PeerIdentity));
  sock_info->std_port = my_port;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "1 sock addr %s addr %s rtt %lu %u\n",
              sock_info->address,
              addr,
              (unsigned long) sock_info->rtt.rel_value_us,
              my_port);
  burst_task = GNUNET_get_udp_socket (sock_info,
                                      &udp_socket_notify);
  GNUNET_free (sock_info);
}
 
 
static struct GNUNET_NETWORK_Handle*
create_udp_socket (const char *bindto,
                   sa_family_t family,
                   struct sockaddr **out,
                   socklen_t *out_len)
{
  struct GNUNET_NETWORK_Handle *sock;
  struct sockaddr *in;
  socklen_t in_len;
  struct sockaddr_storage in_sto;
  socklen_t sto_len;
 
  in = udp_address_to_sockaddr (bindto, family, &in_len);
  if (NULL == in)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to setup UDP socket address with path `%s'\n",
                bindto);
    return NULL;
  }
 
  if ((AF_UNSPEC != family) && (in->sa_family != family))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Invalid UDP socket address setup with path `%s'\n",
                bindto);
    GNUNET_free (in);
    return NULL;
  }
 
  sock =
    GNUNET_NETWORK_socket_create (in->sa_family,
                                  SOCK_DGRAM,
                                  IPPROTO_UDP);
  if (NULL == sock)
  {
    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "socket");
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to create socket for %s family %d\n",
                GNUNET_a2s (in,
                            in_len),
                in->sa_family);
    GNUNET_free (in);
    return NULL;
  }
  if (GNUNET_OK !=
      GNUNET_NETWORK_socket_bind (sock,
                                  in,
                                  in_len))
  {
    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
                              "bind",
                              bindto);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Failed to bind socket for %s family %d sock %p\n",
                GNUNET_a2s (in,
                            in_len),
                in->sa_family,
                sock);
    GNUNET_NETWORK_socket_close (sock);
    sock = NULL;
    GNUNET_free (in);
    return NULL;
  }
 
  /* We might have bound to port 0, allowing the OS to figure it out;
     thus, get the real IN-address from the socket */
  sto_len = sizeof(in_sto);
  if (0 != getsockname (GNUNET_NETWORK_get_fd (sock),
                        (struct sockaddr *) &in_sto,
                        &sto_len))
  {
    memcpy (&in_sto, in, in_len);
    sto_len = in_len;
  }
  GNUNET_free (in);
  *out = GNUNET_malloc (sto_len);
  memcpy (*out, (struct sockaddr *) &in_sto, sto_len);
  *out_len = sto_len;
  return sock;
}
 
 
static void
shutdown_run (struct sockaddr *addrs[2])
{
  if (NULL != addrs[0])
    GNUNET_free (addrs[0]);
  if (NULL != addrs[1])
    GNUNET_free (addrs[1]);
  GNUNET_SCHEDULER_shutdown ();
}
 
 
static void
run (void *cls,
     char *const *args,
     const char *cfgfile,
     const struct GNUNET_CONFIGURATION_Handle *c)
{
  const struct sockaddr_in *v4;
  char *bindto;
  char *bindto6;
  struct sockaddr *in[2];
  socklen_t in_len[2];
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Entering the run method of udp communicator.\n");
 
  cfg = c;
  disable_v6 = GNUNET_NO;
  if ((GNUNET_NO == GNUNET_NETWORK_test_pf (PF_INET6)) ||
      (GNUNET_YES ==
       GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                             COMMUNICATOR_CONFIG_SECTION,
                                             "DISABLE_V6")))
  {
    disable_v6 = GNUNET_YES;
  }
 
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             COMMUNICATOR_CONFIG_SECTION,
                                             "BINDTO",
                                             &bindto))
  {
    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                               COMMUNICATOR_CONFIG_SECTION,
                               "BINDTO");
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "The udp communicator will bind to %s for IPv4\n",
              bindto);
  if (GNUNET_YES != disable_v6)
  {
    if (GNUNET_OK !=
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               COMMUNICATOR_CONFIG_SECTION,
                                               "BINDTO6",
                                               &bindto6))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 COMMUNICATOR_CONFIG_SECTION,
                                 "BINDTO6");
      return;
    }
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "The udp communicator will bind to %s for IPv6\n",
                bindto6);
  }
  else
    bindto6 = NULL;
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_time (cfg,
                                           COMMUNICATOR_CONFIG_SECTION,
                                           "REKEY_INTERVAL",
                                           &rekey_interval))
    rekey_interval = DEFAULT_REKEY_TIME_INTERVAL;
 
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_size (cfg,
                                           COMMUNICATOR_CONFIG_SECTION,
                                           "REKEY_MAX_BYTES",
                                           &rekey_max_bytes))
  {
    rekey_max_bytes = DEFAULT_REKEY_MAX_BYTES;
  }
 
  memset (in, 0, sizeof(struct sockaddr*) * 2);
  memset (in_len, 0, sizeof(socklen_t) * 2);
 
  GNUNET_assert (bindto);
  default_v4_sock = create_udp_socket (
    bindto, AF_INET, &(in[0]), &(in_len[0]));
  GNUNET_free (bindto);
 
  if (GNUNET_YES != disable_v6)
  {
    GNUNET_assert (bindto6);
    default_v6_sock = create_udp_socket (
      bindto6, AF_INET6, &(in[1]), &(in_len[1]));
    GNUNET_free (bindto6);
  }
  else
    default_v6_sock = NULL;
 
  if ((NULL == default_v4_sock) && (NULL == default_v6_sock))
    return;
 
  my_port = 0;
  if (NULL != default_v4_sock)
  {
    GNUNET_assert (in[0]);
    GNUNET_log_from_nocheck (GNUNET_ERROR_TYPE_INFO,
                             "transport",
                             "Bound to `%s' sock %p\n",
                             GNUNET_a2s ((const struct sockaddr *) in[0],
                                         in_len[0]),
                             default_v4_sock);
 
    v4 = (const struct sockaddr_in *) in[0];
 
    my_ipv4 = GNUNET_malloc (INET_ADDRSTRLEN);
    my_port = ntohs (((struct sockaddr_in *) in[0])->sin_port);
    inet_ntop (AF_INET, &v4->sin_addr, my_ipv4, in_len[0]);
  }
  if (NULL != default_v6_sock)
  {
    GNUNET_assert (in[1]);
    GNUNET_log_from_nocheck (GNUNET_ERROR_TYPE_INFO,
                             "transport",
                             "Bound to `%s' sock %p\n",
                             GNUNET_a2s ((const struct sockaddr *) in[1],
                                         in_len[1]),
                             default_v6_sock);
    my_port = ntohs (((struct sockaddr_in6 *) in[1])->sin6_port);
  }
  stats = GNUNET_STATISTICS_create ("communicator-udp", cfg);
  senders = GNUNET_CONTAINER_multihashmap_create (32, GNUNET_YES);
  receivers = GNUNET_CONTAINER_multihashmap_create (32, GNUNET_YES);
  senders_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
  receivers_heap =
    GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
  key_cache = GNUNET_CONTAINER_multishortmap_create (1024, GNUNET_YES);
  GNUNET_SCHEDULER_add_shutdown (&do_shutdown, NULL);
  is = GNUNET_NT_scanner_init ();
  /* start reading */
  if (NULL != default_v4_sock)
    read_v4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
                                                  default_v4_sock,
                                                  &sock_read,
                                                  default_v4_sock);
  else
    read_v4_task = NULL;
  if (NULL != default_v6_sock)
    read_v6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
                                                  default_v6_sock,
                                                  &sock_read,
                                                  default_v6_sock);
  else
    read_v6_task = NULL;
  ch = GNUNET_TRANSPORT_communicator_connect (cfg,
                                              COMMUNICATOR_CONFIG_SECTION,
                                              COMMUNICATOR_ADDRESS_PREFIX,
                                              GNUNET_TRANSPORT_CC_UNRELIABLE,
                                              &mq_init,
                                              NULL,
                                              &enc_notify_cb,
                                              NULL,
                                              &start_burst);
  if (NULL == ch)
  {
    GNUNET_break (0);
    shutdown_run (in);
    return;
  }
  ah = GNUNET_TRANSPORT_application_init (cfg);
  if (NULL == ah)
  {
    GNUNET_break (0);
    shutdown_run (in);
    return;
  }
  /* start broadcasting */
  if (GNUNET_YES !=
      GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                            COMMUNICATOR_CONFIG_SECTION,
                                            "DISABLE_BROADCAST"))
  {
    broadcast_task = GNUNET_SCHEDULER_add_now (&do_broadcast, NULL);
  }
  key_ring = GNUNET_PILS_create_key_ring (cfg, NULL, NULL);
  GNUNET_assert (NULL != key_ring);
  pils = GNUNET_PILS_connect (cfg, NULL, NULL);
  GNUNET_assert (NULL != pils);
 
  nat = GNUNET_NAT_register (cfg,
                             COMMUNICATOR_CONFIG_SECTION,
                             IPPROTO_UDP,
                             (NULL != in[0]? 1 : 0)
                             + (NULL != in[1]? 1 : 0),
                             (const struct sockaddr**)
                             (NULL != in[0]? in : &(in[1])),
                             NULL != in[0]? in_len : &(in_len[1]),
                             &nat_address_cb,
                             try_connection_reversal,
                             NULL /* closure */);
  if (NULL != in[0])
    GNUNET_free (in[0]);
  if (NULL != in[1])
    GNUNET_free (in[1]);
}
 
 
GNUNET_DAEMON_MAIN ("gnunet-communicator-udp",
                    _ ("GNUnet UDP communicator"),
                    &run)
/* end of gnunet-communicator-udp.c */