-fixing #2985
[oweals/gnunet.git] / src / gns / gnunet-service-gns_resolver.c
index fb334c1a0d24f44ddd364da61f09068c2b76acbe..d357a13125a90ae5de5e2033d689f232f011d61d 100644 (file)
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     (C) 2009, 2010, 2011, 2012, 2013 Christian Grothoff (and other contributing authors)
+     (C) 2011-2013 Christian Grothoff (and other contributing authors)
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
  * @brief GNUnet GNS resolver logic
  * @author Martin Schanzenbach
  * @author Christian Grothoff
+ *
+ * TODO:
+ * - recurive GNS resulution
+ * - recursive DNS resolution
+ * - shortening triggers
+ * - revocation checks (privacy!?)
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
 #include "gnunet_transport_service.h"
-#include "gnunet_dns_service.h"
+#include "gnunet_dnsstub_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_namestore_service.h"
 #include "gnunet_dns_service.h"
 #include "gnunet_resolver_service.h"
 #include "gnunet_dnsparser_lib.h"
-#include "gns_protocol.h"
 #include "gnunet_gns_service.h"
-#include "gns_common.h"
 #include "gns.h"
 #include "gnunet-service-gns_resolver.h"
-#ifndef WINDOWS
 #include "gnunet_vpn_service.h"
-#endif
-
-
-#define DHT_OPERATION_TIMEOUT  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 60)
-
-#define GNUNET_GNS_DEFAULT_LOOKUP_TIMEOUT \
-  GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
-
-#define DHT_LOOKUP_TIMEOUT DHT_OPERATION_TIMEOUT
 
-#define DHT_GNS_REPLICATION_LEVEL 5
-
-#define GNUNET_GNS_MAX_PARALLEL_LOOKUPS 500
-
-#define GNUNET_GNS_MAX_NS_TASKS 500
 
+/**
+ * Default DHT timeout for lookups.
+ */
+#define DHT_LOOKUP_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 60)
 
 /**
- * Default DHT timeout
+ * Default timeout for DNS lookups.
  */
-#define DHT_LOOKUP_TIMEOUT DHT_OPERATION_TIMEOUT
+#define DNS_LOOKUP_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
 /**
  * DHT replication level
  */
 #define DHT_GNS_REPLICATION_LEVEL 5
 
+/**
+ * How deep do we allow recursions to go before we abort?
+ */
+#define MAX_RECURSION 256
 
-/*
- * DLL to hold the authority chain
- * we had to pass in the resolution process
+
+/**
+ * DLL to hold the authority chain we had to pass in the resolution
+ * process.
  */
 struct AuthorityChain
 {
+  /**
+   * This is a DLL.
+   */
   struct AuthorityChain *prev;
 
-  struct AuthorityChain *next;
-  
   /**
-   * the zone hash of the authority 
+   * This is a DLL.
    */
-  struct GNUNET_CRYPTO_ShortHashCode zone;
+  struct AuthorityChain *next;
 
   /**
-   * (local) name of the authority 
+   * Resolver handle this entry in the chain belongs to.
    */
-  char name[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
+  struct GNS_ResolverHandle *rh;
 
   /**
-   * was the ns entry fresh 
+   * label/name corresponding to the authority 
    */
-  int fresh;
-};
+  char *label;
+  
+  /**
+   * #GNUNET_YES if the authority was a GNS authority,
+   * #GNUNET_NO if the authority was a DNS authority.
+   */
+  int gns_authority;
 
+  /**
+   * Information about the resolver authority for this label.
+   */
+  union
+  {
 
-/**
- * handle to a resolution process 
- */
-struct ResolverHandle;
+    /**
+     * The zone of the GNS authority 
    */
+    struct GNUNET_CRYPTO_EccPublicKey gns_authority;
 
+    struct
+    {
+      /**
+       * Domain of the DNS resolver that is the authority.
+       * (appended to construct the DNS name to resolve;
+       * this is NOT the DNS name of the DNS server!).
+       */
+      char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
 
-/**
- * processor for a record lookup result
- *
- * @param cls the closure
- * @param rd_count number of results
- * @param rd result data
- */
-typedef void (*RecordLookupProcessor) (void *cls,
-                                      uint32_t rd_count,
-                                      const struct GNUNET_NAMESTORE_RecordData *rd);
+      /**
+       * IP address of the DNS resolver that is authoritative.
+       * (this implementation currently only supports one
+       * IP at a time).
+       */
+      struct sockaddr_storage dns_ip;
 
+    } dns_authority;
 
-/**
- * processor for a resolution result
- *
- * @param cls the closure
- * @param rh the resolution handle
- * @param rd_count number of results
- * @param rd result data (array of 'rd_count' records)
- */
-typedef void (*ResolutionResultProcessor) (void *cls,
-                                          struct ResolverHandle *rh,
-                                          uint32_t rd_count,
-                                          const struct GNUNET_NAMESTORE_RecordData *rd);
+  } authority_info;
+  
+};
 
 
 /**
@@ -175,218 +180,170 @@ enum ResolutionStatus
 
 
 /**
- * Handle to a currenty pending resolution
- * a ResolverHandle is passed to, for example
- * resolve_record_ns to resolve a record in the namestore.
- * On result (positive or negative) the ResolutionResultProcessor
- * is called.
- * If a timeout is set timeout_cont will be called.
- * If no timeout is set (ie timeout forever) then background resolutions
- * might be triggered.
+ * A result we got from DNS.
  */
-struct GNS_ResolverHandle
+struct DnsResult
 {
 
   /**
-   * DLL 
-   */
-  struct ResolverHandle *next;
-
-  /**
-   * DLL 
-   */
-  struct ResolverHandle *prev;
-
-  /**
-   * Last record data found 
-   */
-  struct GNUNET_NAMESTORE_RecordData rd;
-
-  /**
-   * Number of last record data found 
-   */
-  unsigned int rd_count;
-
-  /**
-   * The name to resolve 
+   * Kept in DLL.
    */
-  char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
+  struct DnsResult *next;
 
   /**
-   * has this query been answered? how many matches 
+   * Kept in DLL.
    */
-  int answered;
+  struct DnsResult *prev;
 
   /**
-   * Use only cache 
+   * Binary value stored in the DNS record (appended to this struct)
    */
-  int only_cached;
+  const void *data;
 
   /**
-   * the authoritative zone to query 
+   * Expiration time for the DNS record, 0 if we didn't
+   * get anything useful (i.e. 'gethostbyname' was used).
    */
-  struct GNUNET_CRYPTO_ShortHashCode authority;
+  uint64_t expiration_time;
 
   /**
-   * the name of the authoritative zone to query 
+   * Number of bytes in 'data'.
    */
-  char authority_name[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
+  size_t data_size;
 
   /**
-   * a handle for dht lookups. should be NULL if no lookups are in progress 
+   * Type of the GNS/DNS record.
    */
-  struct GNUNET_DHT_GetHandle *get_handle;
+  uint32_t record_type;
 
-  /**
-   * timeout set for this lookup task 
-   */
-  struct GNUNET_TIME_Relative timeout;
+};
 
-  /**
-   * a handle to a vpn request 
-   */
-  struct GNUNET_VPN_RedirectionRequest *vpn_handle;
 
-  /**
-   * a socket for a dns request 
-   */
-  struct GNUNET_NETWORK_Handle *dns_sock;
+/**
+ * Handle to a currenty pending resolution.  On result (positive or
+ * negative) the #GNS_ResultProcessor is called.  
+ */
+struct GNS_ResolverHandle
+{
 
   /**
-   * a synthesized dns name 
+   * DLL 
    */
-  char dns_name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
+  struct GNS_ResolverHandle *next;
 
   /**
-   * the authoritative dns zone 
+   * DLL 
    */
-  char dns_zone[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
+  struct GNS_ResolverHandle *prev;
 
   /**
-   * the address of the DNS server FIXME not needed? 
+   * The top-level GNS authoritative zone to query 
    */
-  struct sockaddr_in dns_addr;
+  struct GNUNET_CRYPTO_EccPublicKey authority_zone;
 
   /**
-   * handle to the local stub resolver request
+   * called when resolution phase finishes 
    */
-  struct GNUNET_RESOLVER_RequestHandle *dns_resolver_handle;
-
+  GNS_ResultProcessor proc;
+  
   /**
-   * select task for DNS 
+   * closure passed to proc 
    */
-  GNUNET_SCHEDULER_TaskIdentifier dns_read_task;
+  void* proc_cls;
 
   /**
-   * pointer to raw dns query payload FIXME needs to be freed/NULL 
+   * Handle for DHT lookups. should be NULL if no lookups are in progress 
    */
-  char *dns_raw_packet;
+  struct GNUNET_DHT_GetHandle *get_handle;
 
   /**
-   * size of the raw dns query 
+   * Handle to a VPN request, NULL if none is active.
    */
-  size_t dns_raw_packet_size;
+  struct GNUNET_VPN_RedirectionRequest *vpn_handle;
 
   /**
-   * timeout task for the lookup 
+   * Socket for a DNS request, NULL if none is active.
    */
-  GNUNET_SCHEDULER_TaskIdentifier timeout_task;
+  struct GNUNET_DNSSTUB_RequestSocket *dns_request;
 
   /**
-   * continuation to call on timeout 
+   * Handle for standard DNS resolution, NULL if none is active.
    */
-  GNUNET_SCHEDULER_Task timeout_cont;
+  struct GNUNET_RESOLVER_RequestHandle *std_resolve;
 
   /**
-   * closure for timeout cont 
+   * Pending Namestore task
    */
-  void* timeout_cont_cls;
+  struct GNUNET_NAMESTORE_QueueEntry *namestore_qe;
 
   /**
-   * called when resolution phase finishes 
-   */
-  ResolutionResultProcessor proc;
-  
-  /**
-   * closure passed to proc 
+   * Heap node associated with this lookup.  Used to limit number of
+   * concurrent requests.
    */
-  void* proc_cls;
+  struct GNUNET_CONTAINER_HeapNode *dht_heap_node;
 
   /**
    * DLL to store the authority chain 
    */
-  struct AuthorityChain *authority_chain_head;
+  struct AuthorityChain *ac_head;
 
   /**
    * DLL to store the authority chain 
    */
-  struct AuthorityChain *authority_chain_tail;
-
-  /**
-   * status of the resolution result 
-   */
-  enum ResolutionStatus status;
+  struct AuthorityChain *ac_tail;
 
   /**
-   * The provate local zone of this request 
+   * Private key of the shorten zone, NULL to not shorten.
    */
-  struct GNUNET_CRYPTO_ShortHashCode private_local_zone;
+  struct GNUNET_CRYPTO_EccPrivateKey *shorten_key;
 
   /**
-   * private key of an/our authoritative zone
-   * can be NULL but automatical PKEY import will not work
+   * ID of a task associated with the resolution process.
    */
-  struct GNUNET_CRYPTO_EccPrivateKey *priv_key;
+  GNUNET_SCHEDULER_TaskIdentifier task_id;
 
   /**
-   * the heap node associated with this lookup, null if timeout is set
-   * used for DHT background lookups.
+   * The name to resolve 
    */
-  struct GNUNET_CONTAINER_HeapNode *dht_heap_node;
+  char *name;
 
   /**
-   * Id for resolution process
+   * DLL of results we got from DNS.
    */
-  unsigned long long id;
+  struct DnsResult *dns_result_head;
 
   /**
-   * Pending Namestore task
+   * DLL of results we got from DNS.
    */
-  struct GNUNET_NAMESTORE_QueueEntry *namestore_task;
-
-};
-
+  struct DnsResult *dns_result_tail;
 
-/**
- * Handle to a record lookup
- */
-struct RecordLookupHandle
-{
   /**
-   * the record type to look up 
+   * Current offset in 'name' where we are resolving.
    */
-  int record_type;
+  size_t name_resolution_pos;
 
   /**
-   * the name to look up 
+   * Use only cache 
    */
-  char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
+  int only_cached;
 
   /**
-   * Method to call on record resolution result 
+   * Desired type for the resolution.
    */
-  RecordLookupProcessor proc;
+  int record_type;
 
   /**
-   * closure to pass to proc 
+   * We increment the loop limiter for each step in a recursive
+   * resolution.  If it passes our threshold (i.e. due to 
+   * self-recursion in the resolution, i.e CNAME fun), we stop.
    */
-  void* proc_cls;
+  unsigned int loop_limiter;
 
 };
 
 
 /**
- * Handle to a pseu lookup
+ * Handle for a PSEU lookup used to shorten names.
  */
 struct GetPseuAuthorityHandle
 {
@@ -401,61 +358,41 @@ struct GetPseuAuthorityHandle
   struct GetPseuAuthorityHandle *prev;
 
   /**
-   * the name to store the zone under 
+   * Private key of the (shorten) zone to store the resulting
+   * pseudonym in.
    */
-  char name[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
+  struct GNUNET_CRYPTO_EccPrivateKey shorten_zone_key;
 
   /**
-   * test name to store the zone under 
+   * Original label (used if no PSEU record is found).
    */
-  char test_name[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
-  
-  /**
-   * the zone of our authority 
-   */
-  struct GNUNET_CRYPTO_ShortHashCode our_zone;
-
-  /**
-   * the private key of the zone to store the pseu in 
-   */
-  struct GNUNET_CRYPTO_EccPrivateKey *key;
+  char label[GNUNET_DNSPARSER_MAX_LABEL_LENGTH + 1];
 
   /**
-   * a handle for dht lookups. should be NULL if no lookups are in progress 
+   * Label we are currently trying out (during #perform_pseu_lookup).
    */
-  struct GNUNET_DHT_GetHandle *get_handle;
+  char *current_label;
 
   /**
-   * timeout task for lookup 
+   * The zone for which we are trying to find the PSEU record.
    */
-  GNUNET_SCHEDULER_TaskIdentifier timeout;
+  struct GNUNET_CRYPTO_EccPublicKey target_zone;
 
   /**
-   * Authority to shorten 
+   * Handle for DHT lookups. Should be NULL if no lookups are in progress 
    */
-  struct AuthorityChain *auth;
+  struct GNUNET_DHT_GetHandle *get_handle;
 
   /**
-   * handle to namestore request 
+   * Handle to namestore request 
    */
-  struct GNUNET_NAMESTORE_QueueEntry* namestore_task;
-};
-
+  struct GNUNET_NAMESTORE_QueueEntry *namestore_task;
 
-/**
- * Namestore queue entries in background
- */
-struct NamestoreBGTask
-{
   /**
-   * node in heap 
+   * Task to abort DHT lookup operation.
    */
-  struct GNUNET_CONTAINER_HeapNode *node;
+  GNUNET_SCHEDULER_TaskIdentifier timeout_task;
 
-  /**
-   * queue entry 
-   */
-  struct GNUNET_NAMESTORE_QueueEntry *qe;
 };
 
 
@@ -475,51 +412,45 @@ static struct GNUNET_VPN_Handle *vpn_handle;
 static struct GNUNET_DHT_Handle *dht_handle;
 
 /**
- * Heap for parallel DHT lookups
+ * Handle to perform DNS lookups.
  */
-static struct GNUNET_CONTAINER_Heap *dht_lookup_heap;
+static struct GNUNET_DNSSTUB_Context *dns_handle;
 
 /**
- * Heap for namestore queues
+ * Heap for limiting parallel DHT lookups
  */
-static struct GNUNET_CONTAINER_Heap *ns_task_heap;
+static struct GNUNET_CONTAINER_Heap *dht_lookup_heap;
 
 /**
- * Maximum amount of parallel queries in background
+ * Maximum amount of parallel queries to the DHT
  */
 static unsigned long long max_allowed_background_queries;
 
 /**
- * Maximum amount of parallel namestore tasks in background
+ * Head of PSEU/shorten operations list.
  */
-static unsigned long long max_allowed_ns_tasks;
+struct GetPseuAuthorityHandle *gph_head;
 
 /**
- * Whether or not to ignore pending records
+ * Tail of PSEU/shorten operations list.
  */
-static int ignore_pending_records;
+struct GetPseuAuthorityHandle *gph_tail;
 
 /**
- * Resolver lookup list
+ * Head of resolver lookup list
  */
-static struct ResolverHandle *rlh_head;
+static struct GNS_ResolverHandle *rlh_head;
 
 /**
- * Resolver lookup list
+ * Tail of resolver lookup list
  */
-static struct ResolverHandle *rlh_tail;
+static struct GNS_ResolverHandle *rlh_tail;
 
 /**
  * Global configuration.
  */
 static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
-/**
- * a resolution identifier pool variable
- * This is a non critical identifier useful for debugging
- */
-static unsigned long long rid_gen;
-
 
 /**
  * Check if name is in srv format (_x._y.xxx)
@@ -558,7 +489,7 @@ is_srv (const char *name)
  * even though they consist of multiple labels.
  *
  * Examples:
- * a.b.gads  = not canonical
+ * a.b.gnu  = not canonical
  * a         = canonical
  * _foo._srv = canonical
  * _f.bar    = not canonical
@@ -586,24 +517,37 @@ is_canonical (const char *name)
 }
 
 
-static void
-free_get_pseu_authority_handle (struct GetPseuAuthorityHandle *gph)
-{
-  gph->namestore_task = NULL;
-  GNUNET_free (gph->auth);
-  GNUNET_CRYPTO_ecc_key_free (gph->key);
-  GNUNET_CONTAINER_DLL_remove (gph_head, gph_tail, gph);
-  GNUNET_free (gph);
-}
+/* ******************** Shortening logic ************************ */
 
 
 /**
- * Callback that shortens authorities
+ * Cleanup a 'struct GetPseuAuthorityHandle', terminating all
+ * pending activities.
  *
- * @param gph the handle containing the name to shorten
+ * @param gph handle to terminate
  */
 static void
-shorten_authority_chain (struct GetPseuAuthorityHandle *gph);
+free_get_pseu_authority_handle (struct GetPseuAuthorityHandle *gph)
+{
+  if (NULL != gph->get_handle)
+  {
+    GNUNET_DHT_get_stop (gph->get_handle);
+    gph->get_handle = NULL;
+  }
+  if (NULL != gph->namestore_task)
+  {
+    GNUNET_NAMESTORE_cancel (gph->namestore_task);
+    gph->namestore_task = NULL;
+  }
+  if (GNUNET_SCHEDULER_NO_TASK != gph->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (gph->timeout_task);
+    gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
+  }
+  GNUNET_CONTAINER_DLL_remove (gph_head, gph_tail, gph);
+  GNUNET_free_non_null (gph->current_label);
+  GNUNET_free (gph);
+}
 
 
 /**
@@ -614,653 +558,388 @@ shorten_authority_chain (struct GetPseuAuthorityHandle *gph);
  * @param emsg unused
  */
 static void
-create_pkey_cont (void* cls, int32_t success, const char* emsg)
+create_pkey_cont (void* cls, 
+                 int32_t success, 
+                 const char *emsg)
 {
-  //FIXME do sth with error
   struct GetPseuAuthorityHandle* gph = cls;
 
+  gph->namestore_task = NULL;
   free_get_pseu_authority_handle (gph);
 }
 
 
 /**
  * Namestore calls this function if we have record for this name.
- * (or with rd_count=0 to indicate no matches)
+ * (or with rd_count=0 to indicate no matches).
  *
  * @param cls the pending query
- * @param key the key of the zone we did the lookup
- * @param expiration expiration date of the namestore entry
- * @param name the name for which we need an authority
  * @param rd_count the number of records with 'name'
  * @param rd the record data
- * @param signature the signature of the authority for the record data
  */
 static void
-process_pseu_lookup_ns (void* cls,
-                       const struct GNUNET_CRYPTO_EccPublicKey *key,
-                       struct GNUNET_TIME_Absolute expiration,
-                       const char *name, unsigned int rd_count,
-                       const struct GNUNET_NAMESTORE_RecordData *rd,
-                       const struct GNUNET_CRYPTO_EccSignature *signature)
+process_pseu_lookup_ns (void *cls,
+                       unsigned int rd_count,
+                       const struct GNUNET_NAMESTORE_RecordData *rd);
+
+
+/**
+ * We obtained a result for our query to the shorten zone from
+ * the namestore.  Try to decrypt.
+ *
+ * @param cls the handle to our shorten operation
+ * @param block resulting encrypted block
+ */
+static void
+process_pseu_block_ns (void *cls,
+                      const struct GNUNET_NAMESTORE_Block *block)
 {
-  struct GetPseuAuthorityHandle* gph = cls;
+  struct GetPseuAuthorityHandle *gph = cls;
+  struct GNUNET_CRYPTO_EccPublicKey pub;
+
+  gph->namestore_task = NULL;
+  if (NULL == block)
+  {
+    process_pseu_lookup_ns (gph, 0, NULL);
+    return;
+  }
+  GNUNET_CRYPTO_ecc_key_get_public (&gph->shorten_zone_key,
+                                   &pub);
+  if (GNUNET_OK != 
+      GNUNET_NAMESTORE_block_decrypt (block,
+                                     &pub,
+                                     gph->current_label,
+                                     &process_pseu_lookup_ns,
+                                     gph))
+  {
+    GNUNET_break (0);
+    free_get_pseu_authority_handle (gph);
+    return;
+  }
+}
+
+
+/**
+ * Lookup in the namestore for the shorten zone the given label.
+ *
+ * @param gph the handle to our shorten operation
+ * @param label the label to lookup
+ */
+static void 
+perform_pseu_lookup (struct GetPseuAuthorityHandle *gph,
+                    const char *label)
+{ 
+  struct GNUNET_CRYPTO_EccPublicKey pub;
+  struct GNUNET_HashCode query;
+
+  GNUNET_CRYPTO_ecc_key_get_public (&gph->shorten_zone_key,
+                                   &pub);
+  GNUNET_free_non_null (gph->current_label);
+  gph->current_label = GNUNET_strdup (label);
+  GNUNET_NAMESTORE_query_from_public_key (&pub,
+                                         label,
+                                         &query);
+  gph->namestore_task = GNUNET_NAMESTORE_lookup_block (namestore_handle,
+                                                      &query,
+                                                      &process_pseu_block_ns,
+                                                      gph);
+}
+
+
+/**
+ * Namestore calls this function if we have record for this name.
+ * (or with rd_count=0 to indicate no matches).
+ *
+ * @param cls the pending query
+ * @param rd_count the number of records with 'name'
+ * @param rd the record data
+ */
+static void
+process_pseu_lookup_ns (void *cls,
+                       unsigned int rd_count,
+                       const struct GNUNET_NAMESTORE_RecordData *rd)
+{
+  struct GetPseuAuthorityHandle *gph = cls;
   struct GNUNET_NAMESTORE_RecordData new_pkey;
 
   gph->namestore_task = NULL;
   if (rd_count > 0)
   {
     GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_AUTO_PSEU: Name %s already taken in NS!\n", name);
-    free_get_pseu_authority_handle (gph);
+               "Name `%s' already taken, cannot shorten.\n", 
+              gph->current_label);
+    /* if this was not yet the original label, try one more
+       time, this time not using PSEU but the original label */
+    if (0 == strcmp (gph->current_label,
+                    gph->label))
+    {
+      free_get_pseu_authority_handle (gph);
+    }
+    else
+    {
+      perform_pseu_lookup (gph, gph->label);
+    }
     return;
   }
-
-  /* name is free */
+  /* name is available */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_AUTO_PSEU: Name %s not taken in NS! Adding\n", 
-             gph->test_name);
-
+             "Shortening `%s' to `%s'\n", 
+             GNUNET_NAMESTORE_z2s (&gph->target_zone),
+             gph->current_label);
   new_pkey.expiration_time = UINT64_MAX;
-  new_pkey.data_size = sizeof (struct GNUNET_CRYPTO_ShortHashCode);
-  new_pkey.data = &gph->auth->zone;
+  new_pkey.data_size = sizeof (struct GNUNET_CRYPTO_EccPublicKey);
+  new_pkey.data = &gph->target_zone;
   new_pkey.record_type = GNUNET_NAMESTORE_TYPE_PKEY;
   new_pkey.flags = GNUNET_NAMESTORE_RF_AUTHORITY
                  | GNUNET_NAMESTORE_RF_PRIVATE
                  | GNUNET_NAMESTORE_RF_PENDING;
-  gph->namestore_task = GNUNET_NAMESTORE_record_put_by_authority (namestore_handle,
-                                                                 gph->key,
-                                                                 gph->test_name,
-                                                                 1,
-                                                                 &new_pkey,
-                                                                 &create_pkey_cont, 
-                                                                 gph);
+  gph->namestore_task 
+    = GNUNET_NAMESTORE_records_store (namestore_handle,
+                                     &gph->shorten_zone_key,
+                                     gph->current_label,
+                                     1, &new_pkey,
+                                     &create_pkey_cont, gph);
 }
 
 
 /**
- * process result of a dht pseu lookup
+ * Process result of a DHT lookup for a PSEU record.
  *
- * @param gph the handle
- * @param name the pseu result or NULL
+ * @param gph the handle to our shorten operation
+ * @param pseu the pseu result or NULL
  */
 static void
 process_pseu_result (struct GetPseuAuthorityHandle* gph, 
-                    const char* name)
+                    const char *pseu)
 {
-  if (NULL == name)
+  if (NULL == pseu)
   {
+    /* no PSEU found, try original label */
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "GNS_AUTO_PSEU: No PSEU, no shorten. Finished.\n");
-    free_get_pseu_authority_handle (gph);
+                "No PSEU found, trying original label `%s' instead.\n",
+               gph->label);
+    perform_pseu_lookup (gph, gph->label);
     return;
-  }
-  
-  memcpy (gph->test_name, name, strlen(name) + 1);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_AUTO_PSEU: Checking %s for collision in NS\n",
-              gph->test_name);
-  /**
-   * Check for collision
-   */
-  gph->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
-                                                       &gph->our_zone,
-                                                       gph->test_name,
-                                                       GNUNET_NAMESTORE_TYPE_ANY,
-                                                       &process_pseu_lookup_ns,
-                                                       gph);
+  }  
+  /* check if 'pseu' is taken */
+  perform_pseu_lookup (gph, pseu);
 }
 
 
 /**
- * Start shortening algorithm using auth as
- * authority chain
+ * Handle timeout for DHT request during shortening.
  *
- * @param auth the authorities that were resolved
- * @param key the private key for PKEY import
+ * @param cls the request handle as closure
+ * @param tc the task context
  */
 static void
-start_shorten (struct AuthorityChain *auth,
-               const struct GNUNET_CRYPTO_EccPrivateKey *key)
+handle_auth_discovery_timeout (void *cls,
+                               const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
-  struct GetPseuAuthorityHandle *gph;
-  struct GNUNET_CRYPTO_EccPublicKey pkey;
-  
-  GNUNET_CRYPTO_ecc_key_get_public (key, &pkey);
-  gph = GNUNET_new (struct GetPseuAuthorityHandle);
-  gph->key = GNUNET_new (struct GNUNET_CRYPTO_EccPrivateKey);
-  *gph->key = *key;
-  if (NULL == gph->key)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Failed to decode ECC key on shorten\n");
-    GNUNET_free (gph);
-    return;
-  }
-  GNUNET_CRYPTO_short_hash (&pkey,
-                        sizeof (struct GNUNET_CRYPTO_EccPublicKey),
-                        &gph->our_zone);
-  gph->auth = GNUNET_malloc (sizeof (struct AuthorityChain));
-  memcpy (gph->auth, auth, sizeof (struct AuthorityChain));
-  GNUNET_CONTAINER_DLL_insert (gph_head, gph_tail, gph);
-  shorten_authority_chain (gph);
+  struct GetPseuAuthorityHandle *gph = cls;
+
+  gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "DHT lookup for PSEU query timed out.\n");
+  GNUNET_DHT_get_stop (gph->get_handle);
+  gph->get_handle = NULL;
+  process_pseu_result (gph, NULL);
 }
 
 
 /**
- * Initialize the resolver
+ * Handle decrypted records from DHT result.
  *
- * @param nh the namestore handle
- * @param dh the dht handle
- * @param lz the local zone's hash
- * @param c configuration handle
- * @param max_bg_queries maximum number of parallel background queries in dht
- * @param ignore_pending ignore records that still require user confirmation
- *        on lookup
- * @return GNUNET_OK on success
+ * @param cls closure with our 'struct GetPseuAuthorityHandle'
+ * @param rd_count number of entries in 'rd' array
+ * @param rd array of records with data to store
  */
-int
-GNS_resolver_init (struct GNUNET_NAMESTORE_Handle *nh,
-                  struct GNUNET_DHT_Handle *dh,
-                  const struct GNUNET_CONFIGURATION_Handle *c,
-                  unsigned long long max_bg_queries,
-                  int ignore_pending)
+static void
+process_auth_records (void *cls,
+                     unsigned int rd_count,
+                     const struct GNUNET_NAMESTORE_RecordData *rd)
 {
-  if ( (NULL == nh) ||
-       (NULL == dh) )
-    return GNUNET_SYSERR;
-  
-  cfg = c;
-  namestore_handle = nh;
-  dht_handle = dh;
-  local_zone = lz;
-  dht_lookup_heap =
-    GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  ns_task_heap =
-    GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  max_allowed_background_queries = max_bg_queries;
-  max_allowed_ns_tasks = GNUNET_GNS_MAX_NS_TASKS;
-  ignore_pending_records = ignore_pending; 
-  GNUNET_RESOLVER_connect (cfg);
-  return GNUNET_OK;
+  struct GetPseuAuthorityHandle *gph = cls;
+  unsigned int i;
+
+  for (i=0; i < rd_count; i++)
+  {
+    if (GNUNET_NAMESTORE_TYPE_PSEU == rd[i].record_type)
+    {
+      /* found pseu */
+      process_pseu_result (gph, 
+                          (const char *) rd[i].data);
+      return;
+    }
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "No PSEU record found in DHT reply.\n");
+  process_pseu_result (gph, NULL);
 }
 
 
 /**
- * finish lookup
+ * Function called when we find a PSEU entry in the DHT
  *
- * @param rh resolver handle
- * @param rlh record lookup handle
- * @param rd_count number of results
- * @param rd results
- */
-static void
-finish_lookup (struct ResolverHandle *rh,
-               struct RecordLookupHandle* rlh,
-               unsigned int rd_count,
-               const struct GNUNET_NAMESTORE_RecordData *rd);
-
-
-/**
- * Helper function to free resolver handle
- *
- * @param rh the handle to free
- */
-static void
-free_resolver_handle (struct ResolverHandle* rh)
-{
-  struct AuthorityChain *ac;
-  struct AuthorityChain *ac_next;
-
-  if (NULL == rh)
-    return;
-
-  ac_next = rh->authority_chain_head;
-  while (NULL != (ac = ac_next))
-  {
-    ac_next = ac->next;
-    GNUNET_free (ac);
-  }
-  
-  if (NULL != rh->get_handle)
-    GNUNET_DHT_get_stop (rh->get_handle);
-  if (NULL != rh->dns_raw_packet)
-    GNUNET_free (rh->dns_raw_packet);
-  if (NULL != rh->namestore_task)
-  {
-    GNUNET_NAMESTORE_cancel (rh->namestore_task);
-    rh->namestore_task = NULL;
-  }
-  if (GNUNET_SCHEDULER_NO_TASK != rh->dns_read_task)
-    GNUNET_SCHEDULER_cancel (rh->dns_read_task);
-  if (GNUNET_SCHEDULER_NO_TASK != rh->timeout_task)
-    GNUNET_SCHEDULER_cancel (rh->timeout_task);
-  if (NULL != rh->dns_sock)
-    GNUNET_NETWORK_socket_close (rh->dns_sock);
-  if (NULL != rh->dns_resolver_handle)
-    GNUNET_RESOLVER_request_cancel (rh->dns_resolver_handle);
-  if (NULL != rh->rd.data)
-    GNUNET_free ((void*)(rh->rd.data));
-  if (NULL != rh->dht_heap_node)
-    GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
-  GNUNET_free (rh);
-}
-
-
-/**
- * finish shorten
- *
- * @param rh resolver handle
- * @param nsh name shorten handle
- */
-static void
-finish_shorten (struct ResolverHandle *rh,
-                struct NameShortenHandle *nsh);
-
-
-/**
- * finish get auth
- *
- * @param rh resolver handle
- * @param nah get name authority handle
+ * @param cls the request handle
+ * @param exp lifetime
+ * @param key the key the record was stored under
+ * @param get_path get path
+ * @param get_path_length get path length
+ * @param put_path put path
+ * @param put_path_length put path length
+ * @param type the block type
+ * @param size the size of the record
+ * @param data the record data
  */
 static void
-finish_get_auth (struct ResolverHandle *rh,
-                 struct GetNameAuthorityHandle* rlh);
-
-
-/**
- * Shutdown resolver
- */
-void
-GNS_resolver_done ()
+process_auth_discovery_dht_result (void* cls,
+                                   struct GNUNET_TIME_Absolute exp,
+                                   const struct GNUNET_HashCode *key,
+                                   const struct GNUNET_PeerIdentity *get_path,
+                                   unsigned int get_path_length,
+                                   const struct GNUNET_PeerIdentity *put_path,
+                                   unsigned int put_path_length,
+                                   enum GNUNET_BLOCK_Type type,
+                                   size_t size,
+                                   const void *data)
 {
-  struct GetPseuAuthorityHandle *tmp;
-  struct ResolverHandle *rh;
-  struct NamestoreBGTask *nbg;
+  struct GetPseuAuthorityHandle *gph = cls;
+  const struct GNUNET_NAMESTORE_Block *block;
 
-  while (NULL != (tmp = gph_head))
-  {
-    if (tmp->get_handle != NULL)
-    {
-      GNUNET_DHT_get_stop (tmp->get_handle);
-      tmp->get_handle = NULL;
-    }
-    if (tmp->timeout != GNUNET_SCHEDULER_NO_TASK)
-    {
-      GNUNET_SCHEDULER_cancel (tmp->timeout);
-      tmp->timeout = GNUNET_SCHEDULER_NO_TASK;
-    }
-    if (NULL != tmp->namestore_task)
-    {
-      GNUNET_NAMESTORE_cancel (tmp->namestore_task);
-      tmp->namestore_task = NULL;
-    }
-    free_get_pseu_authority_handle (tmp);
-  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got DHT result for PSEU request\n");
+  GNUNET_DHT_get_stop (gph->get_handle);
+  gph->get_handle = NULL;
+  GNUNET_SCHEDULER_cancel (gph->timeout_task);
+  gph->timeout_task = GNUNET_SCHEDULER_NO_TASK;
 
-  while (NULL != rlh_head)
-  {
-    finish_lookup (rlh_head, rlh_head->proc_cls, 0, NULL);
-  }
-  while (NULL != nsh_head)
+  if (NULL == data)
   {
-    finish_shorten (nsh_head, nsh_head->proc_cls);
+    /* is this allowed!? */
+    GNUNET_break (0);
+    process_pseu_result (gph, NULL);
+    return;
   }
-  while (NULL != nah_head)
+  if (size < sizeof (struct GNUNET_NAMESTORE_Block))
   {
-    finish_get_auth (nah_head, nah_head->proc_cls);
+    /* how did this pass DHT block validation!? */
+    GNUNET_break (0);
+    process_pseu_result (gph, NULL);
+    return;   
   }
-
-  while (NULL != (rh = GNUNET_CONTAINER_heap_remove_root(dht_lookup_heap)))
+  block = data;
+  if (size !=
+      ntohs (block->purpose.size) + 
+      sizeof (struct GNUNET_CRYPTO_EccPublicKey) +
+      sizeof (struct GNUNET_CRYPTO_EccSignature))
   {
-      GNUNET_free (rh);
+    /* how did this pass DHT block validation!? */
+    GNUNET_break (0);
+    process_pseu_result (gph, NULL);
+    return;   
   }
-  GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
-  dht_lookup_heap = NULL;
-
-  while (NULL != (nbg = GNUNET_CONTAINER_heap_remove_root(ns_task_heap)))
+  if (GNUNET_OK !=
+      GNUNET_NAMESTORE_block_decrypt (block,
+                                     &gph->target_zone,
+                                     GNUNET_GNS_TLD_PLUS,
+                                     &process_auth_records,
+                                     gph))
   {
-      GNUNET_NAMESTORE_cancel (nbg->qe);
-      GNUNET_free (nbg);
+    /* other peer encrypted invalid block, complain */
+    GNUNET_break_op (0);
+    process_pseu_result (gph, NULL);
+    return;   
   }
-  GNUNET_CONTAINER_heap_destroy (ns_task_heap);
-  ns_task_heap = NULL;
-
 }
 
 
 /**
- * Callback when record data is put into namestore
+ * Callback called by namestore for a zone to name result.  We're
+ * trying to see if a short name for a given zone already exists.
  *
  * @param cls the closure
- * @param success GNUNET_OK on success
- * @param emsg the error message. NULL if SUCCESS==GNUNET_OK
- */
-void
-on_namestore_record_put_result (void *cls,
-                                int32_t success,
-                                const char *emsg)
-{
-  struct NamestoreBGTask *nbg = cls;
-
-  GNUNET_CONTAINER_heap_remove_node (nbg->node);
-  GNUNET_free (nbg);
-
-  if (GNUNET_NO == success)
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_NS: records already in namestore\n");
-    return;
-  }
-  else if (GNUNET_YES == success)
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_NS: records successfully put in namestore\n");
-    return;
-  }
-
-  GNUNET_log(GNUNET_ERROR_TYPE_ERROR,
-             "GNS_NS: Error putting records into namestore: %s\n", emsg);
-}
-
-
-/**
- * Lookup timeout task
- *
- * @param cls the ResolverHandle for the task that timed out
- * @param tc the task context
- */
-static void
-handle_lookup_timeout (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct ResolverHandle *rh = cls;
-  
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Lookup timeout for request %llu triggered\n",
-             rh->id);
-  if (NULL != rh->timeout_cont)
-    rh->timeout_cont (rh->timeout_cont_cls, tc);
-}
-
-
-/**
- * Processor for background lookups in the DHT
- *
- * @param cls closure (NULL)
- * @param rd_count number of records found (not 0)
- * @param rd record data
- */
-static void
-background_lookup_result_processor (void *cls,
-                                   uint32_t rd_count,
-                                   const struct GNUNET_NAMESTORE_RecordData *rd)
-{
-  //We could do sth verbose/more useful here but it doesn't make any difference
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_BG: background dht lookup finished. (%d results)\n",
-              rd_count);
-}
-
-
-/**
- * Handle timeout for DHT requests
- *
- * @param cls the request handle as closure
- * @param tc the task context
+ * @param zone_key the zone we queried
+ * @param name the name found or NULL
+ * @param rd_len number of records for the name
+ * @param rd the record data (PKEY) for the name
  */
 static void
-dht_lookup_timeout (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
+process_zone_to_name_discover (void *cls,
+                              const struct GNUNET_CRYPTO_EccPrivateKey *zone_key,
+                              const char *name,
+                              unsigned int rd_len,
+                              const struct GNUNET_NAMESTORE_RecordData *rd)
 {
-  struct ResolverHandle *rh = cls;
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  char new_name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_PHASE_REC-%llu: dht lookup for query %s (%s) timed out.\n",
-              rh->id, rh->name, 
-             GNUNET_STRINGS_relative_time_to_string (rh->timeout,
-                                                     GNUNET_YES));
-  /**
-   * Start resolution in bg
-   */
-  GNUNET_snprintf (new_name, GNUNET_DNSPARSER_MAX_NAME_LENGTH, "%s.%s",
-                   rh->name, GNUNET_GNS_TLD);
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_PHASE_REC-%llu: Starting background lookup for %s type %d\n",
-              rh->id, new_name, rlh->record_type);
+  struct GetPseuAuthorityHandle* gph = cls;
+  struct GNUNET_HashCode lookup_key;
   
-  gns_resolver_lookup_record (rh->authority,
-                              rh->private_local_zone,
-                              rlh->record_type,
-                              new_name,
-                              NULL,
-                              GNUNET_TIME_UNIT_FOREVER_REL,
-                              GNUNET_NO,
-                              &background_lookup_result_processor,
-                              NULL);
-                              
-  rh->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-
-  GNUNET_DHT_get_stop (rh->get_handle);
-  rh->get_handle = NULL;
-  rh->proc (rh->proc_cls, rh, 0, NULL);
-}
-
-
-/**
- * Function called when we get a result from the dht
- * for our record query
- *
- * @param cls the request handle
- * @param exp lifetime
- * @param key the key the record was stored under
- * @param get_path get path
- * @param get_path_length get path length
- * @param put_path put path
- * @param put_path_length put path length
- * @param type the block type
- * @param size the size of the record
- * @param data the record data
- */
-static void
-process_record_result_dht (void* cls,
-                           struct GNUNET_TIME_Absolute exp,
-                           const struct GNUNET_HashCode * key,
-                           const struct GNUNET_PeerIdentity *get_path,
-                           unsigned int get_path_length,
-                           const struct GNUNET_PeerIdentity *put_path,
-                           unsigned int put_path_length,
-                           enum GNUNET_BLOCK_Type type,
-                           size_t size, const void *data)
-{
-  struct ResolverHandle *rh = cls;
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  const struct GNSNameRecordBlock *nrb = data;
-  uint32_t num_records;
-  const char* name;
-  const char* rd_data;
-  uint32_t i;
-  size_t rd_size;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_PHASE_REC-%llu: got dht result (size=%d)\n", rh->id, size);
-  /* stop lookup and timeout task */
-  GNUNET_DHT_get_stop (rh->get_handle);
-  rh->get_handle = NULL;
-  if (rh->dht_heap_node != NULL)
-  {
-    GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
-    rh->dht_heap_node = NULL;
-  }
-  if (rh->timeout_task != GNUNET_SCHEDULER_NO_TASK)
-  {
-    GNUNET_SCHEDULER_cancel (rh->timeout_task);
-    rh->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  }
-  rh->get_handle = NULL;
-  name = (const char*) &nrb[1];
-  num_records = ntohl (nrb->rd_count);
+  gph->namestore_task = NULL;
+  if (0 != rd_len)
   {
-    struct GNUNET_NAMESTORE_RecordData rd[num_records];
-    struct NamestoreBGTask *ns_heap_root;
-    struct NamestoreBGTask *namestore_bg_task;
-
-    rd_data = &name[strlen (name) + 1];
-    rd_size = size - strlen (name) - 1 - sizeof (struct GNSNameRecordBlock);
-    if (GNUNET_SYSERR == 
-       GNUNET_NAMESTORE_records_deserialize (rd_size,
-                                             rd_data,
-                                             num_records,
-                                             rd))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "GNS_PHASE_REC-%llu: Error deserializing data!\n", rh->id);
-      rh->proc (rh->proc_cls, rh, 0, NULL);
-      return;
-    }
-    for (i = 0; i < num_records; i++)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Got name: %s (wanted %s)\n",
-                  rh->id, name, rh->name);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Got type: %d (wanted %d)\n",
-                  rh->id, rd[i].record_type, rlh->record_type);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Got data length: %d\n",
-                  rh->id, rd[i].data_size);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Got flag %d\n",
-                  rh->id, rd[i].flags);
-
-      if ((strcmp (name, rh->name) == 0) &&
-          (rd[i].record_type == rlh->record_type))
-        rh->answered++;
-
-    }
-
-    /**
-     * FIXME check pubkey against existing key in namestore?
-     * https://gnunet.org/bugs/view.php?id=2179
-     */
-    if (max_allowed_ns_tasks <=
-        GNUNET_CONTAINER_heap_get_size (ns_task_heap))
-    {
-      ns_heap_root = GNUNET_CONTAINER_heap_remove_root (ns_task_heap);
-      GNUNET_NAMESTORE_cancel (ns_heap_root->qe);
-
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Replacing oldest background ns task\n",
-                  rh->id);
-    }
-    
-    /* Save to namestore */
+    /* we found a match in our own zone */
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "GNS_PHASE_REC-%llu: Caching record for %s\n",
-                rh->id, name);
-    namestore_bg_task = GNUNET_malloc (sizeof (struct NamestoreBGTask));
-    namestore_bg_task->qe = GNUNET_NAMESTORE_record_put (namestore_handle,
-                                 &nrb->public_key,
-                                 name,
-                                 exp,
-                                 num_records,
-                                 rd,
-                                 &nrb->signature,
-                                 &on_namestore_record_put_result, //cont
-                                 namestore_bg_task);
-
-    namestore_bg_task->node = GNUNET_CONTAINER_heap_insert (ns_task_heap,
-                                  namestore_bg_task,
-                                  GNUNET_TIME_absolute_get().abs_value_us);
-    if (0 < rh->answered)
-      rh->proc (rh->proc_cls, rh, num_records, rd);
-    else
-      rh->proc (rh->proc_cls, rh, 0, NULL);
+               "Shortening aborted, name `%s' already reserved for the zone\n",
+               name);
+    free_get_pseu_authority_handle (gph);
+    return;
   }
+  /* record does not yet exist, go into DHT to find PSEU record */
+  GNUNET_NAMESTORE_query_from_public_key (&gph->target_zone,
+                                         GNUNET_GNS_TLD_PLUS,                                    
+                                         &lookup_key);
+  gph->timeout_task = GNUNET_SCHEDULER_add_delayed (DHT_LOOKUP_TIMEOUT,
+                                                   &handle_auth_discovery_timeout, 
+                                                   gph);
+  gph->get_handle = GNUNET_DHT_get_start (dht_handle,
+                                         GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
+                                         &lookup_key,
+                                         DHT_GNS_REPLICATION_LEVEL,
+                                         GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE,
+                                         NULL, 0,
+                                         &process_auth_discovery_dht_result,
+                                         gph);
 }
 
 
 /**
- * Start DHT lookup for a (name -> query->record_type) record in
- * rh->authority's zone
+ * Start shortening algorithm, try to allocate a nice short
+ * canonical name for @a pub in @a shorten_zone, using
+ * @a original_label as one possible suggestion.
  *
- * @param rh the pending gns query context
+ * @param original_label original label for the zone
+ * @param pub public key of the zone to shorten
+ * @param shorten_zone private key of the target zone for the new record
  */
 static void
-resolve_record_dht (struct ResolverHandle *rh)
+start_shorten (const char *original_label,
+              const struct GNUNET_CRYPTO_EccPublicKey *pub,
+               const struct GNUNET_CRYPTO_EccPrivateKey *shorten_zone)
 {
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  uint32_t xquery;
-  struct GNUNET_HashCode lookup_key;
-  struct ResolverHandle *rh_heap_root;
-
-  GNUNET_GNS_get_key_for_record (rh->name, &rh->authority, &lookup_key);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GNS_PHASE_REC-%llu: starting dht lookup for %s with key: %s\n",
-              rh->id, rh->name, GNUNET_h2s (&lookup_key));
-
-  rh->dht_heap_node = NULL;
-
-  if (GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us != rh->timeout.rel_value_us)
-  {
-    /**
-     * Update timeout if necessary
-     */
-    if (GNUNET_SCHEDULER_NO_TASK == rh->timeout_task)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "GNS_PHASE_REC-%llu: Adjusting timeout to %s/2\n", 
-                 rh->id,
-                 GNUNET_STRINGS_relative_time_to_string (rh->timeout, GNUNET_YES));
-      /*
-       * Set timeout for authority lookup phase to 1/2
-       */
-      rh->timeout_task = GNUNET_SCHEDULER_add_delayed (
-                                   GNUNET_TIME_relative_divide (rh->timeout, 2),
-                                   &handle_lookup_timeout,
-                                   rh);
-    }
-    rh->timeout_cont = &dht_lookup_timeout;
-    rh->timeout_cont_cls = rh;
-  }
-  else 
+  struct GetPseuAuthorityHandle *gph;
+  
+  if (strlen (original_label) > GNUNET_DNSPARSER_MAX_LABEL_LENGTH)
   {
-    if (max_allowed_background_queries <=
-        GNUNET_CONTAINER_heap_get_size (dht_lookup_heap))
-    {
-      rh_heap_root = GNUNET_CONTAINER_heap_remove_root (dht_lookup_heap);
-      GNUNET_DHT_get_stop (rh_heap_root->get_handle);
-      rh_heap_root->get_handle = NULL;
-      rh_heap_root->dht_heap_node = NULL;
-
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                 "GNS_PHASE_REC-%llu: Replacing oldest background query for %s\n",
-                 rh->id, rh_heap_root->name);
-      rh_heap_root->proc (rh_heap_root->proc_cls,
-                          rh_heap_root,
-                          0,
-                          NULL);
-    }
-    rh->dht_heap_node = GNUNET_CONTAINER_heap_insert (dht_lookup_heap,
-                                         rh,
-                                         GNUNET_TIME_absolute_get ().abs_value_us);
+    GNUNET_break (0);
+    return;
   }
+  gph = GNUNET_new (struct GetPseuAuthorityHandle);
+  gph->shorten_zone_key = *shorten_zone;
+  gph->target_zone = *pub;
+  strcpy (gph->label, original_label);
+  GNUNET_CONTAINER_DLL_insert (gph_head, gph_tail, gph);
+  /* first, check if we *already* have a record for this zone */
+  gph->namestore_task = GNUNET_NAMESTORE_zone_to_name (namestore_handle,
+                                                       shorten_zone,
+                                                       pub,
+                                                       &process_zone_to_name_discover,
+                                                       gph);
+}
 
-  xquery = htonl (rlh->record_type);
 
-  GNUNET_assert (rh->get_handle == NULL);
-  rh->get_handle = GNUNET_DHT_get_start (dht_handle, 
-                                         GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
-                                         &lookup_key,
-                                         DHT_GNS_REPLICATION_LEVEL,
-                                         GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE,
-                                         &xquery,
-                                         sizeof (xquery),
-                                         &process_record_result_dht,
-                                         rh);
+/* ************************** Resolution **************************** */
 
-}
+#if 0
 
 
 /**
@@ -1369,7 +1048,6 @@ process_record_result_ns (void* cls,
 }
 
 
-#ifndef WINDOWS
 /**
  * VPN redirect result callback
  *
@@ -1435,7 +1113,6 @@ process_record_result_vpn (void* cls, int af, const void *address)
              rh->id);
   rh->proc (rh->proc_cls, rh, 0, NULL);
 }
-#endif
 
 
 /**
@@ -1473,325 +1150,6 @@ handle_record_vpn (void* cls, struct ResolverHandle *rh,
 }
 
 
-/**
- * Sends a UDP dns query to a nameserver specified in the rh
- * 
- * @param rh the resolver handle
- */
-static void
-send_dns_packet (struct ResolverHandle *rh);
-
-
-/**
- * Read DNS response
- *
- * @param cls the ResolverHandle for this lookup
- * @param addr the sockaddr
- * @param addrlen the socket address length
- */
-static void
-handle_dns_resolver (void *cls,
-                     const struct sockaddr *addr,
-                     socklen_t addrlen)
-{
-  struct ResolverHandle *rh = cls;
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  struct GNUNET_NAMESTORE_RecordData rd;
-  struct sockaddr_in *sai;
-  struct sockaddr_in6 *sai6;
-
-  if (NULL == addr)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No address found in DNS!\n");
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-  
-  if (sizeof (struct sockaddr_in) == addrlen)
-  {
-    sai = (struct sockaddr_in*) addr;
-    rd.record_type = GNUNET_DNSPARSER_TYPE_A;
-    rd.data_size = sizeof (struct in_addr);
-    rd.data = &sai->sin_addr;
-  }
-  else if (sizeof (struct sockaddr_in6) == addrlen)
-  {
-    sai6 = (struct sockaddr_in6*) addr;
-    rd.record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-    rd.data_size = sizeof (struct in6_addr);
-    rd.data = &sai6->sin6_addr;
-  }
-  else
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Address length is garbage!\n");
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-  rd.expiration_time = UINT64_MAX; /* FIXME: should probably pick something shorter */
-  rd.flags = 0;
-  finish_lookup (rh, rlh, 1, &rd);
-}
-
-
-/**
- * Resolve DNS name via local stub resolver
- *
- * @param rh the resolver handle
- */
-static void
-resolve_dns_name (struct ResolverHandle *rh)
-{
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  int af;
-
-  if ((GNUNET_DNSPARSER_TYPE_A != rlh->record_type) &&
-      (GNUNET_DNSPARSER_TYPE_AAAA != rlh->record_type))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Can only resolve A/AAAA via stub... abort\n");
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-
-  if (GNUNET_DNSPARSER_TYPE_A == rlh->record_type)
-    af = AF_INET;
-  else
-    af = AF_INET6;
-
-  rh->dns_resolver_handle = GNUNET_RESOLVER_ip_get (rh->dns_name,
-                                                    af,
-                                                    rh->timeout,
-                                                    &handle_dns_resolver,
-                                                    rh);
-}
-
-
-/**
- * Read DNS packet from UDP socket and process the reply.
- *
- * @param cls the resolver handle
- * @param tc task context
- */
-static void
-read_dns_response (void *cls,
-                   const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct ResolverHandle *rh = cls;
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  char buf[UINT16_MAX];
-  ssize_t r;
-  struct sockaddr_in addr;
-  socklen_t addrlen;
-  struct GNUNET_DNSPARSER_Packet *packet;
-  struct GNUNET_NAMESTORE_RecordData rd;
-  int found_delegation = GNUNET_NO;
-  int found_cname = GNUNET_NO;
-  char* delegation_name = NULL;
-  int zone_offset = 0;
-  int i;
-
-  rh->dns_read_task = GNUNET_SCHEDULER_NO_TASK;
-  if (0 == (tc->reason & GNUNET_SCHEDULER_REASON_READ_READY))
-  {
-    /* timeout or shutdown */
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Terminating DNS query %d\n", tc->reason);
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-
-  addrlen = sizeof (addr);
-  r = GNUNET_NETWORK_socket_recvfrom (rh->dns_sock,
-                                      buf, sizeof (buf),
-                                      (struct sockaddr*) &addr,
-                                      &addrlen);
-
-  if (-1 == r)
-  {
-    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "recvfrom");
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-  if (NULL == (packet = GNUNET_DNSPARSER_parse (buf, r)))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Failed to parse DNS reply!\n");
-    finish_lookup (rh, rlh, 0, NULL);
-    return;
-  }
-
-  for (i = 0; i < packet->num_answers; i++)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-               "Got record type %d (want %d)\n",
-               packet->answers[i].type,
-               rlh->record_type);
-    /* http://tools.ietf.org/html/rfc1034#section-3.6.2 */
-    if (GNUNET_DNSPARSER_TYPE_CNAME == packet->answers[i].type)
-    {
-      struct GNUNET_DNSPARSER_Query query;
-      struct GNUNET_DNSPARSER_Packet npacket;
-      struct GNUNET_DNSPARSER_Flags flags;
-
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "CNAME record, restarting query with `%s'\n",
-                  packet->answers[i].data.hostname);
-      strcpy (rh->dns_name, 
-             packet->answers[i].data.hostname);
-      found_cname = GNUNET_YES;
-      query.name = rh->dns_name;
-      query.type = rlh->record_type;
-      query.class = GNUNET_DNSPARSER_CLASS_INTERNET;
-      memset (&flags, 0, sizeof (flags));
-      flags.recursion_desired = 1;
-      flags.checking_disabled = 1;
-      npacket.queries = &query;
-      npacket.answers = NULL;
-      npacket.authority_records = NULL;
-      npacket.additional_records = NULL;
-      npacket.num_queries = 1;
-      npacket.num_answers = 0;
-      npacket.num_authority_records = 0;
-      npacket.num_additional_records = 0;
-      npacket.flags = flags;
-      npacket.id = rh->id;
-      GNUNET_free_non_null (rh->dns_raw_packet);
-      rh->dns_raw_packet = NULL;
-      if (GNUNET_OK != GNUNET_DNSPARSER_pack (&npacket,
-                                             UINT16_MAX,
-                                             &rh->dns_raw_packet,
-                                             &rh->dns_raw_packet_size))
-      {
-       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "GNS_PHASE_REC_DNS-%llu: Creating raw dns packet!\n",
-                   rh->id);
-       GNUNET_NETWORK_socket_close (rh->dns_sock);
-       finish_lookup (rh, rlh, 0, NULL);
-       GNUNET_DNSPARSER_free_packet (packet);
-       return;
-      }
-      continue;
-    }
-    
-    if ((packet->answers[i].type == rlh->record_type) &&
-        (0 == strcmp (packet->answers[i].name, rh->dns_name)))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Found record!\n");
-      rd.data = packet->answers[i].data.raw.data;
-      rd.data_size = packet->answers[i].data.raw.data_len;
-      rd.record_type = packet->answers[i].type;
-      rd.flags = 0;
-      rd.expiration_time = packet->answers[i].expiration_time.abs_value_us;
-      finish_lookup (rh, rlh, 1, &rd);
-      GNUNET_DNSPARSER_free_packet (packet);
-      return;
-    }
-  }
-
-  if (GNUNET_YES == found_cname)
-  {
-    zone_offset = strlen (rh->dns_name) - strlen (rh->dns_zone) - 1;   
-    if (0 > zone_offset)
-      zone_offset = 0;
-
-    /* restart query with CNAME */
-    if (0 == strcmp (rh->dns_name + zone_offset, rh->dns_zone))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Asking DNS server for `%s'\n", 
-                 rh->dns_name);
-      
-      send_dns_packet (rh);
-    }
-    else
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Trying system resolver for `%s'\n", rh->dns_name);
-      resolve_dns_name (rh);
-    }
-
-    GNUNET_DNSPARSER_free_packet (packet);
-    return;
-  }
-
-  for (i = 0; i < packet->num_authority_records; i++)
-  {    
-    if (packet->authority_records[i].type == GNUNET_DNSPARSER_TYPE_NS)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Found NS delegation!\n");
-      found_delegation = GNUNET_YES;
-      delegation_name = packet->authority_records[i].data.hostname;
-      break;
-    }
-  }
-
-  for (i = 0; i < packet->num_additional_records; i++)
-  {
-    if (GNUNET_NO == found_delegation)
-      break;
-
-    if ((packet->additional_records[i].type == GNUNET_DNSPARSER_TYPE_A) &&
-        (0 == strcmp (packet->additional_records[i].name, delegation_name)))
-    {
-      GNUNET_assert (sizeof (struct in_addr) ==
-                     packet->authority_records[i].data.raw.data_len);
-      
-      rh->dns_addr.sin_addr =
-        *((struct in_addr*)packet->authority_records[i].data.raw.data);
-      send_dns_packet (rh);
-      GNUNET_DNSPARSER_free_packet (packet);
-      return;
-    }
-  }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Nothing useful in DNS reply!\n");
-  finish_lookup (rh, rlh, 0, NULL);
-  GNUNET_DNSPARSER_free_packet (packet);
-}
-
-
-/**
- * Sends a UDP dns query to a nameserver specified in the rh
- * 
- * @param rh the request handle
- */
-static void
-send_dns_packet (struct ResolverHandle *rh)
-{
-  struct GNUNET_NETWORK_FDSet *rset;
-
-  rset = GNUNET_NETWORK_fdset_create ();
-  GNUNET_NETWORK_fdset_set (rset, rh->dns_sock);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Sending %d byte DNS query\n",
-              (int) rh->dns_raw_packet_size);
-  
-  if (GNUNET_SYSERR ==
-      GNUNET_NETWORK_socket_sendto (rh->dns_sock,
-                                   rh->dns_raw_packet,
-                                   rh->dns_raw_packet_size,
-                                   (struct sockaddr*)&rh->dns_addr,
-                                   sizeof (struct sockaddr_in)))
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-               _("Failed to send DNS request to %s\n"),
-               GNUNET_a2s ((const struct sockaddr *)&rh->dns_addr, 
-                           sizeof (struct sockaddr_in)));
-
-  rh->dns_read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                                    rh->timeout, //FIXME less?
-                                                    rset,
-                                                    NULL,
-                                                    &read_dns_response,
-                                                    rh);
-  GNUNET_NETWORK_fdset_destroy (rset);
-}
-
-
 /**
  * The final phase of resoution.
  * We found a NS RR and want to resolve via DNS
@@ -1808,7 +1166,7 @@ resolve_record_dns (struct ResolverHandle *rh,
   struct RecordLookupHandle *rlh = rh->proc_cls;
   struct GNUNET_DNSPARSER_Query query;
   struct GNUNET_DNSPARSER_Packet packet;
-  struct GNUNET_DNSPARSER_Flags flags;
+  struct GNUNET_TUN_DnsFlags flags;
   struct in_addr dnsip;
   struct sockaddr_in addr;
   struct sockaddr *sa;
@@ -1882,7 +1240,7 @@ resolve_record_dns (struct ResolverHandle *rh,
   }
   query.name = rh->dns_name;
   query.type = rlh->record_type;
-  query.class = GNUNET_DNSPARSER_CLASS_INTERNET;
+  query.class = GNUNET_TUN_DNS_CLASS_INTERNET;
   memset (&flags, 0, sizeof (flags));
   flags.recursion_desired = 1;
   flags.checking_disabled = 1;
@@ -1933,7 +1291,7 @@ resolve_record_vpn (struct ResolverHandle *rh,
 {
   struct RecordLookupHandle *rlh = rh->proc_cls;
   struct GNUNET_HashCode serv_desc;
-  struct vpn_data* vpn;
+  struct GNUNET_TUN_GnsVpnRecord* vpn;
   int af;
   
   /* We cancel here as to not include the ns lookup in the timeout */
@@ -1953,7 +1311,7 @@ resolve_record_vpn (struct ResolverHandle *rh,
                    rh->priv_key);
   }
 
-  vpn = (struct vpn_data*)rd->data;
+  vpn = (struct GNUNET_TUN_GnsVpnRecord*)rd->data;
   GNUNET_CRYPTO_hash ((char*)&vpn[1],
                       strlen ((char*)&vpn[1]) + 1,
                       &serv_desc);
@@ -2046,108 +1404,6 @@ resolve_record_ns(struct ResolverHandle *rh)
 }
 
 
-/**
- * Handle timeout for DHT requests
- *
- * @param cls the request handle as closure
- * @param tc the task context
- */
-static void
-dht_authority_lookup_timeout (void *cls,
-                              const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct ResolverHandle *rh = cls;
-  struct RecordLookupHandle *rlh = rh->proc_cls;
-  char new_name[GNUNET_DNSPARSER_MAX_NAME_LENGTH];
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_DHT-%llu: dht lookup for query %s (%s) timed out.\n",
-             rh->id, rh->authority_name, 
-             GNUNET_STRINGS_relative_time_to_string (rh->timeout,
-                                                     GNUNET_YES));
-
-  rh->status |= RSL_TIMED_OUT;
-  rh->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  if (NULL != rh->get_handle)
-  {
-    GNUNET_DHT_get_stop (rh->get_handle);
-    rh->get_handle = NULL;
-  }
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_PHASE_DELEGATE_DHT-%llu: Got shutdown\n",
-               rh->id);
-    rh->proc (rh->proc_cls, rh, 0, NULL);
-    return;
-  }
-  if (0 == strcmp (rh->name, ""))
-  {
-    /*
-     * promote authority back to name and try to resolve record
-     */
-    strcpy (rh->name, rh->authority_name);
-    rh->proc (rh->proc_cls, rh, 0, NULL);
-    return;
-  }
-  
-  /**
-   * Start resolution in bg
-   */
-  GNUNET_snprintf (new_name, GNUNET_DNSPARSER_MAX_NAME_LENGTH,
-                  "%s.%s.%s", 
-                  rh->name, rh->authority_name, GNUNET_GNS_TLD);
-  strcpy (rh->name, new_name);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_DHT-%llu: Starting background query for %s type %d\n",
-             rh->id, rh->name,
-             rlh->record_type);
-  gns_resolver_lookup_record (rh->authority,
-                              rh->private_local_zone,
-                              rlh->record_type,
-                              new_name,
-                              NULL,
-                              GNUNET_TIME_UNIT_FOREVER_REL,
-                              GNUNET_NO,
-                              &background_lookup_result_processor,
-                              NULL);
-  rh->proc (rh->proc_cls, rh, 0, NULL);
-}
-
-
-/**
- * Start DHT lookup for a name -> PKEY (compare NS) record in
- * rh->authority's zone
- *
- * @param rh the pending gns query
- */
-static void 
-resolve_delegation_dht (struct ResolverHandle *rh);
-
-
-/**
- * Resolve the delegation chain for the request in our namestore
- *
- * @param rh the resolver handle
- */
-static void 
-resolve_delegation_ns (struct ResolverHandle *rh);
-
-
-/**
- * Namestore resolution for delegation finished. Processing result.
- *
- * @param cls the closure
- * @param rh resolver handle
- * @param rd_count number of results (always 0)
- * @param rd record data (always NULL)
- */
-static void
-handle_delegation_ns (void* cls, struct ResolverHandle *rh,
-                     unsigned int rd_count,
-                     const struct GNUNET_NAMESTORE_RecordData *rd);
-
-
 /**
  * This is a callback function that checks for key revocation
  *
@@ -2199,7 +1455,7 @@ process_pkey_revocation_result_ns (void *cls,
     {
       GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
         "GNS_PHASE_DELEGATE_REV-%llu: Starting background lookup for %s type %d\n",
-        rh->id, "+.gads", GNUNET_NAMESTORE_TYPE_REV);
+        rh->id, "+.gnu", GNUNET_NAMESTORE_TYPE_REV);
 
       gns_resolver_lookup_record(rh->authority,
                                  rh->private_local_zone,
@@ -2226,41 +1482,6 @@ process_pkey_revocation_result_ns (void *cls,
 }
 
 
-/**
- * Callback when record data is put into namestore
- *
- * @param cls the closure
- * @param success GNUNET_OK on success
- * @param emsg the error message. NULL if SUCCESS==GNUNET_OK
- */
-void
-on_namestore_delegation_put_result(void *cls,
-                                   int32_t success,
-                                   const char *emsg)
-{
-  struct NamestoreBGTask *nbg = cls;
-
-  GNUNET_CONTAINER_heap_remove_node (nbg->node);
-  GNUNET_free (nbg);
-
-  if (GNUNET_NO == success)
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_NS: records already in namestore\n");
-    return;
-  }
-  else if (GNUNET_YES == success)
-  {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-               "GNS_NS: records successfully put in namestore\n");
-    return;
-  }
-
-  GNUNET_log(GNUNET_ERROR_TYPE_ERROR,
-             "GNS_NS: Error putting records into namestore: %s\n", emsg);
-}
-
-
 /**
  * Function called when we get a result from the dht
  * for our query. Recursively tries to resolve authorities
@@ -2464,12 +1685,12 @@ process_delegation_result_dht (void* cls,
 
 
     /* Check for key revocation and delegate */
-    rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
-                                    &rh->authority,
-                                    GNUNET_GNS_MASTERZONE_STR,
-                                    GNUNET_NAMESTORE_TYPE_REV,
-                                    &process_pkey_revocation_result_ns,
-                                    rh);
+    rh->namestore_task = GNUNET_NAMESTORE_lookup (namestore_handle,
+                                                 &rh->authority,
+                                                 GNUNET_GNS_MASTERZONE_STR,
+                                                 GNUNET_NAMESTORE_TYPE_REV,
+                                                 &process_pkey_revocation_result_ns,
+                                                 rh);
 
     return;
   }
@@ -2565,10 +1786,10 @@ finish_lookup (struct ResolverHandle *rh,
   char new_mx_data[MAX_MX_LENGTH];
   char new_soa_data[MAX_SOA_LENGTH];
   char new_srv_data[MAX_SRV_LENGTH];
-  struct srv_data *old_srv;
-  struct srv_data *new_srv;
-  struct soa_data *old_soa;
-  struct soa_data *new_soa;
+  struct GNUNET_TUN_DnsSrvRecord *old_srv;
+  struct GNUNET_TUN_DnsSrvRecord *new_srv;
+  struct GNUNET_TUN_DnsSoaRecord *old_soa;
+  struct GNUNET_TUN_DnsSoaRecord *new_soa;
   struct GNUNET_NAMESTORE_RecordData p_rd[rd_count];
   char* repl_string;
   char* pos;
@@ -2630,8 +1851,8 @@ finish_lookup (struct ResolverHandle *rh,
       /*
        * Prio, weight and port
        */
-      new_srv = (struct srv_data*)new_srv_data;
-      old_srv = (struct srv_data*)rd[i].data;
+      new_srv = (struct GNUNET_TUN_DnsSrvRecord*)new_srv_data;
+      old_srv = (struct GNUNET_TUN_DnsSrvRecord*)rd[i].data;
       new_srv->prio = old_srv->prio;
       new_srv->weight = old_srv->weight;
       new_srv->port = old_srv->port;
@@ -2639,14 +1860,14 @@ finish_lookup (struct ResolverHandle *rh,
       expand_plus((char*)&new_srv[1], (char*)&old_srv[1],
                   repl_string);
       p_rd[i].data = new_srv_data;
-      p_rd[i].data_size = sizeof (struct srv_data) + strlen ((char*)&new_srv[1]) + 1;
+      p_rd[i].data_size = sizeof (struct GNUNET_TUN_DnsSrvRecord) + strlen ((char*)&new_srv[1]) + 1;
     }
     else if (GNUNET_DNSPARSER_TYPE_SOA == rd[i].record_type)
     {
       /* expand mname and rname */
-      old_soa = (struct soa_data*)rd[i].data;
-      new_soa = (struct soa_data*)new_soa_data;
-      memcpy (new_soa, old_soa, sizeof (struct soa_data));
+      old_soa = (struct GNUNET_TUN_DnsSoaRecord*)rd[i].data;
+      new_soa = (struct GNUNET_TUN_DnsSoaRecord*)new_soa_data;
+      memcpy (new_soa, old_soa, sizeof (struct GNUNET_TUN_DnsSoaRecord));
       // FIXME: how do we know that 'new_soa[1]' has enough space for the new name?
       expand_plus((char*)&new_soa[1], (char*)&old_soa[1], repl_string);
       offset = strlen ((char*)&new_soa[1]) + 1;
@@ -2654,7 +1875,7 @@ finish_lookup (struct ResolverHandle *rh,
       expand_plus((char*)&new_soa[1] + offset,
                   (char*)&old_soa[1] + strlen ((char*)&old_soa[1]) + 1,
                   repl_string);
-      p_rd[i].data_size = sizeof (struct soa_data)
+      p_rd[i].data_size = sizeof (struct GNUNET_TUN_DnsSoaRecord)
                           + offset
                           + strlen ((char*)&new_soa[1] + offset);
       p_rd[i].data = new_soa_data;
@@ -2940,27 +2161,6 @@ resolve_delegation_dht (struct ResolverHandle *rh)
 }
 
 
-/**
- * Checks if "name" ends in ".tld"
- *
- * @param name the name to check
- * @param tld the TLD to check for
- * @return GNUNET_YES or GNUNET_NO
- */
-int
-is_tld (const char* name, const char* tld)
-{
-  size_t offset = 0;
-
-  if (strlen (name) <= strlen (tld))
-    return GNUNET_NO;
-  offset = strlen (name) - strlen (tld);
-  if (0 != strcmp (name + offset, tld))
-    return GNUNET_NO;
-  return GNUNET_YES;
-}
-
-
 /**
  * Namestore resolution for delegation finished. Processing result.
  *
@@ -3359,12 +2559,12 @@ process_delegation_result_ns (void* cls,
       memcpy ((void*)rh->rd.data, rd[i].data, rd[i].data_size);
       rh->rd_count = 1;
       /* Check for key revocation and delegate */
-      rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
-                                                          &rh->authority,
-                                                          GNUNET_GNS_MASTERZONE_STR,
-                                                          GNUNET_NAMESTORE_TYPE_REV,
-                                                          &process_pkey_revocation_result_ns,
-                                                          rh);
+      rh->namestore_task = GNUNET_NAMESTORE_lookup (namestore_handle,
+                                                   &rh->authority,
+                                                   GNUNET_GNS_MASTERZONE_STR,
+                                                   GNUNET_NAMESTORE_TYPE_REV,
+                                                   &process_pkey_revocation_result_ns,
+                                                   rh);
       return;
     default:
       /* ignore, move to next result */
@@ -3409,199 +2609,820 @@ process_delegation_result_ns (void* cls,
 }
 
 
+#endif
+
+///////////////////////////////////////////////////////////////////////////////////////////////////
+///////////////////////////////////////////////////////////////////////////////////////////////////
+///////////////////////////////////////////////////////////////////////////////////////////////////
+///////////////////////////////////////////////////////////////////////////////////////////////////
+///////////////////////////////////////////////////////////////////////////////////////////////////
+
+
 /**
- * Resolve the delegation chain for the request in our namestore
- * (as in, find the respective authority for the leftmost label).
+ * Task scheduled to asynchronously fail a resolution.
  *
- * @param rh the resolver handle
+ * @param cls the 'struct GNS_ResolverHandle' of the resolution to fail
+ * @param tc task context
  */
 static void
-resolve_delegation_ns (struct ResolverHandle *rh)
+fail_resolution (void *cls,
+                const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
-  pop_tld (rh->name, rh->authority_name);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "GNS_PHASE_DELEGATE_NS-%llu: Finding authority for `%s' by looking up `%s' in GADS zone `%s'\n",
-             rh->id,         
-             rh->name,
-             rh->authority_name,
-             GNUNET_short_h2s (&rh->authority));
-  rh->namestore_task = GNUNET_NAMESTORE_lookup_record (namestore_handle,
-                                                      &rh->authority,
-                                                      rh->authority_name,
-                                                      GNUNET_DNSPARSER_TYPE_ANY,
-                                                      &process_delegation_result_ns,
-                                                      rh);
+  struct GNS_ResolverHandle *rh = cls;
+
+  rh->task_id = GNUNET_SCHEDULER_NO_TASK;
+  rh->proc (rh->proc_cls, 0, NULL);
+  GNS_resolver_lookup_cancel (rh);
 }
 
 
 /**
- * Lookup of a record in a specific zone
- * calls lookup result processor on result
+ * Get the next, rightmost label from the name that we are trying to resolve,
+ * and update the resolution position accordingly.
  *
- * @param zone the root zone
- * @param record_type the record type to look up
- * @param name the name to look up
- * @param shorten_key a private key for use with PSEU import (can be NULL)
- * @param only_cached GNUNET_NO to only check locally not DHT for performance
- * @param proc the processor to call on result
- * @param proc_cls the closure to pass to @a proc
+ * @param rh handle to the resolution operation to get the next label from
+ * @return NULL if there are no more labels
  */
-void
-GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey * zone,
-                    uint32_t record_type,
-                    const char* name,
-                    struct GNUNET_CRYPTO_EccPrivateKey *shorten_key,
-                    int only_cached,
-                    RecordLookupProcessor proc,
-                    void *proc_cls)
+static char *
+resolver_lookup_get_next_label (struct GNS_ResolverHandle *rh)
 {
-  struct ResolverHandle *rh;
-  struct RecordLookupHandle* rlh;
-  char string_hash[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
-  char nzkey[GNUNET_DNSPARSER_MAX_LABEL_LENGTH];
-  char* nzkey_ptr = nzkey;
+  const char *rp;
+  const char *dot;
+  size_t len;
 
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Starting resolution for `%s' (type=%d) with timeout %s!\n",
-              name, record_type,
-             GNUNET_STRINGS_relative_time_to_string (timeout, GNUNET_YES));
+  if (0 == rh->name_resolution_pos)
+    return NULL;
+  dot = memrchr (rh->name, (int) '.', rh->name_resolution_pos);
+  if (NULL == dot)
+  {
+    /* done, this was the last one */
+    len = rh->name_resolution_pos;
+    rp = rh->name;
+    rh->name_resolution_pos = 0; 
+  }
+  else
+  {
+    /* advance by one label */
+    len = rh->name_resolution_pos - (dot - rh->name) - 1;
+    rp = dot + 1;
+    rh->name_resolution_pos = dot - rh->name;
+  }  
+  return GNUNET_strndup (rp, len);  
+}
+
+
+/**
+ * Gives the cummulative result obtained to the callback and clean up the request.
+ *
+ * @param rh resolution process that has culminated in a result
+ */
+static void
+transmit_lookup_dns_result (struct GNS_ResolverHandle *rh)
+{
+  struct DnsResult *pos;
+  unsigned int n;
+  unsigned int i;
 
-  if ((is_canonical ((char*)name) == GNUNET_YES) &&
-      (strcmp(GNUNET_GNS_TLD, name) != 0))
+  n = 0;
+  for (pos = rh->dns_result_head; NULL != pos; pos = pos->next)
+    n++;
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "%s is canonical and not gnunet -> cannot resolve!\n", name);
-    proc(cls, 0, NULL);
+    struct GNUNET_NAMESTORE_RecordData rd[n];
+
+    i = 0;
+    for (pos = rh->dns_result_head; NULL != pos; pos = pos->next)
+    {
+      rd[i].data = pos->data;
+      rd[i].data_size = pos->data_size;
+      rd[i].record_type = pos->record_type;
+      if (0 == pos->expiration_time)
+      {
+       rd[i].flags = GNUNET_NAMESTORE_RF_RELATIVE_EXPIRATION;
+       rd[i].expiration_time = 0;
+      }
+      else
+      {
+       rd[i].flags = GNUNET_NAMESTORE_RF_NONE;
+       rd[i].expiration_time = pos->expiration_time;
+      }
+    }      
+    rh->proc (rh->proc_cls,
+             n,
+             rd);
+  }
+  GNS_resolver_lookup_cancel (rh);
+}
+
+
+/**
+ * Add a result from DNS to the records to be returned to the application.
+ *
+ * @param rh resolution request to extend with a result
+ * @param expiration_time expiration time for the answer
+ * @param record_type DNS record type of the answer
+ * @param data_size number of bytes in @a data
+ * @param data binary data to return in DNS record
+ */
+static void
+add_dns_result (struct GNS_ResolverHandle *rh,
+               uint64_t expiration_time,
+               uint32_t record_type,
+               size_t data_size,
+               const void *data)
+{
+  struct DnsResult *res;
+
+  res = GNUNET_malloc (sizeof (struct DnsResult) + data_size);
+  res->expiration_time = expiration_time;
+  res->data_size = data_size;
+  res->record_type = record_type;
+  res->data = &res[1];
+  memcpy (&res[1], data, data_size);
+  GNUNET_CONTAINER_DLL_insert (rh->dns_result_head,
+                              rh->dns_result_tail,
+                              res);
+}
+
+
+/**
+ * We had to do a DNS lookup.  Convert the result (if any) and return
+ * it.
+ *
+ * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param addr one of the addresses of the host, NULL for the last address
+ * @param addrlen length of the address
+ */
+static void
+handle_dns_result (void *cls,
+                  const struct sockaddr *addr,
+                  socklen_t addrlen)
+{
+  struct GNS_ResolverHandle *rh = cls;
+  const struct sockaddr_in *sa4;
+  const struct sockaddr_in6 *sa6;
+
+  rh->std_resolve = NULL;
+  if (NULL == addr)
+  {
+    transmit_lookup_dns_result (rh);
     return;
   }
-  
-  rlh = GNUNET_malloc (sizeof(struct RecordLookupHandle));
-  rh = GNUNET_malloc (sizeof (struct ResolverHandle));
-  rh->authority = zone;
-  rh->id = rid_gen++;
-  rh->proc_cls = rlh;
-  rh->priv_key = key;
-  rh->timeout = timeout;
-  rh->private_local_zone = pzone;
-  rh->only_cached = only_cached;
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    sa4 = (const struct sockaddr_in *) addr;
+    add_dns_result (rh,
+                   0 /* expiration time is unknown */,
+                   GNUNET_DNSPARSER_TYPE_A,
+                   sizeof (struct in_addr),
+                   &sa4->sin_addr);
+    break;
+  case AF_INET6:
+    sa6 = (const struct sockaddr_in6 *) addr;
+    add_dns_result (rh,
+                   0 /* expiration time is unknown */,
+                   GNUNET_DNSPARSER_TYPE_AAAA,
+                   sizeof (struct in6_addr),
+                   &sa6->sin6_addr);
+    break;
+  default:
+    GNUNET_break (0);
+    break;
+  }
+}
 
-  GNUNET_CONTAINER_DLL_insert (rlh_head, rlh_tail, rh);
-  
-  if (NULL == key)
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "No shorten key for resolution\n");
 
-  if (timeout.rel_value_us != GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+/**
+ * Task scheduled to continue with the resolution process.
+ *
+ * @param cls the 'struct GNS_ResolverHandle' of the resolution
+ * @param tc task context
+ */
+static void
+recursive_resolution (void *cls,
+                     const struct GNUNET_SCHEDULER_TaskContext *tc);
+
+
+/**
+ * Function called with the result of a DNS resolution.
+ *
+ * @param cls the request handle of the resolution that
+ *        we were attempting to make
+ * @param rs socket that received the response
+ * @param dns dns response, never NULL
+ * @param dns_len number of bytes in 'dns'
+ */
+static void
+dns_result_parser (void *cls,
+                  struct GNUNET_DNSSTUB_RequestSocket *rs,
+                  const struct GNUNET_TUN_DnsHeader *dns,
+                  size_t dns_len)
+{
+  struct GNS_ResolverHandle *rh = cls;
+  struct GNUNET_DNSPARSER_Packet *p;
+
+  rh->dns_request = NULL;
+  GNUNET_SCHEDULER_cancel (rh->task_id);
+  rh->task_id = GNUNET_SCHEDULER_NO_TASK;
+  p = GNUNET_DNSPARSER_parse ((const char *) dns, 
+                             dns_len);
+  if (NULL == p)
   {
-    /*
-     * Set timeout for authority lookup phase to 1/2
-     */
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Timeout for lookup set to %s/2\n", 
-               GNUNET_STRINGS_relative_time_to_string (rh->timeout, GNUNET_YES));
-    rh->timeout_task = GNUNET_SCHEDULER_add_delayed (
-                                GNUNET_TIME_relative_divide(timeout, 2),
-                                                &handle_lookup_timeout,
-                                                rh);
-    rh->timeout_cont = &dht_authority_lookup_timeout;
-    rh->timeout_cont_cls = rh;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+               _("Failed to parse DNS response\n"));
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
+  }
+  // FIXME: 
+  // Check if the packet is the final answer, or
+  // just pointing us to another NS or another name (CNAME), or another domain (DNAME);
+  // then do the right thing (TM) -- possibly using "recursive_dns_resolution".
+  GNUNET_break (0);
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+             _("NOT IMPLEMENTED\n"));
+  rh->proc (rh->proc_cls, 0, NULL);
+  GNS_resolver_lookup_cancel (rh);
+
+  
+  GNUNET_DNSPARSER_free_packet (p);
+}
+
+
+/**
+ * Perform recursive DNS resolution.  Asks the given DNS resolver to
+ * resolve "rh->dns_name", possibly recursively proceeding following
+ * NS delegations, CNAMES, etc., until 'rh->loop_limiter' bounds us or
+ * we find the answer.
+ *
+ * @param rh resolution information
+ */
+static void
+recursive_dns_resolution (struct GNS_ResolverHandle *rh)
+{
+  struct AuthorityChain *ac;
+  socklen_t sa_len;
+  struct GNUNET_DNSPARSER_Query *query;
+  struct GNUNET_DNSPARSER_Packet *p;
+  char *dns_request;
+  size_t dns_request_length;
+
+  ac = rh->ac_tail;
+  GNUNET_assert (NULL != ac);
+  GNUNET_assert (GNUNET_NO == ac->gns_authority);
+  switch (((const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip)->sa_family)
+  {
+  case AF_INET:
+    sa_len = sizeof (struct sockaddr_in);
+    break;
+  case AF_INET6:
+    sa_len = sizeof (struct sockaddr_in6);
+    break;
+  default:
+    GNUNET_break (0);
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
+  }
+  query = GNUNET_new (struct GNUNET_DNSPARSER_Query);
+  query->name = GNUNET_strdup (ac->label);
+  query->type = rh->record_type;
+  query->class = GNUNET_TUN_DNS_CLASS_INTERNET;
+  p = GNUNET_new (struct GNUNET_DNSPARSER_Packet);
+  p->queries = query;
+  p->num_queries = 1;
+  p->id = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                              UINT16_MAX);
+  p->flags.opcode = GNUNET_TUN_DNS_OPCODE_QUERY;
+  p->flags.recursion_desired = 1;
+  if (GNUNET_OK != 
+      GNUNET_DNSPARSER_pack (p, 1024, &dns_request, &dns_request_length))
+  {
+    GNUNET_break (0);
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
   }
   else
   {
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "No timeout for query!\n");
-    rh->timeout_task = GNUNET_SCHEDULER_NO_TASK;
+    rh->dns_request = GNUNET_DNSSTUB_resolve (dns_handle,
+                                             (const struct sockaddr *) &ac->authority_info.dns_authority.dns_ip,
+                                             sa_len,
+                                             dns_request,
+                                             dns_request_length,
+                                             &dns_result_parser,
+                                             rh);
+    rh->task_id = GNUNET_SCHEDULER_add_delayed (DNS_LOOKUP_TIMEOUT,
+                                               &fail_resolution,
+                                               rh);
   }
+  GNUNET_free (dns_request);
+  GNUNET_DNSPARSER_free_packet (p);
+}
+
+
+/**
+ * Process a records that were decrypted from a block.
+ *
+ * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param rd_count number of entries in @a rd array
+ * @param rd array of records with data to store
+ */
+static void
+handle_gns_resolution_result (void *cls,
+                             unsigned int rd_count,
+                             const struct GNUNET_NAMESTORE_RecordData *rd)
+{
+  struct GNS_ResolverHandle *rh = cls;
+   
+  // FIXME: not implemented
+  // if this was the last label, return 'rd' to application
+  // (possibly first checking about converting records
+  //  to requested type, if possible).
+  // if not, look for PKEY, CNAME, DNAME or NS to extend
+  // auth chain and continue with recursion
+  GNUNET_break (0);
+  rh->proc (rh->proc_cls, 0, NULL);
+  GNS_resolver_lookup_cancel (rh);
+}
+
+
+/**
+ * Function called once the namestore has completed the request for
+ * caching a block.
+ *
+ * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param success #GNUNET_OK on success
+ * @param emsg error message
+ */
+static void
+namestore_cache_continuation (void *cls,
+                             int32_t success,
+                             const char *emsg)
+{
+  struct GNS_ResolverHandle *rh = cls;
+
+  rh->namestore_qe = NULL;
+  if (NULL != emsg)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+               _("Failed to cache GNS resolution: %s\n"),
+               emsg);
+}
+
+
+/**
+ * Iterator called on each result obtained for a DHT
+ * operation that expects a reply
+ *
+ * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param exp when will this value expire
+ * @param key key of the result
+ * @param get_path peers on reply path (or NULL if not recorded)
+ *                 [0] = datastore's first neighbor, [length - 1] = local peer
+ * @param get_path_length number of entries in get_path
+ * @param put_path peers on the PUT path (or NULL if not recorded)
+ *                 [0] = origin, [length - 1] = datastore
+ * @param put_path_length number of entries in get_path
+ * @param type type of the result
+ * @param size number of bytes in data
+ * @param data pointer to the result data
+ */
+static void
+handle_dht_response (void *cls,
+                    struct GNUNET_TIME_Absolute exp,
+                    const struct GNUNET_HashCode * key,
+                    const struct GNUNET_PeerIdentity *get_path,
+                    unsigned int get_path_length,
+                    const struct GNUNET_PeerIdentity *put_path, 
+                    unsigned int put_path_length,
+                    enum GNUNET_BLOCK_Type type,
+                    size_t size, const void *data)
+{
+  struct GNS_ResolverHandle *rh = cls;
+  struct AuthorityChain *ac = rh->ac_tail;
+  const struct GNUNET_NAMESTORE_Block *block;
   
-  if (strcmp(GNUNET_GNS_TLD, name) == 0)
+  GNUNET_DHT_get_stop (rh->get_handle);
+  rh->get_handle = NULL;
+  GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
+  rh->dht_heap_node = NULL;  
+  if (size < sizeof (struct GNUNET_NAMESTORE_Block))
+  {
+    /* how did this pass DHT block validation!? */
+    GNUNET_break (0);
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;   
+  }
+  block = data; 
+  if (size !=
+      ntohs (block->purpose.size) + 
+      sizeof (struct GNUNET_CRYPTO_EccPublicKey) +
+      sizeof (struct GNUNET_CRYPTO_EccSignature))
+  {
+    /* how did this pass DHT block validation!? */
+    GNUNET_break (0);
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;   
+  }
+  if (GNUNET_OK !=
+      GNUNET_NAMESTORE_block_decrypt (block,
+                                     &ac->authority_info.gns_authority,
+                                     ac->label,
+                                     &handle_gns_resolution_result,
+                                     rh))
+  {
+    GNUNET_break_op (0); /* block was ill-formed */
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
+  }
+  /* Cache well-formed blocks */
+  rh->namestore_qe = GNUNET_NAMESTORE_block_cache (namestore_handle,
+                                                  block,
+                                                  &namestore_cache_continuation,
+                                                  rh);
+}
+
+
+/**
+ * Process a record that was stored in the namestore.
+ *
+ * @param cls closure with the 'struct GNS_ResolverHandle'
+ * @param block block that was stored in the namestore
+ */
+static void 
+handle_namestore_block_response (void *cls,
+                                const struct GNUNET_NAMESTORE_Block *block)
+{
+  struct GNS_ResolverHandle *rh = cls;
+  struct GNS_ResolverHandle *rx;
+  struct AuthorityChain *ac = rh->ac_tail;
+  const char *label = ac->label;
+  const struct GNUNET_CRYPTO_EccPublicKey *auth = &ac->authority_info.gns_authority;
+  struct GNUNET_HashCode query;
+
+  GNUNET_NAMESTORE_query_from_public_key (auth,
+                                         label,
+                                         &query);
+  rh->namestore_qe = NULL;
+  if (NULL == block)
+  {
+    /* Namestore knows nothing; try DHT lookup */
+    rh->get_handle = GNUNET_DHT_get_start (dht_handle,
+                                          GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
+                                          &query,
+                                          DHT_GNS_REPLICATION_LEVEL,
+                                          GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE,
+                                          NULL, 0,
+                                          &handle_dht_response, rh);
+    rh->dht_heap_node = GNUNET_CONTAINER_heap_insert (dht_lookup_heap,
+                                                     rh,
+                                                     GNUNET_TIME_absolute_get ().abs_value_us);
+    if (GNUNET_CONTAINER_heap_get_size (dht_lookup_heap) > max_allowed_background_queries)
+    {
+      /* fail longest-standing DHT request */
+      rx = GNUNET_CONTAINER_heap_peek (dht_lookup_heap);
+      rx->proc (rx->proc_cls, 0, NULL);
+      GNS_resolver_lookup_cancel (rx);
+    }
+    return;
+  }
+  if (GNUNET_OK !=
+      GNUNET_NAMESTORE_block_decrypt (block,
+                                     auth,
+                                     label,
+                                     &handle_gns_resolution_result,
+                                     rh))
   {
-    /**
-     * Only '.gads' given
-     */
-    strcpy (rh->name, "\0");
+    GNUNET_break_op (0); /* block was ill-formed */
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
   }
-  else
+}
+
+
+/**
+ * Lookup tail of our authority chain in the namestore.
+ *
+ * @param rh query we are processing
+ */
+static void
+recursive_gns_resolution_namestore (struct GNS_ResolverHandle *rh)
+{
+  struct AuthorityChain *ac = rh->ac_tail;
+  struct GNUNET_HashCode query;
+
+  GNUNET_NAMESTORE_query_from_public_key (&ac->authority_info.gns_authority,
+                                         ac->label,
+                                         &query);
+  rh->namestore_qe = GNUNET_NAMESTORE_lookup_block (namestore_handle,
+                                                   &query,
+                                                   &handle_namestore_block_response,
+                                                   rh);
+}
+
+
+/**
+ * Task scheduled to continue with the resolution process.
+ *
+ * @param cls the 'struct GNS_ResolverHandle' of the resolution
+ * @param tc task context
+ */
+static void
+recursive_resolution (void *cls,
+                    const struct GNUNET_SCHEDULER_TaskContext *tc)
+{
+  struct GNS_ResolverHandle *rh = cls;
+
+  rh->task_id = GNUNET_SCHEDULER_NO_TASK;
+  if (MAX_RECURSION < rh->loop_limiter++)
   {
-    if (is_zkey_tld(name) == GNUNET_YES)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "TLD is zkey\n");
-      /**
-       * This is a zkey tld
-       * build hash and use as initial authority
-       */
-      memset(rh->name, 0,
-             strlen(name)-strlen(GNUNET_GNS_TLD_ZKEY));
-      memcpy(rh->name, name,
-             strlen(name)-strlen(GNUNET_GNS_TLD_ZKEY) - 1);
-      pop_tld (rh->name, string_hash);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+               "Encountered unbounded recursion resolving `%s'\n",
+               rh->name);
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);
+    return;
+  }
+  if (GNUNET_YES == rh->ac_tail->gns_authority)
+    recursive_gns_resolution_namestore (rh);
+  else
+    recursive_dns_resolution (rh);
+}
 
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "ZKEY is %s!\n", string_hash);
-      
-      GNUNET_STRINGS_utf8_toupper(string_hash, &nzkey_ptr);
 
-      if (GNUNET_OK != GNUNET_CRYPTO_short_hash_from_string(nzkey,
-                                                      &rh->authority))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                    "Cannot convert ZKEY `%s' to hash!\n", string_hash);
-        
-       if (GNUNET_SCHEDULER_NO_TASK != rh->timeout_task)
-         GNUNET_SCHEDULER_cancel (rh->timeout_task);
-        GNUNET_CONTAINER_DLL_remove (rlh_head, rlh_tail, rh);
-        GNUNET_free (rh);
-        GNUNET_free (rlh);
-        proc (cls, 0, NULL);
-        return;
-      }
+/**
+ * Lookup of a record in a specific zone calls lookup result processor
+ * on result.
+ *
+ * @param zone the zone to perform the lookup in
+ * @param record_type the record type to look up
+ * @param name the name to look up
+ * @param shorten_key a private key for use with PSEU import (can be NULL)
+ * @param only_cached GNUNET_NO to only check locally not DHT for performance
+ * @param proc the processor to call on result
+ * @param proc_cls the closure to pass to @a proc
+ * @return handle to cancel operation
+ */
+struct GNS_ResolverHandle *
+GNS_resolver_lookup (const struct GNUNET_CRYPTO_EccPublicKey *zone,
+                    uint32_t record_type,
+                    const char *name,
+                    const struct GNUNET_CRYPTO_EccPrivateKey *shorten_key,
+                    int only_cached,
+                    GNS_ResultProcessor proc, void *proc_cls)
+{
+  struct GNS_ResolverHandle *rh;
+  struct AuthorityChain *ac;
+  char *x;
+  char *y;
+  char *pkey;
+
+  rh = GNUNET_new (struct GNS_ResolverHandle);
+  GNUNET_CONTAINER_DLL_insert (rlh_head,
+                              rlh_tail,
+                              rh);
+  rh->authority_zone = *zone;
+  rh->proc = proc;
+  rh->proc_cls = proc_cls;
+  rh->only_cached = only_cached;
+  rh->record_type = record_type;
+  rh->name = GNUNET_strdup (name);
+  rh->name_resolution_pos = strlen (name);
+  if (NULL != shorten_key)
+  {
+    rh->shorten_key = GNUNET_new (struct GNUNET_CRYPTO_EccPrivateKey);
+    *rh->shorten_key = *shorten_key;
+  }
 
-    }
-    else if (is_gads_tld (name) == GNUNET_YES)
+  if ( ( (GNUNET_YES == is_canonical (name)) &&
+        (0 != strcmp (GNUNET_GNS_TLD, name)) ) ||
+       ( (GNUNET_YES != is_gnu_tld (name)) &&
+        (GNUNET_YES != is_zkey_tld (name)) ) )
+  {
+    /* use standard DNS lookup */
+    int af;
+
+    switch (record_type)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "TLD is gads\n");
-      /**
-       * Presumably GADS tld
-       */
-      memcpy (rh->name, name,
-              strlen (name) - strlen(GNUNET_GNS_TLD) - 1);
-      rh->name[strlen (name) - strlen(GNUNET_GNS_TLD) - 1] = '\0';
+    case GNUNET_DNSPARSER_TYPE_A:
+      af = AF_INET;
+      break;
+    case GNUNET_DNSPARSER_TYPE_AAAA:
+      af = AF_INET6;
+      break;
+    default:
+      af = AF_UNSPEC;
+      break;
     }
-    else
+    rh->std_resolve = GNUNET_RESOLVER_ip_get (name, 
+                                             af,
+                                             DNS_LOOKUP_TIMEOUT,
+                                             &handle_dns_result,
+                                             rh);
+    return rh;
+  }
+  if (is_zkey_tld (name))
+  {
+    /* Name ends with ".zkey", try to replace authority zone with zkey
+       authority */
+    GNUNET_free (resolver_lookup_get_next_label (rh)); /* will return "zkey" */
+    x = resolver_lookup_get_next_label (rh); /* will return 'x' coordinate */
+    y = resolver_lookup_get_next_label (rh); /* will return 'y' coordinate */
+    GNUNET_asprintf (&pkey,
+                    "%s%s",
+                    x, y);
+    if ( (NULL == x) ||
+        (NULL == y) ||
+        (GNUNET_OK !=
+         GNUNET_CRYPTO_ecc_public_key_from_string (pkey,
+                                                   strlen (pkey),
+                                                   &rh->authority_zone)) )
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _("Not a GADS TLD: `%s'\n"), 
-                 name);      
-      if (GNUNET_SCHEDULER_NO_TASK != rh->timeout_task)
-        GNUNET_SCHEDULER_cancel (rh->timeout_task);
-      GNUNET_CONTAINER_DLL_remove (rlh_head, rlh_tail, rh);
-      GNUNET_free (rh);
-      GNUNET_free (rlh);
-      proc (cls, 0, NULL);
-      return;
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                 _("Hostname `%s' is not well-formed, resolution fails\n"),
+                 name);
+      rh->task_id = GNUNET_SCHEDULER_add_now (&fail_resolution, rh);
     }
+    GNUNET_free_non_null (x);
+    GNUNET_free_non_null (y);
+    GNUNET_free (pkey);
   }
-  
-  /**
-   * Initialize authority chain
-   */
-  rh->authority_chain_head = GNUNET_malloc (sizeof(struct AuthorityChain));
-  rh->authority_chain_tail = rh->authority_chain_head;
-  rh->authority_chain_head->zone = rh->authority;
-  strcpy (rh->authority_chain_head->name, "");
-  
-  /**
-   * Copy original query into lookup handle
-   */
-  rlh->record_type = record_type;
-  memset(rlh->name, 0, strlen(name) + 1);
-  strcpy(rlh->name, name);
-  rlh->proc = proc;
-  rlh->proc_cls = cls;
-
-  rh->proc = &handle_delegation_ns;
-  resolve_delegation_ns (rh);
+  else
+  {
+    /* Name ends with ".gnu", eat ".gnu" and continue with resolution */
+    GNUNET_free (resolver_lookup_get_next_label (rh));
+  }
+  ac = GNUNET_new (struct AuthorityChain);
+  ac->rh = rh;
+  ac->label = resolver_lookup_get_next_label (rh);
+  if (NULL == ac->label)
+    /* name was just "gnu", so we default to label '+' */
+    ac->label = GNUNET_strdup (GNUNET_GNS_MASTERZONE_STR);
+  ac->gns_authority = GNUNET_YES;
+  ac->authority_info.gns_authority = rh->authority_zone;
+  GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
+                                   rh->ac_tail,
+                                   ac);
+  rh->task_id = GNUNET_SCHEDULER_add_now (&recursive_resolution,
+                                         rh);
+  return rh;
 }
 
 
+/**
+ * Cancel active resolution (i.e. client disconnected).
+ *
+ * @param rh resolution to abort
+ */
+void
+GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
+{
+  struct DnsResult *dr;
+  struct AuthorityChain *ac;
+
+  GNUNET_CONTAINER_DLL_remove (rlh_head,
+                              rlh_tail,
+                              rh);
+  while (NULL != (ac = rh->ac_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (rh->ac_head,
+                                rh->ac_tail,
+                                ac);
+    GNUNET_free (ac->label);
+    GNUNET_free (ac);
+  }
+  if (GNUNET_SCHEDULER_NO_TASK != rh->task_id)
+  {
+    GNUNET_SCHEDULER_cancel (rh->task_id);
+    rh->task_id = GNUNET_SCHEDULER_NO_TASK;
+  }
+  if (NULL != rh->get_handle)
+  {
+    GNUNET_DHT_get_stop (rh->get_handle);
+    rh->get_handle = NULL;
+  }
+  if (NULL != rh->dht_heap_node)
+  {
+    GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
+    rh->dht_heap_node = NULL;
+  }
+  if (NULL != rh->dns_request)
+  {
+    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
+    rh->dns_request = NULL;
+  }
+  if (NULL != rh->namestore_qe)
+  {
+    GNUNET_NAMESTORE_cancel (rh->namestore_qe);
+    rh->namestore_qe = NULL;
+  }
+  if (NULL != rh->std_resolve)
+  {
+    GNUNET_RESOLVER_request_cancel (rh->std_resolve);
+    rh->std_resolve = NULL;
+  }
+  while (NULL != (dr = rh->dns_result_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (rh->dns_result_head,
+                                rh->dns_result_tail,
+                                dr);
+    GNUNET_free (dr);
+  }
+  GNUNET_free_non_null (rh->shorten_key);
+  GNUNET_free (rh->name);
+  GNUNET_free (rh);
+}
+
+
+/* ***************** Resolver initialization ********************* */
+
+
+/**
+ * Initialize the resolver
+ *
+ * @param nh the namestore handle
+ * @param dht the dht handle
+ * @param c configuration handle
+ * @param max_bg_queries maximum number of parallel background queries in dht
+ */
+void
+GNS_resolver_init (struct GNUNET_NAMESTORE_Handle *nh,
+                  struct GNUNET_DHT_Handle *dht,
+                  const struct GNUNET_CONFIGURATION_Handle *c,
+                  unsigned long long max_bg_queries)
+{
+  char *dns_ip;
+
+  cfg = c;
+  namestore_handle = nh;
+  dht_handle = dht;
+  dht_lookup_heap =
+    GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+  max_allowed_background_queries = max_bg_queries;
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_string (c,
+                                            "gns",
+                                            "DNS_RESOLVER",
+                                            &dns_ip))
+  {
+    /* user did not specify DNS resolver, use 8.8.8.8 */
+    dns_ip = GNUNET_strdup ("8.8.8.8");
+  }
+  dns_handle = GNUNET_DNSSTUB_start (dns_ip);
+  GNUNET_free (dns_ip);
+}
+
+
+/**
+ * Shutdown resolver
+ */
+void
+GNS_resolver_done ()
+{
+  struct GNS_ResolverHandle *rh;
+
+  /* abort active resolutions */
+  while (NULL != (rh = rlh_head))
+  {
+    rh->proc (rh->proc_cls, 0, NULL);
+    GNS_resolver_lookup_cancel (rh);    
+  }
+  /* abort active shorten operations */
+  while (NULL != gph_head)
+    free_get_pseu_authority_handle (gph_head);
+  GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
+  dht_lookup_heap = NULL;
+  GNUNET_DNSSTUB_stop (dns_handle);
+  dns_handle = NULL;
+}
+
+
+/* *************** common helper functions (do not really belong here) *********** */
+
+/**
+ * Checks if "name" ends in ".tld"
+ *
+ * @param name the name to check
+ * @param tld the TLD to check for
+ * @return GNUNET_YES or GNUNET_NO
+ */
+int
+is_tld (const char* name, const char* tld)
+{
+  size_t offset = 0;
+
+  if (strlen (name) <= strlen (tld))
+    return GNUNET_NO;
+  offset = strlen (name) - strlen (tld);
+  if (0 != strcmp (name + offset, tld))
+    return GNUNET_NO;
+  return GNUNET_YES;
+}
+
+
+
+
 /* end of gnunet-service-gns_resolver.c */