undo 17963, better solution ahead
[oweals/gnunet.git] / src / transport / plugin_transport_tcp.c
index 7d104f371da36027091a7a5f738f1ae4a431adf1..5a77f25b57acee860475c677afaa245e57e07add 100644 (file)
  */
 #include "platform.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_constants.h"
 #include "gnunet_connection_lib.h"
 #include "gnunet_container_lib.h"
+#include "gnunet_nat_lib.h"
 #include "gnunet_os_lib.h"
 #include "gnunet_protocols.h"
 #include "gnunet_resolver_service.h"
 #include "gnunet_signatures.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_transport_service.h"
-#include "plugin_transport.h"
+#include "gnunet_transport_plugin.h"
 #include "transport.h"
 
-#define DEBUG_TCP GNUNET_YES
-#define DEBUG_TCP_NAT GNUNET_YES
-
-/**
- * How long until we give up on transmitting the welcome message?
- */
-#define HOSTNAME_RESOLVE_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
+#define DEBUG_TCP GNUNET_EXTRA_LOGGING
 
+#define DEBUG_TCP_NAT GNUNET_EXTRA_LOGGING
 
 /**
  * Initial handshake message for a session.
@@ -63,6 +60,7 @@ struct WelcomeMessage
 
 };
 
+
 /**
  * Basically a WELCOME message, but with the purpose
  * of giving the waiting peer a client handle to use
@@ -81,11 +79,23 @@ struct TCP_NAT_ProbeMessage
 
 };
 
+
 /**
  * Context for sending a NAT probe via TCP.
  */
 struct TCPProbeContext
 {
+
+  /**
+   * Active probes are kept in a DLL.
+   */
+  struct TCPProbeContext *next;
+
+  /**
+   * Active probes are kept in a DLL.
+   */
+  struct TCPProbeContext *prev;
+
   /**
    * Probe connection.
    */
@@ -121,7 +131,7 @@ struct IPv4TcpAddress
   /**
    * Port number, in network byte order.
    */
-  uint16_t t_port GNUNET_PACKED;
+  uint16_t t4_port GNUNET_PACKED;
 
 };
 
@@ -143,37 +153,13 @@ struct IPv6TcpAddress
 
 };
 
+
 /**
  * Encapsulation of all of the state of the plugin.
  */
 struct Plugin;
 
 
-/**
- * Local network addresses (actual IP address follows this struct).
- * PORT is NOT included!
- */
-struct LocalAddrList
-{
-
-  /**
-   * This is a doubly linked list.
-   */
-  struct LocalAddrList *next;
-
-  /**
-   * This is a doubly linked list.
-   */
-  struct LocalAddrList *prev;
-
-  /**
-   * Number of bytes of the address that follow
-   */
-  size_t size;
-
-};
-
-
 /**
  * Information kept for each message that is yet to
  * be transmitted.
@@ -328,24 +314,9 @@ struct Plugin
   struct GNUNET_CONNECTION_Handle *lsock;
 
   /**
-   * stdout pipe handle for the gnunet-nat-server process
-   */
-  struct GNUNET_DISK_PipeHandle *server_stdout;
-
-  /**
-   * stdout file handle (for reading) for the gnunet-nat-server process
+   * Our handle to the NAT module.
    */
-  const struct GNUNET_DISK_FileHandle *server_stdout_handle;
-
-  /**
-   * ID of select gnunet-nat-server stdout read task
-   */
-  GNUNET_SCHEDULER_TaskIdentifier server_read_task;
-
-  /**
-   * The process id of the server process (if behind NAT)
-   */
-  pid_t server_pid;
+  struct GNUNET_NAT_Handle *nat;
 
   /**
    * List of open TCP sessions.
@@ -368,41 +339,30 @@ struct Plugin
    */
   struct GNUNET_SERVER_MessageHandler *handlers;
 
-  /**
-   * Handle for request of hostname resolution, non-NULL if pending.
-   */
-  struct GNUNET_RESOLVER_RequestHandle *hostname_dns;
-
   /**
    * Map of peers we have tried to contact behind a NAT
    */
   struct GNUNET_CONTAINER_MultiHashMap *nat_wait_conns;
 
   /**
-   * The external address given to us by the user.  Must be actual
-   * outside visible address for NAT punching to work.
-   */
-  char *external_address;
-
-  /**
-   * The internal address given to us by the user (or discovered).
+   * List of active TCP probes.
    */
-  char *internal_address;
+  struct TCPProbeContext *probe_head;
 
   /**
-   * Address given for us to bind to (ONLY).
+   * List of active TCP probes.
    */
-  char *bind_address;
+  struct TCPProbeContext *probe_tail;
 
   /**
-   * List of our IP addresses.
+   * Handle for (DYN)DNS lookup of our external IP.
    */
-  struct LocalAddrList *lal_head;
+  struct GNUNET_RESOLVER_RequestHandle *ext_dns;
 
   /**
-   * Tail of our IP address list.
+   * How many more TCP sessions are we allowed to open right now?
    */
-  struct LocalAddrList *lal_tail;
+  unsigned long long max_connections;
 
   /**
    * ID of task used to update our addresses when one expires.
@@ -420,66 +380,81 @@ struct Plugin
    */
   uint16_t adv_port;
 
-  /**
-   * Is this transport configured to be behind a NAT?
-   */
-  int behind_nat;
-
-  /**
-   * Is this transport configured to allow connections to NAT'd peers?
-   */
-  int allow_nat;
-
-  /**
-   * Should this transport advertise only NAT addresses (port set to 0)?
-   * If not, all addresses will be duplicated for NAT punching and regular
-   * ports.
-   */
-  int only_nat_addresses;
-
 };
 
 
-static void
-add_to_address_list (struct Plugin *plugin,
-                    const void *arg,
-                    size_t arg_size)
+/**
+ * Function to check if an inbound connection is acceptable.
+ * Mostly used to limit the total number of open connections
+ * we can have.
+ *
+ * @param cls the 'struct Plugin'
+ * @param ucred credentials, if available, otherwise NULL
+ * @param addr address
+ * @param addrlen length of address
+ * @return GNUNET_YES to allow, GNUNET_NO to deny, GNUNET_SYSERR
+ *   for unknown address family (will be denied).
+ */
+static int
+plugin_tcp_access_check (void *cls,
+                         const struct GNUNET_CONNECTION_Credentials *ucred,
+                         const struct sockaddr *addr, socklen_t addrlen)
 {
-  struct LocalAddrList *lal;
+  struct Plugin *plugin = cls;
 
-  lal = plugin->lal_head;
-  while (NULL != lal)
-    {
-      if ( (lal->size == arg_size) &&
-          (0 == memcmp (&lal[1], arg, arg_size)) )
-       return;
-      lal = lal->next;
-    }
-  lal = GNUNET_malloc (sizeof (struct LocalAddrList) + arg_size);
-  lal->size = arg_size;
-  memcpy (&lal[1], arg, arg_size);
-  GNUNET_CONTAINER_DLL_insert (plugin->lal_head,
-                              plugin->lal_tail,
-                              lal);
+  if (0 == plugin->max_connections)
+    return GNUNET_NO;
+  plugin->max_connections--;
+  return GNUNET_YES;
 }
 
 
-static int
-check_local_addr (struct Plugin *plugin,
-                 const void *arg,
-                 size_t arg_size)
+/**
+ * Our external IP address/port mapping has changed.
+ *
+ * @param cls closure, the 'struct LocalAddrList'
+ * @param add_remove GNUNET_YES to mean the new public IP address, GNUNET_NO to mean
+ *     the previous (now invalid) one
+ * @param addr either the previous or the new public IP address
+ * @param addrlen actual lenght of the address
+ */
+static void
+tcp_nat_port_map_callback (void *cls, int add_remove,
+                           const struct sockaddr *addr, socklen_t addrlen)
 {
-  struct LocalAddrList *lal;
-
-  lal = plugin->lal_head;
-  while (NULL != lal)
-    {
-      if ( (lal->size == arg_size) &&
-          (0 == memcmp (&lal[1], arg, arg_size)) )
-       return GNUNET_OK;
-      lal = lal->next;
-    }
-  return GNUNET_SYSERR;
+  struct Plugin *plugin = cls;
+  struct IPv4TcpAddress t4;
+  struct IPv6TcpAddress t6;
+  void *arg;
+  size_t args;
+
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "NPMC called with %d for address `%s'\n", add_remove,
+                   GNUNET_a2s (addr, addrlen));
+  /* convert 'addr' to our internal format */
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (addrlen == sizeof (struct sockaddr_in));
+    t4.ipv4_addr = ((struct sockaddr_in *) addr)->sin_addr.s_addr;
+    t4.t4_port = ((struct sockaddr_in *) addr)->sin_port;
+    arg = &t4;
+    args = sizeof (t4);
+    break;
+  case AF_INET6:
+    GNUNET_assert (addrlen == sizeof (struct sockaddr_in6));
+    memcpy (&t6.ipv6_addr, &((struct sockaddr_in6 *) addr)->sin6_addr,
+            sizeof (struct in6_addr));
+    t6.t6_port = ((struct sockaddr_in6 *) addr)->sin6_port;
+    arg = &t6;
+    args = sizeof (t6);
+    break;
+  default:
+    GNUNET_break (0);
+    return;
+  }
+  /* modify our published address list */
+  plugin->env->notify_address (plugin->env->cls, add_remove, arg, args);
 }
 
 
@@ -494,10 +469,8 @@ check_local_addr (struct Plugin *plugin,
  * @param addrlen length of the address
  * @return string representing the same address
  */
-static const char*
-tcp_address_to_string (void *cls,
-                      const void *addr,
-                      size_t addrlen)
+static const char *
+tcp_address_to_string (void *cls, const void *addr, size_t addrlen)
 {
   static char rbuf[INET6_ADDRSTRLEN + 12];
   char buf[INET6_ADDRSTRLEN];
@@ -510,39 +483,36 @@ tcp_address_to_string (void *cls,
   uint16_t port;
 
   if (addrlen == sizeof (struct IPv6TcpAddress))
-    {
-      t6 = addr;
-      af = AF_INET6;
-      port = ntohs (t6->t6_port);
-      memcpy (&a6, &t6->ipv6_addr, sizeof (a6));
-      sb = &a6;
-    }
+  {
+    t6 = addr;
+    af = AF_INET6;
+    port = ntohs (t6->t6_port);
+    memcpy (&a6, &t6->ipv6_addr, sizeof (a6));
+    sb = &a6;
+  }
   else if (addrlen == sizeof (struct IPv4TcpAddress))
-    {
-      t4 = addr;
-      af = AF_INET;
-      port = ntohs (t4->t_port);
-      memcpy (&a4, &t4->ipv4_addr, sizeof (a4));
-      sb = &a4;
-    }
+  {
+    t4 = addr;
+    af = AF_INET;
+    port = ntohs (t4->t4_port);
+    memcpy (&a4, &t4->ipv4_addr, sizeof (a4));
+    sb = &a4;
+  }
   else
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 _("Unexpected address length: %u\n"),
-                 addrlen);
-      GNUNET_break (0);
-      return NULL;
-    }
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "tcp",
+                     _("Unexpected address length: %u bytes\n"),
+                     (unsigned int) addrlen);
+    GNUNET_break (0);
+    return NULL;
+  }
   if (NULL == inet_ntop (af, sb, buf, INET6_ADDRSTRLEN))
-    {
-      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "inet_ntop");
-      return NULL;
-    }
-  GNUNET_snprintf (rbuf,
-                  sizeof (rbuf),
-                  (af == AF_INET6) ? "[%s]:%u" : "%s:%u",
-                  buf,
-                  port);
+  {
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "inet_ntop");
+    return NULL;
+  }
+  GNUNET_snprintf (rbuf, sizeof (rbuf), (af == AF_INET6) ? "[%s]:%u" : "%s:%u",
+                   buf, port);
   return rbuf;
 }
 
@@ -550,6 +520,8 @@ tcp_address_to_string (void *cls,
 /**
  * Find the session handle for the given client.
  *
+ * @param plugin the plugin
+ * @param client which client to find the session handle for
  * @return NULL if no matching session exists
  */
 static struct Session *
@@ -564,10 +536,11 @@ find_session_by_client (struct Plugin *plugin,
   return ret;
 }
 
+
 /**
  * Create a new session.  Also queues a welcome message.
  *
- * @param plugin us
+ * @param plugin the plugin
  * @param target peer to connect to
  * @param client client to use
  * @param is_nat this a NAT session, we should wait for a client to
@@ -576,8 +549,7 @@ find_session_by_client (struct Plugin *plugin,
  * @return new session object
  */
 static struct Session *
-create_session (struct Plugin *plugin,
-                const struct GNUNET_PeerIdentity *target,
+create_session (struct Plugin *plugin, const struct GNUNET_PeerIdentity *target,
                 struct GNUNET_SERVER_Client *client, int is_nat)
 {
   struct Session *ret;
@@ -588,26 +560,26 @@ create_session (struct Plugin *plugin,
     GNUNET_assert (client != NULL);
   else
     GNUNET_assert (client == NULL);
-
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Creating new session for peer `%4s'\n",
-                  GNUNET_i2s (target));
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Creating new session for peer `%4s'\n",
+                   GNUNET_i2s (target));
 #endif
   ret = GNUNET_malloc (sizeof (struct Session));
   ret->last_activity = GNUNET_TIME_absolute_get ();
   ret->plugin = plugin;
   ret->is_nat = is_nat;
-  if (is_nat != GNUNET_YES) /* If not a NAT WAIT conn, add it to global list */
-    {
-      ret->next = plugin->sessions;
-      plugin->sessions = ret;
-    }
+  if (is_nat != GNUNET_YES)     /* If not a NAT WAIT conn, add it to global list */
+  {
+    ret->next = plugin->sessions;
+    plugin->sessions = ret;
+  }
   ret->client = client;
   ret->target = *target;
   ret->expecting_welcome = GNUNET_YES;
-  pm = GNUNET_malloc (sizeof (struct PendingMessage) + sizeof (struct WelcomeMessage));
-  pm->msg = (const char*) &pm[1];
+  pm = GNUNET_malloc (sizeof (struct PendingMessage) +
+                      sizeof (struct WelcomeMessage));
+  pm->msg = (const char *) &pm[1];
   pm->message_size = sizeof (struct WelcomeMessage);
   welcome.header.size = htons (sizeof (struct WelcomeMessage));
   welcome.header.type = htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME);
@@ -615,16 +587,13 @@ create_session (struct Plugin *plugin,
   memcpy (&pm[1], &welcome, sizeof (welcome));
   pm->timeout = GNUNET_TIME_UNIT_FOREVER_ABS;
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes currently in TCP buffers"),
-                           pm->message_size,
-                           GNUNET_NO);
+                            gettext_noop ("# bytes currently in TCP buffers"),
+                            pm->message_size, GNUNET_NO);
   GNUNET_CONTAINER_DLL_insert (ret->pending_messages_head,
-                              ret->pending_messages_tail,
-                              pm);
+                               ret->pending_messages_tail, pm);
   if (is_nat != GNUNET_YES)
     GNUNET_STATISTICS_update (plugin->env->stats,
-                              gettext_noop ("# TCP sessions active"),
-                              1,
+                              gettext_noop ("# TCP sessions active"), 1,
                               GNUNET_NO);
   return ret;
 }
@@ -636,7 +605,8 @@ create_session (struct Plugin *plugin,
  *
  * @param session for which session should we do this
  */
-static void process_pending_messages (struct Session *session);
+static void
+process_pending_messages (struct Session *session);
 
 
 /**
@@ -663,110 +633,107 @@ do_transmit (void *cls, size_t size, void *buf)
   char *cbuf;
   size_t ret;
 
+  GNUNET_assert (session != NULL);
   session->transmit_handle = NULL;
   plugin = session->plugin;
   if (buf == NULL)
-    {
+  {
 #if DEBUG_TCP
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                       "Timeout trying to transmit to peer `%4s', discarding message queue.\n",
-                       GNUNET_i2s (&session->target));
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Timeout trying to transmit to peer `%4s', discarding message queue.\n",
+                     GNUNET_i2s (&session->target));
 #endif
-      /* timeout; cancel all messages that have already expired */
-      hd = NULL;
-      tl = NULL;
-      ret = 0;
-      now = GNUNET_TIME_absolute_get ();
-      while ( (NULL != (pos = session->pending_messages_head)) &&
-             (pos->timeout.value <= now.value) )
-       {
-         GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                      session->pending_messages_tail,
-                                      pos);
+    /* timeout; cancel all messages that have already expired */
+    hd = NULL;
+    tl = NULL;
+    ret = 0;
+    now = GNUNET_TIME_absolute_get ();
+    while ((NULL != (pos = session->pending_messages_head)) &&
+           (pos->timeout.abs_value <= now.abs_value))
+    {
+      GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
+                                   session->pending_messages_tail, pos);
 #if DEBUG_TCP
-          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                           "Failed to transmit %u byte message to `%4s'.\n",
-                          pos->message_size,
-                           GNUNET_i2s (&session->target));
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Failed to transmit %u byte message to `%4s'.\n",
+                       pos->message_size, GNUNET_i2s (&session->target));
 #endif
-         ret += pos->message_size;
-         GNUNET_CONTAINER_DLL_insert_after (hd, tl, tl, pos);
-        }
-      /* do this call before callbacks (so that if callbacks destroy
-        session, they have a chance to cancel actions done by this
-        call) */
-      process_pending_messages (session);
-      pid = session->target;
-      /* no do callbacks and do not use session again since
-        the callbacks may abort the session */
-      while (NULL != (pos = hd))
-       {
-         GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
-         if (pos->transmit_cont != NULL)
-           pos->transmit_cont (pos->transmit_cont_cls,
-                               &pid, GNUNET_SYSERR);
-         GNUNET_free (pos);
-       }
-      GNUNET_STATISTICS_update (plugin->env->stats,
-                               gettext_noop ("# bytes currently in TCP buffers"),
-                               - (int64_t) ret,
-                               GNUNET_NO);
-      GNUNET_STATISTICS_update (plugin->env->stats,
-                               gettext_noop ("# bytes discarded by TCP (timeout)"),
-                               ret,
-                               GNUNET_NO);
-      return 0;
+      ret += pos->message_size;
+      GNUNET_CONTAINER_DLL_insert_after (hd, tl, tl, pos);
     }
+    /* do this call before callbacks (so that if callbacks destroy
+     * session, they have a chance to cancel actions done by this
+     * call) */
+    process_pending_messages (session);
+    pid = session->target;
+    /* no do callbacks and do not use session again since
+     * the callbacks may abort the session */
+    while (NULL != (pos = hd))
+    {
+      GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
+      if (pos->transmit_cont != NULL)
+        pos->transmit_cont (pos->transmit_cont_cls, &pid, GNUNET_SYSERR);
+      GNUNET_free (pos);
+    }
+    GNUNET_STATISTICS_update (plugin->env->stats,
+                              gettext_noop ("# bytes currently in TCP buffers"),
+                              -(int64_t) ret, GNUNET_NO);
+    GNUNET_STATISTICS_update (plugin->env->stats,
+                              gettext_noop
+                              ("# bytes discarded by TCP (timeout)"), ret,
+                              GNUNET_NO);
+    return 0;
+  }
   /* copy all pending messages that would fit */
   ret = 0;
   cbuf = buf;
   hd = NULL;
   tl = NULL;
   while (NULL != (pos = session->pending_messages_head))
-    {
-      if (ret + pos->message_size > size)
-       break;
-      GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                  session->pending_messages_tail,
-                                  pos);
-      GNUNET_assert (size >= pos->message_size);
-      /* FIXME: this memcpy can be up to 7% of our total runtime */
-      memcpy (cbuf, pos->msg, pos->message_size);
-      cbuf += pos->message_size;
-      ret += pos->message_size;
-      size -= pos->message_size;
-      GNUNET_CONTAINER_DLL_insert_after (hd, tl, tl, pos);
-    }
+  {
+    if (ret + pos->message_size > size)
+      break;
+    GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
+                                 session->pending_messages_tail, pos);
+    GNUNET_assert (size >= pos->message_size);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG,
+                    "tcp",
+                    "Transmitting message of type %u\n",
+                    ntohs (((struct GNUNET_MessageHeader*)pos->msg)->type));
+    /* FIXME: this memcpy can be up to 7% of our total runtime */
+    memcpy (cbuf, pos->msg, pos->message_size);
+    cbuf += pos->message_size;
+    ret += pos->message_size;
+    size -= pos->message_size;
+    GNUNET_CONTAINER_DLL_insert_tail (hd, tl, pos);
+  }
   /* schedule 'continuation' before callbacks so that callbacks that
-     cancel everything don't cause us to use a session that no longer
-     exists... */
+   * cancel everything don't cause us to use a session that no longer
+   * exists... */
   process_pending_messages (session);
   session->last_activity = GNUNET_TIME_absolute_get ();
   pid = session->target;
   /* we'll now call callbacks that may cancel the session; hence
-     we should not use 'session' after this point */
+   * we should not use 'session' after this point */
   while (NULL != (pos = hd))
-    {
-      GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
-      if (pos->transmit_cont != NULL)
-        pos->transmit_cont (pos->transmit_cont_cls,
-                           &pid, GNUNET_OK);
-      GNUNET_free (pos);
-    }
+  {
+    GNUNET_CONTAINER_DLL_remove (hd, tl, pos);
+    if (pos->transmit_cont != NULL)
+      pos->transmit_cont (pos->transmit_cont_cls, &pid, GNUNET_OK);
+    GNUNET_free (pos);
+  }
   GNUNET_assert (hd == NULL);
   GNUNET_assert (tl == NULL);
 #if DEBUG_TCP > 1
-  GNUNET_log(GNUNET_ERROR_TYPE_DEBUG,
-             "Transmitting %u bytes\n", ret);
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp", "Transmitting %u bytes\n",
+                   ret);
 #endif
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes currently in TCP buffers"),
-                           - (int64_t) ret,
-                           GNUNET_NO);
+                            gettext_noop ("# bytes currently in TCP buffers"),
+                            -(int64_t) ret, GNUNET_NO);
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes transmitted via TCP"),
-                           ret,
-                           GNUNET_NO);
+                            gettext_noop ("# bytes transmitted via TCP"), ret,
+                            GNUNET_NO);
   return ret;
 }
 
@@ -788,12 +755,11 @@ process_pending_messages (struct Session *session)
   if (NULL == (pm = session->pending_messages_head))
     return;
 
-  session->transmit_handle
-    = GNUNET_SERVER_notify_transmit_ready (session->client,
-                                           pm->message_size,
+  session->transmit_handle =
+      GNUNET_SERVER_notify_transmit_ready (session->client, pm->message_size,
                                            GNUNET_TIME_absolute_get_remaining
-                                           (pm->timeout),
-                                           &do_transmit, session);
+                                           (pm->timeout), &do_transmit,
+                                           session);
 }
 
 
@@ -812,80 +778,76 @@ disconnect_session (struct Session *session)
   struct PendingMessage *pm;
 
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "Disconnecting from `%4s' at %s (session %p).\n",
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Disconnecting from `%4s' at %s.\n",
                    GNUNET_i2s (&session->target),
-                   (session->connect_addr != NULL) ?
-                   tcp_address_to_string (session->plugin,
-                                         session->connect_addr,
-                                         session->connect_alen) : "*",
-                  session);
+                   (session->connect_addr !=
+                    NULL) ? tcp_address_to_string (session->plugin,
+                                                   session->connect_addr,
+                                                   session->connect_alen) :
+                   "*");
 #endif
   /* remove from session list */
   prev = NULL;
   pos = session->plugin->sessions;
   while (pos != session)
-    {
-      prev = pos;
-      pos = pos->next;
-    }
+  {
+    prev = pos;
+    pos = pos->next;
+  }
   if (prev == NULL)
     session->plugin->sessions = session->next;
   else
     prev->next = session->next;
-  session->plugin->env->session_end (session->plugin->env->cls,
-                                    &session->target,
-                                    session);
+
   /* clean up state */
   if (session->transmit_handle != NULL)
-    {
-      GNUNET_CONNECTION_notify_transmit_ready_cancel
-        (session->transmit_handle);
-      session->transmit_handle = NULL;
-    }
+  {
+    GNUNET_CONNECTION_notify_transmit_ready_cancel (session->transmit_handle);
+    session->transmit_handle = NULL;
+  }
+  session->plugin->env->session_end (session->plugin->env->cls,
+                                     &session->target, session);
   while (NULL != (pm = session->pending_messages_head))
-    {
+  {
 #if DEBUG_TCP
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-
-                       pm->transmit_cont != NULL
-                       ? "Could not deliver message to `%4s'.\n"
-                       :
-                       "Could not deliver message to `%4s', notifying.\n",
-                       GNUNET_i2s (&session->target));
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     pm->transmit_cont !=
+                     NULL ? "Could not deliver message to `%4s'.\n" :
+                     "Could not deliver message to `%4s', notifying.\n",
+                     GNUNET_i2s (&session->target));
 #endif
-      GNUNET_STATISTICS_update (session->plugin->env->stats,
-                               gettext_noop ("# bytes currently in TCP buffers"),
-                               - (int64_t) pm->message_size,
-                               GNUNET_NO);
-      GNUNET_STATISTICS_update (session->plugin->env->stats,
-                               gettext_noop ("# bytes discarded by TCP (disconnect)"),
-                               pm->message_size,
-                               GNUNET_NO);
-      GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
-                                  session->pending_messages_tail,
-                                  pm);
-      if (NULL != pm->transmit_cont)
-        pm->transmit_cont (pm->transmit_cont_cls,
-                           &session->target, GNUNET_SYSERR);
-      GNUNET_free (pm);
-    }
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop ("# bytes currently in TCP buffers"),
+                              -(int64_t) pm->message_size, GNUNET_NO);
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop
+                              ("# bytes discarded by TCP (disconnect)"),
+                              pm->message_size, GNUNET_NO);
+    GNUNET_CONTAINER_DLL_remove (session->pending_messages_head,
+                                 session->pending_messages_tail, pm);
+    if (NULL != pm->transmit_cont)
+      pm->transmit_cont (pm->transmit_cont_cls, &session->target,
+                         GNUNET_SYSERR);
+    GNUNET_free (pm);
+  }
   GNUNET_break (session->client != NULL);
   if (session->receive_delay_task != GNUNET_SCHEDULER_NO_TASK)
-    {
-      GNUNET_SCHEDULER_cancel (session->plugin->env->sched,
-                              session->receive_delay_task);
-      if (session->client != NULL)
-       GNUNET_SERVER_receive_done (session->client,
-                                   GNUNET_SYSERR);     
-    }
-  if (session->client != NULL) 
+  {
+    GNUNET_SCHEDULER_cancel (session->receive_delay_task);
+    if (session->client != NULL)
+      GNUNET_SERVER_receive_done (session->client, GNUNET_SYSERR);
+  }
+  if (session->client != NULL)
+  {
     GNUNET_SERVER_client_drop (session->client);
+    session->client = NULL;
+  }
   GNUNET_STATISTICS_update (session->plugin->env->stats,
-                           gettext_noop ("# TCP sessions active"),
-                           -1,
-                           GNUNET_NO);
+                            gettext_noop ("# TCP sessions active"), -1,
+                            GNUNET_NO);
   GNUNET_free_non_null (session->connect_addr);
+  GNUNET_assert (NULL == session->transmit_handle);
   GNUNET_free (session);
 }
 
@@ -898,90 +860,30 @@ disconnect_session (struct Session *session)
  * @return "better" session (more active)
  */
 static struct Session *
-select_better_session (struct Session *s1,
-                      struct Session *s2)
+select_better_session (struct Session *s1, struct Session *s2)
 {
   if (s1 == NULL)
     return s2;
   if (s2 == NULL)
     return s1;
-  if ( (s1->expecting_welcome == GNUNET_NO) &&
-       (s2->expecting_welcome == GNUNET_YES) )
+  if ((s1->expecting_welcome == GNUNET_NO) &&
+      (s2->expecting_welcome == GNUNET_YES))
     return s1;
-  if ( (s1->expecting_welcome == GNUNET_YES) &&
-       (s2->expecting_welcome == GNUNET_NO) )
+  if ((s1->expecting_welcome == GNUNET_YES) &&
+      (s2->expecting_welcome == GNUNET_NO))
     return s2;
-  if (s1->last_activity.value < s2->last_activity.value)
+  if (s1->last_activity.abs_value < s2->last_activity.abs_value)
     return s2;
-  if (s1->last_activity.value > s2->last_activity.value)
+  if (s1->last_activity.abs_value > s2->last_activity.abs_value)
     return s1;
-  if ( (GNUNET_YES == s1->inbound) &&
-       (GNUNET_NO  == s2->inbound) )
+  if ((GNUNET_YES == s1->inbound) && (GNUNET_NO == s2->inbound))
     return s1;
-  if ( (GNUNET_NO  == s1->inbound) &&
-       (GNUNET_YES == s2->inbound) )
+  if ((GNUNET_NO == s1->inbound) && (GNUNET_YES == s2->inbound))
     return s2;
   return s1;
 }
 
 
-/**
- * We learned about a peer (possibly behind NAT) so run the
- * gnunet-nat-client to send dummy ICMP responses
- *
- * @param plugin the plugin for this transport
- * @param addr the address of the peer
- * @param addrlen the length of the address
- */
-void
-run_gnunet_nat_client (struct Plugin *plugin, const char *addr, size_t addrlen)
-{
-  char inet4[INET_ADDRSTRLEN];
-  char *address_as_string;
-  char *port_as_string;
-  pid_t pid;
-  const struct sockaddr *sa = (const struct sockaddr *)addr;
-
-#if DEBUG_TCP_NAT
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  _("called run_gnunet_nat_client addrlen %d others are %d and %d\n"), addrlen, sizeof (struct sockaddr), sizeof (struct sockaddr_in));
-#endif
-
-  if (addrlen < sizeof (struct sockaddr))
-    return;
-
-  switch (sa->sa_family)
-    {
-    case AF_INET:
-      if (addrlen != sizeof (struct sockaddr_in))
-        return;
-      if (NULL == inet_ntop (AF_INET,
-                            &((struct sockaddr_in *) sa)->sin_addr,
-                            inet4, INET_ADDRSTRLEN))
-       {
-         GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "inet_ntop");
-         return;
-       }
-      address_as_string = GNUNET_strdup (inet4);
-      break;
-    case AF_INET6:
-    default:
-      return;
-    }
-
-  GNUNET_asprintf(&port_as_string, "%d", plugin->adv_port);
-#if DEBUG_TCP_NAT
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  _("Running gnunet-nat-client with arguments: %s %s %d\n"), plugin->external_address, address_as_string, plugin->adv_port);
-#endif
-
-  /* Start the client process */
-  pid = GNUNET_OS_start_process(NULL, NULL, "gnunet-nat-client", "gnunet-nat-client", plugin->external_address, address_as_string, port_as_string, NULL);
-  GNUNET_free(address_as_string);
-  GNUNET_free(port_as_string);
-  GNUNET_OS_process_wait (pid);
-}
-
 
 /**
  * Function that can be used by the transport service to transmit
@@ -1020,16 +922,10 @@ run_gnunet_nat_client (struct Plugin *plugin, const char *addr, size_t addrlen)
  *         and does NOT mean that the message was not transmitted (DV and NAT)
  */
 static ssize_t
-tcp_plugin_send (void *cls,
-                 const struct GNUNET_PeerIdentity *target,
-                 const char *msg,
-                 size_t msgbuf_size,
-                 uint32_t priority,
-                 struct GNUNET_TIME_Relative timeout,
-                struct Session *session,
-                const void *addr,
-                size_t addrlen,
-                int force_address,
+tcp_plugin_send (void *cls, const struct GNUNET_PeerIdentity *target,
+                 const char *msg, size_t msgbuf_size, uint32_t priority,
+                 struct GNUNET_TIME_Relative timeout, struct Session *session,
+                 const void *addr, size_t addrlen, int force_address,
                  GNUNET_TRANSPORT_TransmitContinuation cont, void *cont_cls)
 {
   struct Plugin *plugin = cls;
@@ -1047,202 +943,223 @@ tcp_plugin_send (void *cls,
   unsigned int is_natd;
 
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes TCP was asked to transmit"),
-                           msgbuf_size,
-                           GNUNET_NO);
+                            gettext_noop ("# bytes TCP was asked to transmit"),
+                            msgbuf_size, GNUNET_NO);
   /* FIXME: we could do this cheaper with a hash table
-     where we could restrict the iteration to entries that match
-     the target peer... */
+   * where we could restrict the iteration to entries that match
+   * the target peer... */
   is_natd = GNUNET_NO;
   if (session == NULL)
+  {
+    cand_session = NULL;
+    next = plugin->sessions;
+    while (NULL != (session = next))
     {
-      cand_session = NULL;
-      next = plugin->sessions;
-      while (NULL != (session = next))
-       {
-         next = session->next;
-         GNUNET_assert (session->client != NULL);
-         if (0 != memcmp (target,
-                          &session->target,
-                          sizeof (struct GNUNET_PeerIdentity)))
-           continue;
-         if ( ( (GNUNET_SYSERR == force_address) &&
-                (session->expecting_welcome == GNUNET_NO) ) ||
-              (GNUNET_NO == force_address) )
-           {
-             cand_session = select_better_session (cand_session,
-                                                   session);
-             continue;
-           }
-         if (GNUNET_SYSERR == force_address)
-           continue;
-         GNUNET_break (GNUNET_YES == force_address);
-         if (addr == NULL)
-           {
-             GNUNET_break (0);
-             break;
-           }
-         if (session->inbound == GNUNET_YES)
-           continue;
-         if ((addrlen != session->connect_alen) && (session->is_nat == GNUNET_NO))
-           continue;
-         if ((0 != memcmp (session->connect_addr,
-                          addr,
-                          addrlen)) && (session->is_nat == GNUNET_NO))
-           continue;
-         cand_session = select_better_session (cand_session,
-                                               session);       
-       }
-      session = cand_session;
-    }
-  if ( (session == NULL) &&
-       (addr == NULL) )
-    {
+      next = session->next;
+      GNUNET_assert (session->client != NULL);
+      if (0 !=
+          memcmp (target, &session->target,
+                  sizeof (struct GNUNET_PeerIdentity)))
+        continue;
+      if (((GNUNET_SYSERR == force_address) &&
+           (session->expecting_welcome == GNUNET_NO)) ||
+          (GNUNET_NO == force_address))
+      {
+        cand_session = select_better_session (cand_session, session);
+        continue;
+      }
+      if (GNUNET_SYSERR == force_address)
+        continue;
+      GNUNET_break (GNUNET_YES == force_address);
+      if (addr == NULL)
+      {
+        GNUNET_break (0);
+        break;
+      }
+      if ((addrlen != session->connect_alen) && (session->is_nat == GNUNET_NO))
+        continue;
+      if ((0 != memcmp (session->connect_addr, addr, addrlen)) &&
+          (session->is_nat == GNUNET_NO))
+        continue;
+      cand_session = select_better_session (cand_session, session);
+    }
+    session = cand_session;
+  }
+  if ((session == NULL) && (addrlen == 0))
+  {
 #if DEBUG_TCP
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                       "Asked to transmit to `%4s' without address and I have no existing connection (failing).\n",
-                       GNUNET_i2s (target));
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Asked to transmit to `%4s' without address and I have no existing connection (failing).\n",
+                     GNUNET_i2s (target));
 #endif
-      GNUNET_STATISTICS_update (plugin->env->stats,
-                               gettext_noop ("# bytes discarded by TCP (no address and no connection)"),
-                               msgbuf_size,
-                               GNUNET_NO);
-      return -1;
-    }
+    GNUNET_STATISTICS_update (plugin->env->stats,
+                              gettext_noop
+                              ("# bytes discarded by TCP (no address and no connection)"),
+                              msgbuf_size, GNUNET_NO);
+    return -1;
+  }
   if (session == NULL)
+  {
+    if (addrlen == sizeof (struct IPv6TcpAddress))
     {
-      if (addrlen == sizeof (struct IPv6TcpAddress))
-       {
-         t6 = addr;
-         af = AF_INET6;
-         memset (&a6, 0, sizeof (a6));
+      t6 = addr;
+      af = AF_INET6;
+      memset (&a6, 0, sizeof (a6));
 #if HAVE_SOCKADDR_IN_SIN_LEN
-          a6.sin6_len = sizeof (a6);
+      a6.sin6_len = sizeof (a6);
 #endif
-         a6.sin6_family = AF_INET6;
-         a6.sin6_port = t6->t6_port;
-         if (t6->t6_port == 0)
-           is_natd = GNUNET_YES;
-         memcpy (&a6.sin6_addr,
-                 &t6->ipv6_addr,
-                 sizeof (struct in6_addr));
-         sb = &a6;
-         sbs = sizeof (a6);
-       }
-      else if (addrlen == sizeof (struct IPv4TcpAddress))
-       {
-         t4 = addr;
-         af = AF_INET;
-         memset (&a4, 0, sizeof (a4));
+      a6.sin6_family = AF_INET6;
+      a6.sin6_port = t6->t6_port;
+      if (t6->t6_port == 0)
+        is_natd = GNUNET_YES;
+      memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof (struct in6_addr));
+      sb = &a6;
+      sbs = sizeof (a6);
+    }
+    else if (addrlen == sizeof (struct IPv4TcpAddress))
+    {
+      t4 = addr;
+      af = AF_INET;
+      memset (&a4, 0, sizeof (a4));
 #if HAVE_SOCKADDR_IN_SIN_LEN
-          a4.sin_len = sizeof (a4);
+      a4.sin_len = sizeof (a4);
 #endif
-         a4.sin_family = AF_INET;
-         a4.sin_port = t4->t_port;
-         if (t4->t_port == 0)
-           is_natd = GNUNET_YES;
-         a4.sin_addr.s_addr = t4->ipv4_addr;
-         sb = &a4;
-         sbs = sizeof (a4);
-       }
-      else
-       {
-         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                          _("Address of unexpected length: %u\n"),
-                          addrlen);
-         GNUNET_break (0);
-         return -1;
-       }
-
-      if ((is_natd == GNUNET_YES) && (addrlen == sizeof (struct IPv6TcpAddress)))
-        return -1; /* NAT client only works with IPv4 addresses */
-
-
-      if ((plugin->allow_nat == GNUNET_YES) && (is_natd == GNUNET_YES) &&
-           (GNUNET_NO == GNUNET_CONTAINER_multihashmap_contains(plugin->nat_wait_conns, &target->hashPubKey)))
-        {
+      a4.sin_family = AF_INET;
+      a4.sin_port = t4->t4_port;
+      if (t4->t4_port == 0)
+        is_natd = GNUNET_YES;
+      a4.sin_addr.s_addr = t4->ipv4_addr;
+      sb = &a4;
+      sbs = sizeof (a4);
+    }
+    else
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "tcp",
+                       _("Address of unexpected length: %u\n"), addrlen);
+      GNUNET_break (0);
+      return -1;
+    }
+
+    if ((is_natd == GNUNET_YES) && (addrlen == sizeof (struct IPv6TcpAddress)))
+      return -1;                /* NAT client only works with IPv4 addresses */
+    if (0 == plugin->max_connections)
+      return -1;                /* saturated */
+
+    if ((is_natd == GNUNET_YES) && (NULL != plugin->nat) &&
+        (GNUNET_NO ==
+         GNUNET_CONTAINER_multihashmap_contains (plugin->nat_wait_conns,
+                                                 &target->hashPubKey)))
+    {
 #if DEBUG_TCP_NAT
-          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                           _("Found valid IPv4 NAT address!\n"));
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       _("Found valid IPv4 NAT address (creating session)!\n"));
 #endif
-          session = create_session (plugin,
-                                    target,
-                                    NULL, is_natd);
-
-          /* create new message entry */
-          pm = GNUNET_malloc (sizeof (struct PendingMessage) + msgbuf_size);
-         /* FIXME: the memset of this malloc can be up to 2% of our total runtime */
-          pm->msg = (const char*) &pm[1];
-          memcpy (&pm[1], msg, msgbuf_size);
-         /* FIXME: this memcpy can be up to 7% of our total run-time
-            (for transport service) */
-          pm->message_size = msgbuf_size;
-          pm->timeout = GNUNET_TIME_relative_to_absolute (timeout);
-          pm->transmit_cont = cont;
-          pm->transmit_cont_cls = cont_cls;
-
-          /* append pm to pending_messages list */
-          GNUNET_CONTAINER_DLL_insert_after (session->pending_messages_head,
-                                             session->pending_messages_tail,
-                                             session->pending_messages_tail,
-                                             pm);
-
-          GNUNET_assert(GNUNET_CONTAINER_multihashmap_put(plugin->nat_wait_conns, &target->hashPubKey, session, GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY) == GNUNET_OK);
+      session = create_session (plugin, target, NULL, GNUNET_YES);
+      GNUNET_assert (session != NULL);
+
+      /* create new message entry */
+      pm = GNUNET_malloc (sizeof (struct PendingMessage) + msgbuf_size);
+      /* FIXME: the memset of this malloc can be up to 2% of our total runtime */
+      pm->msg = (const char *) &pm[1];
+      memcpy (&pm[1], msg, msgbuf_size);
+      /* FIXME: this memcpy can be up to 7% of our total run-time
+       * (for transport service) */
+      pm->message_size = msgbuf_size;
+      pm->timeout = GNUNET_TIME_relative_to_absolute (timeout);
+      pm->transmit_cont = cont;
+      pm->transmit_cont_cls = cont_cls;
+
+      /* append pm to pending_messages list */
+      GNUNET_CONTAINER_DLL_insert_tail (session->pending_messages_head,
+                                         session->pending_messages_tail, pm);
+
+      GNUNET_assert (GNUNET_CONTAINER_multihashmap_put
+                     (plugin->nat_wait_conns, &target->hashPubKey, session,
+                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY) ==
+                     GNUNET_OK);
 #if DEBUG_TCP_NAT
-          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                           "Created NAT WAIT connection to `%4s' at `%s'\n",
-                           GNUNET_i2s (target),
-                           GNUNET_a2s (sb, sbs));
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Created NAT WAIT connection to `%4s' at `%s'\n",
+                       GNUNET_i2s (target), GNUNET_a2s (sb, sbs));
 #endif
-          run_gnunet_nat_client (plugin, sb, sbs);
-          return 0;
-        }
-      else if ((plugin->allow_nat == GNUNET_YES) && (is_natd == GNUNET_YES) && (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains(plugin->nat_wait_conns, &target->hashPubKey)))
-        {
-          /* Only do one NAT punch attempt per peer identity */
-          return -1;
-        }
-      sa = GNUNET_CONNECTION_create_from_sockaddr (plugin->env->sched,
-                                                  af, sb, sbs);
-      if (sa == NULL)
-       {
+      GNUNET_NAT_run_client (plugin->nat, &a4);
+      return 0;
+    }
+    if ((is_natd == GNUNET_YES) &&
+        (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_contains (plugin->nat_wait_conns,
+                                                 &target->hashPubKey)))
+    {
+      /* Only do one NAT punch attempt per peer identity */
+      return -1;
+    }
+    sa = GNUNET_CONNECTION_create_from_sockaddr (af, sb, sbs);
+    if (sa == NULL)
+    {
 #if DEBUG_TCP
-         GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                          "Failed to create connection to `%4s' at `%s'\n",
-                          GNUNET_i2s (target),
-                          GNUNET_a2s (sb, sbs));
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Failed to create connection to `%4s' at `%s'\n",
+                       GNUNET_i2s (target), GNUNET_a2s (sb, sbs));
 #endif
-         GNUNET_STATISTICS_update (plugin->env->stats,
-                                   gettext_noop ("# bytes discarded by TCP (failed to connect)"),
-                                   msgbuf_size,
-                                   GNUNET_NO);
-         return -1;
-       }
-#if DEBUG_TCP
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                       "Asked to transmit to `%4s', creating fresh session using address `%s'.\n",
-                      GNUNET_i2s (target),
-                      GNUNET_a2s (sb, sbs));
+      GNUNET_STATISTICS_update (plugin->env->stats,
+                                gettext_noop
+                                ("# bytes discarded by TCP (failed to connect)"),
+                                msgbuf_size, GNUNET_NO);
+      return -1;
+    }
+    GNUNET_assert (0 != plugin->max_connections);
+    plugin->max_connections--;
+#if DEBUG_TCP_NAT
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Asked to transmit to `%4s', creating fresh session using address `%s'.\n",
+                     GNUNET_i2s (target), GNUNET_a2s (sb, sbs));
 #endif
-      session = create_session (plugin,
-                               target,
-                               GNUNET_SERVER_connect_socket (plugin->server,
-                                                             sa), is_natd);
-      session->connect_addr = GNUNET_malloc (addrlen);
-      memcpy (session->connect_addr,
-             addr,
-             addrlen);
-      session->connect_alen = addrlen;
+    session =
+        create_session (plugin, target,
+                        GNUNET_SERVER_connect_socket (plugin->server, sa),
+                        GNUNET_NO);
+    session->connect_addr = GNUNET_malloc (addrlen);
+    memcpy (session->connect_addr, addr, addrlen);
+    session->connect_alen = addrlen;
+  }
+  else                          /* session != NULL */
+  {
+    /* check if session is valid */
+    struct Session *ses = plugin->sessions;
+
+    if (0 != memcmp (target,
+                    &session->target,
+                    sizeof (struct GNUNET_PeerIdentity)))
+    {
+      GNUNET_break (0);
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                 "Got session %p for `%s', but should be for peer `%s'!\n",
+                 session,
+                 GNUNET_i2s (&session->target),
+                 GNUNET_h2s (&target->hashPubKey));
+      return -1;
+    }
+
+    while ((ses != NULL) && (ses != session))
+      ses = ses->next;
+    if (ses == NULL)
+    {
+      GNUNET_break (0);
+      return -1;
     }
+  }
   GNUNET_assert (session != NULL);
   GNUNET_assert (session->client != NULL);
+
+
+  GNUNET_SERVER_client_set_timeout (session->client,
+                                    GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes currently in TCP buffers"),
-                           msgbuf_size,
-                           GNUNET_NO);
+                            gettext_noop ("# bytes currently in TCP buffers"),
+                            msgbuf_size, GNUNET_NO);
   /* create new message entry */
   pm = GNUNET_malloc (sizeof (struct PendingMessage) + msgbuf_size);
-  pm->msg = (const char*) &pm[1];
+  pm->msg = (const char *) &pm[1];
   memcpy (&pm[1], msg, msgbuf_size);
   pm->message_size = msgbuf_size;
   pm->timeout = GNUNET_TIME_relative_to_absolute (timeout);
@@ -1250,15 +1167,12 @@ tcp_plugin_send (void *cls,
   pm->transmit_cont_cls = cont_cls;
 
   /* append pm to pending_messages list */
-  GNUNET_CONTAINER_DLL_insert_after (session->pending_messages_head,
-                                    session->pending_messages_tail,
-                                    session->pending_messages_tail,
-                                    pm);
+  GNUNET_CONTAINER_DLL_insert_tail (session->pending_messages_head,
+                                   session->pending_messages_tail, pm);
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Asked to transmit %u bytes to `%s', added message to list.\n",
-                  msgbuf_size,
-                  GNUNET_i2s (target));
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Asked to transmit %u bytes to `%s', added message to list.\n",
+                   msgbuf_size, GNUNET_i2s (target));
 #endif
   process_pending_messages (session);
   return msgbuf_size;
@@ -1282,8 +1196,7 @@ tcp_plugin_send (void *cls,
  *        to be cancelled
  */
 static void
-tcp_plugin_disconnect (void *cls,
-                      const struct GNUNET_PeerIdentity *target)
+tcp_plugin_disconnect (void *cls, const struct GNUNET_PeerIdentity *target)
 {
   struct Plugin *plugin = cls;
   struct Session *session;
@@ -1291,27 +1204,29 @@ tcp_plugin_disconnect (void *cls,
   struct PendingMessage *pm;
 
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "Asked to cancel session with `%4s'\n",
-                   GNUNET_i2s (target));
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Asked to cancel session with `%4s'\n", GNUNET_i2s (target));
 #endif
   next = plugin->sessions;
   while (NULL != (session = next))
-    {
-      next = session->next;
-      if (0 != memcmp (target,
-                      &session->target,
-                      sizeof (struct GNUNET_PeerIdentity)))
-       continue;
-      pm = session->pending_messages_head;
-      while (pm != NULL)
-       {
-         pm->transmit_cont = NULL;
-         pm->transmit_cont_cls = NULL;
-         pm = pm->next;
-       }
-      disconnect_session (session);
-    }
+  {
+    next = session->next;
+    if (0 !=
+        memcmp (target, &session->target, sizeof (struct GNUNET_PeerIdentity)))
+      continue;
+    pm = session->pending_messages_head;
+    while (pm != NULL)
+    {
+      pm->transmit_cont = NULL;
+      pm->transmit_cont_cls = NULL;
+      pm = pm->next;
+    }
+    GNUNET_STATISTICS_update (session->plugin->env->stats,
+                              gettext_noop
+                              ("# transport-service disconnect requests for TCP"),
+                              1, GNUNET_NO);
+    disconnect_session (session);
+  }
 }
 
 
@@ -1350,11 +1265,11 @@ append_port (void *cls, const char *hostname)
   char *ret;
 
   if (hostname == NULL)
-    {
-      ppc->asc (ppc->asc_cls, NULL);
-      GNUNET_free (ppc);
-      return;
-    }
+  {
+    ppc->asc (ppc->asc_cls, NULL);
+    GNUNET_free (ppc);
+    return;
+  }
   GNUNET_asprintf (&ret, "%s:%d", hostname, ppc->port);
   ppc->asc (ppc->asc_cls, ret);
   GNUNET_free (ret);
@@ -1376,16 +1291,13 @@ append_port (void *cls, const char *hostname)
  * @param asc_cls closure for asc
  */
 static void
-tcp_plugin_address_pretty_printer (void *cls,
-                                   const char *type,
-                                   const void *addr,
-                                   size_t addrlen,
+tcp_plugin_address_pretty_printer (void *cls, const char *type,
+                                   const void *addr, size_t addrlen,
                                    int numeric,
                                    struct GNUNET_TIME_Relative timeout,
                                    GNUNET_TRANSPORT_AddressStringCallback asc,
                                    void *asc_cls)
 {
-  struct Plugin *plugin = cls;
   struct PrettyPrinterContext *ppc;
   const void *sb;
   size_t sbs;
@@ -1396,52 +1308,47 @@ tcp_plugin_address_pretty_printer (void *cls,
   uint16_t port;
 
   if (addrlen == sizeof (struct IPv6TcpAddress))
-    {
-      t6 = addr;
-      memset (&a6, 0, sizeof (a6));
-      a6.sin6_family = AF_INET6;
-      a6.sin6_port = t6->t6_port;
-      memcpy (&a6.sin6_addr,
-             &t6->ipv6_addr,
-             sizeof (struct in6_addr));
-      port = ntohs (t6->t6_port);
-      sb = &a6;
-      sbs = sizeof (a6);
-    }
+  {
+    t6 = addr;
+    memset (&a6, 0, sizeof (a6));
+    a6.sin6_family = AF_INET6;
+    a6.sin6_port = t6->t6_port;
+    memcpy (&a6.sin6_addr, &t6->ipv6_addr, sizeof (struct in6_addr));
+    port = ntohs (t6->t6_port);
+    sb = &a6;
+    sbs = sizeof (a6);
+  }
   else if (addrlen == sizeof (struct IPv4TcpAddress))
-    {
-      t4 = addr;
-      memset (&a4, 0, sizeof (a4));
-      a4.sin_family = AF_INET;
-      a4.sin_port = t4->t_port;
-      a4.sin_addr.s_addr = t4->ipv4_addr;
-      port = ntohs (t4->t_port);
-      sb = &a4;
-      sbs = sizeof (a4);
-    }
+  {
+    t4 = addr;
+    memset (&a4, 0, sizeof (a4));
+    a4.sin_family = AF_INET;
+    a4.sin_port = t4->t4_port;
+    a4.sin_addr.s_addr = t4->ipv4_addr;
+    port = ntohs (t4->t4_port);
+    sb = &a4;
+    sbs = sizeof (a4);
+  }
   else
-    {
-      /* invalid address */
-      GNUNET_break_op (0);
-      asc (asc_cls, NULL);
-      return;
-    }
+  {
+    /* invalid address */
+    GNUNET_break_op (0);
+    asc (asc_cls, NULL);
+    return;
+  }
   ppc = GNUNET_malloc (sizeof (struct PrettyPrinterContext));
   ppc->asc = asc;
   ppc->asc_cls = asc_cls;
   ppc->port = port;
-  GNUNET_RESOLVER_hostname_get (plugin->env->sched,
-                                plugin->env->cfg,
-                                sb,
-                                sbs,
-                                !numeric, timeout, &append_port, ppc);
+  GNUNET_RESOLVER_hostname_get (sb, sbs, !numeric, timeout, &append_port, ppc);
 }
 
 
 /**
- * Check if the given port is plausible (must be either
- * our listen port or our advertised port).  If it is
- * neither, we return GNUNET_SYSERR.
+ * Check if the given port is plausible (must be either our listen
+ * port or our advertised port), or any port if we are behind NAT
+ * and do not have a port open.  If it is neither, we return
+ * GNUNET_SYSERR.
  *
  * @param plugin global variables
  * @param in_port port number to check
@@ -1450,13 +1357,6 @@ tcp_plugin_address_pretty_printer (void *cls,
 static int
 check_port (struct Plugin *plugin, uint16_t in_port)
 {
-  if ( (plugin->behind_nat == GNUNET_YES) && (in_port == 0) )
-    return GNUNET_OK;
-  if ( (plugin->only_nat_addresses == GNUNET_YES) &&
-       (plugin->behind_nat == GNUNET_YES) )
-    {
-      return GNUNET_SYSERR; /* odd case... */
-    }
   if ((in_port == plugin->adv_port) || (in_port == plugin->open_port))
     return GNUNET_OK;
   return GNUNET_SYSERR;
@@ -1479,9 +1379,7 @@ check_port (struct Plugin *plugin, uint16_t in_port)
  *         and transport, GNUNET_SYSERR if not
  */
 static int
-tcp_plugin_check_address (void *cls,
-                         const void *addr,
-                         size_t addrlen)
+tcp_plugin_check_address (void *cls, const void *addr, size_t addrlen)
 {
   struct Plugin *plugin = cls;
   struct IPv4TcpAddress *v4;
@@ -1489,42 +1387,39 @@ tcp_plugin_check_address (void *cls,
 
   if ((addrlen != sizeof (struct IPv4TcpAddress)) &&
       (addrlen != sizeof (struct IPv6TcpAddress)))
-    {
-      GNUNET_break_op (0);
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (addrlen == sizeof (struct IPv4TcpAddress))
+  {
+    v4 = (struct IPv4TcpAddress *) addr;
+    if (GNUNET_OK != check_port (plugin, ntohs (v4->t4_port)))
       return GNUNET_SYSERR;
-    }
-  if (addrlen == sizeof (struct IPv4TcpAddress))
-    {
-      v4 = (struct IPv4TcpAddress *) addr;
-      if (GNUNET_OK !=
-         check_port (plugin, ntohs (v4->t_port)))
-       return GNUNET_SYSERR;
-      if (GNUNET_OK !=
-         check_local_addr (plugin, &v4->ipv4_addr, sizeof (uint32_t)))
-       {
-         return GNUNET_SYSERR;
-       }
-    }
+    if (GNUNET_OK !=
+        GNUNET_NAT_test_address (plugin->nat, &v4->ipv4_addr,
+                                 sizeof (struct in_addr)))
+      return GNUNET_SYSERR;
+  }
   else
+  {
+    v6 = (struct IPv6TcpAddress *) addr;
+    if (IN6_IS_ADDR_LINKLOCAL (&v6->ipv6_addr))
     {
-      v6 = (struct IPv6TcpAddress *) addr;
-      if (IN6_IS_ADDR_LINKLOCAL (&v6->ipv6_addr))
-       {
-         GNUNET_break_op (0);
-         return GNUNET_SYSERR;
-       }
-      if (GNUNET_OK !=
-         check_port (plugin, ntohs (v6->t6_port)))
-       return GNUNET_SYSERR;
-      if (GNUNET_OK !=
-         check_local_addr (plugin, &v6->ipv6_addr, sizeof (struct in6_addr)))
-       {
-         return GNUNET_SYSERR;
-       }
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
     }
+    if (GNUNET_OK != check_port (plugin, ntohs (v6->t6_port)))
+      return GNUNET_SYSERR;
+    if (GNUNET_OK !=
+        GNUNET_NAT_test_address (plugin->nat, &v6->ipv6_addr,
+                                 sizeof (struct in6_addr)))
+      return GNUNET_SYSERR;
+  }
   return GNUNET_OK;
 }
 
+
 /**
  * We've received a nat probe from this peer via TCP.  Finish
  * creating the client session and resume sending of queued
@@ -1535,13 +1430,12 @@ tcp_plugin_check_address (void *cls,
  * @param message the actual message
  */
 static void
-handle_tcp_nat_probe (void *cls,
-                     struct GNUNET_SERVER_Client *client,
-                     const struct GNUNET_MessageHeader *message)
+handle_tcp_nat_probe (void *cls, struct GNUNET_SERVER_Client *client,
+                      const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
   struct Session *session;
-  struct TCP_NAT_ProbeMessage *tcp_nat_probe;
+  const struct TCP_NAT_ProbeMessage *tcp_nat_probe;
   size_t alen;
   void *vaddr;
   struct IPv4TcpAddress *t4;
@@ -1550,7 +1444,7 @@ handle_tcp_nat_probe (void *cls,
   const struct sockaddr_in6 *s6;
 
 #if DEBUG_TCP_NAT
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "received tcp NAT probe\n");
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp", "received NAT probe\n");
 #endif
   /* We have received a TCP NAT probe, meaning we (hopefully) initiated
    * a connection to this peer by running gnunet-nat-client.  This peer
@@ -1558,86 +1452,104 @@ handle_tcp_nat_probe (void *cls,
    * as the default for that peer.  Do so and then send a WELCOME message
    * so we can really be connected!
    */
-  if (ntohs(message->size) != sizeof(struct TCP_NAT_ProbeMessage))
-    {
-#if DEBUG_TCP_NAT
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Bad size for tcp NAT probe, expected %d got %d.\n", sizeof(struct TCP_NAT_ProbeMessage), ntohs(message->size));
-#endif
-      GNUNET_break_op(0);
-      return;
-    }
-  tcp_nat_probe = (struct TCP_NAT_ProbeMessage *)message;
+  if (ntohs (message->size) != sizeof (struct TCP_NAT_ProbeMessage))
+  {
+    GNUNET_break_op (0);
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
+
+  tcp_nat_probe = (const struct TCP_NAT_ProbeMessage *) message;
+  if (0 ==
+      memcmp (&tcp_nat_probe->clientIdentity, plugin->env->my_identity,
+              sizeof (struct GNUNET_PeerIdentity)))
+  {
+    /* refuse connections from ourselves */
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
 
-  if (GNUNET_CONTAINER_multihashmap_contains(plugin->nat_wait_conns, &tcp_nat_probe->clientIdentity.hashPubKey) == GNUNET_YES)
-    {
+  session =
+      GNUNET_CONTAINER_multihashmap_get (plugin->nat_wait_conns,
+                                         &tcp_nat_probe->
+                                         clientIdentity.hashPubKey);
+  if (session == NULL)
+  {
 #if DEBUG_TCP_NAT
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Found session for NAT probe!\n");
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Did NOT find session for NAT probe!\n");
 #endif
-      session = GNUNET_CONTAINER_multihashmap_get(plugin->nat_wait_conns, &tcp_nat_probe->clientIdentity.hashPubKey);
-      GNUNET_assert(session != NULL);
-      GNUNET_assert(GNUNET_CONTAINER_multihashmap_remove(plugin->nat_wait_conns, &tcp_nat_probe->clientIdentity.hashPubKey, session) == GNUNET_YES);
-      GNUNET_SERVER_client_keep (client);
-      session->client = client;
-      session->last_activity = GNUNET_TIME_absolute_get ();
-      session->inbound = GNUNET_NO;
-
-      if (GNUNET_OK ==
-          GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
-        {
+    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    return;
+  }
 #if DEBUG_TCP_NAT
-          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                           "Found address `%s' for incoming connection %p\n",
-                           GNUNET_a2s (vaddr, alen),
-                           client);
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Found session for NAT probe!\n");
 #endif
-          if (((const struct sockaddr *)vaddr)->sa_family == AF_INET)
-            {
-              s4 = vaddr;
-              t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
-              t4->t_port = s4->sin_port;
-              t4->ipv4_addr = s4->sin_addr.s_addr;
-              session->connect_addr = t4;
-              session->connect_alen = sizeof (struct IPv4TcpAddress);
-            }
-          else if (((const struct sockaddr *)vaddr)->sa_family == AF_INET6)
-            {
-              s6 = vaddr;
-              t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
-              t6->t6_port = s6->sin6_port;
-              memcpy (&t6->ipv6_addr,
-                      &s6->sin6_addr,
-                      sizeof (struct in6_addr));
-              session->connect_addr = t6;
-              session->connect_alen = sizeof (struct IPv6TcpAddress);
-            }
-          else
-            {
+  GNUNET_assert (GNUNET_CONTAINER_multihashmap_remove
+                 (plugin->nat_wait_conns,
+                  &tcp_nat_probe->clientIdentity.hashPubKey,
+                  session) == GNUNET_YES);
+  if (GNUNET_OK != GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
+  {
+    GNUNET_break (0);
+    GNUNET_free (session);
+    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    return;
+  }
+
+  GNUNET_SERVER_client_keep (client);
+  session->client = client;
+  session->last_activity = GNUNET_TIME_absolute_get ();
+  session->inbound = GNUNET_NO;
+
 #if DEBUG_TCP_NAT
-              GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                          "Bad address for incoming connection!\n");
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Found address `%s' for incoming connection\n",
+                   GNUNET_a2s (vaddr, alen));
 #endif
-            }
-          GNUNET_free (vaddr);
-        }
-
-      session->next = plugin->sessions;
-      plugin->sessions = session;
-      GNUNET_STATISTICS_update (plugin->env->stats,
-                                gettext_noop ("# TCP sessions active"),
-                                1,
-                                GNUNET_NO);
-      process_pending_messages (session);
-    }
-  else
-    {
+  switch (((const struct sockaddr *) vaddr)->sa_family)
+  {
+  case AF_INET:
+    s4 = vaddr;
+    t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
+    t4->t4_port = s4->sin_port;
+    t4->ipv4_addr = s4->sin_addr.s_addr;
+    session->connect_addr = t4;
+    session->connect_alen = sizeof (struct IPv4TcpAddress);
+    break;
+  case AF_INET6:
+    s6 = vaddr;
+    t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
+    t6->t6_port = s6->sin6_port;
+    memcpy (&t6->ipv6_addr, &s6->sin6_addr, sizeof (struct in6_addr));
+    session->connect_addr = t6;
+    session->connect_alen = sizeof (struct IPv6TcpAddress);
+    break;
+  default:
+    GNUNET_break_op (0);
 #if DEBUG_TCP_NAT
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Did NOT find session for NAT probe!\n");
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Bad address for incoming connection!\n");
 #endif
-    }
+    GNUNET_free (vaddr);
+    GNUNET_SERVER_client_drop (client);
+    GNUNET_free (session);
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
+  GNUNET_free (vaddr);
 
+  session->next = plugin->sessions;
+  plugin->sessions = session;
+  GNUNET_STATISTICS_update (plugin->env->stats,
+                            gettext_noop ("# TCP sessions active"), 1,
+                            GNUNET_NO);
+  process_pending_messages (session);
   GNUNET_SERVER_receive_done (client, GNUNET_OK);
 }
 
+
 /**
  * We've received a welcome from this peer via TCP.  Possibly create a
  * fresh client record and send back our welcome.
@@ -1647,8 +1559,7 @@ handle_tcp_nat_probe (void *cls,
  * @param message the actual message
  */
 static void
-handle_tcp_welcome (void *cls,
-                    struct GNUNET_SERVER_Client *client,
+handle_tcp_welcome (void *cls, struct GNUNET_SERVER_Client *client,
                     const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
@@ -1661,76 +1572,94 @@ handle_tcp_welcome (void *cls,
   const struct sockaddr_in *s4;
   const struct sockaddr_in6 *s6;
 
+  if (0 ==
+      memcmp (&wm->clientIdentity, plugin->env->my_identity,
+              sizeof (struct GNUNET_PeerIdentity)))
+  {
+    /* refuse connections from ourselves */
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "Received %s message from a `%4s/%p'.\n",
-                  "WELCOME",
-                   GNUNET_i2s (&wm->clientIdentity), client);
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Received %s message from `%4s'.\n", "WELCOME",
+                   GNUNET_i2s (&wm->clientIdentity));
 #endif
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# TCP WELCOME messages received"),
-                           1,
-                           GNUNET_NO);
+                            gettext_noop ("# TCP WELCOME messages received"), 1,
+                            GNUNET_NO);
   session = find_session_by_client (plugin, client);
+
   if (session == NULL)
-    {
-      GNUNET_SERVER_client_keep (client);
-      session = create_session (plugin,
-                               &wm->clientIdentity, client, GNUNET_NO);
-      session->inbound = GNUNET_YES;
-      if (GNUNET_OK ==
-         GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
-       {
-#if DEBUG_TCP
-         GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                          "Found address `%s' for incoming connection %p\n",
-                          GNUNET_a2s (vaddr, alen),
-                          client);
+  {
+#if DEBUG_TCP_NAT
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Received %s message from a `%4s', creating new session\n",
+                     "WELCOME", GNUNET_i2s (&wm->clientIdentity));
 #endif
-         if (alen == sizeof (struct sockaddr_in))
-           {
-             s4 = vaddr;
-             t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
-             t4->t_port = s4->sin_port;
-             t4->ipv4_addr = s4->sin_addr.s_addr;
-             session->connect_addr = t4;
-             session->connect_alen = sizeof (struct IPv4TcpAddress);
-           }
-         else if (alen == sizeof (struct sockaddr_in6))
-           {
-             s6 = vaddr;
-             t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
-             t6->t6_port = s6->sin6_port;
-             memcpy (&t6->ipv6_addr,
-                     &s6->sin6_addr,
-                     sizeof (struct in6_addr));
-             session->connect_addr = t6;
-             session->connect_alen = sizeof (struct IPv6TcpAddress);
-           }
-         GNUNET_free (vaddr);
-       }
-      else
-        {
-#if DEBUG_TCP
-         GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                          "Did not obtain TCP socket address for incoming connection\n");
+    GNUNET_SERVER_client_keep (client);
+    session = create_session (plugin, &wm->clientIdentity, client, GNUNET_NO);
+    session->inbound = GNUNET_YES;
+    if (GNUNET_OK == GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
+    {
+#if DEBUG_TCP_NAT
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Found address `%s' for incoming connection\n",
+                       GNUNET_a2s (vaddr, alen));
 #endif
-        }
+      if (alen == sizeof (struct sockaddr_in))
+      {
+        s4 = vaddr;
+        t4 = GNUNET_malloc (sizeof (struct IPv4TcpAddress));
+        t4->t4_port = s4->sin_port;
+        t4->ipv4_addr = s4->sin_addr.s_addr;
+        session->connect_addr = t4;
+        session->connect_alen = sizeof (struct IPv4TcpAddress);
+      }
+      else if (alen == sizeof (struct sockaddr_in6))
+      {
+        s6 = vaddr;
+        t6 = GNUNET_malloc (sizeof (struct IPv6TcpAddress));
+        t6->t6_port = s6->sin6_port;
+        memcpy (&t6->ipv6_addr, &s6->sin6_addr, sizeof (struct in6_addr));
+        session->connect_addr = t6;
+        session->connect_alen = sizeof (struct IPv6TcpAddress);
+      }
+
+      GNUNET_free (vaddr);
+    }
+    else
+    {
 #if DEBUG_TCP
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                       "Creating new session %p for connection %p\n",
-                       session, client);
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Did not obtain TCP socket address for incoming connection\n");
 #endif
-      process_pending_messages (session);
     }
-  if (session->expecting_welcome != GNUNET_YES)
+    process_pending_messages (session);
+  }
+  else
+  {
+#if DEBUG_TCP_NAT
+    if (GNUNET_OK == GNUNET_SERVER_client_get_address (client, &vaddr, &alen))
     {
-      GNUNET_break_op (0);
-      GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-      return;
+      GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                       "Found address `%s' (already have session)\n",
+                       GNUNET_a2s (vaddr, alen));
+      GNUNET_free (vaddr);
     }
+#endif
+  }
+
+  if (session->expecting_welcome != GNUNET_YES)
+  {
+    GNUNET_break_op (0);
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
   session->last_activity = GNUNET_TIME_absolute_get ();
   session->expecting_welcome = GNUNET_NO;
+  GNUNET_SERVER_client_set_timeout (client,
+                                    GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
   GNUNET_SERVER_receive_done (client, GNUNET_OK);
 }
 
@@ -1747,19 +1676,18 @@ delayed_done (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
   struct Session *session = cls;
   struct GNUNET_TIME_Relative delay;
+  struct GNUNET_ATS_Information ats;
 
   session->receive_delay_task = GNUNET_SCHEDULER_NO_TASK;
-  delay = session->plugin->env->receive (session->plugin->env->cls,
-                                        &session->target,
-                                        NULL, 0,
-                                        session,
-                                        NULL, 0);
-  if (delay.value == 0)
+  delay =
+      session->plugin->env->receive (session->plugin->env->cls,
+                                     &session->target, NULL, &ats, 0, session,
+                                     NULL, 0);
+  if (delay.rel_value == 0)
     GNUNET_SERVER_receive_done (session->client, GNUNET_OK);
   else
     session->receive_delay_task =
-      GNUNET_SCHEDULER_add_delayed (session->plugin->env->sched,
-                                   delay, &delayed_done, session);
+        GNUNET_SCHEDULER_add_delayed (delay, &delayed_done, session);
 }
 
 
@@ -1772,48 +1700,67 @@ delayed_done (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
  * @param message the actual message
  */
 static void
-handle_tcp_data (void *cls,
-                 struct GNUNET_SERVER_Client *client,
+handle_tcp_data (void *cls, struct GNUNET_SERVER_Client *client,
                  const struct GNUNET_MessageHeader *message)
 {
   struct Plugin *plugin = cls;
   struct Session *session;
   struct GNUNET_TIME_Relative delay;
+  uint16_t type;
 
-  if ((GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME == ntohs(message->type)) || (ntohs(message->type) == GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE))
-    {
-      /* We don't want to propagate WELCOME and NAT Probe messages up! */
-      GNUNET_SERVER_receive_done (client, GNUNET_OK);
-      return;
-    }
+  type = ntohs (message->type);
+  if ((GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME == type) ||
+      (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE == type))
+  {
+    /* We don't want to propagate WELCOME and NAT Probe messages up! */
+    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    return;
+  }
   session = find_session_by_client (plugin, client);
-  if ( (NULL == session) || (GNUNET_YES == session->expecting_welcome))
-    {
-      GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-      return;
-    }
+  if ((NULL == session) || (GNUNET_YES == session->expecting_welcome))
+  {
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
+  }
   session->last_activity = GNUNET_TIME_absolute_get ();
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Passing %u bytes of type %u from `%4s' to transport service.\n",
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Passing %u bytes of type %u from `%4s' to transport service.\n",
                    (unsigned int) ntohs (message->size),
-                  (unsigned int) ntohs (message->type),
-                  GNUNET_i2s (&session->target));
+                   (unsigned int) ntohs (message->type),
+                   GNUNET_i2s (&session->target));
 #endif
   GNUNET_STATISTICS_update (plugin->env->stats,
-                           gettext_noop ("# bytes received via TCP"),
-                           ntohs (message->size),
-                           GNUNET_NO);
-  delay = plugin->env->receive (plugin->env->cls, &session->target, message, 1,
-                               session,
-                               (GNUNET_YES == session->inbound) ? NULL : session->connect_addr,
-                               (GNUNET_YES == session->inbound) ? 0 : session->connect_alen);
-  if (delay.value == 0)
+                            gettext_noop ("# bytes received via TCP"),
+                            ntohs (message->size), GNUNET_NO);
+  struct GNUNET_ATS_Information distance;
+
+  distance.type = htonl (GNUNET_ATS_QUALITY_NET_DISTANCE);
+  distance.value = htonl (1);
+  delay =
+      plugin->env->receive (plugin->env->cls, &session->target, message,
+                            (const struct GNUNET_ATS_Information *)
+                            &distance, 1, session,
+                            (GNUNET_YES ==
+                             session->inbound) ? NULL : session->connect_addr,
+                            (GNUNET_YES ==
+                             session->inbound) ? 0 : session->connect_alen);
+  if (delay.rel_value == 0)
+  {
     GNUNET_SERVER_receive_done (client, GNUNET_OK);
+  }
   else
+  {
+#if DEBUG_TCP
+    GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                     "Throttling receiving from `%s' for %llu ms\n",
+                     GNUNET_i2s (&session->target),
+                     (unsigned long long) delay.rel_value);
+#endif
+    GNUNET_SERVER_disable_receive_done_warning (client);
     session->receive_delay_task =
-      GNUNET_SCHEDULER_add_delayed (session->plugin->env->sched,
-                                   delay, &delayed_done, session);
+        GNUNET_SCHEDULER_add_delayed (delay, &delayed_done, session);
+  }
 }
 
 
@@ -1825,421 +1772,120 @@ handle_tcp_data (void *cls,
  * @param client identification of the client
  */
 static void
-disconnect_notify (void *cls,
-                  struct GNUNET_SERVER_Client *client)
+disconnect_notify (void *cls, struct GNUNET_SERVER_Client *client)
 {
   struct Plugin *plugin = cls;
   struct Session *session;
 
   if (client == NULL)
     return;
+  plugin->max_connections++;
   session = find_session_by_client (plugin, client);
   if (session == NULL)
     return;                     /* unknown, nothing to do */
 #if DEBUG_TCP
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "Destroying session of `%4s' with %s (%p) due to network-level disconnect.\n",
+  GNUNET_log_from (GNUNET_ERROR_TYPE_DEBUG, "tcp",
+                   "Destroying session of `%4s' with %s due to network-level disconnect.\n",
                    GNUNET_i2s (&session->target),
-                   (session->connect_addr != NULL) ?
-                   tcp_address_to_string (session->plugin,
-                                         session->connect_addr,
-                                         session->connect_alen) : "*",
-                  client);
+                   (session->connect_addr !=
+                    NULL) ? tcp_address_to_string (session->plugin,
+                                                   session->connect_addr,
+                                                   session->connect_alen) :
+                   "*");
 #endif
+  GNUNET_STATISTICS_update (session->plugin->env->stats,
+                            gettext_noop
+                            ("# network-level TCP disconnect events"), 1,
+                            GNUNET_NO);
   disconnect_session (session);
 }
 
 
-/**
- * Add the IP of our network interface to the list of
- * our external IP addresses.
- *
- * @param cls the 'struct Plugin*'
- * @param name name of the interface
- * @param isDefault do we think this may be our default interface
- * @param addr address of the interface
- * @param addrlen number of bytes in addr
- * @return GNUNET_OK to continue iterating
- */
-static int
-process_interfaces (void *cls,
-                    const char *name,
-                    int isDefault,
-                    const struct sockaddr *addr, socklen_t addrlen)
-{
-  struct Plugin *plugin = cls;
-  int af;
-  struct IPv4TcpAddress t4;
-  struct IPv6TcpAddress t6;
-  struct IPv4TcpAddress t4_nat;
-  struct IPv6TcpAddress t6_nat;
-  void *arg;
-  uint16_t args;
-  void *arg_nat;
-  char buf[INET_ADDRSTRLEN];
-
-  af = addr->sa_family;
-  arg_nat = NULL;
-  if (af == AF_INET)
-    {
-      t4.ipv4_addr = ((struct sockaddr_in *) addr)->sin_addr.s_addr;
-      GNUNET_assert(NULL != inet_ntop(AF_INET, &t4.ipv4_addr, &buf[0], INET_ADDRSTRLEN));
-      if ((plugin->bind_address != NULL) && (0 != strcmp(buf, plugin->bind_address)))
-        {
-          GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "%s: Not notifying transport of address %s\n", "TCP", GNUNET_a2s (addr, addrlen));
-          return GNUNET_OK;
-        }
-      add_to_address_list (plugin, &t4.ipv4_addr, sizeof (uint32_t));
-      if ((plugin->behind_nat == GNUNET_YES) && (plugin->only_nat_addresses == GNUNET_YES))
-        t4.t_port = htons(0);
-      else if (plugin->behind_nat == GNUNET_YES) /* We are behind NAT, but will advertise NAT and normal addresses */
-        {
-          t4_nat.ipv4_addr = ((struct sockaddr_in *) addr)->sin_addr.s_addr;
-          t4_nat.t_port = htons(plugin->adv_port);
-          arg_nat = &t4_nat;
-        }
-      else
-        t4.t_port = htons (plugin->adv_port);
-      arg = &t4;
-      args = sizeof (t4);
-    }
-  else if (af == AF_INET6)
-    {
-      if ((IN6_IS_ADDR_LINKLOCAL (&((struct sockaddr_in6 *) addr)->sin6_addr)) || (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno(plugin->env->cfg, "transport-tcp", "disablev6")))
-       {
-         /* skip link local addresses */
-         return GNUNET_OK;
-       }
-      memcpy (&t6.ipv6_addr,
-             &((struct sockaddr_in6 *) addr)->sin6_addr,
-             sizeof (struct in6_addr));
-      add_to_address_list (plugin, &t6.ipv6_addr, sizeof (struct in6_addr));
-      if ((plugin->behind_nat == GNUNET_YES) && (plugin->only_nat_addresses == GNUNET_YES))
-        t6.t6_port = htons(0);
-      else if (plugin->behind_nat == GNUNET_YES) /* We are behind NAT, but will advertise NAT and normal addresses */
-        {
-          memcpy (&t6_nat.ipv6_addr,
-                  &((struct sockaddr_in6 *) addr)->sin6_addr,
-                  sizeof (struct in6_addr));
-          t6_nat.t6_port = htons(plugin->adv_port);
-          arg_nat = &t6;
-        }
-      else
-        t6.t6_port = htons (plugin->adv_port);
-      arg = &t6;
-      args = sizeof (t6);
-    }
-  else
-    {
-      GNUNET_break (0);
-      return GNUNET_OK;
-    }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  _("Found address `%s' (%s) len %d\n"),
-                   GNUNET_a2s (addr, addrlen), name, args);
-
-  plugin->env->notify_address (plugin->env->cls,
-                               "tcp",
-                               arg, args, GNUNET_TIME_UNIT_FOREVER_REL);
-
-  if (arg_nat != NULL)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                      _("Found address `%s' (%s) len %d\n"),
-                      GNUNET_a2s (addr, addrlen), name, args);
-      plugin->env->notify_address (plugin->env->cls,
-                                   "tcp",
-                                   arg_nat, args, GNUNET_TIME_UNIT_FOREVER_REL);
-    }
-
-  return GNUNET_OK;
-}
-
-
-/**
- * Function called by the resolver for each address obtained from DNS
- * for our own hostname.  Add the addresses to the list of our
- * external IP addresses.
- *
- * @param cls closure
- * @param addr one of the addresses of the host, NULL for the last address
- * @param addrlen length of the address
- */
-static void
-process_hostname_ips (void *cls,
-                      const struct sockaddr *addr, socklen_t addrlen)
-{
-  struct Plugin *plugin = cls;
-
-  if (addr == NULL)
-    {
-      plugin->hostname_dns = NULL;
-      return;
-    }
-  /* FIXME: Can we figure out our external address here so it doesn't need to be user specified? */
-  process_interfaces (plugin, "<hostname>", GNUNET_YES, addr, addrlen);
-}
-
 /**
  * We can now send a probe message, copy into buffer to really send.
  *
  * @param cls closure, a struct TCPProbeContext
  * @param size max size to copy
  * @param buf buffer to copy message to
+ * @return number of bytes copied into buf
  */
-static size_t notify_send_probe (void *cls,
-                                 size_t size, void *buf)
+static size_t
+notify_send_probe (void *cls, size_t size, void *buf)
 {
   struct TCPProbeContext *tcp_probe_ctx = cls;
+  struct Plugin *plugin = tcp_probe_ctx->plugin;
+  size_t ret;
 
+  tcp_probe_ctx->transmit_handle = NULL;
+  GNUNET_CONTAINER_DLL_remove (plugin->probe_head, plugin->probe_tail,
+                               tcp_probe_ctx);
   if (buf == NULL)
-    {
-      return 0;
-    }
-
-  GNUNET_assert(size >= sizeof(tcp_probe_ctx->message));
-  memcpy(buf, &tcp_probe_ctx->message, sizeof(tcp_probe_ctx->message));
+  {
+    GNUNET_CONNECTION_destroy (tcp_probe_ctx->sock, GNUNET_NO);
+    GNUNET_free (tcp_probe_ctx);
+    return 0;
+  }
+  GNUNET_assert (size >= sizeof (tcp_probe_ctx->message));
+  memcpy (buf, &tcp_probe_ctx->message, sizeof (tcp_probe_ctx->message));
   GNUNET_SERVER_connect_socket (tcp_probe_ctx->plugin->server,
                                 tcp_probe_ctx->sock);
-
-  GNUNET_free(tcp_probe_ctx);
-  return sizeof(tcp_probe_ctx->message);
+  ret = sizeof (tcp_probe_ctx->message);
+  GNUNET_free (tcp_probe_ctx);
+  return ret;
 }
 
-/*
- * @param cls the plugin handle
- * @param tc the scheduling context (for rescheduling this function again)
- *
- * We have been notified that gnunet-nat-server has written something to stdout.
- * Handle the output, then reschedule this function to be called again once
- * more is available.
+
+/**
+ * Function called by the NAT subsystem suggesting another peer wants
+ * to connect to us via connection reversal.  Try to connect back to the
+ * given IP.
  *
+ * @param cls closure
+ * @param addr address to try
+ * @param addrlen number of bytes in addr
  */
 static void
-tcp_plugin_server_read (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
+try_connection_reversal (void *cls, const struct sockaddr *addr,
+                         socklen_t addrlen)
 {
   struct Plugin *plugin = cls;
-  char mybuf[40];
-  ssize_t bytes;
-  memset(&mybuf, 0, sizeof(mybuf));
-  int i;
-  int port;
-  char *port_start;
-  struct sockaddr_in in_addr;
-  struct TCPProbeContext *tcp_probe_ctx;
   struct GNUNET_CONNECTION_Handle *sock;
+  struct TCPProbeContext *tcp_probe_ctx;
 
-  if (tc->reason == GNUNET_SCHEDULER_REASON_SHUTDOWN)
-    return;
-
-  bytes = GNUNET_DISK_file_read(plugin->server_stdout_handle, &mybuf, sizeof(mybuf));
-
-  if (bytes < 1)
-    {
-#if DEBUG_TCP_NAT
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                      _("Finished reading from server stdout with code: %d\n"), bytes);
-#endif
-      return;
-    }
-
-  port_start = NULL;
-  for (i = 0; i < sizeof(mybuf); i++)
-    {
-      if (mybuf[i] == '\n')
-        mybuf[i] = '\0';
-
-      if ((mybuf[i] == ':') && (i + 1 < sizeof(mybuf)))
-        {
-          mybuf[i] = '\0';
-          port_start = &mybuf[i + 1];
-        }
-    }
-
-  if (port_start != NULL)
-    port = atoi(port_start);
-  else
-    {
-      plugin->server_read_task =
-           GNUNET_SCHEDULER_add_read_file (plugin->env->sched,
-                                           GNUNET_TIME_UNIT_FOREVER_REL,
-                                           plugin->server_stdout_handle, &tcp_plugin_server_read, plugin);
-      return;
-    }
-
-#if DEBUG_TCP_NAT
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  _("nat-server-read read: %s port %d\n"), &mybuf, port);
-#endif
-
-
-  if (inet_pton(AF_INET, &mybuf[0], &in_addr.sin_addr) != 1)
-    {
-
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                  _("nat-server-read malformed address\n"), &mybuf, port);
-
-      plugin->server_read_task =
-          GNUNET_SCHEDULER_add_read_file (plugin->env->sched,
-                                          GNUNET_TIME_UNIT_FOREVER_REL,
-                                          plugin->server_stdout_handle, &tcp_plugin_server_read, plugin);
-      return;
-    }
-
-  in_addr.sin_family = AF_INET;
-  in_addr.sin_port = htons(port);
   /**
-   * We have received an ICMP response, ostensibly from a non-NAT'd peer
-   *  that wants to connect to us! Send a message to establish a connection.
+   * We have received an ICMP response, ostensibly from a peer
+   * that wants to connect to us! Send a message to establish a connection.
    */
-  sock = GNUNET_CONNECTION_create_from_sockaddr (plugin->env->sched, AF_INET, (struct sockaddr *)&in_addr,
-                                                 sizeof(in_addr));
-
-
+  sock = GNUNET_CONNECTION_create_from_sockaddr (AF_INET, addr, addrlen);
   if (sock == NULL)
-    {
-      plugin->server_read_task =
-          GNUNET_SCHEDULER_add_read_file (plugin->env->sched,
-                                          GNUNET_TIME_UNIT_FOREVER_REL,
-                                          plugin->server_stdout_handle, &tcp_plugin_server_read, plugin);
-      return;
-    }
-  else
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                _("Sending TCP probe message!\n"), &mybuf, port);
-
-      tcp_probe_ctx = GNUNET_malloc(sizeof(struct TCPProbeContext));
-      tcp_probe_ctx->message.header.size = htons(sizeof(struct TCP_NAT_ProbeMessage));
-      tcp_probe_ctx->message.header.type = htons(GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE);
-      memcpy(&tcp_probe_ctx->message.clientIdentity, plugin->env->my_identity, sizeof(struct GNUNET_PeerIdentity));
-      tcp_probe_ctx->plugin = plugin;
-      tcp_probe_ctx->sock = sock;
-      tcp_probe_ctx->transmit_handle = GNUNET_CONNECTION_notify_transmit_ready (sock,
-                                                                 ntohs(tcp_probe_ctx->message.header.size),
-                                                                 GNUNET_TIME_UNIT_FOREVER_REL,
-                                                                 &notify_send_probe, tcp_probe_ctx);
-
-    }
-
-  /*GNUNET_SERVER_connect_socket(plugin->server, sock);*/
-  plugin->server_read_task =
-      GNUNET_SCHEDULER_add_read_file (plugin->env->sched,
-                                      GNUNET_TIME_UNIT_FOREVER_REL,
-                                      plugin->server_stdout_handle, &tcp_plugin_server_read, plugin);
-}
-
-/**
- * Start the gnunet-nat-server process for users behind NAT.
- *
- * @param plugin the transport plugin
- *
- * @return GNUNET_YES if process was started, GNUNET_SYSERR on error
- */
-static int
-tcp_transport_start_nat_server(struct Plugin *plugin)
-{
-
-  plugin->server_stdout = GNUNET_DISK_pipe(GNUNET_YES);
-  if (plugin->server_stdout == NULL)
-    return GNUNET_SYSERR;
-
-#if DEBUG_TCP_NAT
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                   "Starting gnunet-nat-server process cmd: %s %s\n", "gnunet-nat-server", plugin->internal_address);
-#endif
-  /* Start the server process */
-  plugin->server_pid = GNUNET_OS_start_process(NULL, plugin->server_stdout, "gnunet-nat-server", "gnunet-nat-server", plugin->internal_address, NULL);
-  if (plugin->server_pid == GNUNET_SYSERR)
-    {
-#if DEBUG_TCP_NAT
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                     "Failed to start gnunet-nat-server process\n");
-#endif
-      return GNUNET_SYSERR;
-    }
-  /* Close the write end of the read pipe */
-  GNUNET_DISK_pipe_close_end(plugin->server_stdout, GNUNET_DISK_PIPE_END_WRITE);
-
-  plugin->server_stdout_handle = GNUNET_DISK_pipe_handle(plugin->server_stdout, GNUNET_DISK_PIPE_END_READ);
-  plugin->server_read_task =
-      GNUNET_SCHEDULER_add_read_file (plugin->env->sched,
-                                      GNUNET_TIME_UNIT_FOREVER_REL,
-                                      plugin->server_stdout_handle, &tcp_plugin_server_read, plugin);
-  return GNUNET_YES;
-}
-
-/**
- * Return the actual path to a file found in the current
- * PATH environment variable.
- *
- * @param binary the name of the file to find
- */
-static char *
-get_path_from_PATH (char *binary)
-{
-  char *path;
-  char *pos;
-  char *end;
-  char *buf;
-  const char *p;
-
-  p = getenv ("PATH");
-  if (p == NULL)
-    return NULL;
-  path = GNUNET_strdup (p);     /* because we write on it */
-  buf = GNUNET_malloc (strlen (path) + 20);
-  pos = path;
+  {
+    /* failed for some odd reason (out of sockets?); ignore attempt */
+    return;
+  }
+
+  /* FIXME: do we need to track these probe context objects so that
+   * we can clean them up on plugin unload? */
+  tcp_probe_ctx = GNUNET_malloc (sizeof (struct TCPProbeContext));
+  tcp_probe_ctx->message.header.size =
+      htons (sizeof (struct TCP_NAT_ProbeMessage));
+  tcp_probe_ctx->message.header.type =
+      htons (GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE);
+  memcpy (&tcp_probe_ctx->message.clientIdentity, plugin->env->my_identity,
+          sizeof (struct GNUNET_PeerIdentity));
+  tcp_probe_ctx->plugin = plugin;
+  tcp_probe_ctx->sock = sock;
+  GNUNET_CONTAINER_DLL_insert (plugin->probe_head, plugin->probe_tail,
+                               tcp_probe_ctx);
+  tcp_probe_ctx->transmit_handle =
+      GNUNET_CONNECTION_notify_transmit_ready (sock,
+                                               ntohs (tcp_probe_ctx->
+                                                      message.header.size),
+                                               GNUNET_TIME_UNIT_FOREVER_REL,
+                                               &notify_send_probe,
+                                               tcp_probe_ctx);
 
-  while (NULL != (end = strchr (pos, ':')))
-    {
-      *end = '\0';
-      sprintf (buf, "%s/%s", pos, binary);
-      if (GNUNET_DISK_file_test (buf) == GNUNET_YES)
-        {
-          GNUNET_free (path);
-          return buf;
-        }
-      pos = end + 1;
-    }
-  sprintf (buf, "%s/%s", pos, binary);
-  if (GNUNET_DISK_file_test (buf) == GNUNET_YES)
-    {
-      GNUNET_free (path);
-      return buf;
-    }
-  GNUNET_free (buf);
-  GNUNET_free (path);
-  return NULL;
 }
 
-/**
- * Check whether the suid bit is set on a file.
- * Attempts to find the file using the current
- * PATH environment variable as a search path.
- *
- * @param binary the name of the file to check
- */
-static int
-check_gnunet_nat_binary(char *binary)
-{
-  struct stat statbuf;
-  char *p;
-
-  p = get_path_from_PATH (binary);
-  if (p == NULL)
-    return GNUNET_NO;
-  if (0 != STAT (p, &statbuf))
-    {
-      GNUNET_free (p);
-      return GNUNET_SYSERR;
-    }
-  GNUNET_free (p);
-  if ( (0 != (statbuf.st_mode & S_ISUID)) &&
-       (statbuf.st_uid == 0) )
-    return GNUNET_YES;
-  return GNUNET_NO;
-}
 
 /**
  * Entry point for the plugin.
@@ -2253,7 +1899,8 @@ libgnunet_plugin_transport_tcp_init (void *cls)
   static const struct GNUNET_SERVER_MessageHandler my_handlers[] = {
     {&handle_tcp_welcome, NULL, GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_WELCOME,
      sizeof (struct WelcomeMessage)},
-    {&handle_tcp_nat_probe, NULL, GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE, sizeof (struct TCP_NAT_ProbeMessage)},
+    {&handle_tcp_nat_probe, NULL, GNUNET_MESSAGE_TYPE_TRANSPORT_TCP_NAT_PROBE,
+     sizeof (struct TCP_NAT_ProbeMessage)},
     {&handle_tcp_data, NULL, GNUNET_MESSAGE_TYPE_ALL, 0},
     {NULL, NULL, 0, 0}
   };
@@ -2263,140 +1910,85 @@ libgnunet_plugin_transport_tcp_init (void *cls)
   struct GNUNET_SERVICE_Context *service;
   unsigned long long aport;
   unsigned long long bport;
+  unsigned long long max_connections;
   unsigned int i;
-  int behind_nat;
-  int allow_nat;
-  int only_nat_addresses;
-  char *internal_address;
-  char *external_address;
-  struct sockaddr_in in_addr;
-  struct IPv4TcpAddress t4;
+  struct GNUNET_TIME_Relative idle_timeout;
+  int ret;
+  struct sockaddr **addrs;
+  socklen_t *addrlens;
 
-  service = GNUNET_SERVICE_start ("transport-tcp", env->sched, env->cfg);
-  if (service == NULL)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                 _("Failed to start service for `%s' transport plugin.\n"),
-                 "tcp");
-      return NULL;
-    }
-
-  if (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
-                                                           "transport-tcp",
-                                                           "BEHIND_NAT"))
-    {
-      /* We are behind nat (according to the user) */
-      if (check_gnunet_nat_binary("gnunet-nat-server") == GNUNET_YES)
-        {
-          behind_nat = GNUNET_YES;
-        }
-      else
-        {
-          behind_nat = GNUNET_NO;
-          GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Configuration specified you are behind a NAT, but gnunet-nat-server is not installed properly (suid bit not set)!\n");
-        }
-    }
-  else
-    behind_nat = GNUNET_NO; /* We are not behind nat! */
-
-  if (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
-                                                           "transport-tcp",
-                                                           "ALLOW_NAT"))
-    {
-      if (check_gnunet_nat_binary("gnunet-nat-client") == GNUNET_YES)
-        allow_nat = GNUNET_YES; /* We will try to connect to NAT'd peers */
-      else
-      {
-        allow_nat = GNUNET_NO;
-        GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Configuration specified you want to connect to NAT'd peers, but gnunet-nat-client is not installed properly (suid bit not set)!\n");
-      }
-    }
-  else
-    allow_nat = GNUNET_NO; /* We don't want to try to help NAT'd peers */
-
-
-  if (GNUNET_YES == GNUNET_CONFIGURATION_get_value_yesno (env->cfg,
-                                                           "transport-tcp",
-                                                           "ONLY_NAT_ADDRESSES"))
-    only_nat_addresses = GNUNET_YES; /* We will only report our addresses as NAT'd */
-  else
-    only_nat_addresses = GNUNET_NO; /* We will report our addresses as NAT'd and non-NAT'd */
-
-  external_address = NULL;
-  if (((GNUNET_YES == behind_nat) || (GNUNET_YES == allow_nat)) && (GNUNET_OK !=
-         GNUNET_CONFIGURATION_get_value_string (env->cfg,
-                                                "transport-tcp",
-                                                "EXTERNAL_ADDRESS",
-                                                &external_address)))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                       _
-                       ("Require EXTERNAL_ADDRESS for service `%s' in configuration (either BEHIND_NAT or ALLOW_NAT set to YES)!\n"),
-                       "transport-tcp");
-      GNUNET_SERVICE_stop (service);
-      return NULL;
-    }
-
-  if ((external_address != NULL) && (inet_pton(AF_INET, external_address, &in_addr.sin_addr) != 1))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Malformed EXTERNAL_ADDRESS %s given in configuration!\n", external_address);
-    }
-
-  internal_address = NULL;
-  if ((GNUNET_YES == behind_nat) && (GNUNET_OK !=
-         GNUNET_CONFIGURATION_get_value_string (env->cfg,
-                                                "transport-tcp",
-                                                "INTERNAL_ADDRESS",
-                                                &internal_address)))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 _("Require INTERNAL_ADDRESS for service `%s' in configuration!\n"),
-                 "transport-tcp");
-      GNUNET_SERVICE_stop (service);
-      GNUNET_free_non_null(external_address);
-      return NULL;
-    }
-
-  if ((internal_address != NULL) && (inet_pton(AF_INET, internal_address, &in_addr.sin_addr) != 1))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Malformed INTERNAL_ADDRESS %s given in configuration!\n", internal_address);
-    }
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp",
+                                             "MAX_CONNECTIONS",
+                                             &max_connections))
+    max_connections = 128;
 
   aport = 0;
   if ((GNUNET_OK !=
-       GNUNET_CONFIGURATION_get_value_number (env->cfg,
-                                              "transport-tcp",
-                                              "PORT",
-                                              &bport)) ||
-      (bport > 65535) ||
+       GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp", "PORT",
+                                              &bport)) || (bport > 65535) ||
       ((GNUNET_OK ==
-        GNUNET_CONFIGURATION_get_value_number (env->cfg,
-                                               "transport-tcp",
-                                               "ADVERTISED-PORT",
-                                               &aport)) && (aport > 65535)))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                       _
-                       ("Require valid port number for service `%s' in configuration!\n"),
-                       "transport-tcp");
-      GNUNET_free_non_null(external_address);
-      GNUNET_free_non_null(internal_address);
-      GNUNET_SERVICE_stop (service);
+        GNUNET_CONFIGURATION_get_value_number (env->cfg, "transport-tcp",
+                                               "ADVERTISED-PORT", &aport)) &&
+       (aport > 65535)))
+  {
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "tcp",
+                     _
+                     ("Require valid port number for service `%s' in configuration!\n"),
+                     "transport-tcp");
+    return NULL;
+  }
+  if (aport == 0)
+    aport = bport;
+  if (bport == 0)
+    aport = 0;
+  if (bport != 0)
+  {
+    service = GNUNET_SERVICE_start ("transport-tcp", env->cfg);
+    if (service == NULL)
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_WARNING, "tcp",
+                       _("Failed to start service.\n"));
       return NULL;
     }
+  }
+  else
+    service = NULL;
+
+
 
-  if (aport == 0)
-    aport = bport;
   plugin = GNUNET_malloc (sizeof (struct Plugin));
+  plugin->max_connections = max_connections;
   plugin->open_port = bport;
   plugin->adv_port = aport;
-  plugin->external_address = external_address;
-  plugin->internal_address = internal_address;
-  plugin->behind_nat = behind_nat;
-  plugin->allow_nat = allow_nat;
-  plugin->only_nat_addresses = only_nat_addresses;
   plugin->env = env;
   plugin->lsock = NULL;
+  if ((service != NULL) &&
+      (GNUNET_SYSERR !=
+       (ret =
+        GNUNET_SERVICE_get_server_addresses ("transport-tcp", env->cfg, &addrs,
+                                             &addrlens))))
+  {
+    plugin->nat =
+        GNUNET_NAT_register (env->cfg, GNUNET_YES, aport, (unsigned int) ret,
+                             (const struct sockaddr **) addrs, addrlens,
+                             &tcp_nat_port_map_callback,
+                             &try_connection_reversal, plugin);
+    while (ret > 0)
+    {
+      ret--;
+      GNUNET_assert (addrs[ret] != NULL);
+      GNUNET_free (addrs[ret]);
+    }
+    GNUNET_free_non_null (addrs);
+    GNUNET_free_non_null (addrlens);
+  }
+  else
+  {
+    plugin->nat =
+        GNUNET_NAT_register (env->cfg, GNUNET_YES, 0, 0, NULL, NULL, NULL,
+                             &try_connection_reversal, plugin);
+  }
   api = GNUNET_malloc (sizeof (struct GNUNET_TRANSPORT_PluginFunctions));
   api->cls = plugin;
   api->send = &tcp_plugin_send;
@@ -2405,81 +1997,50 @@ libgnunet_plugin_transport_tcp_init (void *cls)
   api->check_address = &tcp_plugin_check_address;
   api->address_to_string = &tcp_address_to_string;
   plugin->service = service;
-  plugin->server = GNUNET_SERVICE_get_server (service);
+  if (service != NULL)
+  {
+    plugin->server = GNUNET_SERVICE_get_server (service);
+  }
+  else
+  {
+    if (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_time (env->cfg, "transport-tcp",
+                                             "TIMEOUT", &idle_timeout))
+    {
+      GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "tcp",
+                       _("Failed to find option %s in section %s!\n"),
+                       "TIMEOUT", "transport-tcp");
+      if (plugin->nat != NULL)
+        GNUNET_NAT_unregister (plugin->nat);
+      GNUNET_free (plugin);
+      GNUNET_free (api);
+      return NULL;
+    }
+    plugin->server =
+        GNUNET_SERVER_create_with_sockets (&plugin_tcp_access_check, plugin,
+                                           NULL, idle_timeout, GNUNET_YES);
+  }
   plugin->handlers = GNUNET_malloc (sizeof (my_handlers));
   memcpy (plugin->handlers, my_handlers, sizeof (my_handlers));
   for (i = 0;
-       i <
-       sizeof (my_handlers) / sizeof (struct GNUNET_SERVER_MessageHandler);
+       i < sizeof (my_handlers) / sizeof (struct GNUNET_SERVER_MessageHandler);
        i++)
     plugin->handlers[i].callback_cls = plugin;
   GNUNET_SERVER_add_handlers (plugin->server, plugin->handlers);
-
-  if (plugin->behind_nat == GNUNET_YES)
-    {
-      if (GNUNET_YES != tcp_transport_start_nat_server(plugin))
-        {
-          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-
-                           _
-                           ("Failed to start %s required for NAT in %s!\n"),
-                           "gnunet-nat-server"
-                           "transport-tcp");
-          GNUNET_free_non_null(external_address);
-          GNUNET_free_non_null(internal_address);
-          GNUNET_SERVICE_stop (service);
-         GNUNET_free (api);
-          return NULL;
-        }
-    }
-
-  if (allow_nat == GNUNET_YES)
-    {
-      plugin->nat_wait_conns = GNUNET_CONTAINER_multihashmap_create(100);
-      GNUNET_assert(plugin->nat_wait_conns != NULL);
-    }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, _("TCP transport listening on port %llu\n"), bport);
+  GNUNET_SERVER_disconnect_notify (plugin->server, &disconnect_notify, plugin);
+  plugin->nat_wait_conns = GNUNET_CONTAINER_multihashmap_create (16);
+  if (bport != 0)
+    GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "tcp",
+                     _("TCP transport listening on port %llu\n"), bport);
+  else
+    GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "tcp",
+                     _
+                     ("TCP transport not listening on any port (client only)\n"));
   if (aport != bport)
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                     _("TCP transport advertises itself as being on port %llu\n"),
+    GNUNET_log_from (GNUNET_ERROR_TYPE_INFO, "tcp",
+                     _
+                     ("TCP transport advertises itself as being on port %llu\n"),
                      aport);
-  GNUNET_SERVER_disconnect_notify (plugin->server,
-                                  &disconnect_notify,
-                                   plugin);
-  GNUNET_CONFIGURATION_get_value_string(env->cfg, "transport-tcp", "BINDTO", &plugin->bind_address);
-
-  if (plugin->behind_nat == GNUNET_NO)
-    {
-      GNUNET_OS_network_interfaces_list (&process_interfaces, plugin);
-    }
-
-  plugin->hostname_dns = GNUNET_RESOLVER_hostname_resolve (env->sched,
-                                                           env->cfg,
-                                                           AF_UNSPEC,
-                                                           HOSTNAME_RESOLVE_TIMEOUT,
-                                                           &process_hostname_ips,
-                                                           plugin);
-
-  if ((plugin->behind_nat == GNUNET_YES) && (inet_pton(AF_INET, plugin->external_address, &t4.ipv4_addr) == 1))
-    {
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Notifying transport of address %s:0\n", plugin->external_address);
-      t4.t_port = htons(0);
-      add_to_address_list (plugin, &t4.ipv4_addr, sizeof (uint32_t));
-      plugin->env->notify_address (plugin->env->cls,
-                                  "tcp",
-                                   &t4, sizeof(t4), GNUNET_TIME_UNIT_FOREVER_REL);
-    }
-  else if ((plugin->external_address != NULL) && (inet_pton(AF_INET, plugin->external_address, &t4.ipv4_addr) == 1))
-    {
-      t4.t_port = htons(plugin->adv_port);
-      GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Notifying transport of address %s:%d\n", plugin->external_address, plugin->adv_port);
-      add_to_address_list (plugin, &t4.ipv4_addr, sizeof (uint32_t));
-      plugin->env->notify_address (plugin->env->cls,
-                                   "tcp",
-                                   &t4, sizeof(t4), GNUNET_TIME_UNIT_FOREVER_REL);
-    }
-
   return api;
 }
 
@@ -2493,32 +2054,25 @@ libgnunet_plugin_transport_tcp_done (void *cls)
   struct GNUNET_TRANSPORT_PluginFunctions *api = cls;
   struct Plugin *plugin = api->cls;
   struct Session *session;
-  struct LocalAddrList *lal;
+  struct TCPProbeContext *tcp_probe;
 
   while (NULL != (session = plugin->sessions))
     disconnect_session (session);
-  if (NULL != plugin->hostname_dns)
-    {
-      GNUNET_RESOLVER_request_cancel (plugin->hostname_dns);
-      plugin->hostname_dns = NULL;
-    }
-  GNUNET_SERVICE_stop (plugin->service);
+  if (plugin->service != NULL)
+    GNUNET_SERVICE_stop (plugin->service);
+  else
+    GNUNET_SERVER_destroy (plugin->server);
   GNUNET_free (plugin->handlers);
-  while (NULL != (lal = plugin->lal_head))
-    {
-      GNUNET_CONTAINER_DLL_remove (plugin->lal_head,
-                                  plugin->lal_tail,
-                                  lal);
-      GNUNET_free (lal);
-    }
-
-  if (plugin->behind_nat == GNUNET_YES)
-    {
-      if (0 != PLIBC_KILL (plugin->server_pid, SIGTERM))
-        GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "kill");
-      GNUNET_OS_process_wait (plugin->server_pid);
-    }
-  GNUNET_free_non_null(plugin->bind_address);
+  if (plugin->nat != NULL)
+    GNUNET_NAT_unregister (plugin->nat);
+  while (NULL != (tcp_probe = plugin->probe_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (plugin->probe_head, plugin->probe_tail,
+                                 tcp_probe);
+    GNUNET_CONNECTION_destroy (tcp_probe->sock, GNUNET_NO);
+    GNUNET_free (tcp_probe);
+  }
+  GNUNET_CONTAINER_multihashmap_destroy (plugin->nat_wait_conns);
   GNUNET_free (plugin);
   GNUNET_free (api);
   return NULL;