-use GPLv3+ consistently
[oweals/gnunet.git] / src / gns / gnunet-service-gns_resolver.c
index 4f7f56d218ecee69b8b04bd89720d09b6c660016..8d8dba7fa6c70b3bf480d3c7855cb7aa965311f7 100644 (file)
  * @author Christian Grothoff
  *
  * TODO:
- * - GNS: handle CNAME records (idea: manipulate rh->name)
  * - GNS: handle special SRV names --- no delegation, direct lookup;
  *        can likely be done in 'resolver_lookup_get_next_label'.
- * - recursive DNS resolution
+ * - GNS: expand ".+" in returned values to the respective absolute
+ *        name using '.zkey'
+ * - DNS: convert additional record types to GNS
  * - shortening triggers
  * - revocation checks (make optional: privacy!)
+ * - DNAME support
  *
  * Issues:
  * - We currently go to the DHT simply if we find no local reply; this
@@ -52,7 +54,6 @@
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_transport_service.h"
 #include "gnunet_dnsstub_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_namestore_service.h"
@@ -62,6 +63,7 @@
 #include "gnunet_gns_service.h"
 #include "gns.h"
 #include "gnunet-service-gns_resolver.h"
+#include "gnunet-service-gns_shorten.h"
 #include "gnunet_vpn_service.h"
 
 
@@ -157,53 +159,6 @@ struct AuthorityChain
 };
 
 
-/**
- * Resolution status indicator
- */
-enum ResolutionStatus
-{
-  /**
-   * the name to lookup exists
-   */
-  RSL_RECORD_EXISTS = 1,
-
-  /**
-   * the name in the record expired
-   */
-  RSL_RECORD_EXPIRED = 2,
-  /**
-   * resolution timed out
-   */
-  RSL_TIMED_OUT = 4,
-  /**
-   * Found VPN delegation
-   */
-  RSL_DELEGATE_VPN = 8,
-  /**
-   * Found NS delegation
-   */
-  RSL_DELEGATE_NS = 16,
-  /**
-   * Found PKEY delegation
-   */
-  RSL_DELEGATE_PKEY = 32,
-  
-  /**
-   * Found CNAME record
-   */
-  RSL_CNAME_FOUND = 64,
-  
-  /**
-   * Found PKEY has been revoked
-   */
-  RSL_PKEY_REVOKED = 128
-};
-
-
 /**
  * A result we got from DNS.
  */
@@ -400,60 +355,6 @@ struct GNS_ResolverHandle
 };
 
 
-/**
- * Handle for a PSEU lookup used to shorten names.
- */
-struct GetPseuAuthorityHandle
-{
-  /**
-   * DLL
-   */
-  struct GetPseuAuthorityHandle *next;
-
-  /**
-   * DLL
-   */
-  struct GetPseuAuthorityHandle *prev;
-
-  /**
-   * Private key of the (shorten) zone to store the resulting
-   * pseudonym in.
-   */
-  struct GNUNET_CRYPTO_EccPrivateKey shorten_zone_key;
-
-  /**
-   * Original label (used if no PSEU record is found).
-   */
-  char label[GNUNET_DNSPARSER_MAX_LABEL_LENGTH + 1];
-
-  /**
-   * Label we are currently trying out (during #perform_pseu_lookup).
-   */
-  char *current_label;
-
-  /**
-   * The zone for which we are trying to find the PSEU record.
-   */
-  struct GNUNET_CRYPTO_EccPublicKey target_zone;
-
-  /**
-   * Handle for DHT lookups. Should be NULL if no lookups are in progress 
-   */
-  struct GNUNET_DHT_GetHandle *get_handle;
-
-  /**
-   * Handle to namestore request 
-   */
-  struct GNUNET_NAMESTORE_QueueEntry *namestore_task;
-
-  /**
-   * Task to abort DHT lookup operation.
-   */
-  GNUNET_SCHEDULER_TaskIdentifier timeout_task;
-
-};
-
-
 /**
  * Our handle to the namestore service
  */
@@ -484,16 +385,6 @@ static struct GNUNET_CONTAINER_Heap *dht_lookup_heap;
  */
 static unsigned long long max_allowed_background_queries;
 
-/**
- * Head of PSEU/shorten operations list.
- */
-struct GetPseuAuthorityHandle *gph_head;
-
-/**
- * Tail of PSEU/shorten operations list.
- */
-struct GetPseuAuthorityHandle *gph_tail;
-
 /**
  * Head of resolver lookup list
  */
@@ -575,425 +466,6 @@ is_canonical (const char *name)
 }
 
 
-/* ******************** Shortening logic ************************ */
-
-
-/**
- * Cleanup a 'struct GetPseuAuthorityHandle', terminating all
- * pending activities.
- *
- * @param gph handle to terminate
- */
-static void
-free_get_pseu_authority_handle (struct GetPseuAuthorityHandle *gph)
-{
-  if (NULL != gph->get_handle)
-  {
-    GNUNET_DHT_get_stop (gph->get_handle);
-    gph->get_handle = NULL;
-  }
-  if (NULL != gph->namestore_task)
-  {
-    GNUNET_NAMESTORE_cancel (gph->namestore_task);
-    gph->namestore_task = NULL;
-  }
-  if (GNUNET_SCHEDULER_NO_TASK != gph->timeout_task)
-  {
-    GNUNET_SCHEDULER_cancel (gph->timeout_task);
-    gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  }
-  GNUNET_CONTAINER_DLL_remove (gph_head, gph_tail, gph);
-  GNUNET_free_non_null (gph->current_label);
-  GNUNET_free (gph);
-}
-
-
-/**
- * Continuation for pkey record creation (shorten)
- *
- * @param cls a GetPseuAuthorityHandle
- * @param success unused
- * @param emsg unused
- */
-static void
-create_pkey_cont (void* cls, 
-                 int32_t success, 
-                 const char *emsg)
-{
-  struct GetPseuAuthorityHandle* gph = cls;
-
-  gph->namestore_task = NULL;
-  free_get_pseu_authority_handle (gph);
-}
-
-
-/**
- * Namestore calls this function if we have record for this name.
- * (or with rd_count=0 to indicate no matches).
- *
- * @param cls the pending query
- * @param rd_count the number of records with 'name'
- * @param rd the record data
- */
-static void
-process_pseu_lookup_ns (void *cls,
-                       unsigned int rd_count,
-                       const struct GNUNET_NAMESTORE_RecordData *rd);
-
-
-/**
- * We obtained a result for our query to the shorten zone from
- * the namestore.  Try to decrypt.
- *
- * @param cls the handle to our shorten operation
- * @param block resulting encrypted block
- */
-static void
-process_pseu_block_ns (void *cls,
-                      const struct GNUNET_NAMESTORE_Block *block)
-{
-  struct GetPseuAuthorityHandle *gph = cls;
-  struct GNUNET_CRYPTO_EccPublicKey pub;
-
-  gph->namestore_task = NULL;
-  if (NULL == block)
-  {
-    process_pseu_lookup_ns (gph, 0, NULL);
-    return;
-  }
-  GNUNET_CRYPTO_ecc_key_get_public (&gph->shorten_zone_key,
-                                   &pub);
-  if (GNUNET_OK != 
-      GNUNET_NAMESTORE_block_decrypt (block,
-                                     &pub,
-                                     gph->current_label,
-                                     &process_pseu_lookup_ns,
-                                     gph))
-  {
-    GNUNET_break (0);
-    free_get_pseu_authority_handle (gph);
-    return;
-  }
-}
-
-
-/**
- * Lookup in the namestore for the shorten zone the given label.
- *
- * @param gph the handle to our shorten operation
- * @param label the label to lookup
- */
-static void 
-perform_pseu_lookup (struct GetPseuAuthorityHandle *gph,
-                    const char *label)
-{ 
-  struct GNUNET_CRYPTO_EccPublicKey pub;
-  struct GNUNET_HashCode query;
-
-  GNUNET_CRYPTO_ecc_key_get_public (&gph->shorten_zone_key,
-                                   &pub);
-  GNUNET_free_non_null (gph->current_label);
-  gph->current_label = GNUNET_strdup (label);
-  GNUNET_NAMESTORE_query_from_public_key (&pub,
-                                         label,
-                                         &query);
-  gph->namestore_task = GNUNET_NAMESTORE_lookup_block (namestore_handle,
-                                                      &query,
-                                                      &process_pseu_block_ns,
-                                                      gph);
-}
-
-
-/**
- * Namestore calls this function if we have record for this name.
- * (or with rd_count=0 to indicate no matches).
- *
- * @param cls the pending query
- * @param rd_count the number of records with 'name'
- * @param rd the record data
- */
-static void
-process_pseu_lookup_ns (void *cls,
-                       unsigned int rd_count,
-                       const struct GNUNET_NAMESTORE_RecordData *rd)
-{
-  struct GetPseuAuthorityHandle *gph = cls;
-  struct GNUNET_NAMESTORE_RecordData new_pkey;
-
-  gph->namestore_task = NULL;
-  if (rd_count > 0)
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "Name `%s' already taken, cannot shorten.\n", 
-              gph->current_label);
-    /* if this was not yet the original label, try one more
-       time, this time not using PSEU but the original label */
-    if (0 == strcmp (gph->current_label,
-                    gph->label))
-    {
-      free_get_pseu_authority_handle (gph);
-    }
-    else
-    {
-      perform_pseu_lookup (gph, gph->label);
-    }
-    return;
-  }
-  /* name is available */
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Shortening `%s' to `%s'\n", 
-             GNUNET_NAMESTORE_z2s (&gph->target_zone),
-             gph->current_label);
-  new_pkey.expiration_time = UINT64_MAX;
-  new_pkey.data_size = sizeof (struct GNUNET_CRYPTO_EccPublicKey);
-  new_pkey.data = &gph->target_zone;
-  new_pkey.record_type = GNUNET_NAMESTORE_TYPE_PKEY;
-  new_pkey.flags = GNUNET_NAMESTORE_RF_AUTHORITY
-                 | GNUNET_NAMESTORE_RF_PRIVATE
-                 | GNUNET_NAMESTORE_RF_PENDING;
-  gph->namestore_task 
-    = GNUNET_NAMESTORE_records_store (namestore_handle,
-                                     &gph->shorten_zone_key,
-                                     gph->current_label,
-                                     1, &new_pkey,
-                                     &create_pkey_cont, gph);
-}
-
-
-/**
- * Process result of a DHT lookup for a PSEU record.
- *
- * @param gph the handle to our shorten operation
- * @param pseu the pseu result or NULL
- */
-static void
-process_pseu_result (struct GetPseuAuthorityHandle* gph, 
-                    const char *pseu)
-{
-  if (NULL == pseu)
-  {
-    /* no PSEU found, try original label */
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "No PSEU found, trying original label `%s' instead.\n",
-               gph->label);
-    perform_pseu_lookup (gph, gph->label);
-    return;
-  }  
-  /* check if 'pseu' is taken */
-  perform_pseu_lookup (gph, pseu);
-}
-
-
-/**
- * Handle timeout for DHT request during shortening.
- *
- * @param cls the request handle as closure
- * @param tc the task context
- */
-static void
-handle_auth_discovery_timeout (void *cls,
-                               const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct GetPseuAuthorityHandle *gph = cls;
-
-  gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "DHT lookup for PSEU query timed out.\n");
-  GNUNET_DHT_get_stop (gph->get_handle);
-  gph->get_handle = NULL;
-  process_pseu_result (gph, NULL);
-}
-
-
-/**
- * Handle decrypted records from DHT result.
- *
- * @param cls closure with our 'struct GetPseuAuthorityHandle'
- * @param rd_count number of entries in 'rd' array
- * @param rd array of records with data to store
- */
-static void
-process_auth_records (void *cls,
-                     unsigned int rd_count,
-                     const struct GNUNET_NAMESTORE_RecordData *rd)
-{
-  struct GetPseuAuthorityHandle *gph = cls;
-  unsigned int i;
-
-  for (i=0; i < rd_count; i++)
-  {
-    if (GNUNET_NAMESTORE_TYPE_PSEU == rd[i].record_type)
-    {
-      /* found pseu */
-      process_pseu_result (gph, 
-                          (const char *) rd[i].data);
-      return;
-    }
-  }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "No PSEU record found in DHT reply.\n");
-  process_pseu_result (gph, NULL);
-}
-
-
-/**
- * Function called when we find a PSEU entry in the DHT
- *
- * @param cls the request handle
- * @param exp lifetime
- * @param key the key the record was stored under
- * @param get_path get path
- * @param get_path_length get path length
- * @param put_path put path
- * @param put_path_length put path length
- * @param type the block type
- * @param size the size of the record
- * @param data the record data
- */
-static void
-process_auth_discovery_dht_result (void* cls,
-                                   struct GNUNET_TIME_Absolute exp,
-                                   const struct GNUNET_HashCode *key,
-                                   const struct GNUNET_PeerIdentity *get_path,
-                                   unsigned int get_path_length,
-                                   const struct GNUNET_PeerIdentity *put_path,
-                                   unsigned int put_path_length,
-                                   enum GNUNET_BLOCK_Type type,
-                                   size_t size,
-                                   const void *data)
-{
-  struct GetPseuAuthorityHandle *gph = cls;
-  const struct GNUNET_NAMESTORE_Block *block;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Got DHT result for PSEU request\n");
-  GNUNET_DHT_get_stop (gph->get_handle);
-  gph->get_handle = NULL;
-  GNUNET_SCHEDULER_cancel (gph->timeout_task);
-  gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-
-  if (NULL == data)
-  {
-    /* is this allowed!? */
-    GNUNET_break (0);
-    process_pseu_result (gph, NULL);
-    return;
-  }
-  if (size < sizeof (struct GNUNET_NAMESTORE_Block))
-  {
-    /* how did this pass DHT block validation!? */
-    GNUNET_break (0);
-    process_pseu_result (gph, NULL);
-    return;   
-  }
-  block = data;
-  if (size !=
-      ntohs (block->purpose.size) + 
-      sizeof (struct GNUNET_CRYPTO_EccPublicKey) +
-      sizeof (struct GNUNET_CRYPTO_EccSignature))
-  {
-    /* how did this pass DHT block validation!? */
-    GNUNET_break (0);
-    process_pseu_result (gph, NULL);
-    return;   
-  }
-  if (GNUNET_OK !=
-      GNUNET_NAMESTORE_block_decrypt (block,
-                                     &gph->target_zone,
-                                     GNUNET_GNS_TLD_PLUS,
-                                     &process_auth_records,
-                                     gph))
-  {
-    /* other peer encrypted invalid block, complain */
-    GNUNET_break_op (0);
-    process_pseu_result (gph, NULL);
-    return;   
-  }
-}
-
-
-/**
- * Callback called by namestore for a zone to name result.  We're
- * trying to see if a short name for a given zone already exists.
- *
- * @param cls the closure
- * @param zone_key the zone we queried
- * @param name the name found or NULL
- * @param rd_len number of records for the name
- * @param rd the record data (PKEY) for the name
- */
-static void
-process_zone_to_name_discover (void *cls,
-                              const struct GNUNET_CRYPTO_EccPrivateKey *zone_key,
-                              const char *name,
-                              unsigned int rd_len,
-                              const struct GNUNET_NAMESTORE_RecordData *rd)
-{
-  struct GetPseuAuthorityHandle* gph = cls;
-  struct GNUNET_HashCode lookup_key;
-  
-  gph->namestore_task = NULL;
-  if (0 != rd_len)
-  {
-    /* we found a match in our own zone */
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-               "Shortening aborted, name `%s' already reserved for the zone\n",
-               name);
-    free_get_pseu_authority_handle (gph);
-    return;
-  }
-  /* record does not yet exist, go into DHT to find PSEU record */
-  GNUNET_NAMESTORE_query_from_public_key (&gph->target_zone,
-                                         GNUNET_GNS_TLD_PLUS,                                    
-                                         &lookup_key);
-  gph->timeout_task = GNUNET_SCHEDULER_add_delayed (DHT_LOOKUP_TIMEOUT,
-                                                   &handle_auth_discovery_timeout, 
-                                                   gph);
-  gph->get_handle = GNUNET_DHT_get_start (dht_handle,
-                                         GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
-                                         &lookup_key,
-                                         DHT_GNS_REPLICATION_LEVEL,
-                                         GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE,
-                                         NULL, 0,
-                                         &process_auth_discovery_dht_result,
-                                         gph);
-}
-
-
-/**
- * Start shortening algorithm, try to allocate a nice short
- * canonical name for @a pub in @a shorten_zone, using
- * @a original_label as one possible suggestion.
- *
- * @param original_label original label for the zone
- * @param pub public key of the zone to shorten
- * @param shorten_zone private key of the target zone for the new record
- */
-static void
-start_shorten (const char *original_label,
-              const struct GNUNET_CRYPTO_EccPublicKey *pub,
-               const struct GNUNET_CRYPTO_EccPrivateKey *shorten_zone)
-{
-  struct GetPseuAuthorityHandle *gph;
-  
-  if (strlen (original_label) > GNUNET_DNSPARSER_MAX_LABEL_LENGTH)
-  {
-    GNUNET_break (0);
-    return;
-  }
-  gph = GNUNET_new (struct GetPseuAuthorityHandle);
-  gph->shorten_zone_key = *shorten_zone;
-  gph->target_zone = *pub;
-  strcpy (gph->label, original_label);
-  GNUNET_CONTAINER_DLL_insert (gph_head, gph_tail, gph);
-  /* first, check if we *already* have a record for this zone */
-  gph->namestore_task = GNUNET_NAMESTORE_zone_to_name (namestore_handle,
-                                                       shorten_zone,
-                                                       pub,
-                                                       &process_zone_to_name_discover,
-                                                       gph);
-}
-
 
 /* ************************** Resolution **************************** */
 
@@ -1207,8 +679,9 @@ fail_resolution (void *cls,
   GNS_resolver_lookup_cancel (rh);
 }
 
-#ifdef WINDOWS
-/* Don't have this on W32, here's a naive implementation */
+#if (defined WINDOWS) || (defined DARWIN)
+/* Don't have this on W32, here's a naive implementation
+ * Was somehow removed on OS X ...  */
 void *
 memrchr (const void *s, int c, size_t n)
 {
@@ -1389,6 +862,16 @@ recursive_resolution (void *cls,
                      const struct GNUNET_SCHEDULER_TaskContext *tc);
 
 
+/**
+ * Begin the resolution process from 'name', starting with
+ * the identification of the zone specified by 'name'.
+ *
+ * @param rh resolution to perform
+ */
+static void
+start_resolver_lookup (struct GNS_ResolverHandle *rh);
+
+
 /**
  * Function called with the result of a DNS resolution.
  *
@@ -1406,6 +889,9 @@ dns_result_parser (void *cls,
 {
   struct GNS_ResolverHandle *rh = cls;
   struct GNUNET_DNSPARSER_Packet *p;
+  const struct GNUNET_DNSPARSER_Record *rec;
+  unsigned int rd_count;
+  unsigned int i;
 
   rh->dns_request = NULL;
   GNUNET_SCHEDULER_cancel (rh->task_id);
@@ -1420,17 +906,106 @@ dns_result_parser (void *cls,
     GNS_resolver_lookup_cancel (rh);
     return;
   }
-  // FIXME: 
-  // Check if the packet is the final answer, or
-  // just pointing us to another NS or another name (CNAME), or another domain (DNAME);
-  // then do the right thing (TM) -- possibly using "recursive_dns_resolution".
-  GNUNET_break (0);
-  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-             _("NOT IMPLEMENTED\n"));
-  rh->proc (rh->proc_cls, 0, NULL);
-  GNS_resolver_lookup_cancel (rh);
 
-  
+  if ( (p->num_answers > 0) &&
+       (GNUNET_DNSPARSER_TYPE_CNAME == p->answers[0].type) &&
+       (GNUNET_DNSPARSER_TYPE_CNAME != rh->record_type) )
+    {
+      GNUNET_free (rh->name);
+      rh->name = GNUNET_strdup (p->answers[0].data.hostname);
+      start_resolver_lookup (rh);
+      return;     
+    }
+  /* FIXME: add DNAME support */
+
+  /* convert from DNS to GNS format! */
+  rd_count = p->num_answers + p->num_authority_records + p->num_additional_records;
+  {
+    struct GNUNET_NAMESTORE_RecordData rd[rd_count];
+    unsigned int skip;
+
+    skip = 0;
+    memset (rd, 0, sizeof (rd));
+    for (i=0;i<rd_count;i++)
+    {
+      if (i < p->num_answers)
+       rec = &p->answers[i];
+      else if (i < p->num_answers + p->num_authority_records)
+       rec = &p->authority_records[i - p->num_answers];
+      else 
+       rec = &p->authority_records[i - p->num_answers - p->num_authority_records];
+      /* As we copied the full DNS name to 'rh->ac_tail->label', this
+        should be the correct check to see if this record is actually
+        a record for our label... */
+      if (0 != strcmp (rec->name,
+                      rh->ac_tail->label))
+      {
+       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                   "Dropping record `%s', does not match desired name `%s'\n",
+                   rec->name,
+                   rh->ac_tail->label);
+       skip++;
+       continue;
+      }
+      rd[i - skip].record_type = rec->type;
+      rd[i - skip].expiration_time = rec->expiration_time.abs_value_us;
+      switch (rec->type)
+      {
+      case GNUNET_DNSPARSER_TYPE_A:
+       if (rec->data.raw.data_len != sizeof (struct in_addr))
+       {
+         GNUNET_break_op (0);
+         skip++;
+         continue;
+       }
+       rd[i - skip].data_size = rec->data.raw.data_len;
+       rd[i - skip].data = rec->data.raw.data;
+       break;
+      case GNUNET_DNSPARSER_TYPE_AAAA:
+       if (rec->data.raw.data_len != sizeof (struct in6_addr))
+       {
+         GNUNET_break_op (0);
+         skip++;
+         continue;
+       }
+       rd[i - skip].data_size = rec->data.raw.data_len;
+       rd[i - skip].data = rec->data.raw.data;
+       break;
+      case GNUNET_DNSPARSER_TYPE_CNAME:
+      case GNUNET_DNSPARSER_TYPE_PTR:
+      case GNUNET_DNSPARSER_TYPE_NS:
+       rd[i - skip].data_size = strlen (rec->data.hostname) + 1;
+       rd[i - skip].data = rec->data.hostname;
+       break;
+      case GNUNET_DNSPARSER_TYPE_SOA:
+       // FIXME: not implemented
+       // NOTE: consider exporting implementation in DNSPARSER lib!
+       GNUNET_break (0);
+       skip++;
+       break;
+      case GNUNET_DNSPARSER_TYPE_MX:
+       // FIXME: not implemented
+       // NOTE: consider exporting implementation in DNSPARSER lib!
+       GNUNET_break (0);
+       skip++;
+       break;
+      case GNUNET_DNSPARSER_TYPE_SRV:
+       // FIXME: not implemented
+       // NOTE: consider exporting implementation in DNSPARSER lib!
+       GNUNET_break (0);
+       skip++;
+       break;
+      default:
+       GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                   _("Skipping record of unsupported type %d\n"),
+                   rec->type);
+       skip++;
+       continue;
+      }
+    }
+    rh->proc (rh->proc_cls, rd_count - skip, rd);
+    GNS_resolver_lookup_cancel (rh);
+  }  
   GNUNET_DNSPARSER_free_packet (p);
 }
 
@@ -1518,10 +1093,40 @@ static void
 handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                         const char *cname)
 {
-  // FIXME: not implemented
-  GNUNET_break (0);
-  rh->proc (rh->proc_cls, 0, NULL);
-  GNS_resolver_lookup_cancel (rh);
+  size_t nlen;
+  char *res;
+
+  nlen = strlen (cname);
+  if ( (nlen > 2) &&
+       (0 == strcmp (".+",
+                    &cname[nlen - 2])) )
+  {
+    /* CNAME resolution continues relative to current domain */
+    if (0 == rh->name_resolution_pos)
+    {
+      res = GNUNET_strndup (cname, nlen - 2);
+      rh->name_resolution_pos = nlen - 2;
+    }
+    else
+    {
+      GNUNET_asprintf (&res,
+                      "%.*s.%.*s",
+                      (int) rh->name_resolution_pos,
+                      rh->name,
+                      (int) (nlen - 2),
+                      cname);
+      rh->name_resolution_pos = strlen (res);
+    }
+    GNUNET_free (rh->name);
+    rh->name = res;
+    rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                           rh);
+    return;
+  }
+  /* name is absolute, start from the beginning */
+  GNUNET_free (rh->name);
+  rh->name = GNUNET_strdup (cname);
+  start_resolver_lookup (rh);
 }
 
 
@@ -1630,6 +1235,8 @@ handle_gns_resolution_result (void *cls,
   const char *vname;
   struct GNUNET_HashCode vhash;
   int af;
+  char **scratch;
+  unsigned int scratch_len;
    
   if (0 == rh->name_resolution_pos)
   {
@@ -1645,8 +1252,8 @@ handle_gns_resolution_result (void *cls,
       GNUNET_free (cname);
       return;     
     }
-    /* FIXME: if A/AAAA was requested, but we got a VPN
-       record, we should interact with GNUnet VPN here */
+    /* If A/AAAA was requested, but we got a VPN
+       record, we convert it to A/AAAA using GNUnet VPN */
     if ( (GNUNET_DNSPARSER_TYPE_A == rh->record_type) ||
         (GNUNET_DNSPARSER_TYPE_AAAA == rh->record_type) )
     {
@@ -1698,10 +1305,45 @@ handle_gns_resolution_result (void *cls,
        }
       }
     }
+    /* convert relative names in record values to absolute names,
+       using 'scratch' array for memory allocations */
+    scratch = NULL;
+    scratch_len = 0;
+    for (i=0;i<rd_count;i++)
+    {
+      /* Strategy: dnsparser should expose API to make it easier
+        for us to parse all of these binary record values individually;
+        then, we check if the embedded name(s) end in "+", and if so,
+        replace the "+" with the zone at "ac_tail", changing the name
+        to a ".zkey".  The name is allocated on the 'scratch' array,
+        so we can free it afterwards. */
+      switch (rd[i].record_type)
+      {
+      case GNUNET_DNSPARSER_TYPE_CNAME:
+       GNUNET_break (0); // FIXME: not implemented
+       break;
+      case GNUNET_DNSPARSER_TYPE_SOA:
+       GNUNET_break (0); // FIXME: not implemented
+       break;
+      case GNUNET_DNSPARSER_TYPE_MX:
+       GNUNET_break (0); // FIXME: not implemented
+       break;
+      case GNUNET_DNSPARSER_TYPE_SRV:
+       GNUNET_break (0); // FIXME: not implemented
+       break;
+      default:
+       break;
+      }
+    }
     
     /* yes, we are done, return result */
     rh->proc (rh->proc_cls, rd_count, rd);
     GNS_resolver_lookup_cancel (rh);
+    for (i=0;i<scratch_len;i++)
+      GNUNET_free (scratch[i]);
+    GNUNET_array_grow (scratch, 
+                      scratch_len,
+                      0);
     return;         
   }
   /* need to recurse, check if we can */
@@ -1953,7 +1595,7 @@ handle_dht_response (void *cls,
 /**
  * Process a record that was stored in the namestore.
  *
- * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param cls closure with the `struct GNS_ResolverHandle`
  * @param block block that was stored in the namestore
  */
 static void 
@@ -2032,7 +1674,7 @@ recursive_gns_resolution_namestore (struct GNS_ResolverHandle *rh)
 /**
  * Task scheduled to continue with the resolution process.
  *
- * @param cls the 'struct GNS_ResolverHandle' of the resolution
+ * @param cls the `struct GNS_ResolverHandle` of the resolution
  * @param tc task context
  */
 static void
@@ -2059,58 +1701,28 @@ recursive_resolution (void *cls,
 
 
 /**
- * Lookup of a record in a specific zone calls lookup result processor
- * on result.
+ * Begin the resolution process from 'name', starting with
+ * the identification of the zone specified by 'name'.
  *
- * @param zone the zone to perform the lookup in
- * @param record_type the record type to look up
- * @param name the name to look up
- * @param shorten_key a private key for use with PSEU import (can be NULL)
- * @param only_cached GNUNET_NO to only check locally not DHT for performance
- * @param proc the processor to call on result
- * @param proc_cls the closure to pass to @a proc
- * @return handle to cancel operation
+ * @param rh resolution to perform
  */
-struct GNS_ResolverHandle *
-GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
-                    uint32_t record_type,
-                    const char *name,
-                    const struct GNUNET_CRYPTO_EccPrivateKey *shorten_key,
-                    int only_cached,
-                    GNS_ResultProcessor proc, void *proc_cls)
+static void
+start_resolver_lookup (struct GNS_ResolverHandle *rh)
 {
-  struct GNS_ResolverHandle *rh;
   struct AuthorityChain *ac;
   char *x;
   char *y;
   char *pkey;
 
-  rh = GNUNET_new (struct GNS_ResolverHandle);
-  GNUNET_CONTAINER_DLL_insert (rlh_head,
-                              rlh_tail,
-                              rh);
-  rh->authority_zone = *zone;
-  rh->proc = proc;
-  rh->proc_cls = proc_cls;
-  rh->only_cached = only_cached;
-  rh->record_type = record_type;
-  rh->name = GNUNET_strdup (name);
-  rh->name_resolution_pos = strlen (name);
-  if (NULL != shorten_key)
-  {
-    rh->shorten_key = GNUNET_new (struct GNUNET_CRYPTO_EccPrivateKey);
-    *rh->shorten_key = *shorten_key;
-  }
-
-  if ( ( (GNUNET_YES == is_canonical (name)) &&
-        (0 != strcmp (GNUNET_GNS_TLD, name)) ) ||
-       ( (GNUNET_YES != is_gnu_tld (name)) &&
-        (GNUNET_YES != is_zkey_tld (name)) ) )
+  if ( ( (GNUNET_YES == is_canonical (rh->name)) &&
+        (0 != strcmp (GNUNET_GNS_TLD, rh->name)) ) ||
+       ( (GNUNET_YES != is_gnu_tld (rh->name)) &&
+        (GNUNET_YES != is_zkey_tld (rh->name)) ) )
   {
     /* use standard DNS lookup */
     int af;
 
-    switch (record_type)
+    switch (rh->record_type)
     {
     case GNUNET_DNSPARSER_TYPE_A:
       af = AF_INET;
@@ -2122,14 +1734,14 @@ GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
       af = AF_UNSPEC;
       break;
     }
-    rh->std_resolve = GNUNET_RESOLVER_ip_get (name, 
+    rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name, 
                                              af,
                                              DNS_LOOKUP_TIMEOUT,
                                              &handle_dns_result,
                                              rh);
-    return rh;
+    return;
   }
-  if (is_zkey_tld (name))
+  if (is_zkey_tld (rh->name))
   {
     /* Name ends with ".zkey", try to replace authority zone with zkey
        authority */
@@ -2148,7 +1760,7 @@ GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
     {
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _("Hostname `%s' is not well-formed, resolution fails\n"),
-                 name);
+                 rh->name);
       rh->task_id = GNUNET_SCHEDULER_add_now (&fail_resolution, rh);
     }
     GNUNET_free_non_null (x);
@@ -2173,6 +1785,49 @@ GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
                                    ac);
   rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
                                          rh);
+}
+
+
+/**
+ * Lookup of a record in a specific zone calls lookup result processor
+ * on result.
+ *
+ * @param zone the zone to perform the lookup in
+ * @param record_type the record type to look up
+ * @param name the name to look up
+ * @param shorten_key a private key for use with PSEU import (can be NULL)
+ * @param only_cached #GNUNET_NO to only check locally not DHT for performance
+ * @param proc the processor to call on result
+ * @param proc_cls the closure to pass to @a proc
+ * @return handle to cancel operation
+ */
+struct GNS_ResolverHandle *
+GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
+                    uint32_t record_type,
+                    const char *name,
+                    const struct GNUNET_CRYPTO_EccPrivateKey *shorten_key,
+                    int only_cached,
+                    GNS_ResultProcessor proc, void *proc_cls)
+{
+  struct GNS_ResolverHandle *rh;
+
+  rh = GNUNET_new (struct GNS_ResolverHandle);
+  GNUNET_CONTAINER_DLL_insert (rlh_head,
+                              rlh_tail,
+                              rh);
+  rh->authority_zone = *zone;
+  rh->proc = proc;
+  rh->proc_cls = proc_cls;
+  rh->only_cached = only_cached;
+  rh->record_type = record_type;
+  rh->name = GNUNET_strdup (name);
+  rh->name_resolution_pos = strlen (name);
+  if (NULL != shorten_key)
+  {
+    rh->shorten_key = GNUNET_new (struct GNUNET_CRYPTO_EccPrivateKey);
+    *rh->shorten_key = *shorten_key;
+  }
+  start_resolver_lookup (rh);
   return rh;
 }
 
@@ -2303,22 +1958,21 @@ GNS_resolver_done ()
     rh->proc (rh->proc_cls, 0, NULL);
     GNS_resolver_lookup_cancel (rh);    
   }
-  /* abort active shorten operations */
-  while (NULL != gph_head)
-    free_get_pseu_authority_handle (gph_head);
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
   dht_lookup_heap = NULL;
   GNUNET_DNSSTUB_stop (dns_handle);
   dns_handle = NULL;
   GNUNET_VPN_disconnect (vpn_handle);
   vpn_handle = NULL;
+  dht_handle = NULL;
+  namestore_handle = NULL;
 }
 
 
 /* *************** common helper functions (do not really belong here) *********** */
 
 /**
- * Checks if "name" ends in ".tld"
+ * Checks if @a name ends in ".TLD"
  *
  * @param name the name to check
  * @param tld the TLD to check for