-fixing zkey resolution
[oweals/gnunet.git] / src / gns / gnunet-service-gns_resolver.c
index 708742bb63cb60de89863703833b813c7d42cb37..c881b6b83cbee2ba9c930d41e65913d305b7d3b1 100644 (file)
  * TODO:
  * - GNS: handle special SRV names --- no delegation, direct lookup;
  *        can likely be done in 'resolver_lookup_get_next_label'. (#3003)
- * - revocation checks (use CORE-level broadcasts!), (#3004)
+ * - revocation checks (use REVOCATION service!), (#3004)
  * - DNAME support (#3005)
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
 #include "gnunet_dnsstub_lib.h"
 #include "gnunet_dht_service.h"
+#include "gnunet_gnsrecord_lib.h"
+#include "gnunet_namecache_service.h"
 #include "gnunet_namestore_service.h"
 #include "gnunet_dns_service.h"
 #include "gnunet_resolver_service.h"
+#include "gnunet_revocation_service.h"
 #include "gnunet_dnsparser_lib.h"
 #include "gnunet_gns_service.h"
 #include "gns.h"
@@ -112,7 +115,7 @@ struct AuthorityChain
     /**
      * The zone of the GNS authority
      */
-    struct GNUNET_CRYPTO_EccPublicSignKey gns_authority;
+    struct GNUNET_CRYPTO_EcdsaPublicKey gns_authority;
 
     struct
     {
@@ -165,7 +168,7 @@ struct DnsResult
   uint64_t expiration_time;
 
   /**
-   * Number of bytes in 'data'.
+   * Number of bytes in @e data.
    */
   size_t data_size;
 
@@ -194,7 +197,7 @@ struct VpnContext
   struct GNUNET_VPN_RedirectionRequest *vpn_request;
 
   /**
-   * Number of records serialized in 'rd_data'.
+   * Number of records serialized in @e rd_data.
    */
   unsigned int rd_count;
 
@@ -204,7 +207,7 @@ struct VpnContext
   char *rd_data;
 
   /**
-   * Number of bytes in 'rd_data'.
+   * Number of bytes in @e rd_data.
    */
   size_t rd_data_size;
 };
@@ -230,7 +233,7 @@ struct GNS_ResolverHandle
   /**
    * The top-level GNS authoritative zone to query
    */
-  struct GNUNET_CRYPTO_EccPublicSignKey authority_zone;
+  struct GNUNET_CRYPTO_EcdsaPublicKey authority_zone;
 
   /**
    * called when resolution phase finishes
@@ -263,9 +266,14 @@ struct GNS_ResolverHandle
   struct GNUNET_RESOLVER_RequestHandle *std_resolve;
 
   /**
-   * Pending Namestore lookup task
+   * Pending Namecache lookup task
    */
-  struct GNUNET_NAMESTORE_QueueEntry *namestore_qe;
+  struct GNUNET_NAMECACHE_QueueEntry *namecache_qe;
+
+  /**
+   * Pending revocation check.
+   */
+  struct GNUNET_REVOCATION_Query *rev_check;
 
   /**
    * Heap node associated with this lookup.  Used to limit number of
@@ -286,7 +294,7 @@ struct GNS_ResolverHandle
   /**
    * Private key of the shorten zone, NULL to not shorten.
    */
-  struct GNUNET_CRYPTO_EccPrivateKey *shorten_key;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey *shorten_key;
 
   /**
    * ID of a task associated with the resolution process.
@@ -352,15 +360,15 @@ struct CacheOps
   /**
    * Pending Namestore caching task.
    */
-  struct GNUNET_NAMESTORE_QueueEntry *namestore_qe_cache;
+  struct GNUNET_NAMECACHE_QueueEntry *namecache_qe_cache;
 
 };
 
 
 /**
- * Our handle to the namestore service
+ * Our handle to the namecache service
  */
-static struct GNUNET_NAMESTORE_Handle *namestore_handle;
+static struct GNUNET_NAMECACHE_Handle *namecache_handle;
 
 /**
  * Our handle to the vpn service
@@ -482,7 +490,7 @@ is_canonical (const char *name)
 /* ************************** Resolution **************************** */
 
 /**
- * Exands a name ending in .+ with the zone of origin.
+ * Expands a name ending in .+ with the zone of origin.
  *
  * @param rh resolution context
  * @param name name to modify (to be free'd or returned)
@@ -503,7 +511,7 @@ translate_dot_plus (struct GNS_ResolverHandle *rh,
                   "%.*s.%s",
                   (int) (s_len - 2),
                   name,
-                  GNUNET_NAMESTORE_pkey_to_zkey (&rh->ac_tail->authority_info.gns_authority));
+                  GNUNET_GNSRECORD_pkey_to_zkey (&rh->ac_tail->authority_info.gns_authority));
   GNUNET_free (name);
   return ret;
 }
@@ -597,7 +605,7 @@ transmit_lookup_dns_result (struct GNS_ResolverHandle *rh)
   for (pos = rh->dns_result_head; NULL != pos; pos = pos->next)
     n++;
   {
-    struct GNUNET_NAMESTORE_RecordData rd[n];
+    struct GNUNET_GNSRECORD_Data rd[n];
 
     i = 0;
     for (pos = rh->dns_result_head; NULL != pos; pos = pos->next)
@@ -607,12 +615,12 @@ transmit_lookup_dns_result (struct GNS_ResolverHandle *rh)
       rd[i].record_type = pos->record_type;
       if (0 == pos->expiration_time)
       {
-       rd[i].flags = GNUNET_NAMESTORE_RF_RELATIVE_EXPIRATION;
+       rd[i].flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
        rd[i].expiration_time = 0;
       }
       else
       {
-       rd[i].flags = GNUNET_NAMESTORE_RF_NONE;
+       rd[i].flags = GNUNET_GNSRECORD_RF_NONE;
        rd[i].expiration_time = pos->expiration_time;
       }
       i++;
@@ -663,7 +671,7 @@ add_dns_result (struct GNS_ResolverHandle *rh,
  * We had to do a DNS lookup.  Convert the result (if any) and return
  * it.
  *
- * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param cls closure with the `struct GNS_ResolverHandle`
  * @param addr one of the addresses of the host, NULL for the last address
  * @param addrlen length of the address
  */
@@ -784,7 +792,7 @@ dns_result_parser (void *cls,
   /* convert from (parsed) DNS to (binary) GNS format! */
   rd_count = p->num_answers + p->num_authority_records + p->num_additional_records;
   {
-    struct GNUNET_NAMESTORE_RecordData rd[rd_count];
+    struct GNUNET_GNSRECORD_Data rd[rd_count];
     unsigned int skip;
     char buf[UINT16_MAX];
     size_t buf_off;
@@ -853,7 +861,7 @@ dns_result_parser (void *cls,
          continue;
        }
        rd[i - skip].data_size = buf_off - buf_start;
-       rd[i - skip].data = &buf[buf_start];    
+       rd[i - skip].data = &buf[buf_start];
        break;
       case GNUNET_DNSPARSER_TYPE_SOA:
        buf_start = buf_off;
@@ -868,7 +876,7 @@ dns_result_parser (void *cls,
          continue;
        }
        rd[i - skip].data_size = buf_off - buf_start;
-       rd[i - skip].data = &buf[buf_start];    
+       rd[i - skip].data = &buf[buf_start];
        break;
       case GNUNET_DNSPARSER_TYPE_MX:
        buf_start = buf_off;
@@ -883,7 +891,7 @@ dns_result_parser (void *cls,
          continue;
        }
        rd[i - skip].data_size = buf_off - buf_start;
-       rd[i - skip].data = &buf[buf_start];    
+       rd[i - skip].data = &buf[buf_start];
        break;
       case GNUNET_DNSPARSER_TYPE_SRV:
        buf_start = buf_off;
@@ -898,7 +906,7 @@ dns_result_parser (void *cls,
          continue;
        }
        rd[i - skip].data_size = buf_off - buf_start;
-       rd[i - skip].data = &buf[buf_start];    
+       rd[i - skip].data = &buf[buf_start];
        break;
       default:
        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
@@ -908,6 +916,10 @@ dns_result_parser (void *cls,
        continue;
       }
     }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Returning DNS response for `%s' with %u answers\n",
+                rh->ac_tail->label,
+                (unsigned int) p->num_answers);
     rh->proc (rh->proc_cls, rd_count - skip, rd);
     GNS_resolver_lookup_cancel (rh);
   }
@@ -1063,7 +1075,7 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
 static void
 handle_gns_resolution_result (void *cls,
                              unsigned int rd_count,
-                             const struct GNUNET_NAMESTORE_RecordData *rd);
+                             const struct GNUNET_GNSRECORD_Data *rd);
 
 
 /**
@@ -1087,19 +1099,19 @@ vpn_allocation_cb (void *cls,
 {
   struct VpnContext *vpn_ctx = cls;
   struct GNS_ResolverHandle *rh = vpn_ctx->rh;
-  struct GNUNET_NAMESTORE_RecordData rd[vpn_ctx->rd_count];
+  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
   unsigned int i;
 
   vpn_ctx->vpn_request = NULL;
   rh->vpn_ctx = NULL;
   GNUNET_assert (GNUNET_OK ==
-                GNUNET_NAMESTORE_records_deserialize (vpn_ctx->rd_data_size,
+                GNUNET_GNSRECORD_records_deserialize (vpn_ctx->rd_data_size,
                                                       vpn_ctx->rd_data,
                                                       vpn_ctx->rd_count,
                                                       rd));
   for (i=0;i<vpn_ctx->rd_count;i++)
   {
-    if (GNUNET_NAMESTORE_TYPE_VPN == rd[i].record_type)
+    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
     {
       switch (af)
       {
@@ -1142,7 +1154,7 @@ vpn_allocation_cb (void *cls,
 static void
 handle_gns_resolution_result (void *cls,
                              unsigned int rd_count,
-                             const struct GNUNET_NAMESTORE_RecordData *rd)
+                             const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNS_ResolverHandle *rh = cls;
   struct AuthorityChain *ac;
@@ -1162,13 +1174,13 @@ handle_gns_resolution_result (void *cls,
   size_t scratch_off;
   size_t scratch_start;
   size_t off;
-  struct GNUNET_NAMESTORE_RecordData rd_new[rd_count];
+  struct GNUNET_GNSRECORD_Data rd_new[rd_count];
   unsigned int rd_off;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Resolution succeeded for `%s' in zone %s, got %u records\n",
              rh->ac_tail->label,
-             GNUNET_NAMESTORE_z2s (&rh->ac_tail->authority_info.gns_authority),
+             GNUNET_GNSRECORD_z2s (&rh->ac_tail->authority_info.gns_authority),
              rd_count);
   if (0 == rh->name_resolution_pos)
   {
@@ -1187,7 +1199,8 @@ handle_gns_resolution_result (void *cls,
        GNUNET_break_op (0);
        rh->proc (rh->proc_cls, 0, NULL);
        GNS_resolver_lookup_cancel (rh);
-       return;                 
+        GNUNET_free_non_null (cname);
+       return;
       }
       handle_gns_cname_result (rh,
                               cname);
@@ -1203,7 +1216,7 @@ handle_gns_resolution_result (void *cls,
       {
        switch (rd[i].record_type)
        {
-       case GNUNET_NAMESTORE_TYPE_VPN:
+       case GNUNET_GNSRECORD_TYPE_VPN:
          {
            af = (GNUNET_DNSPARSER_TYPE_A == rh->record_type) ? AF_INET : AF_INET6;
            if (sizeof (struct GNUNET_TUN_GnsVpnRecord) <
@@ -1229,10 +1242,10 @@ handle_gns_resolution_result (void *cls,
            vpn_ctx = GNUNET_new (struct VpnContext);
            rh->vpn_ctx = vpn_ctx;
            vpn_ctx->rh = rh;
-           vpn_ctx->rd_data_size = GNUNET_NAMESTORE_records_get_size (rd_count,
+           vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                                       rd);
            vpn_ctx->rd_data = GNUNET_malloc (vpn_ctx->rd_data_size);
-           (void) GNUNET_NAMESTORE_records_serialize (rd_count,
+           (void) GNUNET_GNSRECORD_records_serialize (rd_count,
                                                       rd,
                                                       vpn_ctx->rd_data_size,
                                                       vpn_ctx->rd_data);
@@ -1246,9 +1259,11 @@ handle_gns_resolution_result (void *cls,
                                                                rh);
            return;
          }
-       case GNUNET_NAMESTORE_TYPE_GNS2DNS:
+       case GNUNET_GNSRECORD_TYPE_GNS2DNS:
          {
            /* delegation to DNS */
+            GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                        "Found GNS2DNS record, delegating to DNS!\n");
            goto do_recurse;
          }
        default:
@@ -1285,6 +1300,7 @@ handle_gns_resolution_result (void *cls,
          else
          {
            cname = translate_dot_plus (rh, cname);
+            GNUNET_break (NULL != cname);
            scratch_start = scratch_off;
            if (GNUNET_OK !=
                GNUNET_DNSPARSER_builder_add_name (scratch,
@@ -1301,7 +1317,7 @@ handle_gns_resolution_result (void *cls,
              rd_off++;
            }
          }
-         GNUNET_free_non_null (cname); 
+         GNUNET_free_non_null (cname);
        }
        break;
       case GNUNET_DNSPARSER_TYPE_SOA:
@@ -1338,7 +1354,7 @@ handle_gns_resolution_result (void *cls,
            }
          }
          if (NULL != soa)
-           GNUNET_DNSPARSER_free_soa (soa);    
+           GNUNET_DNSPARSER_free_soa (soa);
        }
        break;
       case GNUNET_DNSPARSER_TYPE_MX:
@@ -1374,8 +1390,8 @@ handle_gns_resolution_result (void *cls,
            }
          }
          if (NULL != mx)
-           GNUNET_DNSPARSER_free_mx (mx);      
-       }       
+           GNUNET_DNSPARSER_free_mx (mx);
+       }
        break;
       case GNUNET_DNSPARSER_TYPE_SRV:
        {
@@ -1414,27 +1430,54 @@ handle_gns_resolution_result (void *cls,
            }
          }
          if (NULL != srv)
-           GNUNET_DNSPARSER_free_srv (srv);    
+           GNUNET_DNSPARSER_free_srv (srv);
        }
        break;
-      case GNUNET_NAMESTORE_TYPE_PKEY:
-       /* tigger shortening */
-       if (NULL != rh->shorten_key)
-       {
-         struct GNUNET_CRYPTO_EccPublicSignKey pub;
-       
-         if (rd[i].data_size != sizeof (struct GNUNET_CRYPTO_EccPublicSignKey))
+      case GNUNET_GNSRECORD_TYPE_PKEY:
+        {
+         struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+
+         if (rd[i].data_size != sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey))
          {
            GNUNET_break_op (0);
            break;
          }
          memcpy (&pub, rd[i].data, rd[i].data_size);
-         GNS_shorten_start (rh->ac_tail->label,
-                            &pub,
-                            rh->shorten_key);
-       }
-       rd_off++;
+
+          /* tigger shortening */
+          if (NULL != rh->shorten_key)
+          {
+            GNS_shorten_start (rh->ac_tail->label,
+                               &pub,
+                               rh->shorten_key);
+          }
+          rd_off++;
+          if (GNUNET_GNSRECORD_TYPE_PKEY != rh->record_type)
+          {
+            /* try to resolve "+" */
+            struct AuthorityChain *ac;
+
+            ac = GNUNET_new (struct AuthorityChain);
+            ac->rh = rh;
+            ac->gns_authority = GNUNET_YES;
+            ac->authority_info.gns_authority = pub;
+            ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+            GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                              rh->ac_tail,
+                                              ac);
+            rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                                    rh);
+            return;
+          }
+        }
        break;
+      case GNUNET_GNSRECORD_TYPE_GNS2DNS:
+        {
+          /* delegation to DNS */
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "Found GNS2DNS record, delegating to DNS!\n");
+          goto do_recurse;
+        }
       default:
        rd_off++;
        break;
@@ -1442,6 +1485,10 @@ handle_gns_resolution_result (void *cls,
     }
 
     /* yes, we are done, return result */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Returning GNS response for `%s' with %u answers\n",
+                rh->ac_tail->label,
+                rd_off);
     rh->proc (rh->proc_cls, rd_off, rd_new);
     GNS_resolver_lookup_cancel (rh);
     return;
@@ -1452,9 +1499,9 @@ handle_gns_resolution_result (void *cls,
   {
     switch (rd[i].record_type)
     {
-    case GNUNET_NAMESTORE_TYPE_PKEY:
+    case GNUNET_GNSRECORD_TYPE_PKEY:
       /* delegation to another zone */
-      if (sizeof (struct GNUNET_CRYPTO_EccPublicSignKey) !=
+      if (sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) !=
          rd[i].data_size)
       {
        GNUNET_break_op (0);
@@ -1468,7 +1515,7 @@ handle_gns_resolution_result (void *cls,
       ac->gns_authority = GNUNET_YES;
       memcpy (&ac->authority_info.gns_authority,
              rd[i].data,
-             sizeof (struct GNUNET_CRYPTO_EccPublicSignKey));
+             sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
       ac->label = resolver_lookup_get_next_label (rh);
       /* tigger shortening */
       if (NULL != rh->shorten_key)
@@ -1483,7 +1530,7 @@ handle_gns_resolution_result (void *cls,
       rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
                                              rh);
       return;
-    case GNUNET_NAMESTORE_TYPE_GNS2DNS:
+    case GNUNET_GNSRECORD_TYPE_GNS2DNS:
       {
        char *ns;
        /* resolution continues within DNS */
@@ -1571,6 +1618,8 @@ handle_gns_resolution_result (void *cls,
          GNUNET_break_op (0); /* record not well-formed */
          rh->proc (rh->proc_cls, 0, NULL);
          GNS_resolver_lookup_cancel (rh);
+         GNUNET_free_non_null (ns);
+         GNUNET_free (ac);
          return;
        }
        strcpy (ac->authority_info.dns_authority.name,
@@ -1608,7 +1657,7 @@ handle_gns_resolution_result (void *cls,
     case GNUNET_DNSPARSER_TYPE_CNAME:
       {
        char *cname;
-       
+
        off = 0;
        cname = GNUNET_DNSPARSER_parse_name (rd[i].data,
                                             rd[i].data_size,
@@ -1649,13 +1698,13 @@ handle_gns_resolution_result (void *cls,
  * @param emsg error message
  */
 static void
-namestore_cache_continuation (void *cls,
+namecache_cache_continuation (void *cls,
                              int32_t success,
                              const char *emsg)
 {
   struct CacheOps *co = cls;
 
-  co->namestore_qe_cache = NULL;
+  co->namecache_qe_cache = NULL;
   if (NULL != emsg)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _("Failed to cache GNS resolution: %s\n"),
@@ -1697,7 +1746,7 @@ handle_dht_response (void *cls,
 {
   struct GNS_ResolverHandle *rh = cls;
   struct AuthorityChain *ac = rh->ac_tail;
-  const struct GNUNET_NAMESTORE_Block *block;
+  const struct GNUNET_GNSRECORD_Block *block;
   struct CacheOps *co;
 
   GNUNET_DHT_get_stop (rh->get_handle);
@@ -1706,7 +1755,7 @@ handle_dht_response (void *cls,
   rh->dht_heap_node = NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Handling response from the DHT\n");
-  if (size < sizeof (struct GNUNET_NAMESTORE_Block))
+  if (size < sizeof (struct GNUNET_GNSRECORD_Block))
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
@@ -1717,8 +1766,8 @@ handle_dht_response (void *cls,
   block = data;
   if (size !=
       ntohl (block->purpose.size) +
-      sizeof (struct GNUNET_CRYPTO_EccPublicSignKey) +
-      sizeof (struct GNUNET_CRYPTO_EccSignature))
+      sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey) +
+      sizeof (struct GNUNET_CRYPTO_EcdsaSignature))
   {
     /* how did this pass DHT block validation!? */
     GNUNET_break (0);
@@ -1727,7 +1776,7 @@ handle_dht_response (void *cls,
     return;
   }
   if (GNUNET_OK !=
-      GNUNET_NAMESTORE_block_decrypt (block,
+      GNUNET_GNSRECORD_block_decrypt (block,
                                      &ac->authority_info.gns_authority,
                                      ac->label,
                                      &handle_gns_resolution_result,
@@ -1738,13 +1787,19 @@ handle_dht_response (void *cls,
     GNS_resolver_lookup_cancel (rh);
     return;
   }
+  if (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (block->expiration_time)).rel_value_us)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Received expired block from the DHT, will not cache it.\n");
+    return;
+  }
   /* Cache well-formed blocks */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Caching response from the DHT in namestore\n");
   co = GNUNET_new (struct CacheOps);
-  co->namestore_qe_cache = GNUNET_NAMESTORE_block_cache (namestore_handle,
+  co->namecache_qe_cache = GNUNET_NAMECACHE_block_cache (namecache_handle,
                                                         block,
-                                                        &namestore_cache_continuation,
+                                                        &namecache_cache_continuation,
                                                         co);
   GNUNET_CONTAINER_DLL_insert (co_head,
                               co_tail,
@@ -1760,20 +1815,20 @@ handle_dht_response (void *cls,
  */
 static void
 handle_namestore_block_response (void *cls,
-                                const struct GNUNET_NAMESTORE_Block *block)
+                                const struct GNUNET_GNSRECORD_Block *block)
 {
   struct GNS_ResolverHandle *rh = cls;
   struct GNS_ResolverHandle *rx;
   struct AuthorityChain *ac = rh->ac_tail;
   const char *label = ac->label;
-  const struct GNUNET_CRYPTO_EccPublicSignKey *auth = &ac->authority_info.gns_authority;
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *auth = &ac->authority_info.gns_authority;
   struct GNUNET_HashCode query;
 
-  GNUNET_NAMESTORE_query_from_public_key (auth,
+  GNUNET_GNSRECORD_query_from_public_key (auth,
                                          label,
                                          &query);
-  GNUNET_assert (NULL != rh->namestore_qe);
-  rh->namestore_qe = NULL;
+  GNUNET_assert (NULL != rh->namecache_qe);
+  rh->namecache_qe = NULL;
   if ( (GNUNET_NO == rh->only_cached) &&
        ( (NULL == block) ||
         (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (block->expiration_time)).rel_value_us) ) )
@@ -1782,7 +1837,7 @@ handle_namestore_block_response (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Starting DHT lookup for `%s' in zone %s\n",
                ac->label,
-               GNUNET_NAMESTORE_z2s (&ac->authority_info.gns_authority));
+               GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
     GNUNET_assert (NULL == rh->get_handle);
     rh->get_handle = GNUNET_DHT_get_start (dht_handle,
                                           GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
@@ -1811,15 +1866,13 @@ handle_namestore_block_response (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Resolution failed for `%s' in zone %s (DHT lookup not permitted by configuration)\n",
                ac->label,
-               GNUNET_NAMESTORE_z2s (&ac->authority_info.gns_authority));
+               GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
     rh->proc (rh->proc_cls, 0, NULL);
     GNS_resolver_lookup_cancel (rh);
     return;
   }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Decrypting block from the namestore\n");
   if (GNUNET_OK !=
-      GNUNET_NAMESTORE_block_decrypt (block,
+      GNUNET_GNSRECORD_block_decrypt (block,
                                      auth,
                                      label,
                                      &handle_gns_resolution_result,
@@ -1847,15 +1900,63 @@ recursive_gns_resolution_namestore (struct GNS_ResolverHandle *rh)
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Starting GNS resolution for `%s' in zone %s\n",
              ac->label,
-             GNUNET_NAMESTORE_z2s (&ac->authority_info.gns_authority));
-  GNUNET_NAMESTORE_query_from_public_key (&ac->authority_info.gns_authority,
+             GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
+  GNUNET_GNSRECORD_query_from_public_key (&ac->authority_info.gns_authority,
                                          ac->label,
                                          &query);
-  rh->namestore_qe = GNUNET_NAMESTORE_lookup_block (namestore_handle,
+  rh->namecache_qe = GNUNET_NAMECACHE_lookup_block (namecache_handle,
                                                    &query,
                                                    &handle_namestore_block_response,
                                                    rh);
-  GNUNET_assert (NULL != rh->namestore_qe);
+  GNUNET_assert (NULL != rh->namecache_qe);
+}
+
+
+/**
+ * Function called with the result from a revocation check.
+ *
+ * @param cls the `struct GNS_ResovlerHandle`
+ * @param is_valid #GNUNET_YES if the zone was not yet revoked
+ */
+static void
+handle_revocation_result (void *cls,
+                          int is_valid)
+{
+  struct GNS_ResolverHandle *rh = cls;
+  struct AuthorityChain *ac = rh->ac_tail;
+
+  rh->rev_check = NULL;
+  if (GNUNET_YES != is_valid)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Zone %s was revoked, resolution fails\n"),
+                GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
+  }
+  recursive_gns_resolution_namestore (rh);
+}
+
+
+/**
+ * Perform revocation check on tail of our authority chain.
+ *
+ * @param rh query we are processing
+ */
+static void
+recursive_gns_resolution_revocation (struct GNS_ResolverHandle *rh)
+{
+  struct AuthorityChain *ac = rh->ac_tail;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+             "Starting revocation check for zone %s\n",
+             GNUNET_GNSRECORD_z2s (&ac->authority_info.gns_authority));
+  rh->rev_check = GNUNET_REVOCATION_query (cfg,
+                                           &ac->authority_info.gns_authority,
+                                           &handle_revocation_result,
+                                           rh);
+  GNUNET_assert (NULL != rh->rev_check);
 }
 
 
@@ -1882,7 +1983,7 @@ recursive_resolution (void *cls,
     return;
   }
   if (GNUNET_YES == rh->ac_tail->gns_authority)
-    recursive_gns_resolution_namestore (rh);
+    recursive_gns_resolution_revocation (rh);
   else
     recursive_dns_resolution (rh);
 }
@@ -1898,9 +1999,7 @@ static void
 start_resolver_lookup (struct GNS_ResolverHandle *rh)
 {
   struct AuthorityChain *ac;
-  char *x;
   char *y;
-  char *pkey;
 
   if ( ( (GNUNET_YES == is_canonical (rh->name)) &&
         (0 != strcmp (GNUNET_GNS_TLD, rh->name)) ) ||
@@ -1937,26 +2036,19 @@ start_resolver_lookup (struct GNS_ResolverHandle *rh)
     /* Name ends with ".zkey", try to replace authority zone with zkey
        authority */
     GNUNET_free (resolver_lookup_get_next_label (rh)); /* will return "zkey" */
-    x = resolver_lookup_get_next_label (rh); /* will return 'x' coordinate */
     y = resolver_lookup_get_next_label (rh); /* will return 'y' coordinate */
-    GNUNET_asprintf (&pkey,
-                    "%s%s",
-                    x, y);
-    if ( (NULL == x) ||
-        (NULL == y) ||
+    if ( (NULL == y) ||
         (GNUNET_OK !=
-         GNUNET_CRYPTO_ecc_public_sign_key_from_string (pkey,
-                                                   strlen (pkey),
-                                                   &rh->authority_zone)) )
+         GNUNET_CRYPTO_ecdsa_public_key_from_string (y,
+                                                      strlen (y),
+                                                      &rh->authority_zone)) )
     {
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _("Hostname `%s' is not well-formed, resolution fails\n"),
                  rh->name);
       rh->task_id = GNUNET_SCHEDULER_add_now (&fail_resolution, rh);
     }
-    GNUNET_free_non_null (x);
     GNUNET_free_non_null (y);
-    GNUNET_free (pkey);
   }
   else
   {
@@ -1993,10 +2085,10 @@ start_resolver_lookup (struct GNS_ResolverHandle *rh)
  * @return handle to cancel operation
  */
 struct GNS_ResolverHandle *
-GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicSignKey *zone,
+GNS_resolver_lookup (const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
                     uint32_t record_type,
                     const char *name,
-                    const struct GNUNET_CRYPTO_EccPrivateKey *shorten_key,
+                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *shorten_key,
                     int only_cached,
                     GNS_ResultProcessor proc, void *proc_cls)
 {
@@ -2020,7 +2112,7 @@ GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicSignKey *zone,
   rh->name_resolution_pos = strlen (name);
   if (NULL != shorten_key)
   {
-    rh->shorten_key = GNUNET_new (struct GNUNET_CRYPTO_EccPrivateKey);
+    rh->shorten_key = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
     *rh->shorten_key = *shorten_key;
   }
   start_resolver_lookup (rh);
@@ -2077,10 +2169,15 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
     GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
     rh->dns_request = NULL;
   }
-  if (NULL != rh->namestore_qe)
+  if (NULL != rh->namecache_qe)
+  {
+    GNUNET_NAMECACHE_cancel (rh->namecache_qe);
+    rh->namecache_qe = NULL;
+  }
+  if (NULL != rh->rev_check)
   {
-    GNUNET_NAMESTORE_cancel (rh->namestore_qe);
-    rh->namestore_qe = NULL;
+    GNUNET_REVOCATION_query_cancel (rh->rev_check);
+    rh->rev_check = NULL;
   }
   if (NULL != rh->std_resolve)
   {
@@ -2108,13 +2205,13 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
 /**
  * Initialize the resolver
  *
- * @param nh the namestore handle
+ * @param nc the namecache handle
  * @param dht the dht handle
  * @param c configuration handle
  * @param max_bg_queries maximum number of parallel background queries in dht
  */
 void
-GNS_resolver_init (struct GNUNET_NAMESTORE_Handle *nh,
+GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
                   struct GNUNET_DHT_Handle *dht,
                   const struct GNUNET_CONFIGURATION_Handle *c,
                   unsigned long long max_bg_queries)
@@ -2122,7 +2219,7 @@ GNS_resolver_init (struct GNUNET_NAMESTORE_Handle *nh,
   char *dns_ip;
 
   cfg = c;
-  namestore_handle = nh;
+  namecache_handle = nc;
   dht_handle = dht;
   dht_lookup_heap =
     GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
@@ -2162,7 +2259,7 @@ GNS_resolver_done ()
     GNUNET_CONTAINER_DLL_remove (co_head,
                                 co_tail,
                                 co);
-    GNUNET_NAMESTORE_cancel (co->namestore_qe_cache);
+    GNUNET_NAMECACHE_cancel (co->namecache_qe_cache);
     GNUNET_free (co);
   }
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
@@ -2172,7 +2269,7 @@ GNS_resolver_done ()
   GNUNET_VPN_disconnect (vpn_handle);
   vpn_handle = NULL;
   dht_handle = NULL;
-  namestore_handle = NULL;
+  namecache_handle = NULL;
 }