-more logging, avoid duplicate re-scheduling
[oweals/gnunet.git] / src / transport / plugin_transport_tcp.c
index 9e78e47d93911083ed6bc88fb032a666d030fa59..38ba2c3cee83ad01ba0e59d9f772377b3402f58e 100644 (file)
@@ -1,22 +1,22 @@
 /*
-     This file is part of GNUnet
-     (C) 2002--2013 Christian Grothoff (and other contributing authors)
-
-     GNUnet is free software; you can redistribute it and/or modify
-     it under the terms of the GNU General Public License as published
-     by the Free Software Foundation; either version 3, or (at your
-     option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     General Public License for more details.
-
-     You should have received a copy of the GNU General Public License
-     along with GNUnet; see the file COPYING.  If not, write to the
-     Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-     Boston, MA 02111-1307, USA.
-*/
+  This file is part of GNUnet
+  Copyright (C) 2002--2015 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+  Boston, MA 02110-1301, USA.
+ */
 /**
  * @file transport/plugin_transport_tcp.c
  * @brief Implementation of the TCP transport service
 #include "platform.h"
 #include "gnunet_hello_lib.h"
 #include "gnunet_constants.h"
-#include "gnunet_connection_lib.h"
-#include "gnunet_container_lib.h"
+#include "gnunet_util_lib.h"
 #include "gnunet_nat_lib.h"
-#include "gnunet_os_lib.h"
 #include "gnunet_protocols.h"
 #include "gnunet_resolver_service.h"
-#include "gnunet_server_lib.h"
-#include "gnunet_service_lib.h"
 #include "gnunet_signatures.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_transport_service.h"
  */
 #define NAT_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
 
-
 GNUNET_NETWORK_STRUCT_BEGIN
 
-/**
- * Address options
- */
-static uint32_t myoptions;
 
 /**
  * Initial handshake message for a session.
@@ -63,7 +54,7 @@ static uint32_t myoptions;
 struct WelcomeMessage
 {
   /**
-   * Type is GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME.
+   * Type is #GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME.
    */
   struct GNUNET_MessageHeader header;
 
@@ -74,7 +65,6 @@ struct WelcomeMessage
 
 };
 
-
 /**
  * Basically a WELCOME message, but with the purpose
  * of giving the waiting peer a client handle to use
@@ -82,7 +72,7 @@ struct WelcomeMessage
 struct TCP_NAT_ProbeMessage
 {
   /**
-   * Type is GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE.
+   * Type is #GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE.
    */
   struct GNUNET_MessageHeader header;
 
@@ -131,6 +121,27 @@ struct TCPProbeContext
   struct Plugin *plugin;
 };
 
+/**
+ * Bits in the `options` field of TCP addresses.
+ */
+enum TcpAddressOptions
+{
+
+  /**
+   * No bits set.
+   */
+  TCP_OPTIONS_NONE = 0,
+
+  /**
+   * See #HTTP_OPTIONS_VERIFY_CERTIFICATE.
+   */
+  TCP_OPTIONS_RESERVED = 1,
+
+  /**
+   * Enable TCP Stealth-style port knocking.
+   */
+  TCP_OPTIONS_TCP_STEALTH = 2
+};
 
 GNUNET_NETWORK_STRUCT_BEGIN
 
@@ -140,9 +151,10 @@ GNUNET_NETWORK_STRUCT_BEGIN
 struct IPv4TcpAddress
 {
   /**
-   * Optional options and flags for this address
+   * Optional options and flags for this address,
+   * see `enum TcpAddressOptions`
    */
-  uint32_t options;
+  uint32_t options GNUNET_PACKED;
 
   /**
    * IPv4 address, in network byte order.
@@ -156,7 +168,6 @@ struct IPv4TcpAddress
 
 };
 
-
 /**
  * Network format for IPv6 addresses.
  */
@@ -164,8 +175,9 @@ struct IPv6TcpAddress
 {
   /**
    * Optional flags for this address
+   * see `enum TcpAddressOptions`
    */
-  uint32_t options;
+  uint32_t options GNUNET_PACKED;
 
   /**
    * IPv6 address.
@@ -185,7 +197,6 @@ GNUNET_NETWORK_STRUCT_END
  */
 struct Plugin;
 
-
 /**
  * Information kept for each message that is yet to
  * be transmitted.
@@ -216,7 +227,7 @@ struct PendingMessage
   GNUNET_TRANSPORT_TransmitContinuation transmit_cont;
 
   /**
-   * Closure for transmit_cont.
+   * Closure for @e transmit_cont.
    */
   void *transmit_cont_cls;
 
@@ -228,17 +239,16 @@ struct PendingMessage
   /**
    * So that the gnunet-service-transport can group messages together,
    * these pending messages need to accept a message buffer and size
-   * instead of just a GNUNET_MessageHeader.
+   * instead of just a `struct GNUNET_MessageHeader`.
    */
   size_t message_size;
 
 };
 
-
 /**
  * Session handle for TCP connections.
  */
-struct Session
+struct GNUNET_ATS_Session
 {
   /**
    * To whom are we talking to (set to our identity
@@ -246,11 +256,6 @@ struct Session
    */
   struct GNUNET_PeerIdentity target;
 
-  /**
-   * API requirement.
-   */
-  struct SessionHeader header;
-
   /**
    * Pointer to the global plugin struct.
    */
@@ -264,7 +269,7 @@ struct Session
   /**
    * Task cleaning up a NAT client connection establishment attempt;
    */
-  GNUNET_SCHEDULER_TaskIdentifier nat_connection_timeout;
+  struct GNUNET_SCHEDULER_Task *nat_connection_timeout;
 
   /**
    * Messages currently pending for transmission
@@ -283,28 +288,31 @@ struct Session
    */
   struct GNUNET_SERVER_TransmitHandle *transmit_handle;
 
+  /**
+   * Address of the other peer.
+   */
+  struct GNUNET_HELLO_Address *address;
+
   /**
    * ID of task used to delay receiving more to throttle sender.
    */
-  GNUNET_SCHEDULER_TaskIdentifier receive_delay_task;
+  struct GNUNET_SCHEDULER_Task *receive_delay_task;
 
   /**
    * Session timeout task
    */
-  GNUNET_SCHEDULER_TaskIdentifier timeout_task;
+  struct GNUNET_SCHEDULER_Task *timeout_task;
 
   /**
-   * Address of the other peer (either based on our 'connect'
-   * call or on our 'accept' call).
-   *
-   * struct IPv4TcpAddress or struct IPv6TcpAddress
+   * When will this session time out?
    */
-  void *addr;
+  struct GNUNET_TIME_Absolute timeout;
 
   /**
-   * Length of @e addr.
+   * When will we continue to read from the socket?
+   * (used to enforce inbound quota).
    */
-  size_t addrlen;
+  struct GNUNET_TIME_Absolute receive_delay;
 
   /**
    * Last activity on this connection.  Used to select preferred
@@ -313,24 +321,88 @@ struct Session
   struct GNUNET_TIME_Absolute last_activity;
 
   /**
-   * Are we still expecting the welcome message? (#GNUNET_YES/#GNUNET_NO)
+   * Number of bytes waiting for transmission to this peer.
    */
-  int expecting_welcome;
+  unsigned long long bytes_in_queue;
+
+  /**
+   * Number of messages waiting for transmission to this peer.
+   */
+  unsigned int msgs_in_queue;
 
   /**
-   * Was this a connection that was inbound (we accepted)? (#GNUNET_YES/#GNUNET_NO)
+   * Network type of the address.
+   */
+  enum GNUNET_ATS_Network_Type scope;
+
+  /**
+   * Are we still expecting the welcome message? (#GNUNET_YES/#GNUNET_NO)
    */
-  int inbound;
+  int expecting_welcome;
 
   /**
    * Was this session created using NAT traversal?
    */
   int is_nat;
 
+};
+
+
+/**
+ * Context for address to string conversion, closure
+ * for #append_port().
+ */
+struct PrettyPrinterContext
+{
+  /**
+   * DLL
+   */
+  struct PrettyPrinterContext *next;
+
+  /**
+   * DLL
+   */
+  struct PrettyPrinterContext *prev;
+
+  /**
+   * Our plugin.
+   */
+  struct Plugin *plugin;
+
+  /**
+   * Timeout task
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * Resolver handle
+   */
+  struct GNUNET_RESOLVER_RequestHandle *resolver_handle;
+
+  /**
+   * Function to call with the result.
+   */
+  GNUNET_TRANSPORT_AddressStringCallback asc;
+
+  /**
+   * Clsoure for @e asc.
+   */
+  void *asc_cls;
+
   /**
-   * ATS network type in NBO
+   * IPv6 address
+   */
+  int ipv6;
+
+  /**
+   * Options
+   */
+  uint32_t options;
+
+  /**
+   * Port to add after the IP address.
    */
-  enum GNUNET_ATS_Network_Type ats_address_network_type;
+  uint16_t port;
 };
 
 
@@ -395,6 +467,36 @@ struct Plugin
    */
   struct GNUNET_RESOLVER_RequestHandle *ext_dns;
 
+  /**
+   * Function to call about session status changes.
+   */
+  GNUNET_TRANSPORT_SessionInfoCallback sic;
+
+  /**
+   * Closure for @e sic.
+   */
+  void *sic_cls;
+
+  /**
+   * ID of task used to update our addresses when one expires.
+   */
+  struct GNUNET_SCHEDULER_Task *address_update_task;
+
+  /**
+   * Running pretty printers: head
+   */
+  struct PrettyPrinterContext *ppc_dll_head;
+
+  /**
+   * Running pretty printers: tail
+   */
+  struct PrettyPrinterContext *ppc_dll_tail;
+
+  /**
+   * Welcome message used by this peer.
+   */
+  struct WelcomeMessage my_welcome;
+
   /**
    * How many more TCP sessions are we allowed to open right now?
    */
@@ -406,9 +508,9 @@ struct Plugin
   unsigned long long cur_connections;
 
   /**
-   * ID of task used to update our addresses when one expires.
+   * Address options
    */
-  GNUNET_SCHEDULER_TaskIdentifier address_update_task;
+  uint32_t myoptions;
 
   /**
    * Port that we are actually listening on.
@@ -425,156 +527,98 @@ struct Plugin
 
 
 /**
- * Start session timeout
- */
-static void
-start_session_timeout (struct Session *s);
-
-
-/**
- * Increment session timeout due to activity
- */
-static void
-reschedule_session_timeout (struct Session *s);
-
-
-/**
- * Cancel timeout
+ * If a session monitor is attached, notify it about the new
+ * session state.
  *
- * @param s session to cancel timeout for
+ * @param plugin our plugin
+ * @param session session that changed state
+ * @param state new state of the session
  */
 static void
-stop_session_timeout (struct Session *s);
-
-
-/* DEBUG CODE */
-static const char *
-tcp_address_to_string (void *cls, const void *addr, size_t addrlen);
-
-
-static unsigned int sessions;
-
-
-static void
-inc_sessions (struct Plugin *plugin, struct Session *session, int line)
-{
-  sessions++;
-  unsigned int size = GNUNET_CONTAINER_multipeermap_size (plugin->sessionmap);
-  if (sessions != size)
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Inconsistent sessions %u <-> session map size: %u\n",
-         sessions, size);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "%4i Session increased to %u (session map size: %u): `%s' `%s'\n",
-       line,
-       sessions,
-       size,
-       GNUNET_i2s (&session->target),
-       tcp_address_to_string (NULL, session->addr, session->addrlen));
-}
-
-
-static void
-dec_sessions (struct Plugin *plugin,
-              struct Session *session, int line)
+notify_session_monitor (struct Plugin *plugin,
+                        struct GNUNET_ATS_Session *session,
+                        enum GNUNET_TRANSPORT_SessionState state)
 {
-  GNUNET_assert (sessions > 0);
-  unsigned int size = GNUNET_CONTAINER_multipeermap_size(plugin->sessionmap);
-  sessions--;
-  if (sessions != size)
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Inconsistent sessions %u <-> session map size: %u\n",
-         sessions, size);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "%4i Session decreased to %u (session map size: %u): `%s' `%s'\n",
-       line,
-       sessions,
-       size,
-       GNUNET_i2s (&session->target),
-       tcp_address_to_string (NULL, session->addr, session->addrlen));
-}
-/* DEBUG CODE */
+  struct GNUNET_TRANSPORT_SessionInfo info;
 
-
-/**
- * Function to check if an inbound connection is acceptable.
- * Mostly used to limit the total number of open connections
- * we can have.
- *
- * @param cls the 'struct Plugin'
- * @param ucred credentials, if available, otherwise NULL
- * @param addr address
- * @param addrlen length of address
- * @return #GNUNET_YES to allow, #GNUNET_NO to deny, #GNUNET_SYSERR
- *   for unknown address family (will be denied).
- */
-static int
-plugin_tcp_access_check (void *cls,
-                         const struct GNUNET_CONNECTION_Credentials *ucred,
-                         const struct sockaddr *addr, socklen_t addrlen)
-{
-  struct Plugin *plugin = cls;
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Accepting new incoming TCP connection from `%s'\n",
-       GNUNET_a2s (addr, addrlen));
-  if (plugin->cur_connections >= plugin->max_connections)
-    return GNUNET_NO;
-  plugin->cur_connections ++;
-  return GNUNET_YES;
+  if (NULL == plugin->sic)
+    return;
+  memset (&info, 0, sizeof (info));
+  info.state = state;
+  info.is_inbound = (0 != (GNUNET_HELLO_ADDRESS_INFO_INBOUND & session->address->local_info))
+    ? GNUNET_YES
+    : GNUNET_NO;
+  info.num_msg_pending = session->msgs_in_queue;
+  info.num_bytes_pending = session->bytes_in_queue;
+  if (NULL != session->receive_delay_task)
+    info.receive_delay = session->receive_delay;
+  info.session_timeout = session->timeout;
+  info.address = session->address;
+  plugin->sic (plugin->sic_cls,
+               session,
+               &info);
 }
 
 
 /**
  * Our external IP address/port mapping has changed.
  *
- * @param cls closure, the 'struct LocalAddrList'
+ * @param cls closure, the `struct Plugin`
  * @param add_remove #GNUNET_YES to mean the new public IP address, #GNUNET_NO to mean
  *     the previous (now invalid) one
  * @param addr either the previous or the new public IP address
- * @param addrlen actual lenght of the address
+ * @param addrlen actual length of @a addr
  */
 static void
-tcp_nat_port_map_callback (void *cls, int add_remove,
-                           const struct sockaddr *addr, socklen_t addrlen)
+tcp_nat_port_map_callback (void *cls,
+                           int add_remove,
+                           const struct sockaddr *addr,
+                           socklen_t addrlen)
 {
   struct Plugin *plugin = cls;
+  struct GNUNET_HELLO_Address *address;
   struct IPv4TcpAddress t4;
   struct IPv6TcpAddress t6;
   void *arg;
   size_t args;
 
-  LOG (GNUNET_ERROR_TYPE_INFO,
-       "NAT notification to %s address `%s'\n",
-       (GNUNET_YES == add_remove) ? "add" : "remove",
-       GNUNET_a2s (addr, addrlen));
+  LOG(GNUNET_ERROR_TYPE_INFO,
+      "NAT notification to %s address `%s'\n",
+      (GNUNET_YES == add_remove) ? "add" : "remove",
+      GNUNET_a2s (addr, addrlen));
   /* convert 'addr' to our internal format */
   switch (addr->sa_family)
   {
   case AF_INET:
-    GNUNET_assert (addrlen == sizeof (struct sockaddr_in));
-    memset (&t4,0, sizeof (t4));
-    t4.options = htonl (myoptions);
+    GNUNET_assert(addrlen == sizeof(struct sockaddr_in));
+    memset (&t4, 0, sizeof(t4));
+    t4.options = htonl (plugin->myoptions);
     t4.ipv4_addr = ((struct sockaddr_in *) addr)->sin_addr.s_addr;
     t4.t4_port = ((struct sockaddr_in *) addr)->sin_port;
     arg = &t4;
     args = sizeof (t4);
     break;
   case AF_INET6:
-    GNUNET_assert (addrlen == sizeof (struct sockaddr_in6));
-    memset (&t6, 0, sizeof (t6));
+    GNUNET_assert(addrlen == sizeof(struct sockaddr_in6));
+    memset (&t6, 0, sizeof(t6));
     memcpy (&t6.ipv6_addr, &((struct sockaddr_in6 *) addr)->sin6_addr,
-            sizeof (struct in6_addr));
-    t6.options = htonl (myoptions);
+        sizeof(struct in6_addr));
+    t6.options = htonl (plugin->myoptions);
     t6.t6_port = ((struct sockaddr_in6 *) addr)->sin6_port;
     arg = &t6;
     args = sizeof (t6);
     break;
   default:
-    GNUNET_break (0);
+    GNUNET_break(0);
     return;
   }
   /* modify our published address list */
-  plugin->env->notify_address (plugin->env->cls, add_remove, arg, args, "tcp");
+  GNUNET_assert ((args == sizeof (struct IPv4TcpAddress)) ||
+      (args == sizeof (struct IPv6TcpAddress)));
+  address = GNUNET_HELLO_address_allocate (plugin->env->my_identity,
+      PLUGIN_NAME, arg, args, GNUNET_HELLO_ADDRESS_INFO_NONE);
+  plugin->env->notify_address (plugin->env->cls, add_remove, address);
+  GNUNET_HELLO_address_free(address);
 }
 
 
@@ -584,13 +628,15 @@ tcp_nat_port_map_callback (void *cls, int add_remove,
  * address and that the next call to this function is allowed
  * to override the address again.
  *
- * @param cls closure ('struct Plugin*')
+ * @param cls closure (`struct Plugin*`)
  * @param addr binary address
- * @param addrlen length of the address
+ * @param addrlen length of @a addr
  * @return string representing the same address
  */
 static const char *
-tcp_address_to_string (void *cls, const void *addr, size_t addrlen)
+tcp_plugin_address_to_string (void *cls,
+                              const void *addr,
+                              size_t addrlen)
 {
   static char rbuf[INET6_ADDRSTRLEN + 12];
   char buf[INET6_ADDRSTRLEN];
@@ -605,41 +651,40 @@ tcp_address_to_string (void *cls, const void *addr, size_t addrlen)
 
   switch (addrlen)
   {
-  case sizeof (struct IPv6TcpAddress):
+  case sizeof(struct IPv6TcpAddress):
     t6 = addr;
     af = AF_INET6;
     port = ntohs (t6->t6_port);
     options = ntohl (t6->options);
-    memcpy (&a6, &t6->ipv6_addr, sizeof (a6));
+    memcpy (&a6, &t6->ipv6_addr, sizeof(a6));
     sb = &a6;
     break;
-  case sizeof (struct IPv4TcpAddress):
+  case sizeof(struct IPv4TcpAddress):
     t4 = addr;
     af = AF_INET;
     port = ntohs (t4->t4_port);
     options = ntohl (t4->options);
-    memcpy (&a4, &t4->ipv4_addr, sizeof (a4));
+    memcpy (&a4, &t4->ipv4_addr, sizeof(a4));
     sb = &a4;
     break;
-  case 0:
-    {
-      GNUNET_snprintf (rbuf, sizeof (rbuf), "%s",
-               TRANSPORT_SESSION_INBOUND_STRING);
-      return rbuf;
-    }
   default:
     LOG (GNUNET_ERROR_TYPE_WARNING,
-               _("Unexpected address length: %u bytes\n"),
-               (unsigned int) addrlen);
-    return NULL;
+         _("Unexpected address length: %u bytes\n"),
+         (unsigned int) addrlen);
+    return NULL ;
   }
   if (NULL == inet_ntop (af, sb, buf, INET6_ADDRSTRLEN))
   {
-    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "inet_ntop");
-    return NULL;
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "inet_ntop");
+    return NULL ;
   }
-  GNUNET_snprintf (rbuf, sizeof (rbuf), (af == AF_INET6) ? "%s.%u.[%s]:%u" : "%s.%u.%s:%u",
-                   PLUGIN_NAME, options, buf, port);
+  GNUNET_snprintf (rbuf, sizeof(rbuf),
+                   (af == AF_INET6) ? "%s.%u.[%s]:%u" : "%s.%u.%s:%u",
+                   PLUGIN_NAME,
+                   options,
+                   buf,
+                   port);
   return rbuf;
 }
 
@@ -648,7 +693,7 @@ tcp_address_to_string (void *cls, const void *addr, size_t addrlen)
  * Function called to convert a string address to
  * a binary address.
  *
- * @param cls closure ('struct Plugin*')
+ * @param cls closure (`struct Plugin*`)
  * @param addr string address
  * @param addrlen length of the address
  * @param buf location to store the buffer
@@ -657,10 +702,11 @@ tcp_address_to_string (void *cls, const void *addr, size_t addrlen)
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
  */
 static int
-tcp_string_to_address (void *cls,
-                       const char *addr,
-                       uint16_t addrlen,
-                       void **buf, size_t *added)
+tcp_plugin_string_to_address (void *cls,
+                              const char *addr,
+                              uint16_t addrlen,
+                              void **buf,
+                              size_t *added)
 {
   struct sockaddr_storage socket_address;
   char *address;
@@ -672,198 +718,391 @@ tcp_string_to_address (void *cls,
   address = NULL;
   plugin = NULL;
   optionstr = NULL;
-  if ((NULL == addr) || (addrlen == 0))
+  if ((NULL == addr) || (0 == addrlen))
   {
-    GNUNET_break (0);
+    GNUNET_break(0);
     return GNUNET_SYSERR;
   }
   if ('\0' != addr[addrlen - 1])
   {
-    GNUNET_break (0);
+    GNUNET_break(0);
     return GNUNET_SYSERR;
   }
   if (strlen (addr) != addrlen - 1)
   {
-    GNUNET_break (0);
+    GNUNET_break(0);
     return GNUNET_SYSERR;
   }
   plugin = GNUNET_strdup (addr);
   optionstr = strchr (plugin, '.');
   if (NULL == optionstr)
   {
-    GNUNET_break (0);
-    GNUNET_free (plugin);
+    GNUNET_break(0);
+    GNUNET_free(plugin);
     return GNUNET_SYSERR;
   }
   optionstr[0] = '\0';
-  optionstr ++;
+  optionstr++;
   options = atol (optionstr);
   address = strchr (optionstr, '.');
   if (NULL == address)
   {
-    GNUNET_break (0);
-    GNUNET_free (plugin);
+    GNUNET_break(0);
+    GNUNET_free(plugin);
     return GNUNET_SYSERR;
   }
   address[0] = '\0';
-  address ++;
+  address++;
 
   if (GNUNET_OK !=
-      GNUNET_STRINGS_to_address_ip (address, strlen (address),
+      GNUNET_STRINGS_to_address_ip (address,
+                                   strlen (address),
                                    &socket_address))
   {
-    GNUNET_break (0);
-    GNUNET_free (plugin);
+    GNUNET_break(0);
+    GNUNET_free(plugin);
     return GNUNET_SYSERR;
   }
 
-  GNUNET_free (plugin);
+  GNUNET_free(plugin);
   switch (socket_address.ss_family)
   {
   case AF_INET:
-    {
-      struct IPv4TcpAddress *t4;
-      struct sockaddr_in *in4 = (struct sockaddr_in *) &socket_address;
-      t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
-      t4->options =  htonl (options);
-      t4->ipv4_addr = in4->sin_addr.s_addr;
-      t4->t4_port = in4->sin_port;
-      *buf = t4;
-      *added = sizeof (struct IPv4TcpAddress);
-      return GNUNET_OK;
-    }
+  {
+    struct IPv4TcpAddress *t4;
+    struct sockaddr_in *in4 = (struct sockaddr_in *) &socket_address;
+    t4 = GNUNET_new (struct IPv4TcpAddress);
+    t4->options = htonl (options);
+    t4->ipv4_addr = in4->sin_addr.s_addr;
+    t4->t4_port = in4->sin_port;
+    *buf = t4;
+    *added = sizeof(struct IPv4TcpAddress);
+    return GNUNET_OK;
+  }
   case AF_INET6:
-    {
-      struct IPv6TcpAddress *t6;
-      struct sockaddr_in6 *in6 = (struct sockaddr_in6 *) &socket_address;
-      t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
-      t6->options = htonl (options);
-      t6->ipv6_addr = in6->sin6_addr;
-      t6->t6_port = in6->sin6_port;
-      *buf = t6;
-      *added = sizeof (struct IPv6TcpAddress);
-      return GNUNET_OK;
-    }
+  {
+    struct IPv6TcpAddress *t6;
+    struct sockaddr_in6 *in6 = (struct sockaddr_in6 *) &socket_address;
+    t6 = GNUNET_new (struct IPv6TcpAddress);
+    t6->options = htonl (options);
+    t6->ipv6_addr = in6->sin6_addr;
+    t6->t6_port = in6->sin6_port;
+    *buf = t6;
+    *added = sizeof(struct IPv6TcpAddress);
+    return GNUNET_OK;
+  }
   default:
     return GNUNET_SYSERR;
   }
 }
 
 
-struct SessionClientCtx
-{
-  const struct GNUNET_SERVER_Client *client;
-  struct Session *ret;
-};
-
-
-static int
-session_lookup_by_client_it (void *cls,
-                            const struct GNUNET_PeerIdentity *key,
-                            void *value)
-{
-  struct SessionClientCtx *sc_ctx = cls;
-  struct Session *s = value;
-
-  if (s->client == sc_ctx->client)
-  {
-    sc_ctx->ret = s;
-    return GNUNET_NO;
-  }
-  return GNUNET_YES;
-}
-
-
 /**
  * Find the session handle for the given client.
+ * Currently uses both the hashmap and the client
+ * context, as the client context is new and the
+ * logic still needs to be tested.
  *
  * @param plugin the plugin
  * @param client which client to find the session handle for
  * @return NULL if no matching session exists
  */
-static struct Session *
+static struct GNUNET_ATS_Session *
 lookup_session_by_client (struct Plugin *plugin,
-                         const struct GNUNET_SERVER_Client *client)
+                          struct GNUNET_SERVER_Client *client)
 {
-  struct SessionClientCtx sc_ctx;
-
-  sc_ctx.client = client;
-  sc_ctx.ret = NULL;
-  GNUNET_CONTAINER_multipeermap_iterate (plugin->sessionmap, &session_lookup_by_client_it, &sc_ctx);
-  return sc_ctx.ret;
+  return GNUNET_SERVER_client_get_user_context (client,
+                                                struct GNUNET_ATS_Session);
 }
 
 
 /**
- * Create a new session.  Also queues a welcome message.
+ * Functions with this signature are called whenever we need
+ * to close a session due to a disconnect or failure to
+ * establish a connection.
  *
- * @param plugin the plugin
- * @param target peer to connect to
- * @param client client to use, reference counter must have already been increased
- * @param is_nat this a NAT session, we should wait for a client to
- *               connect to us from an address, then assign that to
- *               the session
- * @return new session object
+ * @param cls the `struct Plugin`
+ * @param session session to close down
+ * @return #GNUNET_OK on success
  */
-static struct Session *
-create_session (struct Plugin *plugin,
-                const struct GNUNET_PeerIdentity *target,
-                struct GNUNET_SERVER_Client *client, int is_nat)
+static int
+tcp_plugin_disconnect_session (void *cls,
+                               struct GNUNET_ATS_Session *session)
 {
-  struct Session *session;
+  struct Plugin *plugin = cls;
   struct PendingMessage *pm;
-  struct WelcomeMessage welcome;
-
-  if (GNUNET_YES != is_nat)
-    GNUNET_assert (NULL != client);
-  else
-    GNUNET_assert (NULL == client);
 
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Creating new session for peer `%4s'\n",
-       GNUNET_i2s (target));
-  session = GNUNET_new (struct Session);
-  session->last_activity = GNUNET_TIME_absolute_get ();
-  session->plugin = plugin;
-  session->is_nat = is_nat;
-  session->client = client;
-  session->target = *target;
-  session->expecting_welcome = GNUNET_YES;
-  session->ats_address_network_type = GNUNET_ATS_NET_UNSPECIFIED;
-  pm = GNUNET_malloc (sizeof (struct PendingMessage) +
-                      sizeof (struct WelcomeMessage));
-  pm->msg = (const char *) &pm[1];
-  pm->message_size = sizeof (struct WelcomeMessage);
-  welcome.header.size = htons (sizeof (struct WelcomeMessage));
-  welcome.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME);
-  welcome.clientIdentity = *plugin->env->my_identity;
-  memcpy (&pm[1], &welcome, sizeof (welcome));
-  pm->timeout = GNUNET_TIME_UNIT_FOREVER_ABS;
-  GNUNET_STATISTICS_update (plugin->env->stats,
-                            gettext_noop ("# bytes currently in TCP buffers"),
-                            pm->message_size, GNUNET_NO);
-  GNUNET_CONTAINER_DLL_insert (session->pending_messages_head,
-                               session->pending_messages_tail, pm);
-  if (GNUNET_YES != is_nat)
+       "Disconnecting session of peer `%s' address `%s'\n",
+       GNUNET_i2s (&session->target),
+       tcp_plugin_address_to_string (session->plugin,
+                                     session->address->address,
+                                     session->address->address_length));
+
+  if (NULL != session->timeout_task)
   {
-    GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop ("# TCP sessions active"), 1,
-                              GNUNET_NO);
+    GNUNET_SCHEDULER_cancel (session->timeout_task);
+    session->timeout_task = NULL;
+    session->timeout = GNUNET_TIME_UNIT_ZERO_ABS;
   }
-  start_session_timeout (session);
 
-  return session;
-}
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multipeermap_remove (plugin->sessionmap,
+                                            &session->target,
+                                            session))
+  {
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                             gettext_noop ("# TCP sessions active"),
+                             -1,
+                             GNUNET_NO);
+  }
+  else
+  {
+    GNUNET_assert (GNUNET_YES ==
+                  GNUNET_CONTAINER_multipeermap_remove (plugin->nat_wait_conns,
+                                                        &session->target,
+                                                        session));
+  }
+  if (NULL != session->client)
+    GNUNET_SERVER_client_set_user_context (session->client,
+                                           NULL);
 
+  /* clean up state */
+  if (NULL != session->transmit_handle)
+  {
+    GNUNET_SERVER_notify_transmit_ready_cancel (session->transmit_handle);
+    session->transmit_handle = NULL;
+  }
+  session->plugin->env->session_end (session->plugin->env->cls,
+                                     session->address,
+                                     session);
 
-/**
- * If we have pending messages, ask the server to
- * transmit them (schedule the respective tasks, etc.)
- *
- * @param session for which session should we do this
+  if (NULL != session->nat_connection_timeout)
+  {
+    GNUNET_SCHEDULER_cancel (session->nat_connection_timeout);
+    session->nat_connection_timeout = NULL;
+  }
+
+  while (NULL != (pm = session->pending_messages_head))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         (NULL != pm->transmit_cont)
+         ? "Could not deliver message to `%s' at %s.\n"
+         : "Could not deliver message to `%s' at %s, notifying.\n",
+         GNUNET_i2s (&session->target),
+         tcp_plugin_address_to_string (session->plugin,
+                                       session->address->address,
+                                       session->address->address_length));
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop ("# bytes currently in TCP buffers"),
+                              -(int64_t) pm->message_size, GNUNET_NO);
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop ("# bytes discarded by TCP (disconnect)"),
+                              pm->message_size,
+                              GNUNET_NO);
+    GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
+                                 session->pending_messages_tail,
+                                 pm);
+    GNUNET_assert (0 < session->msgs_in_queue);
+    session->msgs_in_queue--;
+    GNUNET_assert (pm->message_size <= session->bytes_in_queue);
+    session->bytes_in_queue -= pm->message_size;
+    if (NULL != pm->transmit_cont)
+      pm->transmit_cont (pm->transmit_cont_cls,
+                         &session->target,
+                         GNUNET_SYSERR,
+                         pm->message_size,
+                         0);
+    GNUNET_free (pm);
+  }
+  GNUNET_assert (0 == session->msgs_in_queue);
+  GNUNET_assert (0 == session->bytes_in_queue);
+  notify_session_monitor (session->plugin,
+                          session,
+                          GNUNET_TRANSPORT_SS_DONE);
+
+  if (NULL != session->receive_delay_task)
+  {
+    GNUNET_SCHEDULER_cancel (session->receive_delay_task);
+    session->receive_delay_task = NULL;
+  }
+  if (NULL != session->client)
+  {
+    GNUNET_SERVER_client_disconnect (session->client);
+    session->client = NULL;
+  }
+  GNUNET_HELLO_address_free (session->address);
+  GNUNET_assert (NULL == session->transmit_handle);
+  GNUNET_free (session);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function that is called to get the keepalive factor.
+ * #GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT is divided by this number to
+ * calculate the interval between keepalive packets.
+ *
+ * @param cls closure with the `struct Plugin`
+ * @return keepalive factor
+ */
+static unsigned int
+tcp_plugin_query_keepalive_factor (void *cls)
+{
+  return 3;
+}
+
+
+/**
+ * Session was idle for too long, so disconnect it
+ *
+ * @param cls the `struct GNUNET_ATS_Session` of the idle session
+ * @param tc scheduler context
  */
 static void
-process_pending_messages (struct Session *session);
+session_timeout (void *cls,
+                 const struct GNUNET_SCHEDULER_TaskContext *tc)
+{
+  struct GNUNET_ATS_Session *s = cls;
+  struct GNUNET_TIME_Relative left;
+
+  s->timeout_task = NULL;
+  left = GNUNET_TIME_absolute_get_remaining (s->timeout);
+  if (0 != left.rel_value_us)
+  {
+    /* not actually our turn yet, but let's at least update
+       the monitor, it may think we're about to die ... */
+    notify_session_monitor (s->plugin,
+                            s,
+                            GNUNET_TRANSPORT_SS_UPDATE);
+    s->timeout_task = GNUNET_SCHEDULER_add_delayed (left,
+                                                    &session_timeout,
+                                                    s);
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Session %p was idle for %s, disconnecting\n",
+       s,
+       GNUNET_STRINGS_relative_time_to_string (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
+                                               GNUNET_YES));
+  /* call session destroy function */
+  tcp_plugin_disconnect_session (s->plugin,
+                                s);
+}
+
+
+/**
+ * Increment session timeout due to activity.
+ *
+ * @param s session to increment timeout for
+ */
+static void
+reschedule_session_timeout (struct GNUNET_ATS_Session *s)
+{
+  GNUNET_assert (NULL != s->timeout_task);
+  s->timeout = GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
+}
+
+
+/**
+ * Create a new session.  Also queues a welcome message.
+ *
+ * @param plugin the plugin
+ * @param address the address to create the session for
+ * @param scope network scope the address is from
+ * @param client client to use, reference counter must have already been increased
+ * @param is_nat this a NAT session, we should wait for a client to
+ *               connect to us from an address, then assign that to
+ *               the session
+ * @return new session object
+ */
+static struct GNUNET_ATS_Session *
+create_session (struct Plugin *plugin,
+                const struct GNUNET_HELLO_Address *address,
+                enum GNUNET_ATS_Network_Type scope,
+                struct GNUNET_SERVER_Client *client,
+                int is_nat)
+{
+  struct GNUNET_ATS_Session *session;
+  struct PendingMessage *pm;
+
+  if (GNUNET_YES != is_nat)
+    GNUNET_assert (NULL != client);
+  else
+    GNUNET_assert (NULL == client);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Creating new session for peer `%4s' at address %s\n",
+       GNUNET_i2s (&address->peer),
+       tcp_plugin_address_to_string (plugin,
+                                     address->address,
+                                     address->address_length));
+  session = GNUNET_new (struct GNUNET_ATS_Session);
+  session->last_activity = GNUNET_TIME_absolute_get ();
+  session->plugin = plugin;
+  session->is_nat = is_nat;
+  if (NULL != client)
+  {
+    session->client = client;
+    GNUNET_SERVER_client_set_user_context (client,
+                                           session);
+  }
+  session->address = GNUNET_HELLO_address_copy (address);
+  session->target = address->peer;
+  session->expecting_welcome = GNUNET_YES;
+  session->scope = scope;
+  pm = GNUNET_malloc (sizeof (struct PendingMessage) +
+                     sizeof (struct WelcomeMessage));
+  pm->msg = (const char *) &pm[1];
+  pm->message_size = sizeof(struct WelcomeMessage);
+  memcpy (&pm[1],
+          &plugin->my_welcome,
+          sizeof(struct WelcomeMessage));
+  pm->timeout = GNUNET_TIME_UNIT_FOREVER_ABS;
+  GNUNET_STATISTICS_update (plugin->env->stats,
+                            gettext_noop ("# bytes currently in TCP buffers"),
+                           pm->message_size,
+                            GNUNET_NO);
+  GNUNET_CONTAINER_DLL_insert (session->pending_messages_head,
+                               session->pending_messages_tail,
+                               pm);
+  session->msgs_in_queue++;
+  session->bytes_in_queue += pm->message_size;
+  session->timeout = GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
+  session->timeout_task = GNUNET_SCHEDULER_add_delayed (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
+                                                        &session_timeout,
+                                                        session);
+  notify_session_monitor (session->plugin,
+                          session,
+                          GNUNET_TRANSPORT_SS_INIT);
+  if (GNUNET_YES != is_nat)
+  {
+    GNUNET_STATISTICS_update (plugin->env->stats,
+                              gettext_noop ("# TCP sessions active"),
+                              1,
+                              GNUNET_NO);
+    notify_session_monitor (session->plugin,
+                            session,
+                            GNUNET_TRANSPORT_SS_UP);
+  }
+  else
+  {
+    notify_session_monitor (session->plugin,
+                            session,
+                            GNUNET_TRANSPORT_SS_HANDSHAKE);
+  }
+  return session;
+}
+
+
+/**
+ * If we have pending messages, ask the server to
+ * transmit them (schedule the respective tasks, etc.)
+ *
+ * @param session for which session should we do this
+ */
+static void
+process_pending_messages (struct GNUNET_ATS_Session *session);
 
 
 /**
@@ -873,14 +1112,16 @@ process_pending_messages (struct Session *session);
  * writing in the meantime.
  *
  * @param cls closure
- * @param size number of bytes available in buf
+ * @param size number of bytes available in @a buf
  * @param buf where the callee should write the message
- * @return number of bytes written to buf
+ * @return number of bytes written to @a buf
  */
 static size_t
-do_transmit (void *cls, size_t size, void *buf)
+do_transmit (void *cls,
+            size_t size,
+            void *buf)
 {
-  struct Session *session = cls;
+  struct GNUNET_ATS_Session *session = cls;
   struct GNUNET_PeerIdentity pid;
   struct Plugin *plugin;
   struct PendingMessage *pos;
@@ -890,29 +1131,37 @@ do_transmit (void *cls, size_t size, void *buf)
   char *cbuf;
   size_t ret;
 
-  GNUNET_assert (NULL != session);
   session->transmit_handle = NULL;
   plugin = session->plugin;
   if (NULL == buf)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Timeout trying to transmit to peer `%4s', discarding message queue.\n",
-        GNUNET_i2s (&session->target));
+         "Timeout trying to transmit to peer `%4s', discarding message queue.\n",
+         GNUNET_i2s (&session->target));
     /* timeout; cancel all messages that have already expired */
     hd = NULL;
     tl = NULL;
     ret = 0;
     now = GNUNET_TIME_absolute_get ();
-    while ((NULL != (pos = session->pending_messages_head)) &&
-           (pos->timeout.abs_value_us <= now.abs_value_us))
+    while ( (NULL != (pos = session->pending_messages_head)) &&
+            (pos->timeout.abs_value_us <= now.abs_value_us) )
     {
       GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                   session->pending_messages_tail, pos);
+                                   session->pending_messages_tail,
+                                   pos);
+      GNUNET_assert (0 < session->msgs_in_queue);
+      session->msgs_in_queue--;
+      GNUNET_assert (pos->message_size <= session->bytes_in_queue);
+      session->bytes_in_queue -= pos->message_size;
       LOG (GNUNET_ERROR_TYPE_DEBUG,
-          "Failed to transmit %u byte message to `%4s'.\n",
-          pos->message_size, GNUNET_i2s (&session->target));
+           "Failed to transmit %u byte message to `%4s'.\n",
+           pos->message_size,
+           GNUNET_i2s (&session->target));
       ret += pos->message_size;
-      GNUNET_CONTAINER_DLL_insert_after (hd, tl, tl, pos);
+      GNUNET_CONTAINER_DLL_insert_after (hd,
+                                         tl,
+                                         tl,
+                                         pos);
     }
     /* do this call before callbacks (so that if callbacks destroy
      * session, they have a chance to cancel actions done by this
@@ -923,18 +1172,28 @@ do_transmit (void *cls, size_t size, void *buf)
      * the callbacks may abort the session */
     while (NULL != (pos = hd))
     {
-      GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
-      if (pos->transmit_cont != NULL)
-        pos->transmit_cont (pos->transmit_cont_cls, &pid, GNUNET_SYSERR, pos->message_size, 0);
+      GNUNET_CONTAINER_DLL_remove (hd,
+                                   tl,
+                                   pos);
+      if (NULL != pos->transmit_cont)
+        pos->transmit_cont (pos->transmit_cont_cls,
+                            &pid,
+                            GNUNET_SYSERR,
+                            pos->message_size,
+                            0);
       GNUNET_free (pos);
     }
     GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop ("# bytes currently in TCP buffers"),
-                              -(int64_t) ret, GNUNET_NO);
+                              gettext_noop ("# bytes currently in TCP buffers"), -(int64_t) ret,
+                              GNUNET_NO);
     GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop
-                              ("# bytes discarded by TCP (timeout)"), ret,
+                              gettext_noop ("# bytes discarded by TCP (timeout)"),
+                              ret,
                               GNUNET_NO);
+    if (0 < ret)
+      notify_session_monitor (session->plugin,
+                              session,
+                              GNUNET_TRANSPORT_SS_UPDATE);
     return 0;
   }
   /* copy all pending messages that would fit */
@@ -947,18 +1206,35 @@ do_transmit (void *cls, size_t size, void *buf)
     if (ret + pos->message_size > size)
       break;
     GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                 session->pending_messages_tail, pos);
-    GNUNET_assert (size >= pos->message_size);
+                                 session->pending_messages_tail,
+                                 pos);
+    GNUNET_assert (0 < session->msgs_in_queue);
+    session->msgs_in_queue--;
+    GNUNET_assert (pos->message_size <= session->bytes_in_queue);
+    session->bytes_in_queue -= pos->message_size;
+    GNUNET_assert(size >= pos->message_size);
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Transmitting message of type %u\n",
-        ntohs (((struct GNUNET_MessageHeader *) pos->msg)->type));
+         "Transmitting message of type %u size %u to peer %s at %s\n",
+         ntohs (((struct GNUNET_MessageHeader *) pos->msg)->type),
+         pos->message_size,
+         GNUNET_i2s (&session->target),
+         tcp_plugin_address_to_string (session->plugin,
+                                       session->address->address,
+                                       session->address->address_length));
     /* FIXME: this memcpy can be up to 7% of our total runtime */
-    memcpy (cbuf, pos->msg, pos->message_size);
+    memcpy (cbuf,
+            pos->msg,
+            pos->message_size);
     cbuf += pos->message_size;
     ret += pos->message_size;
     size -= pos->message_size;
-    GNUNET_CONTAINER_DLL_insert_tail (hd, tl, pos);
+    GNUNET_CONTAINER_DLL_insert_tail (hd,
+                                      tl,
+                                      pos);
   }
+  notify_session_monitor (session->plugin,
+                          session,
+                          GNUNET_TRANSPORT_SS_UPDATE);
   /* schedule 'continuation' before callbacks so that callbacks that
    * cancel everything don't cause us to use a session that no longer
    * exists... */
@@ -970,19 +1246,23 @@ do_transmit (void *cls, size_t size, void *buf)
   while (NULL != (pos = hd))
   {
     GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
-    if (pos->transmit_cont != NULL)
-      pos->transmit_cont (pos->transmit_cont_cls, &pid, GNUNET_OK, pos->message_size, pos->message_size); /* FIXME: include TCP overhead */
+    if (NULL != pos->transmit_cont)
+      pos->transmit_cont (pos->transmit_cont_cls,
+                          &pid,
+                          GNUNET_OK,
+                          pos->message_size,
+                          pos->message_size); /* FIXME: include TCP overhead */
     GNUNET_free (pos);
   }
-  GNUNET_assert (hd == NULL);
-  GNUNET_assert (tl == NULL);
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Transmitting %u bytes\n",
-                   ret);
+  GNUNET_assert (NULL == hd);
+  GNUNET_assert (NULL == tl);
   GNUNET_STATISTICS_update (plugin->env->stats,
                             gettext_noop ("# bytes currently in TCP buffers"),
-                            -(int64_t) ret, GNUNET_NO);
+                            - (int64_t) ret,
+                            GNUNET_NO);
   GNUNET_STATISTICS_update (plugin->env->stats,
-                            gettext_noop ("# bytes transmitted via TCP"), ret,
+                            gettext_noop ("# bytes transmitted via TCP"),
+                            ret,
                             GNUNET_NO);
   return ret;
 }
@@ -995,165 +1275,25 @@ do_transmit (void *cls, size_t size, void *buf)
  * @param session for which session should we do this
  */
 static void
-process_pending_messages (struct Session *session)
+process_pending_messages (struct GNUNET_ATS_Session *session)
 {
   struct PendingMessage *pm;
 
-  GNUNET_assert (session->client != NULL);
-  if (session->transmit_handle != NULL)
+  GNUNET_assert (NULL != session->client);
+  if (NULL != session->transmit_handle)
     return;
   if (NULL == (pm = session->pending_messages_head))
     return;
 
-  session->transmit_handle =
-      GNUNET_SERVER_notify_transmit_ready (session->client, pm->message_size,
-                                           GNUNET_TIME_absolute_get_remaining
-                                           (pm->timeout), &do_transmit,
+  session->transmit_handle
+    = GNUNET_SERVER_notify_transmit_ready (session->client,
+                                           pm->message_size,
+                                           GNUNET_TIME_absolute_get_remaining (pm->timeout),
+                                           &do_transmit,
                                            session);
 }
 
 
-/**
- * Functions with this signature are called whenever we need
- * to close a session due to a disconnect or failure to
- * establish a connection.
- *
- * @param cls the `struct Plugin`
- * @param session session to close down
- * @return #GNUNET_OK on success
- */
-static int
-tcp_disconnect_session (void *cls,
-                        struct Session *session)
-{
-  struct Plugin *plugin = cls;
-  struct PendingMessage *pm;
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Disconnecting session of peer `%s' address `%s'\n",
-       GNUNET_i2s (&session->target),
-       tcp_address_to_string (NULL, session->addr, session->addrlen));
-
-  stop_session_timeout (session);
-
-  if (GNUNET_YES ==
-      GNUNET_CONTAINER_multipeermap_remove (plugin->sessionmap,
-                                            &session->target,
-                                            session))
-  {
-    GNUNET_STATISTICS_update (session->plugin->env->stats,
-                             gettext_noop ("# TCP sessions active"), -1,
-                             GNUNET_NO);
-    dec_sessions (plugin, session, __LINE__);
-  }
-  else
-  {
-    GNUNET_assert (GNUNET_YES ==
-                   GNUNET_CONTAINER_multipeermap_remove (plugin->nat_wait_conns,
-                                                         &session->target,
-                                                         session));
-  }
-  /* clean up state */
-  if (NULL != session->transmit_handle)
-  {
-    GNUNET_SERVER_notify_transmit_ready_cancel (session->transmit_handle);
-    session->transmit_handle = NULL;
-  }
-  session->plugin->env->session_end (session->plugin->env->cls,
-                                     &session->target, session);
-
-  if (GNUNET_SCHEDULER_NO_TASK != session->nat_connection_timeout)
-  {
-    GNUNET_SCHEDULER_cancel (session->nat_connection_timeout);
-    session->nat_connection_timeout = GNUNET_SCHEDULER_NO_TASK;
-  }
-
-  while (NULL != (pm = session->pending_messages_head))
-  {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-        pm->transmit_cont !=
-        NULL ? "Could not deliver message to `%4s'.\n" :
-        "Could not deliver message to `%4s', notifying.\n",
-        GNUNET_i2s (&session->target));
-    GNUNET_STATISTICS_update (session->plugin->env->stats,
-                              gettext_noop ("# bytes currently in TCP buffers"),
-                              -(int64_t) pm->message_size, GNUNET_NO);
-    GNUNET_STATISTICS_update (session->plugin->env->stats,
-                              gettext_noop
-                              ("# bytes discarded by TCP (disconnect)"),
-                              pm->message_size, GNUNET_NO);
-    GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                 session->pending_messages_tail, pm);
-    if (NULL != pm->transmit_cont)
-      pm->transmit_cont (pm->transmit_cont_cls, &session->target,
-                         GNUNET_SYSERR, pm->message_size, 0);
-    GNUNET_free (pm);
-  }
-  if (session->receive_delay_task != GNUNET_SCHEDULER_NO_TASK)
-  {
-    GNUNET_SCHEDULER_cancel (session->receive_delay_task);
-    if (NULL != session->client)
-      GNUNET_SERVER_receive_done (session->client, GNUNET_SYSERR);
-  }
-  if (NULL != session->client)
-  {
-    GNUNET_SERVER_client_disconnect (session->client);
-    GNUNET_SERVER_client_drop (session->client);
-    session->client = NULL;
-  }
-  GNUNET_free_non_null (session->addr);
-  GNUNET_assert (NULL == session->transmit_handle);
-  GNUNET_free (session);
-  return GNUNET_OK;
-}
-
-
-struct FindSessionContext
-{
-  struct Session *s;
-  int res;
-};
-
-
-static int
-session_it (void *cls,
-           const struct GNUNET_PeerIdentity * key,
-           void *value)
-{
-  struct FindSessionContext *res = cls;
-
-  if (res->s == value)
-  {
-    res->res = GNUNET_OK;
-    return GNUNET_NO;
-  }
-  return GNUNET_YES;
-}
-
-
-static int
-find_session (struct Plugin *plugin, struct Session *session)
-{
-  struct FindSessionContext session_map_res;
-  struct FindSessionContext nat_map_res;
-
-  session_map_res.s = session;
-  session_map_res.res = GNUNET_SYSERR;
-  GNUNET_CONTAINER_multipeermap_iterate (plugin->sessionmap, &session_it, &session_map_res);
-
-  nat_map_res.s = session;
-  nat_map_res.res = GNUNET_SYSERR;
-  GNUNET_CONTAINER_multipeermap_iterate (plugin->nat_wait_conns, &session_it, &nat_map_res);
-
-  if ((session_map_res.res == GNUNET_SYSERR) && (nat_map_res.res == GNUNET_SYSERR))
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
-}
-
-
 /**
  * Function that can be used by the transport service to transmit
  * a message using the plugin.   Note that in the case of a
@@ -1165,7 +1305,7 @@ find_session (struct Plugin *plugin, struct Session *session)
  * @param cls closure
  * @param session which session must be used
  * @param msgbuf the message to transmit
- * @param msgbuf_size number of bytes in 'msgbuf'
+ * @param msgbuf_size number of bytes in @a msgbuf
  * @param priority how important is the message (most plugins will
  *                 ignore message priority and just FIFO)
  * @param to how long to wait at most for the transmission (does not
@@ -1183,25 +1323,17 @@ find_session (struct Plugin *plugin, struct Session *session)
  */
 static ssize_t
 tcp_plugin_send (void *cls,
-    struct Session *session,
-    const char *msgbuf, size_t msgbuf_size,
-    unsigned int priority,
-    struct GNUNET_TIME_Relative to,
-    GNUNET_TRANSPORT_TransmitContinuation cont, void *cont_cls)
+                 struct GNUNET_ATS_Session *session,
+                 const char *msgbuf,
+                 size_t msgbuf_size,
+                 unsigned int priority,
+                 struct GNUNET_TIME_Relative to,
+                 GNUNET_TRANSPORT_TransmitContinuation cont,
+                 void *cont_cls)
 {
   struct Plugin * plugin = cls;
   struct PendingMessage *pm;
 
-  GNUNET_assert (NULL != plugin);
-  GNUNET_assert (NULL != session);
-
-  if (GNUNET_SYSERR == find_session(plugin, session))
-  {
-      LOG (GNUNET_ERROR_TYPE_ERROR,
-           _("Trying to send with invalid session %p\n"));
-      return GNUNET_SYSERR;
-  }
-
   /* create new message entry */
   pm = GNUNET_malloc (sizeof (struct PendingMessage) + msgbuf_size);
   pm->msg = (const char *) &pm[1];
@@ -1211,105 +1343,111 @@ tcp_plugin_send (void *cls,
   pm->transmit_cont = cont;
   pm->transmit_cont_cls = cont_cls;
 
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Asked to transmit %u bytes to `%s', added message to list.\n",
-       msgbuf_size, GNUNET_i2s (&session->target));
+  LOG(GNUNET_ERROR_TYPE_DEBUG,
+      "Asked to transmit %u bytes to `%s', added message to list.\n",
+      msgbuf_size,
+      GNUNET_i2s (&session->target));
 
-  if (GNUNET_YES == GNUNET_CONTAINER_multipeermap_contains_value (plugin->sessionmap,
-                                                                 &session->target,
-                                                                 session))
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multipeermap_contains_value (plugin->sessionmap,
+                                                    &session->target,
+                                                    session))
   {
-    GNUNET_assert (session->client != NULL);
-    reschedule_session_timeout (session);
+    GNUNET_assert (NULL != session->client);
     GNUNET_SERVER_client_set_timeout (session->client,
                                       GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
     GNUNET_STATISTICS_update (plugin->env->stats,
                               gettext_noop ("# bytes currently in TCP buffers"),
-                              msgbuf_size, GNUNET_NO);
+                              msgbuf_size,
+                              GNUNET_NO);
 
     /* append pm to pending_messages list */
     GNUNET_CONTAINER_DLL_insert_tail (session->pending_messages_head,
-                                      session->pending_messages_tail, pm);
-
+                                      session->pending_messages_tail,
+                                      pm);
+    notify_session_monitor (session->plugin,
+                            session,
+                            GNUNET_TRANSPORT_SS_UPDATE);
+    session->msgs_in_queue++;
+    session->bytes_in_queue += pm->message_size;
     process_pending_messages (session);
     return msgbuf_size;
   }
-  else if (GNUNET_YES == GNUNET_CONTAINER_multipeermap_contains_value(plugin->nat_wait_conns, &session->target, session))
+  if (GNUNET_YES ==
+      GNUNET_CONTAINER_multipeermap_contains_value (plugin->nat_wait_conns,
+                                                    &session->target,
+                                                    session))
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "This NAT WAIT session for peer `%s' is not yet ready!\n",
-        GNUNET_i2s (&session->target));
-    reschedule_session_timeout (session);
+         "This NAT WAIT session for peer `%s' is not yet ready!\n",
+         GNUNET_i2s (&session->target));
     GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop ("# bytes currently in TCP buffers"),
-                              msgbuf_size, GNUNET_NO);
-
+                              gettext_noop ("# bytes currently in TCP buffers"), msgbuf_size,
+                              GNUNET_NO);
     /* append pm to pending_messages list */
     GNUNET_CONTAINER_DLL_insert_tail (session->pending_messages_head,
-                                      session->pending_messages_tail, pm);
+                                      session->pending_messages_tail,
+                                      pm);
+    session->msgs_in_queue++;
+    session->bytes_in_queue += pm->message_size;
+    notify_session_monitor (session->plugin,
+                            session,
+                            GNUNET_TRANSPORT_SS_HANDSHAKE);
     return msgbuf_size;
   }
-  else
-  {
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-         "Invalid session %p\n", session);
-    if (NULL != cont)
-      cont (cont_cls, &session->target, GNUNET_SYSERR, pm->message_size, 0);
-    GNUNET_break (0);
-    GNUNET_free (pm);
-    return GNUNET_SYSERR; /* session does not exist here */
-  }
+  LOG (GNUNET_ERROR_TYPE_ERROR,
+       "Invalid session %p\n",
+       session);
+  if (NULL != cont)
+    cont (cont_cls,
+          &session->target,
+          GNUNET_SYSERR,
+          pm->message_size,
+          0);
+  GNUNET_break (0);
+  GNUNET_free (pm);
+  return GNUNET_SYSERR; /* session does not exist here */
 }
 
 
-struct SessionItCtx
+/**
+ * Closure for #session_lookup_it().
+ */
+struct GNUNET_ATS_SessionItCtx
 {
-  void *addr;
-  size_t addrlen;
-  struct Session *result;
+  /**
+   * Address we are looking for.
+   */
+  const struct GNUNET_HELLO_Address *address;
+
+  /**
+   * Where to store the session (if we found it).
+   */
+  struct GNUNET_ATS_Session *result;
+
 };
 
 
+/**
+ * Look for a session by address.
+ *
+ * @param cls the `struct GNUNET_ATS_SessionItCtx`
+ * @param key unused
+ * @param value a `struct GNUNET_ATS_Session`
+ * @return #GNUNET_YES to continue looking, #GNUNET_NO if we found the session
+ */
 static int
 session_lookup_it (void *cls,
-                  const struct GNUNET_PeerIdentity *key,
-                  void *value)
+                   const struct GNUNET_PeerIdentity *key,
+                   void *value)
 {
-  struct SessionItCtx * si_ctx = cls;
-  struct Session * session = value;
-#if 0
-  char * a1 = strdup (tcp_address_to_string(NULL, session->addr, session->addrlen));
-  char * a2 = strdup (tcp_address_to_string(NULL, si_ctx->addr, si_ctx->addrlen));
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Comparing: %s %u <-> %s %u\n",
-       a1,
-       session->addrlen,
-       a2,
-       si_ctx->addrlen);
-  GNUNET_free (a1);
-  GNUNET_free (a2);
-#endif
-  if (session->addrlen != si_ctx->addrlen)
-  {
-    return GNUNET_YES;
-  }
-  if (0 != memcmp (session->addr, si_ctx->addr, si_ctx->addrlen))
-  {
+  struct GNUNET_ATS_SessionItCtx *si_ctx = cls;
+  struct GNUNET_ATS_Session *session = value;
+
+  if (0 !=
+      GNUNET_HELLO_address_cmp (si_ctx->address,
+                                session->address))
     return GNUNET_YES;
-  }
-#if 0
-  a1 = strdup (tcp_address_to_string(NULL, session->addr, session->addrlen));
-  a2 = strdup (tcp_address_to_string(NULL, si_ctx->addr, si_ctx->addrlen));
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Comparing: %s %u <-> %s %u , OK!\n",
-       a1,
-       session->addrlen,
-       a2,
-       si_ctx->addrlen);
-  GNUNET_free (a1);
-  GNUNET_free (a2);
-#endif
-  /* Found existing session */
   si_ctx->result = session;
   return GNUNET_NO;
 }
@@ -1317,21 +1455,93 @@ session_lookup_it (void *cls,
 
 /**
  * Task cleaning up a NAT connection attempt after timeout
+ *
+ * @param cls the `struct GNUNET_ATS_Session`
+ * @param tc scheduler context (unused)
  */
 static void
 nat_connect_timeout (void *cls,
                      const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
-  struct Session *session = cls;
+  struct GNUNET_ATS_Session *session = cls;
 
-  session->nat_connection_timeout = GNUNET_SCHEDULER_NO_TASK;
+  session->nat_connection_timeout = NULL;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "NAT WAIT connection to `%4s' at `%s' could not be established, removing session\n",
        GNUNET_i2s (&session->target),
-       tcp_address_to_string (NULL,
-                              session->addr, session->addrlen));
-  tcp_disconnect_session (session->plugin,
-                          session);
+       tcp_plugin_address_to_string (session->plugin,
+                                     session->address->address,
+                                     session->address->address_length));
+  tcp_plugin_disconnect_session (session->plugin,
+                                 session);
+}
+
+
+/**
+ * Function that will be called whenever the transport service wants to
+ * notify the plugin that a session is still active and in use and
+ * therefore the session timeout for this session has to be updated
+ *
+ * @param cls closure
+ * @param peer which peer was the session for
+ * @param session which session is being updated
+ */
+static void
+tcp_plugin_update_session_timeout (void *cls,
+                                   const struct GNUNET_PeerIdentity *peer,
+                                   struct GNUNET_ATS_Session *session)
+{
+  reschedule_session_timeout (session);
+}
+
+
+/**
+ * Task to signal the server that we can continue
+ * receiving from the TCP client now.
+ *
+ * @param cls the `struct GNUNET_ATS_Session *`
+ * @param tc task context (unused)
+ */
+static void
+delayed_done (void *cls,
+              const struct GNUNET_SCHEDULER_TaskContext *tc)
+{
+  struct GNUNET_ATS_Session *session = cls;
+
+  session->receive_delay_task = NULL;
+  reschedule_session_timeout (session);
+  GNUNET_SERVER_receive_done (session->client,
+                             GNUNET_OK);
+}
+
+
+/**
+ * Function that will be called whenever the transport service wants to
+ * notify the plugin that the inbound quota changed and that the plugin
+ * should update it's delay for the next receive value
+ *
+ * @param cls closure
+ * @param peer which peer was the session for
+ * @param session which session is being updated
+ * @param delay new delay to use for receiving
+ */
+static void
+tcp_plugin_update_inbound_delay (void *cls,
+                                 const struct GNUNET_PeerIdentity *peer,
+                                 struct GNUNET_ATS_Session *session,
+                                 struct GNUNET_TIME_Relative delay)
+{
+  if (NULL == session->receive_delay_task)
+    return;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "New inbound delay %s\n",
+       GNUNET_STRINGS_relative_time_to_string (delay,
+                                               GNUNET_NO));
+  session->receive_delay = GNUNET_TIME_relative_to_absolute (delay);
+  GNUNET_SCHEDULER_cancel (session->receive_delay_task);
+  session->receive_delay_task = GNUNET_SCHEDULER_add_delayed (delay,
+                                                              &delayed_done,
+                                                              session);
 }
 
 
@@ -1341,15 +1551,15 @@ nat_connect_timeout (void *cls,
  * notify us by calling the env->session_end function
  *
  * @param cls closure
- * @param address pointer to the GNUNET_HELLO_Address
+ * @param address the address to use
  * @return the session if the address is valid, NULL otherwise
  */
-static struct Session *
+static struct GNUNET_ATS_Session *
 tcp_plugin_get_session (void *cls,
-                       const struct GNUNET_HELLO_Address *address)
+                        const struct GNUNET_HELLO_Address *address)
 {
   struct Plugin *plugin = cls;
-  struct Session *session = NULL;
+  struct GNUNET_ATS_Session *session = NULL;
   int af;
   const void *sb;
   size_t sbs;
@@ -1358,55 +1568,62 @@ tcp_plugin_get_session (void *cls,
   struct sockaddr_in6 a6;
   const struct IPv4TcpAddress *t4;
   const struct IPv6TcpAddress *t6;
-  struct GNUNET_ATS_Information ats;
+  unsigned int options;
+  enum GNUNET_ATS_Network_Type net_type;
   unsigned int is_natd = GNUNET_NO;
   size_t addrlen;
+#ifdef TCP_STEALTH
+  struct GNUNET_NETWORK_Handle *s;
+#endif
 
-  GNUNET_assert (plugin != NULL);
-  GNUNET_assert (address != NULL);
   addrlen = address->address_length;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Trying to get session for `%s' address of peer `%s'\n",
-       tcp_address_to_string(NULL, address->address, address->address_length),
+       tcp_plugin_address_to_string (plugin,
+                                     address->address,
+                                     address->address_length),
        GNUNET_i2s (&address->peer));
 
+  if (GNUNET_HELLO_address_check_option (address,
+                                         GNUNET_HELLO_ADDRESS_INFO_INBOUND))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+
   /* look for existing session */
   if (GNUNET_YES ==
       GNUNET_CONTAINER_multipeermap_contains (plugin->sessionmap,
-                                             &address->peer))
+                                              &address->peer))
   {
-    struct SessionItCtx si_ctx;
-
-    si_ctx.addr = (void *) address->address;
-    si_ctx.addrlen = address->address_length;
+    struct GNUNET_ATS_SessionItCtx si_ctx;
 
+    si_ctx.address = address;
     si_ctx.result = NULL;
-
     GNUNET_CONTAINER_multipeermap_get_multiple (plugin->sessionmap,
-                                               &address->peer,
-                                               &session_lookup_it, &si_ctx);
-    if (si_ctx.result != NULL)
+                                                &address->peer,
+                                                &session_lookup_it,
+                                               &si_ctx);
+    if (NULL != si_ctx.result)
     {
       session = si_ctx.result;
       LOG (GNUNET_ERROR_TYPE_DEBUG,
-          "Found existing session for `%s' address `%s' session %p\n",
-          GNUNET_i2s (&address->peer),
-          tcp_address_to_string(NULL, address->address, address->address_length),
-          session);
+           "Found existing session for `%s' address `%s'\n",
+           GNUNET_i2s (&address->peer),
+           tcp_plugin_address_to_string (plugin,
+                                         address->address,
+                                         address->address_length));
       return session;
     }
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Existing sessions did not match address `%s' or peer `%s'\n",
-        tcp_address_to_string(NULL, address->address, address->address_length),
-        GNUNET_i2s (&address->peer));
   }
 
-  if (addrlen == sizeof (struct IPv6TcpAddress))
+  if (addrlen == sizeof(struct IPv6TcpAddress))
   {
-    GNUNET_assert (NULL != address->address);     /* make static analysis happy */
+    GNUNET_assert (NULL != address->address); /* make static analysis happy */
     t6 = address->address;
+    options = t6->options;
     af = AF_INET6;
-    memset (&a6, 0, sizeof (a6));
+    memset (&a6, 0, sizeof(a6));
 #if HAVE_SOCKADDR_IN_SIN_LEN
     a6.sin6_len = sizeof (a6);
 #endif
@@ -1414,16 +1631,17 @@ tcp_plugin_get_session (void *cls,
     a6.sin6_port = t6->t6_port;
     if (t6->t6_port == 0)
       is_natd = GNUNET_YES;
-    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof (struct in6_addr));
+    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof(struct in6_addr));
     sb = &a6;
-    sbs = sizeof (a6);
+    sbs = sizeof(a6);
   }
-  else if (addrlen == sizeof (struct IPv4TcpAddress))
+  else if (addrlen == sizeof(struct IPv4TcpAddress))
   {
-    GNUNET_assert (NULL != address->address);     /* make static analysis happy */
+    GNUNET_assert(NULL != address->address); /* make static analysis happy */
     t4 = address->address;
+    options = t4->options;
     af = AF_INET;
-    memset (&a4, 0, sizeof (a4));
+    memset (&a4, 0, sizeof(a4));
 #if HAVE_SOCKADDR_IN_SIN_LEN
     a4.sin_len = sizeof (a4);
 #endif
@@ -1433,20 +1651,24 @@ tcp_plugin_get_session (void *cls,
       is_natd = GNUNET_YES;
     a4.sin_addr.s_addr = t4->ipv4_addr;
     sb = &a4;
-    sbs = sizeof (a4);
+    sbs = sizeof(a4);
   }
   else
   {
     GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop
-                              ("# requests to create session with invalid address"),
-                              1, GNUNET_NO);
+                              gettext_noop ("# requests to create session with invalid address"),
+                              1,
+                              GNUNET_NO);
     return NULL;
   }
 
-  ats = plugin->env->get_address_type (plugin->env->cls, sb, sbs);
+  net_type = plugin->env->get_address_type (plugin->env->cls,
+                                            sb,
+                                            sbs);
+  GNUNET_break (net_type != GNUNET_ATS_NET_UNSPECIFIED);
 
-  if ((is_natd == GNUNET_YES) && (addrlen == sizeof (struct IPv6TcpAddress)))
+  if ( (is_natd == GNUNET_YES) &&
+       (addrlen == sizeof(struct IPv6TcpAddress)) )
   {
     /* NAT client only works with IPv4 addresses */
     return NULL;
@@ -1458,309 +1680,274 @@ tcp_plugin_get_session (void *cls,
     return NULL;
   }
 
-  if ((is_natd == GNUNET_YES) &&
-      (GNUNET_YES ==
-       GNUNET_CONTAINER_multipeermap_contains (plugin->nat_wait_conns,
-                                               &address->peer)))
+  if ( (is_natd == GNUNET_YES) &&
+       (GNUNET_YES ==
+       GNUNET_CONTAINER_multipeermap_contains (plugin->nat_wait_conns,
+                                               &address->peer)))
   {
     /* Only do one NAT punch attempt per peer identity */
-     return NULL;
+    return NULL;
   }
 
-  if ((is_natd == GNUNET_YES) && (NULL != plugin->nat) &&
-      (GNUNET_NO ==
-       GNUNET_CONTAINER_multipeermap_contains (plugin->nat_wait_conns,
-                                               &address->peer)))
+  if ( (is_natd == GNUNET_YES) &&
+       (NULL != plugin->nat) &&
+       (GNUNET_NO ==
+        GNUNET_CONTAINER_multipeermap_contains (plugin->nat_wait_conns,
+                                                &address->peer)))
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Found valid IPv4 NAT address (creating session)!\n") ;
+         "Found valid IPv4 NAT address (creating session)!\n");
     session = create_session (plugin,
-                              &address->peer,
+                              address,
+                              net_type,
                               NULL,
                               GNUNET_YES);
-    session->addrlen = 0;
-    session->addr = NULL;
-    session->ats_address_network_type = (enum GNUNET_ATS_Network_Type) ntohl (ats.value)
-;
-    GNUNET_break (session->ats_address_network_type != GNUNET_ATS_NET_UNSPECIFIED);
     session->nat_connection_timeout = GNUNET_SCHEDULER_add_delayed (NAT_TIMEOUT,
-                                                                   &nat_connect_timeout,
-                                                                   session);
-    GNUNET_assert (session != NULL);
+                                                                    &nat_connect_timeout,
+                                                                    session);
     GNUNET_assert (GNUNET_OK ==
-                  GNUNET_CONTAINER_multipeermap_put (plugin->nat_wait_conns,
-                                                     &session->target,
-                                                     session,
-                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+                   GNUNET_CONTAINER_multipeermap_put (plugin->nat_wait_conns,
+                                                      &session->target,
+                                                      session,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
 
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Created NAT WAIT connection to `%4s' at `%s'\n",
-        GNUNET_i2s (&session->target), GNUNET_a2s (sb, sbs));
-
+         "Created NAT WAIT connection to `%4s' at `%s'\n",
+         GNUNET_i2s (&session->target),
+         GNUNET_a2s (sb, sbs));
     if (GNUNET_OK == GNUNET_NAT_run_client (plugin->nat, &a4))
+    {
       return session;
+    }
     else
     {
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-          "Running NAT client for `%4s' at `%s' failed\n",
-          GNUNET_i2s (&session->target), GNUNET_a2s (sb, sbs));
-      tcp_disconnect_session (plugin, session);
+      LOG(GNUNET_ERROR_TYPE_DEBUG,
+          "Running NAT client for `%4s' at `%s' failed\n",
+          GNUNET_i2s (&session->target),
+          GNUNET_a2s (sb, sbs));
+      tcp_plugin_disconnect_session (plugin,
+                                     session);
       return NULL;
     }
   }
 
   /* create new outbound session */
-  GNUNET_assert (plugin->cur_connections <= plugin->max_connections);
-  sa = GNUNET_CONNECTION_create_from_sockaddr (af, sb, sbs);
-  if (sa == NULL)
+  if (0 != (options & TCP_OPTIONS_TCP_STEALTH))
+  {
+#ifdef TCP_STEALTH
+    s = GNUNET_NETWORK_socket_create (af, SOCK_STREAM, 0);
+    if (NULL == s)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING | GNUNET_ERROR_TYPE_BULK,
+                           "socket");
+      sa = NULL;
+    }
+    else
+    {
+      if ( (GNUNET_OK !=
+            GNUNET_NETWORK_socket_setsockopt (s,
+                                              IPPROTO_TCP,
+                                              TCP_STEALTH,
+                                              &session->target,
+                                              sizeof (struct GNUNET_PeerIdentity))) ||
+           (GNUNET_OK !=
+            GNUNET_NETWORK_socket_setsockopt (s,
+                                              IPPROTO_TCP,
+                                              TCP_STEALTH_INTEGRITY,
+                                              &plugin->my_welcome,
+                                              sizeof (struct WelcomeMessage))) )
+      {
+        /* TCP STEALTH not supported by kernel */
+        GNUNET_break (GNUNET_OK ==
+                      GNUNET_NETWORK_socket_close (s));
+        sa = NULL;
+      }
+      else
+      {
+        sa = GNUNET_CONNECTION_connect_socket (s, sb, sbs);
+      }
+    }
+#else
+    sa = NULL;
+#endif
+  }
+  else
+  {
+    sa = GNUNET_CONNECTION_create_from_sockaddr (af, sb, sbs);
+  }
+  if (NULL == sa)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Failed to create connection to `%4s' at `%s'\n",
-        GNUNET_i2s (&address->peer), GNUNET_a2s (sb, sbs));
+         "Failed to create connection to `%4s' at `%s'\n",
+         GNUNET_i2s (&address->peer),
+         GNUNET_a2s (sb, sbs));
     return NULL;
   }
-  plugin->cur_connections++;
-  if (plugin->cur_connections == plugin->max_connections)
-       GNUNET_SERVER_suspend (plugin->server); /* Maximum number of connections rechead */
-
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Asked to transmit to `%4s', creating fresh session using address `%s'.\n",
-       GNUNET_i2s (&address->peer), GNUNET_a2s (sb, sbs));
+       GNUNET_i2s (&address->peer),
+       GNUNET_a2s (sb, sbs));
 
   session = create_session (plugin,
-                            &address->peer,
-                            GNUNET_SERVER_connect_socket (plugin->server, sa),
+                            address,
+                            net_type,
+                            GNUNET_SERVER_connect_socket (plugin->server,
+                                                          sa),
                             GNUNET_NO);
-  session->addr = GNUNET_malloc (addrlen);
-  memcpy (session->addr, address->address, addrlen);
-  session->addrlen = addrlen;
-  session->ats_address_network_type = (enum GNUNET_ATS_Network_Type) ntohl (ats.value);
-  GNUNET_break (session->ats_address_network_type != GNUNET_ATS_NET_UNSPECIFIED);
-  GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
-                                    &session->target,
-                                    session, GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-  inc_sessions (plugin, session, __LINE__);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Creating new session for `%s' address `%s' session %p\n",
-       GNUNET_i2s (&address->peer),
-       tcp_address_to_string(NULL, address->address, address->address_length),
-       session);
+  (void) GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
+                                            &session->target,
+                                            session,
+                                            GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
   /* Send TCP Welcome */
   process_pending_messages (session);
 
   return session;
-}
-
-
-static int
-session_disconnect_it (void *cls,
-                      const struct GNUNET_PeerIdentity *key,
-                      void *value)
-{
-  struct Plugin *plugin = cls;
-  struct Session *session = value;
-
-  GNUNET_STATISTICS_update (session->plugin->env->stats,
-                            gettext_noop
-                            ("# transport-service disconnect requests for TCP"),
-                            1, GNUNET_NO);
-  tcp_disconnect_session (plugin,
-                          session);
-  return GNUNET_YES;
-}
-
-
-/**
- * Function that can be called to force a disconnect from the
- * specified neighbour.  This should also cancel all previously
- * scheduled transmissions.  Obviously the transmission may have been
- * partially completed already, which is OK.  The plugin is supposed
- * to close the connection (if applicable) and no longer call the
- * transmit continuation(s).
- *
- * Finally, plugin MUST NOT call the services's receive function to
- * notify the service that the connection to the specified target was
- * closed after a getting this call.
- *
- * @param cls closure
- * @param target peer for which the last transmission is
- *        to be cancelled
- */
-static void
-tcp_plugin_disconnect (void *cls, const struct GNUNET_PeerIdentity *target)
-{
-  struct Plugin *plugin = cls;
-
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Disconnecting peer `%4s'\n", GNUNET_i2s (target));
-  GNUNET_CONTAINER_multipeermap_get_multiple (plugin->sessionmap, target,
-                                             &session_disconnect_it, plugin);
-  GNUNET_CONTAINER_multipeermap_get_multiple (plugin->nat_wait_conns, target,
-                                             &session_disconnect_it, plugin);
-}
-
-
-/**
- * Running pretty printers: head
- */
-static struct PrettyPrinterContext *ppc_dll_head;
-
-/**
- * Running pretty printers: tail
- */
-static struct PrettyPrinterContext *ppc_dll_tail;
-
-/**
- * Context for address to string conversion.
- */
-struct PrettyPrinterContext
-{
-  /**
-   * DLL
-   */
-  struct PrettyPrinterContext *next;
-
-  /**
-   * DLL
-   */
-  struct PrettyPrinterContext *prev;
-
-  /**
-   * Timeout task
-   */
-  GNUNET_SCHEDULER_TaskIdentifier timeout_task;
-
-  /**
-   * Resolver handle
-   */
-  struct GNUNET_RESOLVER_RequestHandle *resolver_handle;
-
-  /**
-   * Function to call with the result.
-   */
-  GNUNET_TRANSPORT_AddressStringCallback asc;
-
-  /**
-   * Clsoure for 'asc'.
-   */
-  void *asc_cls;
-
-  /**
-   * Port to add after the IP address.
-   */
-  uint16_t port;
-
-  /**
-   * IPv6 address
-   */
-  int ipv6;
+}
 
-  /**
-   * Options
-   */
-  uint32_t options;
-};
+
+/**
+ * We have been asked to destroy all connections to a particular peer.
+ * This function is called on each applicable session and must tear it
+ * down.
+ *
+ * @param cls the `struct Plugin *`
+ * @param key the peer which the session belongs to (unused)
+ * @param value the `struct GNUNET_ATS_Session`
+ * @return #GNUNET_YES (continue to iterate)
+ */
+static int
+session_disconnect_it (void *cls,
+                       const struct GNUNET_PeerIdentity *key,
+                       void *value)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_ATS_Session *session = value;
+
+  GNUNET_STATISTICS_update (session->plugin->env->stats,
+                            gettext_noop ("# transport-service disconnect requests for TCP"),
+                            1,
+                            GNUNET_NO);
+  tcp_plugin_disconnect_session (plugin,
+                                 session);
+  return GNUNET_YES;
+}
 
 
+/**
+ * Function that can be called to force a disconnect from the
+ * specified neighbour.  This should also cancel all previously
+ * scheduled transmissions.  Obviously the transmission may have been
+ * partially completed already, which is OK.  The plugin is supposed
+ * to close the connection (if applicable) and no longer call the
+ * transmit continuation(s).
+ *
+ * Finally, plugin MUST NOT call the services's receive function to
+ * notify the service that the connection to the specified target was
+ * closed after a getting this call.
+ *
+ * @param cls closure
+ * @param target peer for which the last transmission is
+ *        to be cancelled
+ */
 static void
-ppc_cancel_task (void *cls,
-                 const struct GNUNET_SCHEDULER_TaskContext *tc)
+tcp_plugin_disconnect (void *cls,
+                       const struct GNUNET_PeerIdentity *target)
 {
-  int count = 0;
-  struct PrettyPrinterContext *ppc = cls;
-  struct PrettyPrinterContext *cur;
-
-  for (cur = ppc_dll_head; (NULL != cur); cur = cur->next)
-  {
-    if (cur != ppc)
-      count++;
-  }
+  struct Plugin *plugin = cls;
 
-  // GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Cancel request %p, %u pending\n", ppc, count);
-  ppc->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  if (NULL != ppc->resolver_handle)
-  {
-    GNUNET_RESOLVER_request_cancel (ppc->resolver_handle);
-    ppc->resolver_handle = NULL;
-  }
-  GNUNET_CONTAINER_DLL_remove (ppc_dll_head, ppc_dll_tail, ppc);
-  GNUNET_free (ppc);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Disconnecting peer `%4s'\n",
+       GNUNET_i2s (target));
+  GNUNET_CONTAINER_multipeermap_get_multiple (plugin->sessionmap,
+                                              target,
+                                              &session_disconnect_it,
+                                              plugin);
+  GNUNET_CONTAINER_multipeermap_get_multiple (plugin->nat_wait_conns,
+                                              target,
+                                              &session_disconnect_it,
+                                              plugin);
 }
 
 
 /**
- * Append our port and forward the result.
+ * We are processing an address pretty printing request and finished
+ * the IP resolution (if applicable).  Append our port and forward the
+ * result.  If called with @a hostname NULL, we are done and should
+ * clean up the pretty printer (otherwise, there might be multiple
+ * hostnames for the IP address and we might receive more).
  *
- * @param cls the 'struct PrettyPrinterContext*'
+ * @param cls the `struct PrettyPrinterContext *`
  * @param hostname hostname part of the address
  */
 static void
-append_port (void *cls, const char *hostname)
+append_port (void *cls,
+             const char *hostname)
 {
   struct PrettyPrinterContext *ppc = cls;
-  struct PrettyPrinterContext *cur;
+  struct Plugin *plugin = ppc->plugin;
   char *ret;
-  int count = 0;
 
-  for (cur = ppc_dll_head; (NULL != cur); cur = cur->next)
-  {
-    if (cur != ppc)
-      count++;
-  }
-  //GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Callback request %p == %s, %u pending\n", ppc, hostname, count);
-  if (hostname == NULL)
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "append_port called with hostname `%s'\n",
+              hostname);
+  if (NULL == hostname)
   {
-    ppc->asc (ppc->asc_cls, NULL);
-    GNUNET_CONTAINER_DLL_remove (ppc_dll_head, ppc_dll_tail, ppc);
-    GNUNET_SCHEDULER_cancel (ppc->timeout_task);
-    ppc->timeout_task = GNUNET_SCHEDULER_NO_TASK;
+    /* Final call, done */
     ppc->resolver_handle = NULL;
-    //GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Done request %p, %u pending\n", ppc, count);
+    GNUNET_CONTAINER_DLL_remove (plugin->ppc_dll_head,
+                                 plugin->ppc_dll_tail,
+                                 ppc);
+    ppc->asc (ppc->asc_cls,
+              NULL,
+              GNUNET_OK);
     GNUNET_free (ppc);
     return;
   }
-  for (cur = ppc_dll_head; (NULL != cur); cur = cur->next)
-  {
-       if (cur == ppc)
-               break;
-  }
-  if (NULL == cur)
-  {
-       GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Invalid callback for PPC %p \n", ppc);
-       return;
-  }
-
   if (GNUNET_YES == ppc->ipv6)
-    GNUNET_asprintf (&ret, "%s.%u.[%s]:%d", PLUGIN_NAME, ppc->options, hostname, ppc->port);
+    GNUNET_asprintf (&ret,
+                     "%s.%u.[%s]:%d",
+                     PLUGIN_NAME,
+                     ppc->options,
+                     hostname,
+                     ppc->port);
   else
-    GNUNET_asprintf (&ret, "%s.%u.%s:%d", PLUGIN_NAME, ppc->options, hostname, ppc->port);
-  ppc->asc (ppc->asc_cls, ret);
+    GNUNET_asprintf (&ret,
+                     "%s.%u.%s:%d",
+                     PLUGIN_NAME,
+                     ppc->options,
+                     hostname,
+                     ppc->port);
+  ppc->asc (ppc->asc_cls,
+            ret,
+            GNUNET_OK);
   GNUNET_free (ret);
 }
 
 
 /**
- * Convert the transports address to a nice, human-readable
- * format.
+ * Convert the transports address to a nice, human-readable format.
  *
- * @param cls closure
+ * @param cls closure with the `struct Plugin`
  * @param type name of the transport that generated the address
  * @param addr one of the addresses of the host, NULL for the last address
  *        the specific address format depends on the transport
- * @param addrlen length of the address
+ * @param addrlen length of the @a addr
  * @param numeric should (IP) addresses be displayed in numeric form?
  * @param timeout after how long should we give up?
  * @param asc function to call on each string
- * @param asc_cls closure for asc
+ * @param asc_cls closure for @a asc
  */
 static void
-tcp_plugin_address_pretty_printer (void *cls, const char *type,
-                                   const void *addr, size_t addrlen,
+tcp_plugin_address_pretty_printer (void *cls,
+                                   const char *type,
+                                   const void *addr,
+                                   size_t addrlen,
                                    int numeric,
                                    struct GNUNET_TIME_Relative timeout,
                                    GNUNET_TRANSPORT_AddressStringCallback asc,
                                    void *asc_cls)
 {
+  struct Plugin *plugin = cls;
   struct PrettyPrinterContext *ppc;
   const void *sb;
   size_t sbs;
@@ -1771,45 +1958,43 @@ tcp_plugin_address_pretty_printer (void *cls, const char *type,
   uint16_t port;
   uint32_t options;
 
-  if (addrlen == sizeof (struct IPv6TcpAddress))
+  if (sizeof(struct IPv6TcpAddress) == addrlen)
   {
     t6 = addr;
-    memset (&a6, 0, sizeof (a6));
+    memset (&a6, 0, sizeof(a6));
     a6.sin6_family = AF_INET6;
     a6.sin6_port = t6->t6_port;
-    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof (struct in6_addr));
+    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof(struct in6_addr));
     port = ntohs (t6->t6_port);
     options = ntohl (t6->options);
     sb = &a6;
-    sbs = sizeof (a6);
+    sbs = sizeof(a6);
   }
-  else if (addrlen == sizeof (struct IPv4TcpAddress))
+  else if (sizeof(struct IPv4TcpAddress) == addrlen)
   {
     t4 = addr;
-    memset (&a4, 0, sizeof (a4));
+    memset (&a4, 0, sizeof(a4));
     a4.sin_family = AF_INET;
     a4.sin_port = t4->t4_port;
     a4.sin_addr.s_addr = t4->ipv4_addr;
     port = ntohs (t4->t4_port);
     options = ntohl (t4->options);
     sb = &a4;
-    sbs = sizeof (a4);
-  }
-  else if (0 == addrlen)
-  {
-    asc (asc_cls, TRANSPORT_SESSION_INBOUND_STRING);
-    asc (asc_cls, NULL);
-    return;
+    sbs = sizeof(a4);
   }
   else
   {
     /* invalid address */
-    GNUNET_break_op (0);
-    asc (asc_cls, NULL);
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         _("Unexpected address length: %u bytes\n"),
+         (unsigned int) addrlen);
+    asc (asc_cls, NULL, GNUNET_SYSERR);
+    asc (asc_cls, NULL, GNUNET_OK);
     return;
   }
-  ppc = GNUNET_malloc (sizeof (struct PrettyPrinterContext));
-  if (addrlen == sizeof (struct IPv6TcpAddress))
+  ppc = GNUNET_new (struct PrettyPrinterContext);
+  ppc->plugin = plugin;
+  if (addrlen == sizeof(struct IPv6TcpAddress))
     ppc->ipv6 = GNUNET_YES;
   else
     ppc->ipv6 = GNUNET_NO;
@@ -1817,21 +2002,22 @@ tcp_plugin_address_pretty_printer (void *cls, const char *type,
   ppc->asc_cls = asc_cls;
   ppc->port = port;
   ppc->options = options;
-  ppc->timeout_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply(timeout, 2),
-                                                    &ppc_cancel_task, ppc);
-  ppc->resolver_handle = GNUNET_RESOLVER_hostname_get (sb, sbs, !numeric,
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting DNS reverse lookup\n");
+  ppc->resolver_handle = GNUNET_RESOLVER_hostname_get (sb,
+                                                       sbs,
+                                                       ! numeric,
                                                        timeout,
                                                        &append_port, ppc);
-  if (NULL != ppc->resolver_handle)
-  {
-    //GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Adding request %p\n", ppc);
-    GNUNET_CONTAINER_DLL_insert (ppc_dll_head, ppc_dll_tail, ppc);
-  }
-  else
+  if (NULL == ppc->resolver_handle)
   {
     GNUNET_break (0);
     GNUNET_free (ppc);
+    return;
   }
+  GNUNET_CONTAINER_DLL_insert (plugin->ppc_dll_head,
+                               plugin->ppc_dll_tail,
+                               ppc);
 }
 
 
@@ -1839,16 +2025,18 @@ tcp_plugin_address_pretty_printer (void *cls, const char *type,
  * Check if the given port is plausible (must be either our listen
  * port or our advertised port), or any port if we are behind NAT
  * and do not have a port open.  If it is neither, we return
- * GNUNET_SYSERR.
+ * #GNUNET_SYSERR.
  *
  * @param plugin global variables
  * @param in_port port number to check
- * @return GNUNET_OK if port is either open_port or adv_port
+ * @return #GNUNET_OK if port is either open_port or adv_port
  */
 static int
-check_port (struct Plugin *plugin, uint16_t in_port)
+check_port (struct Plugin *plugin,
+           uint16_t in_port)
 {
-  if ((in_port == plugin->adv_port) || (in_port == plugin->open_port))
+  if ( (in_port == plugin->adv_port) ||
+       (in_port == plugin->open_port) )
     return GNUNET_OK;
   return GNUNET_SYSERR;
 }
@@ -1863,60 +2051,69 @@ check_port (struct Plugin *plugin, uint16_t in_port)
  * traffic to a 3rd party that might try to man-in-the-middle our
  * traffic.
  *
- * @param cls closure, our 'struct Plugin*'
+ * @param cls closure, our `struct Plugin *`
  * @param addr pointer to the address
- * @param addrlen length of addr
- * @return GNUNET_OK if this is a plausible address for this peer
- *         and transport, GNUNET_SYSERR if not
+ * @param addrlen length of @a addr
+ * @return #GNUNET_OK if this is a plausible address for this peer
+ *         and transport, #GNUNET_SYSERR if not
  */
 static int
-tcp_plugin_check_address (void *cls, const void *addr, size_t addrlen)
+tcp_plugin_check_address (void *cls,
+                         const void *addr,
+                         size_t addrlen)
 {
   struct Plugin *plugin = cls;
-  struct IPv4TcpAddress *v4;
-  struct IPv6TcpAddress *v6;
+  const struct IPv4TcpAddress *v4;
+  const struct IPv6TcpAddress *v6;
 
-  if ((addrlen != sizeof (struct IPv4TcpAddress)) &&
-      (addrlen != sizeof (struct IPv6TcpAddress)))
+  if ( (addrlen != sizeof(struct IPv4TcpAddress)) &&
+       (addrlen != sizeof(struct IPv6TcpAddress)) )
   {
-
-
-       return GNUNET_SYSERR;
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
   }
 
-  if (addrlen == sizeof (struct IPv4TcpAddress))
+  if (addrlen == sizeof(struct IPv4TcpAddress))
   {
-    v4 = (struct IPv4TcpAddress *) addr;
-    if (0 != memcmp (&v4->options, &myoptions, sizeof (myoptions)))
+    v4 = (const struct IPv4TcpAddress *) addr;
+    if (0 != memcmp (&v4->options,
+                     &plugin->myoptions,
+                     sizeof(uint32_t)))
     {
-       GNUNET_break (0);
-       return GNUNET_SYSERR;
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
     }
-    if (GNUNET_OK != check_port (plugin, ntohs (v4->t4_port)))
+    if (GNUNET_OK != check_port (plugin,
+                                ntohs (v4->t4_port)))
       return GNUNET_SYSERR;
     if (GNUNET_OK !=
-        GNUNET_NAT_test_address (plugin->nat, &v4->ipv4_addr,
-                                 sizeof (struct in_addr)))
+       GNUNET_NAT_test_address (plugin->nat,
+                                &v4->ipv4_addr,
+                                sizeof (struct in_addr)))
       return GNUNET_SYSERR;
   }
   else
   {
-    v6 = (struct IPv6TcpAddress *) addr;
+    v6 = (const struct IPv6TcpAddress *) addr;
     if (IN6_IS_ADDR_LINKLOCAL (&v6->ipv6_addr))
     {
       GNUNET_break_op (0);
       return GNUNET_SYSERR;
     }
-    if (0 != memcmp (&v6->options, &myoptions, sizeof (myoptions)))
+    if (0 != memcmp (&v6->options,
+                     &plugin->myoptions,
+                     sizeof (uint32_t)))
     {
-       GNUNET_break (0);
-       return GNUNET_SYSERR;
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
     }
-    if (GNUNET_OK != check_port (plugin, ntohs (v6->t6_port)))
+    if (GNUNET_OK != check_port (plugin,
+                                ntohs (v6->t6_port)))
       return GNUNET_SYSERR;
     if (GNUNET_OK !=
-        GNUNET_NAT_test_address (plugin->nat, &v6->ipv6_addr,
-                                 sizeof (struct in6_addr)))
+       GNUNET_NAT_test_address (plugin->nat,
+                                &v6->ipv6_addr,
+                                sizeof(struct in6_addr)))
       return GNUNET_SYSERR;
   }
   return GNUNET_OK;
@@ -1933,11 +2130,12 @@ tcp_plugin_check_address (void *cls, const void *addr, size_t addrlen)
  * @param message the actual message
  */
 static void
-handle_tcp_nat_probe (void *cls, struct GNUNET_SERVER_Client *client,
+handle_tcp_nat_probe (void *cls,
+                      struct GNUNET_SERVER_Client *client,
                       const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
-  struct Session *session;
+  struct GNUNET_ATS_Session *session;
   const struct TCP_NAT_ProbeMessage *tcp_nat_probe;
   size_t alen;
   void *vaddr;
@@ -1946,67 +2144,74 @@ handle_tcp_nat_probe (void *cls, struct GNUNET_SERVER_Client *client,
   const struct sockaddr_in *s4;
   const struct sockaddr_in6 *s6;
 
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Received NAT probe\n");
-
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received NAT probe\n");
   /* We have received a TCP NAT probe, meaning we (hopefully) initiated
    * a connection to this peer by running gnunet-nat-client.  This peer
    * received the punch message and now wants us to use the new connection
    * as the default for that peer.  Do so and then send a WELCOME message
    * so we can really be connected!
    */
-  if (ntohs (message->size) != sizeof (struct TCP_NAT_ProbeMessage))
+  if (ntohs (message->size) != sizeof(struct TCP_NAT_ProbeMessage))
   {
-    GNUNET_break_op (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    GNUNET_break_op(0);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
     return;
   }
 
   tcp_nat_probe = (const struct TCP_NAT_ProbeMessage *) message;
-  if (0 ==
-      memcmp (&tcp_nat_probe->clientIdentity, plugin->env->my_identity,
-              sizeof (struct GNUNET_PeerIdentity)))
+  if (0 == memcmp (&tcp_nat_probe->clientIdentity, plugin->env->my_identity,
+          sizeof(struct GNUNET_PeerIdentity)))
   {
     /* refuse connections from ourselves */
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
     return;
   }
 
-  session =
-      GNUNET_CONTAINER_multipeermap_get (plugin->nat_wait_conns,
-                                         &tcp_nat_probe->
-                                         clientIdentity);
-  if (session == NULL)
+  session = GNUNET_CONTAINER_multipeermap_get (plugin->nat_wait_conns,
+                                               &tcp_nat_probe->clientIdentity);
+  if (NULL == session)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Did NOT find session for NAT probe!\n");
-    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+         "Did NOT find session for NAT probe!\n");
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_OK);
     return;
   }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Found session for NAT probe!\n");
 
-  if (session->nat_connection_timeout != GNUNET_SCHEDULER_NO_TASK)
+  if (NULL != session->nat_connection_timeout)
   {
     GNUNET_SCHEDULER_cancel (session->nat_connection_timeout);
-    session->nat_connection_timeout = GNUNET_SCHEDULER_NO_TASK;
+    session->nat_connection_timeout = NULL;
   }
 
-  if (GNUNET_OK != GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
-  {
-    GNUNET_break (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    tcp_disconnect_session (plugin, session);
+  if (GNUNET_OK !=
+      GNUNET_SERVER_client_get_address (client,
+                                       &vaddr,
+                                       &alen))
+  {
+    GNUNET_break(0);
+    GNUNET_SERVER_receive_done (client,
+                               GNUNET_SYSERR);
+    tcp_plugin_disconnect_session (plugin,
+                                   session);
     return;
   }
-  GNUNET_assert (GNUNET_CONTAINER_multipeermap_remove
-                 (plugin->nat_wait_conns,
-                  &tcp_nat_probe->clientIdentity,
-                  session) == GNUNET_YES);
-  GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
-                                    &session->target, session,
-                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+  GNUNET_assert (GNUNET_YES ==
+                GNUNET_CONTAINER_multipeermap_remove (plugin->nat_wait_conns,
+                                                      &tcp_nat_probe->clientIdentity,
+                                                      session));
+  GNUNET_SERVER_client_set_user_context (client,
+                                        session);
+  (void) GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
+                                           &session->target,
+                                           session,
+                                           GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
   session->last_activity = GNUNET_TIME_absolute_get ();
-  session->inbound = GNUNET_NO;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Found address `%s' for incoming connection\n",
        GNUNET_a2s (vaddr, alen));
@@ -2014,41 +2219,49 @@ handle_tcp_nat_probe (void *cls, struct GNUNET_SERVER_Client *client,
   {
   case AF_INET:
     s4 = vaddr;
-    t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
-    t4->options = 0;
+    t4 = GNUNET_new (struct IPv4TcpAddress);
+    t4->options = htonl (TCP_OPTIONS_NONE);
     t4->t4_port = s4->sin_port;
     t4->ipv4_addr = s4->sin_addr.s_addr;
-    session->addr = t4;
-    session->addrlen = sizeof (struct IPv4TcpAddress);
+    session->address = GNUNET_HELLO_address_allocate (&tcp_nat_probe->clientIdentity,
+                                                      PLUGIN_NAME,
+                                                      &t4,
+                                                      sizeof(struct IPv4TcpAddress),
+                                                      GNUNET_HELLO_ADDRESS_INFO_NONE);
     break;
   case AF_INET6:
     s6 = vaddr;
-    t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
-    t6->options = 0;
+    t6 = GNUNET_new (struct IPv6TcpAddress);
+    t6->options = htonl (TCP_OPTIONS_NONE);
     t6->t6_port = s6->sin6_port;
-    memcpy (&t6->ipv6_addr, &s6->sin6_addr, sizeof (struct in6_addr));
-    session->addr = t6;
-    session->addrlen = sizeof (struct IPv6TcpAddress);
+    memcpy (&t6->ipv6_addr, &s6->sin6_addr, sizeof(struct in6_addr));
+    session->address = GNUNET_HELLO_address_allocate (&tcp_nat_probe->clientIdentity,
+                                                      PLUGIN_NAME,
+                                                      &t6,
+                                                      sizeof(struct IPv6TcpAddress),
+                                                      GNUNET_HELLO_ADDRESS_INFO_NONE);
     break;
   default:
-    GNUNET_break_op (0);
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Bad address for incoming connection!\n");
-    GNUNET_free (vaddr);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    tcp_disconnect_session (plugin, session);
+    GNUNET_break_op(0);
+    LOG(GNUNET_ERROR_TYPE_DEBUG,
+        "Bad address for incoming connection!\n");
+    GNUNET_free(vaddr);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
+    tcp_plugin_disconnect_session (plugin,
+                                   session);
     return;
   }
   GNUNET_free (vaddr);
   GNUNET_break (NULL == session->client);
-  GNUNET_SERVER_client_keep (client);
   session->client = client;
-  inc_sessions (plugin, session, __LINE__);
   GNUNET_STATISTICS_update (plugin->env->stats,
-                            gettext_noop ("# TCP sessions active"), 1,
-                            GNUNET_NO);
+                           gettext_noop ("# TCP sessions active"),
+                           1,
+                           GNUNET_NO);
   process_pending_messages (session);
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
+  GNUNET_SERVER_receive_done (client,
+                             GNUNET_OK);
 }
 
 
@@ -2061,151 +2274,159 @@ handle_tcp_nat_probe (void *cls, struct GNUNET_SERVER_Client *client,
  * @param message the actual message
  */
 static void
-handle_tcp_welcome (void *cls, struct GNUNET_SERVER_Client *client,
+handle_tcp_welcome (void *cls,
+                    struct GNUNET_SERVER_Client *client,
                     const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
   const struct WelcomeMessage *wm = (const struct WelcomeMessage *) message;
-  struct Session *session;
+  struct GNUNET_HELLO_Address *address;
+  struct GNUNET_ATS_Session *session;
   size_t alen;
   void *vaddr;
-  struct IPv4TcpAddress *t4;
-  struct IPv6TcpAddress *t6;
+  struct IPv4TcpAddress t4;
+  struct IPv6TcpAddress t6;
   const struct sockaddr_in *s4;
   const struct sockaddr_in6 *s6;
-  struct GNUNET_ATS_Information ats;
 
-  if (0 ==
-      memcmp (&wm->clientIdentity, plugin->env->my_identity,
-              sizeof (struct GNUNET_PeerIdentity)))
+  if (0 == memcmp (&wm->clientIdentity,
+                   plugin->env->my_identity,
+                   sizeof(struct GNUNET_PeerIdentity)))
   {
     /* refuse connections from ourselves */
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    if (GNUNET_OK == GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
+    if (GNUNET_OK ==
+        GNUNET_SERVER_client_get_address (client,
+                                          &vaddr,
+                                          &alen))
     {
-       LOG (GNUNET_ERROR_TYPE_WARNING,
-         "Received %s message from my own identity `%4s' on address `%s'\n",
-         "WELCOME", GNUNET_i2s (&wm->clientIdentity), GNUNET_a2s (vaddr, alen));
-       GNUNET_free (vaddr);
+      LOG (GNUNET_ERROR_TYPE_INFO,
+           "Received WELCOME message from my own identity `%4s' on address `%s'\n",
+           GNUNET_i2s (&wm->clientIdentity),
+           GNUNET_a2s (vaddr, alen));
+      GNUNET_free(vaddr);
     }
-    GNUNET_break_op (0);
     return;
   }
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Received %s message from `%4s' %p\n", "WELCOME",
-       GNUNET_i2s (&wm->clientIdentity), client);
+
+  LOG(GNUNET_ERROR_TYPE_DEBUG,
+      "Received WELCOME message from `%4s' %p\n",
+      GNUNET_i2s (&wm->clientIdentity),
+      client);
   GNUNET_STATISTICS_update (plugin->env->stats,
-                            gettext_noop ("# TCP WELCOME messages received"), 1,
+                            gettext_noop ("# TCP WELCOME messages received"),
+                            1,
                             GNUNET_NO);
   session = lookup_session_by_client (plugin, client);
-  if (session != NULL)
+  if (NULL != session)
   {
-    if (GNUNET_OK == GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
+    if (GNUNET_OK ==
+        GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
     {
       LOG (GNUNET_ERROR_TYPE_DEBUG,
-          "Found existing session %p for peer `%s'\n",
-          session,
-          GNUNET_a2s (vaddr, alen));
+           "Found existing session %p for peer `%s'\n",
+           session,
+           GNUNET_a2s (vaddr, alen));
       GNUNET_free (vaddr);
     }
   }
   else
   {
-    GNUNET_SERVER_client_keep (client);
-    if (plugin->service != NULL) /* Otherwise value is incremented in tcp_access_check */
-       plugin->cur_connections++;
-    if (plugin->cur_connections == plugin->max_connections)
-       GNUNET_SERVER_suspend (plugin->server); /* Maximum number of connections rechead */
-
-    session = create_session (plugin, &wm->clientIdentity, client, GNUNET_NO);
-    session->inbound = GNUNET_YES;
-    if (GNUNET_OK == GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
+    if (GNUNET_OK ==
+        GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
     {
-      if (alen == sizeof (struct sockaddr_in))
+      if (alen == sizeof(struct sockaddr_in))
       {
         s4 = vaddr;
-        t4 = GNUNET_new (struct IPv4TcpAddress);
-        t4->options = htonl (0);
-        t4->t4_port = s4->sin_port;
-        t4->ipv4_addr = s4->sin_addr.s_addr;
-        session->addr = t4;
-        session->addrlen = sizeof (struct IPv4TcpAddress);
+        memset (&t4, '\0', sizeof (t4));
+        t4.options = htonl (TCP_OPTIONS_NONE);
+        t4.t4_port = s4->sin_port;
+        t4.ipv4_addr = s4->sin_addr.s_addr;
+        address = GNUNET_HELLO_address_allocate (&wm->clientIdentity,
+                                                 PLUGIN_NAME,
+                                                 &t4,
+                                                 sizeof(t4),
+                                                 GNUNET_HELLO_ADDRESS_INFO_INBOUND);
       }
-      else if (alen == sizeof (struct sockaddr_in6))
+      else if (alen == sizeof(struct sockaddr_in6))
       {
         s6 = vaddr;
-        t6 = GNUNET_new (struct IPv6TcpAddress);
-        t6->options = htonl (0);
-        t6->t6_port = s6->sin6_port;
-        memcpy (&t6->ipv6_addr, &s6->sin6_addr, sizeof (struct in6_addr));
-        session->addr = t6;
-        session->addrlen = sizeof (struct IPv6TcpAddress);
+        memset (&t6, '\0', sizeof (t6));
+        t6.options = htonl (TCP_OPTIONS_NONE);
+        t6.t6_port = s6->sin6_port;
+        memcpy (&t6.ipv6_addr, &s6->sin6_addr, sizeof(struct in6_addr));
+        address = GNUNET_HELLO_address_allocate (&wm->clientIdentity,
+                                                 PLUGIN_NAME,
+                                                 &t6,
+                                                 sizeof (t6),
+                                                 GNUNET_HELLO_ADDRESS_INFO_INBOUND);
       }
-
-      ats = plugin->env->get_address_type (plugin->env->cls, vaddr ,alen);
-      session->ats_address_network_type = (enum GNUNET_ATS_Network_Type) ntohl (ats.value);
+      else
+      {
+        GNUNET_break (0);
+        GNUNET_free_non_null (vaddr);
+        GNUNET_SERVER_receive_done (client,
+                                    GNUNET_SYSERR);
+        return;
+      }
+      session = create_session (plugin,
+                                address,
+                                plugin->env->get_address_type (plugin->env->cls,
+                                                               vaddr,
+                                                               alen),
+                                client,
+                                GNUNET_NO);
+      GNUNET_break (GNUNET_ATS_NET_UNSPECIFIED != session->scope);
+      GNUNET_HELLO_address_free (address);
       LOG (GNUNET_ERROR_TYPE_DEBUG,
-           "Creating new session %p for peer `%s'\n",
+           "Creating new%s session %p for peer `%s' client %p\n",
+           GNUNET_HELLO_address_check_option (session->address,
+                                              GNUNET_HELLO_ADDRESS_INFO_INBOUND)
+           ? " inbound" : "",
            session,
-           GNUNET_a2s (vaddr, alen));
+           tcp_plugin_address_to_string (plugin,
+                                         session->address->address,
+                                         session->address->address_length),
+           client);
       GNUNET_free (vaddr);
-      GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
-                                      &session->target,
-                                      session,
-                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-      inc_sessions (plugin, session, __LINE__);
+      (void) GNUNET_CONTAINER_multipeermap_put (plugin->sessionmap,
+                                                &session->target,
+                                                session,
+                                                GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+      /* Notify transport and ATS about new session */
+      plugin->env->session_start (plugin->env->cls,
+                                  session->address,
+                                  session,
+                                  session->scope);
     }
     else
     {
-      LOG (GNUNET_ERROR_TYPE_DEBUG,
-          "Did not obtain TCP socket address for incoming connection\n");
-      GNUNET_break (0);
+      LOG(GNUNET_ERROR_TYPE_DEBUG,
+          "Did not obtain TCP socket address for incoming connection\n");
+      GNUNET_break(0);
+      GNUNET_SERVER_receive_done (client,
+                                  GNUNET_SYSERR);
+      return;
     }
   }
 
   if (session->expecting_welcome != GNUNET_YES)
   {
-    GNUNET_break_op (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    GNUNET_break (0);
+    GNUNET_break_op(0);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
+    GNUNET_break(0);
     return;
   }
   session->last_activity = GNUNET_TIME_absolute_get ();
   session->expecting_welcome = GNUNET_NO;
 
-  /* Notify transport and ATS about new session */
-  if (GNUNET_YES == session->inbound)
-  {
-       plugin->env->session_start (NULL, &wm->clientIdentity, PLUGIN_NAME,
-               (GNUNET_YES == session->inbound) ? NULL : session->addr,
-                 (GNUNET_YES == session->inbound) ? 0 : session->addrlen,
-                 session, &ats, 1);
-  }
-
   process_pending_messages (session);
-
   GNUNET_SERVER_client_set_timeout (client,
                                     GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
-}
-
-
-/**
- * Task to signal the server that we can continue
- * receiving from the TCP client now.
- *
- * @param cls the 'struct Session*'
- * @param tc task context (unused)
- */
-static void
-delayed_done (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct Session *session = cls;
-
-  session->receive_delay_task = GNUNET_SCHEDULER_NO_TASK;
-  reschedule_session_timeout (session);
-
-  GNUNET_SERVER_receive_done (session->client, GNUNET_OK);
+  GNUNET_SERVER_receive_done (client,
+                              GNUNET_OK);
 }
 
 
@@ -2218,20 +2439,22 @@ delayed_done (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
  * @param message the actual message
  */
 static void
-handle_tcp_data (void *cls, struct GNUNET_SERVER_Client *client,
+handle_tcp_data (void *cls,
+                 struct GNUNET_SERVER_Client *client,
                  const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
-  struct Session *session;
+  struct GNUNET_ATS_Session *session;
   struct GNUNET_TIME_Relative delay;
   uint16_t type;
 
   type = ntohs (message->type);
-  if ((GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME == type) ||
-      (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE == type))
+  if ( (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME == type) ||
+       (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE == type) )
   {
     /* We don't want to propagate WELCOME and NAT Probe messages up! */
-    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_OK);
     return;
   }
   session = lookup_session_by_client (plugin, client);
@@ -2241,18 +2464,22 @@ handle_tcp_data (void *cls, struct GNUNET_SERVER_Client *client,
     void *vaddr;
     size_t alen;
 
-    GNUNET_SERVER_client_get_address (client, &vaddr, &alen);
+    GNUNET_SERVER_client_get_address (client,
+                                      &vaddr,
+                                      &alen);
     LOG (GNUNET_ERROR_TYPE_ERROR,
-        "Received unexpected %u bytes of type %u from `%s'\n",
-        (unsigned int) ntohs (message->size),
-        (unsigned int) ntohs (message->type),
-        GNUNET_a2s(vaddr, alen));
-    GNUNET_break_op (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    GNUNET_free_non_null(vaddr);
+         "Received unexpected %u bytes of type %u from `%s'\n",
+         (unsigned int) ntohs (message->size),
+         (unsigned int) ntohs (message->type),
+         GNUNET_a2s (vaddr,
+                     alen));
+    GNUNET_break_op(0);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
+    GNUNET_free_non_null (vaddr);
     return;
   }
-  else if (GNUNET_YES == session->expecting_welcome)
+  if (GNUNET_YES == session->expecting_welcome)
   {
     /* Session is expecting WELCOME message */
     void *vaddr;
@@ -2260,139 +2487,180 @@ handle_tcp_data (void *cls, struct GNUNET_SERVER_Client *client,
 
     GNUNET_SERVER_client_get_address (client, &vaddr, &alen);
     LOG (GNUNET_ERROR_TYPE_ERROR,
-        "Received unexpected %u bytes of type %u from `%s'\n",
-        (unsigned int) ntohs (message->size),
-        (unsigned int) ntohs (message->type),
-        GNUNET_a2s(vaddr, alen));
-    GNUNET_break_op (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    GNUNET_free_non_null(vaddr);
+         "Received unexpected %u bytes of type %u from `%s'\n",
+         (unsigned int) ntohs (message->size),
+         (unsigned int) ntohs (message->type),
+         GNUNET_a2s (vaddr, alen));
+    GNUNET_break_op(0);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_SYSERR);
+    GNUNET_free_non_null (vaddr);
     return;
   }
 
   session->last_activity = GNUNET_TIME_absolute_get ();
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-                   "Passing %u bytes of type %u from `%4s' to transport service.\n",
-                   (unsigned int) ntohs (message->size),
-                   (unsigned int) ntohs (message->type),
-                   GNUNET_i2s (&session->target));
+       "Passing %u bytes of type %u from `%4s' to transport service.\n",
+       (unsigned int) ntohs (message->size),
+       (unsigned int) ntohs (message->type),
+       GNUNET_i2s (&session->target));
 
   GNUNET_STATISTICS_update (plugin->env->stats,
                             gettext_noop ("# bytes received via TCP"),
-                            ntohs (message->size), GNUNET_NO);
-  struct GNUNET_ATS_Information distance;
-
-  distance.type = htonl (GNUNET_ATS_NETWORK_TYPE);
-  distance.value = htonl ((uint32_t) session->ats_address_network_type);
-  GNUNET_break (session->ats_address_network_type != GNUNET_ATS_NET_UNSPECIFIED);
+                            ntohs (message->size),
+                            GNUNET_NO);
 
   GNUNET_assert (GNUNET_CONTAINER_multipeermap_contains_value (plugin->sessionmap,
-                                                              &session->target,
-                                                              session));
-
+                                                               &session->target,
+                                                               session));
   delay = plugin->env->receive (plugin->env->cls,
-                                &session->target,
-                                message,
+                                session->address,
                                 session,
-                                (GNUNET_YES == session->inbound) ? NULL : session->addr,
-                                (GNUNET_YES == session->inbound) ? 0 : session->addrlen);
-  plugin->env->update_address_metrics (plugin->env->cls,
-               &session->target,
-               (GNUNET_YES == session->inbound) ? NULL : session->addr,
-                 (GNUNET_YES == session->inbound) ? 0 : session->addrlen,
-                 session, &distance, 1);
-
+                                message);
   reschedule_session_timeout (session);
-
   if (0 == delay.rel_value_us)
   {
-    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    GNUNET_SERVER_receive_done (client,
+                                GNUNET_OK);
   }
   else
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Throttling receiving from `%s' for %s\n",
-        GNUNET_i2s (&session->target),
-        GNUNET_STRINGS_relative_time_to_string (delay, GNUNET_YES));
+         "Throttling receiving from `%s' for %s\n",
+         GNUNET_i2s (&session->target),
+         GNUNET_STRINGS_relative_time_to_string (delay,
+                                                 GNUNET_YES));
     GNUNET_SERVER_disable_receive_done_warning (client);
-    session->receive_delay_task =
-        GNUNET_SCHEDULER_add_delayed (delay, &delayed_done, session);
+    GNUNET_assert (NULL == session->receive_delay_task);
+    session->receive_delay_task = GNUNET_SCHEDULER_add_delayed (delay,
+                                                                &delayed_done,
+                                                                session);
   }
 }
 
 
 /**
- * Functions with this signature are called whenever a peer
- * is disconnected on the network level.
+ * Function called whenever a peer is connected on the "SERVER" level.
+ * Increments number of active connections and suspends server if we
+ * have reached the limit.
  *
  * @param cls closure
  * @param client identification of the client
  */
 static void
-disconnect_notify (void *cls, struct GNUNET_SERVER_Client *client)
+connect_notify (void *cls,
+               struct GNUNET_SERVER_Client *client)
 {
   struct Plugin *plugin = cls;
-  struct Session *session;
 
-  if (client == NULL)
+  if (NULL == client)
     return;
-  session = lookup_session_by_client (plugin, client);
-  if (session == NULL)
-    return;                     /* unknown, nothing to do */
+  plugin->cur_connections++;
+  GNUNET_STATISTICS_set (plugin->env->stats,
+                         gettext_noop ("# TCP server connections active"),
+                         plugin->cur_connections,
+                         GNUNET_NO);
+  GNUNET_STATISTICS_update (plugin->env->stats,
+                           gettext_noop ("# TCP server connect events"),
+                           1,
+                           GNUNET_NO);
+  if (plugin->cur_connections != plugin->max_connections)
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+             _("TCP connection limit reached, suspending server\n"));
+  GNUNET_STATISTICS_update (plugin->env->stats,
+                           gettext_noop ("# TCP service suspended"),
+                           1,
+                           GNUNET_NO);
+  GNUNET_SERVER_suspend (plugin->server); /* Maximum number of connections rechead */
+}
+
+
+/**
+ * Function called whenever a peer is disconnected on the "SERVER"
+ * level.  Cleans up the connection, decrements number of active
+ * connections and if applicable resumes listening.
+ *
+ * @param cls closure
+ * @param client identification of the client
+ */
+static void
+disconnect_notify (void *cls,
+                   struct GNUNET_SERVER_Client *client)
+{
+  struct Plugin *plugin = cls;
+  struct GNUNET_ATS_Session *session;
+
+  if (NULL == client)
+    return;
+  GNUNET_assert (plugin->cur_connections >= 1);
+  plugin->cur_connections--;
+  session = lookup_session_by_client (plugin,
+                                      client);
+  if (NULL == session)
+    return; /* unknown, nothing to do */
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Destroying session of `%4s' with %s due to network-level disconnect.\n",
        GNUNET_i2s (&session->target),
-       (session->addr !=
-       NULL) ? tcp_address_to_string (session->plugin,
-                                      session->addr,
-                                      session->addrlen) :
-       "*");
+       tcp_plugin_address_to_string (session->plugin,
+                                     session->address->address,
+                                     session->address->address_length));
 
   if (plugin->cur_connections == plugin->max_connections)
+  {
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop ("# TCP service resumed"),
+                              1,
+                              GNUNET_NO);
     GNUNET_SERVER_resume (plugin->server); /* Resume server  */
-
-  if (plugin->cur_connections < 1)
-    GNUNET_break (0);
-  else
-    plugin->cur_connections--;
-
+  }
+  GNUNET_STATISTICS_set (plugin->env->stats,
+                         gettext_noop ("# TCP server connections active"),
+                         plugin->cur_connections,
+                         GNUNET_NO);
   GNUNET_STATISTICS_update (session->plugin->env->stats,
-                            gettext_noop
-                            ("# network-level TCP disconnect events"), 1,
+                            gettext_noop ("# network-level TCP disconnect events"),
+                            1,
                             GNUNET_NO);
-  tcp_disconnect_session (plugin, session);
+  tcp_plugin_disconnect_session (plugin,
+                                session);
 }
 
 
 /**
  * We can now send a probe message, copy into buffer to really send.
  *
- * @param cls closure, a struct TCPProbeContext
+ * @param cls closure, a `struct TCPProbeContext`
  * @param size max size to copy
  * @param buf buffer to copy message to
- * @return number of bytes copied into buf
+ * @return number of bytes copied into @a buf
  */
 static size_t
-notify_send_probe (void *cls, size_t size, void *buf)
+notify_send_probe (void *cls,
+                   size_t size,
+                   void *buf)
 {
   struct TCPProbeContext *tcp_probe_ctx = cls;
   struct Plugin *plugin = tcp_probe_ctx->plugin;
   size_t ret;
 
   tcp_probe_ctx->transmit_handle = NULL;
-  GNUNET_CONTAINER_DLL_remove (plugin->probe_head, plugin->probe_tail,
+  GNUNET_CONTAINER_DLL_remove (plugin->probe_head,
+                               plugin->probe_tail,
                                tcp_probe_ctx);
-  if (buf == NULL)
+  if (NULL == buf)
   {
     GNUNET_CONNECTION_destroy (tcp_probe_ctx->sock);
-    GNUNET_free (tcp_probe_ctx);
+    GNUNET_free(tcp_probe_ctx);
     return 0;
   }
-  GNUNET_assert (size >= sizeof (tcp_probe_ctx->message));
-  memcpy (buf, &tcp_probe_ctx->message, sizeof (tcp_probe_ctx->message));
+  GNUNET_assert(size >= sizeof(tcp_probe_ctx->message));
+  memcpy (buf,
+         &tcp_probe_ctx->message,
+         sizeof(tcp_probe_ctx->message));
   GNUNET_SERVER_connect_socket (tcp_probe_ctx->plugin->server,
                                 tcp_probe_ctx->sock);
-  ret = sizeof (tcp_probe_ctx->message);
+  ret = sizeof(tcp_probe_ctx->message);
   GNUNET_free (tcp_probe_ctx);
   return ret;
 }
@@ -2408,7 +2676,8 @@ notify_send_probe (void *cls, size_t size, void *buf)
  * @param addrlen number of bytes in @a addr
  */
 static void
-try_connection_reversal (void *cls, const struct sockaddr *addr,
+try_connection_reversal (void *cls,
+                         const struct sockaddr *addr,
                          socklen_t addrlen)
 {
   struct Plugin *plugin = cls;
@@ -2419,148 +2688,191 @@ try_connection_reversal (void *cls, const struct sockaddr *addr,
    * We have received an ICMP response, ostensibly from a peer
    * that wants to connect to us! Send a message to establish a connection.
    */
-  sock = GNUNET_CONNECTION_create_from_sockaddr (AF_INET, addr, addrlen);
-  if (sock == NULL)
+  sock = GNUNET_CONNECTION_create_from_sockaddr (AF_INET,
+                                                addr,
+                                                addrlen);
+  if (NULL == sock)
   {
     /* failed for some odd reason (out of sockets?); ignore attempt */
     return;
   }
 
-  /* FIXME: do we need to track these probe context objects so that
-   * we can clean them up on plugin unload? */
-  tcp_probe_ctx = GNUNET_malloc (sizeof (struct TCPProbeContext));
-  tcp_probe_ctx->message.header.size =
-      htons (sizeof (struct TCP_NAT_ProbeMessage));
-  tcp_probe_ctx->message.header.type =
-      htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE);
-  memcpy (&tcp_probe_ctx->message.clientIdentity, plugin->env->my_identity,
-          sizeof (struct GNUNET_PeerIdentity));
+  tcp_probe_ctx = GNUNET_new (struct TCPProbeContext);
+  tcp_probe_ctx->message.header.size
+    = htons (sizeof (struct TCP_NAT_ProbeMessage));
+  tcp_probe_ctx->message.header.type
+    = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE);
+  tcp_probe_ctx->message.clientIdentity
+    = *plugin->env->my_identity;
   tcp_probe_ctx->plugin = plugin;
   tcp_probe_ctx->sock = sock;
-  GNUNET_CONTAINER_DLL_insert (plugin->probe_head, plugin->probe_tail,
+  GNUNET_CONTAINER_DLL_insert (plugin->probe_head,
+                               plugin->probe_tail,
                                tcp_probe_ctx);
-  tcp_probe_ctx->transmit_handle =
-      GNUNET_CONNECTION_notify_transmit_ready (sock,
-                                               ntohs (tcp_probe_ctx->
-                                                      message.header.size),
+  tcp_probe_ctx->transmit_handle
+    = GNUNET_CONNECTION_notify_transmit_ready (sock,
+                                               ntohs (tcp_probe_ctx->message.header.size),
                                                GNUNET_TIME_UNIT_FOREVER_REL,
                                                &notify_send_probe,
                                                tcp_probe_ctx);
-
 }
 
 
 /**
- * Session was idle, so disconnect it
+ * Function obtain the network type for a session
+ *
+ * @param cls closure (`struct Plugin *`)
+ * @param session the session
+ * @return the network type in HBO or #GNUNET_SYSERR
  */
-static void
-session_timeout (void *cls,
-                 const struct GNUNET_SCHEDULER_TaskContext *tc)
+static enum GNUNET_ATS_Network_Type
+tcp_plugin_get_network (void *cls,
+                        struct GNUNET_ATS_Session *session)
 {
-  struct Session *s = cls;
-
-  s->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Session %p was idle for %s, disconnecting\n",
-             s,
-             GNUNET_STRINGS_relative_time_to_string (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
-                                                     GNUNET_YES));
-  /* call session destroy function */
-  tcp_disconnect_session(s->plugin, s);
+  return session->scope;
 }
 
 
 /**
- * Start session timeout
+ * Function obtain the network type for an address.
+ *
+ * @param cls closure (`struct Plugin *`)
+ * @param address the address
+ * @return the network type
  */
-static void
-start_session_timeout (struct Session *s)
+static enum GNUNET_ATS_Network_Type
+tcp_plugin_get_network_for_address (void *cls,
+                                    const struct GNUNET_HELLO_Address *address)
 {
-  GNUNET_assert (GNUNET_SCHEDULER_NO_TASK == s->timeout_task);
-  s->timeout_task = GNUNET_SCHEDULER_add_delayed (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
-                                                  &session_timeout,
-                                                  s);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Timeout for session %p set to %s\n",
-             s,
-             GNUNET_STRINGS_relative_time_to_string (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
-                                                     GNUNET_YES));
+  struct Plugin *plugin = cls;
+  size_t addrlen;
+  struct sockaddr_in a4;
+  struct sockaddr_in6 a6;
+  const struct IPv4TcpAddress *t4;
+  const struct IPv6TcpAddress *t6;
+  const void *sb;
+  size_t sbs;
+
+  addrlen = address->address_length;
+  if (addrlen == sizeof(struct IPv6TcpAddress))
+  {
+    GNUNET_assert (NULL != address->address); /* make static analysis happy */
+    t6 = address->address;
+    memset (&a6, 0, sizeof(a6));
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    a6.sin6_len = sizeof (a6);
+#endif
+    a6.sin6_family = AF_INET6;
+    a6.sin6_port = t6->t6_port;
+    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof(struct in6_addr));
+    sb = &a6;
+    sbs = sizeof(a6);
+  }
+  else if (addrlen == sizeof(struct IPv4TcpAddress))
+  {
+    GNUNET_assert (NULL != address->address); /* make static analysis happy */
+    t4 = address->address;
+    memset (&a4, 0, sizeof(a4));
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    a4.sin_len = sizeof (a4);
+#endif
+    a4.sin_family = AF_INET;
+    a4.sin_port = t4->t4_port;
+    a4.sin_addr.s_addr = t4->ipv4_addr;
+    sb = &a4;
+    sbs = sizeof(a4);
+  }
+  else
+  {
+    GNUNET_break (0);
+    return GNUNET_ATS_NET_UNSPECIFIED;
+  }
+  return plugin->env->get_address_type (plugin->env->cls,
+                                        sb,
+                                        sbs);
 }
 
 
 /**
- * Increment session timeout due to activity
+ * Return information about the given session to the
+ * monitor callback.
+ *
+ * @param cls the `struct Plugin` with the monitor callback (`sic`)
+ * @param peer peer we send information about
+ * @param value our `struct GNUNET_ATS_Session` to send information about
+ * @return #GNUNET_OK (continue to iterate)
  */
-static void
-reschedule_session_timeout (struct Session *s)
+static int
+send_session_info_iter (void *cls,
+                        const struct GNUNET_PeerIdentity *peer,
+                        void *value)
 {
-  GNUNET_assert (NULL != s);
-  GNUNET_assert (GNUNET_SCHEDULER_NO_TASK != s->timeout_task);
-
-  GNUNET_SCHEDULER_cancel (s->timeout_task);
-  s->timeout_task = GNUNET_SCHEDULER_add_delayed (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
-                                                  &session_timeout,
-                                                  s);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Timeout rescheduled for session %p set to %s\n",
-             s,
-             GNUNET_STRINGS_relative_time_to_string (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT,
-                                                     GNUNET_YES));
+  struct Plugin *plugin = cls;
+  struct GNUNET_ATS_Session *session = value;
+
+  notify_session_monitor (plugin,
+                          session,
+                          GNUNET_TRANSPORT_SS_INIT);
+  /* FIXME: cannot tell if this is up or not from current
+     session state... */
+  notify_session_monitor (plugin,
+                          session,
+                          GNUNET_TRANSPORT_SS_UP);
+  return GNUNET_OK;
 }
 
 
 /**
- * Cancel timeout.
+ * Begin monitoring sessions of a plugin.  There can only
+ * be one active monitor per plugin (i.e. if there are
+ * multiple monitors, the transport service needs to
+ * multiplex the generated events over all of them).
  *
- * @param s session to cancel timeout for
+ * @param cls closure of the plugin
+ * @param sic callback to invoke, NULL to disable monitor;
+ *            plugin will being by iterating over all active
+ *            sessions immediately and then enter monitor mode
+ * @param sic_cls closure for @a sic
  */
 static void
-stop_session_timeout (struct Session *s)
+tcp_plugin_setup_monitor (void *cls,
+                          GNUNET_TRANSPORT_SessionInfoCallback sic,
+                          void *sic_cls)
 {
-  GNUNET_assert (NULL != s);
+  struct Plugin *plugin = cls;
 
-  if (GNUNET_SCHEDULER_NO_TASK != s->timeout_task)
+  plugin->sic = sic;
+  plugin->sic_cls = sic_cls;
+  if (NULL != sic)
   {
-    GNUNET_SCHEDULER_cancel (s->timeout_task);
-    s->timeout_task = GNUNET_SCHEDULER_NO_TASK;
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Timeout stopped for session %p canceled\n",
-                s);
+    GNUNET_CONTAINER_multipeermap_iterate (plugin->sessionmap,
+                                           &send_session_info_iter,
+                                           plugin);
+    /* signal end of first iteration */
+    sic (sic_cls, NULL, NULL);
   }
 }
 
-/**
- * Function obtain the network type for a session
- *
- * @param cls closure ('struct Plugin*')
- * @param session the session
- * @return the network type in HBO or #GNUNET_SYSERR
- */
-static enum GNUNET_ATS_Network_Type
-tcp_get_network (void *cls,
-                struct Session *session)
-{
-  GNUNET_assert (NULL != session);
-  return session->ats_address_network_type;
-}
-
 
 /**
  * Entry point for the plugin.
  *
- * @param cls closure, the 'struct GNUNET_TRANSPORT_PluginEnvironment*'
- * @return the 'struct GNUNET_TRANSPORT_PluginFunctions*' or NULL on error
+ * @param cls closure, the `struct GNUNET_TRANSPORT_PluginEnvironment *`
+ * @return the `struct GNUNET_TRANSPORT_PluginFunctions *` or NULL on error
  */
 void *
 libgnunet_plugin_transport_tcp_init (void *cls)
 {
   static const struct GNUNET_SERVER_MessageHandler my_handlers[] = {
-    {&handle_tcp_welcome, NULL, GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME,
-     sizeof (struct WelcomeMessage)},
-    {&handle_tcp_nat_probe, NULL, GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE,
-     sizeof (struct TCP_NAT_ProbeMessage)},
-    {&handle_tcp_data, NULL, GNUNET_MESSAGE_TYPE_ALL, 0},
-    {NULL, NULL, 0, 0}
+    { &handle_tcp_welcome, NULL,
+      GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME,
+      sizeof(struct WelcomeMessage) },
+    { &handle_tcp_nat_probe, NULL,
+      GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE,
+      sizeof(struct TCP_NAT_ProbeMessage) },
+    { &handle_tcp_data, NULL,
+      GNUNET_MESSAGE_TYPE_ALL, 0 },
+    { NULL, NULL, 0, 0 }
   };
   struct GNUNET_TRANSPORT_PluginEnvironment *env = cls;
   struct GNUNET_TRANSPORT_PluginFunctions *api;
@@ -2571,114 +2883,178 @@ libgnunet_plugin_transport_tcp_init (void *cls)
   unsigned long long max_connections;
   unsigned int i;
   struct GNUNET_TIME_Relative idle_timeout;
+#ifdef TCP_STEALTH
+  struct GNUNET_NETWORK_Handle *const*lsocks;
+#endif
   int ret;
   int ret_s;
   struct sockaddr **addrs;
   socklen_t *addrlens;
 
-
   if (NULL == env->receive)
   {
     /* run in 'stub' mode (i.e. as part of gnunet-peerinfo), don't fully
-       initialze the plugin or the API */
+     initialze the plugin or the API */
     api = GNUNET_new (struct GNUNET_TRANSPORT_PluginFunctions);
     api->cls = NULL;
     api->address_pretty_printer = &tcp_plugin_address_pretty_printer;
-    api->address_to_string = &tcp_address_to_string;
-    api->string_to_address = &tcp_string_to_address;
+    api->address_to_string = &tcp_plugin_address_to_string;
+    api->string_to_address = &tcp_plugin_string_to_address;
     return api;
   }
 
   GNUNET_assert (NULL != env->cfg);
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp",
+      GNUNET_CONFIGURATION_get_value_number (env->cfg,
+                                             "transport-tcp",
                                              "MAX_CONNECTIONS",
                                              &max_connections))
     max_connections = 128;
 
   aport = 0;
   if ((GNUNET_OK !=
-       GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp", "PORT",
-                                              &bport)) || (bport > 65535) ||
+       GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp",
+                                              "PORT", &bport)) ||
+      (bport > 65535) ||
       ((GNUNET_OK ==
         GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp",
                                                "ADVERTISED-PORT", &aport)) &&
-       (aport > 65535)))
+       (aport > 65535) ))
   {
-    LOG (GNUNET_ERROR_TYPE_ERROR,
-        _("Require valid port number for service `%s' in configuration!\n"),
-        "transport-tcp");
-    return NULL;
+    LOG(GNUNET_ERROR_TYPE_ERROR,
+        _("Require valid port number for service `%s' in configuration!\n"),
+        "transport-tcp");
+    return NULL ;
   }
-  if (aport == 0)
+  if (0 == aport)
     aport = bport;
-  if (bport == 0)
+  if (0 == bport)
     aport = 0;
-  if (bport != 0)
+  if (0 != bport)
   {
-    service = GNUNET_SERVICE_start ("transport-tcp", env->cfg, GNUNET_SERVICE_OPTION_NONE);
-    if (service == NULL)
+    service = GNUNET_SERVICE_start ("transport-tcp",
+                                    env->cfg,
+                                    GNUNET_SERVICE_OPTION_NONE);
+    if (NULL == service)
     {
       LOG (GNUNET_ERROR_TYPE_WARNING,
-          _("Failed to start service.\n"));
+           _("Failed to start service.\n"));
       return NULL;
     }
   }
   else
     service = NULL;
 
-  /* Initialize my flags */
-  myoptions = 0;
-
+  api = NULL;
   plugin = GNUNET_new (struct Plugin);
-  plugin->sessionmap = GNUNET_CONTAINER_multipeermap_create (max_connections, GNUNET_YES);
+  plugin->sessionmap = GNUNET_CONTAINER_multipeermap_create (max_connections,
+                                                             GNUNET_YES);
   plugin->max_connections = max_connections;
-  plugin->cur_connections = 0;
   plugin->open_port = bport;
   plugin->adv_port = aport;
   plugin->env = env;
-  plugin->lsock = NULL;
-  if ((service != NULL) &&
-      (GNUNET_SYSERR !=
-       (ret_s =
-        GNUNET_SERVICE_get_server_addresses ("transport-tcp", env->cfg, &addrs,
-                                             &addrlens))))
+  plugin->my_welcome.header.size = htons (sizeof(struct WelcomeMessage));
+  plugin->my_welcome.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME);
+  plugin->my_welcome.clientIdentity = *plugin->env->my_identity;
+
+  if ( (NULL != service) &&
+       (GNUNET_YES ==
+        GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
+                                              "transport-tcp",
+                                              "TCP_STEALTH")) )
+  {
+#ifdef TCP_STEALTH
+    plugin->myoptions |= TCP_OPTIONS_TCP_STEALTH;
+    lsocks = GNUNET_SERVICE_get_listen_sockets (service);
+    if (NULL != lsocks)
+    {
+      uint32_t len = sizeof (struct WelcomeMessage);
+
+      for (i=0;NULL!=lsocks[i];i++)
+      {
+        if ( (GNUNET_OK !=
+              GNUNET_NETWORK_socket_setsockopt (lsocks[i],
+                                                IPPROTO_TCP,
+                                                TCP_STEALTH,
+                                                env->my_identity,
+                                                sizeof (struct GNUNET_PeerIdentity))) ||
+             (GNUNET_OK !=
+              GNUNET_NETWORK_socket_setsockopt (lsocks[i],
+                                                IPPROTO_TCP,
+                                                TCP_STEALTH_INTEGRITY_LEN,
+                                                &len,
+                                                sizeof (len))) )
+        {
+          /* TCP STEALTH not supported by kernel */
+          GNUNET_assert (0 == i);
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      _("TCP_STEALTH not supported on this platform.\n"));
+          goto die;
+        }
+      }
+    }
+#else
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _("TCP_STEALTH not supported on this platform.\n"));
+    goto die;
+#endif
+  }
+
+  if ( (NULL != service) &&
+       (GNUNET_SYSERR !=
+        (ret_s =
+         GNUNET_SERVICE_get_server_addresses ("transport-tcp",
+                                              env->cfg,
+                                              &addrs,
+                                              &addrlens))))
   {
     for (ret = ret_s-1; ret >= 0; ret--)
       LOG (GNUNET_ERROR_TYPE_INFO,
-          "Binding to address `%s'\n",
-          GNUNET_a2s (addrs[ret], addrlens[ret]));
-    plugin->nat =
-        GNUNET_NAT_register (env->cfg, GNUNET_YES, aport, (unsigned int) ret_s,
+           "Binding to address `%s'\n",
+           GNUNET_a2s (addrs[ret], addrlens[ret]));
+    plugin->nat
+      = GNUNET_NAT_register (env->cfg,
+                             GNUNET_YES,
+                             aport,
+                             (unsigned int) ret_s,
                              (const struct sockaddr **) addrs, addrlens,
                              &tcp_nat_port_map_callback,
-                             &try_connection_reversal, plugin);
+                             &try_connection_reversal,
+                             plugin, NULL);
     for (ret = ret_s -1; ret >= 0; ret--)
-    {
-      GNUNET_assert (addrs[ret] != NULL);
       GNUNET_free (addrs[ret]);
-    }
     GNUNET_free_non_null (addrs);
     GNUNET_free_non_null (addrlens);
   }
   else
   {
     plugin->nat = GNUNET_NAT_register (plugin->env->cfg,
-                                      GNUNET_YES, 0, 0, NULL, NULL, NULL,
-                                      &try_connection_reversal, plugin);
+                                       GNUNET_YES,
+                                       0,
+                                       0,
+                                       NULL,
+                                       NULL,
+                                       NULL,
+                                       &try_connection_reversal,
+                                       plugin,
+                                       NULL);
   }
   api = GNUNET_new (struct GNUNET_TRANSPORT_PluginFunctions);
   api->cls = plugin;
   api->send = &tcp_plugin_send;
   api->get_session = &tcp_plugin_get_session;
-
-  api->disconnect_session = &tcp_disconnect_session;
+  api->disconnect_session = &tcp_plugin_disconnect_session;
+  api->query_keepalive_factor = &tcp_plugin_query_keepalive_factor;
   api->disconnect_peer = &tcp_plugin_disconnect;
   api->address_pretty_printer = &tcp_plugin_address_pretty_printer;
   api->check_address = &tcp_plugin_check_address;
-  api->address_to_string = &tcp_address_to_string;
-  api->string_to_address = &tcp_string_to_address;
-  api->get_network = &tcp_get_network;
+  api->address_to_string = &tcp_plugin_address_to_string;
+  api->string_to_address = &tcp_plugin_string_to_address;
+  api->get_network = &tcp_plugin_get_network;
+  api->get_network_for_address = &tcp_plugin_get_network_for_address;
+  api->update_session_timeout = &tcp_plugin_update_session_timeout;
+  api->update_inbound_delay = &tcp_plugin_update_inbound_delay;
+  api->setup_monitor = &tcp_plugin_setup_monitor;
   plugin->service = service;
   if (NULL != service)
   {
@@ -2687,52 +3063,74 @@ libgnunet_plugin_transport_tcp_init (void *cls)
   else
   {
     if (GNUNET_OK !=
-        GNUNET_CONFIGURATION_get_value_time (env->cfg, "transport-tcp",
-                                             "TIMEOUT", &idle_timeout))
+        GNUNET_CONFIGURATION_get_value_time (env->cfg,
+                                             "transport-tcp",
+                                             "TIMEOUT",
+                                             &idle_timeout))
     {
       GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
-                                "transport-tcp", "TIMEOUT");
-      if (plugin->nat != NULL)
-        GNUNET_NAT_unregister (plugin->nat);
-      GNUNET_free (plugin);
-      GNUNET_free (api);
-      return NULL;
+                                 "transport-tcp",
+                                 "TIMEOUT");
+      goto die;
     }
-    plugin->server =
-        GNUNET_SERVER_create_with_sockets (&plugin_tcp_access_check, plugin,
-                                           NULL, idle_timeout, GNUNET_YES);
+    plugin->server
+      = GNUNET_SERVER_create_with_sockets (NULL,
+                                           plugin,
+                                          NULL,
+                                           idle_timeout,
+                                          GNUNET_YES);
   }
   plugin->handlers = GNUNET_malloc (sizeof (my_handlers));
-  memcpy (plugin->handlers, my_handlers, sizeof (my_handlers));
-  for (i = 0;
-       i < sizeof (my_handlers) / sizeof (struct GNUNET_SERVER_MessageHandler);
-       i++)
+  memcpy (plugin->handlers, my_handlers, sizeof(my_handlers));
+  for (i = 0;i < sizeof(my_handlers) / sizeof(struct GNUNET_SERVER_MessageHandler);i++)
     plugin->handlers[i].callback_cls = plugin;
 
-  GNUNET_SERVER_add_handlers (plugin->server, plugin->handlers);
-  GNUNET_SERVER_disconnect_notify (plugin->server, &disconnect_notify, plugin);
-  plugin->nat_wait_conns = GNUNET_CONTAINER_multipeermap_create (16, GNUNET_YES);
-  if (bport != 0)
+  GNUNET_SERVER_add_handlers (plugin->server,
+                              plugin->handlers);
+  GNUNET_SERVER_connect_notify (plugin->server,
+                               &connect_notify,
+                               plugin);
+  GNUNET_SERVER_disconnect_notify (plugin->server,
+                                   &disconnect_notify,
+                                   plugin);
+  plugin->nat_wait_conns = GNUNET_CONTAINER_multipeermap_create (16,
+                                                                 GNUNET_YES);
+  if (0 != bport)
     LOG (GNUNET_ERROR_TYPE_INFO,
-        _("TCP transport listening on port %llu\n"), bport);
+         _("TCP transport listening on port %llu\n"),
+         bport);
   else
     LOG (GNUNET_ERROR_TYPE_INFO,
-        _("TCP transport not listening on any port (client only)\n"));
-  if (aport != bport)
+         _("TCP transport not listening on any port (client only)\n"));
+  if ( (aport != bport) &&
+       (0 != bport) )
     LOG (GNUNET_ERROR_TYPE_INFO,
          _("TCP transport advertises itself as being on port %llu\n"),
          aport);
   /* Initially set connections to 0 */
-  GNUNET_assert (NULL != plugin->env->stats);
   GNUNET_STATISTICS_set (plugin->env->stats,
-                        gettext_noop ("# TCP sessions active"), 0,
-                        GNUNET_NO);
+                         gettext_noop ("# TCP sessions active"),
+                         0,
+                         GNUNET_NO);
   return api;
+
+ die:
+  if (NULL != plugin->nat)
+    GNUNET_NAT_unregister (plugin->nat);
+  GNUNET_CONTAINER_multipeermap_destroy (plugin->sessionmap);
+  if (NULL != service)
+    GNUNET_SERVICE_stop (service);
+  GNUNET_free (plugin);
+  GNUNET_free_non_null (api);
+  return NULL;
 }
 
 
 /**
  * Exit point from the plugin.
+ *
+ * @param cls the `struct GNUNET_TRANSPORT_PluginFunctions`
+ * @return NULL
  */
 void *
 libgnunet_plugin_transport_tcp_done (void *cls)
@@ -2745,47 +3143,52 @@ libgnunet_plugin_transport_tcp_done (void *cls)
 
   if (NULL == plugin)
   {
-    GNUNET_free (api);
-    return NULL;
+    GNUNET_free(api);
+    return NULL ;
   }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Shutting down TCP plugin\n");
 
   /* Removing leftover sessions */
   GNUNET_CONTAINER_multipeermap_iterate (plugin->sessionmap,
-                                         &session_disconnect_it, plugin);
+                                         &session_disconnect_it,
+                                         plugin);
   /* Removing leftover NAT sessions */
   GNUNET_CONTAINER_multipeermap_iterate (plugin->nat_wait_conns,
-                                         &session_disconnect_it, plugin);
+                                         &session_disconnect_it,
+                                         plugin);
 
-  next = ppc_dll_head;
-  for (cur = next; NULL != cur; cur = next)
+  for (cur = plugin->ppc_dll_head; NULL != cur; cur = next)
   {
     next = cur->next;
-    GNUNET_CONTAINER_DLL_remove (ppc_dll_head, ppc_dll_tail, cur);
-    if (NULL != cur->resolver_handle)
-      GNUNET_RESOLVER_request_cancel (cur->resolver_handle);
-    GNUNET_SCHEDULER_cancel (cur->timeout_task);
+    GNUNET_CONTAINER_DLL_remove (plugin->ppc_dll_head,
+                                 plugin->ppc_dll_tail,
+                                 cur);
+    GNUNET_RESOLVER_request_cancel (cur->resolver_handle);
+    cur->asc (cur->asc_cls,
+             NULL,
+             GNUNET_OK);
     GNUNET_free (cur);
-    GNUNET_break (0);
   }
 
-  if (plugin->service != NULL)
+  if (NULL != plugin->service)
     GNUNET_SERVICE_stop (plugin->service);
   else
     GNUNET_SERVER_destroy (plugin->server);
   GNUNET_free (plugin->handlers);
-  if (plugin->nat != NULL)
+  if (NULL != plugin->nat)
     GNUNET_NAT_unregister (plugin->nat);
   while (NULL != (tcp_probe = plugin->probe_head))
   {
-    GNUNET_CONTAINER_DLL_remove (plugin->probe_head, plugin->probe_tail,
+    GNUNET_CONTAINER_DLL_remove (plugin->probe_head,
+                                 plugin->probe_tail,
                                  tcp_probe);
     GNUNET_CONNECTION_destroy (tcp_probe->sock);
     GNUNET_free (tcp_probe);
   }
   GNUNET_CONTAINER_multipeermap_destroy (plugin->nat_wait_conns);
   GNUNET_CONTAINER_multipeermap_destroy (plugin->sessionmap);
+  GNUNET_break (0 == plugin->cur_connections);
   GNUNET_free (plugin);
   GNUNET_free (api);
   return NULL;