- htons => htonl
[oweals/gnunet.git] / src / vpn / gnunet-service-vpn.c
index 48de1de461df1ece5a21a592d6adada0ea0613f9..2c14635193290fddc5dc78fc885cd2cfb9709921 100644 (file)
  * @file vpn/gnunet-service-vpn.c
  * @brief service that opens a virtual interface and allows its clients
  *        to allocate IPs on the virtual interface and to then redirect
- *        IP traffic received on those IPs via the GNUnet mesh 
+ *        IP traffic received on those IPs via the GNUnet mesh
  * @author Philipp Toelke
  * @author Christian Grothoff
+ *
+ * TODO:
+ * - keep multiple peers/mesh channels ready as alternative exits /
+ *   detect & recover from channel-to-exit failure gracefully
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
@@ -35,6 +39,7 @@
 #include "gnunet_statistics_service.h"
 #include "gnunet_constants.h"
 #include "gnunet_tun_lib.h"
+#include "gnunet_regex_service.h"
 #include "vpn.h"
 #include "exit.h"
 
 
 
 /**
- * State we keep for each of our tunnels.
+ * State we keep for each of our channels.
+ */
+struct ChannelState;
+
+/**
+ * Information we track for each IP address to determine which channel
+ * to send the traffic over to the destination.
  */
-struct TunnelState;
+struct DestinationEntry;
+
+/**
+ * List of channels we keep for each destination port for a given
+ * destination entry.
+ */
+struct DestinationChannel
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DestinationChannel *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DestinationChannel *prev;
+
+  /**
+   * Destination entry list this `struct DestinationChannel` belongs with.
+   */
+  struct DestinationEntry *destination;
+
+  /**
+   * Pre-allocated channel for this destination, or NULL for none.
+   */
+  struct ChannelState *ts;
+
+  /**
+   * Destination port this channel state is used for.
+   */
+  uint16_t destination_port;
+
+};
 
 
 /**
- * Information we track for each IP address to determine which tunnel
+ * Information we track for each IP address to determine which channel
  * to send the traffic over to the destination.
  */
 struct DestinationEntry
@@ -65,9 +110,14 @@ struct DestinationEntry
   struct GNUNET_HashCode key;
 
   /**
-   * Pre-allocated tunnel for this destination, or NULL for none.
+   * Head of DLL of channels associated with this destination.
    */
-  struct TunnelState *ts;
+  struct DestinationChannel *dt_head;
+
+  /**
+   * Tail of DLL of channels associated with this destination.
+   */
+  struct DestinationChannel *dt_tail;
 
   /**
    * Entry for this entry in the destination_heap.
@@ -75,8 +125,8 @@ struct DestinationEntry
   struct GNUNET_CONTAINER_HeapNode *heap_node;
 
   /**
-   * GNUNET_NO if this is a tunnel to an Internet-exit,
-   * GNUNET_YES if this tunnel is to a service.
+   * #GNUNET_NO if this is a channel to an Internet-exit,
+   * #GNUNET_YES if this channel is to a service.
    */
   int is_service;
 
@@ -89,7 +139,7 @@ struct DestinationEntry
     struct
     {
       /**
-       * The description of the service (only used for service tunnels).
+       * The description of the service (only used for service channels).
        */
       struct GNUNET_HashCode service_descriptor;
 
@@ -100,16 +150,16 @@ struct DestinationEntry
 
     } service_destination;
 
-    struct 
+    struct
     {
-  
+
       /**
        * Address family used (AF_INET or AF_INET6).
        */
       int af;
-      
+
       /**
-       * IP address of the ultimate destination (only used for exit tunnels).
+       * IP address of the ultimate destination (only used for exit channels).
        */
       union
       {
@@ -117,7 +167,7 @@ struct DestinationEntry
         * Address if af is AF_INET.
         */
        struct in_addr v4;
-       
+
        /**
         * Address if af is AF_INET6.
         */
@@ -127,25 +177,25 @@ struct DestinationEntry
     } exit_destination;
 
   } details;
-    
+
 };
 
 
 /**
- * A messages we have in queue for a particular tunnel.
+ * A messages we have in queue for a particular channel.
  */
-struct TunnelMessageQueueEntry
+struct ChannelMessageQueueEntry
 {
   /**
    * This is a doubly-linked list.
    */
-  struct TunnelMessageQueueEntry *next;
+  struct ChannelMessageQueueEntry *next;
 
   /**
    * This is a doubly-linked list.
    */
-  struct TunnelMessageQueueEntry *prev;
-  
+  struct ChannelMessageQueueEntry *prev;
+
   /**
    * Number of bytes in 'msg'.
    */
@@ -159,16 +209,21 @@ struct TunnelMessageQueueEntry
 
 
 /**
- * State we keep for each of our tunnels.
+ * State we keep for each of our channels.
  */
-struct TunnelState
+struct ChannelState
 {
 
   /**
-   * Information about the tunnel to use, NULL if no tunnel
+   * Information about the channel to use, NULL if no channel
    * is available right now.
    */
-  struct GNUNET_MESH_Tunnel *tunnel;
+  struct GNUNET_MESH_Channel *channel;
+
+  /**
+   * Active query with REGEX to locate exit.
+   */
+  struct GNUNET_REGEX_Search *search;
 
   /**
    * Active transmission handle, NULL for none.
@@ -176,40 +231,29 @@ struct TunnelState
   struct GNUNET_MESH_TransmitHandle *th;
 
   /**
-   * Entry for this entry in the tunnel_heap, NULL as long as this
-   * tunnel state is not fully bound.
+   * Entry for this entry in the channel_heap, NULL as long as this
+   * channel state is not fully bound.
    */
   struct GNUNET_CONTAINER_HeapNode *heap_node;
 
   /**
    * Head of list of messages scheduled for transmission.
    */
-  struct TunnelMessageQueueEntry *tmq_head;
+  struct ChannelMessageQueueEntry *tmq_head;
 
   /**
    * Tail of list of messages scheduled for transmission.
    */
-  struct TunnelMessageQueueEntry *tmq_tail;  
+  struct ChannelMessageQueueEntry *tmq_tail;
 
   /**
-   * Client that needs to be notified about the tunnel being
-   * up as soon as a peer is connected; NULL for none.
+   * Destination entry that has a pointer to this channel state;
+   * NULL if this channel state is in the channel map.
    */
-  struct GNUNET_SERVER_Client *client;
+  struct DestinationChannel *destination_container;
 
   /**
-   * Destination entry that has a pointer to this tunnel state;
-   * NULL if this tunnel state is in the tunnel map.
-   */
-  struct DestinationEntry *destination_container;
-
-  /**
-   * ID of the client request that caused us to setup this entry.
-   */ 
-  uint64_t request_id;
-
-  /**
-   * Destination to which this tunnel leads.  Note that
+   * Destination to which this channel leads.  Note that
    * this struct is NOT in the destination_map (but a
    * local copy) and that the 'heap_node' should always
    * be NULL.
@@ -217,12 +261,7 @@ struct TunnelState
   struct DestinationEntry destination;
 
   /**
-   * Task scheduled to destroy the tunnel (or NO_TASK).
-   */
-  GNUNET_SCHEDULER_TaskIdentifier destroy_task;
-
-  /**
-   * Addess family used for this tunnel on the local TUN interface.
+   * Addess family used for this channel on the local TUN interface.
    */
   int af;
 
@@ -245,7 +284,7 @@ struct TunnelState
      * Address if af is AF_INET.
      */
     struct in_addr v4;
-    
+
     /**
      * Address if af is AF_INET6.
      */
@@ -255,7 +294,7 @@ struct TunnelState
 
   /**
    * Destination IP address used by the source on our end (this is the IP
-   * that we pick freely within the VPN's tunnel IP range).
+   * that we pick freely within the VPN's channel IP range).
    */
   union
   {
@@ -263,7 +302,7 @@ struct TunnelState
      * Address if af is AF_INET.
      */
     struct in_addr v4;
-    
+
     /**
      * Address if af is AF_INET6.
      */
@@ -301,7 +340,7 @@ static struct GNUNET_MESH_Handle *mesh_handle;
 
 /**
  * Map from IP address to destination information (possibly with a
- * MESH tunnel handle for fast setup).
+ * MESH channel handle for fast setup).
  */
 static struct GNUNET_CONTAINER_MultiHashMap *destination_map;
 
@@ -312,15 +351,15 @@ static struct GNUNET_CONTAINER_Heap *destination_heap;
 
 /**
  * Map from source and destination address (IP+port) to connection
- * information (mostly with the respective MESH tunnel handle).
+ * information (mostly with the respective MESH channel handle).
  */
-static struct GNUNET_CONTAINER_MultiHashMap *tunnel_map;
+static struct GNUNET_CONTAINER_MultiHashMap *channel_map;
 
 /**
  * Min-Heap sorted by activity time to expire old mappings; values are
- * of type 'struct TunnelState'.
+ * of type 'struct ChannelState'.
  */
-static struct GNUNET_CONTAINER_Heap *tunnel_heap;
+static struct GNUNET_CONTAINER_Heap *channel_heap;
 
 /**
  * Statistics.
@@ -354,10 +393,10 @@ static struct GNUNET_SERVER_NotificationContext *nc;
 static unsigned long long max_destination_mappings;
 
 /**
- * If there are more than this number of open tunnels, old ones
+ * If there are more than this number of open channels, old ones
  * will be removed
  */
-static unsigned long long max_tunnel_mappings;
+static unsigned long long max_channel_mappings;
 
 
 /**
@@ -394,7 +433,7 @@ get_destination_key_from_ip (int af,
 
 /**
  * Compute the key under which we would store an entry in the
- * tunnel_map for the given socket address pair.
+ * channel_map for the given socket address pair.
  *
  * @param af address family (AF_INET or AF_INET6)
  * @param protocol IPPROTO_TCP or IPPROTO_UDP
@@ -405,7 +444,7 @@ get_destination_key_from_ip (int af,
  * @param key where to store the key
  */
 static void
-get_tunnel_key_from_ips (int af,
+get_channel_key_from_ips (int af,
                         uint8_t protocol,
                         const void *source_ip,
                         uint16_t source_port,
@@ -442,7 +481,7 @@ get_tunnel_key_from_ips (int af,
     break;
   }
   memcpy (off, &protocol, sizeof (uint8_t));
-  off += sizeof (uint8_t);  
+  /* off += sizeof (uint8_t);  */
 }
 
 
@@ -467,7 +506,7 @@ send_client_reply (struct GNUNET_SERVER_Client *client,
   switch (result_af)
   {
   case AF_INET:
-    rlen = sizeof (struct in_addr);    
+    rlen = sizeof (struct in_addr);
     break;
   case AF_INET6:
     rlen = sizeof (struct in6_addr);
@@ -494,21 +533,21 @@ send_client_reply (struct GNUNET_SERVER_Client *client,
 
 
 /**
- * Free resources associated with a tunnel state.
+ * Free resources associated with a channel state.
  *
  * @param ts state to free
  */
 static void
-free_tunnel_state (struct TunnelState *ts)
+free_channel_state (struct ChannelState *ts)
 {
   struct GNUNET_HashCode key;
-  struct TunnelMessageQueueEntry *tnq;
-  struct GNUNET_MESH_Tunnel *tunnel;
+  struct ChannelMessageQueueEntry *tnq;
+  struct GNUNET_MESH_Channel *channel;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Cleaning up tunnel state\n");
+             "Cleaning up channel state\n");
   GNUNET_STATISTICS_update (stats,
-                           gettext_noop ("# Active tunnels"),
+                           gettext_noop ("# Active channels"),
                            -1, GNUNET_NO);
   while (NULL != (tnq = ts->tmq_head))
   {
@@ -519,32 +558,27 @@ free_tunnel_state (struct TunnelState *ts)
     GNUNET_free (tnq);
   }
   GNUNET_assert (0 == ts->tmq_length);
-  if (NULL != ts->client)
-  {
-    GNUNET_SERVER_client_drop (ts->client);
-    ts->client = NULL;
-  }
   if (NULL != ts->th)
   {
     GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
     ts->th = NULL;
   }
   GNUNET_assert (NULL == ts->destination.heap_node);
-  if (NULL != (tunnel = ts->tunnel))
+  if (NULL != (channel = ts->channel))
   {
-    ts->tunnel = NULL;
-    GNUNET_MESH_tunnel_destroy (tunnel);
+    ts->channel = NULL;
+    GNUNET_MESH_channel_destroy (channel);
   }
-  if (GNUNET_SCHEDULER_NO_TASK != ts->destroy_task)
+  if (NULL != ts->search)
   {
-    GNUNET_SCHEDULER_cancel (ts->destroy_task);
-    ts->destroy_task = GNUNET_SCHEDULER_NO_TASK;
+    GNUNET_REGEX_search_cancel (ts->search);
+    ts->search = NULL;
   }
   if (NULL != ts->heap_node)
   {
     GNUNET_CONTAINER_heap_remove_node (ts->heap_node);
     ts->heap_node = NULL;
-    get_tunnel_key_from_ips (ts->af,
+    get_channel_key_from_ips (ts->af,
                             ts->protocol,
                             &ts->source_ip,
                             ts->source_port,
@@ -552,7 +586,7 @@ free_tunnel_state (struct TunnelState *ts)
                             ts->destination_port,
                             &key);
     GNUNET_assert (GNUNET_YES ==
-                  GNUNET_CONTAINER_multihashmap_remove (tunnel_map,
+                  GNUNET_CONTAINER_multihashmap_remove (channel_map,
                                                         &key,
                                                         ts));
   }
@@ -566,108 +600,19 @@ free_tunnel_state (struct TunnelState *ts)
 }
 
 
-/**
- * Destroy the mesh tunnel.
- *
- * @param cls the 'struct TunnelState' with the tunnel to destroy
- * @param tc scheduler context
- */
-static void
-destroy_tunnel_task (void *cls,
-                    const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct TunnelState *ts = cls;
-  struct GNUNET_MESH_Tunnel *tunnel;
-
-  ts->destroy_task = GNUNET_SCHEDULER_NO_TASK;
-  GNUNET_assert (NULL != ts->tunnel);
-  tunnel = ts->tunnel;
-  ts->tunnel = NULL;
-  GNUNET_MESH_tunnel_destroy (tunnel);
-  free_tunnel_state (ts);
-}
-
-
-/**
- * Method called whenever a peer has disconnected from the tunnel.
- *
- * @param cls closure
- * @param peer peer identity the tunnel stopped working with
- */
-static void
-tunnel_peer_disconnect_handler (void *cls,
-                               const struct
-                               GNUNET_PeerIdentity * peer)
-{
-  struct TunnelState *ts = cls;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Peer %s disconnected from tunnel.\n",
-             GNUNET_i2s (peer));
-  GNUNET_STATISTICS_update (stats,
-                           gettext_noop ("# peers connected to mesh tunnels"),
-                           -1, GNUNET_NO);
-  if (NULL != ts->th)
-  {
-    GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
-    ts->th = NULL;
-  }
-  if (ts->destination.is_service)
-    return; /* hope for reconnect eventually */
-  /* as we are most likely going to change the exit node now,
-     we should just destroy the tunnel entirely... */
-  if (GNUNET_SCHEDULER_NO_TASK == ts->destroy_task)
-    ts->destroy_task = GNUNET_SCHEDULER_add_now (&destroy_tunnel_task, ts);
-}
-
-
-/**
- * Method called whenever a peer has connected to the tunnel.  Notifies
- * the waiting client that the tunnel is now up.
- *
- * @param cls closure
- * @param peer peer identity the tunnel was created to, NULL on timeout
- * @param atsi performance data for the connection
- */
-static void
-tunnel_peer_connect_handler (void *cls,
-                            const struct GNUNET_PeerIdentity
-                            * peer,
-                            const struct
-                            GNUNET_ATS_Information * atsi)
-{
-  struct TunnelState *ts = cls;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Peer %s connected to tunnel.\n",
-             GNUNET_i2s (peer));
-  GNUNET_STATISTICS_update (stats,
-                           gettext_noop ("# peers connected to mesh tunnels"),
-                           1, GNUNET_NO);
-  if (NULL == ts->client)
-    return; /* nothing to do */
-  send_client_reply (ts->client,
-                    ts->request_id,
-                    ts->af,
-                    &ts->destination_ip);
-  GNUNET_SERVER_client_drop (ts->client);
-  ts->client = NULL;
-}
-
-
 /**
  * Send a message from the message queue via mesh.
  *
- * @param cls the 'struct TunnelState' with the message queue
- * @param size number of bytes available in buf
+ * @param cls the `struct ChannelState` with the message queue
+ * @param size number of bytes available in @a buf
  * @param buf where to copy the message
- * @return number of bytes copied to buf
+ * @return number of bytes copied to @a buf
  */
 static size_t
 send_to_peer_notify_callback (void *cls, size_t size, void *buf)
 {
-  struct TunnelState *ts = cls;
-  struct TunnelMessageQueueEntry *tnq;
+  struct ChannelState *ts = cls;
+  struct ChannelMessageQueueEntry *tnq;
   size_t ret;
 
   ts->th = NULL;
@@ -677,7 +622,7 @@ send_to_peer_notify_callback (void *cls, size_t size, void *buf)
   GNUNET_assert (NULL != tnq);
   GNUNET_assert (size >= tnq->len);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Sending %u bytes via mesh tunnel\n",
+             "Sending %u bytes via mesh channel\n",
              tnq->len);
   GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
                               ts->tmq_tail,
@@ -687,10 +632,9 @@ send_to_peer_notify_callback (void *cls, size_t size, void *buf)
   ret = tnq->len;
   GNUNET_free (tnq);
   if (NULL != (tnq = ts->tmq_head))
-    ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel, 
-                                               GNUNET_NO /* cork */, 
+    ts->th = GNUNET_MESH_notify_transmit_ready (ts->channel,
+                                               GNUNET_NO /* cork */,
                                                GNUNET_TIME_UNIT_FOREVER_REL,
-                                               NULL, 
                                                tnq->len,
                                                &send_to_peer_notify_callback,
                                                ts);
@@ -702,27 +646,27 @@ send_to_peer_notify_callback (void *cls, size_t size, void *buf)
 
 
 /**
- * Add the given message to the given tunnel and trigger the
+ * Add the given message to the given channel and trigger the
  * transmission process.
  *
  * @param tnq message to queue
- * @param ts tunnel to queue the message for
+ * @param ts channel to queue the message for
  */
 static void
-send_to_tunnel (struct TunnelMessageQueueEntry *tnq,
-               struct TunnelState *ts)
+send_to_channel (struct ChannelMessageQueueEntry *tnq,
+               struct ChannelState *ts)
 {
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-             "Queueing %u bytes for transmission via mesh tunnel\n",
+             "Queueing %u bytes for transmission via mesh channel\n",
              tnq->len);
-  GNUNET_assert (NULL != ts->tunnel);
+  GNUNET_assert (NULL != ts->channel);
   GNUNET_CONTAINER_DLL_insert_tail (ts->tmq_head,
                                    ts->tmq_tail,
                                    tnq);
   ts->tmq_length++;
   if (ts->tmq_length > MAX_MESSAGE_QUEUE_SIZE)
   {
-    struct TunnelMessageQueueEntry *dq;
+    struct ChannelMessageQueueEntry *dq;
 
     dq = ts->tmq_head;
     GNUNET_assert (dq != tnq);
@@ -734,15 +678,14 @@ send_to_tunnel (struct TunnelMessageQueueEntry *tnq,
     ts->th = NULL;
     GNUNET_STATISTICS_update (stats,
                              gettext_noop ("# Bytes dropped in mesh queue (overflow)"),
-                             dq->len, 
+                             dq->len,
                              GNUNET_NO);
     GNUNET_free (dq);
   }
   if (NULL == ts->th)
-    ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel, 
+    ts->th = GNUNET_MESH_notify_transmit_ready (ts->channel,
                                                GNUNET_NO /* cork */,
                                                GNUNET_TIME_UNIT_FOREVER_REL,
-                                               NULL, 
                                                tnq->len,
                                                &send_to_peer_notify_callback,
                                                ts);
@@ -750,108 +693,171 @@ send_to_tunnel (struct TunnelMessageQueueEntry *tnq,
 
 
 /**
- * Initialize the given destination entry's mesh tunnel.
+ * Regex has found a potential exit peer for us; consider using it.
  *
- * @param de destination entry for which we need to setup a tunnel
- * @param client client to notify on successful tunnel setup, or NULL for none
+ * @param cls the 'struct ChannelState'
+ * @param id Peer providing a regex that matches the string.
+ * @param get_path Path of the get request.
+ * @param get_path_length Lenght of @a get_path.
+ * @param put_path Path of the put request.
+ * @param put_path_length Length of the @a put_path.
+ */
+static void
+handle_regex_result (void *cls,
+                    const struct GNUNET_PeerIdentity *id,
+                    const struct GNUNET_PeerIdentity *get_path,
+                    unsigned int get_path_length,
+                    const struct GNUNET_PeerIdentity *put_path,
+                    unsigned int put_path_length)
+{
+  struct ChannelState *ts = cls;
+  unsigned int apptype;
+
+  GNUNET_REGEX_search_cancel (ts->search);
+  ts->search = NULL;
+  switch (ts->af)
+  {
+  case AF_INET:
+    apptype = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
+    break;
+  case AF_INET6:
+    apptype = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
+    break;
+  default:
+    GNUNET_break (0);
+    return;
+  }
+  ts->channel = GNUNET_MESH_channel_create (mesh_handle,
+                                          ts,
+                                          id,
+                                          apptype,
+                                          GNUNET_MESH_OPTION_DEFAULT);
+}
+
+
+/**
+ * Initialize the given destination entry's mesh channel.
+ *
+ * @param dt destination channel for which we need to setup a channel
  * @param client_af address family of the address returned to the client
- * @param request_id request ID to send in client notification (unused if client is NULL)
- * @return tunnel state of the tunnel that was created
+ * @return channel state of the channel that was created
  */
-static struct TunnelState *
-create_tunnel_to_destination (struct DestinationEntry *de,
-                             struct GNUNET_SERVER_Client *client,
-                             int client_af,
-                             uint64_t request_id)
+static struct ChannelState *
+create_channel_to_destination (struct DestinationChannel *dt,
+                             int client_af)
 {
-  struct TunnelState *ts;
+  struct ChannelState *ts;
+  unsigned int apptype;
 
   GNUNET_STATISTICS_update (stats,
-                           gettext_noop ("# Mesh tunnels created"),
+                           gettext_noop ("# Mesh channels created"),
                            1, GNUNET_NO);
-  GNUNET_assert (NULL == de->ts);
-  ts = GNUNET_malloc (sizeof (struct TunnelState));
-  ts->af = client_af;
-  if (NULL != client)
+  GNUNET_assert (NULL == dt->ts);
+  switch (client_af)
   {
-    ts->request_id = request_id;
-    ts->client = client;
-    GNUNET_SERVER_client_keep (client);
-  }
-  ts->destination = *de;
-  ts->destination.heap_node = NULL; /* copy is NOT in destination heap */
-  de->ts = ts;
-  ts->destination_container = de; /* we are referenced from de */
-  ts->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
-                                         ts,
-                                         &tunnel_peer_connect_handler,
-                                         &tunnel_peer_disconnect_handler,
-                                         ts);
-  if (NULL == ts->tunnel)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-               _("Failed to setup mesh tunnel!\n"));
-    if (NULL != client)
-      GNUNET_SERVER_client_drop (client);
-    GNUNET_free (ts);
+  case AF_INET:
+    apptype = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
+    break;
+  case AF_INET6:
+    apptype = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
+    break;
+  default:
+    GNUNET_break (0);
     return NULL;
   }
-  if (de->is_service)
-  {
+  ts = GNUNET_new (struct ChannelState);
+  ts->af = client_af;
+  ts->destination = *dt->destination;
+  ts->destination.heap_node = NULL; /* copy is NOT in destination heap */
+  dt->ts = ts;
+  ts->destination_container = dt; /* we are referenced from dt */
+  if (dt->destination->is_service)
+  {
+    ts->channel = GNUNET_MESH_channel_create (mesh_handle,
+                                           ts,
+                                           &dt->destination->details.service_destination.target,
+                                           apptype,
+                                           GNUNET_MESH_OPTION_DEFAULT);
+    if (NULL == ts->channel)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                 _("Failed to setup mesh channel!\n"));
+      GNUNET_free (ts);
+      return NULL;
+    }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-               "Creating tunnel to peer %s offering service %s\n",
-               GNUNET_i2s (&de->details.service_destination.target),
-               GNUNET_h2s (&de->details.service_destination.service_descriptor));
-    GNUNET_MESH_peer_request_connect_add (ts->tunnel,
-                                         &de->details.service_destination.target);  
+               "Creating channel to peer %s offering service %s\n",
+               GNUNET_i2s (&dt->destination->details.service_destination.target),
+               GNUNET_h2s (&dt->destination->details.service_destination.service_descriptor));
   }
   else
   {
-    switch (de->details.exit_destination.af)
+    char *policy;
+
+    switch (dt->destination->details.exit_destination.af)
     {
     case AF_INET:
-      GNUNET_MESH_peer_request_connect_by_type (ts->tunnel,
-                                               GNUNET_APPLICATION_TYPE_IPV4_GATEWAY);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                 "Creating tunnel to exit peer for %s\n",
-                 "IPv4");
-     break;
+    {
+      char address[GNUNET_TUN_IPV4_REGEXLEN];
+
+      GNUNET_TUN_ipv4toregexsearch (&dt->destination->details.exit_destination.ip.v4,
+                                   dt->destination_port,
+                                   address);
+      GNUNET_asprintf (&policy, "%s%s",
+                       GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
+                       address);
+      break;
+    }
     case AF_INET6:
-      GNUNET_MESH_peer_request_connect_by_type (ts->tunnel,
-                                               GNUNET_APPLICATION_TYPE_IPV6_GATEWAY);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                 "Creating tunnel to exit peer for %s\n",
-                 "IPv6");
+    {
+      char address[GNUNET_TUN_IPV6_REGEXLEN];
+
+      GNUNET_TUN_ipv6toregexsearch (&dt->destination->details.exit_destination.ip.v6,
+                                   dt->destination_port,
+                                    address);
+      GNUNET_asprintf (&policy, "%s%s",
+                       GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
+                       address);
       break;
+    }
     default:
       GNUNET_assert (0);
       break;
     }
-  }  
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+               "Requesting connect by string: %s\n",
+               policy);
+    ts->search = GNUNET_REGEX_search (cfg,
+                                     policy,
+                                     &handle_regex_result,
+                                     ts);
+    GNUNET_free (policy);
+  }
   return ts;
 }
 
 
 /**
- * We have too many active tunnels.  Clean up the oldest tunnel.
+ * We have too many active channels.  Clean up the oldest channel.
  *
- * @param except tunnel that must NOT be cleaned up, even if it is the oldest
+ * @param except channel that must NOT be cleaned up, even if it is the oldest
  */
 static void
-expire_tunnel (struct TunnelState *except)
+expire_channel (struct ChannelState *except)
 {
-  struct TunnelState *ts;
+  struct ChannelState *ts;
 
-  ts = GNUNET_CONTAINER_heap_peek (tunnel_heap);
+  ts = GNUNET_CONTAINER_heap_peek (channel_heap);
   GNUNET_assert (NULL != ts);
   if (except == ts)
     return; /* can't do this */
-  free_tunnel_state (ts);
+  free_channel_state (ts);
 }
 
 
 /**
- * Route a packet via mesh to the given destination.  
+ * Route a packet via mesh to the given destination.
  *
  * @param destination description of the destination
  * @param af address family on this end (AF_INET or AF_INET6)
@@ -859,7 +865,7 @@ expire_tunnel (struct TunnelState *except)
  * @param source_ip source IP used by the sender (struct in_addr or struct in6_addr)
  * @param destination_ip destination IP used by the sender (struct in_addr or struct in6_addr)
  * @param payload payload of the packet after the IP header
- * @param payload_length number of bytes in payload
+ * @param payload_length number of bytes in @a payload
  */
 static void
 route_packet (struct DestinationEntry *destination,
@@ -871,14 +877,15 @@ route_packet (struct DestinationEntry *destination,
              size_t payload_length)
 {
   struct GNUNET_HashCode key;
-  struct TunnelState *ts;
-  struct TunnelMessageQueueEntry *tnq;
+  struct ChannelState *ts;
+  struct ChannelMessageQueueEntry *tnq;
   size_t alen;
   size_t mlen;
   int is_new;
   const struct GNUNET_TUN_UdpHeader *udp;
   const struct GNUNET_TUN_TcpHeader *tcp;
   const struct GNUNET_TUN_IcmpHeader *icmp;
+  struct DestinationChannel *dt;
   uint16_t source_port;
   uint16_t destination_port;
 
@@ -902,7 +909,7 @@ route_packet (struct DestinationEntry *destination,
       }
       source_port = ntohs (udp->source_port);
       destination_port = ntohs (udp->destination_port);
-      get_tunnel_key_from_ips (af,
+      get_channel_key_from_ips (af,
                               IPPROTO_UDP,
                               source_ip,
                               source_port,
@@ -918,7 +925,7 @@ route_packet (struct DestinationEntry *destination,
        /* blame kernel? */
        GNUNET_break (0);
        return;
-      }      
+      }
       udp = NULL; /* make compiler happy */
       icmp = NULL;  /* make compiler happy */
       tcp = payload;
@@ -929,7 +936,7 @@ route_packet (struct DestinationEntry *destination,
       }
       source_port = ntohs (tcp->source_port);
       destination_port = ntohs (tcp->destination_port);
-      get_tunnel_key_from_ips (af,
+      get_channel_key_from_ips (af,
                               IPPROTO_TCP,
                               source_ip,
                               source_port,
@@ -938,8 +945,8 @@ route_packet (struct DestinationEntry *destination,
                               &key);
     }
     break;
-  case IPPROTO_ICMP:  
-  case IPPROTO_ICMPV6:  
+  case IPPROTO_ICMP:
+  case IPPROTO_ICMPV6:
     {
       if ( (AF_INET == af) ^ (protocol == IPPROTO_ICMP) )
       {
@@ -957,7 +964,7 @@ route_packet (struct DestinationEntry *destination,
       icmp = payload;
       source_port = 0;
       destination_port = 0;
-      get_tunnel_key_from_ips (af,
+      get_channel_key_from_ips (af,
                               protocol,
                               source_ip,
                               0,
@@ -972,8 +979,9 @@ route_packet (struct DestinationEntry *destination,
                (unsigned int) protocol);
     return;
   }
+  alen = 0;
   if (! destination->is_service)
-  {  
+  {
     switch (destination->details.exit_destination.af)
     {
     case AF_INET:
@@ -983,7 +991,6 @@ route_packet (struct DestinationEntry *destination,
       alen = sizeof (struct in6_addr);
       break;
     default:
-      alen = 0;
       GNUNET_assert (0);
     }
 
@@ -991,7 +998,7 @@ route_packet (struct DestinationEntry *destination,
       char sbuf[INET6_ADDRSTRLEN];
       char dbuf[INET6_ADDRSTRLEN];
       char xbuf[INET6_ADDRSTRLEN];
-      
+
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Routing %s packet from %s:%u -> %s:%u to destination %s:%u\n",
                  (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
@@ -1004,15 +1011,16 @@ route_packet (struct DestinationEntry *destination,
                             xbuf, sizeof (xbuf)),
                  destination_port);
     }
+    for (dt = destination->dt_head; NULL != dt; dt = dt->next)
+      if (dt->destination_port == destination_port)
+       break;
   }
   else
   {
-    /* make compiler happy */
-    alen = 0;
     {
       char sbuf[INET6_ADDRSTRLEN];
       char dbuf[INET6_ADDRSTRLEN];
-      
+
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Routing %s packet from %s:%u -> %s:%u to service %s at peer %s\n",
                  (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
@@ -1023,29 +1031,38 @@ route_packet (struct DestinationEntry *destination,
                  GNUNET_h2s (&destination->details.service_destination.service_descriptor),
                  GNUNET_i2s (&destination->details.service_destination.target));
     }
-
+    dt = destination->dt_head;
+  }
+  if (NULL == dt)
+  {
+    dt = GNUNET_new (struct DestinationChannel);
+    dt->destination = destination;
+    GNUNET_CONTAINER_DLL_insert (destination->dt_head,
+                                destination->dt_tail,
+                                dt);
+    dt->destination_port = destination_port;
   }
 
-  /* see if we have an existing tunnel for this destination */
-  ts = GNUNET_CONTAINER_multihashmap_get (tunnel_map,
+  /* see if we have an existing channel for this destination */
+  ts = GNUNET_CONTAINER_multihashmap_get (channel_map,
                                          &key);
   if (NULL == ts)
   {
-    /* need to either use the existing tunnel from the destination (if still
+    /* need to either use the existing channel from the destination (if still
        available) or create a fresh one */
     is_new = GNUNET_YES;
-    if (NULL == destination->ts)
-      ts = create_tunnel_to_destination (destination, NULL, af, 0);
+    if (NULL == dt->ts)
+      ts = create_channel_to_destination (dt, af);
     else
-      ts = destination->ts;
+      ts = dt->ts;
     if (NULL == ts)
       return;
-    destination->ts = NULL;
+    dt->ts = NULL;
     ts->destination_container = NULL; /* no longer 'contained' */
-    /* now bind existing "unbound" tunnel to our IP/port tuple */
+    /* now bind existing "unbound" channel to our IP/port tuple */
     ts->protocol = protocol;
-    ts->af = af; 
-    if (af == AF_INET)
+    ts->af = af;
+    if (AF_INET == af)
     {
       ts->source_ip.v4 = * (const struct in_addr *) source_ip;
       ts->destination_ip.v4 = * (const struct in_addr *) destination_ip;
@@ -1057,30 +1074,30 @@ route_packet (struct DestinationEntry *destination,
     }
     ts->source_port = source_port;
     ts->destination_port = destination_port;
-    ts->heap_node = GNUNET_CONTAINER_heap_insert (tunnel_heap,
+    ts->heap_node = GNUNET_CONTAINER_heap_insert (channel_heap,
                                                  ts,
-                                                 GNUNET_TIME_absolute_get ().abs_value);
+                                                 GNUNET_TIME_absolute_get ().abs_value_us);
     GNUNET_assert (GNUNET_YES ==
-                  GNUNET_CONTAINER_multihashmap_put (tunnel_map,
+                  GNUNET_CONTAINER_multihashmap_put (channel_map,
                                                      &key,
                                                      ts,
-                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)); 
+                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
     GNUNET_STATISTICS_update (stats,
-                             gettext_noop ("# Active tunnels"),
+                             gettext_noop ("# Active channels"),
                              1, GNUNET_NO);
-    while (GNUNET_CONTAINER_multihashmap_size (tunnel_map) > max_tunnel_mappings)
-      expire_tunnel (ts);
+    while (GNUNET_CONTAINER_multihashmap_size (channel_map) > max_channel_mappings)
+      expire_channel (ts);
   }
   else
   {
     is_new = GNUNET_NO;
-    GNUNET_CONTAINER_heap_update_cost (tunnel_heap, 
+    GNUNET_CONTAINER_heap_update_cost (channel_heap,
                                       ts->heap_node,
-                                      GNUNET_TIME_absolute_get ().abs_value);
+                                      GNUNET_TIME_absolute_get ().abs_value_us);
   }
-  GNUNET_assert (NULL != ts->tunnel);
-  
-  /* send via tunnel */
+  GNUNET_assert (NULL != ts->channel);
+
+  /* send via channel */
   switch (protocol)
   {
   case IPPROTO_UDP:
@@ -1088,14 +1105,14 @@ route_packet (struct DestinationEntry *destination,
     {
       struct GNUNET_EXIT_UdpServiceMessage *usm;
 
-      mlen = sizeof (struct GNUNET_EXIT_UdpServiceMessage) + 
+      mlen = sizeof (struct GNUNET_EXIT_UdpServiceMessage) +
        payload_length - sizeof (struct GNUNET_TUN_UdpHeader);
       if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
       {
        GNUNET_break (0);
        return;
       }
-      tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+      tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
       tnq->len = mlen;
       tnq->msg = &tnq[1];
       usm = (struct GNUNET_EXIT_UdpServiceMessage *) &tnq[1];
@@ -1117,20 +1134,19 @@ route_packet (struct DestinationEntry *destination,
       struct in6_addr *ip6dst;
       void *payload;
 
-      mlen = sizeof (struct GNUNET_EXIT_UdpInternetMessage) + 
+      mlen = sizeof (struct GNUNET_EXIT_UdpInternetMessage) +
        alen + payload_length - sizeof (struct GNUNET_TUN_UdpHeader);
       if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
       {
        GNUNET_break (0);
        return;
       }
-      tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + 
-                          mlen);
+      tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
       tnq->len = mlen;
       tnq->msg = &tnq[1];
       uim = (struct GNUNET_EXIT_UdpInternetMessage *) &tnq[1];
       uim->header.size = htons ((uint16_t) mlen);
-      uim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET); 
+      uim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET);
       uim->af = htonl (destination->details.exit_destination.af);
       uim->source_port = (ntohs (udp->source_port) < 32000) ? udp->source_port : 0;
       uim->destination_port = udp->destination_port;
@@ -1161,14 +1177,14 @@ route_packet (struct DestinationEntry *destination,
       {
        struct GNUNET_EXIT_TcpServiceStartMessage *tsm;
 
-       mlen = sizeof (struct GNUNET_EXIT_TcpServiceStartMessage) + 
+       mlen = sizeof (struct GNUNET_EXIT_TcpServiceStartMessage) +
          payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
        if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
        {
          GNUNET_break (0);
          return;
        }
-       tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+       tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
        tnq->len = mlen;
        tnq->msg = &tnq[1];
        tsm = (struct  GNUNET_EXIT_TcpServiceStartMessage *) &tnq[1];
@@ -1188,20 +1204,20 @@ route_packet (struct DestinationEntry *destination,
        struct in6_addr *ip6dst;
        void *payload;
 
-       mlen = sizeof (struct GNUNET_EXIT_TcpInternetStartMessage) + 
+       mlen = sizeof (struct GNUNET_EXIT_TcpInternetStartMessage) +
          alen + payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
        if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
        {
          GNUNET_break (0);
          return;
        }
-       tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+       tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
        tnq->len = mlen;
        tnq->msg = &tnq[1];
        tim = (struct  GNUNET_EXIT_TcpInternetStartMessage *) &tnq[1];
        tim->header.size = htons ((uint16_t) mlen);
        tim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START);
-       tim->af = htonl (destination->details.exit_destination.af);     
+       tim->af = htonl (destination->details.exit_destination.af);
        tim->tcp_header = *tcp;
        switch (destination->details.exit_destination.af)
        {
@@ -1227,14 +1243,14 @@ route_packet (struct DestinationEntry *destination,
     {
       struct GNUNET_EXIT_TcpDataMessage *tdm;
 
-      mlen = sizeof (struct GNUNET_EXIT_TcpDataMessage) + 
+      mlen = sizeof (struct GNUNET_EXIT_TcpDataMessage) +
        payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
       if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
       {
        GNUNET_break (0);
        return;
       }
-      tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+      tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
       tnq->len = mlen;
       tnq->msg = &tnq[1];
       tdm = (struct  GNUNET_EXIT_TcpDataMessage *) &tnq[1];
@@ -1253,14 +1269,14 @@ route_packet (struct DestinationEntry *destination,
     {
       struct GNUNET_EXIT_IcmpServiceMessage *ism;
 
-      mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) + 
+      mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) +
        payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
       if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
       {
        GNUNET_break (0);
        return;
       }
-      tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+      tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
       tnq->msg = &tnq[1];
       ism = (struct GNUNET_EXIT_IcmpServiceMessage *) &tnq[1];
       ism->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_SERVICE);
@@ -1282,7 +1298,7 @@ route_packet (struct DestinationEntry *destination,
        case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
        case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
          /* throw away ICMP payload, won't be useful for the other side anyway */
-         payload_length = sizeof (struct GNUNET_TUN_IcmpHeader); 
+         payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
          break;
        default:
          GNUNET_STATISTICS_update (stats,
@@ -1300,7 +1316,7 @@ route_packet (struct DestinationEntry *destination,
        case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
        case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
          /* throw away ICMP payload, won't be useful for the other side anyway */
-         payload_length = sizeof (struct GNUNET_TUN_IcmpHeader); 
+         payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
          break;
        case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
        case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
@@ -1310,7 +1326,7 @@ route_packet (struct DestinationEntry *destination,
                                    gettext_noop ("# ICMPv6 packets dropped (not allowed)"),
                                    1, GNUNET_NO);
          return;
-       }       
+       }
        /* end of AF_INET6 */
        break;
       default:
@@ -1319,8 +1335,8 @@ route_packet (struct DestinationEntry *destination,
       }
 
       /* update length calculations, as payload_length may have changed */
-      mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) + 
-       alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);      
+      mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) +
+       alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
       tnq->len = mlen;
       ism->header.size = htons ((uint16_t) mlen);
       /* finally, copy payload (if there is any left...) */
@@ -1335,18 +1351,17 @@ route_packet (struct DestinationEntry *destination,
       struct in6_addr *ip6dst;
       void *payload;
 
-      mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) + 
+      mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) +
        alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
       if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
       {
        GNUNET_break (0);
        return;
       }
-      tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + 
-                          mlen);
+      tnq = GNUNET_malloc (sizeof (struct ChannelMessageQueueEntry) + mlen);
       tnq->msg = &tnq[1];
       iim = (struct GNUNET_EXIT_IcmpInternetMessage *) &tnq[1];
-      iim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET); 
+      iim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET);
       iim->icmp_header = *icmp;
       /* Perform ICMP protocol-translation (depending on destination AF and source AF)
         and throw away ICMP payload depending on ICMP message type */
@@ -1355,11 +1370,11 @@ route_packet (struct DestinationEntry *destination,
       case AF_INET:
        switch (icmp->type)
        {
-       case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:      
+       case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
          if (destination->details.exit_destination.af == AF_INET6)
            iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_ECHO_REPLY;
          break;
-       case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:    
+       case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
          if (destination->details.exit_destination.af == AF_INET6)
            iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST;
          break;
@@ -1369,7 +1384,7 @@ route_packet (struct DestinationEntry *destination,
          /* throw away IP-payload, exit will have to make it up anyway */
          payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
          break;
-       case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED: 
+       case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
          if (destination->details.exit_destination.af == AF_INET6)
            iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
          /* throw away IP-payload, exit will have to make it up anyway */
@@ -1391,7 +1406,7 @@ route_packet (struct DestinationEntry *destination,
          GNUNET_STATISTICS_update (stats,
                                    gettext_noop ("# ICMPv4 packets dropped (type not allowed)"),
                                    1, GNUNET_NO);
-         GNUNET_free (tnq);        
+         GNUNET_free (tnq);
          return;
        }
        /* end of AF_INET */
@@ -1447,17 +1462,17 @@ route_packet (struct DestinationEntry *destination,
            GNUNET_STATISTICS_update (stats,
                                      gettext_noop ("# ICMPv6 packets dropped (type not allowed)"),
                                      1, GNUNET_NO);
-           GNUNET_free (tnq);      
+           GNUNET_free (tnq);
            return;
          }
        /* end of AF_INET6 */
        break;
       default:
        GNUNET_assert (0);
-      } 
+      }
       /* update length calculations, as payload_length may have changed */
-      mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) + 
-       alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);      
+      mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) +
+       alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
       tnq->len = mlen;
       iim->header.size = htons ((uint16_t) mlen);
 
@@ -1488,22 +1503,23 @@ route_packet (struct DestinationEntry *destination,
     GNUNET_assert (0);
     break;
   }
-  send_to_tunnel (tnq, ts);
+  send_to_channel (tnq, ts);
 }
 
 
 /**
  * Receive packets from the helper-process (someone send to the local
- * virtual tunnel interface).  Find the destination mapping, and if it
- * exists, identify the correct MESH tunnel (or possibly create it)
+ * virtual channel interface).  Find the destination mapping, and if it
+ * exists, identify the correct MESH channel (or possibly create it)
  * and forward the packet.
  *
  * @param cls closure, NULL
  * @param client NULL
- * @param message message we got from the client (VPN tunnel interface)
+ * @param message message we got from the client (VPN channel interface)
  */
 static int
-message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
+message_token (void *cls,
+              void *client,
                const struct GNUNET_MessageHeader *message)
 {
   const struct GNUNET_TUN_Layer2PacketHeader *tun;
@@ -1528,7 +1544,7 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
   case ETH_P_IPV6:
     {
       const struct GNUNET_TUN_IPv6Header *pkt6;
-      
+
       if (mlen < sizeof (struct GNUNET_TUN_IPv6Header))
       {
        /* blame kernel */
@@ -1540,15 +1556,10 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
                                   &pkt6->destination_address,
                                   &key);
       de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
-      /* FIXME: do we need to guard against hash collision? 
-        (if so, we need to also store the local destination IP in the
-        destination entry and then compare here; however, the risk
-        of collision seems minimal AND the impact is unlikely to be
-        super-problematic as well... */
       if (NULL == de)
       {
        char buf[INET6_ADDRSTRLEN];
-       
+
        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                    _("Packet received for unmapped destination `%s' (dropping it)\n"),
                    inet_ntop (AF_INET6,
@@ -1560,8 +1571,8 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
       route_packet (de,
                    AF_INET6,
                    pkt6->next_header,
-                   &pkt6->source_address,                  
-                   &pkt6->destination_address,             
+                   &pkt6->source_address,
+                   &pkt6->destination_address,
                    &pkt6[1],
                    mlen - sizeof (struct GNUNET_TUN_IPv6Header));
     }
@@ -1581,15 +1592,10 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
                                   &pkt4->destination_address,
                                   &key);
       de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
-      /* FIXME: do we need to guard against hash collision? 
-        (if so, we need to also store the local destination IP in the
-        destination entry and then compare here; however, the risk
-        of collision seems minimal AND the impact is unlikely to be
-        super-problematic as well... */
       if (NULL == de)
       {
        char buf[INET_ADDRSTRLEN];
-       
+
        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                    _("Packet received for unmapped destination `%s' (dropping it)\n"),
                    inet_ntop (AF_INET,
@@ -1601,14 +1607,14 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
       if (pkt4->header_length * 4 != sizeof (struct GNUNET_TUN_IPv4Header))
       {
        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                   _("Received IPv4 packet with options (dropping it)\n"));                
+                   _("Received IPv4 packet with options (dropping it)\n"));
         return GNUNET_OK;
       }
       route_packet (de,
                    AF_INET,
                    pkt4->protocol,
-                   &pkt4->source_address,                  
-                   &pkt4->destination_address,             
+                   &pkt4->source_address,
+                   &pkt4->destination_address,
                    &pkt4[1],
                    mlen - sizeof (struct GNUNET_TUN_IPv4Header));
     }
@@ -1625,15 +1631,15 @@ message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
 
 /**
  * Synthesize a plausible ICMP payload for an ICMP error
- * response on the given tunnel.
+ * response on the given channel.
  *
- * @param ts tunnel information
+ * @param ts channel information
  * @param ipp IPv4 header to fill in (ICMP payload)
  * @param udp "UDP" header to fill in (ICMP payload); might actually
  *            also be the first 8 bytes of the TCP header
  */
 static void
-make_up_icmpv4_payload (struct TunnelState *ts,
+make_up_icmpv4_payload (struct ChannelState *ts,
                        struct GNUNET_TUN_IPv4Header *ipp,
                        struct GNUNET_TUN_UdpHeader *udp)
 {
@@ -1651,15 +1657,15 @@ make_up_icmpv4_payload (struct TunnelState *ts,
 
 /**
  * Synthesize a plausible ICMP payload for an ICMP error
- * response on the given tunnel.
+ * response on the given channel.
  *
- * @param ts tunnel information
+ * @param ts channel information
  * @param ipp IPv6 header to fill in (ICMP payload)
  * @param udp "UDP" header to fill in (ICMP payload); might actually
  *            also be the first 8 bytes of the TCP header
  */
 static void
-make_up_icmpv6_payload (struct TunnelState *ts,
+make_up_icmpv6_payload (struct ChannelState *ts,
                        struct GNUNET_TUN_IPv6Header *ipp,
                        struct GNUNET_TUN_UdpHeader *udp)
 {
@@ -1676,25 +1682,23 @@ make_up_icmpv6_payload (struct TunnelState *ts,
 
 
 /**
- * We got an ICMP packet back from the MESH tunnel.  Pass it on to the
+ * We got an ICMP packet back from the MESH channel.  Pass it on to the
  * local virtual interface via the helper.
  *
  * @param cls closure, NULL
- * @param tunnel connection to the other end
- * @param tunnel_ctx pointer to our 'struct TunnelState *'
- * @param sender who sent the message
+ * @param channel connection to the other end
+ * @param channel_ctx pointer to our 'struct ChannelState *'
  * @param message the actual message
- * @param atsi performance data for the connection
- * @return GNUNET_OK to keep the connection open,
- *         GNUNET_SYSERR to close it (signal serious error)
- */ 
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
 static int
-receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-                  void **tunnel_ctx, const struct GNUNET_PeerIdentity *sender,
-                  const struct GNUNET_MessageHeader *message,
-                  const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+receive_icmp_back (void *cls,
+                  struct GNUNET_MESH_Channel *channel,
+                  void **channel_ctx,
+                  const struct GNUNET_MessageHeader *message)
 {
-  struct TunnelState *ts = *tunnel_ctx;
+  struct ChannelState *ts = *channel_ctx;
   const struct GNUNET_EXIT_IcmpToVPNMessage *i2v;
   size_t mlen;
 
@@ -1722,7 +1726,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
     char sbuf[INET6_ADDRSTRLEN];
     char dbuf[INET6_ADDRSTRLEN];
-    
+
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ICMP packet from mesh, sending %u bytes from %s -> %s via TUN\n",
                (unsigned int) mlen,
@@ -1733,8 +1737,8 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
   case AF_INET:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv4Header) 
-       + sizeof (struct GNUNET_TUN_IcmpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+       + sizeof (struct GNUNET_TUN_IcmpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -1758,12 +1762,12 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
        memcpy (&icmp[1],
                &i2v[1],
                mlen);
-       /* For some ICMP types, we need to adjust (make up) the payload here. 
-          Also, depending on the AF used on the other side, we have to 
+       /* For some ICMP types, we need to adjust (make up) the payload here.
+          Also, depending on the AF used on the other side, we have to
           do ICMP PT (translate ICMP types) */
        switch (ntohl (i2v->af))
        {
-       case AF_INET:     
+       case AF_INET:
          switch (icmp->type)
          {
          case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
@@ -1771,11 +1775,11 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
            break;
          case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
          case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
-         case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:         
+         case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
            {
              struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -1805,7 +1809,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
            {
              struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -1822,7 +1826,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
            {
              struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -1858,7 +1862,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
        default:
          GNUNET_break_op (0);
          return GNUNET_SYSERR;
-       }       
+       }
        msg->size = htons (size);
        GNUNET_TUN_calculate_icmp_checksum (icmp,
                                            &i2v[1],
@@ -1872,8 +1876,8 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
     break;
   case AF_INET6:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv6Header) 
-       + sizeof (struct GNUNET_TUN_IcmpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+       + sizeof (struct GNUNET_TUN_IcmpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -1896,12 +1900,12 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
                &i2v[1],
                mlen);
 
-       /* For some ICMP types, we need to adjust (make up) the payload here. 
-          Also, depending on the AF used on the other side, we have to 
+       /* For some ICMP types, we need to adjust (make up) the payload here.
+          Also, depending on the AF used on the other side, we have to
           do ICMP PT (translate ICMP types) */
        switch (ntohl (i2v->af))
        {
-       case AF_INET:     
+       case AF_INET:
          /* ICMP PT 4-to-6 and possibly making up payloads */
          switch (icmp->type)
          {
@@ -1916,7 +1920,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
            {
              struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -1928,12 +1932,12 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
              make_up_icmpv6_payload (ts, ipp, udp);
            }
            break;
-         case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:         
+         case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
            icmp->type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
            {
              struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -1948,7 +1952,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
          case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
            GNUNET_STATISTICS_update (stats,
                                      gettext_noop ("# ICMPv4 packets dropped (impossible PT to v6)"),
-                                     1, GNUNET_NO);        
+                                     1, GNUNET_NO);
            return GNUNET_OK;
          default:
            GNUNET_break_op (0);
@@ -1969,7 +1973,7 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
            {
              struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
              struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
-             
+
              if (mlen != 0)
                {
                  /* sender did not strip ICMP payload? */
@@ -2009,33 +2013,31 @@ receive_icmp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   default:
     GNUNET_assert (0);
   }
-  GNUNET_CONTAINER_heap_update_cost (tunnel_heap, 
+  GNUNET_CONTAINER_heap_update_cost (channel_heap,
                                     ts->heap_node,
-                                    GNUNET_TIME_absolute_get ().abs_value);
+                                    GNUNET_TIME_absolute_get ().abs_value_us);
   return GNUNET_OK;
 }
 
 
 /**
- * We got a UDP packet back from the MESH tunnel.  Pass it on to the
+ * We got a UDP packet back from the MESH channel.  Pass it on to the
  * local virtual interface via the helper.
  *
  * @param cls closure, NULL
- * @param tunnel connection to the other end
- * @param tunnel_ctx pointer to our 'struct TunnelState *'
- * @param sender who sent the message
+ * @param channel connection to the other end
+ * @param channel_ctx pointer to our 'struct ChannelState *'
  * @param message the actual message
- * @param atsi performance data for the connection
- * @return GNUNET_OK to keep the connection open,
- *         GNUNET_SYSERR to close it (signal serious error)
- */ 
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
 static int
-receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-                  void **tunnel_ctx, const struct GNUNET_PeerIdentity *sender,
-                  const struct GNUNET_MessageHeader *message,
-                  const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+receive_udp_back (void *cls,
+                 struct GNUNET_MESH_Channel *channel,
+                  void **channel_ctx,
+                  const struct GNUNET_MessageHeader *message)
 {
-  struct TunnelState *ts = *tunnel_ctx;
+  struct ChannelState *ts = *channel_ctx;
   const struct GNUNET_EXIT_UdpReplyMessage *reply;
   size_t mlen;
 
@@ -2063,7 +2065,7 @@ receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
     char sbuf[INET6_ADDRSTRLEN];
     char dbuf[INET6_ADDRSTRLEN];
-    
+
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received UDP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
                (unsigned int) mlen,
@@ -2076,8 +2078,8 @@ receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
   case AF_INET:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv4Header) 
-       + sizeof (struct GNUNET_TUN_UdpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+       + sizeof (struct GNUNET_TUN_UdpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -2121,8 +2123,8 @@ receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
     break;
   case AF_INET6:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv6Header) 
-       + sizeof (struct GNUNET_TUN_UdpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+       + sizeof (struct GNUNET_TUN_UdpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -2166,34 +2168,31 @@ receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   default:
     GNUNET_assert (0);
   }
-  GNUNET_CONTAINER_heap_update_cost (tunnel_heap, 
+  GNUNET_CONTAINER_heap_update_cost (channel_heap,
                                     ts->heap_node,
-                                    GNUNET_TIME_absolute_get ().abs_value);
+                                    GNUNET_TIME_absolute_get ().abs_value_us);
   return GNUNET_OK;
 }
 
 
 /**
- * We got a TCP packet back from the MESH tunnel.  Pass it on to the
+ * We got a TCP packet back from the MESH channel.  Pass it on to the
  * local virtual interface via the helper.
  *
  * @param cls closure, NULL
- * @param tunnel connection to the other end
- * @param tunnel_ctx pointer to our 'struct TunnelState *'
- * @param sender who sent the message
+ * @param channel connection to the other end
+ * @param channel_ctx pointer to our `struct ChannelState *`
  * @param message the actual message
- * @param atsi performance data for the connection
- * @return GNUNET_OK to keep the connection open,
- *         GNUNET_SYSERR to close it (signal serious error)
- */ 
+ * @return #GNUNET_OK to keep the connection open,
+ *         #GNUNET_SYSERR to close it (signal serious error)
+ */
 static int
-receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-                  void **tunnel_ctx,
-                  const struct GNUNET_PeerIdentity *sender GNUNET_UNUSED,
-                  const struct GNUNET_MessageHeader *message,
-                  const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+receive_tcp_back (void *cls,
+                 struct GNUNET_MESH_Channel *channel,
+                  void **channel_ctx,
+                  const struct GNUNET_MessageHeader *message)
 {
-  struct TunnelState *ts = *tunnel_ctx;
+  struct ChannelState *ts = *channel_ctx;
   const struct GNUNET_EXIT_TcpDataMessage *data;
   size_t mlen;
 
@@ -2216,7 +2215,7 @@ receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
     char sbuf[INET6_ADDRSTRLEN];
     char dbuf[INET6_ADDRSTRLEN];
-    
+
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received TCP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
                (unsigned int) mlen,
@@ -2234,8 +2233,8 @@ receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
   {
   case AF_INET:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv4Header) 
-       + sizeof (struct GNUNET_TUN_TcpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+       + sizeof (struct GNUNET_TUN_TcpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -2273,8 +2272,8 @@ receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
     break;
   case AF_INET6:
     {
-      size_t size = sizeof (struct GNUNET_TUN_IPv6Header) 
-       + sizeof (struct GNUNET_TUN_TcpHeader) 
+      size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+       + sizeof (struct GNUNET_TUN_TcpHeader)
        + sizeof (struct GNUNET_MessageHeader) +
        sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
        mlen;
@@ -2311,20 +2310,20 @@ receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
     }
     break;
   }
-  GNUNET_CONTAINER_heap_update_cost (tunnel_heap, 
+  GNUNET_CONTAINER_heap_update_cost (channel_heap,
                                     ts->heap_node,
-                                    GNUNET_TIME_absolute_get ().abs_value);
+                                    GNUNET_TIME_absolute_get ().abs_value_us);
   return GNUNET_OK;
 }
 
 
 /**
- * Allocate an IPv4 address from the range of the tunnel
+ * Allocate an IPv4 address from the range of the channel
  * for a new redirection.
  *
  * @param v4 where to store the address
- * @return GNUNET_OK on success,
- *         GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_SYSERR on error
  */
 static int
 allocate_v4_address (struct in_addr *v4)
@@ -2338,10 +2337,10 @@ allocate_v4_address (struct in_addr *v4)
   unsigned int tries;
 
   GNUNET_assert (1 == inet_pton (AF_INET, ipv4addr, &addr));
-  GNUNET_assert (1 == inet_pton (AF_INET, ipv4mask, &mask));           
-  /* Given 192.168.0.1/255.255.0.0, we want a mask 
+  GNUNET_assert (1 == inet_pton (AF_INET, ipv4mask, &mask));
+  /* Given 192.168.0.1/255.255.0.0, we want a mask
      of '192.168.255.255', thus:  */
-  mask.s_addr = addr.s_addr | ~mask.s_addr;  
+  mask.s_addr = addr.s_addr | ~mask.s_addr;
   tries = 0;
   do
     {
@@ -2353,9 +2352,9 @@ allocate_v4_address (struct in_addr *v4)
        return GNUNET_SYSERR;
       }
       /* Pick random IPv4 address within the subnet, except 'addr' or 'mask' itself */
-      rnd.s_addr = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 
-                                            UINT32_MAX);       
-      v4->s_addr = (addr.s_addr | rnd.s_addr) & mask.s_addr;          
+      rnd.s_addr = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                            UINT32_MAX);
+      v4->s_addr = (addr.s_addr | rnd.s_addr) & mask.s_addr;
       get_destination_key_from_ip (AF_INET,
                                   v4,
                                   &key);
@@ -2370,12 +2369,12 @@ allocate_v4_address (struct in_addr *v4)
 
 
 /**
- * Allocate an IPv6 address from the range of the tunnel
+ * Allocate an IPv6 address from the range of the channel
  * for a new redirection.
  *
  * @param v6 where to store the address
- * @return GNUNET_OK on success,
- *         GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_SYSERR on error
  */
 static int
 allocate_v6_address (struct in6_addr *v6)
@@ -2395,7 +2394,7 @@ allocate_v6_address (struct in6_addr *v6)
   mask = addr;
   for (i=127;i>=ipv6prefix;i--)
     mask.s6_addr[i / 8] |= (1 << (i % 8));
-  
+
   /* Pick random IPv6 address within the subnet, except 'addr' or 'mask' itself */
   tries = 0;
   do
@@ -2410,7 +2409,7 @@ allocate_v6_address (struct in6_addr *v6)
        }
       for (i=0;i<16;i++)
        {
-         rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 
+         rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
                                                                     256);
          v6->s6_addr[i]
            = (addr.s6_addr[i] | rnd.s6_addr[i]) & mask.s6_addr[i];
@@ -2440,20 +2439,29 @@ allocate_v6_address (struct in6_addr *v6)
 static void
 free_destination_entry (struct DestinationEntry *de)
 {
+  struct DestinationChannel *dt;
+
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Cleaning up destination entry\n");
   GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Active destinations"),
                            -1, GNUNET_NO);
-  if (NULL != de->ts)
+  while (NULL != (dt = de->dt_head))
   {
-    free_tunnel_state (de->ts);
-    GNUNET_assert (NULL == de->ts);
+    GNUNET_CONTAINER_DLL_remove (de->dt_head,
+                                de->dt_tail,
+                                dt);
+    if (NULL != dt->ts)
+    {
+      free_channel_state (dt->ts);
+      GNUNET_assert (NULL == dt->ts);
+    }
+    GNUNET_free (dt);
   }
   if (NULL != de->heap_node)
   {
     GNUNET_CONTAINER_heap_remove_node (de->heap_node);
-    de->heap_node = NULL;  
+    de->heap_node = NULL;
     GNUNET_assert (GNUNET_YES ==
                   GNUNET_CONTAINER_multihashmap_remove (destination_map,
                                                         &de->key,
@@ -2468,7 +2476,7 @@ free_destination_entry (struct DestinationEntry *de)
  *
  * @param except destination that must NOT be cleaned up, even if it is the oldest
  */
-static void 
+static void
 expire_destination (struct DestinationEntry *except)
 {
   struct DestinationEntry *de;
@@ -2482,17 +2490,17 @@ expire_destination (struct DestinationEntry *except)
 
 
 /**
- * Allocate an IP address for the response.  
+ * Allocate an IP address for the response.
  *
  * @param result_af desired address family; set to the actual
  *        address family; can initially be AF_UNSPEC if there
  *        is no preference; will be set to AF_UNSPEC if the
  *        allocation failed
- * @param addr set to either v4 or v6 depending on which 
+ * @param addr set to either v4 or v6 depending on which
  *         storage location was used; set to NULL if allocation failed
  * @param v4 storage space for an IPv4 address
  * @param v6 storage space for an IPv6 address
- * @return GNUNET_OK normally, GNUNET_SYSERR if '*result_af' was
+ * @return #GNUNET_OK normally, #GNUNET_SYSERR if `* result_af` was
  *         an unsupported address family (not AF_INET, AF_INET6 or AF_UNSPEC)
  */
 static int
@@ -2537,20 +2545,21 @@ allocate_response_ip (int *result_af,
     return GNUNET_SYSERR;
   }
   return GNUNET_OK;
-}                    
+}
 
 
 /**
- * A client asks us to setup a redirection via some exit
- * node to a particular IP.  Setup the redirection and
- * give the client the allocated IP.
+ * A client asks us to setup a redirection via some exit node to a
+ * particular IP.  Setup the redirection and give the client the
+ * allocated IP.
  *
  * @param cls unused
  * @param client requesting client
- * @param message redirection request (a 'struct RedirectToIpRequestMessage')
+ * @param message redirection request (a `struct RedirectToIpRequestMessage`)
  */
 static void
-service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+service_redirect_to_ip (void *cls,
+                       struct GNUNET_SERVER_Client *client,
                        const struct GNUNET_MessageHeader *message)
 {
   size_t mlen;
@@ -2563,8 +2572,7 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
   void *addr;
   struct DestinationEntry *de;
   struct GNUNET_HashCode key;
-  struct TunnelState *ts;
-  
+
   /* validate and parse request */
   mlen = ntohs (message->size);
   if (mlen < sizeof (struct RedirectToIpRequestMessage))
@@ -2583,7 +2591,7 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
     {
       GNUNET_break (0);
       GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-      return;      
+      return;
     }
     break;
   case AF_INET6:
@@ -2591,13 +2599,13 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
     {
       GNUNET_break (0);
       GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-      return;      
+      return;
     }
     break;
   default:
     GNUNET_break (0);
     GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    return;      
+    return;
   }
 
   /* allocate response IP */
@@ -2607,17 +2615,13 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
                                         &v4, &v6))
   {
     GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    return;      
-  }
-  if ( (result_af == AF_UNSPEC) ||
-       (GNUNET_NO == ntohl (msg->nac)) )
-  {
-    /* send reply "instantly" */
-    send_client_reply (client,
-                      msg->request_id,
-                      result_af,
-                      addr);
+    return;
   }
+  /* send reply with our IP address */
+  send_client_reply (client,
+                    msg->request_id,
+                    result_af,
+                    addr);
   if (result_af == AF_UNSPEC)
   {
     /* failure, we're done */
@@ -2628,16 +2632,16 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
   {
     char sbuf[INET6_ADDRSTRLEN];
     char dbuf[INET6_ADDRSTRLEN];
-    
+
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Allocated address %s for redirection via exit to %s\n",
                inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
                inet_ntop (addr_af,
                           &msg[1], dbuf, sizeof (dbuf)));
   }
-  
+
   /* setup destination record */
-  de = GNUNET_malloc (sizeof (struct DestinationEntry));
+  de = GNUNET_new (struct DestinationEntry);
   de->is_service = GNUNET_NO;
   de->details.exit_destination.af = addr_af;
   memcpy (&de->details.exit_destination.ip,
@@ -2654,30 +2658,12 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
   de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
                                                de,
-                                               GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
+                                               GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value_us);
   GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Active destinations"),
                            1, GNUNET_NO);
   while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
     expire_destination (de);
-  
-  /* setup tunnel to destination */
-  ts = create_tunnel_to_destination (de, 
-                                    (GNUNET_NO == ntohl (msg->nac)) ? NULL : client,
-                                    result_af,
-                                    msg->request_id);
-  switch (result_af)
-  {
-  case AF_INET:
-    ts->destination_ip.v4 = v4;
-    break;
-  case AF_INET6:
-    ts->destination_ip.v6 = v6;
-    break;
-  default:
-    GNUNET_assert (0);
-  }
-  /* we're done */
   GNUNET_SERVER_receive_done (client, GNUNET_OK);
 }
 
@@ -2689,10 +2675,11 @@ service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *cl
  *
  * @param cls unused
  * @param client requesting client
- * @param message redirection request (a 'struct RedirectToPeerRequestMessage')
+ * @param message redirection request (a `struct RedirectToPeerRequestMessage`)
  */
 static void
-service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+service_redirect_to_service (void *cls,
+                            struct GNUNET_SERVER_Client *client,
                             const struct GNUNET_MessageHeader *message)
 {
   const struct RedirectToServiceRequestMessage *msg;
@@ -2702,8 +2689,9 @@ service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Clien
   void *addr;
   struct DestinationEntry *de;
   struct GNUNET_HashCode key;
-  struct TunnelState *ts;
-  
+  struct ChannelState *ts;
+  struct DestinationChannel *dt;
+
   /*  parse request */
   msg = (const struct RedirectToServiceRequestMessage *) message;
 
@@ -2714,17 +2702,12 @@ service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Clien
                                         &v4, &v6))
   {
     GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    return;      
-  }
-  if ( (result_af == AF_UNSPEC) ||
-       (GNUNET_NO == ntohl (msg->nac)) )
-  {
-    /* send reply "instantly" */
-    send_client_reply (client,
-                      msg->request_id,
-                      result_af,
-                      addr);
+    return;
   }
+  send_client_reply (client,
+                    msg->request_id,
+                    result_af,
+                    addr);
   if (result_af == AF_UNSPEC)
   {
     /* failure, we're done */
@@ -2736,16 +2719,16 @@ service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Clien
 
   {
     char sbuf[INET6_ADDRSTRLEN];
-    
+
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Allocated address %s for redirection to service %s on peer %s\n",
                inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
                GNUNET_h2s (&msg->service_descriptor),
                GNUNET_i2s (&msg->target));
   }
-  
+
   /* setup destination record */
-  de = GNUNET_malloc (sizeof (struct DestinationEntry));
+  de = GNUNET_new (struct DestinationEntry);
   de->is_service = GNUNET_YES;
   de->details.service_destination.service_descriptor = msg->service_descriptor;
   de->details.service_destination.target = msg->target;
@@ -2760,13 +2743,17 @@ service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Clien
                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
   de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
                                                de,
-                                               GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
+                                               GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value_us);
   while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
     expire_destination (de);
-  ts = create_tunnel_to_destination (de,
-                                    (GNUNET_NO == ntohl (msg->nac)) ? NULL : client,
-                                    result_af,
-                                    msg->request_id);
+
+  dt = GNUNET_new (struct DestinationChannel);
+  dt->destination = de;
+  GNUNET_CONTAINER_DLL_insert (de->dt_head,
+                              de->dt_tail,
+                              dt);
+  ts = create_channel_to_destination (dt,
+                                    result_af);
   switch (result_af)
   {
   case AF_INET:
@@ -2783,43 +2770,24 @@ service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Clien
 }
 
 
-
 /**
- * Function called for inbound tunnels.  As we don't offer
- * any mesh services, this function should never be called.
- *
- * @param cls closure
- * @param tunnel new handle to the tunnel
- * @param initiator peer that started the tunnel
- * @param atsi performance information for the tunnel
- * @return initial tunnel context for the tunnel
- *         (can be NULL -- that's not an error)
- */ 
-static void *
-inbound_tunnel_cb (void *cls, struct GNUNET_MESH_Tunnel *tunnel,
-                  const struct GNUNET_PeerIdentity *initiator,
-                  const struct GNUNET_ATS_Information *atsi)
-{
-  /* How can and why should anyone open an inbound tunnel to vpn? */
-  GNUNET_break (0);
-  return NULL;
-}
-
-
-/**
- * Function called whenever an inbound tunnel is destroyed.  Should clean up
+ * Function called whenever a channel is destroyed.  Should clean up
  * any associated state.
  *
- * @param cls closure (set from GNUNET_MESH_connect)
- * @param tunnel connection to the other end (henceforth invalid)
- * @param tunnel_ctx place where local state associated
- *                   with the tunnel is stored (our 'struct TunnelState')
- */ 
+ * @param cls closure (set from #GNUNET_MESH_connect)
+ * @param channel connection to the other end (henceforth invalid)
+ * @param channel_ctx place where local state associated
+ *                   with the channel is stored (our `struct ChannelState`)
+ */
 static void
-tunnel_cleaner (void *cls, const struct GNUNET_MESH_Tunnel *tunnel, void *tunnel_ctx)
+channel_cleaner (void *cls,
+               const struct GNUNET_MESH_Channel *channel,
+               void *channel_ctx)
 {
-  /* we don't have inbound tunnels, so this function should never be called */
-  GNUNET_break (0);
+  struct ChannelState *ts = channel_ctx;
+
+  ts->channel = NULL; /* we must not call GNUNET_MESH_channel_destroy() anymore */
+  free_channel_state (ts);
 }
 
 
@@ -2828,8 +2796,8 @@ tunnel_cleaner (void *cls, const struct GNUNET_MESH_Tunnel *tunnel, void *tunnel
  *
  * @param cls unused
  * @param key unused
- * @param value a 'struct DestinationEntry *'
- * @return GNUNET_OK (continue to iterate)
+ * @param value a `struct DestinationEntry *`
+ * @return #GNUNET_OK (continue to iterate)
  */
 static int
 cleanup_destination (void *cls,
@@ -2844,21 +2812,21 @@ cleanup_destination (void *cls,
 
 
 /**
- * Free memory occupied by an entry in the tunnel map.
+ * Free memory occupied by an entry in the channel map.
  *
  * @param cls unused
  * @param key unused
- * @param value a 'struct TunnelState *'
- * @return GNUNET_OK (continue to iterate)
+ * @param value a `struct ChannelState *`
+ * @return #GNUNET_OK (continue to iterate)
  */
 static int
-cleanup_tunnel (void *cls,
+cleanup_channel (void *cls,
                const struct GNUNET_HashCode *key,
                void *value)
 {
-  struct TunnelState *ts = value;
+  struct ChannelState *ts = value;
 
-  free_tunnel_state (ts);
+  free_channel_state (ts);
   return GNUNET_OK;
 }
 
@@ -2870,7 +2838,7 @@ cleanup_tunnel (void *cls,
  * @param tc unused
  */
 static void
-cleanup (void *cls GNUNET_UNUSED,
+cleanup (void *cls,
          const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
   unsigned int i;
@@ -2878,7 +2846,7 @@ cleanup (void *cls GNUNET_UNUSED,
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "VPN is shutting down\n");
   if (NULL != destination_map)
-  {  
+  {
     GNUNET_CONTAINER_multihashmap_iterate (destination_map,
                                           &cleanup_destination,
                                           NULL);
@@ -2890,18 +2858,18 @@ cleanup (void *cls GNUNET_UNUSED,
     GNUNET_CONTAINER_heap_destroy (destination_heap);
     destination_heap = NULL;
   }
-  if (NULL != tunnel_map)
-  {  
-    GNUNET_CONTAINER_multihashmap_iterate (tunnel_map,
-                                          &cleanup_tunnel,
+  if (NULL != channel_map)
+  {
+    GNUNET_CONTAINER_multihashmap_iterate (channel_map,
+                                          &cleanup_channel,
                                           NULL);
-    GNUNET_CONTAINER_multihashmap_destroy (tunnel_map);
-    tunnel_map = NULL;
+    GNUNET_CONTAINER_multihashmap_destroy (channel_map);
+    channel_map = NULL;
   }
-  if (NULL != tunnel_heap)
+  if (NULL != channel_heap)
   {
-    GNUNET_CONTAINER_heap_destroy (tunnel_heap);
-    tunnel_heap = NULL;
+    GNUNET_CONTAINER_heap_destroy (channel_heap);
+    channel_heap = NULL;
   }
   if (NULL != mesh_handle)
   {
@@ -2909,8 +2877,8 @@ cleanup (void *cls GNUNET_UNUSED,
     mesh_handle = NULL;
   }
   if (NULL != helper_handle)
-    {
-    GNUNET_HELPER_stop (helper_handle);
+  {
+    GNUNET_HELPER_stop (helper_handle, GNUNET_NO);
     helper_handle = NULL;
   }
   if (NULL != nc)
@@ -2918,7 +2886,7 @@ cleanup (void *cls GNUNET_UNUSED,
     GNUNET_SERVER_notification_context_destroy (nc);
     nc = NULL;
   }
-  if (stats != NULL)
+  if (NULL != stats)
   {
     GNUNET_STATISTICS_destroy (stats, GNUNET_NO);
     stats = NULL;
@@ -2928,105 +2896,6 @@ cleanup (void *cls GNUNET_UNUSED,
 }
 
 
-/**
- * A client disconnected, clean up all references to it.
- *
- * @param cls the client that disconnected
- * @param key unused
- * @param value a 'struct TunnelState *'
- * @return GNUNET_OK (continue to iterate)
- */
-static int
-cleanup_tunnel_client (void *cls,
-                      const struct GNUNET_HashCode *key,
-                      void *value)
-{
-  struct GNUNET_SERVER_Client *client = cls;
-  struct TunnelState *ts = value;
-
-  if (client == ts->client)
-  {
-    GNUNET_SERVER_client_drop (ts->client);
-    ts->client = NULL;
-  }
-  return GNUNET_OK;
-}
-
-
-/**
- * A client disconnected, clean up all references to it.
- *
- * @param cls the client that disconnected
- * @param key unused
- * @param value a 'struct DestinationEntry *'
- * @return GNUNET_OK (continue to iterate)
- */
-static int
-cleanup_destination_client (void *cls,
-                           const struct GNUNET_HashCode *key,
-                           void *value)
-{
-  struct GNUNET_SERVER_Client *client = cls;
-  struct DestinationEntry *de = value;
-  struct TunnelState *ts;
-
-  if (NULL == (ts = de->ts))
-    return GNUNET_OK;
-  if (client == ts->client)
-  {
-    GNUNET_SERVER_client_drop (ts->client);
-    ts->client = NULL;
-  }
-  return GNUNET_OK;
-}
-
-  
-/**
- * A client has disconnected from us.  If we are currently building
- * a tunnel for it, cancel the operation.
- *
- * @param cls unused
- * @param client handle to the client that disconnected
- */
-static void
-client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
-{
-  if (NULL != tunnel_map)
-    GNUNET_CONTAINER_multihashmap_iterate (tunnel_map,
-                                          &cleanup_tunnel_client,
-                                          client);
-  if (NULL != destination_map)
-    GNUNET_CONTAINER_multihashmap_iterate (destination_map,
-                                          &cleanup_destination_client,
-                                          client);
-}
-
-
-/**
- * Test if the given AF is supported by this system.
- * 
- * @param af to test
- * @return GNUNET_OK if the AF is supported
- */
-static int
-test_af (int af)
-{
-  int s;
-
-  s = socket (af, SOCK_STREAM, 0);
-  if (-1 == s)
-  {
-    if (EAFNOSUPPORT == errno)
-      return GNUNET_NO;
-    GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
-                        "socket");
-    return GNUNET_SYSERR;
-  }
-  (void) close (s);
-  return GNUNET_OK;
-}
-
-
 /**
  * Main function that will be run by the scheduler.
  *
@@ -3042,8 +2911,8 @@ run (void *cls,
   static const struct GNUNET_SERVER_MessageHandler service_handlers[] = {
     /* callback, cls, type, size */
     { &service_redirect_to_ip, NULL, GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_IP, 0},
-    { &service_redirect_to_service, NULL, 
-     GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_SERVICE, 
+    { &service_redirect_to_service, NULL,
+     GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_SERVICE,
      sizeof (struct RedirectToServiceRequestMessage) },
     {NULL, NULL, 0, 0}
   };
@@ -3053,9 +2922,6 @@ run (void *cls,
     { &receive_icmp_back, GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_VPN, 0},
     {NULL, 0, 0}
   };
-  static const GNUNET_MESH_ApplicationType types[] = {
-    GNUNET_APPLICATION_TYPE_END
-  };
   char *ifname;
   char *ipv6addr;
   char *ipv6prefix_s;
@@ -3063,72 +2929,81 @@ run (void *cls,
   char *ipv4mask;
   struct in_addr v4;
   struct in6_addr v6;
+  char *binary;
+
+  binary = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-vpn");
 
   if (GNUNET_YES !=
-      GNUNET_OS_check_helper_binary ("gnunet-helper-vpn"))
+      GNUNET_OS_check_helper_binary (binary, GNUNET_YES, "-d gnunet-vpn - - 169.1.3.3.7 255.255.255.0")) //ipv4 only please!
   {
     fprintf (stderr,
             "`%s' is not SUID, refusing to run.\n",
             "gnunet-helper-vpn");
+    GNUNET_free (binary);
     global_ret = 1;
     return;
   }
+  GNUNET_free (binary);
   cfg = cfg_;
   stats = GNUNET_STATISTICS_create ("vpn", cfg);
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_MAPPING",
+      GNUNET_CONFIGURATION_get_value_number (cfg, "VPN", "MAX_MAPPING",
                                             &max_destination_mappings))
     max_destination_mappings = 200;
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_TUNNELS",
-                                            &max_tunnel_mappings))
-    max_tunnel_mappings = 200;
+      GNUNET_CONFIGURATION_get_value_number (cfg, "VPN", "MAX_TUNNELS",
+                                            &max_channel_mappings))
+    max_channel_mappings = 200;
 
-  destination_map = GNUNET_CONTAINER_multihashmap_create (max_destination_mappings * 2);
+  destination_map = GNUNET_CONTAINER_multihashmap_create (max_destination_mappings * 2, GNUNET_NO);
   destination_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-  tunnel_map = GNUNET_CONTAINER_multihashmap_create (max_tunnel_mappings * 2);
-  tunnel_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+  channel_map = GNUNET_CONTAINER_multihashmap_create (max_channel_mappings * 2, GNUNET_NO);
+  channel_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
 
 
   vpn_argv[0] = GNUNET_strdup ("vpn-gnunet");
   if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IFNAME", &ifname))
+      GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IFNAME", &ifname))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IFNAME' in configuration!\n");
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "VPN", "IFNAME");
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
   vpn_argv[1] = ifname;
-  if (GNUNET_OK == test_af (AF_INET6))
+  ipv6addr = NULL;
+  if (GNUNET_OK == GNUNET_NETWORK_test_pf (PF_INET6))
   {
     if ( (GNUNET_SYSERR ==
-         GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6ADDR",
+         GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IPV6ADDR",
                                                 &ipv6addr) ||
          (1 != inet_pton (AF_INET6, ipv6addr, &v6))) )
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 "No valid entry 'IPV6ADDR' in configuration!\n");
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV6ADDR",
+                                _("Must specify valid IPv6 address"));
       GNUNET_SCHEDULER_shutdown ();
+      GNUNET_free_non_null (ipv6addr);
       return;
     }
     vpn_argv[2] = ipv6addr;
+    ipv6prefix_s = NULL;
     if (GNUNET_SYSERR ==
-       GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6PREFIX",
+       GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IPV6PREFIX",
                                               &ipv6prefix_s))
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 "No entry 'IPV6PREFIX' in configuration!\n");
+      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV6PREFIX");
       GNUNET_SCHEDULER_shutdown ();
+      GNUNET_free_non_null (ipv6prefix_s);
       return;
     }
     vpn_argv[3] = ipv6prefix_s;
     if ( (GNUNET_OK !=
-         GNUNET_CONFIGURATION_get_value_number (cfg, "vpn",
+         GNUNET_CONFIGURATION_get_value_number (cfg, "VPN",
                                                 "IPV6PREFIX",
                                                 &ipv6prefix)) ||
         (ipv6prefix >= 127) )
     {
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4MASK",
+                                _("Must specify valid IPv6 mask"));
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
@@ -3140,27 +3015,31 @@ run (void *cls,
     vpn_argv[2] = GNUNET_strdup ("-");
     vpn_argv[3] = GNUNET_strdup ("-");
   }
-  if (GNUNET_OK == test_af (AF_INET))
+  if (GNUNET_OK == GNUNET_NETWORK_test_pf (PF_INET))
   {
+    ipv4addr = NULL;
     if ( (GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4ADDR",
                                                 &ipv4addr) ||
          (1 != inet_pton (AF_INET, ipv4addr, &v4))) )
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 "No valid entry for 'IPV4ADDR' in configuration!\n");
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4ADDR",
+                                _("Must specify valid IPv4 address"));
       GNUNET_SCHEDULER_shutdown ();
+      GNUNET_free_non_null (ipv4addr);
       return;
     }
     vpn_argv[4] = ipv4addr;
+    ipv4mask = NULL;
     if ( (GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4MASK",
                                                 &ipv4mask) ||
          (1 != inet_pton (AF_INET, ipv4mask, &v4))) )
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                 "No valid entry 'IPV4MASK' in configuration!\n");
+      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4MASK",
+                                _("Must specify valid IPv4 mask"));
       GNUNET_SCHEDULER_shutdown ();
+      GNUNET_free_non_null (ipv4mask);
       return;
     }
     vpn_argv[5] = ipv4mask;
@@ -3175,17 +3054,16 @@ run (void *cls,
   vpn_argv[6] = NULL;
 
   mesh_handle =
-    GNUNET_MESH_connect (cfg_, NULL, 
-                        &inbound_tunnel_cb, 
-                        &tunnel_cleaner, 
+    GNUNET_MESH_connect (cfg_, NULL,
+                        NULL,
+                        &channel_cleaner,
                         mesh_handlers,
-                        types);
+                        NULL);
   helper_handle = GNUNET_HELPER_start (GNUNET_NO,
                                       "gnunet-helper-vpn", vpn_argv,
                                       &message_token, NULL, NULL);
   nc = GNUNET_SERVER_notification_context_create (server, 1);
   GNUNET_SERVER_add_handlers (server, service_handlers);
-  GNUNET_SERVER_disconnect_notify (server, &client_disconnect, NULL);
   GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup, cls);
 }
 
@@ -3201,7 +3079,7 @@ int
 main (int argc, char *const *argv)
 {
   return (GNUNET_OK ==
-          GNUNET_SERVICE_run (argc, argv, "vpn", 
+          GNUNET_SERVICE_run (argc, argv, "vpn",
                              GNUNET_SERVICE_OPTION_NONE,
                               &run, NULL)) ? global_ret : 1;
 }