broken build
[oweals/gnunet.git] / src / gns / gnunet-service-gns_resolver.c
index 76534a10ebce487f7e71dd64f16be2bc37f3bf09..68996a2040392028e192ffd66eb86f16ff2fe1fa 100644 (file)
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     (C) 2009, 2010, 2011 Christian Grothoff (and other contributing authors)
+     (C) 2009, 2010, 2011, 2012, 2013 Christian Grothoff (and other contributing authors)
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -22,6 +22,7 @@
  * @file gns/gnunet-service-gns_resolver.c
  * @brief GNUnet GNS resolver logic
  * @author Martin Schanzenbach
+ * @author Christian Grothoff
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
@@ -223,7 +224,7 @@ free_get_pseu_authority_handle (struct GetPseuAuthorityHandle *gph)
 {
   gph->namestore_task = NULL;
   GNUNET_free (gph->auth);
-  GNUNET_CRYPTO_rsa_key_free (gph->key);
+  GNUNET_CRYPTO_ecc_key_free (gph->key);
   GNUNET_CONTAINER_DLL_remove (gph_head, gph_tail, gph);
   GNUNET_free (gph);
 }
@@ -269,11 +270,11 @@ create_pkey_cont (void* cls, int32_t success, const char* emsg)
  */
 static void
 process_pseu_lookup_ns (void* cls,
-                       const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *key,
+                       const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *key,
                        struct GNUNET_TIME_Absolute expiration,
                        const char *name, unsigned int rd_count,
                        const struct GNUNET_NAMESTORE_RecordData *rd,
-                       const struct GNUNET_CRYPTO_RsaSignature *signature)
+                       const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct GetPseuAuthorityHandle* gph = cls;
   struct GNUNET_NAMESTORE_RecordData new_pkey;
@@ -299,12 +300,13 @@ process_pseu_lookup_ns (void* cls,
   new_pkey.flags = GNUNET_NAMESTORE_RF_AUTHORITY
                  | GNUNET_NAMESTORE_RF_PRIVATE
                  | GNUNET_NAMESTORE_RF_PENDING;
-  gph->namestore_task = GNUNET_NAMESTORE_record_create (namestore_handle,
-                                                       gph->key,
-                                                       gph->test_name,
-                                                       &new_pkey,
-                                                       &create_pkey_cont, 
-                                                       gph);
+  gph->namestore_task = GNUNET_NAMESTORE_record_put_by_authority (namestore_handle,
+                                                                 gph->key,
+                                                                 gph->test_name,
+                                                                 1,
+                                                                 &new_pkey,
+                                                                 &create_pkey_cont, 
+                                                                 gph);
 }
 
 
@@ -462,12 +464,12 @@ process_auth_discovery_dht_result (void* cls,
  */
 static void
 process_auth_discovery_ns_result (void* cls,
-                      const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *key,
+                      const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *key,
                       struct GNUNET_TIME_Absolute expiration,
                       const char *name,
                       unsigned int rd_count,
                       const struct GNUNET_NAMESTORE_RecordData *rd,
-                      const struct GNUNET_CRYPTO_RsaSignature *signature)
+                      const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct GetPseuAuthorityHandle* gph = cls;
   struct GNUNET_HashCode lookup_key;
@@ -535,12 +537,12 @@ process_auth_discovery_ns_result (void* cls,
  */
 static void
 process_zone_to_name_discover (void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature)
+                 const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct GetPseuAuthorityHandle* gph = cls;
   
@@ -591,31 +593,33 @@ shorten_authority_chain (struct GetPseuAuthorityHandle *gph)
  */
 static void
 start_shorten (struct AuthorityChain *auth,
-               const struct GNUNET_CRYPTO_RsaPrivateKey *key)
+               const struct GNUNET_CRYPTO_EccPrivateKey *key)
 {
   struct GetPseuAuthorityHandle *gph;
-  struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded pkey;
-  struct GNUNET_CRYPTO_RsaPrivateKeyBinaryEncoded *pb_key;
+  struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded pkey;
+  struct GNUNET_CRYPTO_EccPrivateKeyBinaryEncoded *pb_key;
   
-  GNUNET_CRYPTO_rsa_key_get_public (key, &pkey);
-  if (NULL == (pb_key = GNUNET_CRYPTO_rsa_encode_key (key)))
+  GNUNET_CRYPTO_ecc_key_get_public (key, &pkey);
+  if (NULL == (pb_key = GNUNET_CRYPTO_ecc_encode_key (key)))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Failed to encode RSA key on shorten\n");
+                "Failed to encode ECC key on shorten\n");
     return;
   }
-  gph = GNUNET_malloc (sizeof (struct GetPseuAuthorityHandle));
-  gph->key = GNUNET_CRYPTO_rsa_decode_key ((const char*) pb_key, ntohs (pb_key->len));
+  gph = GNUNET_new (struct GetPseuAuthorityHandle);
+  gph->key = GNUNET_CRYPTO_ecc_decode_key ((const char*) pb_key, 
+                                          ntohs (pb_key->size),
+                                          GNUNET_YES);
   GNUNET_free (pb_key);
   if (NULL == gph->key)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Failed to decode RSA key on shorten\n");
+                "Failed to decode ECC key on shorten\n");
     GNUNET_free (gph);
     return;
   }
   GNUNET_CRYPTO_short_hash (&pkey,
-                        sizeof (struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded),
+                        sizeof (struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded),
                         &gph->our_zone);
   gph->auth = GNUNET_malloc (sizeof (struct AuthorityChain));
   memcpy (gph->auth, auth, sizeof (struct AuthorityChain));
@@ -1153,11 +1157,11 @@ resolve_record_dht (struct ResolverHandle *rh)
  */
 static void
 process_record_result_ns (void* cls,
-                          const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *key,
+                          const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *key,
                           struct GNUNET_TIME_Absolute expiration,
                           const char *name, unsigned int rd_count,
                           const struct GNUNET_NAMESTORE_RecordData *rd,
-                          const struct GNUNET_CRYPTO_RsaSignature *signature)
+                          const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct RecordLookupHandle *rlh = rh->proc_cls;
@@ -1168,7 +1172,7 @@ process_record_result_ns (void* cls,
 
   rh->namestore_task = NULL;
   GNUNET_CRYPTO_short_hash (key,
-                           sizeof (struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded),
+                           sizeof (struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded),
                            &zone);
   remaining_time = GNUNET_TIME_absolute_get_remaining (expiration);
   rh->status = 0;
@@ -1342,7 +1346,8 @@ handle_record_vpn (void* cls, struct ResolverHandle *rh,
 
   /* results found yay */
   GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_REC_VPN-%llu: Record resolved from VPN!", rh->id);
+             "GNS_PHASE_REC_VPN-%llu: Record resolved from VPN!\n",
+            rh->id);
 
   finish_lookup(rh, rlh, rd_count, rd);
 }
@@ -1444,7 +1449,7 @@ resolve_dns_name (struct ResolverHandle *rh)
 
 
 /**
- * Read DNS udp packet from socket
+ * Read DNS packet from UDP socket and process the reply.
  *
  * @param cls the resolver handle
  * @param tc task context
@@ -1504,14 +1509,47 @@ read_dns_response (void *cls,
                packet->answers[i].type,
                rlh->record_type);
     /* http://tools.ietf.org/html/rfc1034#section-3.6.2 */
-    if (packet->answers[i].type == GNUNET_GNS_RECORD_CNAME)
+    if (GNUNET_GNS_RECORD_CNAME == packet->answers[i].type)
     {
+      struct GNUNET_DNSPARSER_Query query;
+      struct GNUNET_DNSPARSER_Packet npacket;
+      struct GNUNET_DNSPARSER_Flags flags;
+
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "CNAME... restarting query with %s\n",
-                  packet->answers[i].data.hostname
-                 );
-      strcpy (rh->dns_name, packet->answers[i].data.hostname);
+                  "CNAME record, restarting query with `%s'\n",
+                  packet->answers[i].data.hostname);
+      strcpy (rh->dns_name, 
+             packet->answers[i].data.hostname);
       found_cname = GNUNET_YES;
+      query.name = rh->dns_name;
+      query.type = rlh->record_type;
+      query.class = GNUNET_DNSPARSER_CLASS_INTERNET;
+      memset (&flags, 0, sizeof (flags));
+      flags.recursion_desired = 1;
+      flags.checking_disabled = 1;
+      npacket.queries = &query;
+      npacket.answers = NULL;
+      npacket.authority_records = NULL;
+      npacket.num_queries = 1;
+      npacket.num_answers = 0;
+      npacket.num_authority_records = 0;
+      npacket.num_additional_records = 0;
+      npacket.flags = flags;
+      npacket.id = rh->id;
+      GNUNET_free_non_null (rh->dns_raw_packet);
+      rh->dns_raw_packet = NULL;
+      if (GNUNET_OK != GNUNET_DNSPARSER_pack (&npacket,
+                                             UINT16_MAX,
+                                             &rh->dns_raw_packet,
+                                             &rh->dns_raw_packet_size))
+      {
+       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                   "GNS_PHASE_REC_DNS-%llu: Creating raw dns packet!\n",
+                   rh->id);
+       GNUNET_NETWORK_socket_close (rh->dns_sock);
+       finish_lookup (rh, rlh, 0, NULL);
+       return;
+      }
       continue;
     }
     
@@ -1533,22 +1571,23 @@ read_dns_response (void *cls,
 
   if (GNUNET_YES == found_cname)
   {
-    zone_offset = strlen (rh->dns_name) - strlen (rh->dns_zone) - 1;
-    
+    zone_offset = strlen (rh->dns_name) - strlen (rh->dns_zone) - 1;   
     if (0 > zone_offset)
       zone_offset = 0;
 
     /* restart query with CNAME */
-    if (0 == strcmp (rh->dns_name+zone_offset, rh->dns_zone))
+    if (0 == strcmp (rh->dns_name + zone_offset, rh->dns_zone))
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Asking same server for %s\n", rh->dns_name);
+                  "Asking DNS server for `%s'\n", 
+                 rh->dns_name);
+      
       send_dns_packet (rh);
     }
     else
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Trying system resolver for %s\n", rh->dns_name);
+                  "Trying system resolver for `%s'\n", rh->dns_name);
       resolve_dns_name (rh);
     }
 
@@ -1686,12 +1725,12 @@ resolve_record_dns (struct ResolverHandle *rh,
     }
     /* The glue */
     if (GNUNET_GNS_RECORD_A == rd[i].record_type)
-         /* need to use memcpy as .data may be unaligned */
-        memcpy (&dnsip, rd[i].data, sizeof (dnsip));
+      /* need to use memcpy as .data may be unaligned */
+      memcpy (&dnsip, rd[i].data, sizeof (dnsip));
   }
   
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_PHASE_REC_DNS-%llu: Looking up %s from %s\n",
+              "GNS_PHASE_REC_DNS-%llu: Looking up `%s' from `%s'\n",
               rh->id,
               rh->dns_name,
               inet_ntoa (dnsip));
@@ -1710,10 +1749,11 @@ resolve_record_dns (struct ResolverHandle *rh,
   sa->sa_family = AF_INET;
   if (GNUNET_OK != GNUNET_NETWORK_socket_bind (rh->dns_sock,
                                                sa,
-                                               sizeof (struct sockaddr_in)))
+                                               sizeof (struct sockaddr_in),
+                                               0))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "GNS_PHASE_REC_DNS-%llu: Error binding udp socket for dns!\n",
+                "GNS_PHASE_REC_DNS-%llu: Error binding UDP socket for DNS lookup!\n",
                 rh->id);
     finish_lookup (rh, rlh, 0, NULL);
     return;
@@ -1998,12 +2038,12 @@ handle_delegation_ns (void* cls, struct ResolverHandle *rh,
  */
 static void
 process_pkey_revocation_result_ns (void *cls,
-                                  const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *key,
+                                  const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *key,
                                   struct GNUNET_TIME_Absolute expiration,
                                   const char *name,
                                   unsigned int rd_count,
                                   const struct GNUNET_NAMESTORE_RecordData *rd,
-                                  const struct GNUNET_CRYPTO_RsaSignature *signature)
+                                  const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct GNUNET_TIME_Relative remaining_time;
@@ -2651,10 +2691,8 @@ pop_tld (char* name, char* dest)
   //Was canonical?
   if (0 == len)
     return;
-
   name[len] = '\0';
-
-  strcpy(dest, (name+len+1));
+  strcpy (dest, (name+len+1));
 }
 
 
@@ -2780,7 +2818,7 @@ resolve_delegation_dht (struct ResolverHandle *rh)
 
 
 /**
- * Checks if name is in tld
+ * Checks if "name" ends in ".tld"
  *
  * @param name the name to check
  * @param tld the TLD to check for
@@ -2793,14 +2831,9 @@ is_tld (const char* name, const char* tld)
 
   if (strlen (name) <= strlen (tld))
     return GNUNET_NO;
-  
   offset = strlen (name) - strlen (tld);
   if (0 != strcmp (name + offset, tld))
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "%s is not in .%s TLD\n", name, tld);
     return GNUNET_NO;
-  }
   return GNUNET_YES;
 }
 
@@ -2822,9 +2855,9 @@ handle_delegation_ns (void* cls, struct ResolverHandle *rh,
   int check_dht;
   size_t s_len;
 
-  GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_NS-%llu: Resolution status: %d.\n",
-             rh->id, rh->status);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+             "GNS_PHASE_DELEGATE_NS-%llu: Resolution status: %d.\n",
+             rh->id, rh->status);
 
   if (rh->status & RSL_PKEY_REVOKED)
   {
@@ -2907,16 +2940,15 @@ handle_delegation_ns (void* cls, struct ResolverHandle *rh,
     {
       if (GNUNET_GNS_RECORD_NS == rlh->record_type)
       {
-        GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-                   "GNS_PHASE_DELEGATE_NS-%llu: Resolved queried NSRR in NS.\n",
-                   rh->id);
-        finish_lookup(rh, rlh, rd_count, rd);
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                   "GNS_PHASE_DELEGATE_NS-%llu: Resolved queried NSRR in NS.\n",
+                   rh->id);
+        finish_lookup (rh, rlh, rd_count, rd);
         return;
-      }
-      
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-                 "GNS_PHASE_DELEGATE_NS-%llu: NS delegation starting.\n",
-                 rh->id);
+      }      
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                 "GNS_PHASE_DELEGATE_NS-%llu: NS delegation starting.\n",
+                 rh->id);
       GNUNET_assert (NULL != rd);
       rh->proc = &handle_record_ns;
       resolve_record_dns (rh, rd_count, rd);
@@ -3035,12 +3067,12 @@ handle_delegation_ns (void* cls, struct ResolverHandle *rh,
  */
 static void
 process_delegation_result_ns (void* cls,
-                             const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *key,
+                             const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *key,
                              struct GNUNET_TIME_Absolute expiration,
                              const char *name,
                              unsigned int rd_count,
                              const struct GNUNET_NAMESTORE_RecordData *rd,
-                             const struct GNUNET_CRYPTO_RsaSignature *signature)
+                             const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct GNUNET_TIME_Relative remaining_time;
@@ -3048,27 +3080,31 @@ process_delegation_result_ns (void* cls,
   char new_name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
   unsigned int i;
   struct GNUNET_TIME_Absolute et;
+  struct AuthorityChain *auth;
  
   rh->namestore_task = NULL;
+  GNUNET_CRYPTO_short_hash (key,
+                           sizeof (struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded),
+                           &zone);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_NS-%llu: Got %d records from authority lookup\n",
-             rh->id, rd_count);
+             "GNS_PHASE_DELEGATE_NS-%llu: Got %d records from authority lookup for `%s' in zone %s\n",
+             rh->id, rd_count,
+             name,
+             GNUNET_short_h2s (&zone));
 
-  GNUNET_CRYPTO_short_hash (key,
-                      sizeof(struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded),
-                      &zone);
   remaining_time = GNUNET_TIME_absolute_get_remaining (expiration);
   
   rh->status = 0;
   
-  if (name != NULL)
+  if (NULL != name)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "GNS_PHASE_DELEGATE_NS-%llu: Records with name %s exist.\n",
-                rh->id, name);
+                "GNS_PHASE_DELEGATE_NS-%llu: Records with name `%s' exist in zone %s.\n",
+                rh->id, name,
+               GNUNET_short_h2s (&zone));
     rh->status |= RSL_RECORD_EXISTS;
   
-    if (remaining_time.rel_value == 0)
+    if (0 == remaining_time.rel_value)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "GNS_PHASE_DELEGATE_NS-%llu: Record set %s expired.\n",
@@ -3080,7 +3116,7 @@ process_delegation_result_ns (void* cls,
   /**
    * No authority found in namestore.
    */
-  if (rd_count == 0)
+  if (0 == rd_count)
   {
     /**
      * We did not find an authority in the namestore
@@ -3124,125 +3160,104 @@ process_delegation_result_ns (void* cls,
    */
   for (i=0; i < rd_count;i++)
   {
-    
-    /**
-     * A CNAME. Like regular DNS this means the is no other record for this
-     * name.
-     */
-    if (rd[i].record_type == GNUNET_GNS_RECORD_CNAME)
+    switch (rd[i].record_type)
     {
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-                 "GNS_PHASE_DELEGATE_NS-%llu: CNAME found.\n",
-                 rh->id);
+    case GNUNET_GNS_RECORD_CNAME:
+      /* Like in regular DNS this should mean that there is no other
+       * record for this name.  */
 
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                 "GNS_PHASE_DELEGATE_NS-%llu: CNAME `%.*s' found.\n",
+                 rh->id,
+                 (int) rd[i].data_size,
+                 rd[i].data);
       rh->status |= RSL_CNAME_FOUND;
       rh->proc (rh->proc_cls, rh, rd_count, rd);
       return;
-    }
-
-    /**
-     * Redirect via VPN
-     */
-    if (rd[i].record_type == GNUNET_GNS_RECORD_VPN)
-    {
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-                 "GNS_PHASE_DELEGATE_NS-%llu: VPN found.\n",
-                 rh->id);
+    case GNUNET_GNS_RECORD_VPN:
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                 "GNS_PHASE_DELEGATE_NS-%llu: VPN found.\n",
+                 rh->id);
       rh->status |= RSL_DELEGATE_VPN;
       rh->proc (rh->proc_cls, rh, rd_count, rd);
       return;
-    }
-
-    /**
-     * Redirect via NS
-     * FIXME make optional
-     */
-    if (rd[i].record_type == GNUNET_GNS_RECORD_NS)
-    {
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-                 "GNS_PHASE_DELEGATE_NS-%llu: NS found.\n",
-                 rh->id);
+    case GNUNET_GNS_RECORD_NS:
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                 "GNS_PHASE_DELEGATE_NS-%llu: NS `%.*s' found.\n",
+                 rh->id,
+                 (int) rd[i].data_size,
+                 rd[i].data);
       rh->status |= RSL_DELEGATE_NS;
       rh->proc (rh->proc_cls, rh, rd_count, rd);
       return;
-    }
-  
-    if (rd[i].record_type != GNUNET_GNS_RECORD_PKEY)
-      continue;
-
-    rh->status |= RSL_DELEGATE_PKEY;
-
-    if ((ignore_pending_records != 0) &&
-        (rd[i].flags & GNUNET_NAMESTORE_RF_PENDING))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-     "GNS_PHASE_DELEGATE_NS-%llu: PKEY for %s is pending user confirmation.\n",
-        rh->id,
-        name);
-      continue;
-    }
-    
-    GNUNET_break (0 == (rd[i].flags & GNUNET_NAMESTORE_RF_RELATIVE_EXPIRATION));
-    et.abs_value = rd[i].expiration_time;
-    if ((GNUNET_TIME_absolute_get_remaining (et)).rel_value
-         == 0)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_DELEGATE_NS-%llu: This pkey is expired.\n",
-                  rh->id);
-      if (remaining_time.rel_value == 0)
+    case GNUNET_GNS_RECORD_PKEY:
+      rh->status |= RSL_DELEGATE_PKEY;
+      if ((ignore_pending_records != 0) &&
+         (rd[i].flags & GNUNET_NAMESTORE_RF_PENDING))
       {
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                    "GNS_PHASE_DELEGATE_NS-%llu: This dht entry is expired.\n",
-                    rh->id);
-        rh->authority_chain_head->fresh = 0;
-        rh->proc (rh->proc_cls, rh, 0, NULL);
-        return;
+       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                   "GNS_PHASE_DELEGATE_NS-%llu: PKEY for %s is pending user confirmation.\n",
+                   rh->id,
+                   name);
+       continue;
+      }    
+      GNUNET_break (0 == (rd[i].flags & GNUNET_NAMESTORE_RF_RELATIVE_EXPIRATION));
+      et.abs_value = rd[i].expiration_time;
+      if (0 == (GNUNET_TIME_absolute_get_remaining (et)).rel_value)
+      {
+       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                   "GNS_PHASE_DELEGATE_NS-%llu: This pkey is expired.\n",
+                   rh->id);
+       if (remaining_time.rel_value == 0)
+       {
+         GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                     "GNS_PHASE_DELEGATE_NS-%llu: This dht entry is expired.\n",
+                     rh->id);
+         rh->authority_chain_head->fresh = 0;
+         rh->proc (rh->proc_cls, rh, 0, NULL);
+         return;
+       }       
+       continue;
       }
-
-      continue;
+      /* Resolve rest of query with new authority */
+      memcpy (&rh->authority, rd[i].data,
+             sizeof (struct GNUNET_CRYPTO_ShortHashCode));
+      auth = GNUNET_malloc(sizeof (struct AuthorityChain));
+      auth->zone = rh->authority;
+      memset (auth->name, 0, strlen (rh->authority_name)+1);
+      strcpy (auth->name, rh->authority_name);
+      GNUNET_CONTAINER_DLL_insert (rh->authority_chain_head,
+                                  rh->authority_chain_tail,
+                                  auth);
+      if (NULL != rh->rd.data)
+       GNUNET_free ((void*)(rh->rd.data));      
+      memcpy (&rh->rd, &rd[i], sizeof (struct GNUNET_NAMESTORE_RecordData));
+      rh->rd.data = GNUNET_malloc (rd[i].data_size);
+      memcpy ((void*)rh->rd.data, rd[i].data, rd[i].data_size);
+      rh->rd_count = 1;
+      /* Check for key revocation and delegate */
+      rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
+                                                          &rh->authority,
+                                                          GNUNET_GNS_MASTERZONE_STR,
+                                                          GNUNET_GNS_RECORD_REV,
+                                                          &process_pkey_revocation_result_ns,
+                                                          rh);
+      return;
+    default:
+      /* ignore, move to next result */
+      break;
     }
-
-    /**
-     * Resolve rest of query with new authority
-     */
-    GNUNET_assert (rd[i].record_type == GNUNET_GNS_RECORD_PKEY);
-    memcpy (&rh->authority, rd[i].data,
-            sizeof (struct GNUNET_CRYPTO_ShortHashCode));
-    struct AuthorityChain *auth = GNUNET_malloc(sizeof (struct AuthorityChain));
-    auth->zone = rh->authority;
-    memset (auth->name, 0, strlen (rh->authority_name)+1);
-    strcpy (auth->name, rh->authority_name);
-    GNUNET_CONTAINER_DLL_insert (rh->authority_chain_head,
-                                 rh->authority_chain_tail,
-                                 auth);
-    if (NULL != rh->rd.data)
-      GNUNET_free ((void*)(rh->rd.data));
-    
-    memcpy (&rh->rd, &rd[i], sizeof (struct GNUNET_NAMESTORE_RecordData));
-    rh->rd.data = GNUNET_malloc (rd[i].data_size);
-    memcpy ((void*)rh->rd.data, rd[i].data, rd[i].data_size);
-    rh->rd_count = 1;
-    /* Check for key revocation and delegate */
-    rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
-                                                        &rh->authority,
-                                                        GNUNET_GNS_MASTERZONE_STR,
-                                                        GNUNET_GNS_RECORD_REV,
-                                                        &process_pkey_revocation_result_ns,
-                                                        rh);
-    return;
   }
   
-  /**
-   * no answers found
-   */
+  /* no answers that would cause delegation were found */
   GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-    "GNS_PHASE_DELEGATE_NS-%llu: Authority lookup and no PKEY...\n", rh->id);
+            "GNS_PHASE_DELEGATE_NS-%llu: Authority lookup failed (no PKEY record)\n", 
+            rh->id);
   /**
    * If we have found some records for the LAST label
-   * we return the results. Else null.
+   * we return the results. Else NULL.
    */
-  if (strcmp (rh->name, "") == 0)
+  if (0 == strcmp (rh->name, ""))
   {
     /* Start shortening */
     if ((rh->priv_key != NULL) &&
@@ -3273,6 +3288,7 @@ process_delegation_result_ns (void* cls,
 
 /**
  * Resolve the delegation chain for the request in our namestore
+ * (as in, find the respective authority for the leftmost label).
  *
  * @param rh the resolver handle
  */
@@ -3281,9 +3297,11 @@ resolve_delegation_ns (struct ResolverHandle *rh)
 {
   pop_tld (rh->name, rh->authority_name);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_NS-%llu: Resolving delegation for %s by looking up %s\n",
-             rh->id, rh->name,
-             rh->authority_name);
+             "GNS_PHASE_DELEGATE_NS-%llu: Finding authority for `%s' by looking up `%s' in GADS zone `%s'\n",
+             rh->id,         
+             rh->name,
+             rh->authority_name,
+             GNUNET_short_h2s (&rh->authority));
   rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
                                                       &rh->authority,
                                                       rh->authority_name,
@@ -3312,7 +3330,7 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
                             struct GNUNET_CRYPTO_ShortHashCode pzone,
                             uint32_t record_type,
                             const char* name,
-                            struct GNUNET_CRYPTO_RsaPrivateKey *key,
+                            struct GNUNET_CRYPTO_EccPrivateKey *key,
                             struct GNUNET_TIME_Relative timeout,
                             int only_cached,
                             RecordLookupProcessor proc,
@@ -3325,7 +3343,7 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
   char* nzkey_ptr = nzkey;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Starting resolution for %s (type=%d) with timeout %s!\n",
+              "Starting resolution for `%s' (type=%d) with timeout %s!\n",
               name, record_type,
              GNUNET_STRINGS_relative_time_to_string (timeout, GNUNET_YES));
 
@@ -3378,14 +3396,12 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
   if (strcmp(GNUNET_GNS_TLD, name) == 0)
   {
     /**
-     * Only 'gnunet' given
+     * Only '.gads' given
      */
-    strcpy(rh->name, "\0");
+    strcpy (rh->name, "\0");
   }
   else
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Checking for TLD...\n");
     if (is_zkey_tld(name) == GNUNET_YES)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -3398,7 +3414,7 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
              strlen(name)-strlen(GNUNET_GNS_TLD_ZKEY));
       memcpy(rh->name, name,
              strlen(name)-strlen(GNUNET_GNS_TLD_ZKEY) - 1);
-      pop_tld(rh->name, string_hash);
+      pop_tld (rh->name, string_hash);
 
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                   "ZKEY is %s!\n", string_hash);
@@ -3435,8 +3451,8 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
     else
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Cannot handle this TLD %s\n", string_hash);
-      
+                  _("Not a GADS TLD: `%s'\n"), 
+                 name);      
       if (GNUNET_SCHEDULER_NO_TASK != rh->timeout_task)
         GNUNET_SCHEDULER_cancel (rh->timeout_task);
       GNUNET_CONTAINER_DLL_remove (rlh_head, rlh_tail, rh);
@@ -3465,7 +3481,7 @@ gns_resolver_lookup_record (struct GNUNET_CRYPTO_ShortHashCode zone,
   rlh->proc_cls = cls;
 
   rh->proc = &handle_delegation_ns;
-  resolve_delegation_ns(rh);
+  resolve_delegation_ns (rh);
 }
 
 /******** END Record Resolver ***********/
@@ -3497,12 +3513,12 @@ finish_shorten (struct ResolverHandle *rh,
  */
 static void
 process_zone_to_name_shorten_root (void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature);
+                 const struct GNUNET_CRYPTO_EccSignature *signature);
 
 
 /**
@@ -3519,12 +3535,12 @@ process_zone_to_name_shorten_root (void *cls,
  */
 static void
 process_zone_to_name_shorten_shorten (void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature)
+                 const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct NameShortenHandle* nsh = rh->proc_cls;
@@ -3635,12 +3651,12 @@ process_zone_to_name_shorten_shorten (void *cls,
  */
 static void
 process_zone_to_name_shorten_private (void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature)
+                 const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct NameShortenHandle* nsh = rh->proc_cls;
@@ -3750,12 +3766,12 @@ process_zone_to_name_shorten_private (void *cls,
  */
 static void
 process_zone_to_name_shorten_root (void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature)
+                 const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct NameShortenHandle* nsh = rh->proc_cls;
@@ -3973,12 +3989,12 @@ handle_delegation_ns_shorten (void* cls,
  */
 static void
 process_zone_to_name_zkey(void *cls,
-                 const struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded *zone_key,
+                 const struct GNUNET_CRYPTO_EccPublicKeyBinaryEncoded *zone_key,
                  struct GNUNET_TIME_Absolute expire,
                  const char *name,
                  unsigned int rd_len,
                  const struct GNUNET_NAMESTORE_RecordData *rd,
-                 const struct GNUNET_CRYPTO_RsaSignature *signature)
+                 const struct GNUNET_CRYPTO_EccSignature *signature)
 {
   struct ResolverHandle *rh = cls;
   struct NameShortenHandle *nsh = rh->proc_cls;